docs: record single-representation production gate (#249)
This commit is contained in:
AAA authored and GitHub committed
1 parent
d39f4359cd
commit
9591b4daff
18 files changed
+110
-111
No files matched your search
+2
-2
@@ -4,10 +4,10 @@
|
||||
- [方案设计](./方案设计.md): accepted implementation design; unfinished release and validation work is tracked in the current TODO ledger.
|
||||
- [Project memory](./project-memory.md): durable current product and source snapshot to read at the start of future work.
|
||||
- [Current status](./status.md): bounded current/index snapshot of production, active milestones, decisions, blockers, and links to detail.
|
||||
- [Verification status](./verification-status.md): exact integrated/deployed v11 gates, current production evidence, open physical proof boundaries, and expensive-test applicability.
|
||||
- [Verification status](./verification-status.md): exact integrated/deployed gates, current production evidence, open physical proof boundaries, and expensive-test applicability.
|
||||
- [Session handoff](./session-handoff.md): temporary bootstrap prompt that points a new session back to the canonical truth owners.
|
||||
- [Current TODO](./todo.md): unresolved work, active truth holds, and decisions that still require user confirmation.
|
||||
- [Deployment](./deployment.md): exact current v11 production, immutable release operations, scoped recovery rules, and transport evidence boundaries.
|
||||
- [Deployment](./deployment.md): exact current production, immutable release operations, scoped recovery rules, and transport evidence boundaries.
|
||||
- [Maintenance guide](./maintenance.md): Git workflow, context hygiene, document lifecycle, research policy, and automation.
|
||||
- [P2P WebRTC research](./research/webrtc-p2p-screen-sharing.md): evidence, bandwidth model, browser constraints, reference implementations, and feasibility assessment.
|
||||
- [Peer-assisted media research](./research/peer-assisted-media.md): browser shared-encode limits, standard relay re-encoding, deterministic sticky topology, exact-route implementation evidence, and remaining physical gates.
|
||||
|
||||
@@ -31,11 +31,9 @@ contradict the private-room cost model or duplicate mature WebRTC capabilities.
|
||||
## Current Ownership
|
||||
|
||||
[ADR-0005](./0005-automatic-hybrid-media-routing.md) owns current routing
|
||||
invariants and assisted-route roles. Production runs exact deployed
|
||||
application/runtime revision `c4962f54443ad5f98bc65861195a3d9c74a48996`, release
|
||||
`c4962f5`; canonical `main` contains the same runtime code. Current source and
|
||||
production use the strict `screener-v11` Browser wire and the same accepted route
|
||||
model. Real-network validation remains open.
|
||||
invariants and assisted-route roles. Current source, production, and
|
||||
real-network validation are indexed by [status](../status.md) and
|
||||
[verification status](../verification-status.md).
|
||||
[ADR-0004](./0004-peer-assisted-media-experiment.md)
|
||||
owns only historical peer-assisted evidence. Access and room lifetime are owned
|
||||
by [ADR-0002](./0002-memory-resident-protected-rooms.md).
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# ADR-0002: Memory-Resident Rooms And Scoped Viewer Access
|
||||
|
||||
- Status: Accepted and deployed in exact release `bf32859` on strict v12
|
||||
- Status: Accepted and deployed on strict v12
|
||||
- Date: 2026-08-23
|
||||
|
||||
## Context
|
||||
@@ -173,10 +173,9 @@ the generic `SERVER_ERROR`. None of those paths is folded into
|
||||
Current source and production use the strict `screener-v12` wire and implement the
|
||||
22-character room-incarnation grant, exact digest validation, rotate/revoke,
|
||||
browser-storage privacy, `open | private` code entry, and the `ROOM_NOT_FOUND`
|
||||
split without a v11 parser. Production is exact deployed revision
|
||||
`bf328590b3de5dfa509fcc70f6316286af3eae7e`, release `bf32859`.
|
||||
split without a v11 parser.
|
||||
|
||||
Exact release and operational evidence remain owned by deployment and
|
||||
Exact release and operational evidence are owned by deployment, status, and
|
||||
verification status.
|
||||
|
||||
## Decision Sources
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# ADR-0005: Automatic Hybrid Media Routing
|
||||
|
||||
- Status: The route model is accepted and deployed in exact release `bf32859`
|
||||
- Status: The route model is accepted and deployed in exact release `1d87615`
|
||||
on strict v12, including Browser SFU ICE-server isolation, no product
|
||||
diagnostic-download UI, and the retained Host-only acceptance snapshot.
|
||||
- Date: 2026-08-20
|
||||
@@ -362,15 +362,15 @@ deployment-wide.
|
||||
## Current Source And Deployment Boundary
|
||||
|
||||
Production runs exact deployed application/runtime revision
|
||||
`bf328590b3de5dfa509fcc70f6316286af3eae7e`, release `bf32859`; canonical `main`
|
||||
`1d8761528d0dba43fb6d818df3934483ba2f5340`, release `1d87615`; canonical `main`
|
||||
contains the same application/runtime tree plus the current truth checkpoint, including exact
|
||||
Browser SFU ICE-server-isolation implementation
|
||||
`ae09c760adec76fd26da611d4928486d105c6d3b`. Both run strict `screener-v12` and
|
||||
the direct/STUN peer plus LiveKit SFU/UDP route model. Browser SFU PCs use empty
|
||||
external ICE-server lists. Owner physical fallback proof remains bounded to
|
||||
predecessor release `c4962f5`; the operation owner remains only `route`. Exact operational
|
||||
evidence is owned by the deployment document; broader heterogeneous-network,
|
||||
codec, and SFU lifecycle validation remains open.
|
||||
external ICE-server lists. Chrome 151 on that exact production verified one
|
||||
publisher and one subscriber advancing frames over LiveKit UDP; the operation
|
||||
owner remains only `route`. Exact operational evidence is owned by the deployment
|
||||
document; broader heterogeneous-network and SFU lifecycle validation remains open.
|
||||
|
||||
## Acceptance Boundary
|
||||
|
||||
|
||||
@@ -148,8 +148,10 @@ results do not create an application media-layer selector or route authority:
|
||||
|
||||
The current Browser decision is one `HIGH` representation without simulcast,
|
||||
Dynacast, or a manual layer controller. The measured public `q`-inactive A/B
|
||||
remained bandwidth-constrained, so this verdict does not claim SFU 60 fps or
|
||||
replace the pending exact single-representation production gate.
|
||||
remained bandwidth-constrained, so this verdict does not claim SFU 60 fps.
|
||||
Chrome 151 later closed the exact-production single-representation gate on
|
||||
release `1d87615` with one no-RID encoding and progressing publisher and
|
||||
subscriber frames over LiveKit UDP.
|
||||
Reopening a dual/native representation is a new decision with new physical
|
||||
game, encoder, and upload evidence.
|
||||
3. **Current Web/LiveKit SVC: rejected
|
||||
|
||||
+15
-14
@@ -3,7 +3,7 @@
|
||||
Last verified against upstream documentation: 2026-08-24.
|
||||
|
||||
This page records production running exact deployed application/runtime revision
|
||||
`bf328590b3de5dfa509fcc70f6316286af3eae7e`, release `bf32859`, and the single
|
||||
`1d8761528d0dba43fb6d818df3934483ba2f5340`, release `1d87615`, and the single
|
||||
Browser `screener-v12` contract. Product direction and pending work are owned by
|
||||
[project memory](./project-memory.md) and [the TODO ledger](./todo.md).
|
||||
|
||||
@@ -13,8 +13,8 @@ Caddy or nginx; ordinary peer ICE advertises only STUN, while Browser LiveKit
|
||||
PCs configure no external ICE server and retain LiveKit-signaled UDP candidates.
|
||||
LiveKit supplies bounded SFU fallback capacity. Normal media remains distributed
|
||||
through direct or peer edges whenever those paths work. Production includes
|
||||
implementation `ae09c760adec76fd26da611d4928486d105c6d3b`; the owner's physical SFU
|
||||
fallback media proof remains bounded to predecessor release `c4962f5`.
|
||||
implementation `ae09c760adec76fd26da611d4928486d105c6d3b`. Chrome 151 physically
|
||||
verified its exact single-representation SFU publisher and subscriber.
|
||||
|
||||
A deployment may additionally provide one dedicated single-node LiveKit process
|
||||
as the current controller's automatic final media fallback. This capacity is
|
||||
@@ -25,21 +25,22 @@ ICE/UDP only. Ordinary peer ICE remains STUN-only and production coturn uses the
|
||||
tracked STUN-only configuration with TCP/TLS disabled. The source and production
|
||||
configure no TURN, ICE/TCP, media TCP, or TLS-relayed media.
|
||||
|
||||
Production runs exact `bf328590b3de5dfa509fcc70f6316286af3eae7e`, release
|
||||
`bf32859`, from `/opt/screener/releases/bf32859`. The immutable runtime ZIP
|
||||
Production runs exact `1d8761528d0dba43fb6d818df3934483ba2f5340`, release
|
||||
`1d87615`, from `/opt/screener/releases/1d87615`. The immutable runtime ZIP
|
||||
SHA-256 is
|
||||
`e8b8fccf0ab15591af5e6675ca9236bae28b648dccfa8b1ea208a79b927168be`.
|
||||
`715480487059bf83516a34e0d1083b52437619838c46bdc26ca5967529a1cf05`.
|
||||
Its 38-file path/size/hash manifest SHA-256 is
|
||||
`d1c6b7c025e37711c0d06f5ec222a6fba26391d2e34a06b374deb1a05ddd63c6`.
|
||||
`96845789560394ca20b16c37a8e7ddadc7b488876e32241709d0f7a577fdca26`.
|
||||
Local and public `/healthz` return 200; Screener, LiveKit, coturn, and nginx are
|
||||
active with `NRestarts=0`. The public main Browser asset is
|
||||
`assets/index-BmWh33Cv.js` with SHA-256
|
||||
`e0400b1d5a5017bf5851158f5a884425aaca0269c5e3efa4cc521f3580c19bce`.
|
||||
`assets/index-DfMqhOXY.js` with SHA-256
|
||||
`cf6dd1c46cc9414a87331a9312eec315ddce8fce565741284998aa0141b18d47`.
|
||||
|
||||
The release deploys the single Browser `screener-v12` wire, fixed VP8 for Browser
|
||||
direct, browser-relay, and SFU video, no video `contentHint`, no codec UI/state/wire,
|
||||
random four-digit
|
||||
memory rooms with a 24-hour dormant lease, a room-lived 22-character grant,
|
||||
direct, browser-relay, and SFU video, one SFU `HIGH` encoding without simulcast
|
||||
or a subscriber layer selector, disabled Dynacast, no video `contentHint`, no
|
||||
codec UI/state/wire, random four-digit memory rooms with a 24-hour dormant lease,
|
||||
a room-lived 22-character grant,
|
||||
orthogonal `open | private` grant/code admission,
|
||||
20-Viewer room admission, the uniform endpoint media-copy cap `2`, and the
|
||||
one-controller exact-candidate route runtime. Exact predecessor release
|
||||
@@ -271,7 +272,7 @@ lifetime. An actively connected Host prevents expiry; explicit stop or Host
|
||||
disconnect starts the lease, and only the exact Host token renews it before
|
||||
expiry. Viewer activity never renews ownership. `ROOM_DATABASE_PATH` and
|
||||
`ROOM_TTL_SECONDS` fail startup even when blank.
|
||||
Production `bf32859` accepts 1 through 20 and explicitly selects 20. This is an
|
||||
Production `1d87615` accepts 1 through 20 and explicitly selects 20. This is an
|
||||
admission limit, not evidence that every publisher, network, or quality profile
|
||||
can sustain that many streams.
|
||||
`ENDPOINT_MEDIA_COPY_CAPACITY` defaults to 2 and accepts only 1, 2, or 3. It is
|
||||
@@ -284,7 +285,7 @@ must fail or wait before a fourth endpoint copy is issued.
|
||||
Supplying the removed `MAX_PEER_RELAY_DOWNSTREAM_EDGES`, even blank, fails
|
||||
startup.
|
||||
|
||||
Production release `bf32859` runs the deployed server and Browser assets
|
||||
Production release `1d87615` runs the deployed server and Browser assets
|
||||
atomically on `screener-v12`; every stale Browser or executable-sender wire fails
|
||||
before room authority. Native senders and helpers are outside this release.
|
||||
|
||||
|
||||
@@ -29,19 +29,18 @@ Last updated: 2026-08-25
|
||||
|
||||
## Current Source And Production
|
||||
|
||||
- Production runs exact application/runtime revision `bf328590b3de5dfa509fcc70f6316286af3eae7e`, release `bf32859`, on strict `screener-v12`; canonical `main` contains the same application/runtime tree plus the current truth checkpoint.
|
||||
- Current source and production admit up to `20` Viewers and implement the uniform `1/2/3` endpoint cap, exact prepare candidate, first-decoded-frame commit, strict rollback revision, decoded-progress stall, a two-stage direct/SFU operation deadline, and one event-driven room controller. A short-lived exact-generation decoded-frame observer proves only the pending candidate inside the existing total deadline; the periodic stats sampler remains responsible for active-path diagnostics and stalls. Ordinary peer ICE is STUN-only and the sole application fallback is SFU/UDP; stale TURN environment keys fail startup. SFU admission uses exact publication and Viewer-subscription handles with explicit no-default ingress/egress capacities and a listener-fenced dedicated LiveKit owner. Browser SFU publisher/subscriber connects use fresh empty ICE-server options; the owner physically verified deployed SFU fallback media after release `c4962f5`, closing the prior core-route hold.
|
||||
- Production runs exact application/runtime revision `1d8761528d0dba43fb6d818df3934483ba2f5340`, release `1d87615`, on strict `screener-v12`; canonical `main` contains the same application/runtime tree plus the current truth checkpoint.
|
||||
- Current source and production admit up to `20` Viewers and implement the uniform `1/2/3` endpoint cap, exact prepare candidate, first-decoded-frame commit, strict rollback revision, decoded-progress stall, a two-stage direct/SFU operation deadline, and one event-driven room controller. A short-lived exact-generation decoded-frame observer proves only the pending candidate inside the existing total deadline; the periodic stats sampler remains responsible for active-path diagnostics and stalls. Ordinary peer ICE is STUN-only and the sole application fallback is SFU/UDP; stale TURN environment keys fail startup. SFU admission uses exact publication and Viewer-subscription handles with explicit no-default ingress/egress capacities and a listener-fenced dedicated LiveKit owner. Browser SFU publisher/subscriber connects use fresh empty ICE-server options; Chrome 151 on exact production `1d87615` verified one no-RID publisher encoding and progressing publisher/subscriber frames over LiveKit UDP, closing the current single-representation gate.
|
||||
- Source and production use random four-digit memory rooms, dormant leases, exact-Host resume, restart loss, local preference replay, orthogonal grants/code entry, and no SQLite runtime. V12 uses a 22-character room-incarnation grant, `ROOM_NOT_FOUND`, no diagnostic-file export, and a compact UI showing the complete shorter URL.
|
||||
- Exact production artifacts, services, ports, and any change-scoped infrastructure recovery boundary are owned by [deployment](./deployment.md) and indexed by [status](./status.md).
|
||||
- Source and production require v12, fixed VP8, and no video hint. Current source publishes exactly one SFU `HIGH` encoding without simulcast or a subscriber layer selector; production still sends ordered `q,h` until the next application cutover. Current Pause/Resume, live audio ceilings, exact-sender metrics, relay/SFU audio continuity, typed Viewer presentation, and quality profiles match the product truths above.
|
||||
- Source and production require v12, fixed VP8, and no video hint. Both publish exactly one SFU `HIGH` encoding without simulcast or a subscriber layer selector and keep Dynacast disabled. Current Pause/Resume, live audio ceilings, exact-sender metrics, relay/SFU audio continuity, typed Viewer presentation, and quality profiles match the product truths above.
|
||||
- Browser SFU subscribers reconcile eligible Host screen publications across connect/activate event ordering, participant/track arrival, and reconnect. Production LiveKit logs only warn/error, and the application service has a bounded same-host LiveKit readiness preflight.
|
||||
- Exact `main@bf32859` passed TypeScript, 613 Web tests, both builds, hygiene, review, and production postflight. Chrome 151 closed direct/browser-relay VP8 cadence and active-audio ceilings; its SFU A/B rejected always-active `LOW` without claiming a deployed single representation, public SFU 60 fps, or real-game synchronization. Exact metrics live in [verification status](./verification-status.md).
|
||||
- Exact `main@1d87615` passed TypeScript, 607 Web tests, both builds, hygiene, three reviews, production postflight, and a Chrome 151 physical gate proving one no-RID SFU encoding with progressing publisher/subscriber frames over LiveKit UDP. Earlier gates closed direct/browser-relay VP8 cadence and active-audio ceilings; public SFU 60 fps and real-game synchronization remain unproven. Exact metrics live in [verification status](./verification-status.md).
|
||||
- Chrome loopback, cap2/cap3, short resource, recovery, MBB, and A/V fixtures are bounded evidence only. They do not establish quality, resource limits, or product policy.
|
||||
|
||||
## Current Priority
|
||||
|
||||
1. Deploy and physically verify the current single-`HIGH` Browser SFU publication; leave direct, browser-relay, content-hint, and routing behavior unchanged.
|
||||
2. Then finish real-network route, recovery, screen-audio and real-game A/V acceptance. Browser VP8 hardware acceleration and mobile Viewer lifecycle remain Accepted Later; Native/executable, distribution, and repository-wide simplification remain later phases.
|
||||
1. Finish real-network route, recovery, screen-audio and real-game A/V acceptance. Browser VP8 hardware acceleration and mobile Viewer lifecycle remain Accepted Later; Native/executable, distribution, and repository-wide simplification remain later phases.
|
||||
|
||||
The desktop Host background/minimized report is deferred until it reproduces on current production with a real game and synchronized media plus CPU/GPU evidence. The bounded current-Chrome screening found no immediate Host-page lifecycle drop, and removal of the old harmful `contentHint = "motion"` remains a plausible confound rather than a proven background fix. Mobile Viewer playback and assigned-relay survival remain a separate lifecycle gate.
|
||||
|
||||
|
||||
@@ -8,11 +8,9 @@
|
||||
retained evidence. Exact Browser v10 source
|
||||
`fdd5a4a529ff297f41c05ea3388bf484d76afe8f` implements ADR-0005's single
|
||||
child-reparent reconciliation and exact first-frame transaction and remains
|
||||
dated implementation evidence. Production runs exact deployed
|
||||
application/runtime revision `c4962f54443ad5f98bc65861195a3d9c74a48996`, release
|
||||
`c4962f5`; canonical `main` contains the same runtime code. Current source and
|
||||
production run the strict `screener-v11` form of that route contract.
|
||||
Advanced encoded-media routes remain unimplemented candidates.
|
||||
dated implementation evidence. Current source and production are indexed by
|
||||
[status](../status.md) and follow ADR-0005. Advanced encoded-media routes remain
|
||||
unimplemented candidates.
|
||||
|
||||
This document is research evidence, not current architecture or a backlog. See
|
||||
[ADR-0005](../adr/0005-automatic-hybrid-media-routing.md) for accepted routing
|
||||
|
||||
@@ -73,11 +73,9 @@ gate and do not inherit this desktop Host result.
|
||||
## Current Source Boundary
|
||||
|
||||
The no-video-hint review baseline is
|
||||
`a26eb39dc677003110787b0ed1581c208f894fd7`. Production runs exact deployed
|
||||
application/runtime revision `c4962f54443ad5f98bc65861195a3d9c74a48996`, release
|
||||
`c4962f5`; canonical `main` contains the same runtime code. Current source and
|
||||
production use strict `screener-v11`, fixed VP8, no video hint, and no codec UI,
|
||||
quality state, or wire field.
|
||||
`a26eb39dc677003110787b0ed1581c208f894fd7`. Current source and production use
|
||||
fixed VP8, no video hint, and no codec UI, quality state, or wire field; their
|
||||
exact identity is owned by [status](../status.md).
|
||||
The current path does not claim or implement a page-keepalive mechanism, and
|
||||
deployment health supplies no physical background-capture evidence.
|
||||
|
||||
|
||||
@@ -4,12 +4,11 @@ Accessed: 2026-08-25
|
||||
|
||||
Status: current Browser source and production use strict `screener-v12`, fixed
|
||||
VP8, no video hint, and one Opus screen-audio path with bounded 64/128/256 kbps
|
||||
sender ceilings. Production runs exact application/runtime revision
|
||||
`bf328590b3de5dfa509fcc70f6316286af3eae7e`, release `bf32859`; canonical
|
||||
`main` contains the same runtime code. The capture request disables local speech
|
||||
processing, live mutation has applied readback, relay track changes preserve the
|
||||
persistent stream, and SFU reconnect reacquires exact publications/senders.
|
||||
Current-production physical evidence closes the active-source `1 kbps` report;
|
||||
sender ceilings. Exact source and production identities are owned by
|
||||
[status](../status.md). The capture request disables local speech processing,
|
||||
live mutation has applied readback, relay track changes preserve the persistent
|
||||
stream, and SFU reconnect reacquires exact publications/senders.
|
||||
Exact-production `bf32859` physical evidence closes the active-source `1 kbps` report;
|
||||
audible game quality and real-game SFU A/V synchronization remain open.
|
||||
|
||||
## Observed-Bitrate Identity Boundary
|
||||
@@ -468,8 +467,8 @@ deltas in earlier video loopbacks. This is functional evidence, not packaging,
|
||||
real-game sync, second-Viewer, SFU/UDP, or endurance evidence.
|
||||
|
||||
Run one bounded matrix rather than a full route Cartesian product against
|
||||
production release `c4962f5` and its matching current runtime source on Windows
|
||||
Chrome/Edge for tab/window/monitor,
|
||||
the exact production release and matching runtime source at execution time on
|
||||
Windows Chrome/Edge for tab/window/monitor,
|
||||
audio selected/unselected, and a simultaneous voice call; then the native
|
||||
candidate on current Windows 11 with game parent and child audio, an independent
|
||||
voice process, notifications, no render stream, and process restart. Windows 10
|
||||
|
||||
@@ -5,13 +5,8 @@
|
||||
low latency, and bounded host media fanout
|
||||
- Status: research and dated route evidence. Current invariants and assisted
|
||||
transport roles are in [ADR-0005](../adr/0005-automatic-hybrid-media-routing.md).
|
||||
Production runs exact deployed application/runtime revision
|
||||
`c4962f54443ad5f98bc65861195a3d9c74a48996`, release `c4962f5`; canonical
|
||||
`main` and production include Browser SFU ICE-server-isolation implementation
|
||||
`ae09c760adec76fd26da611d4928486d105c6d3b` and owner physical fallback proof.
|
||||
Source and production retain the route transaction and diagnostics on
|
||||
strict `screener-v11`. Real-network validation remains in
|
||||
[verification status](../verification-status.md).
|
||||
Current source and production are indexed by [status](../status.md);
|
||||
real-network validation remains in [verification status](../verification-status.md).
|
||||
|
||||
## Current Transport Conclusion
|
||||
|
||||
@@ -603,7 +598,7 @@ counters would not be deployment-wide admission.
|
||||
| Route | Where copies are emitted | Endpoint cost | Evidence status |
|
||||
| --- | --- | --- | --- |
|
||||
| Direct host P2P | Host emits one copy per Viewer | Host upload and sender pipelines grow with Viewers | Baseline evidence; current capacity is owned by the product contract |
|
||||
| Bounded browser relay DAG | Host and each Web relay emit at most the configured endpoint cap | Ordinary browser, but every relay decodes and re-encodes and adds a hop | Current v11 source and production both admit up to 20; the exact v10 local direct loopback gate passed, while heterogeneous networks remain open |
|
||||
| Bounded browser relay DAG | Host and each Web relay emit at most the configured endpoint cap | Ordinary browser, but every relay decodes and re-encodes and adds a hop | Current source and production admit up to 20; the exact v10 local direct loopback gate passed, while heterogeneous networks remain open |
|
||||
| Native shared-encode host | Host targets one encode for standard WebRTC edges | libwebrtc public-API proxy risk spike, with Pion as fallback | Research evidence; still pays per-edge upload |
|
||||
| Native volunteer encoded-RTP relay | Each volunteer forwards one encoded copy | Native install, RTP/RTCP forwarding, packaging, and opt-in relay policy | Research only; no current product authorization |
|
||||
| SFU service | SFU emits authorized subscription copies | Service pays bounded egress; an authoritative Host publisher supplies media | Production deploys the current topology/admission; local LiveKit functional evidence exists, while heterogeneous-network/resource validation remains open |
|
||||
|
||||
@@ -6,12 +6,10 @@
|
||||
earlier resource/quality gate remains eight
|
||||
- Status: historical evidence plus the bounded controller. Exact Browser v10
|
||||
source `fdd5a4a529ff297f41c05ea3388bf484d76afe8f` remains the dated local
|
||||
direct-loopback implementation evidence. Production runs exact deployed
|
||||
application/runtime revision `c4962f54443ad5f98bc65861195a3d9c74a48996`, release
|
||||
`c4962f5`; canonical `main` contains the same runtime code. Current source and
|
||||
production run the strict `screener-v11` ADR-0005 route transaction. A
|
||||
historical v8 canary decoded SFU media. Heterogeneous-network, mobile,
|
||||
resource, and endurance evidence remains open.
|
||||
direct-loopback implementation evidence. Current source and production are
|
||||
indexed by [status](../status.md) and follow ADR-0005. A historical v8 canary
|
||||
decoded SFU media. Heterogeneous-network, mobile, resource, and endurance
|
||||
evidence remains open.
|
||||
|
||||
This document owns dated measurements and implementation evidence. Current
|
||||
capacity and routing authority live in [ADR-0005](../adr/0005-automatic-hybrid-media-routing.md)
|
||||
|
||||
@@ -12,7 +12,7 @@ game UI, maps, subtitles, and text become unreadable; `maintain-resolution`
|
||||
may instead lower frame rate. Neither preference overrides congestion control.
|
||||
|
||||
Production runs exact deployed application/runtime revision
|
||||
`bf328590b3de5dfa509fcc70f6316286af3eae7e`, release `bf32859`; canonical
|
||||
`1d8761528d0dba43fb6d818df3934483ba2f5340`, release `1d87615`; canonical
|
||||
`main` contains the same runtime code. Current Browser source and production use
|
||||
strict `screener-v12`, fixed VP8, no video `contentHint`, and no codec UI,
|
||||
quality state, or wire field. They use `balanced` as the recommended profile
|
||||
@@ -49,7 +49,7 @@ available bandwidth without losing frame cadence. Both paths needed about
|
||||
intrinsic VP8/no-hint localhost 60 fps shortfall; sender ceilings are not startup
|
||||
or delivery guarantees, and no application start-bitrate hack follows.
|
||||
|
||||
The exact SFU path isolated a different issue. With the current ordered `q,h`
|
||||
The exact SFU path isolated a different issue. With the then-deployed ordered `q,h`
|
||||
publication, the 1904x928 `h` stream stabilized near 9.2 fps and 1.37 Mbps. With
|
||||
`q` inactive from the first sender-parameter application, the otherwise
|
||||
unchanged `h` stream reached about 23.3 fps and 3.32 Mbps. Source/capture stayed
|
||||
@@ -61,6 +61,18 @@ ADR-0007 rejects that candidate and accepts one Browser SFU `HIGH`
|
||||
representation. The public SFU ingress remained constrained, so this gate does
|
||||
not claim SFU 60 fps or real-game performance.
|
||||
|
||||
## 2026-08-25 Exact-Production Single-Representation Gate
|
||||
|
||||
Chrome 151 exercised exact production `1d87615` with a real dynamic tab capture.
|
||||
The bounded gate made only the ordinary STUN peer attempt unusable so the existing
|
||||
route operation reached its SFU suffix; Browser LiveKit publisher and subscriber
|
||||
PCs retained empty external ICE-server lists and selected UDP. The publisher
|
||||
reported one video sender encoding and one outbound video stats object, both
|
||||
without RID. Over six seconds it encoded 180 frames and the subscriber decoded
|
||||
and rendered 182 frames at 1822x1080, with byte counters advancing on both ends.
|
||||
This closes ADR-0007's implementation/deployment gate. It does not establish
|
||||
public SFU 60 fps, real-game quality, heterogeneous networks, or endurance.
|
||||
|
||||
## Route Quality Authority
|
||||
|
||||
Current-path WebRTC stats can diagnose loss, RTT, jitter, bitrate, resolution,
|
||||
@@ -179,7 +191,7 @@ video blur, but Screener does not add application SDP bitrate hacks.
|
||||
|
||||
The same release was also reported to reduce game-stream frame rate and
|
||||
consume noticeable Host resources. That report applies only to
|
||||
`769de201f7cc`, not to current production or automatically to the current v11
|
||||
`769de201f7cc`, not to current production or automatically to the current
|
||||
diagnostics.
|
||||
The Web
|
||||
sender creates one independent `RTCRtpSender` per viewer and has no cross-PC
|
||||
@@ -255,7 +267,7 @@ SFU publication explicitly uses VP8 with no backup codec. The UI and quality
|
||||
wire expose no codec choice. Codec/profile/encoder stats remain diagnostic and
|
||||
do not authorize automatic switching, route changes, or another controller.
|
||||
Production runs exact deployed application/runtime revision
|
||||
`bf328590b3de5dfa509fcc70f6316286af3eae7e`, release `bf32859`; canonical
|
||||
`1d8761528d0dba43fb6d818df3934483ba2f5340`, release `1d87615`; canonical
|
||||
`main` contains the same runtime code. Current source and production implement
|
||||
this strict `screener-v12` contract.
|
||||
|
||||
@@ -443,10 +455,10 @@ one unambiguous encoding. Current quality settings do not request a mode, so
|
||||
the requested value remains null and a browser-reported default is not called
|
||||
a mismatch; multiple encodings remain unknown. Inbound stats provide no current
|
||||
standard `scalabilityMode` source, so C does not carry a null-only placeholder.
|
||||
The exact-production gate above rejected its ordered `q,h` publication because
|
||||
the active lower representation reduced `HIGH`. Current source now implements
|
||||
ADR-0007's one Browser SFU `HIGH`; production remains `q,h` until the exact
|
||||
single-representation deployment gate passes.
|
||||
The earlier exact-production gate rejected its ordered `q,h` publication because
|
||||
the active lower representation reduced `HIGH`. Current source and production
|
||||
now implement ADR-0007's one Browser SFU `HIGH`; the exact deployment gate above
|
||||
proved one no-RID encoding with progressing publisher/subscriber frames.
|
||||
|
||||
Official W3C text checked 2026-08-19 defines names ending in `Id` as stats-object
|
||||
references. In particular, outbound [`mediaSourceId`](https://www.w3.org/TR/webrtc-stats/#dom-rtcoutboundrtpstreamstats-mediasourceid)
|
||||
@@ -671,9 +683,9 @@ pipeline.
|
||||
Compare image readability and motion continuity instead of declaring success
|
||||
from FPS alone. If reproducible evidence later shows a supported preference
|
||||
oscillates or makes the wrong tradeoff on supported machines, revise that
|
||||
explicit option only from a new controlled gate. Browser SFU verification must
|
||||
show exactly one VP8 outbound video encoding, no `q,h` simulcast, continuing
|
||||
publisher/subscriber frame progress, and unchanged ADR-0005 resource accounting.
|
||||
explicit option only from a new controlled gate. The exact Browser SFU gate
|
||||
showed one VP8 outbound video encoding, no `q,h` simulcast, and continuing
|
||||
publisher/subscriber frame progress without changing ADR-0005 resource accounting.
|
||||
The application's evidence windows remain diagnostic only; they do not command
|
||||
another representation, change topology, or override stock congestion control.
|
||||
|
||||
|
||||
@@ -36,11 +36,12 @@ Current high-signal boundary:
|
||||
subscriber PCs explicitly use no external ICE server and check the dedicated
|
||||
public SFU candidate directly; ordinary peers and LiveKit server-side public
|
||||
IP discovery retain deployment STUN. Production exact deployed
|
||||
application/runtime revision `bf328590b3de5dfa509fcc70f6316286af3eae7e`,
|
||||
release `bf32859`, uses strict `screener-v12` and includes exact Browser SFU
|
||||
application/runtime revision `1d8761528d0dba43fb6d818df3934483ba2f5340`,
|
||||
release `1d87615`, uses strict `screener-v12` and includes exact Browser SFU
|
||||
ICE-server-isolation implementation
|
||||
`ae09c760adec76fd26da611d4928486d105c6d3b`. Owner physical SFU fallback proof
|
||||
remains bounded to predecessor release `c4962f5`. The route uses one short-lived
|
||||
`ae09c760adec76fd26da611d4928486d105c6d3b`. Chrome 151 on that exact production
|
||||
verified one no-RID publisher encoding and progressing publisher/subscriber
|
||||
frames over LiveKit UDP. The route uses one short-lived
|
||||
exact-generation decoded-frame observer only for the pending candidate inside
|
||||
the existing total deadline; the periodic stats sampler still owns active-path
|
||||
diagnostics and stalls. Broader external-network and SFU lifecycle evidence
|
||||
@@ -56,10 +57,10 @@ Current high-signal boundary:
|
||||
Automated source gates and the exact deployment postflight passed. Chrome 151
|
||||
physically verified direct/browser-relay/SFU screen-audio continuity and all
|
||||
three sender ceilings. An exact-production VP8 gate sustained about 59.5 fps
|
||||
on direct and Browser-relay paths and rejected the current SFU `q,h`
|
||||
publication because active `LOW` reduced `HIGH`. ADR-0007 accepts one Browser
|
||||
SFU `HIGH`; current source implements that single representation, while
|
||||
production remains `q,h` until the next application cutover and physical gate.
|
||||
on direct and Browser-relay paths and rejected the then-deployed `bf32859`
|
||||
SFU `q,h` publication because active `LOW` reduced `HIGH`. ADR-0007 accepts one Browser
|
||||
SFU `HIGH`; current source and production implement it. Chrome 151 verified
|
||||
one no-RID encoding and progressing publisher/subscriber frames over LiveKit UDP.
|
||||
- Ordinary browser ICE owns direct reachability. Do not build port prediction,
|
||||
guessed candidates, NAT classification, TCP probes, quality scores, or
|
||||
quality-driven reparenting. Current-path quality is diagnostic; a healthy
|
||||
|
||||
+7
-8
@@ -6,14 +6,14 @@ This is the current execution index. Git history owns completed timelines; [veri
|
||||
|
||||
## Production
|
||||
|
||||
- `https://share.bonfire.icu` runs exact deployed application/runtime revision `bf328590b3de5dfa509fcc70f6316286af3eae7e`, release `bf32859`, wire `screener-v12`, from `/opt/screener/releases/bf32859`; that revision is integrated in canonical `main`. Its immutable runtime ZIP SHA-256 is `e8b8fccf0ab15591af5e6675ca9236bae28b648dccfa8b1ea208a79b927168be`, and its 38-file manifest SHA-256 is `d1c6b7c025e37711c0d06f5ec222a6fba26391d2e34a06b374deb1a05ddd63c6`.
|
||||
- `screener`, LiveKit, coturn, and nginx are active/running; local/public `/healthz` and the served Browser asset match the immutable release, and all four services report `NRestarts=0`. The main Browser asset is `assets/index-BmWh33Cv.js` with SHA-256 `e0400b1d5a5017bf5851158f5a884425aaca0269c5e3efa4cc521f3580c19bce`; the prior asset returns 404.
|
||||
- The service process resolves its working directory to exact release `bf32859`; it has no writable room `StateDirectory` or SQLite runtime.
|
||||
- `https://share.bonfire.icu` runs exact deployed application/runtime revision `1d8761528d0dba43fb6d818df3934483ba2f5340`, release `1d87615`, wire `screener-v12`, from `/opt/screener/releases/1d87615`; that revision is integrated in canonical `main`. Its immutable runtime ZIP SHA-256 is `715480487059bf83516a34e0d1083b52437619838c46bdc26ca5967529a1cf05`, and its 38-file manifest SHA-256 is `96845789560394ca20b16c37a8e7ddadc7b488876e32241709d0f7a577fdca26`.
|
||||
- `screener`, LiveKit, coturn, and nginx are active/running; local/public `/healthz` and the served Browser asset match the immutable release, and all four services report `NRestarts=0`. The main Browser asset is `assets/index-DfMqhOXY.js` with SHA-256 `cf6dd1c46cc9414a87331a9312eec315ddce8fce565741284998aa0141b18d47`; the prior asset returns 404.
|
||||
- The service process resolves its working directory to exact release `1d87615`; it has no writable room `StateDirectory` or SQLite runtime.
|
||||
- Production admits one Host plus 20 Viewers, applies endpoint capacity `2`, rejects stale Browser and executable-sender wires before room authority, and runs the one-controller exact-candidate route model with one staged total deadline. Rooms use random free four-digit codes, a 24-hour dormant lease, restart loss, local Host creation preferences, a room-lived 22-character Viewer grant, and exactly `open | private` code entry. Private rooms without a password are invitation-only; configuring one additionally permits matching code-and-password entry. LiveKit remains dedicated with `room.auto_create: false`, `max_participants: 21`, and global admission `1` publication ingress / `20` subscription egress.
|
||||
- Production media ports remain STUN-only UDP 3478 and LiveKit UDP 7882; coturn TCP/TLS, port 5349, media TCP, and relay ranges are disabled. The public Web ingress remains TCP 80/443; Node 8787 and LiveKit control/signaling 7880 are internal-only. The stable `inet bonfire_filter` table SHA-256 is `afaf9d066e9f292d8bd19032b38c0978ccf60dd01c2fe7f210968ff751f90534`; the dynamic fail2ban table is excluded from that identity.
|
||||
- SFU subscribers reconcile Host screen publications across connect, activation, participant arrival, track publication, and reconnect. LiveKit runs at `warn`/Pion `error`, and the Screener unit waits boundedly for the same-host LiveKit control listener before startup. The current postflight found healthy unchanged services; exact-production direct and Browser-relay VP8 evidence is closed, while accepted single-`HIGH` SFU deployment/physical proof and broader real-network acceptance remain open.
|
||||
- SFU subscribers reconcile Host screen publications across connect, activation, participant arrival, track publication, and reconnect. LiveKit runs at `warn`/Pion `error`, and the Screener unit waits boundedly for the same-host LiveKit control listener before startup. The current postflight found healthy unchanged services; exact-production direct, Browser-relay, and single-representation SFU gates are closed, while broader real-network acceptance remains open.
|
||||
- Production Browser SFU publisher and subscriber PCs explicitly use empty external ICE-server lists while retaining LiveKit-signaled UDP candidates. The owner verified that the deployed isolation fixes the reported SFU connection failure; the prior P1 core-route hold is closed.
|
||||
- Production leaves video `contentHint` unset, keeps audio `contentHint = "music"`, and fixes Browser direct, browser-relay, and SFU video to VP8 without codec UI, quality state, wire fields, or fallback media codecs. The deployed SFU publisher still sends ordered `q,h` simulcast; the exact-production quality gate rejected that candidate, so production is not yet aligned with ADR-0007's accepted single-`HIGH` representation.
|
||||
- Production leaves video `contentHint` unset, keeps audio `contentHint = "music"`, and fixes Browser direct, browser-relay, and SFU video to VP8 without codec UI, quality state, wire fields, or fallback media codecs. Its SFU publisher uses exactly one `HIGH` encoding with `simulcast: false`, no subscriber quality selector, and explicit `dynacast: false`.
|
||||
|
||||
## Current Source
|
||||
|
||||
@@ -25,12 +25,11 @@ This is the current execution index. Git history owns completed timelines; [veri
|
||||
- Current source leaves video `contentHint` unset and keeps audio `contentHint = "music"`. Browser direct and browser-relay offers contain VP8 as their only media codec, and SFU publication uses exactly one VP8 `HIGH` encoding with `simulcast: false`, no backup codec, no subscriber quality selector, and explicit `dynacast: false`. Codec UI, quality state, wire fields, fallback media codecs, and share-lifetime codec branches are absent. Live 64/128/256 kbps audio-ceiling mutation remains unchanged; ordinary Host and SFU publisher metrics select the exact current sender, relays reconcile audio-track additions and removals on the persistent stream, and an SFU reconnect reacquires the current publication/sender or fails the route closed.
|
||||
- Current source implements typed first-frame Viewer presentation and recovery, Chinese user-facing route/access failures, local connection details without a diagnostic-file export, authenticated Host-only on-demand route snapshots for automatic acceptance, explicit missing-room presentation, and responsive entry controls. Host invitation controls remain independent from two-state room-code entry.
|
||||
- Recommended quality remains exactly `1080p60`, `1080p30`, and `720p30`; current source defaults to `1080p30`. Advanced resolution adds `480p` as `854x480` without adding a fourth preset, and advanced FPS and bitrate remain independent.
|
||||
- Current source passed repository hygiene, TypeScript, all 607 Web tests in 44 files, and both production builds. Exact production `bf32859` separately passed its recorded source and postflight gates. A Chrome 151 production gate exercised two direct children, one browser-relay child, one SFU subscription, all three audio ceilings, and live source replacement with progressing audio/video. A separate exact-production VP8 gate sustained about 59.5 fps on direct and browser-relay paths, while its SFU A/B proved that the always-active `LOW` materially reduced `HIGH`; the new single-representation source still requires exact deployed proof.
|
||||
- Exact `main@1d87615` passed repository hygiene, TypeScript, all 607 Web tests in 44 files, both production builds, three independent reviews, immutable deployment postflight, and the Chrome 151 single-representation SFU gate. Earlier exact-production gates exercised direct, browser-relay, SFU audio continuity and all three audio ceilings, and sustained about 59.5 fps on direct and browser-relay paths; exact applicability remains in [verification status](./verification-status.md).
|
||||
|
||||
## Current Milestone
|
||||
|
||||
1. Deploy the current single-`HIGH` Browser SFU source, then physically verify exactly one outbound video encoding with progressing publisher/subscriber media. Direct and browser-relay VP8/no-hint performance is already closed by the exact-production gate.
|
||||
2. Finish representative ICE/STUN/SFU acceptance, including route recovery, screen-audio continuity and real-game A/V sync on mobile and heterogeneous networks. Browser port prediction, NAT classification, TCP probing, fake page keepalive, and quality-driven reparenting remain outside the accepted model.
|
||||
1. Finish representative ICE/STUN/SFU acceptance, including route recovery, screen-audio continuity and real-game A/V sync on mobile and heterogeneous networks. Browser port prediction, NAT classification, TCP probing, fake page keepalive, and quality-driven reparenting remain outside the accepted model.
|
||||
|
||||
## Active Boundaries
|
||||
|
||||
|
||||
+1
-2
@@ -6,8 +6,7 @@ Only items in **Now** are executable after their stated decision gate. A branch
|
||||
|
||||
## Now
|
||||
|
||||
1. **Deploy and prove the current single-`HIGH` Browser SFU publication.** Exact production Chrome 151 closed the intrinsic VP8/no-hint shortfall on direct and browser-relay paths, but proved that the always-active SFU `LOW` materially reduces `HIGH` on the measured public ingress. Current source now uses one VP8 `HIGH` encoding and removes only the unowned two-layer helpers and assertions. Deploy the exact artifact and physically verify exactly one outbound video encoding, no RID or second representation, and progressing publisher/subscriber frames over LiveKit UDP. Do not change direct/browser-relay media, `contentHint`, route ordering, deadlines, or add a bitrate controller.
|
||||
2. **Finish real-network route acceptance.** Measure standard ICE/STUN direct paths, peer relay, SFU ingress/subscription, exact first-frame commit and rollback, relay-ingress repair with subtree retention, disconnect/capacity drain, Pause/Resume, screen-audio continuity and real-game A/V sync, and bounded explicit failure across representative IPv4/IPv6 NATs and mobile networks. Include an all-UDP-blocked case to establish the current failure boundary. Do not add port prediction, NAT classification, TCP probes, guessed candidates, route scores, or quality-driven reparenting.
|
||||
1. **Finish real-network route acceptance.** Measure standard ICE/STUN direct paths, peer relay, SFU ingress/subscription, exact first-frame commit and rollback, relay-ingress repair with subtree retention, disconnect/capacity drain, Pause/Resume, screen-audio continuity and real-game A/V sync, and bounded explicit failure across representative IPv4/IPv6 NATs and mobile networks. Include an all-UDP-blocked case to establish the current failure boundary. Do not add port prediction, NAT classification, TCP probes, guessed candidates, route scores, or quality-driven reparenting.
|
||||
|
||||
## Accepted Later Roadmap
|
||||
|
||||
|
||||
@@ -10,37 +10,38 @@ Capacity and routing entries below describe the exact tested source or release o
|
||||
|
||||
## Deployment Evidence
|
||||
|
||||
- Production runs exact deployed application/runtime revision `bf328590b3de5dfa509fcc70f6316286af3eae7e`, release `bf32859`, wire `screener-v12`, from `/opt/screener/releases/bf32859`; that revision is integrated in canonical `main`. The immutable runtime ZIP SHA-256 is `e8b8fccf0ab15591af5e6675ca9236bae28b648dccfa8b1ea208a79b927168be`; its 38-file manifest SHA-256 is `d1c6b7c025e37711c0d06f5ec222a6fba26391d2e34a06b374deb1a05ddd63c6`.
|
||||
- Postflight found `screener`, LiveKit, coturn, and nginx active with zero restarts and no warning-level Screener journal entries. Local/public health and the served main Browser asset matched the release; `assets/index-BmWh33Cv.js` has SHA-256 `e0400b1d5a5017bf5851158f5a884425aaca0269c5e3efa4cc521f3580c19bce`, while the prior main asset returns 404.
|
||||
- Production runs exact deployed application/runtime revision `1d8761528d0dba43fb6d818df3934483ba2f5340`, release `1d87615`, wire `screener-v12`, from `/opt/screener/releases/1d87615`; that revision is integrated in canonical `main`. The immutable runtime ZIP SHA-256 is `715480487059bf83516a34e0d1083b52437619838c46bdc26ca5967529a1cf05`; its 38-file manifest SHA-256 is `96845789560394ca20b16c37a8e7ddadc7b488876e32241709d0f7a577fdca26`.
|
||||
- Postflight found `screener`, LiveKit, coturn, and nginx active with zero restarts and no warning-level Screener journal entries. Local/public health and the served main Browser asset matched the release; `assets/index-DfMqhOXY.js` has SHA-256 `cf6dd1c46cc9414a87331a9312eec315ddce8fce565741284998aa0141b18d47`, while the prior main asset returns 404.
|
||||
- Production uses endpoint capacity `2`, room admission `20`, random free four-digit memory rooms, `ROOM_LEASE_SECONDS=86400`, a dedicated LiveKit instance with `room.auto_create: false` and `max_participants: 21`, and global SFU admission `1` ingress / `20` egress. Room authority is process-memory-only. Coturn is `stun-only`, `no-tcp`, and `no-tls`; only UDP 3478 listens, and nft exposes only UDP 3478/7882 for Screener media.
|
||||
- The production service orders Screener after LiveKit and boundedly waits for its control listener. Media listeners remain STUN-only UDP 3478 and LiveKit UDP 7882 with no 5349, coturn TCP/TLS, relay range, ICE/TCP, or media TCP listener. The stable `inet bonfire_filter` table stayed unchanged through cutover at SHA-256 `afaf9d066e9f292d8bd19032b38c0978ccf60dd01c2fe7f210968ff751f90534`; the whole ruleset is not used as an identity because fail2ban owns a dynamic address set.
|
||||
- This application-only postflight proves archive identity, atomic application/assets, process health, and listener/firewall continuity. It did not re-exercise access, stale-wire rejection, direct, browser-relay, SFU, audio, codec, mobile, quality, or endurance behavior; those retained results remain revision-bounded below. Routine application-only releases do not maintain a full rollback/configuration backup; any future infrastructure or irreversible-state change requires recovery scoped to what it changes.
|
||||
|
||||
## Retained Functional Evidence
|
||||
|
||||
- Exact deployed `main@bf32859` passed repository hygiene, TypeScript typecheck, all 613 Web tests in 44 files, client and server production builds, focused independent review, and production artifact/service postflight. Exact predecessor `b68c471` separately passed the 261-test SFU admission gate and explicit-Chrome access/privacy gate. Retained Chrome 20-Viewer and responsive visual checks apply only to their recorded predecessor revisions.
|
||||
- Exact deployed `main@1d87615` passed repository hygiene, TypeScript typecheck, all 607 Web tests in 44 files, client and server production builds, three independent reviews, and production artifact/service postflight. Exact predecessor `b68c471` separately passed the 261-test SFU admission gate and explicit-Chrome access/privacy gate. Retained Chrome 20-Viewer and responsive visual checks apply only to their recorded predecessor revisions.
|
||||
- Chrome 151 on exact production `1d87615` used real dynamic-tab `getDisplayMedia()` at 1822x1080 and made only the ordinary STUN peer attempt unusable so the existing route operation reached its SFU suffix. Publisher and subscriber LiveKit PCs retained empty external ICE-server lists and selected UDP. The publisher exposed one video sender encoding and one outbound video stats object, both without RID; over six seconds it encoded 180 frames while the subscriber decoded and rendered 182 frames, with bytes advancing at both ends. This closes the single-representation implementation/deployment gate without claiming public SFU 60 fps, real-game quality, heterogeneous-network behavior, or endurance.
|
||||
- Chrome 151 on exact production `bf32859` captured a continuously changing tab with generated audio through real `getDisplayMedia()`. Two Host-direct children plus one browser-relay child and one forced-SFU Viewer all advanced decoded audio energy and video frames at 64/128/256 kbps sender ceilings and after live source replacement. Ordinary paths selected direct UDP; the SFU publisher/subscriber selected LiveKit UDP with empty external ICE-server lists. The UI never reported the faulty constant `1 kbps` with active audio. Direct/browser-relay actual traffic tracked each selected ceiling; SFU 64/128 traffic was higher because the accepted LiveKit default retains RED, so sender ceiling/readback and wire traffic remain distinct. After RTCP mapping became available, direct/browser-relay audio-minus-video playout timestamps ranged from -101 to +4 ms; Chrome exposed no corresponding value on the SFU subscription, so real-game SFU A/V synchronization remains open rather than inferred.
|
||||
- Chrome 151 on exact production `bf32859` used real `getDisplayMedia()`, a continuously changing source, separate Browser processes, VP8/libvpx, and no video hint. Direct stabilized near 59.5 encoded/received/decoded/rendered fps at 1904x928; a Browser relay kept every stage near 59.4--59.7 fps, adapting its outbound to 1428x696 under bandwidth pressure. Both converged after about 25--30 seconds of stock BWE ramp-up. On the exact public SFU path, current `q,h` publication held `h` near 9.2 fps/1.37 Mbps; making `q` inactive from the first sender-parameter application raised the same 1904x928 `h` to about 23.3 fps/3.32 Mbps with source/capture near 60, 4.46 ms encode time per frame, zero loss/retransmission, and about 4.81 Mbps available outgoing bitrate. This closes an intrinsic VP8/no-hint direct/relay shortfall and rejects always-active `LOW`; it does not prove a deployed single-representation SFU path, public SFU 60 fps, or real-game performance.
|
||||
- Chrome 151 on exact production `bf32859` used real `getDisplayMedia()`, a continuously changing source, separate Browser processes, VP8/libvpx, and no video hint. Direct stabilized near 59.5 encoded/received/decoded/rendered fps at 1904x928; a Browser relay kept every stage near 59.4--59.7 fps, adapting its outbound to 1428x696 under bandwidth pressure. Both converged after about 25--30 seconds of stock BWE ramp-up. On the exact public SFU path, the then-current `q,h` publication held `h` near 9.2 fps/1.37 Mbps; making `q` inactive from the first sender-parameter application raised the same 1904x928 `h` to about 23.3 fps/3.32 Mbps with source/capture near 60, 4.46 ms encode time per frame, zero loss/retransmission, and about 4.81 Mbps available outgoing bitrate. That gate closed an intrinsic VP8/no-hint direct/relay shortfall and rejected always-active `LOW`; it did not prove a deployed single-representation SFU path, public SFU 60 fps, or real-game performance.
|
||||
- Exact Browser SFU ICE-server-isolation implementation `ae09c760adec76fd26da611d4928486d105c6d3b` passed repository hygiene, TypeScript typecheck, all 605 Web tests in 45 files, client and server production builds, three independent code reviews, focused 95-test publisher/subscriber and ordinary-peer isolation coverage, deployment postflight, and owner physical SFU fallback media proof. This establishes the reported production connection fix without turning candidate type/count into an invariant; full route/network acceptance remains open.
|
||||
- A fresh canonical `main@c4962f5` background gate passed repository hygiene, all 605 Web tests, both production builds, the 254-test SFU admission suite, and the Chrome 151 20-Viewer 720p30/30-second local route gate. All 20 Viewers advanced decoded frames, Host and relays stayed within endpoint cap `2`, no orphan SFU publication appeared, and all four current-child timing distributions contained 20 values. The browser gate uses deterministic canvas and does not start LiveKit, so it proves local direct/browser-relay control and media behavior only; it is not physical capture or SFU evidence.
|
||||
- Exact v10 runtime source `fdd5a4a529ff297f41c05ea3388bf484d76afe8f` passed repository hygiene, TypeScript typecheck, client and server production builds, all 610 Web tests in 45 files, the 257-test SFU admission gate, the access/privacy Browser gate, and the production-dependency audit with zero vulnerabilities. Its one-Host/20-Viewer Chrome 151 direct-loopback report passed all seven assertions: all Viewers decoded, the selected VP8 settings reached every participant, Host and relay media edges stayed within cap `2`, no orphan SFU publication appeared, and all four current-child timing distributions contained 20 values. The report SHA-256 is `802CBB7632E9AEA3C39FE831A7F7880D24140B2E83942CE0DFDA05DE4B408EED`. This validates the v10 source boundary, not H.264 quality, hardware attribution, physical capture, public-network behavior, or SFU packet flow.
|
||||
- Chrome 151 synthetic `1/3/5/8` and 720p30 runs preserved bounded fanout and decoding. A `9461e20`-era three-Viewer rerun kept Host2/Browser Viewer1, decoded every Viewer, and recovered a hard first-level relay departure in 5,380 ms; it did not exercise quality-triggered MBB. Sixteen-Viewer cap2/cap3 loopbacks decoded all Viewers and a ten-second follow-up recorded guarded sender and aggregate Chromium CPU evidence, but resolution/FPS remained low and the ordinary-PC data cannot rank caps, select product policy, or prove sustainable heterogeneous-network quality. See [peer-assisted media](./research/peer-assisted-media.md).
|
||||
- Chrome 151 with local LiveKit 1.13.5/client 2.22.0 proved one SFU/UDP root after `q,f` -> `q,h`: decoded frames advanced 3 -> 23, rendered frames reached 26, Host used one edge, and leaves were clean. This is functional evidence only. See [low-server media routes](./research/low-server-media-routes.md).
|
||||
- Chrome 151 on the current Windows TUN path reproduced intermittent production LiveKit initial ICE before publication: server counters observed both ingress and egress while Browser ICE received no responses. Eight isolated Host attempts using the LiveKit-provided STUN endpoint succeeded `2/8`; explicitly empty Browser SFU `iceServers` succeeded `8/8`, observed a peer-reflexive-to-host UDP pair within 0.5--1.7 seconds, and published 75--89 ms later. This selects Browser SFU ICE-server isolation; the observed candidate type is diagnostic, not a gate, and the run does not close exact deployed Host/Viewer first-frame, mobile, quality, or endurance evidence. See [low-server media routes](./research/low-server-media-routes.md).
|
||||
- Host A+B and authenticated P2P Viewer C evidence is sanitized, generation-bound, diagnostic-only, and closed for stale or ambiguous reports. Production can expose a Host-local current SFU `h` snapshot and clears it on publisher identity changes; raw media metadata is not retained. See [realtime quality adaptation](./research/realtime-quality-adaptation.md).
|
||||
- Fresh Chrome 151 tab-capture probes identified two separate Browser boundaries. Removing video `contentHint = "motion"` changed VP8 from 14.93 fps at 428x208 to 29.73 fps at 1904x928 under the same 5 Mbps balanced setup. No-hint AMD H.264 remained about 14--16 fps with hundreds of outer rate-limiter drops, while the same MFT reached 29.93 fps under diagnostic Desktop SW BRC; OpenH264 was slower. The page cannot enable that Chromium field trial or select an adapter/MFT. No-hint VP8 used libvpx software and held about 30 fps in one- and two-sender loopback on the test machine, but the process CPU totals include capture and local decode and are not real-game or weaker-device evidence. This evidence selects fixed VP8 for the Browser contract; current source and production implement that decision, and the exact-production gate above now verifies VP8 on direct, Browser-relay, and current dual-representation SFU paths. See [realtime quality adaptation](./research/realtime-quality-adaptation.md), [Native H.264](./research/native-h264-hardware-decision.md), and [Native shared encode](./research/native-shared-encode-sender.md).
|
||||
- Host A+B and authenticated P2P Viewer C evidence is sanitized, generation-bound, diagnostic-only, and closed for stale or ambiguous reports. Production exposes one Host-local current SFU sender snapshot and clears it on publisher identity changes; raw media metadata is not retained. See [realtime quality adaptation](./research/realtime-quality-adaptation.md).
|
||||
- Fresh Chrome 151 tab-capture probes identified two separate Browser boundaries. Removing video `contentHint = "motion"` changed VP8 from 14.93 fps at 428x208 to 29.73 fps at 1904x928 under the same 5 Mbps balanced setup. No-hint AMD H.264 remained about 14--16 fps with hundreds of outer rate-limiter drops, while the same MFT reached 29.93 fps under diagnostic Desktop SW BRC; OpenH264 was slower. The page cannot enable that Chromium field trial or select an adapter/MFT. No-hint VP8 used libvpx software and held about 30 fps in one- and two-sender loopback on the test machine, but the process CPU totals include capture and local decode and are not real-game or weaker-device evidence. This evidence selects fixed VP8 for the Browser contract; current source and production implement that decision, and exact-production gates verify VP8 on direct, Browser-relay, and single-representation SFU paths. See [realtime quality adaptation](./research/realtime-quality-adaptation.md), [Native H.264](./research/native-h264-hardware-decision.md), and [Native shared encode](./research/native-shared-encode-sender.md).
|
||||
- One bounded Chrome 151/Windows 25H2 current-browser screening used real `getDisplayMedia()` window capture, VP8/libvpx with no video hint, a continuously changing WPF source, and one same-machine loopback receiver. Focused, hidden-tab, and minimized 15-second windows measured about 29.4--29.6 capture/encoded/decoded fps and 1.35--1.50 ms encode time per frame; each boundary sample read an enabled, unmuted, live 1186x712 track and each end sample reported `qualityLimitationReason=none`. All rates used monotonic counter deltas over the outbound-RTP RTCStats timestamp interval; source/inbound timestamps and raw stats identities were not retained independently. The sample did not observe an immediate Host-document background drop; it does not cover exact production code, a real game, physical Viewer, CPU/GPU contention, audio, repetition, a hold beyond five minutes, or public routing. See [Browser background capture](./research/browser-background-capture.md).
|
||||
- Native Windows 11 process audio is source-only and default-off. A retained run isolated the target by about 4018x and delivered 495 Opus packets to one Viewer; package download, game sync, Windows 10, and other routes remain open. See [ADR-0008](./adr/0008-window-scoped-audio-capture.md).
|
||||
|
||||
## Open Proof Boundaries
|
||||
|
||||
- Routing: exact v10 local direct loopback remains historical evidence for admission-20 initial ingress and exact-candidate first-frame commit timing on that source. Current v12 production still needs route rollback, direct-stage exhaustion and SFU admission, relay-ingress reparent with subtree retention, disconnect/effective-capacity drain, pause/resume, and bounded failure on real browser/media paths. Silent control partitions may wait 30 to 60 seconds for heartbeat detection before the default five-second grace; a non-paused decoded-frame stall may invalidate only that exact child edge.
|
||||
- Quality: exact-production direct and Browser-relay VP8/no-hint cadence is closed. Current source implements ADR-0007's single-`HIGH` SFU publication; deployment and exact single-representation publisher/subscriber evidence remain open. Startup ramp is stock BWE behavior and does not authorize an SDP or application bitrate workaround.
|
||||
- Quality: exact-production direct and Browser-relay VP8/no-hint cadence plus ADR-0007's single-`HIGH` SFU implementation/deployment gate are closed. Public SFU 60 fps, real-game quality, heterogeneous devices, and endurance remain open. Startup ramp is stock BWE behavior and does not authorize an SDP or application bitrate workaround.
|
||||
- Host background: deferred until the report reproduces on exact production with a continuously changing real game or replay, a separate direct wired Viewer, synchronized capture/outbound/inbound plus CPU/GPU evidence, and repeated focused/unfocused/hidden/minimized windows. The current-Chrome Browser `getDisplayMedia()` WPF-window screening did not observe an immediate Host-page media drop, and the old harmful `contentHint = "motion"` release remains a plausible confound rather than a proven background cause. Current evidence authorizes no keepalive, Wake Lock, timer, codec switch, route change, or Native fallback.
|
||||
- Relay resources: current source and production expose the authenticated `1/2/3` endpoint-cap boundary, and retained v10 local loopback evidence covers 20 Viewers at cap `2` only for that source. CPU/GPU/upload and heterogeneous-network measurements remain diagnostics, not authority to change the contract.
|
||||
- Room scale: current source and production admit 20 Viewers plus one Host, and the retained v10 local Browser convergence gate covers that bound on direct loopback. A real public-network 1:20 session, quality, and sustained resource matrix remain open.
|
||||
- SFU: production uses one Host publication with exact Viewer subscriptions and no fixed root-count or room-wide lease rule. Browser SFU PCs use the accepted empty-external-ICE-server rule and owner physical media proof closed the reported connection hold. Current source publishes one `HIGH` encoding without simulcast or a subscriber layer selector, while production still publishes `q,h`; exact deployment and physical proof remain open. Real LiveKit lifecycle/JWT replay, resource use, SFU-fed first-child behavior, and broader heterogeneous-network acceptance remain open.
|
||||
- Audio: current v12 source and production select the exact active ordinary Host or SFU publisher audio sender, reset samples across track changes or absence, keep relay children synchronized with persistent-stream audio changes, and reacquire exact SFU publications/senders after reconnect. The reported active-source `1 kbps` observation and all three live ceilings are physically closed on current Chrome/production across direct, browser-relay and SFU. Audible game quality, heterogeneous-network changes and real-game A/V synchronization remain part of route acceptance; a muted/idle Opus track may still legitimately remain near 1 kbps.
|
||||
- SFU: source and production use one Host `HIGH` encoding without simulcast or a subscriber layer selector, with exact Viewer subscriptions and no fixed root-count or room-wide lease rule. Chrome 151 physically closed the empty-external-ICE-server connection hold and exact single-representation publisher/subscriber gate. Real LiveKit lifecycle/JWT replay, resource use, SFU-fed first-child behavior, and broader heterogeneous-network acceptance remain open.
|
||||
- Audio: current v12 source and production select the exact active ordinary Host or SFU publisher audio sender, reset samples across track changes or absence, keep relay children synchronized with persistent-stream audio changes, and reacquire exact SFU publications/senders after reconnect. Chrome 151 on exact production `bf32859` physically closed the reported active-source `1 kbps` observation and all three live ceilings across direct, browser-relay and SFU. Audible game quality, heterogeneous-network changes and real-game A/V synchronization remain part of route acceptance; a muted/idle Opus track may still legitimately remain near 1 kbps.
|
||||
- Observability: current v12 source and production keep local connection details but no Host/Viewer diagnostic downloads or Browser file-export plumbing. The Host-only bounded snapshot stays for automatic acceptance. Chrome 151 supplied selected candidate endpoints and ordinary-route A/V playout timestamps in the current gate, but omitted the SFU A/V timestamp. Target-browser availability and actual values remain open for codec/fmtp and encoder implementation/power efficiency, media-source and encoded FPS, and broader jitter/concealment cases. All retained fields diagnose and have no recovery authority; they do not by themselves prove hardware encode, synchronization quality, or route quality.
|
||||
- Mobile: Android/iOS remain Viewer-only. Autoplay, rotation, iOS lock-screen/page reclamation, background reconnection, and network changes need device evidence. AirPlay/system mirroring is Viewer-local output, not a portable in-app WebRTC output contract.
|
||||
- Native: ADR-0006 has one-Viewer evidence only. Viewer2/FIFO, hardware diversity, endurance, downloaded-package/public-host, game A/V, and browser diversity remain open.
|
||||
|
||||
+2
-2
@@ -2,7 +2,7 @@
|
||||
|
||||
## 2026-08-18 14:45
|
||||
|
||||
状态：production 运行精确 application/runtime revision `bf328590b3de5dfa509fcc70f6316286af3eae7e`、release `bf32859` 和严格 `screener-v12`；canonical `main` 含相同 application/runtime tree 与当前 truth checkpoint。源码与生产已实现 22 字符 room-lived Viewer grant、`ROOM_NOT_FOUND`、产品诊断下载移除、完整短 URL 邀请 UI、收敛的房间密码控件、exact-current audio stats 与音轨跨 relay/SFU reconnect 连续性，并固定 Browser VP8，video 不设置 `contentHint`、audio 保留 `music`，且无 codec UI/state/wire 或分享生命周期分支；Pause/Resume 继续由当前 Host session 和 `shareGeneration` 约束。Owner 的 SFU fallback 实测证据仍严格归属于 predecessor release `c4962f5`。
|
||||
状态：production 运行精确 application/runtime revision `1d8761528d0dba43fb6d818df3934483ba2f5340`、release `1d87615` 和严格 `screener-v12`；canonical `main` 含相同 application/runtime tree 与当前 truth checkpoint。源码与生产已实现 22 字符 room-lived Viewer grant、`ROOM_NOT_FOUND`、产品诊断下载移除、完整短 URL 邀请 UI、收敛的房间密码控件、exact-current audio stats 与音轨跨 relay/SFU reconnect 连续性，并固定 Browser VP8，video 不设置 `contentHint`、audio 保留 `music`，且无 codec UI/state/wire 或分享生命周期分支；Pause/Resume 继续由当前 Host session 和 `shareGeneration` 约束。Browser SFU 发布为单个无 RID 的 `HIGH` encoding，不启用 simulcast 或 Dynacast；Chrome 151 已在该精确 production 上验证发布端与订阅端经 LiveKit UDP 持续推进帧。
|
||||
|
||||
## 目标与边界
|
||||
|
||||
@@ -362,7 +362,7 @@ Token-free SFU standby prewarm 保持可选且不创建 participant、publicatio
|
||||
|
||||
## 当前交付边界
|
||||
|
||||
- Production 使用严格单一 `screener-v12` wire 和精确 deployed application/runtime revision `bf328590b3de5dfa509fcc70f6316286af3eae7e`、release `bf32859`；current source 含相同 application/runtime tree 与当前 truth checkpoint。两者均已实现短 room-lived grant、明确 missing-room 结果、产品诊断下载移除、完整短 URL 邀请 UI、exact-current audio stats 与音轨跨 relay/SFU reconnect 连续性，固定 Browser VP8 且 video 不设置 `contentHint`，codec selector、quality-state/wire 字段与分享生命周期 codec 分支不存在。
|
||||
- Production 使用严格单一 `screener-v12` wire 和精确 deployed application/runtime revision `1d8761528d0dba43fb6d818df3934483ba2f5340`、release `1d87615`；current source 含相同 application/runtime tree 与当前 truth checkpoint。两者均已实现短 room-lived grant、明确 missing-room 结果、产品诊断下载移除、完整短 URL 邀请 UI、exact-current audio stats 与音轨跨 relay/SFU reconnect 连续性，固定 Browser VP8 且 video 不设置 `contentHint`，codec selector、quality-state/wire 字段与分享生命周期 codec 分支不存在；Browser SFU 只发布一个 `HIGH` encoding，不启用 simulcast 或 Dynacast。
|
||||
- Pause/Resume 由当前 Host session 和 `shareGeneration` 约束。Host 后台性能和 VP8 hardware acceleration 分别按受控根因证据诊断；标准 ICE/SFU 按真实异构网络验收。
|
||||
- 当前发布面只包含 Web Host、Viewer 和 browser relay。Native sender、capture helper、shared-encode executable 与两个分发包仍由各自后续决策和物理证据驱动，不属于当前 Browser release。
|
||||
|
||||
|
||||
Reference in new issue
Block a user