Piik/docs/verification-status.md

Current Verification Status

Last updated: 2026-08-23

Purpose

This is the demand-loaded ledger for cross-cutting validation evidence and open proof boundaries that do not fit one requirement, ADR, research note, or deployment guide. It is current state, not a release diary: replace superseded facts in place, move durable specialist conclusions to their owning documents, and let Git history retain completed timelines.

Capacity and routing entries below describe the exact tested source or release only. Product direction and executable work are owned by project memory and the TODO ledger.

Deployment Evidence

• Production runs exact 6b87732b5f97b7836f628a2c333d0c3f05990c99, release 6b87732, wire screener-v7, from /opt/screener/releases/6b87732; the immutable archive SHA-256 is 3e88575e3842074f3ecb5dcbd548c159d13a113316d70f680ac6629e39a7f733. 9461e20 remains the rollback release, and /opt/screener/backups/6b87732-precutover-20260823T115350Z contains the verified pre-cutover SQLite/environment/LiveKit configuration.
• The 2026-08-23 postflight found screener, LiveKit, coturn, and nginx active with zero restarts after cutover; local and public /healthz returned 200. The deployed browser bundle is assets/index-BzbOwAcC.js, SHA-256 680bc27dcb3951cdbde54acaa4c7a456682946c1ba72076e956fc9ce6525f91f, matching the locally built artifact and containing the single screener-v7 wire literal.
• Production uses endpoint capacity 2, room admission 20, a dedicated LiveKit instance with room.auto_create: false and max_participants: 21, global SFU admission 1 ingress / 20 egress, and selected TURN admission 2. These are conservative bounded admissions, not throughput or quality claims. LiveKit listed zero rooms after startup, and SQLite v3 remains integrity-ok with six rooms, owner screener:screener, and mode 0600.
• Rollback evidence confirms the old release entrypoint is readable, every pre-cutover backup checksum passes, the backed-up database remains schema v3/integrity-ok with six rooms, and the current and rollback release regular-file sets share zero inodes.
• Share audio presets, local-only diagnostics, self-check, diagnostic export, signaling-partition recovery, and selected-edge transport remain deployed surfaces. Their real-route media behavior and target-browser field availability remain unverified.

Retained Functional Evidence

• Exact source 31e323e2754fcfde15f7b4d69e925ec71e2795cb passed repository hygiene, TypeScript typecheck, client/server builds, all 660 Web tests, all Native Go packages, go vet, and two independent P0/P1 reviews. The tests cover strict v6 endpoint-cap authentication, ordinary active/waiting authorization and grace promotion, Native cap propagation and admission, and peer-assisted cap rejection. This is local state-machine/build evidence, not a complete Native physical-slot matrix or production, browser-quality, or heterogeneous-network acceptance.
• Exact Wave B implementation source 815c6174d411c55648daf5cd6ac4c42f64effff9, based on d1ba2e52919225e67ad0c8dd2b660f333fbc88fd, passed its 372-test SFU-admission gate, all 690 Web tests, TypeScript typecheck, and client/server builds. Focused tests cover reserved/committed/draining accounting, reserve-before-token enforcement, explicit room lifecycle, listener-owner startup fencing, restart cleanup, stale-token replay boundaries, Host-offline reclamation, shutdown races, and two-room global admission. This is fake-control-plane and local state-machine evidence, not a real LiveKit process/JWT replay, packet-flow, multi-process, deployment-capacity, or production proof.
• Exact route source 4e0a922 passed repository hygiene, TypeScript typecheck, and 84 focused controller, runtime, protocol, transition, decoded-stall, and SFU-admission tests. During the same convergence, the full 557-test Web suite and client/server builds passed before the final no-consumer cleanup. The two independent route audits' model and wire findings are incorporated, and final static review found no remaining P0/P1. No Browser, Native, Go, helper, hardware, or executable test ran in the final pass; this is source and state-machine evidence, not production or heterogeneous-network proof.
• Exact source 6b87732 passed the required one-Host/20-Viewer local Browser smoke on Windows Node 24.19.0 / Chrome 151.0.7922.174, using 720p30 synthetic canvas media, endpoint cap 2, a 30-second measurement window, and report SHA-256 1347E036BB9AC35D51B4ED9B215290E742715128C7F3056D8FEB185CC84456D6. All six checks passed: 20/20 Viewers had live clean upstreams and increasing decoded frames, Host and relay sender counts stayed at two, topology was coherent, and no orphan SFU publication appeared. Maximum authenticate-to-first-decoded latency was 958 ms; the final graph had two Host children and eighteen peer descendants. The application Node process consumed about 0.95 additional CPU seconds over the 54-second observation window, peaked near 284 MiB RSS, and settled near 162 MiB; isolated Chromium averaged 761% CPU over its valid 25.97-second process interval. The harness did not configure LiveKit or TURN, so their observed usage was zero and this loopback is not a public-network, SFU/TURN, quality, or endurance claim.
• Current source TURN-admission unit and signaling tests cover independent peer and Host-SFU logical edges, shared capacity exhaustion, exact reserve/commit/drain/release identity, current-share cleanup, and graceful shutdown. This is local authorization evidence, not real coturn, network-media, or production-capacity proof.
• Chrome 151 synthetic 1/3/5/8 and 720p30 runs preserved bounded fanout and decoding. A 9461e20-era three-Viewer rerun kept Host2/Browser Viewer1, decoded every Viewer, and recovered a hard first-level relay departure in 5,380 ms; it did not exercise quality-triggered MBB. Sixteen-Viewer cap2/cap3 loopbacks decoded all Viewers and a ten-second follow-up recorded guarded sender and aggregate Chromium CPU evidence, but resolution/FPS remained low and the ordinary-PC data cannot rank caps, select product policy, or prove sustainable heterogeneous-network quality. See peer-assisted media.
• Chrome 151 with local LiveKit 1.13.5/client 2.22.0 proved one SFU/UDP root after q,f -> q,h: decoded frames advanced 3 -> 23, rendered frames reached 26, Host used one edge, leaves were clean, and TURN was absent. This is functional evidence only. See low-server media routes.
• Host A+B and authenticated P2P Viewer C evidence is sanitized, generation-bound, diagnostic-only, and closed for stale or ambiguous reports. Production can expose a Host-local current SFU h snapshot and clears it on publisher identity changes; raw media metadata is not retained. See realtime quality adaptation.
• The built-in peer TURN canary was rejected after allocation passed but the direct Host/Pion Viewer path failed before forced relay. Full rollback restored STUN-only client ICE and zero allocations. See built-in peer ICE TURN.
• Chrome H.264 loopback proves negotiation and decode interoperability, not encoder performance or hardware attribution. Native WGC/MF has a one-Viewer Windows proof with 203 rendered 1280x720 frames, 500 Opus packets, and nonzero process/LUID-correlated VideoEncode. See Native H.264 and Native shared encode.
• Native Windows 11 process audio is source-only and default-off. A retained run isolated the target by about 4018x and delivered 495 Opus packets to one Viewer; package download, game sync, Windows 10, and other routes remain open. See ADR-0008.
• The local access gate proves the current source's pre-DOM fragment clearing, room-scoped session isolation, no site/grant transport-log hits, no raw room-password SQLite sentinel, and rotate/revoke behavior. It predates the accepted in-memory room replacement and is headless loopback evidence only. See ADR-0002.

Open Proof Boundaries

• Routing: verify current-release initial ingress, exact candidate first-frame commit and rollback, peer-selected expiry/failure, relay-ingress reparent with subtree retention, disconnect/effective-capacity drain, pause/resume, and bounded failure on real browser/media paths. Silent control partitions may wait 30 to 60 seconds for heartbeat detection before the default five-second grace; a non-paused decoded-frame stall may invalidate only that exact child edge.
• Quality: production startup blur remains unclassified. One same-balanced local A/B retained route/PC/SSRC/track while 720p rose to 1080p, but natural ramp prevents causal, production, or SFU conclusions. Correlate Host capture/encode/send with Viewer receive/decode before changing policy.
• Relay resources: source and production expose the authenticated 1/2/3 endpoint-cap boundary, and the 20-Viewer loopback observed maximum Host and relay active-media edges of two at cap 2. CPU/GPU/upload and heterogeneous-network measurements remain diagnostics, not authority to change the contract.
• Room scale: source and production admit 20 Viewers plus one Host, and focused plus local Browser convergence evidence covers that bound. A real public-network 1:20 session, quality, and sustained resource matrix remain open.
• SFU: production uses one Host publication with exact Viewer subscriptions and no fixed root-count or room-wide lease rule. Real LiveKit lifecycle/JWT replay, shaped packet-flow, BWE downshift/recovery, resource use, and SFU-fed first-child evidence remain open. Use Linux tc or an authorized public canary for per-leaf shaping, never CDP throttling.
• Audio: verify the 64/128/256 kbps Share settings, negotiated/observed bitrate, audible music quality, route changes, and game A/V synchronization. Bitrate settings are ceilings, not quality proof.
• Observability: the UI and local stats plumbing are deployed, including identity-bound relayed-detail retention and export freshness guards, but target-browser availability and actual values remain unverified for Host SFU sender evidence, codec/fmtp and encoder implementation/power efficiency, media-source and encoded FPS, A/V playout/jitter/concealment, selected candidate endpoints, and bounded same-pair STUN-response observation. These fields diagnose and have no recovery authority; they do not by themselves prove hardware encode, synchronization quality, or route quality.
• Mobile: Android/iOS remain Viewer-only. Autoplay, rotation, iOS lock-screen/page reclamation, background reconnection, and network changes need device evidence. AirPlay/system mirroring is Viewer-local output, not a portable in-app WebRTC output contract.
• Native: ADR-0006 has one-Viewer evidence only. Viewer2/FIFO, hardware diversity, endurance, downloaded-package/public-host, game A/V, and browser diversity remain open.
• Access and operations: run headful/production checks for fragment consumption, rotate/revoke, and request/nginx/journal/SQLite leakage. The isolated VM/IP gate remains required before clean-port migration; shared-IP smoke cannot approve it.

Evidence Rules

• Target-device and production measurements drive performance decisions. Ordinary-PC synthetic runs prove only correctness or interoperability.
• Record expensive evidence with exact source, environment, result, and applicability. When a relevant media path changes, replace or invalidate the corresponding entry; unrelated documentation changes do not require rerunning it.
• Keep architecture-splitting candidates out of this ledger unless a proven consumer boundary makes them active work; file length alone is not evidence.