docs(quality): bound browser adaptation correction (#254)

docs/adr/0007-path-isolated-representation-quality.md

@@ -1,6 +1,6 @@
 # ADR-0007: LiveKit-Owned SFU Representation Adaptation
 
-- Status: Accepted and implemented in current source; not deployed
+- Status: Framework adaptation deployed; lightweight lower representation accepted and pending
 - Date: 2026-08-19
 - Last reviewed: 2026-08-25
 
@@ -32,10 +32,11 @@ removing the representation required by constrained Viewers.
 
 1. Direct and peer paths retain independent stock WebRTC congestion control.
    Viewer feedback is never aggregated into a room-wide target.
-2. The Browser Host SFU publication provides the pinned SDK's bounded VP8
-   screen-share representations: one half-resolution encoding and the original
-   full-resolution encoding. The representation count is fixed and does not
-   grow with Viewer count.
+2. The Browser Host SFU publication provides two bounded VP8 screen-share
+   representations: one half-resolution encoding and the original full-resolution
+   encoding. The lower representation keeps at most 30 fps and derives its
+   bitrate from the pinned SDK's pixel-and-frame-rate formula; the representation
+   count is fixed and does not grow with Viewer count.
 3. LiveKit Dynacast and its per-subscriber stream allocator/BWE own publication
    layer activation and the actual layer forwarded to each SFU subscriber.
    Screener does not implement a quality score, bandwidth estimator, periodic
@@ -51,13 +52,17 @@ removing the representation required by constrained Viewers.
 6. ADR-0005 remains the only route owner. Layer choice does not change topology,
    endpoint capacity, SFU admission, or decoded-stall recovery authority.
 
-Current source leaves the screen-share simulcast layers unset so pinned client
-`2.22.0` supplies its default half-resolution plus original-resolution pair,
-enables Dynacast, and tracks the required server send-side-BWE configuration.
-Those two encodings use RIDs `q,h`; LiveKit's protocol labels them `LOW,MEDIUM`,
+Production release `e14eb0e` leaves the screen-share layer list unset, so pinned
+client `2.22.0` supplies a same-FPS half-resolution representation beside the
+original. A live mixed P2P/SFU observation confirmed that the 60 fps lower
+representation can consume enough Host-to-SFU budget to starve the highest
+representation. The accepted correction keeps LiveKit's two-layer ownership but
+supplies one half-resolution lower preset with
+`lowFps = min(30, highFps)` and the SDK's existing proportional bitrate formula.
+The two encodings remain RIDs `q,h`; LiveKit's protocol labels them `LOW,MEDIUM`,
 while a subscriber's default `HIGH` ceiling still selects the highest available
-encoding. Production remains the deployed single-encoding implementation until
-cutover.
+encoding. Dynacast, server send-side BWE, and disabled AdaptiveStream remain
+unchanged.
 
 ## Pinned Physical Result
 
@@ -83,9 +88,10 @@ bounded cost, not eliminated by Dynacast. AdaptiveStream selected the full
 representation for a large attached element, the lower representation for a
 small element, paused a hidden element, and recovered when visible. With no
 attached element it received only the lower representation, confirming that it
-cannot own relay ingress. The accepted product combination is pinned-default
+cannot own relay ingress. This gate established the framework combination of
 VP8 screen-share simulcast, Dynacast, server send-side BWE, and
-`adaptiveStream: false` for Screener subscribers.
+`adaptiveStream: false`; the later production observation amends only the lower
+representation's FPS and proportional bitrate.
 
 ## Evidence Boundary
 

docs/project-memory.md

@@ -17,7 +17,7 @@ Last updated: 2026-08-25
 - One Host publication may serve all SFU subscriptions. Its exact generation owns one ingress handle and exact Viewer subscription handles own egress; later SFU children reuse the publication, while reserved, committed, and draining handles remain charged until the managed room is deleted and proven absent. Actual SFU usage release wakes only rooms that previously lost a candidate to global admission, and SFU-fed and peer-fed endpoints use the same provisional-child transaction. Parent choice hard-filters authority, reachability, cycles, effective capacity, and producer transition, then orders by shallowest result, remaining steady sender capacity, stable join order, and peer identity; server admission is checked at the current cursor. Acyclicity and room admission bound maximum depth; depth is observed but has no separate hard cap. Healthy committed edges remain sticky: the controller repairs waiting, invalid, departed-parent, and overflow children but does not periodically rebalance the graph. Raw IP, claimed NAT type, UA, geography, all-pairs probes, weighted scores, and periodic room rebalancing are not route inputs.
 - Ordinary peer ICE is STUN-only. Browser LiveKit publisher and subscriber PCs use no external ICE server, retain LiveKit-signaled UDP candidates, and let standard ICE nominate a non-relay pair; deployment STUN remains available to ordinary peers and LiveKit server-side public-IP discovery. This Browser SFU ICE-server isolation avoids the reproduced external-STUN/SFU association conflict without constraining candidate type or count and without adding TURN, another route, a port, or a timeout. Credentials, room secrets, candidate details, and diagnostic data remain private and narrowly scoped. A future strict-firewall transport requires separate evidence and must remain inside LiveKit rather than becoming another Screener route candidate.
 - Browser peers use existing periodic WebRTC/LiveKit sampling to maintain one exact-route decoded-progress timestamp. New frames or route/connection changes reset it; a non-paused deadline reports once. An active SFU cadence treats an absent track/report or stats failure as no progress without fabricating metrics and stops only on deactivation/teardown. Other current-path stats remain diagnostic and cannot prove another parent better.
-- ADR-0007 accepts pinned-default VP8 half-resolution plus original-resolution SFU representations, Dynacast, server send-side BWE, and no AdaptiveStream for potential relays. Current source implements it; production remains single-encoding until cutover.
+- ADR-0007's two VP8 SFU representations, Dynacast, server send-side BWE, and disabled AdaptiveStream for potential relays are the deployed framework model. Production still gives the half-resolution representation the highest representation's FPS; the accepted correction caps that lower representation at 30 fps with proportionally derived bitrate. Screener adds no media-layer selector.
 - Browser capture requests available share audio by default on initial capture and source switch, with an explicit video-only warning when no audio track is returned. Its screen-audio control offers live-switchable 64/128/256 kbps sender ceilings and defaults to 128. The last-wins quality wire owns desired state; each endpoint serially applies and reads back current Host/relay/SFU audio senders, exposes local failures, and gives future senders the latest desired value. Opus remains fixed, and without an applied-ack wire the Host does not claim room-wide atomic convergence. These are configuration ceilings, not fidelity claims.
 - Browser display video leaves `contentHint` unset so Chromium retains its screen-capture classification; returned audio tracks keep `contentHint = "music"`. Browser video is fixed to VP8 across direct, browser-relay, and SFU paths; codec selection, fallback to another media codec, quality-state/wire fields, and share-lifetime codec branches are not product features. Actual codec/profile/encoder stats remain diagnostic only.
 - Recommended quality remains exactly `1080p60`, `1080p30`, and `720p30`, with the middle `1080p30` as the accepted default. `480p` means only an advanced `854x480` resolution choice whose FPS and bitrate remain independently selected; it is not a fourth recommended profile.
@@ -29,18 +29,18 @@ Last updated: 2026-08-25
 
 ## Current Source And Production
 
-- Production runs exact application/runtime revision `1d8761528d0dba43fb6d818df3934483ba2f5340`, release `1d87615`, on strict `screener-v12`; canonical `main` is newer and pending deployment.
-- Current source and production admit up to `20` Viewers and implement the uniform `1/2/3` endpoint cap, exact prepare candidate, first-decoded-frame commit, strict rollback revision, decoded-progress stall, one direct/SFU operation deadline, and one event-driven controller. Current source keeps active-SFU sampling alive through an absent track/report or stats failure; production retains the reproduced gap. Ordinary peer ICE is STUN-only and the sole application fallback is SFU/UDP. Exact SFU admission and empty Browser SFU ICE-server options remain unchanged; Chrome 151 closed release `1d87615`'s single-representation UDP gate.
+- Production runs exact application/runtime revision `e14eb0e3e62731a43dca8ff92fa6d5165c8267a3`, release `e14eb0e`, on strict `screener-v12`; canonical `main` contains that deployed application tree plus current truth.
+- Current source and production admit up to `20` Viewers and implement the uniform `1/2/3` endpoint cap, exact prepare candidate, first-decoded-frame commit, strict rollback revision, decoded-progress stall, one direct/SFU operation deadline, and one event-driven controller. Active-SFU sampling remains live through an absent track/report or stats failure. Ordinary peer ICE is STUN-only and the sole application fallback is SFU/UDP. Exact SFU admission and empty Browser SFU ICE-server options remain unchanged.
 - Source and production use random four-digit memory rooms, dormant leases, exact-Host resume, restart loss, local preference replay, orthogonal grants/code entry, and no SQLite runtime. V12 uses a 22-character room-incarnation grant, `ROOM_NOT_FOUND`, no diagnostic-file export, and a compact UI showing the complete shorter URL.
 - Exact production artifacts, services, ports, and any change-scoped infrastructure recovery boundary are owned by [deployment](./deployment.md) and indexed by [status](./status.md).
-- Source and production require v12, fixed VP8, and no video hint. Current source uses pinned-default SFU half-resolution plus original-resolution simulcast and Dynacast; production retains one encoding with Dynacast off. Other current media and UI behavior matches the truths above.
+- Source and production require v12, fixed VP8, and no video hint, and currently use pinned-default SFU half-resolution plus original-resolution simulcast, Dynacast, and server send-side BWE. The lightweight lower-representation correction is accepted but not yet implemented or deployed. Other current media and UI behavior matches the truths above.
 - Browser SFU subscribers reconcile eligible Host screen publications across connect/activate event ordering, participant/track arrival, and reconnect. Production LiveKit logs only warn/error, and the application service has a bounded same-host LiveKit readiness preflight.
-- Exact deployed source `1d87615` passed TypeScript, 607 Web tests, both builds, hygiene, three reviews, production postflight, one no-RID SFU encoding gate, and a controlled exact-candidate rollback/SFU commit gate with progressing publisher/subscriber frames over LiveKit UDP. Earlier gates closed direct/browser-relay VP8 cadence and active-audio ceilings; representative networks, all-UDP-blocked failure, public SFU 60 fps, and real-game synchronization remain unproven. Exact metrics live in [verification status](./verification-status.md).
+- The deployed application tree passed TypeScript, 611 Web tests, both builds, hygiene, immutable artifact verification, and production postflight. Earlier exact-production gates closed direct/browser-relay VP8 cadence, active-audio ceilings, a single-representation SFU baseline, and one controlled exact-candidate SFU commit; the pinned-stack gate proved native representation selection. Controlled recovery on this release, representative networks, all-UDP-blocked failure, public SFU 60 fps, and real-game synchronization remain unproven. Exact metrics live in [verification status](./verification-status.md).
 - Chrome loopback, cap2/cap3, short resource, recovery, MBB, and A/V fixtures are bounded evidence only. They do not establish quality, resource limits, or product policy.
 
 ## Current Priority
 
-1. Deploy the implemented LiveKit-native dual-representation/Dynacast/send-side-BWE model and active-SFU decoded-progress cadence, repeat controlled recovery, and finish real-network route, screen-audio, and real-game A/V acceptance. VP8 acceleration, mobile lifecycle, Native, distribution, and repository simplification remain later.
+1. Correct the SFU lower-representation cost without removing constrained-Viewer support, then repeat controlled active-SFU recovery and finish real-network route, screen-audio, and real-game A/V acceptance. VP8 acceleration, mobile lifecycle, Native, distribution, and repository simplification remain later.
 
 The desktop Host background/minimized report is deferred until it reproduces on current production with a real game and synchronized media plus CPU/GPU evidence. The bounded current-Chrome screening found no immediate Host-page lifecycle drop, and removal of the old harmful `contentHint = "motion"` remains a plausible confound rather than a proven background fix. Mobile Viewer playback and assigned-relay survival remain a separate lifecycle gate.
 

docs/research/realtime-quality-adaptation.md

@@ -12,8 +12,7 @@ game UI, maps, subtitles, and text become unreadable; `maintain-resolution`
 may instead lower frame rate. Neither preference overrides congestion control.
 
 Production runs exact deployed application/runtime revision
-`1d8761528d0dba43fb6d818df3934483ba2f5340`, release `1d87615`; canonical
-`main` contains newer SFU publication source pending deployment. Current Browser source and production use
+`e14eb0e3e62731a43dca8ff92fa6d5165c8267a3`, release `e14eb0e`. Current Browser source and production use
 strict `screener-v12`, fixed VP8, no video `contentHint`, and no codec UI,
 quality state, or wire field. They use `balanced` as the recommended profile
 and advanced default;
@@ -108,6 +107,45 @@ stays disabled for current subscribers because every Viewer may become a relay.
 The earlier dual-encode cost is handled through explicit Host share profiles,
 not by silently abandoning low-bandwidth Viewers.
 
+## 2026-08-25 Content Classification And Bounded Scaling Gate
+
+Chrome `151.0.7922.174` exercised one real `getDisplayMedia()` track, one VP8
+P2P sender/receiver pair, `maintain-framerate`, and the same deterministic
+moving 1904x928 source for 30-second windows. At an 8 Mbps ceiling, no video
+hint held about 60 fps at 1904x928 and about 8 Mbps with no resolution changes.
+`contentHint = "motion"` held 60 fps but the native quality scaler reduced the
+track and sender to 242x118 and remained there through the steady window.
+Applying an 854x480 minimum track constraint before the motion run did not form
+an encoder floor: the steady sender was 428x208 at about 60 fps and 8 Mbps.
+
+The result matches Chrome's exact libwebrtc pin: VP8 automatic resize is disabled
+for a screencast and enabled only for a realtime, single-active-stream encoder.
+The motion hint therefore restores native bandwidth/QP spatial scaling by
+changing the whole content classification, not by enabling an independent
+quality switch. The available standard track constraint does not bound that
+internal encoder scaling. Restoring motion would recover multiple resolution
+steps but can make game UI unreadable, so current source must not restore it as
+a global or fluid-profile shortcut.
+
+This gate proves the mechanism, not visual quality for every game. It also means
+the no-hint result is not a free efficiency gain: it preserves screen encoding
+semantics and resolution while shifting pressure into quantization or frame
+drops. A future bounded P2P spatial controller is a separate product mechanism,
+not a hidden consequence of `degradationPreference`.
+
+The same production session exposed the separate SFU ingress boundary. A
+1440p60/8 Mbps publication advertised a same-FPS half-resolution 2 Mbps lower
+representation. The SFU Viewer received the highest representation at
+2400x1350, about 37 fps and 1.84 Mbps while its downlink reported 54 ms RTT and
+zero loss; the simultaneous P2P Viewer received about 59 fps and 5 Mbps. A
+server interval measured about 4.46 Mbps ingress and 2.63 Mbps egress, consistent
+with the unforwarded lower representation consuming Host-to-SFU budget. Later,
+the native allocator selected only LOW and an RTP-layer sample observed LOW
+traffic with no HIGH traffic, so downstream layer selection itself was not
+stuck. The accepted correction keeps that native selector and reduces only the
+60 fps lower representation to at most 30 fps using the SDK's proportional
+bitrate formula.
+
 ## Route Quality Authority
 
 Current-path WebRTC stats can diagnose loss, RTT, jitter, bitrate, resolution,

docs/status.md

@@ -6,14 +6,14 @@ This is the current execution index. Git history owns completed timelines; [veri
 
 ## Production
 
-- `https://share.bonfire.icu` runs exact deployed application/runtime revision `1d8761528d0dba43fb6d818df3934483ba2f5340`, release `1d87615`, wire `screener-v12`, from `/opt/screener/releases/1d87615`; that revision is integrated in canonical `main`. Its immutable runtime ZIP SHA-256 is `715480487059bf83516a34e0d1083b52437619838c46bdc26ca5967529a1cf05`, and its 38-file manifest SHA-256 is `96845789560394ca20b16c37a8e7ddadc7b488876e32241709d0f7a577fdca26`.
-- `screener`, LiveKit, coturn, and nginx are active/running; local/public `/healthz` and the served Browser asset match the immutable release, and all four services report `NRestarts=0`. The main Browser asset is `assets/index-DfMqhOXY.js` with SHA-256 `cf6dd1c46cc9414a87331a9312eec315ddce8fce565741284998aa0141b18d47`; the prior asset returns 404.
-- The service process resolves its working directory to exact release `1d87615`; it has no writable room `StateDirectory` or SQLite runtime.
+- `https://share.bonfire.icu` runs exact deployed application/runtime revision `e14eb0e3e62731a43dca8ff92fa6d5165c8267a3`, release `e14eb0e`, wire `screener-v12`, from `/opt/screener/releases/e14eb0e`; that revision is integrated in canonical `main`. Its immutable runtime tar SHA-256 is `59368004dce38a8497aef46fa27c052884208ae90fa1a9fad6981084f8d408d5`, and its 39-file manifest SHA-256 is `36c5d7594ec9c8e96e98dab25c652de5ee69bf0419c2df4b26a20d5d1c887773`.
+- `screener`, LiveKit, coturn, and nginx are active/running; local/public `/healthz` and the served Browser asset match the immutable release, and all four services report `NRestarts=0`. The main Browser asset is `assets/index-Bjcb0_oa.js` with SHA-256 `87405412b926b7b6227801b706fd5eee61b8b907bba8629813315876a526c055`; predecessor asset `assets/index-DfMqhOXY.js` returns 404.
+- The service process resolves its working directory to exact release `e14eb0e`; it has no writable room `StateDirectory` or SQLite runtime.
 - Production admits one Host plus 20 Viewers, applies endpoint capacity `2`, rejects stale Browser and executable-sender wires before room authority, and runs the one-controller exact-candidate route model with one staged total deadline. Rooms use random free four-digit codes, a 24-hour dormant lease, restart loss, local Host creation preferences, a room-lived 22-character Viewer grant, and exactly `open | private` code entry. Private rooms without a password are invitation-only; configuring one additionally permits matching code-and-password entry. LiveKit remains dedicated with `room.auto_create: false`, `max_participants: 21`, and global admission `1` publication ingress / `20` subscription egress.
 - Production media ports remain STUN-only UDP 3478 and LiveKit UDP 7882; coturn TCP/TLS, port 5349, media TCP, and relay ranges are disabled. The public Web ingress remains TCP 80/443; Node 8787 and LiveKit control/signaling 7880 are internal-only. The stable `inet bonfire_filter` table SHA-256 is `afaf9d066e9f292d8bd19032b38c0978ccf60dd01c2fe7f210968ff751f90534`; the dynamic fail2ban table is excluded from that identity.
-- SFU subscribers reconcile Host screen publications across connect, activation, participant arrival, track publication, and reconnect. LiveKit runs at `warn`/Pion `error`, and the Screener unit waits boundedly for the same-host LiveKit control listener before startup. The current postflight found healthy unchanged services; exact-production direct, Browser-relay, single-representation SFU, and controlled direct-rollback-to-SFU gates are closed. A later exact-production subscriber-PC closure injection exposed the decoded-progress cadence defect described below; it is not physical network-loss evidence, so recovery and broader real-network acceptance remain open.
+- SFU subscribers reconcile Host screen publications across connect, activation, participant arrival, track publication, and reconnect. LiveKit runs at `warn`/Pion `error`, and the Screener unit waits boundedly for the same-host LiveKit control listener before startup. The decoded-progress cadence correction is deployed; the earlier subscriber-PC closure remains only the reproduction, so a controlled recovery transaction and physical network-loss evidence remain open.
 - Production Browser SFU publisher and subscriber PCs explicitly use empty external ICE-server lists while retaining LiveKit-signaled UDP candidates. The owner verified that the deployed isolation fixes the reported SFU connection failure; the prior P1 core-route hold is closed.
-- Production leaves video `contentHint` unset, keeps audio `contentHint = "music"`, and fixes Browser direct, browser-relay, and SFU video to VP8 without codec UI, quality state, wire fields, or fallback media codecs. Its SFU publisher uses exactly one `HIGH` encoding with `simulcast: false`, no subscriber quality selector, and explicit `dynacast: false`.
+- Production leaves video `contentHint` unset, keeps audio `contentHint = "music"`, and fixes Browser direct, browser-relay, and SFU video to VP8 without codec UI, quality state, wire fields, or fallback media codecs. Its SFU publisher leaves screen-share layers to pinned LiveKit's half-resolution plus original-resolution defaults, enables Dynacast and server send-side BWE, keeps AdaptiveStream disabled, and adds no Screener layer selector.
 
 ## Current Source
 
@@ -25,11 +25,11 @@ This is the current execution index. Git history owns completed timelines; [veri
 - Current source leaves video `contentHint` unset and keeps audio `contentHint = "music"`. Browser direct and browser-relay offers contain VP8 as their only media codec. SFU publication fixes VP8 with no backup codec, leaves screen-share simulcast layers unset so pinned client `2.22.0` supplies its half-resolution plus original-resolution pair, enables Dynacast, retains LiveKit's default maximum subscriber ceiling, and keeps AdaptiveStream disabled. Codec UI, quality state, wire fields, fallback media codecs, and share-lifetime codec branches are absent. Live 64/128/256 kbps audio-ceiling mutation remains unchanged; ordinary Host and SFU publisher metrics select the exact current sender, relays reconcile audio-track additions and removals on the persistent stream, and an SFU reconnect reacquires the exact current publication/sender, avoids unchanged parameter/stat resets, or fails the route closed.
 - Current source implements typed first-frame Viewer presentation and recovery, Chinese user-facing route/access failures, local connection details without a diagnostic-file export, authenticated Host-only on-demand route snapshots for automatic acceptance, explicit missing-room presentation, and responsive entry controls. Host invitation controls remain independent from two-state room-code entry.
 - Recommended quality remains exactly `1080p60`, `1080p30`, and `720p30`; current source defaults to `1080p30`. Advanced resolution adds `480p` as `854x480` without adding a fourth preset, and advanced FPS and bitrate remain independent.
-- Exact deployed source `1d87615` passed repository hygiene, TypeScript, all 607 Web tests in 44 files, both production builds, three independent reviews, immutable deployment postflight, the Chrome 151 single-representation SFU gate, and the controlled direct-rollback-to-SFU transaction. Earlier exact-production gates exercised direct, browser-relay, SFU audio continuity and all three audio ceilings, and sustained about 59.5 fps on direct and browser-relay paths; exact applicability remains in [verification status](./verification-status.md).
+- The deployed application tree passed repository hygiene, TypeScript, all 611 Web tests in 44 files, both production builds, and immutable artifact/postflight checks. Earlier exact-production gates exercised direct, browser-relay, SFU audio continuity and all three audio ceilings, and sustained about 59.5 fps on direct and browser-relay paths; the pinned-stack gate proved native two-representation selection before deployment. Exact applicability remains in [verification status](./verification-status.md).
 
 ## Current Milestone
 
-1. Deploy current source with ADR-0007's pinned-default VP8 dual representation, Dynacast, server send-side BWE, and active-SFU decoded-progress cadence; repeat the controlled recovery transaction and finish representative ICE/STUN/SFU acceptance including screen-audio continuity and real-game A/V sync on mobile and heterogeneous networks. Browser port prediction, NAT classification, TCP probing, fake page keepalive, and quality-driven reparenting remain outside the accepted model.
+1. Apply and verify ADR-0007's lightweight half-resolution representation, then repeat the controlled active-SFU recovery transaction on exact production and finish representative ICE/STUN/SFU acceptance including screen-audio continuity and real-game A/V sync on mobile and heterogeneous networks. Browser port prediction, NAT classification, TCP probing, fake page keepalive, and quality-driven reparenting remain outside the accepted model.
 
 ## Active Boundaries
 
@@ -42,7 +42,7 @@ This is the current execution index. Git history owns completed timelines; [veri
 
 ## Current Hold
 
-The reproduced active-SFU decoded-progress starvation is a P1 core-route hold for
-the current route-acceptance phase until its single-cadence correction is deployed
-and the controlled recovery transaction passes. Native/executable work and broad
-repository cleanup remain outside the current evidence boundary.
+The active-SFU cadence correction is deployed, but the controlled recovery
+transaction has not yet been repeated on this release. That exact proof remains
+the P1 hold for route acceptance. Native/executable work and broad repository
+cleanup remain outside the current evidence boundary.

docs/todo.md

@@ -6,8 +6,8 @@ Only items in **Now** are executable after their stated decision gate. A branch
 
 ## Now
 
-1. **Deploy native SFU representation adaptation.** Current source publishes the pinned-default VP8 half-resolution plus original-resolution screen-share representations, enables Dynacast, and tracks LiveKit server send-side BWE while keeping AdaptiveStream disabled because any Viewer may become a relay. Deploy and verify that exact combination without adding a Screener quality controller or falling back to one encoding for Host resource protection.
-2. **Finish real-network route acceptance.** Deploy the current-source active-SFU decoded-progress cadence correction and repeat the controlled recovery transaction. Then measure standard ICE/STUN direct paths, peer relay, SFU ingress/subscription, relay-ingress repair with subtree retention, disconnect/capacity drain, Pause/Resume, screen-audio continuity and real-game A/V sync across representative IPv4/IPv6 NATs and mobile networks. Include an all-UDP-blocked case to establish bounded explicit failure. Do not add another watchdog, port prediction, NAT classification, TCP probes, guessed candidates, route scores, or quality-driven reparenting.
+1. **Correct constrained SFU publication quality.** Keep the two LiveKit-owned VP8 spatial representations, Dynacast, send-side BWE, and no AdaptiveStream. Cap the half-resolution representation at 30 fps and derive its bitrate from the pinned SDK's proportional formula, including live profile updates. In the same mixed P2P/SFU dynamic-source gate, verify that HIGH recovers materially, P2P does not regress, and a constrained SFU downlink still selects and decodes LOW before deployment. Do not restore global `motion`, add more simulcast encodings, return to single HIGH, or add a Screener layer selector.
+2. **Finish real-network route acceptance.** Repeat the controlled active-SFU recovery transaction on exact production. Then measure standard ICE/STUN direct paths, peer relay, SFU ingress/subscription, relay-ingress repair with subtree retention, disconnect/capacity drain, Pause/Resume, screen-audio continuity and real-game A/V sync across representative IPv4/IPv6 NATs and mobile networks. Include Host and Viewer TUN/VPN cases and an all-UDP-blocked case to distinguish an application ICE-option defect from operating-system interception and establish bounded explicit failure. Do not add another watchdog, port prediction, NAT classification, TCP probes, guessed candidates, route scores, or quality-driven reparenting.
 
 ## Accepted Later Roadmap
 
@@ -20,7 +20,7 @@ These items are real product work, ordered after the current physical-media, rea
 5. **Fully local one-click Host-server package.** Package Windows/macOS/Linux Host capture, the exact application server and local state without requiring source, Node or any external Screener/STUN/SFU/tunnel/relay service. Preserve usable direct P2P and use the completed NAT/network evidence to maximize reachability, while reporting public-origin, gateway, NAT and firewall limits truthfully; loopback/LAN success is not universal Internet success.
 6. **Native Host capture backend.** At lowest priority, productize a proven Windows native capture path before expanding capture/audio backends to macOS and Linux. Its capture, hardware encode, audio, identity and lifecycle evidence becomes an input to later packages; a source checkout, helper executable, or evaluation ZIP is not a distributable product.
 7. **Native shared encode, Windows first.** At lowest priority, prove one hardware encoder output can serve two independent Viewer transports and the Host-SFU publication while each connection retains its own RTP/RTCP, pacing, encryption, feedback, and upload accounting. Productize only after actual access-unit identity, Viewer2/FIFO, heterogeneous feedback, game-resource, browser/hardware, A/V, packaging, and licensing gates pass. Web Host/relay remains standard per-`RTCPeerConnection` encoding because no portable shared-encoder contract exists.
-8. **Whole-product UI polish and bilingual-scope decision.** After current functional, physical-media, and real-network work stabilizes, review the product UI once as a whole: simplify and align copy, refine responsive hierarchy and visual consistency, add restrained motion, and measure rendering and bundle cost. Decide Chinese/English scope, default/fallback and switching persistence before introducing one shared text catalog; do not add duplicate screen-specific translations or let presentation redefine room and route semantics.
+8. **Whole-product UI polish and bilingual-scope decision.** After current functional, physical-media, and real-network work stabilizes, review the product UI once as a whole: simplify and align copy, refine responsive hierarchy and visual consistency, add restrained motion, and measure rendering and bundle cost. Connection presentation uses the two user-facing media labels `P2P` and `SFU` without naming SFU as fallback. A completed reconnect must clear stale “正在重连” stage copy, while retained notices gain an explicit close action. The compact Host roster shows each Viewer's IP for duplicate-name disambiguation without waiting for expanded details; its exact source and data boundary remain part of that task. Decide Chinese/English scope, default/fallback and switching persistence before introducing one shared text catalog; do not add duplicate screen-specific translations or let presentation redefine room and route semantics.
 9. **Repository simplification audit.** After the current Browser, physical-media, route, and room checkpoints settle, inventory components, configuration, migrations, gates, timers, compatibility paths, tests, and truth-document duplication using the [maintenance review](./maintenance.md#机制减负审查). Begin read-only: identify the behavior or decision each surface preserves and compare that value with its whole-system cost. Any accepted feature tradeoff updates its single owning contract before complete unused surfaces are removed. This later audit must not become a broad refactor or block current product work.
 
 ## Product Decisions Needed