docs: record live controls deployment (#15)

docs/project-memory.md

@@ -36,11 +36,11 @@ Last updated: 2026-08-19
 - The repository contains a single npm package using Node.js 24, React, TypeScript, Vite, native WebRTC, `ws`, Zod, Vitest, and a separate coturn deployment. The server defaults to an all-interface listener for LAN development and containers; the bare-metal reverse-proxy baseline explicitly binds loopback. It provides a process-only `/healthz` endpoint and requires STUN plus explicit TURN/UDP and TURN/TCP URLs before production startup. TURN/TLS is accepted but optional; configuration checks do not establish public-network reachability.
 - The Web PoC implements capture-before-room creation, live source and profile changes without renegotiating healthy peers, three manual quality profiles with an explicit `balanced` sender preference, temporary picture pause with audio unaffected, one independent peer connection per viewer, stable signaling reconnect identities that also work for LAN viewers on HTTP, explicit ICE restart or peer rebuild, host session generation isolation, viewer connection-generation guards for asynchronous signaling and stats, short-lived TURN credentials, clearer waiting/TURN states, and local WebRTC statistics.
 - Access is deliberately small: `ACCESS_PASSWORD` is optional, site-wide, and accepts 1 through 128 visible ASCII characters when non-empty. When configured, host and viewer routes first establish a 12-hour stateless HMAC HttpOnly `SameSite=Strict` cookie; room creation and WebSocket upgrade accept that cookie and no direct room-creation Bearer bypass. There are no accounts, JWTs, server-side access-session maps, or logout flow.
-- ADR-0002 accepts an optional `ROOM_DATABASE_PATH` only alongside `ACCESS_PASSWORD`. In that mode, built-in `node:sqlite` stores only an auto-incremented room ID and host-token digest; links do not expire and stopping sharing leaves the room waiting. Without the path, rooms remain random and temporary. Public mode can never use sequential persistent rooms. Commit `2f66770f8e90` is deployed with `/var/lib/screener/rooms.sqlite`; the state directory and database permissions are verified, and the empty database preserves ID `1` for the first real browser room.
+- ADR-0002 accepts an optional `ROOM_DATABASE_PATH` only alongside `ACCESS_PASSWORD`. In that mode, built-in `node:sqlite` stores only an auto-incremented room ID and host-token digest; links do not expire and stopping sharing leaves the room waiting. Without the path, rooms remain random and temporary. Public mode can never use sequential persistent rooms. Commit `5b2fb005f6f7` is deployed with `/var/lib/screener/rooms.sqlite`; the state directory and database permissions are verified, and room ID `1` survived the deployment restart.
 - `/r/{code}` carries no viewer token or fragment, `/join` accepts only the numeric code, and the 256-bit host token stays internal to host authentication. In public mode the random code is the sole viewing capability and is not a strong privacy guarantee, so private Internet deployments should configure `ACCESS_PASSWORD`.
 - The Web control plane is deployed at `https://share.bonfire.icu` behind nginx with Node.js 24.19.0, and `turn.bonfire.icu` runs authenticated coturn 4.17.2 on standard UDP/TCP 3478. HTTPS, WSS, room authentication, certificate renewal, public STUN, authenticated TURN/UDP and TURN/TCP allocations, and relay-only bidirectional data paths are verified. TURN/TLS is intentionally not enabled.
-- Automated checks pass 108 Vitest tests and both production builds; production remains at the earlier deployed revision. Same-machine synthetic-media Chromium recovery and public relay-only DataChannel evidence remains from that baseline. A real live quality/pause cycle, persistent-room stop/reuse/restart cycle, real screen/game audio, heterogeneous media sessions, mobile lifecycle handling, and latency or quality targets remain unverified.
-- No infrastructure blocker remains for the current staging deployment. The immediate control-plane milestone and the separate real-device/media matrix are bounded in `docs/status.md`; neither justifies a native sender yet.
+- Automated checks pass 108 Vitest tests and both production builds. Release `5b2fb005f6f7` passed loopback and public HTTPS/access-gate deployment checks with zero automatic service restarts; nginx, coturn, and the existing blog remained healthy. Same-machine synthetic-media Chromium recovery and public relay-only DataChannel evidence remain from the earlier baseline. A real live quality/pause cycle, persistent-room stop/reuse browser cycle, real screen/game audio, heterogeneous media sessions, mobile lifecycle handling, and latency or quality targets remain unverified.
+- No infrastructure blocker remains for the current deployment. The live-control browser cycle and real-device media matrix are bounded in `docs/status.md`; neither justifies a native sender yet.
 
 ## Provisional Quality Targets
 

docs/status.md

@@ -5,16 +5,15 @@ Last updated: 2026-08-19
 ## Phase
 
 The WebRTC proof of concept is deployed at `https://share.bonfire.icu`. Commit
-`2f66770f8e90` adds protected SQLite persistence, sequential room IDs, reusable
-links, and a waiting state after sharing stops. The production database is
-initialized and empty, so the first real persistent room can receive ID `1`.
+`5b2fb005f6f7` adds live quality changes, picture pause, clearer connection
+states, protected SQLite persistence, sequential room IDs, reusable links, and
+a waiting state after sharing stops. The production database contains room ID
+`1`; the deployment restart preserved that row.
 
-The Web PoC now includes live quality changes, an explicit `balanced` sender
-degradation preference,
+The Web PoC includes an explicit `balanced` sender degradation preference,
 temporary picture pause with audio unaffected, and clearer stopped/waiting and
-TURN-warning states. These controls are not deployed yet. Real capture, game
-audio, mobile lifecycle, sustained multi-viewer behavior, and performance
-targets remain unverified.
+TURN-warning states. Real capture, game audio, mobile lifecycle, sustained
+multi-viewer behavior, and performance targets remain unverified.
 
 ## Established Baseline
 
@@ -30,6 +29,13 @@ targets remain unverified.
 ## Verification
 
 - `npm run check` passes type checking, 108 Vitest tests, and both production builds.
+- Release `5b2fb005f6f7` passed a separate production-process smoke on loopback,
+  then was atomically activated under `/opt/screener/current`. External HTTPS
+  health, the protected access gate, authenticated Secure/HttpOnly cookie, and
+  the new 1080p30 client asset passed after restart. Screener reported zero
+  automatic restarts and no warning-level journal entries; nginx and coturn
+  remained active, while `bonfire.icu` and `www.bonfire.icu` continued returning
+  HTTP 200.
 - Headless Chromium 151 established real local peer connections from animated canvas streams, delivered a live video track over direct UDP, and recovered from dropped offer/answer and initial `createOffer` failures.
 - Host and viewer generation guards discard delayed signaling, candidate, and stats work after replacement. Synthetic source changes added and removed audio without another offer, preserved healthy peer objects, and stopped retired tracks.
 - Unit coverage verifies live capture constraints, balanced sender parameters, video-only pause, sender-update failure and retry, source replacement rollback, and audio `null -> track -> null` changes.
@@ -39,9 +45,9 @@ targets remain unverified.
 
 ## Next Milestone
 
-Merge and deploy the live controls, then verify a real quality/pause cycle, room
-ID `1`, stop-and-republish behavior, reusable links, and recovery after a service
-restart.
+Verify a real quality/pause cycle in room ID `1`, stop-and-republish behavior,
+link reuse in the browser, and host recovery after a service restart. The
+database row itself has already survived the live-controls deployment restart.
 
 Execute and record the manual browser/network matrix:
 
@@ -54,7 +60,8 @@ Execute and record the manual browser/network matrix:
 
 ## Current Blocker
 
-- No infrastructure blocker remains. The live-control browser cycle, first real persistent-room lifecycle, and real-device media matrix remain unverified.
+- No infrastructure blocker remains. The live-control browser cycle, room `1`
+  browser lifecycle, and real-device media matrix remain unverified.
 
 ## Blocking Decisions