docs(release): record selected-pair cleanup deployment (#244)

docs/adr/0002-memory-resident-protected-rooms.md

@@ -1,6 +1,6 @@
 # ADR-0002: Memory-Resident Rooms And Scoped Viewer Access
 
-- Status: Accepted and deployed in exact release `b68c471` on strict v12
+- Status: Accepted and deployed in exact release `2d5818c` on strict v12
 - Date: 2026-08-23
 
 ## Context
@@ -174,7 +174,7 @@ Current source and production use the strict `screener-v12` wire and implement t
 22-character room-incarnation grant, exact digest validation, rotate/revoke,
 browser-storage privacy, `open | private` code entry, and the `ROOM_NOT_FOUND`
 split without a v11 parser. Production is exact deployed revision
-`b68c47167da592dd673a78ec3d072936ef49e3ea`, release `b68c471`.
+`2d5818ccf57f8ccf0999160ea74a16c9b4d97d12`, release `2d5818c`.
 
 Exact release and operational evidence remain owned by deployment and
 verification status.

docs/adr/0005-automatic-hybrid-media-routing.md

@@ -1,6 +1,6 @@
 # ADR-0005: Automatic Hybrid Media Routing
 
-- Status: The route model is accepted and deployed in exact release `b68c471`
+- Status: The route model is accepted and deployed in exact release `2d5818c`
   on strict v12, including Browser SFU ICE-server isolation, no product
   diagnostic-download UI, and the retained Host-only acceptance snapshot.
 - Date: 2026-08-20
@@ -362,7 +362,7 @@ deployment-wide.
 ## Current Source And Deployment Boundary
 
 Production runs exact deployed application/runtime revision
-`b68c47167da592dd673a78ec3d072936ef49e3ea`, release `b68c471`; canonical `main`
+`2d5818ccf57f8ccf0999160ea74a16c9b4d97d12`, release `2d5818c`; canonical `main`
 contains the same application/runtime tree plus the current truth checkpoint, including exact
 Browser SFU ICE-server-isolation implementation
 `ae09c760adec76fd26da611d4928486d105c6d3b`. Both run strict `screener-v12` and

docs/deployment.md

@@ -3,7 +3,7 @@
 Last verified against upstream documentation: 2026-08-24.
 
 This page records production running exact deployed application/runtime revision
-`b68c47167da592dd673a78ec3d072936ef49e3ea`, release `b68c471`, and the single
+`2d5818ccf57f8ccf0999160ea74a16c9b4d97d12`, release `2d5818c`, and the single
 Browser `screener-v12` contract. Product direction and pending work are owned by
 [project memory](./project-memory.md) and [the TODO ledger](./todo.md).
 
@@ -13,8 +13,8 @@ Caddy or nginx; ordinary peer ICE advertises only STUN, while Browser LiveKit
 PCs configure no external ICE server and retain LiveKit-signaled UDP candidates.
 LiveKit supplies bounded SFU fallback capacity. Normal media remains distributed
 through direct or peer edges whenever those paths work. Production includes
-implementation `ae09c760adec76fd26da611d4928486d105c6d3b`; the owner physically
-verified SFU fallback media after the cutover.
+implementation `ae09c760adec76fd26da611d4928486d105c6d3b`; the owner's physical SFU
+fallback media proof remains bounded to predecessor release `c4962f5`.
 
 A deployment may additionally provide one dedicated single-node LiveKit process
 as the current controller's automatic final media fallback. This capacity is
@@ -25,16 +25,16 @@ ICE/UDP only. Ordinary peer ICE remains STUN-only and production coturn uses the
 tracked STUN-only configuration with TCP/TLS disabled. The source and production
 configure no TURN, ICE/TCP, media TCP, or TLS-relayed media.
 
-Production runs exact `b68c47167da592dd673a78ec3d072936ef49e3ea`, release
-`b68c471`, from `/opt/screener/releases/b68c471`. The immutable runtime ZIP
+Production runs exact `2d5818ccf57f8ccf0999160ea74a16c9b4d97d12`, release
+`2d5818c`, from `/opt/screener/releases/2d5818c`. The immutable runtime ZIP
 SHA-256 is
-`e5932880677ebb745ef9325f8def2185d88cdd7bb557fada7c3e1a9e1a7c2ffd`.
+`a2e4c6b3bdf062103cd09b75c7de072eedcb8f311264070f57fbb0dfcf2bf315`.
 Its 38-file path/size/hash manifest SHA-256 is
-`12e092822abad0d8448d9c6ec87386e8ff82eaafecfeab766e050fa0f3b46710`.
+`eb118c51759e087bb81b530c7d765fd862220227d5f70bcf807628b61155b5f4`.
 Local and public `/healthz` return 200; Screener, LiveKit, coturn, and nginx are
 active with `NRestarts=0`. The public main Browser asset is
-`assets/index-BSZhUco2.js` with SHA-256
-`30cf3bea2a7f80c5b0140f0e40fb0f3f3c082a6195e2ad0990509c663a605f96`.
+`assets/index-CgT-8Ltd.js` with SHA-256
+`f04c6ed8e963694a584b0e7de4bbf44820a7be1da10360a3ae99fb36149fb6be`.
 
 The release deploys the single Browser `screener-v12` wire, fixed VP8 for Browser
 direct, browser-relay, and SFU video, no video `contentHint`, no codec UI/state/wire,
@@ -42,9 +42,10 @@ random four-digit
 memory rooms with a 24-hour dormant lease, a room-lived 22-character grant,
 orthogonal `open | private` grant/code admission,
 20-Viewer room admission, the uniform endpoint media-copy cap `2`, and the
-one-controller exact-candidate route runtime. Production postflight verified open
-code entry, private invitation-only and password entry, grant rotation/revocation,
-typed missing-room failure, and stale `screener-v11` rejection with
+one-controller exact-candidate route runtime. Exact predecessor release
+`b68c471` production postflight verified open code entry, private invitation-only
+and password entry, grant rotation/revocation, typed missing-room failure, and
+stale `screener-v11` rejection with
 `INVALID_MESSAGE` and WebSocket close 1008 before room authority. The service unit
 has no writable room StateDirectory; all room authority is process-memory-only.
 LiveKit is dedicated, has `room.auto_create: false` and
@@ -270,7 +271,7 @@ lifetime. An actively connected Host prevents expiry; explicit stop or Host
 disconnect starts the lease, and only the exact Host token renews it before
 expiry. Viewer activity never renews ownership. `ROOM_DATABASE_PATH` and
 `ROOM_TTL_SECONDS` fail startup even when blank.
-Production `b68c471` accepts 1 through 20 and explicitly selects 20. This is an
+Production `2d5818c` accepts 1 through 20 and explicitly selects 20. This is an
 admission limit, not evidence that every publisher, network, or quality profile
 can sustain that many streams.
 `ENDPOINT_MEDIA_COPY_CAPACITY` defaults to 2 and accepts only 1, 2, or 3. It is
@@ -283,7 +284,7 @@ must fail or wait before a fourth endpoint copy is issued.
 Supplying the removed `MAX_PEER_RELAY_DOWNSTREAM_EDGES`, even blank, fails
 startup.
 
-Production release `b68c471` runs the deployed server and Browser assets
+Production release `2d5818c` runs the deployed server and Browser assets
 atomically on `screener-v12`; every stale Browser or executable-sender wire fails
 before room authority. Native senders and helpers are outside this release.
 

docs/project-memory.md

@@ -28,13 +28,13 @@ Last updated: 2026-08-25
 
 ## Current Source And Production
 
-- Production runs exact application/runtime revision `b68c47167da592dd673a78ec3d072936ef49e3ea`, release `b68c471`, on strict `screener-v12`; canonical `main` contains the same application/runtime tree plus the current truth checkpoint.
+- Production runs exact application/runtime revision `2d5818ccf57f8ccf0999160ea74a16c9b4d97d12`, release `2d5818c`, on strict `screener-v12`; canonical `main` contains the same application/runtime tree plus the current truth checkpoint.
 - Current source and production admit up to `20` Viewers and implement the uniform `1/2/3` endpoint cap, exact prepare candidate, first-decoded-frame commit, strict rollback revision, decoded-progress stall, a two-stage direct/SFU operation deadline, and one event-driven room controller. A short-lived exact-generation decoded-frame observer proves only the pending candidate inside the existing total deadline; the periodic stats sampler remains responsible for active-path diagnostics and stalls. Ordinary peer ICE is STUN-only and the sole application fallback is SFU/UDP; stale TURN environment keys fail startup. SFU admission uses exact publication and Viewer-subscription handles with explicit no-default ingress/egress capacities and a listener-fenced dedicated LiveKit owner. Browser SFU publisher/subscriber connects use fresh empty ICE-server options; the owner physically verified deployed SFU fallback media after release `c4962f5`, closing the prior core-route hold.
 - Source and production use random four-digit memory rooms, dormant leases, exact-Host resume, restart loss, local preference replay, orthogonal grants/code entry, and no SQLite runtime. V12 uses a 22-character room-incarnation grant, `ROOM_NOT_FOUND`, no diagnostic-file export, and a compact UI showing the complete shorter URL.
 - Exact production artifacts, services, ports, and any change-scoped infrastructure recovery boundary are owned by [deployment](./deployment.md) and indexed by [status](./status.md).
 - Source and production require v12, fix Browser direct, browser-relay, and SFU media to VP8, leave video `contentHint` unset, and contain no codec UI, quality state, wire field, fallback media codec, or share-lifetime codec branch. They use `shareGeneration`-fenced Pause/Resume, implement live 64/128/256 kbps audio-ceiling mutation, bind Host and SFU publisher audio metrics to the exact current sender track, keep typed first-frame Viewer presentation, and expose exactly three recommended profiles with `1080p30` as default plus advanced-only `854x480`.
 - Browser SFU subscribers reconcile eligible Host screen publications across connect/activate event ordering, participant/track arrival, and reconnect. Production LiveKit logs only warn/error, and the application service has a bounded same-host LiveKit readiness preflight.
-- Exact `main@b68c471` passed TypeScript, 609 Web tests in 44 files, both builds, repository hygiene, the 261-test SFU gate, the explicit-Chrome access/privacy gate, focused review, and production access/postflight checks. Retained 20-Viewer, responsive visual, and physical SFU evidence stays bounded to its exact predecessor revisions.
+- Exact `main@2d5818c` passed TypeScript, 608 Web tests in 44 files, both builds, repository hygiene, focused review, and production artifact/service postflight. The SFU, access/privacy, 20-Viewer, responsive visual, and physical SFU evidence stays bounded to its exact predecessor revisions.
 - Chrome loopback, cap2/cap3, short resource, recovery, MBB, and A/V fixtures are bounded evidence only. They do not establish quality, resource limits, or product policy.
 
 ## Current Priority

docs/session-handoff.md

@@ -36,8 +36,8 @@ Current high-signal boundary:
   subscriber PCs explicitly use no external ICE server and check the dedicated
   public SFU candidate directly; ordinary peers and LiveKit server-side public
   IP discovery retain deployment STUN. Production exact deployed
-  application/runtime revision `b68c47167da592dd673a78ec3d072936ef49e3ea`,
-  release `b68c471`, uses strict `screener-v12` and includes exact Browser SFU
+  application/runtime revision `2d5818ccf57f8ccf0999160ea74a16c9b4d97d12`,
+  release `2d5818c`, uses strict `screener-v12` and includes exact Browser SFU
   ICE-server-isolation implementation
   `ae09c760adec76fd26da611d4928486d105c6d3b`. Owner physical SFU fallback proof
   remains bounded to predecessor release `c4962f5`. The route uses one short-lived

docs/status.md

@@ -6,9 +6,9 @@ This is the current execution index. Git history owns completed timelines; [veri
 
 ## Production
 
-- `https://share.bonfire.icu` runs exact deployed application/runtime revision `b68c47167da592dd673a78ec3d072936ef49e3ea`, release `b68c471`, wire `screener-v12`, from `/opt/screener/releases/b68c471`; that revision is integrated in canonical `main`. Its immutable runtime ZIP SHA-256 is `e5932880677ebb745ef9325f8def2185d88cdd7bb557fada7c3e1a9e1a7c2ffd`, and its 38-file manifest SHA-256 is `12e092822abad0d8448d9c6ec87386e8ff82eaafecfeab766e050fa0f3b46710`.
-- `screener`, LiveKit, coturn, and nginx are active/running; local/public `/healthz` return 200, all six served Browser files match the immutable release, and all four services report `NRestarts=0`. The main Browser asset is `assets/index-BSZhUco2.js` with SHA-256 `30cf3bea2a7f80c5b0140f0e40fb0f3f3c082a6195e2ad0990509c663a605f96`; the prior asset returns 404.
-- The service process resolves its working directory to exact release `b68c471`; it has no writable room `StateDirectory` or SQLite runtime.
+- `https://share.bonfire.icu` runs exact deployed application/runtime revision `2d5818ccf57f8ccf0999160ea74a16c9b4d97d12`, release `2d5818c`, wire `screener-v12`, from `/opt/screener/releases/2d5818c`; that revision is integrated in canonical `main`. Its immutable runtime ZIP SHA-256 is `a2e4c6b3bdf062103cd09b75c7de072eedcb8f311264070f57fbb0dfcf2bf315`, and its 38-file manifest SHA-256 is `eb118c51759e087bb81b530c7d765fd862220227d5f70bcf807628b61155b5f4`.
+- `screener`, LiveKit, coturn, and nginx are active/running; local/public `/healthz` return 200, all six served Browser files match the immutable release, and all four services report `NRestarts=0`. The main Browser asset is `assets/index-CgT-8Ltd.js` with SHA-256 `f04c6ed8e963694a584b0e7de4bbf44820a7be1da10360a3ae99fb36149fb6be`; the prior asset returns 404.
+- The service process resolves its working directory to exact release `2d5818c`; it has no writable room `StateDirectory` or SQLite runtime.
 - Production admits one Host plus 20 Viewers, applies endpoint capacity `2`, rejects stale Browser and executable-sender wires before room authority, and runs the one-controller exact-candidate route model with one staged total deadline. Rooms use random free four-digit codes, a 24-hour dormant lease, restart loss, local Host creation preferences, a room-lived 22-character Viewer grant, and exactly `open | private` code entry. Private rooms without a password are invitation-only; configuring one additionally permits matching code-and-password entry. LiveKit remains dedicated with `room.auto_create: false`, `max_participants: 21`, and global admission `1` publication ingress / `20` subscription egress.
 - Production media ports remain STUN-only UDP 3478 and LiveKit UDP 7882; coturn TCP/TLS, port 5349, media TCP, and relay ranges are disabled. The public Web ingress remains TCP 80/443; Node 8787 and LiveKit control/signaling 7880 are internal-only. The stable `inet bonfire_filter` table SHA-256 is `afaf9d066e9f292d8bd19032b38c0978ccf60dd01c2fe7f210968ff751f90534`; the dynamic fail2ban table is excluded from that identity.
 - SFU subscribers reconcile Host screen publications across connect, activation, participant arrival, track publication, and reconnect. LiveKit runs at `warn`/Pion `error`, and the Screener unit waits boundedly for the same-host LiveKit control listener before startup. The current postflight found healthy unchanged services; owner physical SFU fallback proof remains bounded to exact predecessor release `c4962f5`. Full current-release direct/browser-relay/SFU codec and real-network acceptance remain open.
@@ -25,7 +25,7 @@ This is the current execution index. Git history owns completed timelines; [veri
 - Current source leaves video `contentHint` unset and keeps audio `contentHint = "music"`. Browser direct and browser-relay offers contain VP8 as their only media codec, and SFU publication explicitly uses VP8 with no backup codec. Codec UI, quality state, wire fields, fallback media codecs, and share-lifetime codec branches are absent. Live 64/128/256 kbps audio-ceiling mutation remains unchanged; ordinary Host and SFU publisher metrics now select the exact current audio sender track and reset their baseline when that identity changes or disappears.
 - Current source implements typed first-frame Viewer presentation and recovery, Chinese user-facing route/access failures, local connection details without a diagnostic-file export, authenticated Host-only on-demand route snapshots for automatic acceptance, explicit missing-room presentation, and responsive entry controls. Host invitation controls remain independent from two-state room-code entry.
 - Recommended quality remains exactly `1080p60`, `1080p30`, and `720p30`; current source defaults to `1080p30`. Advanced resolution adds `480p` as `854x480` without adding a fourth preset, and advanced FPS and bitrate remain independent.
-- Exact `main@b68c471` passed repository hygiene, TypeScript, all 609 Web tests in 44 files, both production builds, the 261-test SFU gate, the explicit-Chrome access/privacy gate, focused independent review, and the production access/postflight checks above. Retained 20-Viewer loopback, responsive visual, and physical SFU evidence remains separately revision-bounded in [verification status](./verification-status.md).
+- Exact `main@2d5818c` passed repository hygiene, TypeScript, all 608 Web tests in 44 files, both production builds, focused independent review, and the production artifact/service postflight above. The predecessor SFU gate, access/privacy gate, 20-Viewer loopback, responsive visual, and physical SFU evidence remain separately revision-bounded in [verification status](./verification-status.md).
 
 ## Current Milestone
 

docs/todo.md

@@ -9,7 +9,6 @@ Only items in **Now** are executable after their stated decision gate. A branch
 1. **Physically validate live screen-audio statistics.** The deployed source binds ordinary Host and SFU publisher audio stats to the exact current sender track, merges SFU video/audio reports, and resets the baseline when audio identity changes or disappears. Reproduce the reported `1 kbps` state with known audible content and switch the 64/128/256 kbps ceilings across direct, browser-relay, and SFU paths while checking sender/receiver counters, route continuity, audible result, and A/V synchronization. A real muted/idle track may legitimately use about 1 kbps; do not multiply the value or display the configured ceiling as observed bitrate.
 2. **Diagnose and physically validate Browser VP8 performance with no video hint.** First reproduce the reported localhost `1080p60` shortfall with current production and separate source capture, encoded, sent, received, decoded, and rendered frame rates plus encode time, quality limitation, CPU/GPU load, and actual encoder implementation. Compare `contentHint` only as a controlled diagnostic and do not restore it by assumption. Then confirm actual VP8 codec, capture, outbound, and decoded stats on direct, browser-relay, and SFU paths; automated gates and the predecessor SFU connectivity proof do not close this performance/codec gate.
 3. **Finish real-network route acceptance.** Measure standard ICE/STUN direct paths, peer relay, SFU ingress/subscription, exact first-frame commit and rollback, relay-ingress repair with subtree retention, disconnect/capacity drain, Pause/Resume, and bounded explicit failure across representative IPv4/IPv6 NATs and mobile networks. Include an all-UDP-blocked case to establish the current failure boundary. Do not add port prediction, NAT classification, TCP probes, guessed candidates, route scores, or quality-driven reparenting.
-4. **Apply the accepted local-observation cleanup.** Remove the selected-pair `responsesReceived` cumulative and interval counters, their sampling window, and their tests; retain exact selected-pair resolution for current path metrics. Keep the signaling watchdog limited to authenticated, visible sessions with an active authoritative route. Hidden/background transitions rebaseline instead of proving failure, and the watchdog does not provide page or media keepalive.
 
 ## Accepted Later Roadmap
 

docs/verification-status.md

@@ -10,15 +10,15 @@ Capacity and routing entries below describe the exact tested source or release o
 
 ## Deployment Evidence
 
-- Production runs exact deployed application/runtime revision `b68c47167da592dd673a78ec3d072936ef49e3ea`, release `b68c471`, wire `screener-v12`, from `/opt/screener/releases/b68c471`; that revision is integrated in canonical `main`. The immutable runtime ZIP SHA-256 is `e5932880677ebb745ef9325f8def2185d88cdd7bb557fada7c3e1a9e1a7c2ffd`; its 38-file manifest SHA-256 is `12e092822abad0d8448d9c6ec87386e8ff82eaafecfeab766e050fa0f3b46710`.
-- Postflight found `screener`, LiveKit, coturn, and nginx active with zero restarts and no warning-level Screener journal entries. Local/public health and all six served Browser files matched the release; `assets/index-BSZhUco2.js` has SHA-256 `30cf3bea2a7f80c5b0140f0e40fb0f3f3c082a6195e2ad0990509c663a605f96`, while the prior main asset returns 404.
+- Production runs exact deployed application/runtime revision `2d5818ccf57f8ccf0999160ea74a16c9b4d97d12`, release `2d5818c`, wire `screener-v12`, from `/opt/screener/releases/2d5818c`; that revision is integrated in canonical `main`. The immutable runtime ZIP SHA-256 is `a2e4c6b3bdf062103cd09b75c7de072eedcb8f311264070f57fbb0dfcf2bf315`; its 38-file manifest SHA-256 is `eb118c51759e087bb81b530c7d765fd862220227d5f70bcf807628b61155b5f4`.
+- Postflight found `screener`, LiveKit, coturn, and nginx active with zero restarts and no warning-level Screener journal entries. Local/public health and all six served Browser files matched the release; `assets/index-CgT-8Ltd.js` has SHA-256 `f04c6ed8e963694a584b0e7de4bbf44820a7be1da10360a3ae99fb36149fb6be`, while the prior main asset returns 404.
 - Production uses endpoint capacity `2`, room admission `20`, random free four-digit memory rooms, `ROOM_LEASE_SECONDS=86400`, a dedicated LiveKit instance with `room.auto_create: false` and `max_participants: 21`, and global SFU admission `1` ingress / `20` egress. Room authority is process-memory-only. Coturn is `stun-only`, `no-tcp`, and `no-tls`; only UDP 3478 listens, and nft exposes only UDP 3478/7882 for Screener media.
 - The production service orders Screener after LiveKit and boundedly waits for its control listener. Media listeners remain STUN-only UDP 3478 and LiveKit UDP 7882 with no 5349, coturn TCP/TLS, relay range, ICE/TCP, or media TCP listener. The stable `inet bonfire_filter` table stayed unchanged through cutover at SHA-256 `afaf9d066e9f292d8bd19032b38c0978ccf60dd01c2fe7f210968ff751f90534`; the whole ruleset is not used as an identity because fail2ban owns a dynamic address set.
-- This application-only postflight proves archive identity, atomic application/assets, stale-v11 rejection, process health, listener/firewall continuity, and the production `open | private` access model: 22-character room-lived grant, approximately 24-hour dormant lease, public code entry, private invitation-only and password entry, rotate/revoke, and typed missing-room failure. It did not exercise direct, browser-relay, SFU, audio, codec, mobile, quality, or endurance behavior. Routine application-only releases do not maintain a full rollback/configuration backup; any future infrastructure or irreversible-state change requires recovery scoped to what it changes.
+- This application-only postflight proves archive identity, atomic application/assets, process health, and listener/firewall continuity. It did not re-exercise access, stale-wire rejection, direct, browser-relay, SFU, audio, codec, mobile, quality, or endurance behavior; those retained results remain revision-bounded below. Routine application-only releases do not maintain a full rollback/configuration backup; any future infrastructure or irreversible-state change requires recovery scoped to what it changes.
 
 ## Retained Functional Evidence
 
-- Exact deployed `main@b68c471` passed repository hygiene, TypeScript typecheck, all 609 Web tests in 44 files, client and server production builds, the 261-test SFU admission gate in 10 files, the explicit-Chrome access/privacy gate, and focused independent review. Retained Chrome 20-Viewer and responsive visual checks apply only to their recorded predecessor revisions; no current-release physical direct/browser-relay/SFU media claim is inferred.
+- Exact deployed `main@2d5818c` passed repository hygiene, TypeScript typecheck, all 608 Web tests in 44 files, client and server production builds, focused independent review, and production artifact/service postflight. Exact predecessor `b68c471` separately passed the 261-test SFU admission gate and explicit-Chrome access/privacy gate. Retained Chrome 20-Viewer and responsive visual checks apply only to their recorded predecessor revisions; no current-release physical direct/browser-relay/SFU media claim is inferred.
 - Exact Browser SFU ICE-server-isolation implementation `ae09c760adec76fd26da611d4928486d105c6d3b` passed repository hygiene, TypeScript typecheck, all 605 Web tests in 45 files, client and server production builds, three independent code reviews, focused 95-test publisher/subscriber and ordinary-peer isolation coverage, deployment postflight, and owner physical SFU fallback media proof. This establishes the reported production connection fix without turning candidate type/count into an invariant; full route/codec/network acceptance remains open.
 - A fresh canonical `main@c4962f5` background gate passed repository hygiene, all 605 Web tests, both production builds, the 254-test SFU admission suite, and the Chrome 151 20-Viewer 720p30/30-second local route gate. All 20 Viewers advanced decoded frames, Host and relays stayed within endpoint cap `2`, no orphan SFU publication appeared, and all four current-child timing distributions contained 20 values. The browser gate uses deterministic canvas and does not start LiveKit, so it proves local direct/browser-relay control and media behavior only; it is not physical capture or SFU evidence.
 - Exact v10 runtime source `fdd5a4a529ff297f41c05ea3388bf484d76afe8f` passed repository hygiene, TypeScript typecheck, client and server production builds, all 610 Web tests in 45 files, the 257-test SFU admission gate, the access/privacy Browser gate, and the production-dependency audit with zero vulnerabilities. Its one-Host/20-Viewer Chrome 151 direct-loopback report passed all seven assertions: all Viewers decoded, the selected VP8 settings reached every participant, Host and relay media edges stayed within cap `2`, no orphan SFU publication appeared, and all four current-child timing distributions contained 20 values. The report SHA-256 is `802CBB7632E9AEA3C39FE831A7F7880D24140B2E83942CE0DFDA05DE4B408EED`. This validates the v10 source boundary, not H.264 quality, hardware attribution, physical capture, public-network behavior, or SFU packet flow.
@@ -39,10 +39,10 @@ Capacity and routing entries below describe the exact tested source or release o
 - Room scale: current source and production admit 20 Viewers plus one Host, and the retained v10 local Browser convergence gate covers that bound on direct loopback. A real public-network 1:20 session, quality, and sustained resource matrix remain open.
 - SFU: production uses one Host publication with exact Viewer subscriptions and no fixed root-count or room-wide lease rule. Browser SFU PCs use the accepted empty-external-ICE-server rule and owner physical media proof closed the reported connection hold. Real LiveKit lifecycle/JWT replay, shaped packet-flow, BWE downshift/recovery, resource use, SFU-fed first-child behavior, and broader heterogeneous-network acceptance remain open. Use Linux `tc` or an authorized public canary for per-leaf shaping, never CDP throttling.
 - Audio: current v12 source and production select the exact active ordinary Host or SFU publisher audio sender and reset samples across track changes or absence. Physical verification of the 64/128/256 kbps settings, negotiated/observed bitrate, audible music quality, route changes, and game A/V synchronization remains open. Bitrate settings are ceilings, not quality proof, and a muted/idle Opus track may legitimately remain near 1 kbps.
-- Observability: current v12 source and production keep local connection details but no Host/Viewer diagnostic downloads or Browser file-export plumbing. The Host-only bounded snapshot stays for automatic acceptance. Target-browser availability and actual values remain unverified for Host SFU sender evidence, codec/fmtp and encoder implementation/power efficiency, media-source and encoded FPS, A/V playout/jitter/concealment, selected candidate endpoints, and bounded same-pair STUN-response observation. All retained fields diagnose and have no recovery authority; they do not by themselves prove hardware encode, synchronization quality, or route quality.
+- Observability: current v12 source and production keep local connection details but no Host/Viewer diagnostic downloads or Browser file-export plumbing. The Host-only bounded snapshot stays for automatic acceptance. Target-browser availability and actual values remain unverified for Host SFU sender evidence, codec/fmtp and encoder implementation/power efficiency, media-source and encoded FPS, A/V playout/jitter/concealment, and selected candidate endpoints. All retained fields diagnose and have no recovery authority; they do not by themselves prove hardware encode, synchronization quality, or route quality.
 - Mobile: Android/iOS remain Viewer-only. Autoplay, rotation, iOS lock-screen/page reclamation, background reconnection, and network changes need device evidence. AirPlay/system mirroring is Viewer-local output, not a portable in-app WebRTC output contract.
 - Native: ADR-0006 has one-Viewer evidence only. Viewer2/FIFO, hardware diversity, endurance, downloaded-package/public-host, game A/V, and browser diversity remain open.
-- Access and operations: exact deployed v12 passed the access/privacy gate with explicit Chrome and production cutover/postflight, including stale-v11 rejection before authority, room-lived grant/code orthogonality, private entry with and without a password, rotate/revoke, missing-room typing, and memory-only runtime. Headful same-browser preference replay and the isolated VM/IP clean-port matrix remain open; shared-IP smoke cannot approve them.
+- Access and operations: exact predecessor `b68c471` passed the access/privacy gate with explicit Chrome and production cutover/postflight, including stale-v11 rejection before authority, room-lived grant/code orthogonality, private entry with and without a password, rotate/revoke, missing-room typing, and memory-only runtime. Headful same-browser preference replay and the isolated VM/IP clean-port matrix remain open; shared-IP smoke cannot approve them.
 
 ## Evidence Rules
 

docs/方案设计.md

@@ -2,7 +2,7 @@
 
 ## 2026-08-18 14:45
 
-状态：production 运行精确 application/runtime revision `b68c47167da592dd673a78ec3d072936ef49e3ea`、release `b68c471` 和严格 `screener-v12`；canonical `main` 含相同 application/runtime tree 与当前 truth checkpoint。源码与生产已实现 22 字符 room-lived Viewer grant、`ROOM_NOT_FOUND`、产品诊断下载移除、完整短 URL 邀请 UI、收敛的房间密码控件与 exact-current audio stats，并固定 Browser VP8，video 不设置 `contentHint`、audio 保留 `music`，且无 codec UI/state/wire 或分享生命周期分支；Pause/Resume 继续由当前 Host session 和 `shareGeneration` 约束。Owner 的 SFU fallback 实测证据仍严格归属于 predecessor release `c4962f5`。
+状态：production 运行精确 application/runtime revision `2d5818ccf57f8ccf0999160ea74a16c9b4d97d12`、release `2d5818c` 和严格 `screener-v12`；canonical `main` 含相同 application/runtime tree 与当前 truth checkpoint。源码与生产已实现 22 字符 room-lived Viewer grant、`ROOM_NOT_FOUND`、产品诊断下载移除、完整短 URL 邀请 UI、收敛的房间密码控件与 exact-current audio stats，并固定 Browser VP8，video 不设置 `contentHint`、audio 保留 `music`，且无 codec UI/state/wire 或分享生命周期分支；Pause/Resume 继续由当前 Host session 和 `shareGeneration` 约束。Owner 的 SFU fallback 实测证据仍严格归属于 predecessor release `c4962f5`。
 
 ## 目标与边界
 
@@ -362,7 +362,7 @@ Token-free SFU standby prewarm 保持可选且不创建 participant、publicatio
 
 ## 当前交付边界
 
-- Production 使用严格单一 `screener-v12` wire 和精确 deployed application/runtime revision `b68c47167da592dd673a78ec3d072936ef49e3ea`、release `b68c471`；current source 含相同 application/runtime tree 与当前 truth checkpoint。两者均已实现短 room-lived grant、明确 missing-room 结果、产品诊断下载移除、完整短 URL 邀请 UI 与 exact-current audio stats，固定 Browser VP8 且 video 不设置 `contentHint`，codec selector、quality-state/wire 字段与分享生命周期 codec 分支不存在。
+- Production 使用严格单一 `screener-v12` wire 和精确 deployed application/runtime revision `2d5818ccf57f8ccf0999160ea74a16c9b4d97d12`、release `2d5818c`；current source 含相同 application/runtime tree 与当前 truth checkpoint。两者均已实现短 room-lived grant、明确 missing-room 结果、产品诊断下载移除、完整短 URL 邀请 UI 与 exact-current audio stats，固定 Browser VP8 且 video 不设置 `contentHint`，codec selector、quality-state/wire 字段与分享生命周期 codec 分支不存在。
 - Pause/Resume 由当前 Host session 和 `shareGeneration` 约束。Host 后台性能和 VP8 hardware acceleration 分别按受控根因证据诊断；标准 ICE/SFU 按真实异构网络验收。
 - 当前发布面只包含 Web Host、Viewer 和 browser relay。Native sender、capture helper、shared-encode executable 与两个分发包仍由各自后续决策和物理证据驱动，不属于当前 Browser release。