Current Status

Last updated: 2026-08-25

This is the current execution index. Git history owns completed timelines; verification status owns evidence boundaries.

Production

https://share.bonfire.icu runs exact deployed application/runtime revision 2d5818ccf57f8ccf0999160ea74a16c9b4d97d12, release 2d5818c, wire screener-v12, from /opt/screener/releases/2d5818c; that revision is integrated in canonical main. Its immutable runtime ZIP SHA-256 is a2e4c6b3bdf062103cd09b75c7de072eedcb8f311264070f57fbb0dfcf2bf315, and its 38-file manifest SHA-256 is eb118c51759e087bb81b530c7d765fd862220227d5f70bcf807628b61155b5f4.
screener, LiveKit, coturn, and nginx are active/running; local/public /healthz return 200, all six served Browser files match the immutable release, and all four services report NRestarts=0. The main Browser asset is assets/index-CgT-8Ltd.js with SHA-256 f04c6ed8e963694a584b0e7de4bbf44820a7be1da10360a3ae99fb36149fb6be; the prior asset returns 404.
The service process resolves its working directory to exact release 2d5818c; it has no writable room StateDirectory or SQLite runtime.
Production admits one Host plus 20 Viewers, applies endpoint capacity 2, rejects stale Browser and executable-sender wires before room authority, and runs the one-controller exact-candidate route model with one staged total deadline. Rooms use random free four-digit codes, a 24-hour dormant lease, restart loss, local Host creation preferences, a room-lived 22-character Viewer grant, and exactly open | private code entry. Private rooms without a password are invitation-only; configuring one additionally permits matching code-and-password entry. LiveKit remains dedicated with room.auto_create: false, max_participants: 21, and global admission 1 publication ingress / 20 subscription egress.
Production media ports remain STUN-only UDP 3478 and LiveKit UDP 7882; coturn TCP/TLS, port 5349, media TCP, and relay ranges are disabled. The public Web ingress remains TCP 80/443; Node 8787 and LiveKit control/signaling 7880 are internal-only. The stable inet bonfire_filter table SHA-256 is afaf9d066e9f292d8bd19032b38c0978ccf60dd01c2fe7f210968ff751f90534; the dynamic fail2ban table is excluded from that identity.
SFU subscribers reconcile Host screen publications across connect, activation, participant arrival, track publication, and reconnect. LiveKit runs at warn/Pion error, and the Screener unit waits boundedly for the same-host LiveKit control listener before startup. The current postflight found healthy unchanged services; owner physical SFU fallback proof remains bounded to exact predecessor release c4962f5. Full current-release direct/browser-relay/SFU codec and real-network acceptance remain open.
Production Browser SFU publisher and subscriber PCs explicitly use empty external ICE-server lists while retaining LiveKit-signaled UDP candidates. The owner verified that the deployed isolation fixes the reported SFU connection failure; the prior P1 core-route hold is closed.
Production leaves video contentHint unset, keeps audio contentHint = "music", and fixes Browser direct, browser-relay, and SFU video to VP8 without codec UI, quality state, wire fields, or fallback media codecs.

Current Source

Canonical root main is the integration truth; auxiliary branches and older worktrees do not supersede it. Current source and production use the single strict Browser screener-v12 wire and reject every other wire before room authority.
Current source implements one Host plus up to 20 Viewers, one steady outbound media-copy cap for every non-server endpoint (default 2, static 1/2/3), and the process-memory room model with random four-digit codes, a default 24-hour dormant lease, exact-Host resume, restart loss, local Host preference replay, exactly open | private code entry, and no SQLite runtime. Every room defaults to open without a room password and independently receives a Viewer grant: one 22-character opaque value bound to that room incarnation. Private rooms without a password are invitation-only; configuring a password additionally permits matching code-only entry. Unallocated/reclaimed/expired code-only entry returns ROOM_NOT_FOUND without a password prompt.
One event-driven controller owns the committed graph and at most one room-serial child operation. It uses one deterministic candidate list/cursor and one total direct-then-SFU deadline; exact admission and physical resources remain charged through drain, and the pending candidate commits only after an exact-generation decoded-frame proof. A short-lived 100 ms stats observer proves only that candidate inside the existing deadline, while the 2-second sampler remains responsible for active-path diagnostics and decoded-frame stalls. Healthy edges remain sticky and current-path quality does not authorize reparenting.
Ordinary peer ICE is STUN-only and the only application fallback is the dedicated LiveKit SFU over UDP. SFU generations use explicit no-default ingress/egress capacities, exact reserved | committed | draining accounting, delete-plus-absence release, one Host publication, and exact Viewer subscription handles. No Screener TURN, ICE/TCP, media TCP, or TLS-relayed media route exists.
Current Browser SFU publisher and subscriber connects supply fresh autoSubscribe: false plus rtcConfig: { iceServers: [] } options. Ordinary peers retain deployment STUN; LiveKit signaling candidates, server-side public-IP discovery, route deadlines, ports, and retry behavior are unchanged.
Current source leaves video contentHint unset and keeps audio contentHint = "music". Browser direct and browser-relay offers contain VP8 as their only media codec, and SFU publication explicitly uses VP8 with no backup codec. Codec UI, quality state, wire fields, fallback media codecs, and share-lifetime codec branches are absent. Live 64/128/256 kbps audio-ceiling mutation remains unchanged; ordinary Host and SFU publisher metrics now select the exact current audio sender track and reset their baseline when that identity changes or disappears.
Current source implements typed first-frame Viewer presentation and recovery, Chinese user-facing route/access failures, local connection details without a diagnostic-file export, authenticated Host-only on-demand route snapshots for automatic acceptance, explicit missing-room presentation, and responsive entry controls. Host invitation controls remain independent from two-state room-code entry.
Recommended quality remains exactly 1080p60, 1080p30, and 720p30; current source defaults to 1080p30. Advanced resolution adds 480p as 854x480 without adding a fourth preset, and advanced FPS and bitrate remain independent.
Exact main@2d5818c passed repository hygiene, TypeScript, all 608 Web tests in 44 files, both production builds, focused independent review, and the production artifact/service postflight above. The predecessor SFU gate, access/privacy gate, 20-Viewer loopback, responsive visual, and physical SFU evidence remain separately revision-bounded in verification status.

Current Milestone

Physically validate the corrected live screen-audio statistics and 64/128/256 kbps ceilings with known audible content across direct, browser-relay, and SFU paths.
Physically verify fixed-VP8/no-video-hint direct, browser-relay, and SFU paths from actual codec, capture, outbound, and decoded stats.
Finish representative ICE/STUN/SFU acceptance including mobile networks. Browser port prediction, NAT classification, TCP probing, fake page keepalive, and quality-driven reparenting remain outside the accepted model.

Active Boundaries

fix/configurable-relay-cap is an old, incomplete draft and must not be merged as-is.
The desktop Host background/minimized report is deferred until a current-production real-game reproduction supplies synchronized media and CPU/GPU evidence. Mobile Viewer background playback and relay survival remain a separate Accepted Later lifecycle gate.
Open PR #192 and the Native stack are evidence/research, not pending product releases. Native senders, capture helpers, shared-encode executables, and their test binaries are outside the current Browser milestone and are not built or run.
Deployed surfaces and retained candidates that still need product decisions are indexed only in the TODO ledger; do not extend or roll them back automatically.
Room lifetime, authorization/storage semantics, restart loss, and routing are aligned on strict v12 in current source and production. The application-only cutover reused unchanged infrastructure and configuration and does not maintain a full rollback/configuration backup; any future infrastructure or irreversible-state change requires recovery scoped to the surfaces it actually changes.
Real SFU recovery, heterogeneous networks, mobile lifecycle, audio/A-V device behavior, and endurance/resource measurements remain external acceptance evidence, not blockers for unrelated reversible work.

Current Hold

There is no active core-route hold. Native/executable work and broad repository cleanup remain outside the current evidence boundary.

9.1 KiB Raw Blame History