docs(native): record post-fix one-viewer no-go (#74)

docs/adr/0006-fixed-high-native-sender-canary.md

@@ -111,17 +111,32 @@ one `fatal` with the fixed sanitized message `local media bridge read failed`.
 Focused tests prove the abnormal classification without its underlying close
 reason and prove normal close and app shutdown do not misreport. This is a real
 P1 bridge-read failure fix, but it does not classify the retained zero counters
-or prove a framing defect. The current unrun gate still records only bounded
-attempt/synchronous-return/synchronous-throw counters for the first local bridge
-generation and rechecks that identity at Viewer signal, Viewer media, and final
-success. Pure tests reject late replacement. No Chrome rerun occurred; another
-run requires separate authorization. There is still no Viewer, two-viewer, FIFO,
-or physical/hardware-encoder proof.
+or prove a framing defect.
+
+One authorized post-fix revalidation then ran the frozen gate exactly once on
+exact source `86386b75d01919b213f5725467e495cdd0aa9a54`, fixed VP8 `HIGH`,
+Chrome 151, one in-memory local room, and peer assistance disabled. Its flushed
+ledger reached sequence 6 and retained capture request/resolution, Host
+admission/create/WSS, local bridge readiness and config acceptance, first
+encoded output, one encoder object, bridge generation 1, and one binary send
+attempt that returned synchronously without a throw. Go retained zero frames,
+source-RTP packets, and source-RTP bytes, so the first failed stage was
+`sender-start` and no Viewer was created. Chrome, Native, Node, all task ports,
+and the exact task profile then cleaned up before the result was finalized. No
+retry, threshold change, H.264, second Viewer, FIFO, or production run followed.
+
+The result remains `no-go-unclassified`. It proves the first product binary
+send returned, narrowing the retained interval to after that return and before
+Go frame accounting. It does not prove Go read or decode, and the fixed bridge
+fatal is not part of this failure ledger, so no raw cause may be inferred. A
+separate minimal diagnostic or fix slice must classify this interval before any
+further Chrome run. There is still no Viewer, two-viewer, FIFO, or physical or
+hardware-encoder proof.
 
 ## Staged Revalidation
 
-A new run requires separate authorization and must stop at the first failed
-stage while synchronously retaining a bounded final-negative snapshot:
+Any further run requires separate authorization and must stop at the first
+failed stage while synchronously retaining a bounded final-negative snapshot:
 
 1. Prove host room/auth, local config acknowledgement, one encoder object,
    bridge ingress, frame decode, source RTP, and zero critical errors.

docs/project-memory.md

@@ -23,7 +23,7 @@ Last updated: 2026-08-20
 - Use direct host P2P for one or two viewers. Keep ADR-0004 off broadly; use an isolated exact-room candidate until resource, quality, recovery, SFU/UDP, bounded-failure, and browser/mobile gates pass.
 - Browser relays resend remote `MediaStreamTrack` values and re-encode at each hop; WebRTC does not guarantee a shared encoder across peer connections, so measure the cost.
 - Keep experiments bounded: the standard representation sequence is below; native RTP relay, encoded-object striping, and FEC remain separate.
-- ADR-0006 stays no-go: retained Chrome reached WebCodecs output, then Go frame/RTP stayed zero and no Viewer was created. A real `/media` integration now accepts the current 17-byte binary frame into Go frame/RTP; unexpected post-config reads emit a fixed sanitized fatal. No Chrome rerun occurred, so the retained product-send/framing cause remains unproved. A separate MF fixture proved RTX H.264 hardware over 360/360 frames, but `42c01f` misses Pion's default fmtp; Viewer interop remains unproven. Native v2 stays memory-only and leaves SQLite/Web unchanged.
+- ADR-0006 stays no-go: one post-fix run retained VP8 output and one first-generation binary `send()` return, but Go frame/RTP stayed zero, so no Viewer was created; cleanup passed and no retry followed. The fixed bridge fatal was not retained, so the break after browser send return and before Go accounting remains unclassified. A separate MF fixture proved RTX H.264 hardware over 360/360 frames, but `42c01f` misses Pion's default fmtp; Viewer interop remains unproven. Native v2 stays memory-only and leaves SQLite/Web unchanged.
 - Mobile Web Host is unsupported; feature-detect and fail clearly. Mobile Viewer stays leaf-only. After Windows native, gate Android 14+; iOS waits for stable iOS 27 ScreenCaptureKit.
 - ADR-0005 accepts direct/peer UDP, bounded SFU roots, then optional selected-edge TURN. The built-in participant-wide candidate failed its real direct acceptance before forced relay and rolled back completely; it is rejected as the product path. Production advertises STUN-only ICE.
 - Keep the controller exact-room only: room `1` is the STUN/SFU smoke. Preserve sticky progressing P2P, mobile leaves and break-before-make. Recovery spends one attempt per layer (ICE restart, same-parent rebuild, alternate peer, then SFU), never three identical retries; active SFU gets one fresh grant before Peer failback.

docs/research/native-shared-encode-sender.md

@@ -296,17 +296,39 @@ post-config close, normal close, and app shutdown. All Go tests, vet, Windows
 amd64 no-CGO build, TypeScript typecheck, and the relevant bridge probe/ledger
 tests pass.
 
-The retained first break interval is still after WebCodecs output callback entry
-and before Go frame/source-RTP accounting. This fix does not prove the retained
-zero counters came from a read error or framing defect. The current unrun probe
-still binds the first actual local media WebSocket as gate-local generation 1
-and records only bounded binary-send attempt, synchronous-return, and
-synchronous-throw counters. A second bridge generation saturates at 2, stops
+One authorized post-fix run then used exact source
+`86386b75d01919b213f5725467e495cdd0aa9a54` and the unchanged tracked gate
+exactly once. Its fixed VP8 1280x720@30, 3 Mbps, one-Viewer boundary used Chrome
+151, one in-memory loopback room, and no peer assistance. Preflight had passed
+the 411-test Node suite, typecheck, both builds, all Go tests, vet, a Windows
+gate build, and the 11 focused ledger/generation/cleanup tests.
+
+The append-and-flush ledger reached sequence 6. It retained capture request and
+resolution, Host admission, private room creation, Host WSS authentication,
+bridge readiness, fixed-`HIGH` config acceptance, first WebCodecs output, one
+encoder object, bridge generation 1, and the first observed binary `super.send()`
+returning synchronously; it retained no observed synchronous throw. The ledger
+does not count later sends. Go still reported
+zero frames, source-RTP packets, and source-RTP bytes. The gate therefore failed
+at `sender-start` and did not create a Viewer. It did not run Viewer signaling,
+SDP/ICE, Pion bound-edge output, decode/render, H.264, a second Viewer, FIFO, or
+production. No retry or threshold change followed.
+
+Cleanup completed before final failure: Chrome and Native exited, Node and all
+task ports closed, and the exact task profile was audited and removed. The
+pre-existing historical task-profile count did not increase. The result remains
+`no-go-unclassified`: it narrows the retained interval to after the first
+product binary `send()` returned and before Go frame accounting, but does not
+prove Go read or decode. The fixed bridge fatal is not retained by this failure
+ledger, so no underlying close or raw cause may be inferred. A separate minimal
+diagnostic or fix slice must classify this interval before another Chrome run.
+
+The frozen probe continues to bind the first actual local media WebSocket as
+gate-local generation 1. A second bridge generation saturates at 2, stops
 accumulating the first generation's counters, and fails the Viewer signal,
-Viewer media, and final-success checks even after Sender-start passed. A pure
-in-memory test covers success, throw, and late replacement without retaining a
-URL, payload, token, SDP, IP address, or raw error. No subsequent Chrome run was
-authorized or occurred.
+Viewer media, and final-success checks. Pure tests cover success, throw, and
+late replacement without retaining a URL, payload, token, SDP, candidate, IP
+address, or raw error.
 
 Chromium documents the tab-capture auto-selection switch as a test-only aid,
 and Chrome requires a non-default user-data directory for remote debugging from

docs/status.md

@@ -35,7 +35,7 @@ and is not part of production.
 - Host A+B and authenticated P2P Viewer C are sanitized, generation-bound, read-only, and fail closed for stale, ambiguous, or SFU-fed evidence; no raw media metadata is retained.
 - SVC is `no-go-web-svc-cross-path-hardware-contract`: no direct/peer selection, cross-PC shared encode, or portable hardware proof; pinned screen share is `L1T3`. No browser run was warranted.
 - The `a11a73d` built-in TURN canary is rejected: local allocation passed, but direct Host/Pion Viewer failed before forced relay. Full rollback restored STUN-only client ICE and zero allocations.
-- Native stays no-go: retained Chrome reached WebCodecs output but Go stayed zero. A real `/media` test accepts the 17-byte frame into Go frame/RTP; unexpected post-config reads emit a fixed sanitized fatal. No Chrome rerun occurred, so retained send/framing cause and MF H.264-to-Pion/Viewer interop remain unproven.
+- Native remains no-go after one post-fix gate: fixed VP8, one encoder and one generation-1 binary send returned, but Go frame/RTP stayed zero; no Viewer was created. Cleanup passed; no retry followed. The fixed bridge fatal was not retained, so the send-to-Go interval and MF H.264 Viewer interop remain unproven.
 - Access protocol/config/HTTP/storage/SQLite/signaling focused tests pass, including commit-first teardown and v1 rollback.
 
 ## Unverified Boundaries
@@ -60,8 +60,8 @@ The recovery target uses one ICE restart, one same-parent rebuild, one alternate
 SFU; it never runs three identical retries or abandons progressing P2P early.
 
 Next gate exactly-two/Dynacast-off BWE on a zero-child SFU leaf, then root
-evacuation. Native needs separate authorization; its next Chrome run must retain
-the first product binary-send outcome before Go RTP.
+evacuation. Native is stopped after browser send return but zero Go frame/RTP;
+classify that interval in a separate fix slice before any new run.
 Audio A/B/C may proceed without displacing P0.
 Ordinary Peer ICE stays STUN-only. Participant-wide TURN source and wire are
 removed; stale `PEER_ICE_TURN_*` keys fail startup even blank. Selected-edge TURN