Piik/docs/verification-status.md

Current Verification Status

Last updated: 2026-08-24

Purpose

This is the demand-loaded ledger for cross-cutting validation evidence and open proof boundaries that do not fit one requirement, ADR, research note, or deployment guide. It is current state, not a release diary: replace superseded facts in place, move durable specialist conclusions to their owning documents, and let Git history retain completed timelines.

Capacity and routing entries below describe the exact tested source or release only. Product direction and executable work are owned by project memory and the TODO ledger.

Deployment Evidence

• Production runs exact 8f5b3f192ddd010ca01c969008e512191312736a, release 8f5b3f1, wire screener-v8, from /opt/screener/releases/8f5b3f1; the immutable runtime archive SHA-256 is 09c18d3604b64b627b01164b5a8d954fcbaeb567ca12dedf0b89deaac72bd767, and /opt/screener/backups/8f5b3f1-precutover-20260823T182438Z contains the exact previous application/environment/LiveKit/coturn/nft/unit boundary.
• The 2026-08-24 postflight found screener, LiveKit, coturn, and nginx active with zero restarts; local/public health returned 200. The deployed browser asset assets/index-sh8IJzwp.js matches local SHA-256 7fbc2f7ed67478c160e0122873116c03539084d637f3495cc588af70058364fc and contains exactly one screener-v8 wire literal.
• Production uses endpoint capacity 2, room admission 20, random free four-digit memory rooms, ROOM_LEASE_SECONDS=86400, a dedicated LiveKit instance with room.auto_create: false and max_participants: 21, and global SFU admission 1 ingress / 20 egress. Coturn is stun-only, no-tcp, and no-tls; only UDP 3478 listens, a randomized external STUN Binding request returned a matching 40-byte success response, and nft exposes only UDP 3478/7882 for Screener media. The v8 service has no StateDirectory or SQLite descriptor and the old live SQLite path is absent.
• A public control-plane smoke passed site access, four-digit creation, Host v8 authentication, stale-v7 rejection before authority, independent code-only and grant Viewer admission, grant rotation that preserved the code Viewer, signaling challenge, and exact room abandonment. A separate service-restart smoke rejected the old Host token and Viewer grant, atomically created a password-policy replacement room, and abandoned it.
• The first reported SFU failure showed Host screen tracks published and the Viewer active over LiveKit UDP, but the candidate was deleted before a usable route committed. Exact d3ff9e7 fixed missing subscription reconciliation across pending connect, participant/track arrival, activation, and reconnect; 550 Web tests passed, and a production Host plus three zero-downstream Viewer canary forced one peer and two active 1920x1080 SFU roots. Room 9403 then exposed a separate blocker: repeated cellular attempts never entered LiveKit because silent earlier route work consumed the total deadline before sfu:reuse. Current 8f5b3f1 leaves only direct and SFU shares, including a virtual Host-full bootstrap stage; local runtime tests pass and an exact heterogeneous-network field recheck remains open.
• The first hotfix cutover start raced LiveKit ActiveState before TCP 7880 and produced one supervised Screener restart. A production-only After/Wants plus bounded listener-ready ExecStartPre was installed; a simultaneous LiveKit/Screener restart then completed with both NRestarts=0. Pinned LiveKit info records were confirmed to contain raw PublisherOffer SDP, so production now uses warn/Pion-error. Three archived journal files containing prior raw SDP (90,404,248 bytes total) were deleted; the active journal and the post-hardening SFU canary contain zero PublisherOffer record.
• Rollback evidence confirms release 6b87732 and its old environment/runtime imports are readable, every precutover backup checksum passes, the backed-up database remains schema v3/integrity-ok with six rooms, and the current and rollback release regular-file sets share zero inodes.
• Share audio presets, local-only diagnostics, self-check, diagnostic export, and signaling-partition recovery remain deployed surfaces. Their remaining real-route media behavior and target-browser field availability remain unverified.

Retained Functional Evidence

• Exact source 31e323e2754fcfde15f7b4d69e925ec71e2795cb passed repository hygiene, TypeScript typecheck, client/server builds, all 660 Web tests, all Native Go packages, go vet, and two independent P0/P1 reviews. The tests cover strict v6 endpoint-cap authentication, ordinary active/waiting authorization and grace promotion, Native cap propagation and admission, and peer-assisted cap rejection. This is local state-machine/build evidence, not a complete Native physical-slot matrix or production, browser-quality, or heterogeneous-network acceptance.
• Exact Wave B implementation source 815c6174d411c55648daf5cd6ac4c42f64effff9, based on d1ba2e52919225e67ad0c8dd2b660f333fbc88fd, passed its 372-test SFU-admission gate, all 690 Web tests, TypeScript typecheck, and client/server builds. Focused tests cover reserved/committed/draining accounting, reserve-before-token enforcement, explicit room lifecycle, listener-owner startup fencing, restart cleanup, stale-token replay boundaries, Host-offline reclamation, shutdown races, and two-room global admission. This is fake-control-plane and local state-machine evidence, not a real LiveKit process/JWT replay, packet-flow, multi-process, deployment-capacity, or production proof.
• Exact route source 4e0a922 passed repository hygiene, TypeScript typecheck, and 84 focused controller, runtime, protocol, transition, decoded-stall, and SFU-admission tests. During the same convergence, the full 557-test Web suite and client/server builds passed before the final no-consumer cleanup. The two independent route audits' model and wire findings are incorporated, and final static review found no remaining P0/P1. No Browser, Native, Go, helper, hardware, or executable test ran in the final pass; this is source and state-machine evidence, not production or heterogeneous-network proof.
• Exact source 6b87732 passed the required one-Host/20-Viewer local Browser smoke on Windows Node 24.19.0 / Chrome 151.0.7922.174, using 720p30 synthetic canvas media, endpoint cap 2, a 30-second measurement window, and report SHA-256 1347E036BB9AC35D51B4ED9B215290E742715128C7F3056D8FEB185CC84456D6. All six checks passed: 20/20 Viewers had live clean upstreams and increasing decoded frames, Host and relay sender counts stayed at two, topology was coherent, and no orphan SFU publication appeared. Maximum authenticate-to-first-decoded latency was 958 ms; the final graph had two Host children and eighteen peer descendants. The application Node process consumed about 0.95 additional CPU seconds over the 54-second observation window, peaked near 284 MiB RSS, and settled near 162 MiB; isolated Chromium averaged 761% CPU over its valid 25.97-second process interval. The harness did not configure LiveKit, so its observed SFU usage was zero and this loopback is not a public-network, SFU, quality, or endurance claim.
• Exact memory-room source 2ba155782bd5c4a193484c007ee69007e562ddb9 passed repository hygiene, TypeScript typecheck, all 548 Web tests, and client/server builds. The focused room/access set contributed 239 passing tests across allocation, dormant leases, grant/code orthogonality, password KDF bounds, stale generation atomicity, protocol v8, HTTP/signaling, local ownership, and creation-profile replay. A fresh Chrome access/privacy gate also passed all fixed checks: pre-DOM fragment consumption, room-scoped session grant, zero request/nginx/application-log secret hits, zero persistent room files, strong grant rotate/revoke coverage, and cleanup. This is local source, state-machine, and loopback-browser evidence; it is not production deployment, restart/rollback, heterogeneous-network, or media-quality evidence.
• The direct-to-SFU source passed repository typecheck, all 531 Web tests in 41 files, and client/server production builds. The server build clears its fixed generated-output directory before compilation so the artifact contains only current route modules. Focused controller/runtime coverage proves direct-stage wake, Host-full virtual SFU bootstrap without a premature route error, SFU reuse, and a departed-root sequence where new demand takes the freed Host slot while healthy descendants remain sticky. This is local state-machine/build evidence; no Native/executable suite or heterogeneous-network media run was performed.
• Chrome 151 synthetic 1/3/5/8 and 720p30 runs preserved bounded fanout and decoding. A 9461e20-era three-Viewer rerun kept Host2/Browser Viewer1, decoded every Viewer, and recovered a hard first-level relay departure in 5,380 ms; it did not exercise quality-triggered MBB. Sixteen-Viewer cap2/cap3 loopbacks decoded all Viewers and a ten-second follow-up recorded guarded sender and aggregate Chromium CPU evidence, but resolution/FPS remained low and the ordinary-PC data cannot rank caps, select product policy, or prove sustainable heterogeneous-network quality. See peer-assisted media.
• Chrome 151 with local LiveKit 1.13.5/client 2.22.0 proved one SFU/UDP root after q,f -> q,h: decoded frames advanced 3 -> 23, rendered frames reached 26, Host used one edge, and leaves were clean. This is functional evidence only. See low-server media routes.
• Host A+B and authenticated P2P Viewer C evidence is sanitized, generation-bound, diagnostic-only, and closed for stale or ambiguous reports. Production can expose a Host-local current SFU h snapshot and clears it on publisher identity changes; raw media metadata is not retained. See realtime quality adaptation.
• Chrome H.264 loopback proves negotiation and decode interoperability, not encoder performance or hardware attribution. Native WGC/MF has a one-Viewer Windows proof with 203 rendered 1280x720 frames, 500 Opus packets, and nonzero process/LUID-correlated VideoEncode. See Native H.264 and Native shared encode.
• Native Windows 11 process audio is source-only and default-off. A retained run isolated the target by about 4018x and delivered 495 Opus packets to one Viewer; package download, game sync, Windows 10, and other routes remain open. See ADR-0008.

Open Proof Boundaries

• Routing: verify current-release initial ingress, exact candidate first-frame commit and rollback, direct-stage exhaustion and SFU admission, relay-ingress reparent with subtree retention, disconnect/effective-capacity drain, pause/resume, and bounded failure on real browser/media paths. Silent control partitions may wait 30 to 60 seconds for heartbeat detection before the default five-second grace; a non-paused decoded-frame stall may invalidate only that exact child edge.
• Quality: production startup blur remains unclassified. One same-balanced local A/B retained route/PC/SSRC/track while 720p rose to 1080p, but natural ramp prevents causal, production, or SFU conclusions. Correlate Host capture/encode/send with Viewer receive/decode before changing policy.
• Relay resources: source and production expose the authenticated 1/2/3 endpoint-cap boundary, and the 20-Viewer loopback observed maximum Host and relay active-media edges of two at cap 2. CPU/GPU/upload and heterogeneous-network measurements remain diagnostics, not authority to change the contract.
• Room scale: source and production admit 20 Viewers plus one Host, and focused plus local Browser convergence evidence covers that bound. A real public-network 1:20 session, quality, and sustained resource matrix remain open.
• SFU: production uses one Host publication with exact Viewer subscriptions and no fixed root-count or room-wide lease rule. Real LiveKit lifecycle/JWT replay, shaped packet-flow, BWE downshift/recovery, resource use, and SFU-fed first-child evidence remain open. Use Linux tc or an authorized public canary for per-leaf shaping, never CDP throttling.
• Audio: verify the 64/128/256 kbps Share settings, negotiated/observed bitrate, audible music quality, route changes, and game A/V synchronization. Bitrate settings are ceilings, not quality proof.
• Observability: the v8 UI and local stats/export plumbing are deployed, including identity-bound relayed-detail retention and export freshness guards, but target-browser availability and actual values remain unverified for Host SFU sender evidence, codec/fmtp and encoder implementation/power efficiency, media-source and encoded FPS, A/V playout/jitter/concealment, selected candidate endpoints, and bounded same-pair STUN-response observation. The accepted v9 Viewer stage and on-demand Host route snapshot are not implemented or deployed. All of these fields diagnose and have no recovery authority; they do not by themselves prove hardware encode, synchronization quality, or route quality.
• Mobile: Android/iOS remain Viewer-only. Autoplay, rotation, iOS lock-screen/page reclamation, background reconnection, and network changes need device evidence. AirPlay/system mirroring is Viewer-local output, not a portable in-app WebRTC output contract.
• Native: ADR-0006 has one-Viewer evidence only. Viewer2/FIFO, hardware diversity, endurance, downloaded-package/public-host, game A/V, and browser diversity remain open.
• Access and operations: v8 production preflight/postflight, atomic environment/unit replacement, stale-v7 rejection, restart-wide room loss, password-profile creation, grant/code orthogonality, rotate/revoke, no-SQLite runtime, and exact current journal/nginx sentinel checks passed. Three historical rotated nginx access logs containing the current site secret in old /r/... request paths were deleted, and all remaining plain/gzip nginx logs plus Screener/LiveKit journals rescanned with zero site-secret hit. Headful same-browser preference replay and the isolated VM/IP clean-port matrix remain open; shared-IP smoke cannot approve them.

Evidence Rules

• Target-device and production measurements drive performance decisions. Ordinary-PC synthetic runs prove only correctness or interoperability.
• Record expensive evidence with exact source, environment, result, and applicability. When a relevant media path changes, replace or invalidate the corresponding entry; unrelated documentation changes do not require rerunning it.
• Keep architecture-splitting candidates out of this ledger unless a proven consumer boundary makes them active work; file length alone is not evidence.