Piik/docs/verification-status.md

Current Verification Status

Last updated: 2026-08-24

Purpose

This is the demand-loaded ledger for cross-cutting validation evidence and open proof boundaries that do not fit one requirement, ADR, research note, or deployment guide. It is current state, not a release diary: replace superseded facts in place, move durable specialist conclusions to their owning documents, and let Git history retain completed timelines.

Capacity and routing entries below describe the exact tested source or release only. Product direction and executable work are owned by project memory and the TODO ledger.

Deployment Evidence

• Production runs exact deployed application/runtime revision c4962f54443ad5f98bc65861195a3d9c74a48996, release c4962f5, wire screener-v11, from /opt/screener/releases/c4962f5; that revision is integrated in canonical main. The immutable runtime ZIP SHA-256 is 734815479a03728bb81b44ce5dc04fe010323acdbb91cdbea0e806548278164c; its 38-file manifest SHA-256 is aefc414238655e9cb33d33975813bcc44afd22c5ad4e056ab719fae6c20aed47.
• Postflight found screener, LiveKit, coturn, and nginx active with zero restarts. Local/public health matched the release; assets/index-DQgIVwby.js has SHA-256 f819df6c94652d0c5847daa602431384f7b6bf58aa38615fa327526755ede4ef.
• Production uses endpoint capacity 2, room admission 20, random free four-digit memory rooms, ROOM_LEASE_SECONDS=86400, a dedicated LiveKit instance with room.auto_create: false and max_participants: 21, and global SFU admission 1 ingress / 20 egress. Room authority is process-memory-only. Coturn is stun-only, no-tcp, and no-tls; only UDP 3478 listens, and nft exposes only UDP 3478/7882 for Screener media.
• The production service orders Screener after LiveKit and boundedly waits for its control listener. The LiveKit namespace is empty; media listeners remain STUN-only UDP 3478 and LiveKit UDP 7882 with no 5349, coturn TCP/TLS, relay range, ICE/TCP, or media TCP listener. The unchanged nft ruleset has SHA-256 a895f0bb7b66ffe21071ee18acd84d4ea43ca16d4bca9517e6272e14d0ecced4.
• This application-only postflight proves archive identity, atomic application/assets, stale-wire rejection, process health, listener/firewall continuity, and log sentinels. It did not exercise direct, browser-relay, SFU, audio, codec, mobile, quality, or endurance behavior. Routine application-only releases do not maintain a full rollback/configuration backup; any future infrastructure or irreversible-state change requires recovery scoped to what it changes.

Retained Functional Evidence

• Exact v12 predecessor implementation 064db16c1b6d25fd24b7057b7e2fca172002e3c4 passed repository hygiene, TypeScript typecheck, all 604 Web tests in 45 files, client and server production builds, the 255-test SFU admission gate in 10 files, the explicit-Chrome access/privacy gate, and the Chrome 20-Viewer loopback gate. Independent reviews found no remaining blocker. Real Chrome checks at 1440, 600, and 390 CSS pixels showed the complete 53-character local invitation URL without overflow; the 390-pixel room-password control stayed collapsed until requested and its editor fit when opened. A missing well-formed room showed 房间不存在或已过期, no password control, and no horizontal overflow. This validates that exact source and responsive surface only; it is not deployment, physical screen-audio, public-network, or real-SFU evidence.
• Exact v11 implementation f5a295c52e0ac7d18e5a7949217861c7aa74e9c9, integrated with the SFU isolation fix into deployed application/runtime revision c4962f54443ad5f98bc65861195a3d9c74a48996 and canonical main, passed TypeScript typecheck, all 605 Web tests in 45 files, client and server production builds, the 254-test SFU gate in 10 files, and the access/privacy gate with explicit Chrome. This validates source structure, strict-wire behavior, fixed-VP8 path configuration, build output, and the covered Browser gate only; it does not provide full physical direct/browser-relay/SFU codec evidence.
• Exact Browser SFU ICE-server-isolation implementation ae09c760adec76fd26da611d4928486d105c6d3b passed repository hygiene, TypeScript typecheck, all 605 Web tests in 45 files, client and server production builds, three independent code reviews, focused 95-test publisher/subscriber and ordinary-peer isolation coverage, deployment postflight, and owner physical SFU fallback media proof. This establishes the reported production connection fix without turning candidate type/count into an invariant; full route/codec/network acceptance remains open.
• A fresh canonical main@c4962f5 background gate passed repository hygiene, all 605 Web tests, both production builds, the 254-test SFU admission suite, and the Chrome 151 20-Viewer 720p30/30-second local route gate. All 20 Viewers advanced decoded frames, Host and relays stayed within endpoint cap 2, no orphan SFU publication appeared, and all four current-child timing distributions contained 20 values. The browser gate uses deterministic canvas and does not start LiveKit, so it proves local direct/browser-relay control and media behavior only; it is not physical capture or SFU evidence.
• Exact v10 runtime source fdd5a4a529ff297f41c05ea3388bf484d76afe8f passed repository hygiene, TypeScript typecheck, client and server production builds, all 610 Web tests in 45 files, the 257-test SFU admission gate, the access/privacy Browser gate, and the production-dependency audit with zero vulnerabilities. Its one-Host/20-Viewer Chrome 151 direct-loopback report passed all seven assertions: all Viewers decoded, the selected VP8 settings reached every participant, Host and relay media edges stayed within cap 2, no orphan SFU publication appeared, and all four current-child timing distributions contained 20 values. The report SHA-256 is 802CBB7632E9AEA3C39FE831A7F7880D24140B2E83942CE0DFDA05DE4B408EED. This validates the v10 source boundary, not H.264 quality, hardware attribution, physical capture, public-network behavior, or SFU packet flow.
• Chrome 151 synthetic 1/3/5/8 and 720p30 runs preserved bounded fanout and decoding. A 9461e20-era three-Viewer rerun kept Host2/Browser Viewer1, decoded every Viewer, and recovered a hard first-level relay departure in 5,380 ms; it did not exercise quality-triggered MBB. Sixteen-Viewer cap2/cap3 loopbacks decoded all Viewers and a ten-second follow-up recorded guarded sender and aggregate Chromium CPU evidence, but resolution/FPS remained low and the ordinary-PC data cannot rank caps, select product policy, or prove sustainable heterogeneous-network quality. See peer-assisted media.
• Chrome 151 with local LiveKit 1.13.5/client 2.22.0 proved one SFU/UDP root after q,f -> q,h: decoded frames advanced 3 -> 23, rendered frames reached 26, Host used one edge, and leaves were clean. This is functional evidence only. See low-server media routes.
• Chrome 151 on the current Windows TUN path reproduced intermittent production LiveKit initial ICE before publication: server counters observed both ingress and egress while Browser ICE received no responses. Eight isolated Host attempts using the LiveKit-provided STUN endpoint succeeded 2/8; explicitly empty Browser SFU iceServers succeeded 8/8, observed a peer-reflexive-to-host UDP pair within 0.5--1.7 seconds, and published 75--89 ms later. This selects Browser SFU ICE-server isolation; the observed candidate type is diagnostic, not a gate, and the run does not close exact deployed Host/Viewer first-frame, mobile, quality, or endurance evidence. See low-server media routes.
• Host A+B and authenticated P2P Viewer C evidence is sanitized, generation-bound, diagnostic-only, and closed for stale or ambiguous reports. Production can expose a Host-local current SFU h snapshot and clears it on publisher identity changes; raw media metadata is not retained. See realtime quality adaptation.
• Fresh Chrome 151 tab-capture probes identified two separate Browser boundaries. Removing video contentHint = "motion" changed VP8 from 14.93 fps at 428x208 to 29.73 fps at 1904x928 under the same 5 Mbps balanced setup. No-hint AMD H.264 remained about 14--16 fps with hundreds of outer rate-limiter drops, while the same MFT reached 29.93 fps under diagnostic Desktop SW BRC; OpenH264 was slower. The page cannot enable that Chromium field trial or select an adapter/MFT. No-hint VP8 used libvpx software and held about 30 fps in one- and two-sender loopback on the test machine, but the process CPU totals include capture and local decode and are not real-game or weaker-device evidence. This evidence selects fixed VP8 for the Browser contract; current source and production implement that decision, while physical production codec behavior remains unverified. See realtime quality adaptation, Native H.264, and Native shared encode.
• One bounded Chrome 151/Windows 25H2 current-browser screening used real getDisplayMedia() window capture, VP8/libvpx with no video hint, a continuously changing WPF source, and one same-machine loopback receiver. Focused, hidden-tab, and minimized 15-second windows measured about 29.4--29.6 capture/encoded/decoded fps and 1.35--1.50 ms encode time per frame; each boundary sample read an enabled, unmuted, live 1186x712 track and each end sample reported qualityLimitationReason=none. All rates used monotonic counter deltas over the outbound-RTP RTCStats timestamp interval; source/inbound timestamps and raw stats identities were not retained independently. The sample did not observe an immediate Host-document background drop; it does not cover exact production code, a real game, physical Viewer, CPU/GPU contention, audio, repetition, a hold beyond five minutes, or public routing. See Browser background capture.
• Native Windows 11 process audio is source-only and default-off. A retained run isolated the target by about 4018x and delivered 495 Opus packets to one Viewer; package download, game sync, Windows 10, and other routes remain open. See ADR-0008.

Open Proof Boundaries

• Routing: exact v10 local direct loopback remains historical evidence for admission-20 initial ingress and exact-candidate first-frame commit timing on that source. Current v11 production still needs physical direct, browser-relay, and SFU codec verification, together with route rollback, direct-stage exhaustion and SFU admission, relay-ingress reparent with subtree retention, disconnect/effective-capacity drain, pause/resume, and bounded failure on real browser/media paths. Silent control partitions may wait 30 to 60 seconds for heartbeat detection before the default five-second grace; a non-paused decoded-frame stall may invalidate only that exact child edge.
• Quality: production startup blur remains unclassified. One same-balanced local A/B retained route/PC/SSRC/track while 720p rose to 1080p, but natural ramp prevents causal, production, or SFU conclusions. Correlate Host capture/encode/send with Viewer receive/decode before changing policy.
• Host background: deferred until the report reproduces on exact production with a continuously changing real game or replay, a separate direct wired Viewer, synchronized capture/outbound/inbound plus CPU/GPU evidence, and repeated focused/unfocused/hidden/minimized windows. The current-Chrome Browser getDisplayMedia() WPF-window screening did not observe an immediate Host-page media drop, and the old harmful contentHint = "motion" release remains a plausible confound rather than a proven background cause. Current evidence authorizes no keepalive, Wake Lock, timer, codec switch, route change, or Native fallback.
• Relay resources: current source and production expose the authenticated 1/2/3 endpoint-cap boundary, and retained v10 local loopback evidence covers 20 Viewers at cap 2 only for that source. CPU/GPU/upload and heterogeneous-network measurements remain diagnostics, not authority to change the contract.
• Room scale: current source and production admit 20 Viewers plus one Host, and the retained v10 local Browser convergence gate covers that bound on direct loopback. A real public-network 1:20 session, quality, and sustained resource matrix remain open.
• SFU: production uses one Host publication with exact Viewer subscriptions and no fixed root-count or room-wide lease rule. Browser SFU PCs use the accepted empty-external-ICE-server rule and owner physical media proof closed the reported connection hold. Real LiveKit lifecycle/JWT replay, shaped packet-flow, BWE downshift/recovery, resource use, SFU-fed first-child behavior, and broader heterogeneous-network acceptance remain open. Use Linux tc or an authorized public canary for per-leaf shaping, never CDP throttling.
• Audio: current v12 source selects the exact active ordinary Host or SFU publisher audio sender and resets samples across track changes or absence. Physical verification of the 64/128/256 kbps settings, negotiated/observed bitrate, audible music quality, route changes, and game A/V synchronization remains open. Bitrate settings are ceilings, not quality proof, and a muted/idle Opus track may legitimately remain near 1 kbps.
• Observability: current v12 source keeps local connection details but removes Host/Viewer diagnostic downloads and Browser file-export plumbing; production v11 retains its old surface until deployment. The Host-only bounded snapshot stays for automatic acceptance. Target-browser availability and actual values remain unverified for Host SFU sender evidence, codec/fmtp and encoder implementation/power efficiency, media-source and encoded FPS, A/V playout/jitter/concealment, selected candidate endpoints, and bounded same-pair STUN-response observation. All retained fields diagnose and have no recovery authority; they do not by themselves prove hardware encode, synchronization quality, or route quality.
• Mobile: Android/iOS remain Viewer-only. Autoplay, rotation, iOS lock-screen/page reclamation, background reconnection, and network changes need device evidence. AirPlay/system mirroring is Viewer-local output, not a portable in-app WebRTC output contract.
• Native: ADR-0006 has one-Viewer evidence only. Viewer2/FIFO, hardware diversity, endurance, downloaded-package/public-host, game A/V, and browser diversity remain open.
• Access and operations: exact v11 implementation passed the access/privacy gate with explicit Chrome. Production passed atomic v11 application cutover/postflight plus stale-v10 rejection before authority. Restart-wide room loss, password-profile creation, grant/code orthogonality, rotate/revoke, memory-only runtime, and exact current journal/nginx sentinel checks retain their focused evidence. Headful same-browser preference replay and the isolated VM/IP clean-port matrix remain open; shared-IP smoke cannot approve them.

Evidence Rules

• Target-device and production measurements drive performance decisions. Ordinary-PC synthetic runs prove only correctness or interoperability.
• Record expensive evidence with exact source, environment, result, and applicability. When a relevant media path changes, replace or invalidate the corresponding entry; unrelated documentation changes do not require rerunning it.
• Keep architecture-splitting candidates out of this ledger unless a proven consumer boundary makes them active work; file length alone is not evidence.