From 36a2fcdf4a6586698bfa6da364c448c0134841f5 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 19 Aug 2026 16:22:15 +0800
Subject: [PATCH] docs(status): record room canary verification

---
 docs/status.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/status.md b/docs/status.md
index d31acca..f5c34ae 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -15,7 +15,7 @@ deployed binary still uses one host peer connection per viewer and P2P/TURN.
 - Whole-site `ACCESS_PASSWORD` is optional. Protected sessions use a stateless 12-hour HMAC HttpOnly `SameSite=Strict` cookie; host authentication remains internal and signaling is role-bound.
 - Without `ROOM_DATABASE_PATH`, rooms are random and temporary. With both the database path and site password, room IDs start at `1`, links persist, and stopping a share leaves viewers waiting. SQLite stores only room ID and host-token digest.
 - Direct ICE is preferred independently per media edge. Authenticated TURN/UDP and TURN/TCP are required production fallbacks; TURN/TLS is optional.
-- Hidden routing is `direct P2P -> peer-assisted -> optional SFU`. Strict optional `PEER_ASSISTED_ROOM_IDS` limits peer/SFU state to exact rooms; unlisted rooms stay legacy P2P, while empty or missing means all rooms when enabled. Production remains disabled.
+- Hidden routing is `direct P2P -> peer-assisted -> optional SFU`. `PEER_ASSISTED_ROOM_IDS` canaries exact rooms; others stay legacy P2P. Empty or missing means all, production is disabled, and the 22-file/284-test full suite covers both paths.
 - Complete fallback configuration adds a non-secret standby URL to peer-assisted authentication. Host and viewers import the SDK and make one token-free DNS/TLS warmup; no configuration means no field, import, request, participant, or media edge.
 - A viewer starts as a leaf each session and explicitly advertises relay capacity zero or one; the Web client reports detected mobile/iPad clients as zero and desktop-class browsers as one. Withdrawal stops future assignment without moving a healthy edge. Browser relays remain one-child; the host remains two-child.
 - Production uses one strict, memory-only video quality setting with bounded manual ceilings and sender readback. It also carries equal idle-stage share/join actions and default-closed technical details. Browser audio remains request/presence-only.