feat(web): observe selected pair responses (#181)

Add local, generation-guarded selected-pair response evidence without granting it routing or recovery authority.

docs/research/peer-assisted-media.md

@@ -367,6 +367,55 @@ zero, then the current Web client advertises an explicit per-session capacity
 of one. The first production smoke scoped it to room `1`; current production no
 longer has that room boundary. There is no mobile/iPad, UA, or visibility branch.
 
+## Selected-Pair Response Observation
+
+The W3C Stats specification makes `RTCTransportStats.selectedCandidatePairId`
+the exact reference to the current `RTCIceCandidatePairStats`. A stats object's
+`id` identifies the monitored object, while `responsesReceived` is the
+cumulative number of connectivity-check responses received by that candidate
+pair. Stats snapshots carry timestamps and applications derive interval values
+from two snapshots. Unsupported fields are omitted, and a current pair is
+deleted when the transport switches to a newly generated pair. These semantics
+support a local observation; they do not define an application failure signal.
+The existing compatibility fallback is retained only when that exact reference
+is absent and exactly one same-transport succeeded nominated/selected pair is
+available; an ambiguous or broken relationship remains unknown.
+
+RFC 7675 binds consent to one transport 5-tuple. An authenticated matching STUN
+response refreshes consent, but the default consent-check interval is randomized
+between four and six seconds and a response can match an earlier request.
+Therefore zero `responsesReceived` growth over one two-second application sample
+does not prove a silent partition. Conversely, growth proves only that a STUN
+response was observed on that pair, not that media quality or future reachability
+is healthy. Video-frame counters are independent, so a static shared frame must
+not be classified as a transport failure.
+
+The bounded implementation uses one accumulator per `RTCPeerConnection` and the
+selected pair's own stats timestamp. It reports the cumulative counter plus a
+delta and elapsed milliseconds only across adjacent samples of the same pair.
+The first sample, PC replacement, pair change or disappearance, missing/invalid
+counter or timestamp, non-increasing timestamp, counter retreat, or a sampling
+gap above five seconds reports the interval fields as unknown and establishes a
+new baseline. The five-second ceiling is a named observation-window bound for
+the current two-second sampler; it is not a consent timeout or a route policy.
+
+Acceptance for this slice is observation-only:
+
+- expanded local connection details show the opaque selected-pair identity,
+  cumulative `responsesReceived`, and the adjacent bounded delta/window;
+- the click-only diagnostic allowlist may contain the cumulative counter,
+  interval delta, and interval duration, but not the pair ID, candidate
+  addresses/ports, raw stats, signaling, or credentials;
+- a missing response counter or required timestamp remains unknown rather than
+  zero; and
+- no value starts ICE restart, emits `route-failed`, changes topology/quality,
+  adds a wire or server ping, or uploads/persists telemetry.
+
+Sources, accessed 2026-08-22:
+
+- [W3C Identifiers for WebRTC's Statistics API](https://www.w3.org/TR/webrtc-stats/)
+- [RFC 7675, Consent Freshness for WebRTC](https://www.rfc-editor.org/rfc/rfc7675.html)
+
 ## Bounded Spike And Gates
 
 This historical gate assumed default-off configuration through

docs/status.md

@@ -15,6 +15,7 @@ This file is the current execution index. Load [verification status](./verificat
 
 - Capture precedes room creation. Balanced, automatic codec, and 128 kbps screen audio are defaults; clarity/fluid, H.264/VP8, and 64/128/256 kbps audio are deployed next-share choices. Codec and audio quality lock during a share.
 - Local-only connection details expose current Host SFU sender evidence, actual codec/fmtp and encoder fields, media-source/encode FPS evidence, A/V playout/jitter/concealment evidence, and selected candidate endpoints. These fields do not enter quality signaling, server state, logs, persistence, or route selection.
+- A source candidate additionally shows the selected pair's local cumulative STUN responses and a bounded same-pair sample delta. It is observation-only, is not deployed, and does not trigger recovery or upload the pair identity.
 - The deployed pre-share self-check uses disposable, no-room resources for health, WSS, and STUN `srflx` checks and treats configured SFU as unverified until a real route. Expanded connection details provide click-only, versioned JSON export; its fixed allowlist excludes candidate addresses/ports, participant and room identity, raw signaling, URLs, and credentials, and no report is uploaded or persisted.
 - Private fragment grants enter directly; code-only Viewers need site access and private rooms additionally need their password. Credentials remain unstored. Web names and presence are session-only; duplicate names alone show an ID suffix.
 - Rooms default to eight Viewers and accept an explicit admission limit from one through sixteen. Current source is server-authoritative and role-aware: Host physical media edges are bounded to two, ordinary Browser Viewer downstream edges to one, and upstream receive is free. Active/provisional/selected overlays count, as does Host SFU publication. Deployment values 1/2 may only tighten these limits; old/malicious Viewer advertisements 2/3 cannot lift them. Web assignment execution also truncates physical children to Host2/Viewer1 as defense-in-depth, and deployment limit one promotes an occupied Host branch root before reserving the SFU publication slot. The wire retains `0/1/2/3` only as a future envelope, and SFU roots remain separately bounded to two.

docs/verification-status.md

@@ -33,7 +33,7 @@ This is the demand-loaded ledger for cross-cutting validation evidence and open
 - Relay resources: production is Host2/ordinary Browser Viewer1 and rejects any Viewer child2 regardless of advertised capacity. Two-child relay corroboration is therefore a future-capacity experiment, while the triggering child's edge-local MBB remains active. Relay CPU/GPU/upload cost and heterogeneous-network behavior remain unverified. Finish the role-aware matrix before the 20-viewer gate or any future capacity-tier change.
 - SFU: production deploys ordered `q,h`, roots <=2, and Dynacast off. Real zero-child shaped LiveKit packet flow, BWE downshift/recovery, resource cost, and root-with-children behavior remain open. Use Linux `tc` or a public canary for per-leaf shaping, never CDP throttling.
 - Audio: verify the 64/128/256 kbps Share settings, negotiated/observed bitrate, audible music quality, route changes, and game A/V synchronization. Bitrate settings are ceilings, not quality proof.
-- Observability: the UI and local stats plumbing are deployed, but target-browser availability and actual values remain unverified for Host SFU sender evidence, codec/fmtp and encoder implementation/power efficiency, media-source and encoded FPS, A/V playout/jitter/concealment, and selected candidate endpoints. These fields diagnose; they do not by themselves prove hardware encode, synchronization quality, or route quality.
+- Observability: the UI and local stats plumbing are deployed, but target-browser availability and actual values remain unverified for Host SFU sender evidence, codec/fmtp and encoder implementation/power efficiency, media-source and encoded FPS, A/V playout/jitter/concealment, and selected candidate endpoints. A source-only candidate adds bounded same-pair STUN-response observation without recovery authority. These fields diagnose; they do not by themselves prove hardware encode, synchronization quality, or route quality.
 - Mobile: Android/iOS remain Viewer-only. Autoplay, rotation, iOS lock-screen/page reclamation, background reconnection, and network changes need device evidence. AirPlay/system mirroring is Viewer-local output, not a portable in-app WebRTC output contract.
 - Native: ADR-0006 has one-Viewer evidence only. Viewer2/FIFO, hardware diversity, endurance, downloaded-package/public-host, game A/V, and browser diversity remain open.
 - Access and operations: run headful/production checks for fragment consumption, rotate/revoke, and request/nginx/journal/SQLite leakage. The isolated VM/IP gate remains required before clean-port migration; shared-IP smoke cannot approve it.