fix(access): renew site access during active use (#315)

docs/product/rooms-access.md

@@ -27,9 +27,12 @@ the storage decision; implementation detail belongs in code and tests.
 Three independent authorities exist:
 
 1. **Site access.** Production requires an independent
-   `SITE_ACCESS_PASSWORD`. Successful entry creates a 12-hour stateless,
-   HttpOnly, `SameSite=Strict` cookie. It authorizes room creation, Host role,
-   and code-only Viewer attempts; it is not a room credential.
+   `SITE_ACCESS_PASSWORD`. Successful entry creates a stateless, HttpOnly,
+   `SameSite=Strict` cookie with a 24-hour rolling idle lifetime. An already
+   authorized page renews it through the site-access check while it remains
+   active. It authorizes room creation, Host role, and code-only Viewer
+   attempts; it is not a room credential, and Viewer-grant admission cannot
+   create or renew it.
 2. **Host ownership.** The exact Host token authorizes that room's Host and
    access-management operations. It cannot authorize another room.
 3. **Viewer invitation.** Every room creates a 128-bit, 22-character base64url

docs/project-memory.md

@@ -1,6 +1,6 @@
 # Project Memory
 
-Last updated: 2026-08-27
+Last updated: 2026-08-28
 
 Screener is private, low-latency game screen sharing for one Host and up to 20
 authenticated friends. The current product surface is Web Host, Web Viewer, and
@@ -52,10 +52,11 @@ implementation and routine UI detail.
 
 ## Current Snapshot
 
-Canonical source and production use the strict `screener-v16` Browser/server
-contract with committed media readiness, bounded candidate-relative progress
-and one-shot Host-root convergence. Both retain optional SQLite room authority
-and the H.264/VP8 sender gate. [Status](./status.md) owns exact identity.
+Canonical source uses the strict `screener-v17` Browser/server contract with
+committed media readiness, bounded candidate-relative progress and one-shot
+Host-root convergence. It retains optional SQLite room authority and the
+H.264/VP8 sender gate. [Status](./status.md) owns exact source and production
+identity.
 
 Current work is owned by the [TODO ledger](./todo.md). Open physical evidence is
 owned by [verification status](./verification-status.md). Environment and initial

docs/status.md

@@ -45,7 +45,7 @@ This is the current execution index. Git history owns completed timelines;
 
 ## Current Source
 
-- Canonical source uses the strict `screener-v16` Browser/server contract.
+- Canonical source uses the strict `screener-v17` Browser/server contract.
   Optional SQLite stable authority, non-expiring local preferred code, atomic
   room replacement and the Host codec selector remain implemented; production
   selects stable storage. Graceful restart, crash, timeout and network loss use
@@ -76,6 +76,8 @@ This is the current execution index. Git history owns completed timelines;
 
 ## Source/Production Delta
 
+- Current source uses 24-hour rolling site-access authorization and the v17
+  single wire contract; production remains on the v16 contract until release.
 - Current source replaces aggregate route-fact retries with exact session,
   publication and transition opportunities; advances proved non-improving
   candidates; binds stall and recovery reports to physical media identities;

docs/todo.md

@@ -7,9 +7,8 @@ topics are not implementation authority.
 
 ## Now
 
-No implementation task is currently authorized. The audit root-cause
-corrections are integrated and verified in current source but remain undeployed;
-deployment requires explicit authority.
+Release the accepted current source with 24-hour rolling site access and the
+strict v17 Browser/server contract, then record exact production identity.
 
 ## Parked Product Work