Piik/docs/status.md

Current Status

Last updated: 2026-08-25

This is the current execution index. Git history owns completed timelines; verification status owns evidence boundaries.

Production

• https://share.bonfire.icu runs exact deployed application/runtime revision 1d8761528d0dba43fb6d818df3934483ba2f5340, release 1d87615, wire screener-v12, from /opt/screener/releases/1d87615; that revision is integrated in canonical main. Its immutable runtime ZIP SHA-256 is 715480487059bf83516a34e0d1083b52437619838c46bdc26ca5967529a1cf05, and its 38-file manifest SHA-256 is 96845789560394ca20b16c37a8e7ddadc7b488876e32241709d0f7a577fdca26.
• screener, LiveKit, coturn, and nginx are active/running; local/public /healthz and the served Browser asset match the immutable release, and all four services report NRestarts=0. The main Browser asset is assets/index-DfMqhOXY.js with SHA-256 cf6dd1c46cc9414a87331a9312eec315ddce8fce565741284998aa0141b18d47; the prior asset returns 404.
• The service process resolves its working directory to exact release 1d87615; it has no writable room StateDirectory or SQLite runtime.
• Production admits one Host plus 20 Viewers, applies endpoint capacity 2, rejects stale Browser and executable-sender wires before room authority, and runs the one-controller exact-candidate route model with one staged total deadline. Rooms use random free four-digit codes, a 24-hour dormant lease, restart loss, local Host creation preferences, a room-lived 22-character Viewer grant, and exactly open | private code entry. Private rooms without a password are invitation-only; configuring one additionally permits matching code-and-password entry. LiveKit remains dedicated with room.auto_create: false, max_participants: 21, and global admission 1 publication ingress / 20 subscription egress.
• Production media ports remain STUN-only UDP 3478 and LiveKit UDP 7882; coturn TCP/TLS, port 5349, media TCP, and relay ranges are disabled. The public Web ingress remains TCP 80/443; Node 8787 and LiveKit control/signaling 7880 are internal-only. The stable inet bonfire_filter table SHA-256 is afaf9d066e9f292d8bd19032b38c0978ccf60dd01c2fe7f210968ff751f90534; the dynamic fail2ban table is excluded from that identity.
• SFU subscribers reconcile Host screen publications across connect, activation, participant arrival, track publication, and reconnect. LiveKit runs at warn/Pion error, and the Screener unit waits boundedly for the same-host LiveKit control listener before startup. The current postflight found healthy unchanged services; exact-production direct, Browser-relay, single-representation SFU, and controlled direct-rollback-to-SFU gates are closed. A later exact-production subscriber-PC closure injection exposed the decoded-progress cadence defect described below; it is not physical network-loss evidence, so recovery and broader real-network acceptance remain open.
• Production Browser SFU publisher and subscriber PCs explicitly use empty external ICE-server lists while retaining LiveKit-signaled UDP candidates. The owner verified that the deployed isolation fixes the reported SFU connection failure; the prior P1 core-route hold is closed.
• Production leaves video contentHint unset, keeps audio contentHint = "music", and fixes Browser direct, browser-relay, and SFU video to VP8 without codec UI, quality state, wire fields, or fallback media codecs. Its SFU publisher uses exactly one HIGH encoding with simulcast: false, no subscriber quality selector, and explicit dynacast: false.

Current Source

• Canonical root main is the integration truth; auxiliary branches and older worktrees do not supersede it. Current source and production use the single strict Browser screener-v12 wire and reject every other wire before room authority.
• Current source implements one Host plus up to 20 Viewers, one steady outbound media-copy cap for every non-server endpoint (default 2, static 1/2/3), and the process-memory room model with random four-digit codes, a default 24-hour dormant lease, exact-Host resume, restart loss, local Host preference replay, exactly open | private code entry, and no SQLite runtime. Every room defaults to open without a room password and independently receives a Viewer grant: one 22-character opaque value bound to that room incarnation. Private rooms without a password are invitation-only; configuring a password additionally permits matching code-only entry. Unallocated/reclaimed/expired code-only entry returns ROOM_NOT_FOUND without a password prompt.
• One event-driven controller owns the committed graph and at most one room-serial child operation. It uses one deterministic candidate list/cursor and one total direct-then-SFU deadline; exact admission and physical resources remain charged through drain, and the pending candidate commits only after an exact-generation decoded-frame proof. A short-lived 100 ms stats observer proves only that candidate inside the existing deadline. The active-path 2-second sampler currently ceases to drive its 15-second decoded-progress deadline when an SFU subscriber has no video track, no merged report, or a failed stats read; the accepted correction keeps that same cadence delivery alive without adding a timer or fabricating metrics. Healthy edges remain sticky and current-path quality does not authorize reparenting.
• Ordinary peer ICE is STUN-only and the only application fallback is the dedicated LiveKit SFU over UDP. SFU generations use explicit no-default ingress/egress capacities, exact reserved | committed | draining accounting, delete-plus-absence release, one Host publication, and exact Viewer subscription handles. No Screener TURN, ICE/TCP, media TCP, or TLS-relayed media route exists.
• Current Browser SFU publisher and subscriber connects supply fresh autoSubscribe: false plus rtcConfig: { iceServers: [] } options. Ordinary peers retain deployment STUN; LiveKit signaling candidates, server-side public-IP discovery, route deadlines, ports, and retry behavior are unchanged.
• Current source leaves video contentHint unset and keeps audio contentHint = "music". Browser direct and browser-relay offers contain VP8 as their only media codec, and SFU publication uses exactly one VP8 HIGH encoding with simulcast: false, no backup codec, no subscriber quality selector, and explicit dynacast: false. Codec UI, quality state, wire fields, fallback media codecs, and share-lifetime codec branches are absent. Live 64/128/256 kbps audio-ceiling mutation remains unchanged; ordinary Host and SFU publisher metrics select the exact current sender, relays reconcile audio-track additions and removals on the persistent stream, and an SFU reconnect reacquires the current publication/sender or fails the route closed.
• Current source implements typed first-frame Viewer presentation and recovery, Chinese user-facing route/access failures, local connection details without a diagnostic-file export, authenticated Host-only on-demand route snapshots for automatic acceptance, explicit missing-room presentation, and responsive entry controls. Host invitation controls remain independent from two-state room-code entry.
• Recommended quality remains exactly 1080p60, 1080p30, and 720p30; current source defaults to 1080p30. Advanced resolution adds 480p as 854x480 without adding a fourth preset, and advanced FPS and bitrate remain independent.
• Exact main@1d87615 passed repository hygiene, TypeScript, all 607 Web tests in 44 files, both production builds, three independent reviews, immutable deployment postflight, the Chrome 151 single-representation SFU gate, and the controlled direct-rollback-to-SFU transaction. Earlier exact-production gates exercised direct, browser-relay, SFU audio continuity and all three audio ceilings, and sustained about 59.5 fps on direct and browser-relay paths; exact applicability remains in verification status.

Current Milestone

1. Implement ADR-0007's accepted VP8 HIGH+LOW simulcast with Dynacast and LiveKit server send-side BWE; keep AdaptiveStream disabled for potential relays and add no application layer controller. Then correct and deploy the active-SFU decoded-progress cadence, repeat the controlled recovery transaction, and finish representative ICE/STUN/SFU acceptance including screen-audio continuity and real-game A/V sync on mobile and heterogeneous networks. Browser port prediction, NAT classification, TCP probing, fake page keepalive, and quality-driven reparenting remain outside the accepted model.

Active Boundaries

• fix/configurable-relay-cap is an old, incomplete draft and must not be merged as-is.
• The desktop Host background/minimized report is deferred until a current-production real-game reproduction supplies synchronized media and CPU/GPU evidence. Mobile Viewer background playback and relay survival remain a separate Accepted Later lifecycle gate.
• Open PR #192 and the Native stack are evidence/research, not pending product releases. Native senders, capture helpers, shared-encode executables, and their test binaries are outside the current Browser milestone and are not built or run.
• Deployed surfaces and retained candidates that still need product decisions are indexed only in the TODO ledger; do not extend or roll them back automatically.
• Room lifetime, authorization/storage semantics, restart loss, and routing are aligned on strict v12 in current source and production. The application-only cutover reused unchanged infrastructure and configuration and does not maintain a full rollback/configuration backup; any future infrastructure or irreversible-state change requires recovery scoped to the surfaces it actually changes.
• Real SFU recovery, heterogeneous networks, mobile lifecycle, audio/A-V device behavior, and endurance/resource measurements remain external acceptance evidence, not blockers for unrelated reversible work.

Current Hold

The reproduced active-SFU decoded-progress starvation is a P1 core-route hold for the current route-acceptance phase until its single-cadence correction is deployed and the controlled recovery transaction passes. Native/executable work and broad repository cleanup remain outside the current evidence boundary.