docs(release): record Browser v12 production
This commit is contained in:
AAA authored and GitHub committed
1 parent
928068fb01
commit
1ed8af0f61
10 files changed
+90
-90
No files matched your search
@@ -2,9 +2,9 @@
|
||||
|
||||
Screener is a private, low-latency screen-sharing project for one game player and a small group of friends. Its accepted media target is WebRTC P2P-first, with a dedicated LiveKit SFU/UDP virtual parent feeding only the necessary roots when direct/STUN peer paths cannot serve them. Roots continue distributing to bounded peer descendants; this is not an always-SFU conferencing design. Viewers should be able to join from a desktop or mobile browser without installing the sender application.
|
||||
|
||||
The first measurable Web proof of concept is implemented. A host captures a screen, window, or browser tab and shares a random four-digit room code plus an independent fragment invitation. During a share, the host can change between three ceiling profiles without reopening the source picker, pause, and switch sources. Browser video is fixed VP8 and leaves the video content hint unset. Code-only entry defaults to `open` after site access and may instead require a room password or be disabled; a valid grant enters directly. Rooms are process-memory state with a configurable dormant lease and disappear on restart. Lightweight deployments may keep independent direct WebRTC connections. The flagship deployment enables the all-room controller with bounded peer descendants and one LiveKit Host publication serving admitted Viewer subscriptions. Production admits 20 viewers; that admission limit is not a performance promise.
|
||||
The first measurable Web proof of concept is implemented. A host captures a screen, window, or browser tab and shares a random four-digit room code plus an independent fragment invitation. During a share, the host can change between three ceiling profiles without reopening the source picker, pause, and switch sources. Browser video is fixed VP8 and leaves the video content hint unset. Code-only entry defaults to `open` after site access; the only other state is `private`, which is invitation-only without a room password and also permits matching code-and-password entry when one is configured. A valid grant enters directly in either state. Rooms are process-memory state with a configurable dormant lease and disappear on restart. Lightweight deployments may keep independent direct WebRTC connections. The flagship deployment enables the all-room controller with bounded peer descendants and one LiveKit Host publication serving admitted Viewer subscriptions. Production admits 20 viewers; that admission limit is not a performance promise.
|
||||
|
||||
This is not yet a broadly validated product release; [Current status](./docs/status.md) owns the deployed revision and validation evidence. The deployed flagship boundary is the all-room bounded peer/SFU-UDP controller plus the memory-resident room/access model on `screener-v11`, with ordinary peer ICE kept STUN-only and no TURN or TCP media route. The optional Windows native sender remains source-only and is not a production runtime. Mobile devices are Web viewers only; ordinary Android and iOS browsers do not expose reliable screen capture for a Web Host. Real cross-network SFU media, game audio, a sustained public-network 1:20 session, mobile browser lifecycle behavior, and latency targets still require the documented manual test matrix.
|
||||
This is not yet a broadly validated product release; [Current status](./docs/status.md) owns the deployed revision and validation evidence. The deployed flagship boundary is the all-room bounded peer/SFU-UDP controller plus the memory-resident room/access model on `screener-v12`, with ordinary peer ICE kept STUN-only and no TURN or TCP media route. The optional Windows native sender remains source-only and is not a production runtime. Mobile devices are Web viewers only; ordinary Android and iOS browsers do not expose reliable screen capture for a Web Host. Real cross-network SFU media, game audio, a sustained public-network 1:20 session, mobile browser lifecycle behavior, and latency targets still require the documented manual test matrix.
|
||||
|
||||
## Run locally
|
||||
|
||||
@@ -15,7 +15,7 @@ npm ci
|
||||
npm run dev
|
||||
```
|
||||
|
||||
Production requires an independent 8-128 byte visible-ASCII `SITE_ACCESS_PASSWORD`. It protects room creation, Host role, and code-only Viewer entry. A valid room-scoped fragment grant enters directly without it; otherwise code-only entry needs site access before the room's `open | password | disabled` policy is evaluated. Local development and tests may leave it empty.
|
||||
Production requires an independent 8-128 byte visible-ASCII `SITE_ACCESS_PASSWORD`. It protects room creation, Host role, and code-only Viewer entry. A valid room-scoped fragment grant enters directly without it; otherwise code-only entry needs site access before the room's `open | private` policy is evaluated. Local development and tests may leave it empty.
|
||||
|
||||
Open `http://localhost:8787`. The server listens on `0.0.0.0` by default so a
|
||||
phone on the same LAN can load `http://<computer-lan-ip>:8787`. To generate an
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
# ADR-0002: Memory-Resident Rooms And Scoped Viewer Access
|
||||
|
||||
- Status: Accepted; current source implements the strict v12 room model, while
|
||||
production remains exact release `c4962f5` on the older strict v11 contract
|
||||
- Status: Accepted and deployed in exact release `b68c471` on strict v12
|
||||
- Date: 2026-08-23
|
||||
|
||||
## Context
|
||||
@@ -171,12 +170,11 @@ the generic `SERVER_ERROR`. None of those paths is folded into
|
||||
|
||||
## Implementation Status
|
||||
|
||||
Current source uses the strict `screener-v12` wire and implements the
|
||||
Current source and production use the strict `screener-v12` wire and implement the
|
||||
22-character room-incarnation grant, exact digest validation, rotate/revoke,
|
||||
browser-storage privacy, `open | private` code entry, and the `ROOM_NOT_FOUND`
|
||||
split without a v11 parser. Production remains exact deployed revision
|
||||
`c4962f54443ad5f98bc65861195a3d9c74a48996`, release `c4962f5`, on strict
|
||||
`screener-v11`; the v12 source has not been deployed.
|
||||
split without a v11 parser. Production is exact deployed revision
|
||||
`b68c47167da592dd673a78ec3d072936ef49e3ea`, release `b68c471`.
|
||||
|
||||
Exact release and operational evidence remain owned by deployment and
|
||||
verification status.
|
||||
|
||||
@@ -1,12 +1,10 @@
|
||||
# ADR-0005: Automatic Hybrid Media Routing
|
||||
|
||||
- Status: The route model is accepted and deployed in exact release `c4962f5`,
|
||||
including Browser SFU ICE-server isolation and owner physical fallback proof;
|
||||
exact source `064db16c1b6d25fd24b7057b7e2fca172002e3c4` removes the product
|
||||
diagnostic-download UI for v12 while retaining the Host-only acceptance
|
||||
snapshot, but that source is not deployed.
|
||||
- Status: The route model is accepted and deployed in exact release `b68c471`
|
||||
on strict v12, including Browser SFU ICE-server isolation, no product
|
||||
diagnostic-download UI, and the retained Host-only acceptance snapshot.
|
||||
- Date: 2026-08-20
|
||||
- Last updated: 2026-08-24
|
||||
- Last updated: 2026-08-25
|
||||
|
||||
## Context
|
||||
|
||||
@@ -156,7 +154,7 @@ A `prepare` route update names that operation's exact child, route kind, and
|
||||
server-issued candidate connection identity. Parent and child therefore
|
||||
prepare the same connection; neither endpoint infers candidate authority from
|
||||
an assignment-list difference.
|
||||
The current Browser runtime contract uses the single `screener-v11` wire. On each WebSocket, the
|
||||
The current Browser runtime contract uses the single `screener-v12` wire. On each WebSocket, the
|
||||
server sends the exact prepare before its SFU configuration; the candidate child
|
||||
is queued before a peer parent is allowed to start its offer. WebSocket ordering
|
||||
is the companion-delivery contract, so clients keep no reordering inbox.
|
||||
@@ -363,13 +361,14 @@ deployment-wide.
|
||||
|
||||
## Current Source And Deployment Boundary
|
||||
|
||||
Production and canonical `main` run exact deployed application/runtime revision
|
||||
`c4962f54443ad5f98bc65861195a3d9c74a48996`, release `c4962f5`, including exact
|
||||
Production runs exact deployed application/runtime revision
|
||||
`b68c47167da592dd673a78ec3d072936ef49e3ea`, release `b68c471`; canonical `main`
|
||||
contains the same application/runtime tree plus the current truth checkpoint, including exact
|
||||
Browser SFU ICE-server-isolation implementation
|
||||
`ae09c760adec76fd26da611d4928486d105c6d3b`. Both run strict `screener-v11` and
|
||||
`ae09c760adec76fd26da611d4928486d105c6d3b`. Both run strict `screener-v12` and
|
||||
the direct/STUN peer plus LiveKit SFU/UDP route model. Browser SFU PCs use empty
|
||||
external ICE-server lists, and the owner physically verified fallback media
|
||||
after deployment. The operation owner remains only `route`. Exact operational
|
||||
external ICE-server lists. Owner physical fallback proof remains bounded to
|
||||
predecessor release `c4962f5`; the operation owner remains only `route`. Exact operational
|
||||
evidence is owned by the deployment document; broader heterogeneous-network,
|
||||
codec, and SFU lifecycle validation remains open.
|
||||
|
||||
|
||||
+27
-19
@@ -3,8 +3,8 @@
|
||||
Last verified against upstream documentation: 2026-08-24.
|
||||
|
||||
This page records production running exact deployed application/runtime revision
|
||||
`c4962f54443ad5f98bc65861195a3d9c74a48996`, release `c4962f5`, and the single
|
||||
Browser `screener-v11` contract. Product direction and pending work are owned by
|
||||
`b68c47167da592dd673a78ec3d072936ef49e3ea`, release `b68c471`, and the single
|
||||
Browser `screener-v12` contract. Product direction and pending work are owned by
|
||||
[project memory](./project-memory.md) and [the TODO ledger](./todo.md).
|
||||
|
||||
This section documents the accepted UDP-only deployment contract: one Node.js
|
||||
@@ -25,30 +25,38 @@ ICE/UDP only. Ordinary peer ICE remains STUN-only and production coturn uses the
|
||||
tracked STUN-only configuration with TCP/TLS disabled. The source and production
|
||||
configure no TURN, ICE/TCP, media TCP, or TLS-relayed media.
|
||||
|
||||
Production runs exact `c4962f54443ad5f98bc65861195a3d9c74a48996`, release
|
||||
`c4962f5`, from `/opt/screener/releases/c4962f5`. The immutable runtime ZIP
|
||||
Production runs exact `b68c47167da592dd673a78ec3d072936ef49e3ea`, release
|
||||
`b68c471`, from `/opt/screener/releases/b68c471`. The immutable runtime ZIP
|
||||
SHA-256 is
|
||||
`734815479a03728bb81b44ce5dc04fe010323acdbb91cdbea0e806548278164c`.
|
||||
`e5932880677ebb745ef9325f8def2185d88cdd7bb557fada7c3e1a9e1a7c2ffd`.
|
||||
Its 38-file path/size/hash manifest SHA-256 is
|
||||
`aefc414238655e9cb33d33975813bcc44afd22c5ad4e056ab719fae6c20aed47`.
|
||||
`12e092822abad0d8448d9c6ec87386e8ff82eaafecfeab766e050fa0f3b46710`.
|
||||
Local and public `/healthz` return 200; Screener, LiveKit, coturn, and nginx are
|
||||
active with `NRestarts=0`. The public main Browser asset is
|
||||
`assets/index-DQgIVwby.js` with SHA-256
|
||||
`f819df6c94652d0c5847daa602431384f7b6bf58aa38615fa327526755ede4ef`.
|
||||
`assets/index-BSZhUco2.js` with SHA-256
|
||||
`30cf3bea2a7f80c5b0140f0e40fb0f3f3c082a6195e2ad0990509c663a605f96`.
|
||||
|
||||
The release deploys the single Browser `screener-v11` wire, fixed VP8 for Browser
|
||||
The release deploys the single Browser `screener-v12` wire, fixed VP8 for Browser
|
||||
direct, browser-relay, and SFU video, no video `contentHint`, no codec UI/state/wire,
|
||||
random four-digit
|
||||
memory rooms with a 24-hour dormant lease, orthogonal grant/code admission,
|
||||
memory rooms with a 24-hour dormant lease, a room-lived 22-character grant,
|
||||
orthogonal `open | private` grant/code admission,
|
||||
20-Viewer room admission, the uniform endpoint media-copy cap `2`, and the
|
||||
one-controller exact-candidate route runtime. A credential-free postflight sent
|
||||
a well-formed authentication shape with stale `screener-v10`; it received
|
||||
`INVALID_MESSAGE` and WebSocket close 1008 before room authority without creating
|
||||
a room. The service unit has no writable room StateDirectory; all room authority
|
||||
is process-memory-only. LiveKit is dedicated, has `room.auto_create: false` and
|
||||
one-controller exact-candidate route runtime. Production postflight verified open
|
||||
code entry, private invitation-only and password entry, grant rotation/revocation,
|
||||
typed missing-room failure, and stale `screener-v11` rejection with
|
||||
`INVALID_MESSAGE` and WebSocket close 1008 before room authority. The service unit
|
||||
has no writable room StateDirectory; all room authority is process-memory-only.
|
||||
LiveKit is dedicated, has `room.auto_create: false` and
|
||||
`max_participants: 21`, and is admitted to one global publication ingress plus
|
||||
twenty subscription egress handles. Coturn listens only on UDP 3478 for STUN;
|
||||
LiveKit media listens on UDP 7882.
|
||||
LiveKit media listens on UDP 7882. The stable application firewall table
|
||||
`inet bonfire_filter` has SHA-256
|
||||
`afaf9d066e9f292d8bd19032b38c0978ccf60dd01c2fe7f210968ff751f90534`,
|
||||
and `/etc/nftables.conf` has SHA-256
|
||||
`d57cab70b455e6ddd5cd4688c354b9af5e1d4fb9e9b67c6b85ade0da347cb1d0`;
|
||||
the whole live ruleset is not a stable identity because fail2ban owns a dynamic
|
||||
address set.
|
||||
These bounds are fail-safe admissions, not throughput or quality claims.
|
||||
The retained local 20-Viewer Browser smoke and open real-network boundaries are
|
||||
owned by [verification status](./verification-status.md).
|
||||
@@ -262,7 +270,7 @@ lifetime. An actively connected Host prevents expiry; explicit stop or Host
|
||||
disconnect starts the lease, and only the exact Host token renews it before
|
||||
expiry. Viewer activity never renews ownership. `ROOM_DATABASE_PATH` and
|
||||
`ROOM_TTL_SECONDS` fail startup even when blank.
|
||||
Production `c4962f5` accepts 1 through 20 and explicitly selects 20. This is an
|
||||
Production `b68c471` accepts 1 through 20 and explicitly selects 20. This is an
|
||||
admission limit, not evidence that every publisher, network, or quality profile
|
||||
can sustain that many streams.
|
||||
`ENDPOINT_MEDIA_COPY_CAPACITY` defaults to 2 and accepts only 1, 2, or 3. It is
|
||||
@@ -275,8 +283,8 @@ must fail or wait before a fourth endpoint copy is issued.
|
||||
Supplying the removed `MAX_PEER_RELAY_DOWNSTREAM_EDGES`, even blank, fails
|
||||
startup.
|
||||
|
||||
Production release `c4962f5` runs the deployed server and Browser assets
|
||||
atomically on `screener-v11`; every stale Browser or executable-sender wire fails
|
||||
Production release `b68c471` runs the deployed server and Browser assets
|
||||
atomically on `screener-v12`; every stale Browser or executable-sender wire fails
|
||||
before room authority. Native senders and helpers are outside this release.
|
||||
|
||||
The four `LIVEKIT_*` values must either all be absent or all be present, and a
|
||||
|
||||
@@ -28,20 +28,19 @@ Last updated: 2026-08-25
|
||||
|
||||
## Current Source And Production
|
||||
|
||||
- Production is exact revision `c4962f54443ad5f98bc65861195a3d9c74a48996`, release `c4962f5`, on strict `screener-v11`. Current source uses strict `screener-v12`.
|
||||
- Production runs exact application/runtime revision `b68c47167da592dd673a78ec3d072936ef49e3ea`, release `b68c471`, on strict `screener-v12`; canonical `main` contains the same application/runtime tree plus the current truth checkpoint.
|
||||
- Current source and production admit up to `20` Viewers and implement the uniform `1/2/3` endpoint cap, exact prepare candidate, first-decoded-frame commit, strict rollback revision, decoded-progress stall, a two-stage direct/SFU operation deadline, and one event-driven room controller. A short-lived exact-generation decoded-frame observer proves only the pending candidate inside the existing total deadline; the periodic stats sampler remains responsible for active-path diagnostics and stalls. Ordinary peer ICE is STUN-only and the sole application fallback is SFU/UDP; stale TURN environment keys fail startup. SFU admission uses exact publication and Viewer-subscription handles with explicit no-default ingress/egress capacities and a listener-fenced dedicated LiveKit owner. Browser SFU publisher/subscriber connects use fresh empty ICE-server options; the owner physically verified deployed SFU fallback media after release `c4962f5`, closing the prior core-route hold.
|
||||
- Both use random four-digit memory rooms, dormant leases, exact-Host resume, restart loss, local preference replay, orthogonal grants/code entry, and no SQLite runtime. V12 source uses a 22-character room-incarnation grant, `ROOM_NOT_FOUND`, no diagnostic-file export, and a compact UI showing the complete shorter URL. Production v11 retains the prior grant and UI until an authorized atomic release.
|
||||
- Source and production use random four-digit memory rooms, dormant leases, exact-Host resume, restart loss, local preference replay, orthogonal grants/code entry, and no SQLite runtime. V12 uses a 22-character room-incarnation grant, `ROOM_NOT_FOUND`, no diagnostic-file export, and a compact UI showing the complete shorter URL.
|
||||
- Exact production artifacts, services, ports, and any change-scoped infrastructure recovery boundary are owned by [deployment](./deployment.md) and indexed by [status](./status.md).
|
||||
- Current source requires v12 and production requires v11; both fix Browser direct, browser-relay, and SFU media to VP8, leave video `contentHint` unset, and contain no codec UI, quality state, wire field, fallback media codec, or share-lifetime codec branch. Both use `shareGeneration`-fenced Pause/Resume and implement live 64/128/256 kbps audio-ceiling mutation, typed first-frame Viewer presentation, exactly three recommended profiles with `1080p30` as default, and advanced-only `854x480`. Current source additionally binds Host and SFU publisher audio metrics to the exact current sender track.
|
||||
- Source and production require v12, fix Browser direct, browser-relay, and SFU media to VP8, leave video `contentHint` unset, and contain no codec UI, quality state, wire field, fallback media codec, or share-lifetime codec branch. They use `shareGeneration`-fenced Pause/Resume, implement live 64/128/256 kbps audio-ceiling mutation, bind Host and SFU publisher audio metrics to the exact current sender track, keep typed first-frame Viewer presentation, and expose exactly three recommended profiles with `1080p30` as default plus advanced-only `854x480`.
|
||||
- Browser SFU subscribers reconcile eligible Host screen publications across connect/activate event ordering, participant/track arrival, and reconnect. Production LiveKit logs only warn/error, and the application service has a bounded same-host LiveKit readiness preflight.
|
||||
- Current Browser v12 source passed TypeScript, 609 Web tests in 44 files, both builds, repository hygiene, and focused review. Its exact predecessor owns the separately bounded SFU, Chrome access/privacy, 20-Viewer, and responsive visual evidence. V12 is not deployed; the earlier SFU fix retains owner physical proof.
|
||||
- Exact `main@b68c471` passed TypeScript, 609 Web tests in 44 files, both builds, repository hygiene, the 261-test SFU gate, the explicit-Chrome access/privacy gate, focused review, and production access/postflight checks. Retained 20-Viewer, responsive visual, and physical SFU evidence stays bounded to its exact predecessor revisions.
|
||||
- Chrome loopback, cap2/cap3, short resource, recovery, MBB, and A/V fixtures are bounded evidence only. They do not establish quality, resource limits, or product policy.
|
||||
|
||||
## Current Priority
|
||||
|
||||
1. After explicit owner instruction, deploy the exact strict-v12 source atomically and run bounded postflight plus invitation/access/direct/SFU smoke checks.
|
||||
2. Physically validate the corrected `1 kbps` audio observation and live audio ceilings with audible content across direct, browser-relay, and SFU paths.
|
||||
3. Then physically validate exact direct, browser-relay, and SFU codec behavior on the deployed Browser release and finish real-network route acceptance. Browser VP8 hardware acceleration and mobile Viewer lifecycle remain Accepted Later; Native/executable, distribution, and repository-wide simplification remain later phases.
|
||||
1. Physically validate the corrected `1 kbps` audio observation and live audio ceilings with audible content across direct, browser-relay, and SFU paths.
|
||||
2. Then physically validate exact direct, browser-relay, and SFU codec behavior on the deployed Browser release and finish real-network route acceptance. Browser VP8 hardware acceleration and mobile Viewer lifecycle remain Accepted Later; Native/executable, distribution, and repository-wide simplification remain later phases.
|
||||
|
||||
The desktop Host background/minimized report is deferred until it reproduces on current production with a real game and synchronized media plus CPU/GPU evidence. The bounded current-Chrome screening found no immediate Host-page lifecycle drop, and removal of the old harmful `contentHint = "motion"` remains a plausible confound rather than a proven background fix. Mobile Viewer playback and assigned-relay survival remain a separate lifecycle gate.
|
||||
|
||||
|
||||
+10
-11
@@ -1,6 +1,6 @@
|
||||
# Session Handoff
|
||||
|
||||
Last updated: 2026-08-24
|
||||
Last updated: 2026-08-25
|
||||
|
||||
This file is a bootstrap prompt, not a product-truth owner. The linked documents
|
||||
replace any duplicated or conflicting statement here. Update or remove this file
|
||||
@@ -36,25 +36,24 @@ Current high-signal boundary:
|
||||
subscriber PCs explicitly use no external ICE server and check the dedicated
|
||||
public SFU candidate directly; ordinary peers and LiveKit server-side public
|
||||
IP discovery retain deployment STUN. Production exact deployed
|
||||
application/runtime revision `c4962f54443ad5f98bc65861195a3d9c74a48996`,
|
||||
release `c4962f5`, uses strict `screener-v11` and includes exact Browser SFU
|
||||
application/runtime revision `b68c47167da592dd673a78ec3d072936ef49e3ea`,
|
||||
release `b68c471`, uses strict `screener-v12` and includes exact Browser SFU
|
||||
ICE-server-isolation implementation
|
||||
`ae09c760adec76fd26da611d4928486d105c6d3b`. The owner physically verified
|
||||
deployed SFU fallback media. The route uses one short-lived
|
||||
`ae09c760adec76fd26da611d4928486d105c6d3b`. Owner physical SFU fallback proof
|
||||
remains bounded to predecessor release `c4962f5`. The route uses one short-lived
|
||||
exact-generation decoded-frame observer only for the pending candidate inside
|
||||
the existing total deadline; the periodic stats sampler still owns active-path
|
||||
diagnostics and stalls. Broader external-network and SFU lifecycle evidence
|
||||
remains open. Do not run executable/native suites unless their later acceptance
|
||||
boundary specifically requires them.
|
||||
- ADR-0002 owns the room model. Use `docs/status.md` for the exact current-source
|
||||
and production boundary; production stays exact `c4962f5` on v11 until an
|
||||
explicitly authorized atomic application release.
|
||||
Neither source nor production uses SQLite; exact release operations and
|
||||
- ADR-0002 owns the room model. Current source and production use strict v12 with
|
||||
exactly `open | private` code entry and the room-lived 22-character Viewer
|
||||
grant. Neither source nor production uses SQLite; exact release operations and
|
||||
change-scoped infrastructure recovery are owned by deployment.
|
||||
- Browser display video must leave `contentHint` unset; audio keeps `music`.
|
||||
Browser video is fixed VP8 across direct, browser-relay, and SFU paths; strict
|
||||
v12 source and v11 production have no codec UI/state/wire or fallback media
|
||||
codec. Automated source gates and the existing deployment postflight passed,
|
||||
v12 source and production have no codec UI/state/wire or fallback media codec.
|
||||
Automated source gates and the exact deployment postflight passed,
|
||||
but no physical direct, browser-relay, or SFU codec path has been verified.
|
||||
- Ordinary browser ICE owns direct reachability. Do not build port prediction,
|
||||
guessed candidates, NAT classification, TCP probes, quality scores, or
|
||||
|
||||
+12
-13
@@ -6,18 +6,18 @@ This is the current execution index. Git history owns completed timelines; [veri
|
||||
|
||||
## Production
|
||||
|
||||
- `https://share.bonfire.icu` runs exact deployed application/runtime revision `c4962f54443ad5f98bc65861195a3d9c74a48996`, release `c4962f5`, wire `screener-v11`, from `/opt/screener/releases/c4962f5`; that revision is integrated in canonical `main`. Its immutable runtime ZIP SHA-256 is `734815479a03728bb81b44ce5dc04fe010323acdbb91cdbea0e806548278164c`, and its 38-file manifest SHA-256 is `aefc414238655e9cb33d33975813bcc44afd22c5ad4e056ab719fae6c20aed47`.
|
||||
- `screener`, LiveKit, coturn, and nginx are active/running; local/public `/healthz` return 200 and all four services report `NRestarts=0`. The served main Browser asset is `assets/index-DQgIVwby.js` with SHA-256 `f819df6c94652d0c5847daa602431384f7b6bf58aa38615fa327526755ede4ef`.
|
||||
- The service process resolves its working directory to exact release `c4962f5`; it has no writable room `StateDirectory` or SQLite runtime.
|
||||
- Production admits one Host plus 20 Viewers, applies endpoint capacity `2`, rejects stale Browser and executable-sender wires before room authority, and runs the one-controller exact-candidate route model with one staged total deadline. Rooms use random free four-digit codes, a 24-hour dormant lease, restart loss, local Host creation preferences, independent Viewer grants, and `open | password | disabled` code entry. LiveKit remains dedicated with `room.auto_create: false`, `max_participants: 21`, and global admission `1` publication ingress / `20` subscription egress.
|
||||
- Production media ports remain STUN-only UDP 3478 and LiveKit UDP 7882; coturn TCP/TLS, port 5349, media TCP, and relay ranges are disabled. The public Web ingress remains TCP 80/443; Node 8787 and LiveKit control/signaling 7880 are internal-only. The nft ruleset SHA-256 is `a895f0bb7b66ffe21071ee18acd84d4ea43ca16d4bca9517e6272e14d0ecced4`.
|
||||
- SFU subscribers reconcile Host screen publications across connect, activation, participant arrival, track publication, and reconnect. LiveKit runs at `warn`/Pion `error`, and the Screener unit waits boundedly for the same-host LiveKit control listener before startup. Postflight found healthy unchanged services and the owner physically verified current SFU fallback media. Full direct/browser-relay/SFU codec and real-network acceptance remain open.
|
||||
- `https://share.bonfire.icu` runs exact deployed application/runtime revision `b68c47167da592dd673a78ec3d072936ef49e3ea`, release `b68c471`, wire `screener-v12`, from `/opt/screener/releases/b68c471`; that revision is integrated in canonical `main`. Its immutable runtime ZIP SHA-256 is `e5932880677ebb745ef9325f8def2185d88cdd7bb557fada7c3e1a9e1a7c2ffd`, and its 38-file manifest SHA-256 is `12e092822abad0d8448d9c6ec87386e8ff82eaafecfeab766e050fa0f3b46710`.
|
||||
- `screener`, LiveKit, coturn, and nginx are active/running; local/public `/healthz` return 200, all six served Browser files match the immutable release, and all four services report `NRestarts=0`. The main Browser asset is `assets/index-BSZhUco2.js` with SHA-256 `30cf3bea2a7f80c5b0140f0e40fb0f3f3c082a6195e2ad0990509c663a605f96`; the prior asset returns 404.
|
||||
- The service process resolves its working directory to exact release `b68c471`; it has no writable room `StateDirectory` or SQLite runtime.
|
||||
- Production admits one Host plus 20 Viewers, applies endpoint capacity `2`, rejects stale Browser and executable-sender wires before room authority, and runs the one-controller exact-candidate route model with one staged total deadline. Rooms use random free four-digit codes, a 24-hour dormant lease, restart loss, local Host creation preferences, a room-lived 22-character Viewer grant, and exactly `open | private` code entry. Private rooms without a password are invitation-only; configuring one additionally permits matching code-and-password entry. LiveKit remains dedicated with `room.auto_create: false`, `max_participants: 21`, and global admission `1` publication ingress / `20` subscription egress.
|
||||
- Production media ports remain STUN-only UDP 3478 and LiveKit UDP 7882; coturn TCP/TLS, port 5349, media TCP, and relay ranges are disabled. The public Web ingress remains TCP 80/443; Node 8787 and LiveKit control/signaling 7880 are internal-only. The stable `inet bonfire_filter` table SHA-256 is `afaf9d066e9f292d8bd19032b38c0978ccf60dd01c2fe7f210968ff751f90534`; the dynamic fail2ban table is excluded from that identity.
|
||||
- SFU subscribers reconcile Host screen publications across connect, activation, participant arrival, track publication, and reconnect. LiveKit runs at `warn`/Pion `error`, and the Screener unit waits boundedly for the same-host LiveKit control listener before startup. The current postflight found healthy unchanged services; owner physical SFU fallback proof remains bounded to exact predecessor release `c4962f5`. Full current-release direct/browser-relay/SFU codec and real-network acceptance remain open.
|
||||
- Production Browser SFU publisher and subscriber PCs explicitly use empty external ICE-server lists while retaining LiveKit-signaled UDP candidates. The owner verified that the deployed isolation fixes the reported SFU connection failure; the prior P1 core-route hold is closed.
|
||||
- Production leaves video `contentHint` unset, keeps audio `contentHint = "music"`, and fixes Browser direct, browser-relay, and SFU video to VP8 without codec UI, quality state, wire fields, or fallback media codecs.
|
||||
|
||||
## Current Source
|
||||
|
||||
- Canonical root `main` is the integration truth; auxiliary branches and older worktrees do not supersede it. Current source uses the single strict Browser `screener-v12` wire and rejects every other wire before room authority. Production remains the older exact v11 revision stated above.
|
||||
- Canonical root `main` is the integration truth; auxiliary branches and older worktrees do not supersede it. Current source and production use the single strict Browser `screener-v12` wire and reject every other wire before room authority.
|
||||
- Current source implements one Host plus up to `20` Viewers, one steady outbound media-copy cap for every non-server endpoint (default `2`, static `1/2/3`), and the process-memory room model with random four-digit codes, a default 24-hour dormant lease, exact-Host resume, restart loss, local Host preference replay, exactly `open | private` code entry, and no SQLite runtime. Every room defaults to `open` without a room password and independently receives a Viewer grant: one 22-character opaque value bound to that room incarnation. Private rooms without a password are invitation-only; configuring a password additionally permits matching code-only entry. Unallocated/reclaimed/expired code-only entry returns `ROOM_NOT_FOUND` without a password prompt.
|
||||
- One event-driven controller owns the committed graph and at most one room-serial child operation. It uses one deterministic candidate list/cursor and one total direct-then-SFU deadline; exact admission and physical resources remain charged through drain, and the pending candidate commits only after an exact-generation decoded-frame proof. A short-lived 100 ms stats observer proves only that candidate inside the existing deadline, while the 2-second sampler remains responsible for active-path diagnostics and decoded-frame stalls. Healthy edges remain sticky and current-path quality does not authorize reparenting.
|
||||
- Ordinary peer ICE is STUN-only and the only application fallback is the dedicated LiveKit SFU over UDP. SFU generations use explicit no-default ingress/egress capacities, exact `reserved | committed | draining` accounting, delete-plus-absence release, one Host publication, and exact Viewer subscription handles. No Screener TURN, ICE/TCP, media TCP, or TLS-relayed media route exists.
|
||||
@@ -25,14 +25,13 @@ This is the current execution index. Git history owns completed timelines; [veri
|
||||
- Current source leaves video `contentHint` unset and keeps audio `contentHint = "music"`. Browser direct and browser-relay offers contain VP8 as their only media codec, and SFU publication explicitly uses VP8 with no backup codec. Codec UI, quality state, wire fields, fallback media codecs, and share-lifetime codec branches are absent. Live 64/128/256 kbps audio-ceiling mutation remains unchanged; ordinary Host and SFU publisher metrics now select the exact current audio sender track and reset their baseline when that identity changes or disappears.
|
||||
- Current source implements typed first-frame Viewer presentation and recovery, Chinese user-facing route/access failures, local connection details without a diagnostic-file export, authenticated Host-only on-demand route snapshots for automatic acceptance, explicit missing-room presentation, and responsive entry controls. Host invitation controls remain independent from two-state room-code entry.
|
||||
- Recommended quality remains exactly `1080p60`, `1080p30`, and `720p30`; current source defaults to `1080p30`. Advanced resolution adds `480p` as `854x480` without adding a fourth preset, and advanced FPS and bitrate remain independent.
|
||||
- Current v12 source passed repository hygiene, TypeScript, all 609 Web tests in 44 files, both production builds, and focused independent review. The exact predecessor's SFU, Chrome access/privacy, 20-Viewer loopback, and responsive visual evidence remains separately bounded in [verification status](./verification-status.md). V12 is not deployed.
|
||||
- Exact `main@b68c471` passed repository hygiene, TypeScript, all 609 Web tests in 44 files, both production builds, the 261-test SFU gate, the explicit-Chrome access/privacy gate, focused independent review, and the production access/postflight checks above. Retained 20-Viewer loopback, responsive visual, and physical SFU evidence remains separately revision-bounded in [verification status](./verification-status.md).
|
||||
|
||||
## Current Milestone
|
||||
|
||||
1. Release the accepted strict v12 source atomically and verify stale-wire rejection, health, invitation/access behavior, and unchanged direct/SFU operation. Private rooms without a password remain invitation-only, and a configured password additionally permits matching code-only entry; no deployment has occurred at this checkpoint.
|
||||
2. Physically validate the corrected live screen-audio statistics and 64/128/256 kbps ceilings with known audible content across direct, browser-relay, and SFU paths.
|
||||
3. Physically verify fixed-VP8/no-video-hint direct, browser-relay, and SFU paths from actual codec, capture, outbound, and decoded stats.
|
||||
4. Finish representative ICE/STUN/SFU acceptance including mobile networks. Browser port prediction, NAT classification, TCP probing, fake page keepalive, and quality-driven reparenting remain outside the accepted model.
|
||||
1. Physically validate the corrected live screen-audio statistics and 64/128/256 kbps ceilings with known audible content across direct, browser-relay, and SFU paths.
|
||||
2. Physically verify fixed-VP8/no-video-hint direct, browser-relay, and SFU paths from actual codec, capture, outbound, and decoded stats.
|
||||
3. Finish representative ICE/STUN/SFU acceptance including mobile networks. Browser port prediction, NAT classification, TCP probing, fake page keepalive, and quality-driven reparenting remain outside the accepted model.
|
||||
|
||||
## Active Boundaries
|
||||
|
||||
@@ -40,7 +39,7 @@ This is the current execution index. Git history owns completed timelines; [veri
|
||||
- The desktop Host background/minimized report is deferred until a current-production real-game reproduction supplies synchronized media and CPU/GPU evidence. Mobile Viewer background playback and relay survival remain a separate Accepted Later lifecycle gate.
|
||||
- Open PR #192 and the Native stack are evidence/research, not pending product releases. Native senders, capture helpers, shared-encode executables, and their test binaries are outside the current Browser milestone and are not built or run.
|
||||
- Deployed surfaces and retained candidates that still need product decisions are indexed only in [the TODO ledger](./todo.md); do not extend or roll them back automatically.
|
||||
- Room lifetime, authorization/storage semantics, restart loss, and routing remain aligned, while current source is strict v12 and production remains strict v11 until an explicitly authorized atomic application release. The prior application-only cutover reused unchanged infrastructure and configuration and does not maintain a full rollback/configuration backup; any future infrastructure or irreversible-state change requires recovery scoped to the surfaces it actually changes.
|
||||
- Room lifetime, authorization/storage semantics, restart loss, and routing are aligned on strict v12 in current source and production. The application-only cutover reused unchanged infrastructure and configuration and does not maintain a full rollback/configuration backup; any future infrastructure or irreversible-state change requires recovery scoped to the surfaces it actually changes.
|
||||
- Real SFU recovery, heterogeneous networks, mobile lifecycle, audio/A-V device behavior, and endurance/resource measurements remain external acceptance evidence, not blockers for unrelated reversible work.
|
||||
|
||||
## Current Hold
|
||||
|
||||
+5
-6
@@ -6,17 +6,16 @@ Only items in **Now** are executable after their stated decision gate. A branch
|
||||
|
||||
## Now
|
||||
|
||||
1. **Finish the accepted private room-entry contract, then deploy Browser v12 only after explicit owner instruction.** Strict v12 must use only `open | private`: private without a password is invitation-only, while a configured password also permits matching code-only entry. Production remains exact `c4962f5` on v11. A release must switch server and Browser assets atomically, reject stale v11 before room authority, run bounded health/postflight checks, and verify the shorter complete invitation URL, rotate/revoke, public/private code entry with and without a password, code-only missing-room result, direct media, and SFU fallback. This is an application-only release unless its scope is explicitly expanded.
|
||||
2. **Physically validate live screen-audio statistics.** The source fix binds ordinary Host and SFU publisher audio stats to the exact current sender track, merges SFU video/audio reports, and resets the baseline when audio identity changes or disappears. After deployment, reproduce the reported `1 kbps` state with known audible content and switch the 64/128/256 kbps ceilings across direct, browser-relay, and SFU paths while checking sender/receiver counters, route continuity, audible result, and A/V synchronization. A real muted/idle track may legitimately use about 1 kbps; do not multiply the value or display the configured ceiling as observed bitrate.
|
||||
3. **Diagnose and physically validate Browser VP8 performance with no video hint.** First reproduce the reported localhost `1080p60` shortfall with current source and separate source capture, encoded, sent, received, decoded, and rendered frame rates plus encode time, quality limitation, CPU/GPU load, and actual encoder implementation. Compare `contentHint` only as a controlled diagnostic and do not restore it by assumption. Then confirm actual VP8 codec, capture, outbound, and decoded stats on direct, browser-relay, and SFU paths; automated gates and the owner SFU connectivity proof do not close this performance/codec gate.
|
||||
4. **Finish real-network route acceptance.** Measure standard ICE/STUN direct paths, peer relay, SFU ingress/subscription, exact first-frame commit and rollback, relay-ingress repair with subtree retention, disconnect/capacity drain, Pause/Resume, and bounded explicit failure across representative IPv4/IPv6 NATs and mobile networks. Include an all-UDP-blocked case to establish the current failure boundary. Do not add port prediction, NAT classification, TCP probes, guessed candidates, route scores, or quality-driven reparenting.
|
||||
5. **Apply the accepted local-observation cleanup.** Remove the selected-pair `responsesReceived` cumulative and interval counters, their sampling window, and their tests; retain exact selected-pair resolution for current path metrics. Keep the signaling watchdog limited to authenticated, visible sessions with an active authoritative route. Hidden/background transitions rebaseline instead of proving failure, and the watchdog does not provide page or media keepalive.
|
||||
1. **Physically validate live screen-audio statistics.** The deployed source binds ordinary Host and SFU publisher audio stats to the exact current sender track, merges SFU video/audio reports, and resets the baseline when audio identity changes or disappears. Reproduce the reported `1 kbps` state with known audible content and switch the 64/128/256 kbps ceilings across direct, browser-relay, and SFU paths while checking sender/receiver counters, route continuity, audible result, and A/V synchronization. A real muted/idle track may legitimately use about 1 kbps; do not multiply the value or display the configured ceiling as observed bitrate.
|
||||
2. **Diagnose and physically validate Browser VP8 performance with no video hint.** First reproduce the reported localhost `1080p60` shortfall with current production and separate source capture, encoded, sent, received, decoded, and rendered frame rates plus encode time, quality limitation, CPU/GPU load, and actual encoder implementation. Compare `contentHint` only as a controlled diagnostic and do not restore it by assumption. Then confirm actual VP8 codec, capture, outbound, and decoded stats on direct, browser-relay, and SFU paths; automated gates and the predecessor SFU connectivity proof do not close this performance/codec gate.
|
||||
3. **Finish real-network route acceptance.** Measure standard ICE/STUN direct paths, peer relay, SFU ingress/subscription, exact first-frame commit and rollback, relay-ingress repair with subtree retention, disconnect/capacity drain, Pause/Resume, and bounded explicit failure across representative IPv4/IPv6 NATs and mobile networks. Include an all-UDP-blocked case to establish the current failure boundary. Do not add port prediction, NAT classification, TCP probes, guessed candidates, route scores, or quality-driven reparenting.
|
||||
4. **Apply the accepted local-observation cleanup.** Remove the selected-pair `responsesReceived` cumulative and interval counters, their sampling window, and their tests; retain exact selected-pair resolution for current path metrics. Keep the signaling watchdog limited to authenticated, visible sessions with an active authoritative route. Hidden/background transitions rebaseline instead of proving failure, and the watchdog does not provide page or media keepalive.
|
||||
|
||||
## Accepted Later Roadmap
|
||||
|
||||
These items are real product work, ordered after the current physical-media, real-network, and product-decision gates; they are not permission to resume an old branch wholesale.
|
||||
|
||||
1. **Browser VP8 hardware-acceleration evidence.** After the v11 physical codec gate, measure supported Chrome/Edge platform combinations under real game load using actual negotiated codec, encoder implementation, power-efficient status, encode time, frame rate, and CPU/GPU attribution. Capability advertisement alone is not proof. Do not add another codec, a custom encoder, GPU-selection workaround, codec ladder, or Native helper without a new accepted decision.
|
||||
1. **Browser VP8 hardware-acceleration evidence.** After the current physical codec gate, measure supported Chrome/Edge platform combinations under real game load using actual negotiated codec, encoder implementation, power-efficient status, encode time, frame rate, and CPU/GPU attribution. Capability advertisement alone is not proof. Do not add another codec, a custom encoder, GPU-selection workaround, codec ladder, or Native helper without a new accepted decision.
|
||||
2. **Mobile Viewer lifecycle.** Run Android Chrome and iOS Safari device matrices for autoplay gesture, foreground/background audio, foreground video recovery, lock/page reclamation, rotation, Wi-Fi/cellular migration, and an assigned relay's outbound-media survival or controller failover across those transitions. Preserve the same media element and current reconnect path; do not promise background video composition, background relay continuity, or unsupported lock-screen behavior.
|
||||
3. **Platform output only when real.** Revisit AirPlay/Cast only when a target browser and physical receiver prove the live `MediaStream` contract. System mirroring remains external; no placeholder button, custom receiver, or server transcode is scheduled.
|
||||
4. **Public-server one-click deployment package.** After every current functional and real-network item is settled, package the exact application, STUN/SFU, reverse proxy, secrets, and health checks for a user-owned public server. Require real domain/TLS/firewall/capacity inputs and recovery scoped to any infrastructure or irreversible state the installer actually changes; routine application-only immutable updates do not create or maintain a full configuration backup. Never ship credentials or call a partial deployment ready.
|
||||
|
||||
+10
-11
@@ -1,6 +1,6 @@
|
||||
# Current Verification Status
|
||||
|
||||
Last updated: 2026-08-24
|
||||
Last updated: 2026-08-25
|
||||
|
||||
## Purpose
|
||||
|
||||
@@ -10,16 +10,15 @@ Capacity and routing entries below describe the exact tested source or release o
|
||||
|
||||
## Deployment Evidence
|
||||
|
||||
- Production runs exact deployed application/runtime revision `c4962f54443ad5f98bc65861195a3d9c74a48996`, release `c4962f5`, wire `screener-v11`, from `/opt/screener/releases/c4962f5`; that revision is integrated in canonical `main`. The immutable runtime ZIP SHA-256 is `734815479a03728bb81b44ce5dc04fe010323acdbb91cdbea0e806548278164c`; its 38-file manifest SHA-256 is `aefc414238655e9cb33d33975813bcc44afd22c5ad4e056ab719fae6c20aed47`.
|
||||
- Postflight found `screener`, LiveKit, coturn, and nginx active with zero restarts. Local/public health matched the release; `assets/index-DQgIVwby.js` has SHA-256 `f819df6c94652d0c5847daa602431384f7b6bf58aa38615fa327526755ede4ef`.
|
||||
- Production runs exact deployed application/runtime revision `b68c47167da592dd673a78ec3d072936ef49e3ea`, release `b68c471`, wire `screener-v12`, from `/opt/screener/releases/b68c471`; that revision is integrated in canonical `main`. The immutable runtime ZIP SHA-256 is `e5932880677ebb745ef9325f8def2185d88cdd7bb557fada7c3e1a9e1a7c2ffd`; its 38-file manifest SHA-256 is `12e092822abad0d8448d9c6ec87386e8ff82eaafecfeab766e050fa0f3b46710`.
|
||||
- Postflight found `screener`, LiveKit, coturn, and nginx active with zero restarts and no warning-level Screener journal entries. Local/public health and all six served Browser files matched the release; `assets/index-BSZhUco2.js` has SHA-256 `30cf3bea2a7f80c5b0140f0e40fb0f3f3c082a6195e2ad0990509c663a605f96`, while the prior main asset returns 404.
|
||||
- Production uses endpoint capacity `2`, room admission `20`, random free four-digit memory rooms, `ROOM_LEASE_SECONDS=86400`, a dedicated LiveKit instance with `room.auto_create: false` and `max_participants: 21`, and global SFU admission `1` ingress / `20` egress. Room authority is process-memory-only. Coturn is `stun-only`, `no-tcp`, and `no-tls`; only UDP 3478 listens, and nft exposes only UDP 3478/7882 for Screener media.
|
||||
- The production service orders Screener after LiveKit and boundedly waits for its control listener. The LiveKit namespace is empty; media listeners remain STUN-only UDP 3478 and LiveKit UDP 7882 with no 5349, coturn TCP/TLS, relay range, ICE/TCP, or media TCP listener. The unchanged nft ruleset has SHA-256 `a895f0bb7b66ffe21071ee18acd84d4ea43ca16d4bca9517e6272e14d0ecced4`.
|
||||
- This application-only postflight proves archive identity, atomic application/assets, stale-wire rejection, process health, listener/firewall continuity, and log sentinels. It did not exercise direct, browser-relay, SFU, audio, codec, mobile, quality, or endurance behavior. Routine application-only releases do not maintain a full rollback/configuration backup; any future infrastructure or irreversible-state change requires recovery scoped to what it changes.
|
||||
- The production service orders Screener after LiveKit and boundedly waits for its control listener. Media listeners remain STUN-only UDP 3478 and LiveKit UDP 7882 with no 5349, coturn TCP/TLS, relay range, ICE/TCP, or media TCP listener. The stable `inet bonfire_filter` table stayed unchanged through cutover at SHA-256 `afaf9d066e9f292d8bd19032b38c0978ccf60dd01c2fe7f210968ff751f90534`; the whole ruleset is not used as an identity because fail2ban owns a dynamic address set.
|
||||
- This application-only postflight proves archive identity, atomic application/assets, stale-v11 rejection, process health, listener/firewall continuity, and the production `open | private` access model: 22-character room-lived grant, approximately 24-hour dormant lease, public code entry, private invitation-only and password entry, rotate/revoke, and typed missing-room failure. It did not exercise direct, browser-relay, SFU, audio, codec, mobile, quality, or endurance behavior. Routine application-only releases do not maintain a full rollback/configuration backup; any future infrastructure or irreversible-state change requires recovery scoped to what it changes.
|
||||
|
||||
## Retained Functional Evidence
|
||||
|
||||
- Exact v12 predecessor implementation `064db16c1b6d25fd24b7057b7e2fca172002e3c4` passed repository hygiene, TypeScript typecheck, all 604 Web tests in 45 files, client and server production builds, the 255-test SFU admission gate in 10 files, the explicit-Chrome access/privacy gate, and the Chrome 20-Viewer loopback gate. Independent reviews found no remaining blocker. Real Chrome checks at 1440, 600, and 390 CSS pixels showed the complete 53-character local invitation URL without overflow; the 390-pixel room-password control stayed collapsed until requested and its editor fit when opened. A missing well-formed room showed `房间不存在或已过期`, no password control, and no horizontal overflow. This validates that exact source and responsive surface only; it is not deployment, physical screen-audio, public-network, or real-SFU evidence.
|
||||
- Exact v11 implementation `f5a295c52e0ac7d18e5a7949217861c7aa74e9c9`, integrated with the SFU isolation fix into deployed application/runtime revision `c4962f54443ad5f98bc65861195a3d9c74a48996` and canonical `main`, passed TypeScript typecheck, all 605 Web tests in 45 files, client and server production builds, the 254-test SFU gate in 10 files, and the access/privacy gate with explicit Chrome. This validates source structure, strict-wire behavior, fixed-VP8 path configuration, build output, and the covered Browser gate only; it does not provide full physical direct/browser-relay/SFU codec evidence.
|
||||
- Exact deployed `main@b68c471` passed repository hygiene, TypeScript typecheck, all 609 Web tests in 44 files, client and server production builds, the 261-test SFU admission gate in 10 files, the explicit-Chrome access/privacy gate, and focused independent review. Retained Chrome 20-Viewer and responsive visual checks apply only to their recorded predecessor revisions; no current-release physical direct/browser-relay/SFU media claim is inferred.
|
||||
- Exact Browser SFU ICE-server-isolation implementation `ae09c760adec76fd26da611d4928486d105c6d3b` passed repository hygiene, TypeScript typecheck, all 605 Web tests in 45 files, client and server production builds, three independent code reviews, focused 95-test publisher/subscriber and ordinary-peer isolation coverage, deployment postflight, and owner physical SFU fallback media proof. This establishes the reported production connection fix without turning candidate type/count into an invariant; full route/codec/network acceptance remains open.
|
||||
- A fresh canonical `main@c4962f5` background gate passed repository hygiene, all 605 Web tests, both production builds, the 254-test SFU admission suite, and the Chrome 151 20-Viewer 720p30/30-second local route gate. All 20 Viewers advanced decoded frames, Host and relays stayed within endpoint cap `2`, no orphan SFU publication appeared, and all four current-child timing distributions contained 20 values. The browser gate uses deterministic canvas and does not start LiveKit, so it proves local direct/browser-relay control and media behavior only; it is not physical capture or SFU evidence.
|
||||
- Exact v10 runtime source `fdd5a4a529ff297f41c05ea3388bf484d76afe8f` passed repository hygiene, TypeScript typecheck, client and server production builds, all 610 Web tests in 45 files, the 257-test SFU admission gate, the access/privacy Browser gate, and the production-dependency audit with zero vulnerabilities. Its one-Host/20-Viewer Chrome 151 direct-loopback report passed all seven assertions: all Viewers decoded, the selected VP8 settings reached every participant, Host and relay media edges stayed within cap `2`, no orphan SFU publication appeared, and all four current-child timing distributions contained 20 values. The report SHA-256 is `802CBB7632E9AEA3C39FE831A7F7880D24140B2E83942CE0DFDA05DE4B408EED`. This validates the v10 source boundary, not H.264 quality, hardware attribution, physical capture, public-network behavior, or SFU packet flow.
|
||||
@@ -33,17 +32,17 @@ Capacity and routing entries below describe the exact tested source or release o
|
||||
|
||||
## Open Proof Boundaries
|
||||
|
||||
- Routing: exact v10 local direct loopback remains historical evidence for admission-20 initial ingress and exact-candidate first-frame commit timing on that source. Current v11 production still needs physical direct, browser-relay, and SFU codec verification, together with route rollback, direct-stage exhaustion and SFU admission, relay-ingress reparent with subtree retention, disconnect/effective-capacity drain, pause/resume, and bounded failure on real browser/media paths. Silent control partitions may wait 30 to 60 seconds for heartbeat detection before the default five-second grace; a non-paused decoded-frame stall may invalidate only that exact child edge.
|
||||
- Routing: exact v10 local direct loopback remains historical evidence for admission-20 initial ingress and exact-candidate first-frame commit timing on that source. Current v12 production still needs physical direct, browser-relay, and SFU codec verification, together with route rollback, direct-stage exhaustion and SFU admission, relay-ingress reparent with subtree retention, disconnect/effective-capacity drain, pause/resume, and bounded failure on real browser/media paths. Silent control partitions may wait 30 to 60 seconds for heartbeat detection before the default five-second grace; a non-paused decoded-frame stall may invalidate only that exact child edge.
|
||||
- Quality: production startup blur remains unclassified. One same-`balanced` local A/B retained route/PC/SSRC/track while 720p rose to 1080p, but natural ramp prevents causal, production, or SFU conclusions. Correlate Host capture/encode/send with Viewer receive/decode before changing policy.
|
||||
- Host background: deferred until the report reproduces on exact production with a continuously changing real game or replay, a separate direct wired Viewer, synchronized capture/outbound/inbound plus CPU/GPU evidence, and repeated focused/unfocused/hidden/minimized windows. The current-Chrome Browser `getDisplayMedia()` WPF-window screening did not observe an immediate Host-page media drop, and the old harmful `contentHint = "motion"` release remains a plausible confound rather than a proven background cause. Current evidence authorizes no keepalive, Wake Lock, timer, codec switch, route change, or Native fallback.
|
||||
- Relay resources: current source and production expose the authenticated `1/2/3` endpoint-cap boundary, and retained v10 local loopback evidence covers 20 Viewers at cap `2` only for that source. CPU/GPU/upload and heterogeneous-network measurements remain diagnostics, not authority to change the contract.
|
||||
- Room scale: current source and production admit 20 Viewers plus one Host, and the retained v10 local Browser convergence gate covers that bound on direct loopback. A real public-network 1:20 session, quality, and sustained resource matrix remain open.
|
||||
- SFU: production uses one Host publication with exact Viewer subscriptions and no fixed root-count or room-wide lease rule. Browser SFU PCs use the accepted empty-external-ICE-server rule and owner physical media proof closed the reported connection hold. Real LiveKit lifecycle/JWT replay, shaped packet-flow, BWE downshift/recovery, resource use, SFU-fed first-child behavior, and broader heterogeneous-network acceptance remain open. Use Linux `tc` or an authorized public canary for per-leaf shaping, never CDP throttling.
|
||||
- Audio: current v12 source selects the exact active ordinary Host or SFU publisher audio sender and resets samples across track changes or absence. Physical verification of the 64/128/256 kbps settings, negotiated/observed bitrate, audible music quality, route changes, and game A/V synchronization remains open. Bitrate settings are ceilings, not quality proof, and a muted/idle Opus track may legitimately remain near 1 kbps.
|
||||
- Observability: current v12 source keeps local connection details but removes Host/Viewer diagnostic downloads and Browser file-export plumbing; production v11 retains its old surface until deployment. The Host-only bounded snapshot stays for automatic acceptance. Target-browser availability and actual values remain unverified for Host SFU sender evidence, codec/fmtp and encoder implementation/power efficiency, media-source and encoded FPS, A/V playout/jitter/concealment, selected candidate endpoints, and bounded same-pair STUN-response observation. All retained fields diagnose and have no recovery authority; they do not by themselves prove hardware encode, synchronization quality, or route quality.
|
||||
- Audio: current v12 source and production select the exact active ordinary Host or SFU publisher audio sender and reset samples across track changes or absence. Physical verification of the 64/128/256 kbps settings, negotiated/observed bitrate, audible music quality, route changes, and game A/V synchronization remains open. Bitrate settings are ceilings, not quality proof, and a muted/idle Opus track may legitimately remain near 1 kbps.
|
||||
- Observability: current v12 source and production keep local connection details but no Host/Viewer diagnostic downloads or Browser file-export plumbing. The Host-only bounded snapshot stays for automatic acceptance. Target-browser availability and actual values remain unverified for Host SFU sender evidence, codec/fmtp and encoder implementation/power efficiency, media-source and encoded FPS, A/V playout/jitter/concealment, selected candidate endpoints, and bounded same-pair STUN-response observation. All retained fields diagnose and have no recovery authority; they do not by themselves prove hardware encode, synchronization quality, or route quality.
|
||||
- Mobile: Android/iOS remain Viewer-only. Autoplay, rotation, iOS lock-screen/page reclamation, background reconnection, and network changes need device evidence. AirPlay/system mirroring is Viewer-local output, not a portable in-app WebRTC output contract.
|
||||
- Native: ADR-0006 has one-Viewer evidence only. Viewer2/FIFO, hardware diversity, endurance, downloaded-package/public-host, game A/V, and browser diversity remain open.
|
||||
- Access and operations: exact v11 implementation passed the access/privacy gate with explicit Chrome. Production passed atomic v11 application cutover/postflight plus stale-v10 rejection before authority. Restart-wide room loss, password-profile creation, grant/code orthogonality, rotate/revoke, memory-only runtime, and exact current journal/nginx sentinel checks retain their focused evidence. Headful same-browser preference replay and the isolated VM/IP clean-port matrix remain open; shared-IP smoke cannot approve them.
|
||||
- Access and operations: exact deployed v12 passed the access/privacy gate with explicit Chrome and production cutover/postflight, including stale-v11 rejection before authority, room-lived grant/code orthogonality, private entry with and without a password, rotate/revoke, missing-room typing, and memory-only runtime. Headful same-browser preference replay and the isolated VM/IP clean-port matrix remain open; shared-IP smoke cannot approve them.
|
||||
|
||||
## Evidence Rules
|
||||
|
||||
|
||||
+2
-2
@@ -2,7 +2,7 @@
|
||||
|
||||
## 2026-08-18 14:45
|
||||
|
||||
状态：current source 使用严格 `screener-v12`；production 仍运行精确 revision `c4962f54443ad5f98bc65861195a3d9c74a48996`、release `c4962f5` 与严格 `screener-v11`，v12 尚未部署。源码已实现 22 字符 room-lived Viewer grant、`ROOM_NOT_FOUND`、产品诊断下载移除、完整短 URL 邀请 UI、收敛的房间密码控件与 exact-current audio stats。源码和生产均固定 Browser VP8，video 不设置 `contentHint`、audio 保留 `music`，且无 codec UI/state/wire 或分享生命周期分支；Pause/Resume 继续由当前 Host session 和 `shareGeneration` 约束。Owner 已在生产实测现有 SFU fallback 成功取得画面。
|
||||
状态：production 运行精确 application/runtime revision `b68c47167da592dd673a78ec3d072936ef49e3ea`、release `b68c471` 和严格 `screener-v12`；canonical `main` 含相同 application/runtime tree 与当前 truth checkpoint。源码与生产已实现 22 字符 room-lived Viewer grant、`ROOM_NOT_FOUND`、产品诊断下载移除、完整短 URL 邀请 UI、收敛的房间密码控件与 exact-current audio stats，并固定 Browser VP8，video 不设置 `contentHint`、audio 保留 `music`，且无 codec UI/state/wire 或分享生命周期分支；Pause/Resume 继续由当前 Host session 和 `shareGeneration` 约束。Owner 的 SFU fallback 实测证据仍严格归属于 predecessor release `c4962f5`。
|
||||
|
||||
## 目标与边界
|
||||
|
||||
@@ -362,7 +362,7 @@ Token-free SFU standby prewarm 保持可选且不创建 participant、publicatio
|
||||
|
||||
## 当前交付边界
|
||||
|
||||
- Current source 使用严格单一 `screener-v12` wire，并已实现短 room-lived grant、明确 missing-room 结果、产品诊断下载移除、完整短 URL 邀请 UI 与 exact-current audio stats。Production 仍运行精确 deployed application/runtime revision `c4962f54443ad5f98bc65861195a3d9c74a48996`、release `c4962f5` 和严格 `screener-v11`，v12 尚未部署。源码与生产均固定 Browser VP8 且 video 不设置 `contentHint`，codec selector、quality-state/wire 字段与分享生命周期 codec 分支不存在。
|
||||
- Production 使用严格单一 `screener-v12` wire 和精确 deployed application/runtime revision `b68c47167da592dd673a78ec3d072936ef49e3ea`、release `b68c471`；current source 含相同 application/runtime tree 与当前 truth checkpoint。两者均已实现短 room-lived grant、明确 missing-room 结果、产品诊断下载移除、完整短 URL 邀请 UI 与 exact-current audio stats，固定 Browser VP8 且 video 不设置 `contentHint`，codec selector、quality-state/wire 字段与分享生命周期 codec 分支不存在。
|
||||
- Pause/Resume 由当前 Host session 和 `shareGeneration` 约束。Host 后台性能和 VP8 hardware acceleration 分别按受控根因证据诊断；标准 ICE/SFU 按真实异构网络验收。
|
||||
- 当前发布面只包含 Web Host、Viewer 和 browser relay。Native sender、capture helper、shared-encode executable 与两个分发包仍由各自后续决策和物理证据驱动，不属于当前 Browser release。
|
||||
|
||||
|
||||
Reference in new issue
Block a user