fix(route): fix committed route state and bounded convergence (#303)

docs/adr/0005-automatic-hybrid-media-routing.md

@@ -76,6 +76,13 @@ There is no independent depth cap. Room admission and acyclicity bound the graph
 shallowest-first is a preference, not a periodic balancing mandate. IP address,
 geography, NAT guess, UA, and scalar quality score do not select a parent.
 
+One structural exception is event-driven Host-root capacity convergence. After a
+new Host-root edge commits, if that root has zero direct children and another
+Host root has at least two, one deterministic direct child may prepare against the new
+root. A fresh healthy candidate sender proof is required before make-before-break
+commit. Success moves one branch toward even fanout; failure consumes that one-shot intent. No timer,
+continuous rebalance or general load score is introduced.
+
 A failed exact tuple is consumed only for its current operation. A later external
 fact may make it eligible again; there is no persistent parent blacklist.
 
@@ -119,6 +126,11 @@ Peer candidates converge behind working media, one at a time and round-robin
 across SFU Viewers. New join or repair work preempts this background convergence.
 Exhausting direct candidates simply keeps the working SFU route.
 
+The five-second no-transport-progress window is candidate-relative across every
+Peer operation. A new candidate receives its own window within the unchanged
+total operation deadline; exact transport progress retains it until media proof
+or that deadline.
+
 If the Host is full and no publication exists, one bounded SFU-bootstrap intent
 owns the original waiting demand and a finite cursor of eligible Host-direct
 children. A carrier must create the publication through a normal overlap; it may

docs/product/presentation-lifecycle.md

@@ -43,6 +43,9 @@ must continuously show a truthful accessible connection stage rather than a
 black screen, ICE-connected state, or unproved `playing` event.
 
 - A proved current frame remains visible behind non-terminal recovery state.
+- Host roster connection state follows the server's committed physical media
+  path. A pending candidate or temporarily stale quality sample may annotate
+  optimization, but cannot downgrade an active Viewer to routing.
 - Host pause retains the current frame and waits for resume.
 - Host signaling loss alone does not invalidate media that is still healthy.
 - Exact media failure or terminal route failure invalidates current-frame proof

docs/product/routing-transport.md

@@ -67,6 +67,18 @@ without discarding its subtree; departure and capacity changes move only affecte
 children. ADR-0005 owns filtering, ordering, cursor, revision, reservation, and
 rollback mechanics.
 
+Every unconnected Peer candidate gets the same five-second no-progress window.
+Transport-connected progress retains it through the operation deadline. This
+applies to join, recovery, direct convergence, quality convergence and structural
+convergence; candidate order never resets the total deadline.
+
+When a newly committed Host-root Viewer exposes unused downstream capacity while
+another Host root has at least two direct children, the same background operation may
+move one of those children to the new root. The candidate must prove a healthy
+native sender edge before commit. This one-shot event-driven move reduces root
+fanout skew; it is not periodic balancing and does not move a healthy branch
+without admitted overlap.
+
 Framework reconnect runs before route reassignment. Manual media reconnect also
 rebuilds only the current P2P parent or current SFU subscription; it does not
 perform quality selection or choose another route.

docs/project-memory.md

@@ -52,11 +52,11 @@ implementation and routine UI detail.
 
 ## Current Snapshot
 
-Canonical source and production use the strict `screener-v15` Browser/server
-contract with the corrected opt-in native-edge convergence controller, optional
-SQLite room authority, and the H.264/VP8 sender gate. [Status](./status.md) is
-the sole owner of exact source, artifact, deployment, milestone, and blocker
-identity.
+Canonical source uses the strict `screener-v16` Browser/server contract with
+committed media readiness, bounded candidate-relative progress and one-shot
+Host-root convergence. Production remains on `screener-v15` until the current
+correction release completes. Both retain optional SQLite room authority and the
+H.264/VP8 sender gate. [Status](./status.md) owns exact identity.
 
 Current work is owned by the [TODO ledger](./todo.md). Open physical evidence is
 owned by [verification status](./verification-status.md). Environment and initial

docs/research/realtime-quality-adaptation.md

@@ -227,6 +227,20 @@ into a scalar score or infer unconnected path quality. The single SFU
 publication does not imply one quality node: Host ingress is generation-scoped,
 and every Viewer subscription needs its own candidate proof.
 
+The 2026-08-27 room-6020 canary observed 21 successful Peer candidates, all
+within two seconds, and 19 failed candidates with a 15-second median. Reusing the
+existing five-second no-progress window for each background Peer candidate
+therefore removes measured queue tail without adding a new threshold; candidates
+with transport progress still retain the total deadline. The same run showed
+that native sender health can recover while a Viewer still reports low delivered
+FPS, so receiver-quality routing remains an evidence problem rather than grounds
+for an uncalibrated FPS threshold.
+
+Canary logs use stable room-scoped anonymous ordinals. They may record native
+limitation reason and bounded sender/receiver FPS and bitrate already collected
+by the application, but never display names, raw Peer IDs, SDP, ICE candidates,
+tokens or media credentials.
+
 SFU has asymmetric evidence. The Browser publication proves shared Host-to-SFU
 ingress, while exact SFU-to-Viewer sending and layer selection live inside
 LiveKit. The accepted model therefore keeps SFU as a bounded suffix: LiveKit

docs/status.md

@@ -45,7 +45,7 @@ This is the current execution index. Git history owns completed timelines;
 
 ## Current Source
 
-- Canonical source uses the strict `screener-v15` Browser/server contract.
+- Canonical source uses the strict `screener-v16` Browser/server contract.
   Optional SQLite stable authority, non-expiring local preferred code, atomic
   room replacement and the Host codec selector remain implemented; production
   selects stable storage. Graceful restart, crash, timeout and network loss use
@@ -72,10 +72,10 @@ This is the current execution index. Git history owns completed timelines;
 
 ## Current Milestone
 
-Native-edge local convergence is deployed behind its default-off per-share
-policy. Persistent exact sender windows drive ordinary P2P movement. SFU quality
-work is limited to multi-root Host fanout relief and requires independent
-Host-ingress and same-Viewer candidate proof before one move.
+The 6020 canary correction is implemented in source and awaits deployment. It
+keeps Host roster state on committed media, bounds each no-progress Peer
+candidate at five seconds, adds one-shot healthy Host-root fanout convergence,
+and stabilizes anonymized canary identity and metrics.
 
 ## Active Boundaries
 
@@ -92,5 +92,6 @@ Host-ingress and same-Viewer candidate proof before one move.
 
 ## Current Hold
 
-No source or deployment P0/P1 is open. Sanitized route-event logging remains
-enabled for the pre-release canary. Broader product evidence remains parked.
+Production `screener-v15` can falsely show committed Viewers as routing and can
+spend 15 seconds on background candidates. `screener-v16` is the active P1
+correction. Sanitized route logging remains enabled.

docs/todo.md

@@ -7,7 +7,9 @@ topics are not implementation authority.
 
 ## Now
 
-No implementation task is currently authorized.
+1. **Release the 6020 canary follow-up.** Preserve committed Host roster state,
+   reuse the five-second candidate progress gate, perform one-shot healthy root
+   fanout convergence, and retain stable bounded canary evidence.
 
 ## Parked Repository Work