docs: record 93e468 production rollout (#176)

docs/deployment.md

@@ -20,19 +20,24 @@ tracked coturn example remains `stun-only`; the shared host retains its older
 authenticated-relay daemon configuration and firewall range. The application
 does not pre-advertise TURN credentials to ordinary peers.
 
-Production currently runs exact `66eb337171931edaf5d621600c3803a186cf85ac`
-from `/opt/screener/releases/66eb33717193`; immediate rollback is
-`/opt/screener/releases/d315d333e0a8`. Local and public health return 200;
+Production currently runs exact `93e4681915768db0bf3b0165c0fd9ec3f54f95c8`
+from `/opt/screener/releases/93e468191576`; immediate rollback is
+`/opt/screener/releases/66eb33717193`. Local and public health return 200;
 Screener, LiveKit, coturn, and nginx are active, and Screener reports
 `NRestarts=0`.
 
 The current release deploys the bounded pre-share health/WSS/STUN self-check,
 privacy-safe click-only diagnostic JSON export, room admission default eight
-with explicit limits from one through sixteen, and peer-quality MBB v1. MBB v1
-selects only an ordinary peer-upstream Viewer candidate; Host and SFU-root
-provisional children remain open. Production keeps the two-edge endpoint
+with explicit limits from one through sixteen, and peer-quality MBB. One
+ordinary Viewer with a peer or SFU upstream may own the provisional child;
+Host provisional children remain open. Production keeps the two-edge endpoint
 default. The retained sixteen-Viewer and resource runs are ordinary-PC
 functional evidence only and do not justify cap3 or close performance gates.
+The cutover used audited tree `848f1588000006d91546468abae858bf027929e6`,
+an independent production dependency tree with zero shared regular-file inodes,
+and byte-identical public client assets. A no-room Chrome 151 canary passed
+health, WSS open/close, STUN-only configuration, and `srflx` gathering in 2.49
+seconds; it did not exercise room media, route migration, SFU, or TURN.
 
 ## Topology and prerequisites
 
@@ -122,7 +127,7 @@ ICE. The accepted ladder is direct/peer UDP, then the revision-bound SFU/UDP
 virtual parent, then optional authenticated TURN for one controller-selected
 exceptional edge. LiveKit participants receive only revision-bound `sfu-config`
 URL/token messages and negotiate within LiveKit's separate ICE domain. The
-selected-edge TURN config/wire is deployed in the current `66eb33717193` release with one
+selected-edge TURN config/wire is deployed in the current `93e468191576` release with one
 UDP URL and a 120-second credential TTL. It was not exercised by a real media
 session during this cutover.
 

docs/project-memory.md

@@ -28,7 +28,7 @@ Last updated: 2026-08-22
 - Mobile endpoints are Web Viewer-only. Current Android/iOS browsers do not expose Web Host capture; AirPlay/system mirroring is Viewer-local output.
 - ADR-0005: direct/peer UDP -> bounded SFU roots -> selected-edge TURN. The deployed controller caps pending/answered `peer-selected` at one per room; Host ingress is independent. A pre-`ecc794d` exact-source/production-media canary proves active Host ingress only. Ordinary peers stay STUN-only.
 - `PEER_ASSISTED_MEDIA=true` covers all rooms. One-root healthy-SFU MBB is deployed with retained parent, media proof, Host2/browser1 overlap, cooldown and fresh two-window proof; it excludes `peer-selected`. Active-SFU loss uses normal recovery; the manual control keeps its route: peer restarts its edge, SFU reauthenticates signaling and rebuilds that subscriber. Capacity `0 -> 1`, multi-root/browser gates remain open.
-- C+B stays edge-local: deployed MBB v1 gives only the triggering child one ordinary peer-upstream Viewer attempt while its old edge remains active. The source candidate extends the provisional-child owner to an ordinary Viewer whose active upstream is peer or SFU; Host remains excluded. Current-generation RTP, decoded frames, and live video atomically promote the same provisional PC. A ready-then-failed identity survives until active/rollback, while session/share change or an unrelated authoritative failure aborts the soft probe. Failure, timeout, or no candidate keeps the old edge without SFU/TURN. Sibling MBB remains separate. No score.
+- C+B stays edge-local: deployed MBB gives only the triggering child one attempt to an ordinary Viewer whose active upstream is peer or SFU while its old edge remains active; Host remains excluded. Current-generation RTP, decoded frames, and live video atomically promote the same provisional PC. A ready-then-failed identity survives until active/rollback, while session/share change or an unrelated authoritative failure aborts the soft probe. Failure, timeout, or no candidate keeps the old edge without SFU/TURN. Sibling MBB remains separate. No score.
 - Flagship media is UDP; HTTPS/WSS stays TLS/TCP; the old release remains rollback-only.
 - Treat settings as ceilings and degradation as unclassified. Use correlated Host A+B/Viewer C and one-variable evidence; never force AV1, infer by UA, or create a composite score.
 - Screen audio: production Web capture requests speech processing off and ideal stereo. Share advanced settings offer 64/128/256 kbps sender ceilings, default 128, and lock the choice for the active share across P2P, browser relay, and SFU. Peer answers permit stereo up to 256 kbps; SFU keeps `forceStereo`, DTX off, and RED retained. Local Viewer details expose non-uploaded A/V playout, jitter-buffer, and concealment evidence. Target-browser/route proof remains open; voice and Native stay separate.
@@ -43,7 +43,7 @@ Last updated: 2026-08-22
 ## Current Implementation
 
 - The repository is one npm package using Node.js 24, React, TypeScript, Vite, native WebRTC, `ws`, Zod, Vitest, and separate coturn.
-- Production: exact `66eb337171931edaf5d621600c3803a186cf85ac`, release `66eb33717193`, Web wire `screener-v5`; `d315d333e0a8` is the rollback release.
+- Production: exact `93e4681915768db0bf3b0165c0fd9ec3f54f95c8`, release `93e468191576`, Web wire `screener-v5`; `66eb33717193` is the rollback release.
 - Web keeps one SFU stream, clears unavailable video, exposes evidence-backed routes/transports and paused preview, and drops signals to a grace-retained offline current-edge target. Routing is automatic; entry/nickname UI is live; Native remains source-only.
 - Production rooms default to eight Viewers and accept an explicit admission limit from one through sixteen. Web endpoints use cap2 with one upstream; source supports an explicit deployment cap from one through three without a UA/visibility split.
 - Relay evidence is opt-in; direct proof and selected-pair addresses stay local, never in relayed evidence. The deployed pre-share self-check uses disposable health/WSS/STUN probes and reports configured SFU as unverified until a real route. Click-only diagnostic JSON uses a fixed privacy allowlist; neither path uploads or persists a report.

docs/status.md

@@ -6,10 +6,10 @@ This file is the current execution index. Load [verification status](./verificat
 
 ## Production
 
-- `https://share.bonfire.icu` runs exact `66eb337171931edaf5d621600c3803a186cf85ac`, release `66eb33717193`, wire `screener-v5`; `d315d333e0a8` is the rollback release.
+- `https://share.bonfire.icu` runs exact `93e4681915768db0bf3b0165c0fd9ec3f54f95c8`, release `93e468191576`, wire `screener-v5`; `66eb33717193` is the rollback release.
 - `screener`, LiveKit, coturn, and nginx are active, local/public health return 200, and `screener` has `NRestarts=0`. SQLite remains schema v3 with five rooms and mode 0600.
 - Ordinary ICE is STUN-only. Production allows SFU roots <=2, one `peer-selected` attempt excluding Host ingress, selected UDP TTL 120, room admission default eight with explicit limits from one through sixteen, and two downstream edges per Web endpoint. `MAX_PEER_RELAY_DOWNSTREAM_EDGES` is unset, so the parameterized default is active.
-- Stable SFU, route/transport truth, pause notices, entry/nickname UI, selected-edge lease authority, corroborated bad-relay demotion, Share audio presets, local media-path diagnostics, pre-share self-check, privacy-safe diagnostic export, and peer-quality MBB v1 are live. MBB v1 selects only an ordinary peer-upstream Viewer candidate; Host/SFU-root provisional children and sibling MBB remain open. Native remains source-only.
+- Stable SFU, route/transport truth, pause notices, entry/nickname UI, selected-edge lease authority, corroborated bad-relay demotion, Share audio presets, local media-path diagnostics, pre-share self-check, privacy-safe diagnostic export, and peer-quality MBB are live. A candidate ordinary Viewer may have a peer or SFU upstream; Host provisional children and sibling MBB remain open. Native remains source-only.
 
 ## Current Product Snapshot
 
@@ -18,7 +18,7 @@ This file is the current execution index. Load [verification status](./verificat
 - The deployed pre-share self-check uses disposable, no-room resources for health, WSS, and STUN `srflx` checks and treats configured SFU as unverified until a real route. Expanded connection details provide click-only, versioned JSON export; its fixed allowlist excludes candidate addresses/ports, participant and room identity, raw signaling, URLs, and credentials, and no report is uploaded or persisted.
 - Private fragment grants enter directly; code-only Viewers need site access and private rooms additionally need their password. Credentials remain unstored. Web names and presence are session-only; duplicate names alone show an ID suffix.
 - Rooms default to eight Viewers and accept an explicit admission limit from one through sixteen. Roots and ordinary Web relays are bounded to two downstream edges, Viewer upstream receive is free, and source permits an explicit endpoint cap from one through three. SFU root capacity remains separate.
-- Relay quality handling compares fresh child FPS with parent input. Two current corroborating children can pause one Viewer relay for 30 seconds and request peer-only reassignment. Deployed MBB v1 keeps the triggering child's old edge while one ordinary peer-upstream Viewer proves current-generation media. The source candidate also allows an ordinary SFU-root Viewer with a strict spare relay slot to own the provisional child PC; matching current-generation RTP, decoded frames, live video, revision, and identity promote that same PC. Host remains excluded. Failure, timeout, session/share change, or no candidate keeps the old edge without SFU/TURN. Sibling MBB remains open.
+- Relay quality handling compares fresh child FPS with parent input. Two current corroborating children can pause one Viewer relay for 30 seconds and request peer-only reassignment. Deployed MBB keeps the triggering child's old edge while one ordinary Viewer with a peer or SFU upstream and a strict spare relay slot owns the provisional child PC. Matching current-generation RTP, decoded frames, live video, revision, and identity promote that same PC. Host remains excluded. Failure, timeout, session/share change, or no candidate keeps the old edge without SFU/TURN. Sibling MBB remains open.
 - A generation-bound 15-second initial-connect deadline enters ICE restart. One-root healthy-SFU make-before-break is deployed but media-unverified; capacity `0 -> 1`, multi-root, browser, and mobile gates remain open.
 
 ## Active Milestone

docs/verification-status.md

@@ -8,11 +8,11 @@ This is the demand-loaded ledger for cross-cutting validation evidence and open
 
 ## Deployment Evidence
 
-- Production runs exact `66eb337171931edaf5d621600c3803a186cf85ac`, release `66eb33717193`, with `d315d333e0a8` retained for rollback. A post-deploy no-room Chrome canary passed health, unauthenticated WSS open/close, and STUN `srflx` gathering without logging candidate data; room media, SFU, TURN, and performance remain unverified.
+- Production runs exact `93e4681915768db0bf3b0165c0fd9ec3f54f95c8`, release `93e468191576`, with `66eb33717193` retained for rollback. Its audited runtime tree has no regular-file inode shared with rollback, and all public client assets matched the local build byte-for-byte. A post-deploy no-room Chrome 151 canary passed health, unauthenticated WSS open/close, STUN-only configuration, and `srflx` gathering in 2.49 seconds without logging candidate data; room media, route migration, SFU, TURN, and performance remain unverified.
 - Local/public health return 200; `screener`, LiveKit, coturn, and nginx are active; `screener` reports zero restarts. SQLite v3 has five rooms, SHA-256 `aef724ae52c4107be8ec8791e72f8dcaa11b0ec849fb432d022e2cfb9cfe0974`, owner `screener:screener`, and mode 0600.
 - Room admission defaults to eight and accepts explicit limits from one through sixteen. The endpoint-cap environment is unset, so Web endpoints use the parameterized default of two. Ordinary peer ICE stays STUN-only, SFU roots stay <=2, and selected-edge UDP authority is bounded to one pending/answered `peer-selected` attempt per room excluding Host ingress.
 - Share audio presets and local-only Host SFU, codec/encoder, A/V, and selected-candidate diagnostics are deployed. Their target-browser field availability and actual media values remain unverified.
-- The bounded pre-share self-check, privacy-safe local JSON export, and peer-quality MBB v1 are deployed. MBB v1 accepts only an ordinary peer-upstream Viewer candidate; Host/SFU-root provisional children and sibling MBB remain open. Real-route behavior remains part of the routing gate.
+- The bounded pre-share self-check, privacy-safe local JSON export, and peer-quality MBB are deployed. An ordinary Viewer with a peer or SFU upstream may own the provisional child; Host provisional children and sibling MBB remain open. Real-route behavior remains part of the routing gate.
 - Earlier exact-`16f6eab` evidence proves active Host ingress only; it does not prove the current release, initial Viewer ingress, healthy reselection, last-mile quality, or TURN performance.
 
 ## Retained Functional Evidence