From 9591b4dafffb4c6edf83aa188b83a49afa733d4a Mon Sep 17 00:00:00 2001 From: AAA <35992542+TNTcraftHIM@users.noreply.github.com> Date: Tue, 25 Aug 2026 06:11:15 +0800 Subject: [PATCH] docs: record single-representation production gate (#249) --- docs/README.md | 4 +-- docs/adr/0001-p2p-first-media-topology.md | 8 ++--- .../0002-memory-resident-protected-rooms.md | 7 ++-- .../0005-automatic-hybrid-media-routing.md | 12 +++---- ...07-path-isolated-representation-quality.md | 6 ++-- docs/deployment.md | 29 ++++++++-------- docs/project-memory.md | 11 +++--- docs/research/advanced-peer-distribution.md | 8 ++--- docs/research/browser-background-capture.md | 8 ++--- docs/research/browser-screen-audio-quality.md | 15 ++++---- docs/research/low-server-media-routes.md | 11 ++---- docs/research/peer-assisted-media.md | 10 +++--- docs/research/realtime-quality-adaptation.md | 34 +++++++++++++------ docs/session-handoff.md | 17 +++++----- docs/status.md | 15 ++++---- docs/todo.md | 3 +- docs/verification-status.md | 19 ++++++----- docs/方案设计.md | 4 +-- 18 files changed, 110 insertions(+), 111 deletions(-) diff --git a/docs/README.md b/docs/README.md index e85af28..b80e3b9 100644 --- a/docs/README.md +++ b/docs/README.md @@ -4,10 +4,10 @@ - [方案设计](./方案设计.md): accepted implementation design; unfinished release and validation work is tracked in the current TODO ledger. - [Project memory](./project-memory.md): durable current product and source snapshot to read at the start of future work. - [Current status](./status.md): bounded current/index snapshot of production, active milestones, decisions, blockers, and links to detail. -- [Verification status](./verification-status.md): exact integrated/deployed v11 gates, current production evidence, open physical proof boundaries, and expensive-test applicability. +- [Verification status](./verification-status.md): exact integrated/deployed gates, current production evidence, open physical proof boundaries, and expensive-test applicability. - [Session handoff](./session-handoff.md): temporary bootstrap prompt that points a new session back to the canonical truth owners. - [Current TODO](./todo.md): unresolved work, active truth holds, and decisions that still require user confirmation. -- [Deployment](./deployment.md): exact current v11 production, immutable release operations, scoped recovery rules, and transport evidence boundaries. +- [Deployment](./deployment.md): exact current production, immutable release operations, scoped recovery rules, and transport evidence boundaries. - [Maintenance guide](./maintenance.md): Git workflow, context hygiene, document lifecycle, research policy, and automation. - [P2P WebRTC research](./research/webrtc-p2p-screen-sharing.md): evidence, bandwidth model, browser constraints, reference implementations, and feasibility assessment. - [Peer-assisted media research](./research/peer-assisted-media.md): browser shared-encode limits, standard relay re-encoding, deterministic sticky topology, exact-route implementation evidence, and remaining physical gates. diff --git a/docs/adr/0001-p2p-first-media-topology.md b/docs/adr/0001-p2p-first-media-topology.md index 7d2121e..de7b5a4 100644 --- a/docs/adr/0001-p2p-first-media-topology.md +++ b/docs/adr/0001-p2p-first-media-topology.md @@ -31,11 +31,9 @@ contradict the private-room cost model or duplicate mature WebRTC capabilities. ## Current Ownership [ADR-0005](./0005-automatic-hybrid-media-routing.md) owns current routing -invariants and assisted-route roles. Production runs exact deployed -application/runtime revision `c4962f54443ad5f98bc65861195a3d9c74a48996`, release -`c4962f5`; canonical `main` contains the same runtime code. Current source and -production use the strict `screener-v11` Browser wire and the same accepted route -model. Real-network validation remains open. +invariants and assisted-route roles. Current source, production, and +real-network validation are indexed by [status](../status.md) and +[verification status](../verification-status.md). [ADR-0004](./0004-peer-assisted-media-experiment.md) owns only historical peer-assisted evidence. Access and room lifetime are owned by [ADR-0002](./0002-memory-resident-protected-rooms.md). diff --git a/docs/adr/0002-memory-resident-protected-rooms.md b/docs/adr/0002-memory-resident-protected-rooms.md index f4c7b67..949fe22 100644 --- a/docs/adr/0002-memory-resident-protected-rooms.md +++ b/docs/adr/0002-memory-resident-protected-rooms.md @@ -1,6 +1,6 @@ # ADR-0002: Memory-Resident Rooms And Scoped Viewer Access -- Status: Accepted and deployed in exact release `bf32859` on strict v12 +- Status: Accepted and deployed on strict v12 - Date: 2026-08-23 ## Context @@ -173,10 +173,9 @@ the generic `SERVER_ERROR`. None of those paths is folded into Current source and production use the strict `screener-v12` wire and implement the 22-character room-incarnation grant, exact digest validation, rotate/revoke, browser-storage privacy, `open | private` code entry, and the `ROOM_NOT_FOUND` -split without a v11 parser. Production is exact deployed revision -`bf328590b3de5dfa509fcc70f6316286af3eae7e`, release `bf32859`. +split without a v11 parser. -Exact release and operational evidence remain owned by deployment and +Exact release and operational evidence are owned by deployment, status, and verification status. ## Decision Sources diff --git a/docs/adr/0005-automatic-hybrid-media-routing.md b/docs/adr/0005-automatic-hybrid-media-routing.md index ecfbb7a..0a377aa 100644 --- a/docs/adr/0005-automatic-hybrid-media-routing.md +++ b/docs/adr/0005-automatic-hybrid-media-routing.md @@ -1,6 +1,6 @@ # ADR-0005: Automatic Hybrid Media Routing -- Status: The route model is accepted and deployed in exact release `bf32859` +- Status: The route model is accepted and deployed in exact release `1d87615` on strict v12, including Browser SFU ICE-server isolation, no product diagnostic-download UI, and the retained Host-only acceptance snapshot. - Date: 2026-08-20 @@ -362,15 +362,15 @@ deployment-wide. ## Current Source And Deployment Boundary Production runs exact deployed application/runtime revision -`bf328590b3de5dfa509fcc70f6316286af3eae7e`, release `bf32859`; canonical `main` +`1d8761528d0dba43fb6d818df3934483ba2f5340`, release `1d87615`; canonical `main` contains the same application/runtime tree plus the current truth checkpoint, including exact Browser SFU ICE-server-isolation implementation `ae09c760adec76fd26da611d4928486d105c6d3b`. Both run strict `screener-v12` and the direct/STUN peer plus LiveKit SFU/UDP route model. Browser SFU PCs use empty -external ICE-server lists. Owner physical fallback proof remains bounded to -predecessor release `c4962f5`; the operation owner remains only `route`. Exact operational -evidence is owned by the deployment document; broader heterogeneous-network, -codec, and SFU lifecycle validation remains open. +external ICE-server lists. Chrome 151 on that exact production verified one +publisher and one subscriber advancing frames over LiveKit UDP; the operation +owner remains only `route`. Exact operational evidence is owned by the deployment +document; broader heterogeneous-network and SFU lifecycle validation remains open. ## Acceptance Boundary diff --git a/docs/adr/0007-path-isolated-representation-quality.md b/docs/adr/0007-path-isolated-representation-quality.md index e3c0539..7d0f341 100644 --- a/docs/adr/0007-path-isolated-representation-quality.md +++ b/docs/adr/0007-path-isolated-representation-quality.md @@ -148,8 +148,10 @@ results do not create an application media-layer selector or route authority: The current Browser decision is one `HIGH` representation without simulcast, Dynacast, or a manual layer controller. The measured public `q`-inactive A/B - remained bandwidth-constrained, so this verdict does not claim SFU 60 fps or - replace the pending exact single-representation production gate. + remained bandwidth-constrained, so this verdict does not claim SFU 60 fps. + Chrome 151 later closed the exact-production single-representation gate on + release `1d87615` with one no-RID encoding and progressing publisher and + subscriber frames over LiveKit UDP. Reopening a dual/native representation is a new decision with new physical game, encoder, and upload evidence. 3. **Current Web/LiveKit SVC: rejected diff --git a/docs/deployment.md b/docs/deployment.md index 79ca933..4a15f64 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -3,7 +3,7 @@ Last verified against upstream documentation: 2026-08-24. This page records production running exact deployed application/runtime revision -`bf328590b3de5dfa509fcc70f6316286af3eae7e`, release `bf32859`, and the single +`1d8761528d0dba43fb6d818df3934483ba2f5340`, release `1d87615`, and the single Browser `screener-v12` contract. Product direction and pending work are owned by [project memory](./project-memory.md) and [the TODO ledger](./todo.md). @@ -13,8 +13,8 @@ Caddy or nginx; ordinary peer ICE advertises only STUN, while Browser LiveKit PCs configure no external ICE server and retain LiveKit-signaled UDP candidates. LiveKit supplies bounded SFU fallback capacity. Normal media remains distributed through direct or peer edges whenever those paths work. Production includes -implementation `ae09c760adec76fd26da611d4928486d105c6d3b`; the owner's physical SFU -fallback media proof remains bounded to predecessor release `c4962f5`. +implementation `ae09c760adec76fd26da611d4928486d105c6d3b`. Chrome 151 physically +verified its exact single-representation SFU publisher and subscriber. A deployment may additionally provide one dedicated single-node LiveKit process as the current controller's automatic final media fallback. This capacity is @@ -25,21 +25,22 @@ ICE/UDP only. Ordinary peer ICE remains STUN-only and production coturn uses the tracked STUN-only configuration with TCP/TLS disabled. The source and production configure no TURN, ICE/TCP, media TCP, or TLS-relayed media. -Production runs exact `bf328590b3de5dfa509fcc70f6316286af3eae7e`, release -`bf32859`, from `/opt/screener/releases/bf32859`. The immutable runtime ZIP +Production runs exact `1d8761528d0dba43fb6d818df3934483ba2f5340`, release +`1d87615`, from `/opt/screener/releases/1d87615`. The immutable runtime ZIP SHA-256 is -`e8b8fccf0ab15591af5e6675ca9236bae28b648dccfa8b1ea208a79b927168be`. +`715480487059bf83516a34e0d1083b52437619838c46bdc26ca5967529a1cf05`. Its 38-file path/size/hash manifest SHA-256 is -`d1c6b7c025e37711c0d06f5ec222a6fba26391d2e34a06b374deb1a05ddd63c6`. +`96845789560394ca20b16c37a8e7ddadc7b488876e32241709d0f7a577fdca26`. Local and public `/healthz` return 200; Screener, LiveKit, coturn, and nginx are active with `NRestarts=0`. The public main Browser asset is -`assets/index-BmWh33Cv.js` with SHA-256 -`e0400b1d5a5017bf5851158f5a884425aaca0269c5e3efa4cc521f3580c19bce`. +`assets/index-DfMqhOXY.js` with SHA-256 +`cf6dd1c46cc9414a87331a9312eec315ddce8fce565741284998aa0141b18d47`. The release deploys the single Browser `screener-v12` wire, fixed VP8 for Browser -direct, browser-relay, and SFU video, no video `contentHint`, no codec UI/state/wire, -random four-digit -memory rooms with a 24-hour dormant lease, a room-lived 22-character grant, +direct, browser-relay, and SFU video, one SFU `HIGH` encoding without simulcast +or a subscriber layer selector, disabled Dynacast, no video `contentHint`, no +codec UI/state/wire, random four-digit memory rooms with a 24-hour dormant lease, +a room-lived 22-character grant, orthogonal `open | private` grant/code admission, 20-Viewer room admission, the uniform endpoint media-copy cap `2`, and the one-controller exact-candidate route runtime. Exact predecessor release @@ -271,7 +272,7 @@ lifetime. An actively connected Host prevents expiry; explicit stop or Host disconnect starts the lease, and only the exact Host token renews it before expiry. Viewer activity never renews ownership. `ROOM_DATABASE_PATH` and `ROOM_TTL_SECONDS` fail startup even when blank. -Production `bf32859` accepts 1 through 20 and explicitly selects 20. This is an +Production `1d87615` accepts 1 through 20 and explicitly selects 20. This is an admission limit, not evidence that every publisher, network, or quality profile can sustain that many streams. `ENDPOINT_MEDIA_COPY_CAPACITY` defaults to 2 and accepts only 1, 2, or 3. It is @@ -284,7 +285,7 @@ must fail or wait before a fourth endpoint copy is issued. Supplying the removed `MAX_PEER_RELAY_DOWNSTREAM_EDGES`, even blank, fails startup. -Production release `bf32859` runs the deployed server and Browser assets +Production release `1d87615` runs the deployed server and Browser assets atomically on `screener-v12`; every stale Browser or executable-sender wire fails before room authority. Native senders and helpers are outside this release. diff --git a/docs/project-memory.md b/docs/project-memory.md index e43a4e5..329bc90 100644 --- a/docs/project-memory.md +++ b/docs/project-memory.md @@ -29,19 +29,18 @@ Last updated: 2026-08-25 ## Current Source And Production -- Production runs exact application/runtime revision `bf328590b3de5dfa509fcc70f6316286af3eae7e`, release `bf32859`, on strict `screener-v12`; canonical `main` contains the same application/runtime tree plus the current truth checkpoint. -- Current source and production admit up to `20` Viewers and implement the uniform `1/2/3` endpoint cap, exact prepare candidate, first-decoded-frame commit, strict rollback revision, decoded-progress stall, a two-stage direct/SFU operation deadline, and one event-driven room controller. A short-lived exact-generation decoded-frame observer proves only the pending candidate inside the existing total deadline; the periodic stats sampler remains responsible for active-path diagnostics and stalls. Ordinary peer ICE is STUN-only and the sole application fallback is SFU/UDP; stale TURN environment keys fail startup. SFU admission uses exact publication and Viewer-subscription handles with explicit no-default ingress/egress capacities and a listener-fenced dedicated LiveKit owner. Browser SFU publisher/subscriber connects use fresh empty ICE-server options; the owner physically verified deployed SFU fallback media after release `c4962f5`, closing the prior core-route hold. +- Production runs exact application/runtime revision `1d8761528d0dba43fb6d818df3934483ba2f5340`, release `1d87615`, on strict `screener-v12`; canonical `main` contains the same application/runtime tree plus the current truth checkpoint. +- Current source and production admit up to `20` Viewers and implement the uniform `1/2/3` endpoint cap, exact prepare candidate, first-decoded-frame commit, strict rollback revision, decoded-progress stall, a two-stage direct/SFU operation deadline, and one event-driven room controller. A short-lived exact-generation decoded-frame observer proves only the pending candidate inside the existing total deadline; the periodic stats sampler remains responsible for active-path diagnostics and stalls. Ordinary peer ICE is STUN-only and the sole application fallback is SFU/UDP; stale TURN environment keys fail startup. SFU admission uses exact publication and Viewer-subscription handles with explicit no-default ingress/egress capacities and a listener-fenced dedicated LiveKit owner. Browser SFU publisher/subscriber connects use fresh empty ICE-server options; Chrome 151 on exact production `1d87615` verified one no-RID publisher encoding and progressing publisher/subscriber frames over LiveKit UDP, closing the current single-representation gate. - Source and production use random four-digit memory rooms, dormant leases, exact-Host resume, restart loss, local preference replay, orthogonal grants/code entry, and no SQLite runtime. V12 uses a 22-character room-incarnation grant, `ROOM_NOT_FOUND`, no diagnostic-file export, and a compact UI showing the complete shorter URL. - Exact production artifacts, services, ports, and any change-scoped infrastructure recovery boundary are owned by [deployment](./deployment.md) and indexed by [status](./status.md). -- Source and production require v12, fixed VP8, and no video hint. Current source publishes exactly one SFU `HIGH` encoding without simulcast or a subscriber layer selector; production still sends ordered `q,h` until the next application cutover. Current Pause/Resume, live audio ceilings, exact-sender metrics, relay/SFU audio continuity, typed Viewer presentation, and quality profiles match the product truths above. +- Source and production require v12, fixed VP8, and no video hint. Both publish exactly one SFU `HIGH` encoding without simulcast or a subscriber layer selector and keep Dynacast disabled. Current Pause/Resume, live audio ceilings, exact-sender metrics, relay/SFU audio continuity, typed Viewer presentation, and quality profiles match the product truths above. - Browser SFU subscribers reconcile eligible Host screen publications across connect/activate event ordering, participant/track arrival, and reconnect. Production LiveKit logs only warn/error, and the application service has a bounded same-host LiveKit readiness preflight. -- Exact `main@bf32859` passed TypeScript, 613 Web tests, both builds, hygiene, review, and production postflight. Chrome 151 closed direct/browser-relay VP8 cadence and active-audio ceilings; its SFU A/B rejected always-active `LOW` without claiming a deployed single representation, public SFU 60 fps, or real-game synchronization. Exact metrics live in [verification status](./verification-status.md). +- Exact `main@1d87615` passed TypeScript, 607 Web tests, both builds, hygiene, three reviews, production postflight, and a Chrome 151 physical gate proving one no-RID SFU encoding with progressing publisher/subscriber frames over LiveKit UDP. Earlier gates closed direct/browser-relay VP8 cadence and active-audio ceilings; public SFU 60 fps and real-game synchronization remain unproven. Exact metrics live in [verification status](./verification-status.md). - Chrome loopback, cap2/cap3, short resource, recovery, MBB, and A/V fixtures are bounded evidence only. They do not establish quality, resource limits, or product policy. ## Current Priority -1. Deploy and physically verify the current single-`HIGH` Browser SFU publication; leave direct, browser-relay, content-hint, and routing behavior unchanged. -2. Then finish real-network route, recovery, screen-audio and real-game A/V acceptance. Browser VP8 hardware acceleration and mobile Viewer lifecycle remain Accepted Later; Native/executable, distribution, and repository-wide simplification remain later phases. +1. Finish real-network route, recovery, screen-audio and real-game A/V acceptance. Browser VP8 hardware acceleration and mobile Viewer lifecycle remain Accepted Later; Native/executable, distribution, and repository-wide simplification remain later phases. The desktop Host background/minimized report is deferred until it reproduces on current production with a real game and synchronized media plus CPU/GPU evidence. The bounded current-Chrome screening found no immediate Host-page lifecycle drop, and removal of the old harmful `contentHint = "motion"` remains a plausible confound rather than a proven background fix. Mobile Viewer playback and assigned-relay survival remain a separate lifecycle gate. diff --git a/docs/research/advanced-peer-distribution.md b/docs/research/advanced-peer-distribution.md index 481a3bf..33539be 100644 --- a/docs/research/advanced-peer-distribution.md +++ b/docs/research/advanced-peer-distribution.md @@ -8,11 +8,9 @@ retained evidence. Exact Browser v10 source `fdd5a4a529ff297f41c05ea3388bf484d76afe8f` implements ADR-0005's single child-reparent reconciliation and exact first-frame transaction and remains - dated implementation evidence. Production runs exact deployed - application/runtime revision `c4962f54443ad5f98bc65861195a3d9c74a48996`, release - `c4962f5`; canonical `main` contains the same runtime code. Current source and - production run the strict `screener-v11` form of that route contract. - Advanced encoded-media routes remain unimplemented candidates. + dated implementation evidence. Current source and production are indexed by + [status](../status.md) and follow ADR-0005. Advanced encoded-media routes remain + unimplemented candidates. This document is research evidence, not current architecture or a backlog. See [ADR-0005](../adr/0005-automatic-hybrid-media-routing.md) for accepted routing diff --git a/docs/research/browser-background-capture.md b/docs/research/browser-background-capture.md index 72af6ad..bd00f96 100644 --- a/docs/research/browser-background-capture.md +++ b/docs/research/browser-background-capture.md @@ -73,11 +73,9 @@ gate and do not inherit this desktop Host result. ## Current Source Boundary The no-video-hint review baseline is -`a26eb39dc677003110787b0ed1581c208f894fd7`. Production runs exact deployed -application/runtime revision `c4962f54443ad5f98bc65861195a3d9c74a48996`, release -`c4962f5`; canonical `main` contains the same runtime code. Current source and -production use strict `screener-v11`, fixed VP8, no video hint, and no codec UI, -quality state, or wire field. +`a26eb39dc677003110787b0ed1581c208f894fd7`. Current source and production use +fixed VP8, no video hint, and no codec UI, quality state, or wire field; their +exact identity is owned by [status](../status.md). The current path does not claim or implement a page-keepalive mechanism, and deployment health supplies no physical background-capture evidence. diff --git a/docs/research/browser-screen-audio-quality.md b/docs/research/browser-screen-audio-quality.md index 68e6f3b..c92422e 100644 --- a/docs/research/browser-screen-audio-quality.md +++ b/docs/research/browser-screen-audio-quality.md @@ -4,12 +4,11 @@ Accessed: 2026-08-25 Status: current Browser source and production use strict `screener-v12`, fixed VP8, no video hint, and one Opus screen-audio path with bounded 64/128/256 kbps -sender ceilings. Production runs exact application/runtime revision -`bf328590b3de5dfa509fcc70f6316286af3eae7e`, release `bf32859`; canonical -`main` contains the same runtime code. The capture request disables local speech -processing, live mutation has applied readback, relay track changes preserve the -persistent stream, and SFU reconnect reacquires exact publications/senders. -Current-production physical evidence closes the active-source `1 kbps` report; +sender ceilings. Exact source and production identities are owned by +[status](../status.md). The capture request disables local speech processing, +live mutation has applied readback, relay track changes preserve the persistent +stream, and SFU reconnect reacquires exact publications/senders. +Exact-production `bf32859` physical evidence closes the active-source `1 kbps` report; audible game quality and real-game SFU A/V synchronization remain open. ## Observed-Bitrate Identity Boundary @@ -468,8 +467,8 @@ deltas in earlier video loopbacks. This is functional evidence, not packaging, real-game sync, second-Viewer, SFU/UDP, or endurance evidence. Run one bounded matrix rather than a full route Cartesian product against -production release `c4962f5` and its matching current runtime source on Windows -Chrome/Edge for tab/window/monitor, +the exact production release and matching runtime source at execution time on +Windows Chrome/Edge for tab/window/monitor, audio selected/unselected, and a simultaneous voice call; then the native candidate on current Windows 11 with game parent and child audio, an independent voice process, notifications, no render stream, and process restart. Windows 10 diff --git a/docs/research/low-server-media-routes.md b/docs/research/low-server-media-routes.md index 83a6478..f7861d5 100644 --- a/docs/research/low-server-media-routes.md +++ b/docs/research/low-server-media-routes.md @@ -5,13 +5,8 @@ low latency, and bounded host media fanout - Status: research and dated route evidence. Current invariants and assisted transport roles are in [ADR-0005](../adr/0005-automatic-hybrid-media-routing.md). - Production runs exact deployed application/runtime revision - `c4962f54443ad5f98bc65861195a3d9c74a48996`, release `c4962f5`; canonical - `main` and production include Browser SFU ICE-server-isolation implementation - `ae09c760adec76fd26da611d4928486d105c6d3b` and owner physical fallback proof. - Source and production retain the route transaction and diagnostics on - strict `screener-v11`. Real-network validation remains in - [verification status](../verification-status.md). + Current source and production are indexed by [status](../status.md); + real-network validation remains in [verification status](../verification-status.md). ## Current Transport Conclusion @@ -603,7 +598,7 @@ counters would not be deployment-wide admission. | Route | Where copies are emitted | Endpoint cost | Evidence status | | --- | --- | --- | --- | | Direct host P2P | Host emits one copy per Viewer | Host upload and sender pipelines grow with Viewers | Baseline evidence; current capacity is owned by the product contract | -| Bounded browser relay DAG | Host and each Web relay emit at most the configured endpoint cap | Ordinary browser, but every relay decodes and re-encodes and adds a hop | Current v11 source and production both admit up to 20; the exact v10 local direct loopback gate passed, while heterogeneous networks remain open | +| Bounded browser relay DAG | Host and each Web relay emit at most the configured endpoint cap | Ordinary browser, but every relay decodes and re-encodes and adds a hop | Current source and production admit up to 20; the exact v10 local direct loopback gate passed, while heterogeneous networks remain open | | Native shared-encode host | Host targets one encode for standard WebRTC edges | libwebrtc public-API proxy risk spike, with Pion as fallback | Research evidence; still pays per-edge upload | | Native volunteer encoded-RTP relay | Each volunteer forwards one encoded copy | Native install, RTP/RTCP forwarding, packaging, and opt-in relay policy | Research only; no current product authorization | | SFU service | SFU emits authorized subscription copies | Service pays bounded egress; an authoritative Host publisher supplies media | Production deploys the current topology/admission; local LiveKit functional evidence exists, while heterogeneous-network/resource validation remains open | diff --git a/docs/research/peer-assisted-media.md b/docs/research/peer-assisted-media.md index 02aca9c..4c97020 100644 --- a/docs/research/peer-assisted-media.md +++ b/docs/research/peer-assisted-media.md @@ -6,12 +6,10 @@ earlier resource/quality gate remains eight - Status: historical evidence plus the bounded controller. Exact Browser v10 source `fdd5a4a529ff297f41c05ea3388bf484d76afe8f` remains the dated local - direct-loopback implementation evidence. Production runs exact deployed - application/runtime revision `c4962f54443ad5f98bc65861195a3d9c74a48996`, release - `c4962f5`; canonical `main` contains the same runtime code. Current source and - production run the strict `screener-v11` ADR-0005 route transaction. A - historical v8 canary decoded SFU media. Heterogeneous-network, mobile, - resource, and endurance evidence remains open. + direct-loopback implementation evidence. Current source and production are + indexed by [status](../status.md) and follow ADR-0005. A historical v8 canary + decoded SFU media. Heterogeneous-network, mobile, resource, and endurance + evidence remains open. This document owns dated measurements and implementation evidence. Current capacity and routing authority live in [ADR-0005](../adr/0005-automatic-hybrid-media-routing.md) diff --git a/docs/research/realtime-quality-adaptation.md b/docs/research/realtime-quality-adaptation.md index 34e62d1..dd7dabb 100644 --- a/docs/research/realtime-quality-adaptation.md +++ b/docs/research/realtime-quality-adaptation.md @@ -12,7 +12,7 @@ game UI, maps, subtitles, and text become unreadable; `maintain-resolution` may instead lower frame rate. Neither preference overrides congestion control. Production runs exact deployed application/runtime revision -`bf328590b3de5dfa509fcc70f6316286af3eae7e`, release `bf32859`; canonical +`1d8761528d0dba43fb6d818df3934483ba2f5340`, release `1d87615`; canonical `main` contains the same runtime code. Current Browser source and production use strict `screener-v12`, fixed VP8, no video `contentHint`, and no codec UI, quality state, or wire field. They use `balanced` as the recommended profile @@ -49,7 +49,7 @@ available bandwidth without losing frame cadence. Both paths needed about intrinsic VP8/no-hint localhost 60 fps shortfall; sender ceilings are not startup or delivery guarantees, and no application start-bitrate hack follows. -The exact SFU path isolated a different issue. With the current ordered `q,h` +The exact SFU path isolated a different issue. With the then-deployed ordered `q,h` publication, the 1904x928 `h` stream stabilized near 9.2 fps and 1.37 Mbps. With `q` inactive from the first sender-parameter application, the otherwise unchanged `h` stream reached about 23.3 fps and 3.32 Mbps. Source/capture stayed @@ -61,6 +61,18 @@ ADR-0007 rejects that candidate and accepts one Browser SFU `HIGH` representation. The public SFU ingress remained constrained, so this gate does not claim SFU 60 fps or real-game performance. +## 2026-08-25 Exact-Production Single-Representation Gate + +Chrome 151 exercised exact production `1d87615` with a real dynamic tab capture. +The bounded gate made only the ordinary STUN peer attempt unusable so the existing +route operation reached its SFU suffix; Browser LiveKit publisher and subscriber +PCs retained empty external ICE-server lists and selected UDP. The publisher +reported one video sender encoding and one outbound video stats object, both +without RID. Over six seconds it encoded 180 frames and the subscriber decoded +and rendered 182 frames at 1822x1080, with byte counters advancing on both ends. +This closes ADR-0007's implementation/deployment gate. It does not establish +public SFU 60 fps, real-game quality, heterogeneous networks, or endurance. + ## Route Quality Authority Current-path WebRTC stats can diagnose loss, RTT, jitter, bitrate, resolution, @@ -179,7 +191,7 @@ video blur, but Screener does not add application SDP bitrate hacks. The same release was also reported to reduce game-stream frame rate and consume noticeable Host resources. That report applies only to -`769de201f7cc`, not to current production or automatically to the current v11 +`769de201f7cc`, not to current production or automatically to the current diagnostics. The Web sender creates one independent `RTCRtpSender` per viewer and has no cross-PC @@ -255,7 +267,7 @@ SFU publication explicitly uses VP8 with no backup codec. The UI and quality wire expose no codec choice. Codec/profile/encoder stats remain diagnostic and do not authorize automatic switching, route changes, or another controller. Production runs exact deployed application/runtime revision -`bf328590b3de5dfa509fcc70f6316286af3eae7e`, release `bf32859`; canonical +`1d8761528d0dba43fb6d818df3934483ba2f5340`, release `1d87615`; canonical `main` contains the same runtime code. Current source and production implement this strict `screener-v12` contract. @@ -443,10 +455,10 @@ one unambiguous encoding. Current quality settings do not request a mode, so the requested value remains null and a browser-reported default is not called a mismatch; multiple encodings remain unknown. Inbound stats provide no current standard `scalabilityMode` source, so C does not carry a null-only placeholder. -The exact-production gate above rejected its ordered `q,h` publication because -the active lower representation reduced `HIGH`. Current source now implements -ADR-0007's one Browser SFU `HIGH`; production remains `q,h` until the exact -single-representation deployment gate passes. +The earlier exact-production gate rejected its ordered `q,h` publication because +the active lower representation reduced `HIGH`. Current source and production +now implement ADR-0007's one Browser SFU `HIGH`; the exact deployment gate above +proved one no-RID encoding with progressing publisher/subscriber frames. Official W3C text checked 2026-08-19 defines names ending in `Id` as stats-object references. In particular, outbound [`mediaSourceId`](https://www.w3.org/TR/webrtc-stats/#dom-rtcoutboundrtpstreamstats-mediasourceid) @@ -671,9 +683,9 @@ pipeline. Compare image readability and motion continuity instead of declaring success from FPS alone. If reproducible evidence later shows a supported preference oscillates or makes the wrong tradeoff on supported machines, revise that -explicit option only from a new controlled gate. Browser SFU verification must -show exactly one VP8 outbound video encoding, no `q,h` simulcast, continuing -publisher/subscriber frame progress, and unchanged ADR-0005 resource accounting. +explicit option only from a new controlled gate. The exact Browser SFU gate +showed one VP8 outbound video encoding, no `q,h` simulcast, and continuing +publisher/subscriber frame progress without changing ADR-0005 resource accounting. The application's evidence windows remain diagnostic only; they do not command another representation, change topology, or override stock congestion control. diff --git a/docs/session-handoff.md b/docs/session-handoff.md index 5f3803c..5387d04 100644 --- a/docs/session-handoff.md +++ b/docs/session-handoff.md @@ -36,11 +36,12 @@ Current high-signal boundary: subscriber PCs explicitly use no external ICE server and check the dedicated public SFU candidate directly; ordinary peers and LiveKit server-side public IP discovery retain deployment STUN. Production exact deployed - application/runtime revision `bf328590b3de5dfa509fcc70f6316286af3eae7e`, - release `bf32859`, uses strict `screener-v12` and includes exact Browser SFU + application/runtime revision `1d8761528d0dba43fb6d818df3934483ba2f5340`, + release `1d87615`, uses strict `screener-v12` and includes exact Browser SFU ICE-server-isolation implementation - `ae09c760adec76fd26da611d4928486d105c6d3b`. Owner physical SFU fallback proof - remains bounded to predecessor release `c4962f5`. The route uses one short-lived + `ae09c760adec76fd26da611d4928486d105c6d3b`. Chrome 151 on that exact production + verified one no-RID publisher encoding and progressing publisher/subscriber + frames over LiveKit UDP. The route uses one short-lived exact-generation decoded-frame observer only for the pending candidate inside the existing total deadline; the periodic stats sampler still owns active-path diagnostics and stalls. Broader external-network and SFU lifecycle evidence @@ -56,10 +57,10 @@ Current high-signal boundary: Automated source gates and the exact deployment postflight passed. Chrome 151 physically verified direct/browser-relay/SFU screen-audio continuity and all three sender ceilings. An exact-production VP8 gate sustained about 59.5 fps - on direct and Browser-relay paths and rejected the current SFU `q,h` - publication because active `LOW` reduced `HIGH`. ADR-0007 accepts one Browser - SFU `HIGH`; current source implements that single representation, while - production remains `q,h` until the next application cutover and physical gate. + on direct and Browser-relay paths and rejected the then-deployed `bf32859` + SFU `q,h` publication because active `LOW` reduced `HIGH`. ADR-0007 accepts one Browser + SFU `HIGH`; current source and production implement it. Chrome 151 verified + one no-RID encoding and progressing publisher/subscriber frames over LiveKit UDP. - Ordinary browser ICE owns direct reachability. Do not build port prediction, guessed candidates, NAT classification, TCP probes, quality scores, or quality-driven reparenting. Current-path quality is diagnostic; a healthy diff --git a/docs/status.md b/docs/status.md index 0fe7532..4efb20b 100644 --- a/docs/status.md +++ b/docs/status.md @@ -6,14 +6,14 @@ This is the current execution index. Git history owns completed timelines; [veri ## Production -- `https://share.bonfire.icu` runs exact deployed application/runtime revision `bf328590b3de5dfa509fcc70f6316286af3eae7e`, release `bf32859`, wire `screener-v12`, from `/opt/screener/releases/bf32859`; that revision is integrated in canonical `main`. Its immutable runtime ZIP SHA-256 is `e8b8fccf0ab15591af5e6675ca9236bae28b648dccfa8b1ea208a79b927168be`, and its 38-file manifest SHA-256 is `d1c6b7c025e37711c0d06f5ec222a6fba26391d2e34a06b374deb1a05ddd63c6`. -- `screener`, LiveKit, coturn, and nginx are active/running; local/public `/healthz` and the served Browser asset match the immutable release, and all four services report `NRestarts=0`. The main Browser asset is `assets/index-BmWh33Cv.js` with SHA-256 `e0400b1d5a5017bf5851158f5a884425aaca0269c5e3efa4cc521f3580c19bce`; the prior asset returns 404. -- The service process resolves its working directory to exact release `bf32859`; it has no writable room `StateDirectory` or SQLite runtime. +- `https://share.bonfire.icu` runs exact deployed application/runtime revision `1d8761528d0dba43fb6d818df3934483ba2f5340`, release `1d87615`, wire `screener-v12`, from `/opt/screener/releases/1d87615`; that revision is integrated in canonical `main`. Its immutable runtime ZIP SHA-256 is `715480487059bf83516a34e0d1083b52437619838c46bdc26ca5967529a1cf05`, and its 38-file manifest SHA-256 is `96845789560394ca20b16c37a8e7ddadc7b488876e32241709d0f7a577fdca26`. +- `screener`, LiveKit, coturn, and nginx are active/running; local/public `/healthz` and the served Browser asset match the immutable release, and all four services report `NRestarts=0`. The main Browser asset is `assets/index-DfMqhOXY.js` with SHA-256 `cf6dd1c46cc9414a87331a9312eec315ddce8fce565741284998aa0141b18d47`; the prior asset returns 404. +- The service process resolves its working directory to exact release `1d87615`; it has no writable room `StateDirectory` or SQLite runtime. - Production admits one Host plus 20 Viewers, applies endpoint capacity `2`, rejects stale Browser and executable-sender wires before room authority, and runs the one-controller exact-candidate route model with one staged total deadline. Rooms use random free four-digit codes, a 24-hour dormant lease, restart loss, local Host creation preferences, a room-lived 22-character Viewer grant, and exactly `open | private` code entry. Private rooms without a password are invitation-only; configuring one additionally permits matching code-and-password entry. LiveKit remains dedicated with `room.auto_create: false`, `max_participants: 21`, and global admission `1` publication ingress / `20` subscription egress. - Production media ports remain STUN-only UDP 3478 and LiveKit UDP 7882; coturn TCP/TLS, port 5349, media TCP, and relay ranges are disabled. The public Web ingress remains TCP 80/443; Node 8787 and LiveKit control/signaling 7880 are internal-only. The stable `inet bonfire_filter` table SHA-256 is `afaf9d066e9f292d8bd19032b38c0978ccf60dd01c2fe7f210968ff751f90534`; the dynamic fail2ban table is excluded from that identity. -- SFU subscribers reconcile Host screen publications across connect, activation, participant arrival, track publication, and reconnect. LiveKit runs at `warn`/Pion `error`, and the Screener unit waits boundedly for the same-host LiveKit control listener before startup. The current postflight found healthy unchanged services; exact-production direct and Browser-relay VP8 evidence is closed, while accepted single-`HIGH` SFU deployment/physical proof and broader real-network acceptance remain open. +- SFU subscribers reconcile Host screen publications across connect, activation, participant arrival, track publication, and reconnect. LiveKit runs at `warn`/Pion `error`, and the Screener unit waits boundedly for the same-host LiveKit control listener before startup. The current postflight found healthy unchanged services; exact-production direct, Browser-relay, and single-representation SFU gates are closed, while broader real-network acceptance remains open. - Production Browser SFU publisher and subscriber PCs explicitly use empty external ICE-server lists while retaining LiveKit-signaled UDP candidates. The owner verified that the deployed isolation fixes the reported SFU connection failure; the prior P1 core-route hold is closed. -- Production leaves video `contentHint` unset, keeps audio `contentHint = "music"`, and fixes Browser direct, browser-relay, and SFU video to VP8 without codec UI, quality state, wire fields, or fallback media codecs. The deployed SFU publisher still sends ordered `q,h` simulcast; the exact-production quality gate rejected that candidate, so production is not yet aligned with ADR-0007's accepted single-`HIGH` representation. +- Production leaves video `contentHint` unset, keeps audio `contentHint = "music"`, and fixes Browser direct, browser-relay, and SFU video to VP8 without codec UI, quality state, wire fields, or fallback media codecs. Its SFU publisher uses exactly one `HIGH` encoding with `simulcast: false`, no subscriber quality selector, and explicit `dynacast: false`. ## Current Source @@ -25,12 +25,11 @@ This is the current execution index. Git history owns completed timelines; [veri - Current source leaves video `contentHint` unset and keeps audio `contentHint = "music"`. Browser direct and browser-relay offers contain VP8 as their only media codec, and SFU publication uses exactly one VP8 `HIGH` encoding with `simulcast: false`, no backup codec, no subscriber quality selector, and explicit `dynacast: false`. Codec UI, quality state, wire fields, fallback media codecs, and share-lifetime codec branches are absent. Live 64/128/256 kbps audio-ceiling mutation remains unchanged; ordinary Host and SFU publisher metrics select the exact current sender, relays reconcile audio-track additions and removals on the persistent stream, and an SFU reconnect reacquires the current publication/sender or fails the route closed. - Current source implements typed first-frame Viewer presentation and recovery, Chinese user-facing route/access failures, local connection details without a diagnostic-file export, authenticated Host-only on-demand route snapshots for automatic acceptance, explicit missing-room presentation, and responsive entry controls. Host invitation controls remain independent from two-state room-code entry. - Recommended quality remains exactly `1080p60`, `1080p30`, and `720p30`; current source defaults to `1080p30`. Advanced resolution adds `480p` as `854x480` without adding a fourth preset, and advanced FPS and bitrate remain independent. -- Current source passed repository hygiene, TypeScript, all 607 Web tests in 44 files, and both production builds. Exact production `bf32859` separately passed its recorded source and postflight gates. A Chrome 151 production gate exercised two direct children, one browser-relay child, one SFU subscription, all three audio ceilings, and live source replacement with progressing audio/video. A separate exact-production VP8 gate sustained about 59.5 fps on direct and browser-relay paths, while its SFU A/B proved that the always-active `LOW` materially reduced `HIGH`; the new single-representation source still requires exact deployed proof. +- Exact `main@1d87615` passed repository hygiene, TypeScript, all 607 Web tests in 44 files, both production builds, three independent reviews, immutable deployment postflight, and the Chrome 151 single-representation SFU gate. Earlier exact-production gates exercised direct, browser-relay, SFU audio continuity and all three audio ceilings, and sustained about 59.5 fps on direct and browser-relay paths; exact applicability remains in [verification status](./verification-status.md). ## Current Milestone -1. Deploy the current single-`HIGH` Browser SFU source, then physically verify exactly one outbound video encoding with progressing publisher/subscriber media. Direct and browser-relay VP8/no-hint performance is already closed by the exact-production gate. -2. Finish representative ICE/STUN/SFU acceptance, including route recovery, screen-audio continuity and real-game A/V sync on mobile and heterogeneous networks. Browser port prediction, NAT classification, TCP probing, fake page keepalive, and quality-driven reparenting remain outside the accepted model. +1. Finish representative ICE/STUN/SFU acceptance, including route recovery, screen-audio continuity and real-game A/V sync on mobile and heterogeneous networks. Browser port prediction, NAT classification, TCP probing, fake page keepalive, and quality-driven reparenting remain outside the accepted model. ## Active Boundaries diff --git a/docs/todo.md b/docs/todo.md index eab1925..76464c6 100644 --- a/docs/todo.md +++ b/docs/todo.md @@ -6,8 +6,7 @@ Only items in **Now** are executable after their stated decision gate. A branch ## Now -1. **Deploy and prove the current single-`HIGH` Browser SFU publication.** Exact production Chrome 151 closed the intrinsic VP8/no-hint shortfall on direct and browser-relay paths, but proved that the always-active SFU `LOW` materially reduces `HIGH` on the measured public ingress. Current source now uses one VP8 `HIGH` encoding and removes only the unowned two-layer helpers and assertions. Deploy the exact artifact and physically verify exactly one outbound video encoding, no RID or second representation, and progressing publisher/subscriber frames over LiveKit UDP. Do not change direct/browser-relay media, `contentHint`, route ordering, deadlines, or add a bitrate controller. -2. **Finish real-network route acceptance.** Measure standard ICE/STUN direct paths, peer relay, SFU ingress/subscription, exact first-frame commit and rollback, relay-ingress repair with subtree retention, disconnect/capacity drain, Pause/Resume, screen-audio continuity and real-game A/V sync, and bounded explicit failure across representative IPv4/IPv6 NATs and mobile networks. Include an all-UDP-blocked case to establish the current failure boundary. Do not add port prediction, NAT classification, TCP probes, guessed candidates, route scores, or quality-driven reparenting. +1. **Finish real-network route acceptance.** Measure standard ICE/STUN direct paths, peer relay, SFU ingress/subscription, exact first-frame commit and rollback, relay-ingress repair with subtree retention, disconnect/capacity drain, Pause/Resume, screen-audio continuity and real-game A/V sync, and bounded explicit failure across representative IPv4/IPv6 NATs and mobile networks. Include an all-UDP-blocked case to establish the current failure boundary. Do not add port prediction, NAT classification, TCP probes, guessed candidates, route scores, or quality-driven reparenting. ## Accepted Later Roadmap diff --git a/docs/verification-status.md b/docs/verification-status.md index f54c0c5..42f3201 100644 --- a/docs/verification-status.md +++ b/docs/verification-status.md @@ -10,37 +10,38 @@ Capacity and routing entries below describe the exact tested source or release o ## Deployment Evidence -- Production runs exact deployed application/runtime revision `bf328590b3de5dfa509fcc70f6316286af3eae7e`, release `bf32859`, wire `screener-v12`, from `/opt/screener/releases/bf32859`; that revision is integrated in canonical `main`. The immutable runtime ZIP SHA-256 is `e8b8fccf0ab15591af5e6675ca9236bae28b648dccfa8b1ea208a79b927168be`; its 38-file manifest SHA-256 is `d1c6b7c025e37711c0d06f5ec222a6fba26391d2e34a06b374deb1a05ddd63c6`. -- Postflight found `screener`, LiveKit, coturn, and nginx active with zero restarts and no warning-level Screener journal entries. Local/public health and the served main Browser asset matched the release; `assets/index-BmWh33Cv.js` has SHA-256 `e0400b1d5a5017bf5851158f5a884425aaca0269c5e3efa4cc521f3580c19bce`, while the prior main asset returns 404. +- Production runs exact deployed application/runtime revision `1d8761528d0dba43fb6d818df3934483ba2f5340`, release `1d87615`, wire `screener-v12`, from `/opt/screener/releases/1d87615`; that revision is integrated in canonical `main`. The immutable runtime ZIP SHA-256 is `715480487059bf83516a34e0d1083b52437619838c46bdc26ca5967529a1cf05`; its 38-file manifest SHA-256 is `96845789560394ca20b16c37a8e7ddadc7b488876e32241709d0f7a577fdca26`. +- Postflight found `screener`, LiveKit, coturn, and nginx active with zero restarts and no warning-level Screener journal entries. Local/public health and the served main Browser asset matched the release; `assets/index-DfMqhOXY.js` has SHA-256 `cf6dd1c46cc9414a87331a9312eec315ddce8fce565741284998aa0141b18d47`, while the prior main asset returns 404. - Production uses endpoint capacity `2`, room admission `20`, random free four-digit memory rooms, `ROOM_LEASE_SECONDS=86400`, a dedicated LiveKit instance with `room.auto_create: false` and `max_participants: 21`, and global SFU admission `1` ingress / `20` egress. Room authority is process-memory-only. Coturn is `stun-only`, `no-tcp`, and `no-tls`; only UDP 3478 listens, and nft exposes only UDP 3478/7882 for Screener media. - The production service orders Screener after LiveKit and boundedly waits for its control listener. Media listeners remain STUN-only UDP 3478 and LiveKit UDP 7882 with no 5349, coturn TCP/TLS, relay range, ICE/TCP, or media TCP listener. The stable `inet bonfire_filter` table stayed unchanged through cutover at SHA-256 `afaf9d066e9f292d8bd19032b38c0978ccf60dd01c2fe7f210968ff751f90534`; the whole ruleset is not used as an identity because fail2ban owns a dynamic address set. - This application-only postflight proves archive identity, atomic application/assets, process health, and listener/firewall continuity. It did not re-exercise access, stale-wire rejection, direct, browser-relay, SFU, audio, codec, mobile, quality, or endurance behavior; those retained results remain revision-bounded below. Routine application-only releases do not maintain a full rollback/configuration backup; any future infrastructure or irreversible-state change requires recovery scoped to what it changes. ## Retained Functional Evidence -- Exact deployed `main@bf32859` passed repository hygiene, TypeScript typecheck, all 613 Web tests in 44 files, client and server production builds, focused independent review, and production artifact/service postflight. Exact predecessor `b68c471` separately passed the 261-test SFU admission gate and explicit-Chrome access/privacy gate. Retained Chrome 20-Viewer and responsive visual checks apply only to their recorded predecessor revisions. +- Exact deployed `main@1d87615` passed repository hygiene, TypeScript typecheck, all 607 Web tests in 44 files, client and server production builds, three independent reviews, and production artifact/service postflight. Exact predecessor `b68c471` separately passed the 261-test SFU admission gate and explicit-Chrome access/privacy gate. Retained Chrome 20-Viewer and responsive visual checks apply only to their recorded predecessor revisions. +- Chrome 151 on exact production `1d87615` used real dynamic-tab `getDisplayMedia()` at 1822x1080 and made only the ordinary STUN peer attempt unusable so the existing route operation reached its SFU suffix. Publisher and subscriber LiveKit PCs retained empty external ICE-server lists and selected UDP. The publisher exposed one video sender encoding and one outbound video stats object, both without RID; over six seconds it encoded 180 frames while the subscriber decoded and rendered 182 frames, with bytes advancing at both ends. This closes the single-representation implementation/deployment gate without claiming public SFU 60 fps, real-game quality, heterogeneous-network behavior, or endurance. - Chrome 151 on exact production `bf32859` captured a continuously changing tab with generated audio through real `getDisplayMedia()`. Two Host-direct children plus one browser-relay child and one forced-SFU Viewer all advanced decoded audio energy and video frames at 64/128/256 kbps sender ceilings and after live source replacement. Ordinary paths selected direct UDP; the SFU publisher/subscriber selected LiveKit UDP with empty external ICE-server lists. The UI never reported the faulty constant `1 kbps` with active audio. Direct/browser-relay actual traffic tracked each selected ceiling; SFU 64/128 traffic was higher because the accepted LiveKit default retains RED, so sender ceiling/readback and wire traffic remain distinct. After RTCP mapping became available, direct/browser-relay audio-minus-video playout timestamps ranged from -101 to +4 ms; Chrome exposed no corresponding value on the SFU subscription, so real-game SFU A/V synchronization remains open rather than inferred. -- Chrome 151 on exact production `bf32859` used real `getDisplayMedia()`, a continuously changing source, separate Browser processes, VP8/libvpx, and no video hint. Direct stabilized near 59.5 encoded/received/decoded/rendered fps at 1904x928; a Browser relay kept every stage near 59.4--59.7 fps, adapting its outbound to 1428x696 under bandwidth pressure. Both converged after about 25--30 seconds of stock BWE ramp-up. On the exact public SFU path, current `q,h` publication held `h` near 9.2 fps/1.37 Mbps; making `q` inactive from the first sender-parameter application raised the same 1904x928 `h` to about 23.3 fps/3.32 Mbps with source/capture near 60, 4.46 ms encode time per frame, zero loss/retransmission, and about 4.81 Mbps available outgoing bitrate. This closes an intrinsic VP8/no-hint direct/relay shortfall and rejects always-active `LOW`; it does not prove a deployed single-representation SFU path, public SFU 60 fps, or real-game performance. +- Chrome 151 on exact production `bf32859` used real `getDisplayMedia()`, a continuously changing source, separate Browser processes, VP8/libvpx, and no video hint. Direct stabilized near 59.5 encoded/received/decoded/rendered fps at 1904x928; a Browser relay kept every stage near 59.4--59.7 fps, adapting its outbound to 1428x696 under bandwidth pressure. Both converged after about 25--30 seconds of stock BWE ramp-up. On the exact public SFU path, the then-current `q,h` publication held `h` near 9.2 fps/1.37 Mbps; making `q` inactive from the first sender-parameter application raised the same 1904x928 `h` to about 23.3 fps/3.32 Mbps with source/capture near 60, 4.46 ms encode time per frame, zero loss/retransmission, and about 4.81 Mbps available outgoing bitrate. That gate closed an intrinsic VP8/no-hint direct/relay shortfall and rejected always-active `LOW`; it did not prove a deployed single-representation SFU path, public SFU 60 fps, or real-game performance. - Exact Browser SFU ICE-server-isolation implementation `ae09c760adec76fd26da611d4928486d105c6d3b` passed repository hygiene, TypeScript typecheck, all 605 Web tests in 45 files, client and server production builds, three independent code reviews, focused 95-test publisher/subscriber and ordinary-peer isolation coverage, deployment postflight, and owner physical SFU fallback media proof. This establishes the reported production connection fix without turning candidate type/count into an invariant; full route/network acceptance remains open. - A fresh canonical `main@c4962f5` background gate passed repository hygiene, all 605 Web tests, both production builds, the 254-test SFU admission suite, and the Chrome 151 20-Viewer 720p30/30-second local route gate. All 20 Viewers advanced decoded frames, Host and relays stayed within endpoint cap `2`, no orphan SFU publication appeared, and all four current-child timing distributions contained 20 values. The browser gate uses deterministic canvas and does not start LiveKit, so it proves local direct/browser-relay control and media behavior only; it is not physical capture or SFU evidence. - Exact v10 runtime source `fdd5a4a529ff297f41c05ea3388bf484d76afe8f` passed repository hygiene, TypeScript typecheck, client and server production builds, all 610 Web tests in 45 files, the 257-test SFU admission gate, the access/privacy Browser gate, and the production-dependency audit with zero vulnerabilities. Its one-Host/20-Viewer Chrome 151 direct-loopback report passed all seven assertions: all Viewers decoded, the selected VP8 settings reached every participant, Host and relay media edges stayed within cap `2`, no orphan SFU publication appeared, and all four current-child timing distributions contained 20 values. The report SHA-256 is `802CBB7632E9AEA3C39FE831A7F7880D24140B2E83942CE0DFDA05DE4B408EED`. This validates the v10 source boundary, not H.264 quality, hardware attribution, physical capture, public-network behavior, or SFU packet flow. - Chrome 151 synthetic `1/3/5/8` and 720p30 runs preserved bounded fanout and decoding. A `9461e20`-era three-Viewer rerun kept Host2/Browser Viewer1, decoded every Viewer, and recovered a hard first-level relay departure in 5,380 ms; it did not exercise quality-triggered MBB. Sixteen-Viewer cap2/cap3 loopbacks decoded all Viewers and a ten-second follow-up recorded guarded sender and aggregate Chromium CPU evidence, but resolution/FPS remained low and the ordinary-PC data cannot rank caps, select product policy, or prove sustainable heterogeneous-network quality. See [peer-assisted media](./research/peer-assisted-media.md). - Chrome 151 with local LiveKit 1.13.5/client 2.22.0 proved one SFU/UDP root after `q,f` -> `q,h`: decoded frames advanced 3 -> 23, rendered frames reached 26, Host used one edge, and leaves were clean. This is functional evidence only. See [low-server media routes](./research/low-server-media-routes.md). - Chrome 151 on the current Windows TUN path reproduced intermittent production LiveKit initial ICE before publication: server counters observed both ingress and egress while Browser ICE received no responses. Eight isolated Host attempts using the LiveKit-provided STUN endpoint succeeded `2/8`; explicitly empty Browser SFU `iceServers` succeeded `8/8`, observed a peer-reflexive-to-host UDP pair within 0.5--1.7 seconds, and published 75--89 ms later. This selects Browser SFU ICE-server isolation; the observed candidate type is diagnostic, not a gate, and the run does not close exact deployed Host/Viewer first-frame, mobile, quality, or endurance evidence. See [low-server media routes](./research/low-server-media-routes.md). -- Host A+B and authenticated P2P Viewer C evidence is sanitized, generation-bound, diagnostic-only, and closed for stale or ambiguous reports. Production can expose a Host-local current SFU `h` snapshot and clears it on publisher identity changes; raw media metadata is not retained. See [realtime quality adaptation](./research/realtime-quality-adaptation.md). -- Fresh Chrome 151 tab-capture probes identified two separate Browser boundaries. Removing video `contentHint = "motion"` changed VP8 from 14.93 fps at 428x208 to 29.73 fps at 1904x928 under the same 5 Mbps balanced setup. No-hint AMD H.264 remained about 14--16 fps with hundreds of outer rate-limiter drops, while the same MFT reached 29.93 fps under diagnostic Desktop SW BRC; OpenH264 was slower. The page cannot enable that Chromium field trial or select an adapter/MFT. No-hint VP8 used libvpx software and held about 30 fps in one- and two-sender loopback on the test machine, but the process CPU totals include capture and local decode and are not real-game or weaker-device evidence. This evidence selects fixed VP8 for the Browser contract; current source and production implement that decision, and the exact-production gate above now verifies VP8 on direct, Browser-relay, and current dual-representation SFU paths. See [realtime quality adaptation](./research/realtime-quality-adaptation.md), [Native H.264](./research/native-h264-hardware-decision.md), and [Native shared encode](./research/native-shared-encode-sender.md). +- Host A+B and authenticated P2P Viewer C evidence is sanitized, generation-bound, diagnostic-only, and closed for stale or ambiguous reports. Production exposes one Host-local current SFU sender snapshot and clears it on publisher identity changes; raw media metadata is not retained. See [realtime quality adaptation](./research/realtime-quality-adaptation.md). +- Fresh Chrome 151 tab-capture probes identified two separate Browser boundaries. Removing video `contentHint = "motion"` changed VP8 from 14.93 fps at 428x208 to 29.73 fps at 1904x928 under the same 5 Mbps balanced setup. No-hint AMD H.264 remained about 14--16 fps with hundreds of outer rate-limiter drops, while the same MFT reached 29.93 fps under diagnostic Desktop SW BRC; OpenH264 was slower. The page cannot enable that Chromium field trial or select an adapter/MFT. No-hint VP8 used libvpx software and held about 30 fps in one- and two-sender loopback on the test machine, but the process CPU totals include capture and local decode and are not real-game or weaker-device evidence. This evidence selects fixed VP8 for the Browser contract; current source and production implement that decision, and exact-production gates verify VP8 on direct, Browser-relay, and single-representation SFU paths. See [realtime quality adaptation](./research/realtime-quality-adaptation.md), [Native H.264](./research/native-h264-hardware-decision.md), and [Native shared encode](./research/native-shared-encode-sender.md). - One bounded Chrome 151/Windows 25H2 current-browser screening used real `getDisplayMedia()` window capture, VP8/libvpx with no video hint, a continuously changing WPF source, and one same-machine loopback receiver. Focused, hidden-tab, and minimized 15-second windows measured about 29.4--29.6 capture/encoded/decoded fps and 1.35--1.50 ms encode time per frame; each boundary sample read an enabled, unmuted, live 1186x712 track and each end sample reported `qualityLimitationReason=none`. All rates used monotonic counter deltas over the outbound-RTP RTCStats timestamp interval; source/inbound timestamps and raw stats identities were not retained independently. The sample did not observe an immediate Host-document background drop; it does not cover exact production code, a real game, physical Viewer, CPU/GPU contention, audio, repetition, a hold beyond five minutes, or public routing. See [Browser background capture](./research/browser-background-capture.md). - Native Windows 11 process audio is source-only and default-off. A retained run isolated the target by about 4018x and delivered 495 Opus packets to one Viewer; package download, game sync, Windows 10, and other routes remain open. See [ADR-0008](./adr/0008-window-scoped-audio-capture.md). ## Open Proof Boundaries - Routing: exact v10 local direct loopback remains historical evidence for admission-20 initial ingress and exact-candidate first-frame commit timing on that source. Current v12 production still needs route rollback, direct-stage exhaustion and SFU admission, relay-ingress reparent with subtree retention, disconnect/effective-capacity drain, pause/resume, and bounded failure on real browser/media paths. Silent control partitions may wait 30 to 60 seconds for heartbeat detection before the default five-second grace; a non-paused decoded-frame stall may invalidate only that exact child edge. -- Quality: exact-production direct and Browser-relay VP8/no-hint cadence is closed. Current source implements ADR-0007's single-`HIGH` SFU publication; deployment and exact single-representation publisher/subscriber evidence remain open. Startup ramp is stock BWE behavior and does not authorize an SDP or application bitrate workaround. +- Quality: exact-production direct and Browser-relay VP8/no-hint cadence plus ADR-0007's single-`HIGH` SFU implementation/deployment gate are closed. Public SFU 60 fps, real-game quality, heterogeneous devices, and endurance remain open. Startup ramp is stock BWE behavior and does not authorize an SDP or application bitrate workaround. - Host background: deferred until the report reproduces on exact production with a continuously changing real game or replay, a separate direct wired Viewer, synchronized capture/outbound/inbound plus CPU/GPU evidence, and repeated focused/unfocused/hidden/minimized windows. The current-Chrome Browser `getDisplayMedia()` WPF-window screening did not observe an immediate Host-page media drop, and the old harmful `contentHint = "motion"` release remains a plausible confound rather than a proven background cause. Current evidence authorizes no keepalive, Wake Lock, timer, codec switch, route change, or Native fallback. - Relay resources: current source and production expose the authenticated `1/2/3` endpoint-cap boundary, and retained v10 local loopback evidence covers 20 Viewers at cap `2` only for that source. CPU/GPU/upload and heterogeneous-network measurements remain diagnostics, not authority to change the contract. - Room scale: current source and production admit 20 Viewers plus one Host, and the retained v10 local Browser convergence gate covers that bound on direct loopback. A real public-network 1:20 session, quality, and sustained resource matrix remain open. -- SFU: production uses one Host publication with exact Viewer subscriptions and no fixed root-count or room-wide lease rule. Browser SFU PCs use the accepted empty-external-ICE-server rule and owner physical media proof closed the reported connection hold. Current source publishes one `HIGH` encoding without simulcast or a subscriber layer selector, while production still publishes `q,h`; exact deployment and physical proof remain open. Real LiveKit lifecycle/JWT replay, resource use, SFU-fed first-child behavior, and broader heterogeneous-network acceptance remain open. -- Audio: current v12 source and production select the exact active ordinary Host or SFU publisher audio sender, reset samples across track changes or absence, keep relay children synchronized with persistent-stream audio changes, and reacquire exact SFU publications/senders after reconnect. The reported active-source `1 kbps` observation and all three live ceilings are physically closed on current Chrome/production across direct, browser-relay and SFU. Audible game quality, heterogeneous-network changes and real-game A/V synchronization remain part of route acceptance; a muted/idle Opus track may still legitimately remain near 1 kbps. +- SFU: source and production use one Host `HIGH` encoding without simulcast or a subscriber layer selector, with exact Viewer subscriptions and no fixed root-count or room-wide lease rule. Chrome 151 physically closed the empty-external-ICE-server connection hold and exact single-representation publisher/subscriber gate. Real LiveKit lifecycle/JWT replay, resource use, SFU-fed first-child behavior, and broader heterogeneous-network acceptance remain open. +- Audio: current v12 source and production select the exact active ordinary Host or SFU publisher audio sender, reset samples across track changes or absence, keep relay children synchronized with persistent-stream audio changes, and reacquire exact SFU publications/senders after reconnect. Chrome 151 on exact production `bf32859` physically closed the reported active-source `1 kbps` observation and all three live ceilings across direct, browser-relay and SFU. Audible game quality, heterogeneous-network changes and real-game A/V synchronization remain part of route acceptance; a muted/idle Opus track may still legitimately remain near 1 kbps. - Observability: current v12 source and production keep local connection details but no Host/Viewer diagnostic downloads or Browser file-export plumbing. The Host-only bounded snapshot stays for automatic acceptance. Chrome 151 supplied selected candidate endpoints and ordinary-route A/V playout timestamps in the current gate, but omitted the SFU A/V timestamp. Target-browser availability and actual values remain open for codec/fmtp and encoder implementation/power efficiency, media-source and encoded FPS, and broader jitter/concealment cases. All retained fields diagnose and have no recovery authority; they do not by themselves prove hardware encode, synchronization quality, or route quality. - Mobile: Android/iOS remain Viewer-only. Autoplay, rotation, iOS lock-screen/page reclamation, background reconnection, and network changes need device evidence. AirPlay/system mirroring is Viewer-local output, not a portable in-app WebRTC output contract. - Native: ADR-0006 has one-Viewer evidence only. Viewer2/FIFO, hardware diversity, endurance, downloaded-package/public-host, game A/V, and browser diversity remain open. diff --git a/docs/方案设计.md b/docs/方案设计.md index 3e73be5..6919beb 100644 --- a/docs/方案设计.md +++ b/docs/方案设计.md @@ -2,7 +2,7 @@ ## 2026-08-18 14:45 -状态：production 运行精确 application/runtime revision `bf328590b3de5dfa509fcc70f6316286af3eae7e`、release `bf32859` 和严格 `screener-v12`；canonical `main` 含相同 application/runtime tree 与当前 truth checkpoint。源码与生产已实现 22 字符 room-lived Viewer grant、`ROOM_NOT_FOUND`、产品诊断下载移除、完整短 URL 邀请 UI、收敛的房间密码控件、exact-current audio stats 与音轨跨 relay/SFU reconnect 连续性，并固定 Browser VP8，video 不设置 `contentHint`、audio 保留 `music`，且无 codec UI/state/wire 或分享生命周期分支；Pause/Resume 继续由当前 Host session 和 `shareGeneration` 约束。Owner 的 SFU fallback 实测证据仍严格归属于 predecessor release `c4962f5`。 +状态：production 运行精确 application/runtime revision `1d8761528d0dba43fb6d818df3934483ba2f5340`、release `1d87615` 和严格 `screener-v12`；canonical `main` 含相同 application/runtime tree 与当前 truth checkpoint。源码与生产已实现 22 字符 room-lived Viewer grant、`ROOM_NOT_FOUND`、产品诊断下载移除、完整短 URL 邀请 UI、收敛的房间密码控件、exact-current audio stats 与音轨跨 relay/SFU reconnect 连续性，并固定 Browser VP8，video 不设置 `contentHint`、audio 保留 `music`，且无 codec UI/state/wire 或分享生命周期分支；Pause/Resume 继续由当前 Host session 和 `shareGeneration` 约束。Browser SFU 发布为单个无 RID 的 `HIGH` encoding，不启用 simulcast 或 Dynacast；Chrome 151 已在该精确 production 上验证发布端与订阅端经 LiveKit UDP 持续推进帧。 ## 目标与边界 @@ -362,7 +362,7 @@ Token-free SFU standby prewarm 保持可选且不创建 participant、publicatio ## 当前交付边界 -- Production 使用严格单一 `screener-v12` wire 和精确 deployed application/runtime revision `bf328590b3de5dfa509fcc70f6316286af3eae7e`、release `bf32859`；current source 含相同 application/runtime tree 与当前 truth checkpoint。两者均已实现短 room-lived grant、明确 missing-room 结果、产品诊断下载移除、完整短 URL 邀请 UI、exact-current audio stats 与音轨跨 relay/SFU reconnect 连续性，固定 Browser VP8 且 video 不设置 `contentHint`，codec selector、quality-state/wire 字段与分享生命周期 codec 分支不存在。 +- Production 使用严格单一 `screener-v12` wire 和精确 deployed application/runtime revision `1d8761528d0dba43fb6d818df3934483ba2f5340`、release `1d87615`；current source 含相同 application/runtime tree 与当前 truth checkpoint。两者均已实现短 room-lived grant、明确 missing-room 结果、产品诊断下载移除、完整短 URL 邀请 UI、exact-current audio stats 与音轨跨 relay/SFU reconnect 连续性，固定 Browser VP8 且 video 不设置 `contentHint`，codec selector、quality-state/wire 字段与分享生命周期 codec 分支不存在；Browser SFU 只发布一个 `HIGH` encoding，不启用 simulcast 或 Dynacast。 - Pause/Resume 由当前 Host session 和 `shareGeneration` 约束。Host 后台性能和 VP8 hardware acceleration 分别按受控根因证据诊断；标准 ICE/SFU 按真实异构网络验收。 - 当前发布面只包含 Web Host、Viewer 和 browser relay。Native sender、capture helper、shared-encode executable 与两个分发包仍由各自后续决策和物理证据驱动，不属于当前 Browser release。