docs(deploy): correct Host-name rollback truth

Align deployment truth snapshots with the 2026-08-20 Host-name rollback and current healthy runtime. No runtime changes.

docs/deployment.md

@@ -21,8 +21,9 @@ configuration and firewall range, but the application advertises no credential.
 
 Production currently runs `fdd14ba0d9b5ea4c43aa0f6a3a29e0eacf182612` for exact
 room `1` on the existing shared public IP, with health 200 and SQLite v3. The
-preceding `fdd14ba` deployment completed successfully and remains the rollback
-target. Rolling back the admission-policy cutover requires
+current Screener, LiveKit, coturn, and nginx services each report
+`NRestarts=0`. The preceding `fdd14ba` deployment completed successfully and
+remains the rollback target. Rolling back the admission-policy cutover requires
 `89e6d7649169` plus the environment backup recorded below; only deeper
 pre-access `9610032fc5f5` may restore matching v1 state. The production
 application TURN tuple is absent and the failed canary backup is inactive. This
@@ -405,18 +406,18 @@ lock remained; the immutable upload, active release, and backups are retained.
 No real room triggered admission rescue, so this verifies deployment and
 rollback readiness, not the new route transition or media quality.
 
-The subsequent Host display-name candidate used exact source
+The sole Host display-name cutover attempt used exact source
 `61a87ae47e38abc943cef47b3d7318bb51bf86d6` and artifact
 `screener-61a87ae47e38abc943cef47b3d7318bb51bf86d6-20260820T143538Z.tar.gz`
 (883597 bytes, SHA-256
-`d5b4d6cc567ba96ce37f8eb9934dd5822c64dc084796047d5f6d6217e2e74acb`). The
-ephemeral deployment wrapper reached `RELEASE_PREPARED` but omitted the
-`mv` from the prepared stage into `release`; systemd then reported
-`status=200/CHDIR`. The application and database were not the cause. Automatic
-rollback left `fdd14ba0d9b5` active and healthy, with SQLite v3 retaining four
-rooms including room `1`; Screener `NRestarts=31`, while LiveKit, coturn, and
-nginx were 0. Host display-name remains source-only/not deployed. No
-selected-edge TURN enablement occurred.
+`d5b4d6cc567ba96ce37f8eb9934dd5822c64dc084796047d5f6d6217e2e74acb`). It ran at
+`2026-08-20T16:09Z`; the prepare-to-release switch and health gate passed, but a
+post-cutover assertion compared against stale `NRestarts=31` data and triggered
+automatic rollback. The application and database were not the cause. Rollback
+left `fdd14ba0d9b5` active and healthy, with SQLite v3 retaining four rooms
+including room `1`; the current Screener, LiveKit, coturn, and nginx services
+each report `NRestarts=0`. Host display-name remains source-only/not deployed.
+No selected-edge TURN enablement occurred.
 
 Enabling persistence does not migrate rooms that existed only in memory. The
 deployment restart invalidates those temporary links; the first subsequently

docs/project-memory.md

@@ -39,11 +39,11 @@ Last updated: 2026-08-20
 ## Current Implementation
 
 - The repository is one npm package using Node.js 24, React, TypeScript, Vite, native WebRTC, `ws`, Zod, Vitest, and separate coturn.
-- Production currently serves `fdd14ba0d9b5ea4c43aa0f6a3a29e0eacf182612` at `https://share.bonfire.icu` after automatic rollback from the attempted `61a87ae47e38abc943cef47b3d7318bb51bf86d6` Host display-name activation. Health is 200; SQLite v3 retains four rooms including room `1`. Room `1` alone enables peer/SFU routing, C+B local reparenting, and admission rescue; unlisted rooms remain ordinary P2P. The preceding `31bee238` release remains historical rollback evidence.
-- The `61a87ae` artifact was prepared but the ephemeral wrapper omitted `mv` from `RELEASE_PREPARED` into `release`, producing systemd `status=200/CHDIR`; this was an activation-wrapper failure, not an application or database failure. Screener `NRestarts=31` reflects the attempt; LiveKit, coturn, and nginx were 0. Selected-edge TURN remains disabled.
+- Production currently serves `fdd14ba0d9b5ea4c43aa0f6a3a29e0eacf182612` at `https://share.bonfire.icu` after the single Host display-name cutover attempt at `2026-08-20T16:09Z` was automatically rolled back. The prepare-to-release switch and health gate passed; a post-cutover assertion used stale `NRestarts=31` data and triggered the rollback. Health is 200 and SQLite v3 retains four rooms including room `1`. Room `1` alone enables peer/SFU routing, C+B local reparenting, and admission rescue; unlisted rooms remain ordinary P2P. The preceding `31bee238` release remains historical rollback evidence.
+- The current Screener, LiveKit, coturn, and nginx services each report `NRestarts=0`. The Host display-name artifact was not retained as an active release, so Host names remain source-only/not deployed; selected-edge TURN remains disabled.
 - Production ICE is STUN-only; stale `PEER_ICE_TURN_*` keys fail startup even blank. Source has a default-off coturn REST rebuild for the original failed Host/ViewerRelay edge after Viewer-root SFU exhaustion; it is undeployed/unverified and production advertises no TURN credential.
 - Production requires an independent `HOST_ADMISSION_PASSWORD` only for creation/Host role. Default private fragment grants, room passwords, and explicit public-watch authorize Viewers; four anonymous Chrome routes stayed neutral until authorization. There are no accounts/JWT/session rows; SQLite v3 still contains all four rooms, including room `1`.
-- Production uses nginx, Node.js 24.19.0, coturn 4.17.2, and pinned LiveKit 1.13.5 on UDP 7882 with TCP fallback disabled. The application TURN tuple is absent; coturn retains the old authenticated-relay config and TCP/UDP 3478 plus UDP 49152-49251 rules but receives no advertised credential. Current service state is health 200 with Screener `NRestarts=31` from the failed activation sequence and LiveKit/coturn/nginx at 0.
+- Production uses nginx, Node.js 24.19.0, coturn 4.17.2, and pinned LiveKit 1.13.5 on UDP 7882 with TCP fallback disabled. The application TURN tuple is absent; coturn retains the old authenticated-relay config and TCP/UDP 3478 plus UDP 49152-49251 rules but receives no advertised credential. Current service state is health 200 with all four service restart counts at 0.
 - ADR-0005 is configured with exact `PEER_ASSISTED_ROOM_IDS=1`; unlisted rooms use ordinary P2P. `screener-v2` is the only deployed signaling literal; there is no v1 parser or translator.
 - Chrome 151/LiveKit localhost A/B cut failure-to-active/render from 1.481/2.257 seconds to 0.200/0.320; 31 new frames and 25 ms sampling kept host edges at two. It is headless synthetic 720p30 and includes SDK/network prewarm, not public-network evidence.
 - Chrome 151 synthetic topology/quality-control runs kept fanout 2/1 and all viewers decoding; one relay close recovered in 5.32 seconds. This is control evidence only.

docs/status.md

@@ -5,19 +5,16 @@ Last updated: 2026-08-20
 ## Phase
 
 `https://share.bonfire.icu` currently serves `fdd14ba0d9b5ea4c43aa0f6a3a29e0eacf182612`
-with health 200 after an automatic rollback from the attempted
-`61a87ae47e38abc943cef47b3d7318bb51bf86d6` Host display-name deployment. The
-ephemeral wrapper reached `RELEASE_PREPARED` but omitted the `mv` from its
-prepared stage into `release`; systemd reported `status=200/CHDIR`. The
-application and database were not the failure cause. SQLite v3 still has four
-rooms including room `1`; Screener `NRestarts=31` records the failed activation
-sequence, while LiveKit, coturn, and nginx remained at zero. Host display names
-remain source-only and are not deployed.
+with health 200 after the sole Host display-name cutover at `2026-08-20T16:09Z`.
+Prepare/release and health passed; a stale `NRestarts=31` assertion triggered
+automatic rollback. SQLite v3 has four rooms including room `1`; the
+application/database stayed healthy, and current Screener, LiveKit, coturn, and
+nginx services each report `NRestarts=0`. Host display names remain
+source-only/not deployed.
 Ordinary ICE is STUN-only process-wide; persistent room `1` alone enables the
 automatic peer/SFU-UDP controller with at most two SFU roots. The old
-`fdd14ba0d9b5` is the current healthy rollback target with the v3 DB/env;
-older schema rollback boundaries are in `docs/deployment.md`. Native remains
-no-go and is not part of production.
+`fdd14ba0d9b5` is the healthy v3 rollback target; older schema details are in
+`docs/deployment.md`. Native is no-go and not in production.
 
 ## Current Snapshot
 
@@ -42,7 +39,7 @@ no-go and is not part of production.
 - Native VP8 loopback (Chrome 151) reached one Viewer: 30 sender frames, 85 source RTP packets, 877 inbound packets, 299 decoded/rendered at 1280x720, no fatal. Pion outbound delta missed a 2s refresh; hardware/multi-viewer/FIFO/endurance/public/native proof remains open.
 - Access protocol/config/HTTP/storage/SQLite/signaling focused tests pass, including commit-first teardown and v1 rollback.
 - Selected-edge typecheck and 131 focused control tests pass; no TURN allocation/media evidence exists.
-- Prepared artifact `screener-61a87ae47e38abc943cef47b3d7318bb51bf86d6-20260820T143538Z.tar.gz` (883597 bytes, SHA-256 `d5b4d6cc567ba96ce37f8eb9934dd5822c64dc084796047d5f6d6217e2e74acb`) was never activated; rollback left `fdd14ba` healthy and selected-edge TURN disabled.
+- Prepared artifact `screener-61a87ae47e38abc943cef47b3d7318bb51bf86d6-20260820T143538Z.tar.gz` (883597 bytes, SHA-256 `d5b4d6cc567ba96ce37f8eb9934dd5822c64dc084796047d5f6d6217e2e74acb`) was the sole Host-name cutover candidate. Its prepare-to-release and health gates passed before the stale restart-count assertion caused automatic rollback; `fdd14ba` is healthy with all four service restart counts at 0, and Host display-name remains source-only. Selected-edge TURN is disabled.
 
 ## Unverified Boundaries