Piik/docs/verification-status.md

Current Verification Status

Last updated: 2026-08-23

Purpose

This is the demand-loaded ledger for cross-cutting validation evidence and open proof boundaries that do not fit one requirement, ADR, research note, or deployment guide. It is current state, not a release diary: replace superseded facts in place, move durable specialist conclusions to their owning documents, and let Git history retain completed timelines.

Capacity and routing entries below describe the exact tested source or release only. Product direction and executable work are owned by project memory and the TODO ledger.

Deployment Evidence

• Production runs exact d3ff9e7b7b4a8fe58db700565971aaeda638d2e9, release d3ff9e7, wire screener-v8, from /opt/screener/releases/d3ff9e7; the immutable runtime archive SHA-256 is a7c3b7b7cf593f3933a1c194a07370131fd76b3d4c30768b5206e84ccf93b63d. 352c457 is the immediate rollback release, and /opt/screener/backups/d3ff9e7-precutover-20260823T150618Z contains the verified environment/unit/LiveKit boundary.
• The 2026-08-23 postflight found screener, LiveKit, coturn, and nginx active with zero restarts; local and public /healthz returned 200 and the Screener journal contained no error line. The deployed browser bundle is assets/index-BVK8yQk2.js, SHA-256 388a093734e8dc37a07b859651ea15d4098a8c8f13864ca9d70eb99128a911a3, matching the locally built artifact and containing one screener-v8 and zero screener-v7 literals.
• Production uses endpoint capacity 2, room admission 20, random free four-digit memory rooms, ROOM_LEASE_SECONDS=86400, a dedicated LiveKit instance with room.auto_create: false and max_participants: 21, global SFU admission 1 ingress / 20 egress, and selected TURN admission 2. The v8 service has no StateDirectory or SQLite descriptor; the old live SQLite file/directory is absent and LiveKit listed zero rooms after startup.
• A public control-plane smoke passed site access, four-digit creation, Host v8 authentication, stale-v7 rejection before authority, independent code-only and grant Viewer admission, grant rotation that preserved the code Viewer, signaling challenge, and exact room abandonment. A separate service-restart smoke rejected the old Host token and Viewer grant, atomically created a password-policy replacement room, and abandoned it.
• The first reported SFU failure showed Host screen tracks published and the Viewer active over LiveKit UDP, but the candidate was deleted before a usable route committed. Exact d3ff9e7 fixed missing subscription reconciliation across pending connect, participant/track arrival, activation, and reconnect; 550 Web tests passed, and a production Host plus three zero-downstream Viewer canary forced one peer and two active 1920x1080 SFU roots. Room 9403 then exposed a separate earlier blocker: repeated cellular attempts never entered LiveKit. With Host peer slots full, bootstrap correctly converted one existing direct child into a healthy Host publication plus one SFU subscriber, but the cellular child's next operation again exhausted in direct/selected work before sfu:reuse. This is the active P1 stage-budget regression, not evidence that the publication or LiveKit UDP path is unavailable.
• The first hotfix cutover start raced LiveKit ActiveState before TCP 7880 and produced one supervised Screener restart. A production-only After/Wants plus bounded listener-ready ExecStartPre was installed; a simultaneous LiveKit/Screener restart then completed with both NRestarts=0. Pinned LiveKit info records were confirmed to contain raw PublisherOffer SDP, so production now uses warn/Pion-error. Three archived journal files containing prior raw SDP (90,404,248 bytes total) were deleted; the active journal and the post-hardening SFU canary contain zero PublisherOffer record.
• Rollback evidence confirms release 6b87732 and its old environment/runtime imports are readable, every precutover backup checksum passes, the backed-up database remains schema v3/integrity-ok with six rooms, and the current and rollback release regular-file sets share zero inodes.
• Share audio presets, local-only diagnostics, self-check, diagnostic export, signaling-partition recovery, and selected-edge transport remain deployed surfaces. Their real-route media behavior and target-browser field availability remain unverified.

Retained Functional Evidence

• Exact source 31e323e2754fcfde15f7b4d69e925ec71e2795cb passed repository hygiene, TypeScript typecheck, client/server builds, all 660 Web tests, all Native Go packages, go vet, and two independent P0/P1 reviews. The tests cover strict v6 endpoint-cap authentication, ordinary active/waiting authorization and grace promotion, Native cap propagation and admission, and peer-assisted cap rejection. This is local state-machine/build evidence, not a complete Native physical-slot matrix or production, browser-quality, or heterogeneous-network acceptance.
• Exact Wave B implementation source 815c6174d411c55648daf5cd6ac4c42f64effff9, based on d1ba2e52919225e67ad0c8dd2b660f333fbc88fd, passed its 372-test SFU-admission gate, all 690 Web tests, TypeScript typecheck, and client/server builds. Focused tests cover reserved/committed/draining accounting, reserve-before-token enforcement, explicit room lifecycle, listener-owner startup fencing, restart cleanup, stale-token replay boundaries, Host-offline reclamation, shutdown races, and two-room global admission. This is fake-control-plane and local state-machine evidence, not a real LiveKit process/JWT replay, packet-flow, multi-process, deployment-capacity, or production proof.
• Exact route source 4e0a922 passed repository hygiene, TypeScript typecheck, and 84 focused controller, runtime, protocol, transition, decoded-stall, and SFU-admission tests. During the same convergence, the full 557-test Web suite and client/server builds passed before the final no-consumer cleanup. The two independent route audits' model and wire findings are incorporated, and final static review found no remaining P0/P1. No Browser, Native, Go, helper, hardware, or executable test ran in the final pass; this is source and state-machine evidence, not production or heterogeneous-network proof.
• Exact source 6b87732 passed the required one-Host/20-Viewer local Browser smoke on Windows Node 24.19.0 / Chrome 151.0.7922.174, using 720p30 synthetic canvas media, endpoint cap 2, a 30-second measurement window, and report SHA-256 1347E036BB9AC35D51B4ED9B215290E742715128C7F3056D8FEB185CC84456D6. All six checks passed: 20/20 Viewers had live clean upstreams and increasing decoded frames, Host and relay sender counts stayed at two, topology was coherent, and no orphan SFU publication appeared. Maximum authenticate-to-first-decoded latency was 958 ms; the final graph had two Host children and eighteen peer descendants. The application Node process consumed about 0.95 additional CPU seconds over the 54-second observation window, peaked near 284 MiB RSS, and settled near 162 MiB; isolated Chromium averaged 761% CPU over its valid 25.97-second process interval. The harness did not configure LiveKit or TURN, so their observed usage was zero and this loopback is not a public-network, SFU/TURN, quality, or endurance claim.
• Exact memory-room source 2ba155782bd5c4a193484c007ee69007e562ddb9 passed repository hygiene, TypeScript typecheck, all 548 Web tests, and client/server builds. The focused room/access set contributed 239 passing tests across allocation, dormant leases, grant/code orthogonality, password KDF bounds, stale generation atomicity, protocol v8, HTTP/signaling, local ownership, and creation-profile replay. A fresh Chrome access/privacy gate also passed all fixed checks: pre-DOM fragment consumption, room-scoped session grant, zero request/nginx/application-log secret hits, zero persistent room files, strong grant rotate/revoke coverage, and cleanup. This is local source, state-machine, and loopback-browser evidence; it is not production deployment, restart/rollback, heterogeneous-network, or media-quality evidence.
• Current source TURN-admission unit and signaling tests cover independent peer and Host-SFU logical edges, shared capacity exhaustion, exact reserve/commit/drain/release identity, current-share cleanup, and graceful shutdown. This is local authorization evidence, not real coturn, network-media, or production-capacity proof.
• Chrome 151 synthetic 1/3/5/8 and 720p30 runs preserved bounded fanout and decoding. A 9461e20-era three-Viewer rerun kept Host2/Browser Viewer1, decoded every Viewer, and recovered a hard first-level relay departure in 5,380 ms; it did not exercise quality-triggered MBB. Sixteen-Viewer cap2/cap3 loopbacks decoded all Viewers and a ten-second follow-up recorded guarded sender and aggregate Chromium CPU evidence, but resolution/FPS remained low and the ordinary-PC data cannot rank caps, select product policy, or prove sustainable heterogeneous-network quality. See peer-assisted media.
• Chrome 151 with local LiveKit 1.13.5/client 2.22.0 proved one SFU/UDP root after q,f -> q,h: decoded frames advanced 3 -> 23, rendered frames reached 26, Host used one edge, leaves were clean, and TURN was absent. This is functional evidence only. See low-server media routes.
• Host A+B and authenticated P2P Viewer C evidence is sanitized, generation-bound, diagnostic-only, and closed for stale or ambiguous reports. Production can expose a Host-local current SFU h snapshot and clears it on publisher identity changes; raw media metadata is not retained. See realtime quality adaptation.
• The built-in peer TURN canary was rejected after allocation passed but the direct Host/Pion Viewer path failed before forced relay. Full rollback restored STUN-only client ICE and zero allocations. See built-in peer ICE TURN.
• Chrome H.264 loopback proves negotiation and decode interoperability, not encoder performance or hardware attribution. Native WGC/MF has a one-Viewer Windows proof with 203 rendered 1280x720 frames, 500 Opus packets, and nonzero process/LUID-correlated VideoEncode. See Native H.264 and Native shared encode.
• Native Windows 11 process audio is source-only and default-off. A retained run isolated the target by about 4018x and delivered 495 Opus packets to one Viewer; package download, game sync, Windows 10, and other routes remain open. See ADR-0008.

Open Proof Boundaries

• Routing: verify current-release initial ingress, exact candidate first-frame commit and rollback, peer-selected expiry/failure, relay-ingress reparent with subtree retention, disconnect/effective-capacity drain, pause/resume, and bounded failure on real browser/media paths. Silent control partitions may wait 30 to 60 seconds for heartbeat detection before the default five-second grace; a non-paused decoded-frame stall may invalidate only that exact child edge.
• Quality: production startup blur remains unclassified. One same-balanced local A/B retained route/PC/SSRC/track while 720p rose to 1080p, but natural ramp prevents causal, production, or SFU conclusions. Correlate Host capture/encode/send with Viewer receive/decode before changing policy.
• Relay resources: source and production expose the authenticated 1/2/3 endpoint-cap boundary, and the 20-Viewer loopback observed maximum Host and relay active-media edges of two at cap 2. CPU/GPU/upload and heterogeneous-network measurements remain diagnostics, not authority to change the contract.
• Room scale: source and production admit 20 Viewers plus one Host, and focused plus local Browser convergence evidence covers that bound. A real public-network 1:20 session, quality, and sustained resource matrix remain open.
• SFU: production uses one Host publication with exact Viewer subscriptions and no fixed root-count or room-wide lease rule. Real LiveKit lifecycle/JWT replay, shaped packet-flow, BWE downshift/recovery, resource use, and SFU-fed first-child evidence remain open. Use Linux tc or an authorized public canary for per-leaf shaping, never CDP throttling.
• Audio: verify the 64/128/256 kbps Share settings, negotiated/observed bitrate, audible music quality, route changes, and game A/V synchronization. Bitrate settings are ceilings, not quality proof.
• Observability: the UI and local stats plumbing are deployed, including identity-bound relayed-detail retention and export freshness guards, but target-browser availability and actual values remain unverified for Host SFU sender evidence, codec/fmtp and encoder implementation/power efficiency, media-source and encoded FPS, A/V playout/jitter/concealment, selected candidate endpoints, and bounded same-pair STUN-response observation. These fields diagnose and have no recovery authority; they do not by themselves prove hardware encode, synchronization quality, or route quality.
• Mobile: Android/iOS remain Viewer-only. Autoplay, rotation, iOS lock-screen/page reclamation, background reconnection, and network changes need device evidence. AirPlay/system mirroring is Viewer-local output, not a portable in-app WebRTC output contract.
• Native: ADR-0006 has one-Viewer evidence only. Viewer2/FIFO, hardware diversity, endurance, downloaded-package/public-host, game A/V, and browser diversity remain open.
• Access and operations: v8 production preflight/postflight, atomic environment/unit replacement, stale-v7 rejection, restart-wide room loss, password-profile creation, grant/code orthogonality, rotate/revoke, no-SQLite runtime, and exact current journal/nginx sentinel checks passed. Three historical rotated nginx access logs containing the current site secret in old /r/... request paths were deleted, and all remaining plain/gzip nginx logs plus Screener/LiveKit journals rescanned with zero site-secret hit. Headful same-browser preference replay and the isolated VM/IP clean-port matrix remain open; shared-IP smoke cannot approve them.

Evidence Rules

• Target-device and production measurements drive performance decisions. Ordinary-PC synthetic runs prove only correctness or interoperability.
• Record expensive evidence with exact source, environment, result, and applicability. When a relevant media path changes, replace or invalidate the corresponding entry; unrelated documentation changes do not require rerunning it.
• Keep architecture-splitting candidates out of this ledger unless a proven consumer boundary makes them active work; file length alone is not evidence.