From 721bf583f60b71efe2c34bf575f818ffd68069a6 Mon Sep 17 00:00:00 2001 From: AAA <35992542+TNTcraftHIM@users.noreply.github.com> Date: Thu, 20 Aug 2026 18:08:40 +0800 Subject: [PATCH] docs(native): record post-fix one-viewer no-go (#74) --- .../0006-fixed-high-native-sender-canary.md | 31 ++++++++++---- docs/project-memory.md | 2 +- docs/research/native-shared-encode-sender.md | 42 ++++++++++++++----- docs/status.md | 6 +-- 4 files changed, 59 insertions(+), 22 deletions(-) diff --git a/docs/adr/0006-fixed-high-native-sender-canary.md b/docs/adr/0006-fixed-high-native-sender-canary.md index 0c95b4e..ac5a4bf 100644 --- a/docs/adr/0006-fixed-high-native-sender-canary.md +++ b/docs/adr/0006-fixed-high-native-sender-canary.md @@ -111,17 +111,32 @@ one `fatal` with the fixed sanitized message `local media bridge read failed`. Focused tests prove the abnormal classification without its underlying close reason and prove normal close and app shutdown do not misreport. This is a real P1 bridge-read failure fix, but it does not classify the retained zero counters -or prove a framing defect. The current unrun gate still records only bounded -attempt/synchronous-return/synchronous-throw counters for the first local bridge -generation and rechecks that identity at Viewer signal, Viewer media, and final -success. Pure tests reject late replacement. No Chrome rerun occurred; another -run requires separate authorization. There is still no Viewer, two-viewer, FIFO, -or physical/hardware-encoder proof. +or prove a framing defect. + +One authorized post-fix revalidation then ran the frozen gate exactly once on +exact source `86386b75d01919b213f5725467e495cdd0aa9a54`, fixed VP8 `HIGH`, +Chrome 151, one in-memory local room, and peer assistance disabled. Its flushed +ledger reached sequence 6 and retained capture request/resolution, Host +admission/create/WSS, local bridge readiness and config acceptance, first +encoded output, one encoder object, bridge generation 1, and one binary send +attempt that returned synchronously without a throw. Go retained zero frames, +source-RTP packets, and source-RTP bytes, so the first failed stage was +`sender-start` and no Viewer was created. Chrome, Native, Node, all task ports, +and the exact task profile then cleaned up before the result was finalized. No +retry, threshold change, H.264, second Viewer, FIFO, or production run followed. + +The result remains `no-go-unclassified`. It proves the first product binary +send returned, narrowing the retained interval to after that return and before +Go frame accounting. It does not prove Go read or decode, and the fixed bridge +fatal is not part of this failure ledger, so no raw cause may be inferred. A +separate minimal diagnostic or fix slice must classify this interval before any +further Chrome run. There is still no Viewer, two-viewer, FIFO, or physical or +hardware-encoder proof. ## Staged Revalidation -A new run requires separate authorization and must stop at the first failed -stage while synchronously retaining a bounded final-negative snapshot: +Any further run requires separate authorization and must stop at the first +failed stage while synchronously retaining a bounded final-negative snapshot: 1. Prove host room/auth, local config acknowledgement, one encoder object, bridge ingress, frame decode, source RTP, and zero critical errors. diff --git a/docs/project-memory.md b/docs/project-memory.md index 66e6edd..9b21f62 100644 --- a/docs/project-memory.md +++ b/docs/project-memory.md @@ -23,7 +23,7 @@ Last updated: 2026-08-20 - Use direct host P2P for one or two viewers. Keep ADR-0004 off broadly; use an isolated exact-room candidate until resource, quality, recovery, SFU/UDP, bounded-failure, and browser/mobile gates pass. - Browser relays resend remote `MediaStreamTrack` values and re-encode at each hop; WebRTC does not guarantee a shared encoder across peer connections, so measure the cost. - Keep experiments bounded: the standard representation sequence is below; native RTP relay, encoded-object striping, and FEC remain separate. -- ADR-0006 stays no-go: retained Chrome reached WebCodecs output, then Go frame/RTP stayed zero and no Viewer was created. A real `/media` integration now accepts the current 17-byte binary frame into Go frame/RTP; unexpected post-config reads emit a fixed sanitized fatal. No Chrome rerun occurred, so the retained product-send/framing cause remains unproved. A separate MF fixture proved RTX H.264 hardware over 360/360 frames, but `42c01f` misses Pion's default fmtp; Viewer interop remains unproven. Native v2 stays memory-only and leaves SQLite/Web unchanged. +- ADR-0006 stays no-go: one post-fix run retained VP8 output and one first-generation binary `send()` return, but Go frame/RTP stayed zero, so no Viewer was created; cleanup passed and no retry followed. The fixed bridge fatal was not retained, so the break after browser send return and before Go accounting remains unclassified. A separate MF fixture proved RTX H.264 hardware over 360/360 frames, but `42c01f` misses Pion's default fmtp; Viewer interop remains unproven. Native v2 stays memory-only and leaves SQLite/Web unchanged. - Mobile Web Host is unsupported; feature-detect and fail clearly. Mobile Viewer stays leaf-only. After Windows native, gate Android 14+; iOS waits for stable iOS 27 ScreenCaptureKit. - ADR-0005 accepts direct/peer UDP, bounded SFU roots, then optional selected-edge TURN. The built-in participant-wide candidate failed its real direct acceptance before forced relay and rolled back completely; it is rejected as the product path. Production advertises STUN-only ICE. - Keep the controller exact-room only: room `1` is the STUN/SFU smoke. Preserve sticky progressing P2P, mobile leaves and break-before-make. Recovery spends one attempt per layer (ICE restart, same-parent rebuild, alternate peer, then SFU), never three identical retries; active SFU gets one fresh grant before Peer failback. diff --git a/docs/research/native-shared-encode-sender.md b/docs/research/native-shared-encode-sender.md index 242e584..08d713f 100644 --- a/docs/research/native-shared-encode-sender.md +++ b/docs/research/native-shared-encode-sender.md @@ -296,17 +296,39 @@ post-config close, normal close, and app shutdown. All Go tests, vet, Windows amd64 no-CGO build, TypeScript typecheck, and the relevant bridge probe/ledger tests pass. -The retained first break interval is still after WebCodecs output callback entry -and before Go frame/source-RTP accounting. This fix does not prove the retained -zero counters came from a read error or framing defect. The current unrun probe -still binds the first actual local media WebSocket as gate-local generation 1 -and records only bounded binary-send attempt, synchronous-return, and -synchronous-throw counters. A second bridge generation saturates at 2, stops +One authorized post-fix run then used exact source +`86386b75d01919b213f5725467e495cdd0aa9a54` and the unchanged tracked gate +exactly once. Its fixed VP8 1280x720@30, 3 Mbps, one-Viewer boundary used Chrome +151, one in-memory loopback room, and no peer assistance. Preflight had passed +the 411-test Node suite, typecheck, both builds, all Go tests, vet, a Windows +gate build, and the 11 focused ledger/generation/cleanup tests. + +The append-and-flush ledger reached sequence 6. It retained capture request and +resolution, Host admission, private room creation, Host WSS authentication, +bridge readiness, fixed-`HIGH` config acceptance, first WebCodecs output, one +encoder object, bridge generation 1, and the first observed binary `super.send()` +returning synchronously; it retained no observed synchronous throw. The ledger +does not count later sends. Go still reported +zero frames, source-RTP packets, and source-RTP bytes. The gate therefore failed +at `sender-start` and did not create a Viewer. It did not run Viewer signaling, +SDP/ICE, Pion bound-edge output, decode/render, H.264, a second Viewer, FIFO, or +production. No retry or threshold change followed. + +Cleanup completed before final failure: Chrome and Native exited, Node and all +task ports closed, and the exact task profile was audited and removed. The +pre-existing historical task-profile count did not increase. The result remains +`no-go-unclassified`: it narrows the retained interval to after the first +product binary `send()` returned and before Go frame accounting, but does not +prove Go read or decode. The fixed bridge fatal is not retained by this failure +ledger, so no underlying close or raw cause may be inferred. A separate minimal +diagnostic or fix slice must classify this interval before another Chrome run. + +The frozen probe continues to bind the first actual local media WebSocket as +gate-local generation 1. A second bridge generation saturates at 2, stops accumulating the first generation's counters, and fails the Viewer signal, -Viewer media, and final-success checks even after Sender-start passed. A pure -in-memory test covers success, throw, and late replacement without retaining a -URL, payload, token, SDP, IP address, or raw error. No subsequent Chrome run was -authorized or occurred. +Viewer media, and final-success checks. Pure tests cover success, throw, and +late replacement without retaining a URL, payload, token, SDP, candidate, IP +address, or raw error. Chromium documents the tab-capture auto-selection switch as a test-only aid, and Chrome requires a non-default user-data directory for remote debugging from diff --git a/docs/status.md b/docs/status.md index f0e71e4..98922ad 100644 --- a/docs/status.md +++ b/docs/status.md @@ -35,7 +35,7 @@ and is not part of production. - Host A+B and authenticated P2P Viewer C are sanitized, generation-bound, read-only, and fail closed for stale, ambiguous, or SFU-fed evidence; no raw media metadata is retained. - SVC is `no-go-web-svc-cross-path-hardware-contract`: no direct/peer selection, cross-PC shared encode, or portable hardware proof; pinned screen share is `L1T3`. No browser run was warranted. - The `a11a73d` built-in TURN canary is rejected: local allocation passed, but direct Host/Pion Viewer failed before forced relay. Full rollback restored STUN-only client ICE and zero allocations. -- Native stays no-go: retained Chrome reached WebCodecs output but Go stayed zero. A real `/media` test accepts the 17-byte frame into Go frame/RTP; unexpected post-config reads emit a fixed sanitized fatal. No Chrome rerun occurred, so retained send/framing cause and MF H.264-to-Pion/Viewer interop remain unproven. +- Native remains no-go after one post-fix gate: fixed VP8, one encoder and one generation-1 binary send returned, but Go frame/RTP stayed zero; no Viewer was created. Cleanup passed; no retry followed. The fixed bridge fatal was not retained, so the send-to-Go interval and MF H.264 Viewer interop remain unproven. - Access protocol/config/HTTP/storage/SQLite/signaling focused tests pass, including commit-first teardown and v1 rollback. ## Unverified Boundaries @@ -60,8 +60,8 @@ The recovery target uses one ICE restart, one same-parent rebuild, one alternate SFU; it never runs three identical retries or abandons progressing P2P early. Next gate exactly-two/Dynacast-off BWE on a zero-child SFU leaf, then root -evacuation. Native needs separate authorization; its next Chrome run must retain -the first product binary-send outcome before Go RTP. +evacuation. Native is stopped after browser send return but zero Go frame/RTP; +classify that interval in a separate fix slice before any new run. Audio A/B/C may proceed without displacing P0. Ordinary Peer ICE stays STUN-only. Participant-wide TURN source and wire are removed; stale `PEER_ICE_TURN_*` keys fail startup even blank. Selected-edge TURN