diff --git a/docs/evidence/public-verified-piece-flow-20261028.json b/docs/evidence/public-verified-piece-flow-20261028.json new file mode 100644 index 0000000..ed738e0 --- /dev/null +++ b/docs/evidence/public-verified-piece-flow-20261028.json @@ -0,0 +1,106 @@ +{ + "schema": 1, + "measuredAt": "2026-10-28", + "status": "RED", + "provenance": { + "sdkSourceCommit": "d4a1235b035b4244ea73b55b1da0d4f88f64c376", + "websiteCommit": "46f714264a5631c5ba67949c0ff9de951e6b988c", + "analysisSha256": "87e3f2a3aa9ded9fdf2cd820fe565be8da4492e409acf056d7f7ebeafc9a7942", + "resultSha256": "c8c77fa197e98ca6d0bac1c0c90fcd2b894a1125014d78134ca5fa5d0b4fe022" + }, + "scope": { + "host": "One M4 Max Mac", + "browser": "Chrome 156.0.8078.48", + "headless": true, + "freshProfiles": 2, + "browserHttpCacheDisabled": true, + "signalling": "Controlled signalling on the same host; not public rendezvous qualification", + "publicAssetsMatchedForBothViewers": true, + "privateSdkOverride": false, + "adapterOverride": false, + "factoryInstrumentation": false, + "fullyVisibleAtAllDeclaredBoundaries": true + }, + "observation": { + "requiredWallSpanMs": 330000, + "recordedWallSpanMs": 329993, + "monotonicSpanMs": 330002.347833, + "failureReasons": [ + "less-than-330-seconds-observed" + ], + "verdict": "RED solely because recorded wall span is below 330000 ms; monotonic duration does not replace this gate. No rescore." + }, + "viewers": { + "A": { + "firstFrameMs": 3511.2, + "nativeFirstFrameDimensions": [ + 3840, + 2160 + ], + "observedPostFrameStalls": 0, + "observedPostFramePlayerErrors": 0, + "observedPostFrameDroppedFrames": 0, + "acceptedPeerBytes": 253697256, + "loadedSourceBytes": 833669668, + "acceptedPeerSharePercent": 23.331, + "httpCapture": { + "complete": true, + "requests": 183, + "inclusiveBodyBytes": 1004986003, + "completedBodyBytes": 839793194, + "partialFailedOrCancelledBodyBytes": 165192809, + "redirectBodyBytes": 0 + }, + "guaranteedSecondsAfterObservedWrap": 71.665, + "sdkReportRing": { + "retained": 240, + "total": 284, + "evicted": 44 + } + }, + "B": { + "firstFrameMs": 9346.5, + "nativeFirstFrameDimensions": [ + 3840, + 2160 + ], + "observedPostFrameStalls": 0, + "observedPostFramePlayerErrors": 0, + "observedPostFrameDroppedFrames": 0, + "acceptedPeerBytes": 74560956, + "loadedSourceBytes": 1001068971, + "acceptedPeerSharePercent": 6.932, + "httpCapture": { + "complete": true, + "requests": 185, + "inclusiveBodyBytes": 1053045042, + "completedBodyBytes": 1001204636, + "partialFailedOrCancelledBodyBytes": 51840406, + "redirectBodyBytes": 0 + }, + "guaranteedSecondsAfterObservedWrap": 71.665, + "sdkReportRing": { + "retained": 240, + "total": 281, + "evicted": 41 + } + } + }, + "accounting": { + "acceptedPeerShare": "accepted peer bytes / (accepted peer bytes + completed loaded source bytes); includes buffered media and is not HTTP, wire or billing savings", + "httpBodyUnits": "CDP dataReceived.dataLength; inclusive bytes include completed, partial, failed and cancelled response bodies; not encoded wire bytes", + "healthBasis": "Existing native snapshots, cumulative counters and complete native events; retained normal report rows checked separately", + "earlySdkAndHlsDetail": "UNKNOWN: early rich rows evicted from ring240, not reconstructed" + }, + "cleanup": { + "allCopiedEvidenceHashVerified": true, + "browserContextsClosed": true, + "ownedStageRemoved": true, + "profilesAbsent": true, + "metadataReverifiedBeforeRemoval": true + }, + "limits": [ + "One same-host headless diagnostic, not a causal performance comparison; prior results remain unchanged.", + "No physical-phone, independent-network/NAT, public TURN, synchronisation, competitor advantage or traffic-saving qualification." + ] +} diff --git a/docs/media-showcase.md b/docs/media-showcase.md index 4ab4e12..a82f904 100644 --- a/docs/media-showcase.md +++ b/docs/media-showcase.md @@ -75,6 +75,21 @@ wrap, but fewer than 60 seconds were observed afterwards. This failed sustained-playback check remains failed; the estimator correction needs a new check on its actual published assets. +The subsequent [28 October public check](evidence/public-verified-piece-flow-20261028.json) +on RelaySwarm `d4a1235` and site `46f7142` remains **RED**: its recorded wall +span was 329,993 ms against the strict 330,000 ms requirement. The monotonic +span was 330,002.347833 ms; it does not replace that gate or rescore the run. +Both fresh headless Chrome profiles on one M4, using controlled signalling +and the published assets without source overrides, recorded zero post-frame +stalls, player errors and dropped frames, including 71.665 seconds after a +programme wrap. First frames took 3.5112 and 9.3465 seconds. Accepted peer media +was 253,697,256 and 74,560,956 bytes (23.331% and 6.932% of accepted peer plus +loaded-source bytes); these shares are not traffic savings. Complete HTTP +body counts include partial or cancelled responses in the linked evidence. +Early rich SDK/Hls rows are unknown after 44 and 41 ring evictions. This is +no physical-phone, NAT/public TURN, synchronisation, competitor or causal +performance qualification; earlier results remain unchanged. + The [27 October public pair attempt](evidence/public-pair-startup-red-20261027.json) did not complete its planned observation: the first viewer presented 4K after 4.629 seconds, but the second viewer reached the one-shot startup buffer's diff --git a/site/llms.txt b/site/llms.txt index 078e285..9086e9a 100644 --- a/site/llms.txt +++ b/site/llms.txt @@ -9,6 +9,7 @@ - [Use cases](https://forgesworn.dev/use-cases.html): 32 end-to-end workflows, each naming the exact libraries it composes - [4K listening room and comparison player](https://forgesworn.dev/media-lab.html): the complete licensed Deja Vu mix leads the homepage. Play & join starts or joins a shared listening clock and real RelaySwarm participation. For a new room, the first full-recording viewer prepares a bounded verified media reservoir locally before publishing the shared start time; preparation does not count as an active listener. A viewer still preparing a private start adopts a verified active room promptly, retires its empty old loader before the acknowledgement and preserves the original Play request; a failed acknowledgement restores an explicit retry. Cancelled or replaced asynchronous setup failures cannot fail a newer Play request; genuine current publication failures still restore retry. Existing rooms keep their advancing clocks and later listeners join live, the starter can leave while others continue, and the room expires after the last listener leaves a short grace period. Pause leaves; Play rejoins live. The recording loops while occupied; the 1080p excerpt has its own room. The live listener ticker includes joined listeners and excludes read-only page observers; Play/Pause events update it directly, with lease expiry for abrupt departures and unknown status during lost room observation. A confirmed empty room invites the first listener to start. One visible player per visitor, room participants distinct from locally connected peers, stable identity mapping through peerConnectionDetails(), proportional media-batch movement and rates, source-host feeds, explicitly self-reported remote links, separate loaded-source/verified-peer/upload counters and recent local peer contribution. Loaded source includes browser cache; playback details distinguish completed source response bodies from network and cache when timing coverage is available. Cache hits do not animate as fresh local network traffic; concealed timings remain unavailable. The browser integration pins RelaySwarm source d4a1235b035b4244ea73b55b1da0d4f88f64c376 (package version 0.4.4), retaining bounded rolling startup planning, sustainable peer waits and range-sized WASM uploads. Startup preserves its verified contiguous future prefix before using the existing fourth residency slot even after the original first interval expires; that contiguous successor is not skipped by the previous fragment’s service-time lead once the target reaches both verified futures; the original first response is unchanged. The full-recording startup explicitly reserves a 32 MiB encoded aggregate including that response within the existing 64 MiB shared held budget; future bytes alone retain a 24 MiB cap, and non-startup playback keeps the SDK default. These are encoded reservoir limits, not total browser memory. Newly verified short peer pieces can refresh an older rate through a batch within one transfer and connection, retaining the 300 ms and 32 KiB floors, elapsed gaps and verification time. Origin bytes, duplicates and rejected responses cannot train this input; no first-byte timing sample or Rust/WASM binary change is introduced. The 27 October 330-second public pair on source 25354e3 and site acd26cd recorded 9 and 11 post-frame stalls, with fewer than 60 seconds observed after the wrap. That sustained-playback check remains failed; the estimator change requires fresh published-runtime qualification. Startup now has twelve seconds from the original first-fragment load entry, clipped to a shorter parent load deadline; ordinary speculative requests keep their eight-second expiry. Startup accepts parsed fragment start/duration roundoff within bounded machine precision, capped at one nanosecond, instead of falsely cancelling a matching context; sequence, continuity, level, key, size and duration checks remain authoritative. This does not establish stall-free or sustained 4K playback. A longer bounded wait does not establish successful real-source startup or alter required verified recovery headroom. Controlled correctness regressions do not establish reliable cold multi-viewer startup, decoded playback or traffic savings for this pin. When an owned source response finishes and its key is already known, eligible retained HAVE is published before FETCH withdrawal, including synchronous hls.js disposal; unknown keys do not delay playback for another hash. Cache/verification limits remain unchanged and no new peer-wait policy is enabled. This correction does not establish traffic savings or smoother playback. Peers exchange object-framing support in existing authenticated SDP offers and answers; an explicit version 2 is accepted only after current admitted SDP installation. Eligible new channels can therefore use verified range transfers before a periodic presence announcement; missing or unsupported values preserve conservative presence-derived behaviour. Admission, verification, upload limits and HTTP deadlines remain unchanged. Confirmed recorded main media requires a live same-key fetch lease before waiting for unavailable video; live and unknown playlists retain bounded seeding coordination. Sharing continues throughout active playback without an elapsed-time or cumulative-byte cutoff; upload rate, peers and cache remain bounded. Known pinned recordings use a client-generated bounded sliding live playlist with discontinuities across programme wraps and one visible player. The 267.32-second 4K programme preserves every original audio packet; a separately named, hash-pinned final fragment removes only 32 video frames after the soundtrack ends. The init and first 133 fragments remain byte-identical; the old immutable assets remain available. The next head can load before the tail ends; normal wraps do not end the element, reset its raw time or trigger replay priming. The bounded playlist retains 24 seconds of metadata behind the room clock so a slow initial response does not immediately eject the playhead; this does not enlarge the four-second media back buffer or encoded-media cache. A fixed per-session timeline origin maps raw media time to the shared clock; programme phase drives displayed time, telemetry and the musical pulse. Metadata preparation and peer creation remain after Play. Canonical manifest hashes and exact media URLs are checked, virtual global sequence/discontinuity values are signed against the unchanged piece catalogue, and a separate source/quality/epoch/manifest/duration cohort isolates this mode. Unsupported metadata and native HLS keep the ordinary VOD fallback; automatic clock corrections wait for sustained drift and stable, safely buffered playback, with the measured seek interruption added to the drift threshold, without changing music tempo. The responsive swarm picture keeps short labels and puts transfer rates and contribution statistics below it. A 16 KB score derived from the soundtrack drives a musical broadcast pulse against actual media time; pause, buffering, hidden pages and reduced motion stop it. This does not establish exact global audience counts or multi-speaker audio synchronisation. iPhone and iPad use the same peer-capable HLS path as other MediaSource-capable browsers; browser identity does not bypass sharing. The public Spry credential endpoint remains unconfigured pending an independently operated public endpoint. When configured, active playback requests and renews unique temporary TLS credentials from that independently operated instance, alongside STUN discovery. The supported public service uses its four-field credential contract and fresh one-hour leases, separately from KithMoot paired/private access. The final public instance endpoint remains operator configuration. This supplies a route for browsers that restrict direct UDP, including default Vanadium configurations. The bundle contains no relay password or operator root secret; availability diagnostics contain no credential. Pause cancels renewal. Issuer or route failure preserves HTTPS playback. Playback details can save or share a local JSON report with at most 240 one-second observations of actual frames, buffering, stalls and verified peer traffic, omitting network addresses, keys and credentials; no report is uploaded automatically. The HLS module prepares before Play without media requests or a player. The first tap attaches the selected media source and requests audible playback before awaiting room or peer setup; initial playback no longer waits for paused priming. This preserves request ordering but does not establish physical iPhone acceptance or stall-free startup. VOD fallback replay can still use a safely buffered current position while retaining buffered correction to the room. Reports retain raw media position/buffers and expose recording phase/duration separately; infinite continuous-media duration stays unavailable rather than being relabelled as the finite recording duration. Healthy network-stalled events with future data do not count as playback waits. The deployed 26 October 330-second same-M4 run used two fresh HTTP-cache-disabled Chrome profiles and the actual CDN assets, with no asset, controller or RTC overrides. Both had zero observed post-frame stalls/drops through the programme wrap and at least 60 seconds afterwards; accepted peer shares were 21.05% and 45.31%. First frames took 12.979 and 5.030 seconds. One midway report export per viewer remained in all measurements; A retained one nonfatal pre-frame aborted fragment event with no post-frame error increase. This is sampled same-host evidence, not physical-phone, independent-network, public TURN, wire-cost or eight-person-call acceptance. The earlier lab route passed public browser credential/CORS and hash-verified TLS data checks; that test route was retired. Fresh public-instance issuance, actual lease rotation during playback, independent-network cold-cache 4K and physical iPhone acceptance on the current revision remain separate gates. Positive peer waits require actual origin timing; a cold loader starts HTTP immediately while cached and late-HAVE peers retain their parallel race. Positive waits are bounded by the segment duration after measured origin recovery time; cached peer races start HTTP immediately and use an explicit peer-only Rust ranged planner with no internal HTTP source. The demo enables lateHaveRace: only native connections accepted at load entry can participate, after an actual exact-object HAVE arrives within the original 2.5-second window. HTTP continues immediately; one holder set is frozen and the deadline never extends. A verified calibration piece unlocks bounded pending work. Four-piece and 512 KiB request caps retain upload burst bounds for larger fragments. At the floor the peer arm cancels while its independent HTTP request continues. Normal buffered mixed transfers retain their HTTP ranges; older modules safely decline the unsupported mode. Range uploads copy the requested bytes across the WASM boundary, rather than the whole 4K object for every range. A separately packaged module Worker reuses the compiled Rust/WASM module for bounded piece scheduling and payload verification; HTTP continues during Worker startup or failure, and leaving the swarm terminates it. The bundle receipt pins the companion source and digest. This separates verification work from playback controls; measured device continuity and useful peer contribution remain acceptance checks. On native-HLS-capable browsers, repeated stalls can switch playback to native HLS; anonymous CORS is set before selecting the approved cross-origin media, peer resources close and native transfer totals are marked unavailable. Native recovery requests playback immediately and restores phase on metadata without a second Play; a later pause or policy rejection stays authoritative. Saved reports retain fixed HLS/native error codes, fallback reason and failed state without arbitrary messages or URLs. Terminal media failure restores Play again. A real Chrome recovery test decoded 333 native 4K frames with zero drops over 13 seconds after an intentional fatal Hls event; the transition interrupted playback for 3.827 seconds. This is recovery evidence, not sustained cold-cache or physical-phone acceptance. The Rust/WASM scheduler exchanges site-verified pieces of the unchanged 4K source, with HTTP completing the remainder, native controls, a Back to live action and shared-room invitation links. Integrity uses a site-pinned HTTPS digest catalogue with receiver-local commitment signing. Resource limits and reproduction: https://github.com/forgesworn/forgesworn.dev/blob/main/docs/media-showcase.md. The local runner compares native Sapflow and MediaMTX with the same H.264/AAC source and optionally real RelaySwarm delivery through Spry or coturn over UDP/TCP. Public process results are dated recordings; live origin CPU requires the local runner. Reproduction: https://github.com/forgesworn/forgesworn.dev/blob/main/docs/media-lab.md - [Deployed 4K playback evidence](https://github.com/forgesworn/forgesworn.dev/blob/main/docs/evidence/public-prepared-adoption-4k-20261026.json): dated 26 October 2026; two fresh Chrome profiles on one M4 Max, actual public assets, 330 seconds each, zero observed post-frame stalls/drops, 21.05% / 45.31% accepted peer media. Startup took 12.979 / 5.030 seconds. Includes report-export interactions and one retained pre-frame abort; no physical-phone, public TURN, independent-network or competitor advantage claim. +- [28 October public verified-piece-flow check](https://github.com/forgesworn/forgesworn.dev/blob/main/docs/evidence/public-verified-piece-flow-20261028.json): RelaySwarm d4a1235/site 46f7142, two fresh headless Chrome profiles on one M4 using controlled signalling and actual public assets without source overrides. Overall RED solely because the recorded wall span 329,993 ms was below the strict 330,000 ms gate; monotonic 330,002.347833 ms does not replace it or rescore the run. Both viewers recorded zero post-frame stalls/player errors/dropped frames and 71.665 seconds after a programme wrap; first frames 3511.2/9346.5 ms. Accepted peer 253,697,256/74,560,956 B (23.331%/6.932% of accepted peer plus loaded-source bytes) is not HTTP/wire savings. Linked evidence includes complete HTTP body accounting with partial/cancelled bodies and 44/41 SDK ring evictions, leaving early rich SDK/Hls detail unknown. No physical-phone, NAT/public TURN, synchronisation, competitor or causal performance qualification; prior results remain unchanged. - [Failed public pair startup attempt](https://github.com/forgesworn/forgesworn.dev/blob/main/docs/evidence/public-pair-startup-red-20261027.json): 27 October 2026, source cce9807/e910147. Viewer A presented 4K after 4.629 seconds; viewer B reached its one-shot startup deadline without a frame. The planned observation did not complete and this is not a 90-second or 330-second pass. Current terminal startup handling restores an explicit Play retry instead of retrying a permanently failed barrier; it does not resolve the underlying startup deadline or extend the deadline. Saved target/coverage/headroom values describe the last observed diagnostic geometry, not present residency after failure. - [Short public pair diagnostic](https://github.com/forgesworn/forgesworn.dev/blob/main/docs/evidence/public-pair-startup-diagnostic-20261027.json): 27 October 2026, site 03c9c95 and RelaySwarm e910147. Two fresh Chrome profiles with HTTP caching disabled on one M4 completed 90.2 seconds after the second first frame. Accepted peer video was 6.19 MB / 159.19 MB (1.74% / 47.26% of source-plus-peer loaded video), with zero reported post-frame stalls/errors and eight post-frame dropped frames in the second viewer. The second viewer still recorded 309.77 MB of HTTP bodies, including partial/aborted responses, so accepted peer share does not establish equivalent source-traffic savings. This shows useful participation; clean-frame, full-loop, phone, separate-network, public TURN, wire savings and competitor qualifications remain open. The earlier failed join remains published; this result does not establish a streaming-performance improvement from the UI patch. - [Dated physical iPhone playback evidence](https://github.com/forgesworn/forgesworn.dev/blob/main/docs/evidence/physical-safari-prepared-adoption-20261026.json): 26 October 2026, captured site4489e74/controller8f30da43/RelaySwarm e910147. 330.527 seconds,135 foreground samples, two natural wraps, zero displayed stalls/player errors; owner described phone playback as perfect while reporting desktop Chrome problems. Frames/drops, HTTP errors, first tap and phone cache state remain unqualified. This acceptance applies to the captured runtime, not later fixes. Phone and M4 companion both accepted zero peer media despite uploads; useful peer delivery in that case remains under investigation. No public TURN, NAT or savings claim.