From 11f51e918434a22585fe776e391d7188c33ba44c Mon Sep 17 00:00:00 2001 From: TheCryptoDonkey <147930957+TheCryptoDonkey@users.noreply.github.com> Date: Mon, 26 Oct 2026 18:26:59 +0000 Subject: [PATCH] docs: publish deployed 4K continuity and peer delivery evidence --- .../public-prepared-adoption-4k-20261026.json | 221 ++++++++++++++++++ docs/media-showcase.md | 36 ++- site/llms.txt | 3 +- 3 files changed, 258 insertions(+), 2 deletions(-) create mode 100644 docs/evidence/public-prepared-adoption-4k-20261026.json diff --git a/docs/evidence/public-prepared-adoption-4k-20261026.json b/docs/evidence/public-prepared-adoption-4k-20261026.json new file mode 100644 index 0000000..c1cd877 --- /dev/null +++ b/docs/evidence/public-prepared-adoption-4k-20261026.json @@ -0,0 +1,221 @@ +{ + "schema": 1, + "kind": "deployed-public-recorded-4k-room-adoption", + "measuredAt": "2026-10-26T18:00:31.951Z", + "scope": "Two fresh HTTP-cache-disabled Chromium profiles on one M4 Max, using the actual public CDN assets without substitutions. Each viewer observed for at least 330 seconds after first frame, at 1x and unmuted. This is not physical-phone, independent-network, TURN or eight-person-call acceptance.", + "source": { + "siteCommit": "6e7d20cbc4f294dce61c1e60a5544fe5b76fdcba", + "applicationCommit": "2534854bac99b2d75afec05c3450f8313bdd7301", + "sdkCommit": "e910147fe971b2a96327ded6a8e43e0647c41f3d", + "entryTag": "20261026-prepared-adoption", + "controllerSha256": "8f30da43ae54add9f93ae70c14d829b81452d87a583cb25188da85f22b64e0f8", + "listenerSha256": "a8138683d3259699c9065ec4cacadc0a50014be5512666fa04d3c683b921ff7e", + "publicSwarmSha256": "cc93371bdb2a7ce04c849436fa2316f570fe52f2fffd09748e05a9d349d9c31d", + "bundleSha256": "ae965a6dace9aff494161ced5f2f6e9dc515197d0871e5a666cf875ee7be598b", + "wasmSha256": "7767f54cbeac999bee42419394647fcd472544d5bad005350f83d8d4dce4dce9", + "workerSha256": "9b4db9c6998e3303197c047364b3eb9d15f45af5f825d1d2890827007ed7dfc4" + }, + "protocolSha256": "d6d38c80e0b3ac4d150dbb958e6616c2f9fbfc591f45336d1aa37c282a80f548", + "measurement": { + "assetAndControllerOverrides": 0, + "rtcOrEndpointOverrides": 0, + "httpCacheDisabled": true, + "trustedPlayPerViewer": true, + "interaction": "One existing Save report button activation around 150 seconds per viewer and a final export after observation. No scroll, details, focus or playback controls changed. All effects retained; no excluded observation window.", + "syncMethod": "Two normal app report snapshots merged by exact elapsedMs; overlapping rows must agree. No clock or origin inference. Unknown, hidden or non-following observations fail qualification.", + "maximumAllowedSyncSampleGapMs": 2500, + "roomIdentityWitness": "Sampled stable DOM room epoch, single video object and nonempty source URI; not a direct bound-SDK cohort witness." + }, + "selectedContributionReceiver": "M4B", + "contributionGate": { + "minimumAcceptedPeerBytes": 10485760, + "minimumAcceptedPeerShare": 0.1, + "selectedReceiverPassed": true, + "everyViewerPassed": true + }, + "viewers": [ + { + "viewer": "M4A", + "observationSeconds": 330.688, + "firstFrameMs": 12979.300000190735, + "postFrameStalls": 0, + "postFrameDroppedFrames": 0, + "acceptedPeerBytes": 225087782, + "acceptedLoadedMediaBytes": 1069507775, + "acceptedPeerShare": 0.2104592292468374, + "uploadedMediaBytes": 509931304, + "videoElementDimensions": { + "width": 3842, + "height": 2160 + }, + "allSixRuntimeAssetHashesVerified": true, + "stableSampledVideoSourceAndRoomEpoch": true, + "unknownOrHiddenIdentityRows": 0, + "sync": { + "sampleCount": 274, + "overlapCount": 91, + "maximumGapMs": 1225.5999994277954, + "full330Coverage": true, + "maximumAbsoluteDriftSeconds": 0.25812299999999944, + "syncQualified": true, + "unknownPlayerErrorRows": 0, + "cumulativePlayerErrorValues": [ + 1 + ], + "postframePlayerErrorIncrease": false + }, + "invalidSyncRows": { + "conflictingOverlapElapsedMs": 0, + "unknownDriftElapsedMs": 0, + "driftViolationElapsedMs": 0, + "nonFollowingOrRoomUnknownElapsedMs": 0, + "pausedOrUnknownElapsedMs": 0, + "underflowOrStallOrUnknownElapsedMs": 0, + "nonzeroOrUnknownDropElapsedMs": 0, + "nonVisibleOrUnknownElapsedMs": 0 + }, + "wrap": { + "beforeRaw": 266.617026, + "afterRaw": 268.620191, + "beforePhase": 266.56875600000006, + "afterPhase": 1.2652160000000094, + "advancing20sAfter": true, + "periodicSecondsAfterWrap": 68.134, + "stockCcValues": [ + 0, + 1 + ], + "stockCcAdvanced": true + }, + "firstRetainedPlayerErrorObservation": { + "elapsedMs": 6055, + "hasPresentedFrame": false, + "literal": { + "type": "networkError", + "detail": "aborted", + "fatal": false, + "mediaErrorCode": null, + "fragment": { + "sn": 0, + "cc": 0, + "type": "main" + } + }, + "actualErrorEventTime": "not captured; this is first report observation", + "millisecondsBeforeActualFrame": 6924.300000190735 + }, + "selectedIceEnums": [ + { + "kind": "direct", + "localCandidateType": "host", + "remoteCandidateType": "host", + "localRelayProtocol": null, + "remoteRelayProtocol": null + } + ], + "hashes": { + "result.json": "b1fa0ea8c83cd069c2e472608ef045589ba0e40e01ce1d7c811b9682e75f12e4", + "stock-report-midway.json": "bf31107add681dc4d1b10aeea503d50bd8adbbfb0a466a73c30ca8292d4ae803", + "stock-report-final.json": "106e13a4257c794540a5d9e50c8da7ed2bc94838e2741fcc151191be2a400709" + } + }, + { + "viewer": "M4B", + "observationSeconds": 330.839, + "firstFrameMs": 5030.400000572205, + "postFrameStalls": 0, + "postFrameDroppedFrames": 0, + "acceptedPeerBytes": 479604520, + "acceptedLoadedMediaBytes": 1058396292, + "acceptedPeerShare": 0.4531426684174362, + "uploadedMediaBytes": 285596943, + "videoElementDimensions": { + "width": 3842, + "height": 2160 + }, + "allSixRuntimeAssetHashesVerified": true, + "stableSampledVideoSourceAndRoomEpoch": true, + "unknownOrHiddenIdentityRows": 0, + "sync": { + "sampleCount": 273, + "overlapCount": 91, + "maximumGapMs": 1218.0, + "full330Coverage": true, + "maximumAbsoluteDriftSeconds": 0.24238900000000108, + "syncQualified": true, + "unknownPlayerErrorRows": 0, + "cumulativePlayerErrorValues": [ + 0 + ], + "postframePlayerErrorIncrease": false + }, + "invalidSyncRows": { + "conflictingOverlapElapsedMs": 0, + "unknownDriftElapsedMs": 0, + "driftViolationElapsedMs": 0, + "nonFollowingOrRoomUnknownElapsedMs": 0, + "pausedOrUnknownElapsedMs": 0, + "underflowOrStallOrUnknownElapsedMs": 0, + "nonzeroOrUnknownDropElapsedMs": 0, + "nonVisibleOrUnknownElapsedMs": 0 + }, + "wrap": { + "beforeRaw": 266.838195, + "afterRaw": 268.844421, + "beforePhase": 266.54651600000005, + "afterPhase": 1.2444710000000327, + "advancing20sAfter": true, + "periodicSecondsAfterWrap": 60.117, + "stockCcValues": [ + 0, + 1 + ], + "stockCcAdvanced": true + }, + "firstRetainedPlayerErrorObservation": null, + "selectedIceEnums": [ + { + "kind": "direct", + "localCandidateType": "host", + "remoteCandidateType": "host", + "localRelayProtocol": null, + "remoteRelayProtocol": null + } + ], + "hashes": { + "result.json": "8e3c9079c98a1a23687b35305cf1a700449d22c462153b11542b7254dee14579", + "stock-report-midway.json": "f726f8c146e10ead8db1cc4e580759c97db8b88ebebd8ca2daeb6cabfd6505df", + "stock-report-final.json": "4811dea82c8c25239300d2993beae81d503f938cb7e4dae45775ac5e20f4e026" + } + } + ], + "runtime": { + "nodeVersion": "v24.13.0", + "browserVersion": "155.0.8059.85", + "cpu": "Apple M4 Max", + "arch": "arm64" + }, + "rawEvidence": { + "summarySha256": "f820c2fda0c2361b8835a74ac8b6390e5f0a455a301cec89867b1bf04bd4528b", + "auditSha256": "430d0a319210bc51d68ce265782906eaeee6047f7bee18f9d3b70d37201baee2", + "manifestSha256": "41008082752cc4eb2ddc8575a9182818055551c0502ea20a94227506e7d2c011", + "filesHashVerified": 20, + "bytesHashVerified": 2596320 + }, + "cleanup": { + "ownedBrowserAndFixtureProcesses": 0, + "ownedProfilesRemoved": true, + "ownedPlainStageRemoved": true + }, + "limits": [ + "HTTP cache was disabled and profiles were fresh; a cold CDN or origin was not established.", + "Both viewers ran on the same M4. Physical iPhone, GrapheneOS, separate-network traversal and public TURN remain separate gates.", + "Startup took 12.979 seconds for A and 5.030 seconds for B; this is not an instant-start or comparator-speed claim.", + "A retained one nonfatal pre-frame networkError/aborted SN0/CC0/main observation. The error count stayed at one throughout post-frame playback; B stayed at zero.", + "The sampled DOM room epoch is not the staged test direct bound-SDK cohort witness.", + "One midway measurement export per viewer is included in all gates; this is not claimed to be uninteracted playback.", + "Accepted media includes buffered data. Peer and upload payload counters do not establish wire-byte savings, cost savings or competitor superiority.", + "Selected candidates were host/host. Transport protocol was not captured in this run.", + "This exercises recorded peer-assisted HLS, not KithMoot interactive camera/microphone delivery or eight-person meetings." + ] +} diff --git a/docs/media-showcase.md b/docs/media-showcase.md index 38f73f5..a96738e 100644 --- a/docs/media-showcase.md +++ b/docs/media-showcase.md @@ -442,6 +442,39 @@ request. The pinned RelaySwarm source `e910147` also rolls its bounded startup plan forward using verified future-load timing. Release still requires current verified coverage; the three-object, 24 MiB and eight-second limits are unchanged. +The [deployed public receipt](evidence/public-prepared-adoption-4k-20261026.json) +records two fresh, HTTP-cache-disabled Chrome profiles on one M4 Max using the +actual public CDN assets at site revision `6e7d20c`, without asset, controller, +RTC or endpoint overrides. Each played unmuted at 1x for more than 330 seconds +after its first frame. Both had **zero observed post-frame stalls and dropped +frames**, crossed the programme wrap without resetting raw media time, and +continued for at least 60 seconds afterwards. + +| Viewer | Accepted peer bytes | Share of loaded media | Uploaded media bytes | First frame | Maximum sampled room offset | +| --- | ---: | ---: | ---: | ---: | ---: | +| A | 225,087,782 | 21.05% | 509,931,304 | 12.979 s | 0.258 s | +| B (preselected receiver) | 479,604,520 | 45.31% | 285,596,943 | 5.030 s | 0.242 s | + +Both exceeded the predeclared receiver threshold of 10 MiB and 10% accepted +peer media. The percentages include buffered media and do not measure net +network or cost savings. Startup is measured above; it was not instantaneous. +A retained one nonfatal pre-frame `networkError/aborted` event for the old +fragment; its cumulative error count remained at one throughout playback. B +remained at zero. No new post-frame player error was observed. + +One normal report export around 150 seconds and a final export retained the +whole observation despite each report's 240-sample limit. Those interactions +remained in all measurements; no window was excluded. Exact overlapping sample +rows agreed. The merged reports contained 274 and 273 known sync observations, +with maximum gaps of 1.226 and 1.218 seconds. Single video, nonempty source URI +and room-epoch continuity were sampled; the epoch witness came from the DOM, +not directly from the SDK binding. + +This establishes that deployed same-M4 run. The CDN cache was not controlled. +The selected route was direct host-to-host; its transport protocol was not +captured. Physical-phone performance on this revision, independent networks, +public TURN and interactive eight-person calls remain separate gates. + The [room-adoption candidate receipt](evidence/prepared-adoption-staged-4k-20261026.json) records one 60-second run per viewer on the same M4 Max, with browser HTTP cache disabled and four candidate assets substituted. Both viewers had zero observed @@ -453,7 +486,8 @@ observation overlap was 57.408 seconds. All 306 fresh, eligible room comparisons matched, including 294 during that overlap. B retained one nonfatal pre-frame `aborted` event while its old loader stopped for room adoption. -This is staged evidence. It does not establish deployed 330-second continuity, +That candidate run is staged evidence. It does not itself establish deployed +330-second continuity, physical-phone performance, public TURN or net network savings. The recorded listening room exercises peer-assisted HLS; it does not qualify KithMoot's interactive camera/microphone path or eight-person meetings. diff --git a/site/llms.txt b/site/llms.txt index 12f08f0..98ae61d 100644 --- a/site/llms.txt +++ b/site/llms.txt @@ -7,7 +7,8 @@ - [Landing page](https://forgesworn.dev/): products you can run today, the creed, and the full repo catalogue grouped into eleven focus areas - [Ecosystem map](https://forgesworn.dev/map/ecosystem-map.svg): every project on one page, grouped by what it does (SVG; printable A4 PDF at https://forgesworn.dev/map/ecosystem-map-a4.pdf) - [Use cases](https://forgesworn.dev/use-cases.html): 32 end-to-end workflows, each naming the exact libraries it composes -- [4K listening room and comparison player](https://forgesworn.dev/media-lab.html): the complete licensed Deja Vu mix leads the homepage. Play & join starts or joins a shared listening clock and real RelaySwarm participation. For a new room, the first full-recording viewer prepares a bounded verified media reservoir locally before publishing the shared start time; preparation does not count as an active listener. A viewer still preparing a private start adopts a verified active room promptly, retires its empty old loader before the acknowledgement and preserves the original Play request; a failed acknowledgement restores an explicit retry. Existing rooms keep their advancing clocks and later listeners join live, the starter can leave while others continue, and the room expires after the last listener leaves a short grace period. Pause leaves; Play rejoins live. The recording loops while occupied; the 1080p excerpt has its own room. The live listener ticker includes joined listeners and excludes read-only page observers; Play/Pause events update it directly, with lease expiry for abrupt departures and unknown status during lost room observation. A confirmed empty room invites the first listener to start. One visible player per visitor, room participants distinct from locally connected peers, stable identity mapping through peerConnectionDetails(), proportional media-batch movement and rates, source-host feeds, explicitly self-reported remote links, separate loaded-source/verified-peer/upload counters and recent local peer contribution. Loaded source includes browser cache; playback details distinguish completed source response bodies from network and cache when timing coverage is available. Cache hits do not animate as fresh local network traffic; concealed timings remain unavailable. The browser integration pins RelaySwarm source e910147 (package version 0.4.4), including bounded rolling startup planning from verified future-load timing, with sustainable peer waits, range-sized WASM upload inputs and cached schema-3 mixed admission despite late whole-object estimates. Confirmed recorded main media requires a live same-key fetch lease before waiting for unavailable video; live and unknown playlists retain bounded seeding coordination. Sharing continues throughout active playback without an elapsed-time or cumulative-byte cutoff; upload rate, peers and cache remain bounded. Known pinned recordings use a client-generated bounded sliding live playlist with discontinuities across programme wraps and one visible player. The 267.32-second 4K programme preserves every original audio packet; a separately named, hash-pinned final fragment removes only 32 video frames after the soundtrack ends. The init and first 133 fragments remain byte-identical; the old immutable assets remain available. The next head can load before the tail ends; normal wraps do not end the element, reset its raw time or trigger replay priming. The bounded playlist retains 24 seconds of metadata behind the room clock so a slow initial response does not immediately eject the playhead; this does not enlarge the four-second media back buffer or encoded-media cache. A fixed per-session timeline origin maps raw media time to the shared clock; programme phase drives displayed time, telemetry and the musical pulse. Metadata preparation and peer creation remain after Play. Canonical manifest hashes and exact media URLs are checked, virtual global sequence/discontinuity values are signed against the unchanged piece catalogue, and a separate source/quality/epoch/manifest/duration cohort isolates this mode. Unsupported metadata and native HLS keep the ordinary VOD fallback; automatic clock corrections wait for sustained drift and stable, safely buffered playback, with the measured seek interruption added to the drift threshold, without changing music tempo. The responsive swarm picture keeps short labels and puts transfer rates and contribution statistics below it. A 16 KB score derived from the soundtrack drives a musical broadcast pulse against actual media time; pause, buffering, hidden pages and reduced motion stop it. This does not establish exact global audience counts or multi-speaker audio synchronisation. iPhone and iPad use the same peer-capable HLS path as other MediaSource-capable browsers; browser identity does not bypass sharing. The public Spry credential endpoint remains unconfigured pending an independently operated public endpoint. When configured, active playback requests and renews unique temporary TLS credentials from that independently operated instance, alongside STUN discovery. The supported public service uses its four-field credential contract and fresh one-hour leases, separately from KithMoot paired/private access. The final public instance endpoint remains operator configuration. This supplies a route for browsers that restrict direct UDP, including default Vanadium configurations. The bundle contains no relay password or operator root secret; availability diagnostics contain no credential. Pause cancels renewal. Issuer or route failure preserves HTTPS playback. Playback details can save or share a local JSON report with at most 240 one-second observations of actual frames, buffering, stalls and verified peer traffic, omitting network addresses, keys and credentials; no report is uploaded automatically. The HLS module prepares before Play without media requests or a player. The first tap attaches the selected media source and requests audible playback before awaiting room or peer setup; initial playback no longer waits for paused priming. This preserves request ordering but does not establish physical iPhone acceptance or stall-free startup. VOD fallback replay can still use a safely buffered current position while retaining buffered correction to the room. Reports retain raw media position/buffers and expose recording phase/duration separately; infinite continuous-media duration stays unavailable rather than being relabelled as the finite recording duration. Healthy network-stalled events with future data do not count as playback waits. Continuous-mode peer playback, cold-cache continuity and physical boundary acceptance remain verification gates. The earlier lab route passed public browser credential/CORS and hash-verified TLS data checks; that test route was retired. Fresh public-instance issuance, sustained cold-cache 4K, actual lease rotation during playback and physical iPhone acceptance remain separate gates. Positive peer waits require actual origin timing; a cold loader starts HTTP immediately while cached and late-HAVE peers retain their parallel race. Positive waits are bounded by the segment duration after measured origin recovery time; cached peer races start HTTP immediately and use an explicit peer-only Rust ranged planner with no internal HTTP source. The demo enables lateHaveRace: only native connections accepted at load entry can participate, after an actual exact-object HAVE arrives within the original 2.5-second window. HTTP continues immediately; one holder set is frozen and the deadline never extends. A verified calibration piece unlocks bounded pending work. Four-piece and 512 KiB request caps retain upload burst bounds for larger fragments. At the floor the peer arm cancels while its independent HTTP request continues. Normal buffered mixed transfers retain their HTTP ranges; older modules safely decline the unsupported mode. Range uploads copy the requested bytes across the WASM boundary, rather than the whole 4K object for every range. A separately packaged module Worker reuses the compiled Rust/WASM module for bounded piece scheduling and payload verification; HTTP continues during Worker startup or failure, and leaving the swarm terminates it. The bundle receipt pins the companion source and digest. This separates verification work from playback controls; measured device continuity and useful peer contribution remain acceptance checks. On native-HLS-capable browsers, repeated stalls can switch playback to native HLS; anonymous CORS is set before selecting the approved cross-origin media, peer resources close and native transfer totals are marked unavailable. Native recovery requests playback immediately and restores phase on metadata without a second Play; a later pause or policy rejection stays authoritative. Saved reports retain fixed HLS/native error codes, fallback reason and failed state without arbitrary messages or URLs. Terminal media failure restores Play again. A real Chrome recovery test decoded 333 native 4K frames with zero drops over 13 seconds after an intentional fatal Hls event; the transition interrupted playback for 3.827 seconds. This is recovery evidence, not sustained cold-cache or physical-phone acceptance. The Rust/WASM scheduler exchanges site-verified pieces of the unchanged 4K source, with HTTP completing the remainder, native controls, a Back to live action and shared-room invitation links. Integrity uses a site-pinned HTTPS digest catalogue with receiver-local commitment signing. Resource limits and reproduction: https://github.com/forgesworn/forgesworn.dev/blob/main/docs/media-showcase.md. The local runner compares native Sapflow and MediaMTX with the same H.264/AAC source and optionally real RelaySwarm delivery through Spry or coturn over UDP/TCP. Public process results are dated recordings; live origin CPU requires the local runner. Reproduction: https://github.com/forgesworn/forgesworn.dev/blob/main/docs/media-lab.md +- [4K listening room and comparison player](https://forgesworn.dev/media-lab.html): the complete licensed Deja Vu mix leads the homepage. Play & join starts or joins a shared listening clock and real RelaySwarm participation. For a new room, the first full-recording viewer prepares a bounded verified media reservoir locally before publishing the shared start time; preparation does not count as an active listener. A viewer still preparing a private start adopts a verified active room promptly, retires its empty old loader before the acknowledgement and preserves the original Play request; a failed acknowledgement restores an explicit retry. Existing rooms keep their advancing clocks and later listeners join live, the starter can leave while others continue, and the room expires after the last listener leaves a short grace period. Pause leaves; Play rejoins live. The recording loops while occupied; the 1080p excerpt has its own room. The live listener ticker includes joined listeners and excludes read-only page observers; Play/Pause events update it directly, with lease expiry for abrupt departures and unknown status during lost room observation. A confirmed empty room invites the first listener to start. One visible player per visitor, room participants distinct from locally connected peers, stable identity mapping through peerConnectionDetails(), proportional media-batch movement and rates, source-host feeds, explicitly self-reported remote links, separate loaded-source/verified-peer/upload counters and recent local peer contribution. Loaded source includes browser cache; playback details distinguish completed source response bodies from network and cache when timing coverage is available. Cache hits do not animate as fresh local network traffic; concealed timings remain unavailable. The browser integration pins RelaySwarm source e910147 (package version 0.4.4), including bounded rolling startup planning from verified future-load timing, with sustainable peer waits, range-sized WASM upload inputs and cached schema-3 mixed admission despite late whole-object estimates. Confirmed recorded main media requires a live same-key fetch lease before waiting for unavailable video; live and unknown playlists retain bounded seeding coordination. Sharing continues throughout active playback without an elapsed-time or cumulative-byte cutoff; upload rate, peers and cache remain bounded. Known pinned recordings use a client-generated bounded sliding live playlist with discontinuities across programme wraps and one visible player. The 267.32-second 4K programme preserves every original audio packet; a separately named, hash-pinned final fragment removes only 32 video frames after the soundtrack ends. The init and first 133 fragments remain byte-identical; the old immutable assets remain available. The next head can load before the tail ends; normal wraps do not end the element, reset its raw time or trigger replay priming. The bounded playlist retains 24 seconds of metadata behind the room clock so a slow initial response does not immediately eject the playhead; this does not enlarge the four-second media back buffer or encoded-media cache. A fixed per-session timeline origin maps raw media time to the shared clock; programme phase drives displayed time, telemetry and the musical pulse. Metadata preparation and peer creation remain after Play. Canonical manifest hashes and exact media URLs are checked, virtual global sequence/discontinuity values are signed against the unchanged piece catalogue, and a separate source/quality/epoch/manifest/duration cohort isolates this mode. Unsupported metadata and native HLS keep the ordinary VOD fallback; automatic clock corrections wait for sustained drift and stable, safely buffered playback, with the measured seek interruption added to the drift threshold, without changing music tempo. The responsive swarm picture keeps short labels and puts transfer rates and contribution statistics below it. A 16 KB score derived from the soundtrack drives a musical broadcast pulse against actual media time; pause, buffering, hidden pages and reduced motion stop it. This does not establish exact global audience counts or multi-speaker audio synchronisation. iPhone and iPad use the same peer-capable HLS path as other MediaSource-capable browsers; browser identity does not bypass sharing. The public Spry credential endpoint remains unconfigured pending an independently operated public endpoint. When configured, active playback requests and renews unique temporary TLS credentials from that independently operated instance, alongside STUN discovery. The supported public service uses its four-field credential contract and fresh one-hour leases, separately from KithMoot paired/private access. The final public instance endpoint remains operator configuration. This supplies a route for browsers that restrict direct UDP, including default Vanadium configurations. The bundle contains no relay password or operator root secret; availability diagnostics contain no credential. Pause cancels renewal. Issuer or route failure preserves HTTPS playback. Playback details can save or share a local JSON report with at most 240 one-second observations of actual frames, buffering, stalls and verified peer traffic, omitting network addresses, keys and credentials; no report is uploaded automatically. The HLS module prepares before Play without media requests or a player. The first tap attaches the selected media source and requests audible playback before awaiting room or peer setup; initial playback no longer waits for paused priming. This preserves request ordering but does not establish physical iPhone acceptance or stall-free startup. VOD fallback replay can still use a safely buffered current position while retaining buffered correction to the room. Reports retain raw media position/buffers and expose recording phase/duration separately; infinite continuous-media duration stays unavailable rather than being relabelled as the finite recording duration. Healthy network-stalled events with future data do not count as playback waits. The deployed 26 October 330-second same-M4 run used two fresh HTTP-cache-disabled Chrome profiles and the actual CDN assets, with no asset, controller or RTC overrides. Both had zero observed post-frame stalls/drops through the programme wrap and at least 60 seconds afterwards; accepted peer shares were 21.05% and 45.31%. First frames took 12.979 and 5.030 seconds. One midway report export per viewer remained in all measurements; A retained one nonfatal pre-frame aborted fragment event with no post-frame error increase. This is sampled same-host evidence, not physical-phone, independent-network, public TURN, wire-cost or eight-person-call acceptance. The earlier lab route passed public browser credential/CORS and hash-verified TLS data checks; that test route was retired. Fresh public-instance issuance, actual lease rotation during playback, independent-network cold-cache 4K and physical iPhone acceptance on the current revision remain separate gates. Positive peer waits require actual origin timing; a cold loader starts HTTP immediately while cached and late-HAVE peers retain their parallel race. Positive waits are bounded by the segment duration after measured origin recovery time; cached peer races start HTTP immediately and use an explicit peer-only Rust ranged planner with no internal HTTP source. The demo enables lateHaveRace: only native connections accepted at load entry can participate, after an actual exact-object HAVE arrives within the original 2.5-second window. HTTP continues immediately; one holder set is frozen and the deadline never extends. A verified calibration piece unlocks bounded pending work. Four-piece and 512 KiB request caps retain upload burst bounds for larger fragments. At the floor the peer arm cancels while its independent HTTP request continues. Normal buffered mixed transfers retain their HTTP ranges; older modules safely decline the unsupported mode. Range uploads copy the requested bytes across the WASM boundary, rather than the whole 4K object for every range. A separately packaged module Worker reuses the compiled Rust/WASM module for bounded piece scheduling and payload verification; HTTP continues during Worker startup or failure, and leaving the swarm terminates it. The bundle receipt pins the companion source and digest. This separates verification work from playback controls; measured device continuity and useful peer contribution remain acceptance checks. On native-HLS-capable browsers, repeated stalls can switch playback to native HLS; anonymous CORS is set before selecting the approved cross-origin media, peer resources close and native transfer totals are marked unavailable. Native recovery requests playback immediately and restores phase on metadata without a second Play; a later pause or policy rejection stays authoritative. Saved reports retain fixed HLS/native error codes, fallback reason and failed state without arbitrary messages or URLs. Terminal media failure restores Play again. A real Chrome recovery test decoded 333 native 4K frames with zero drops over 13 seconds after an intentional fatal Hls event; the transition interrupted playback for 3.827 seconds. This is recovery evidence, not sustained cold-cache or physical-phone acceptance. The Rust/WASM scheduler exchanges site-verified pieces of the unchanged 4K source, with HTTP completing the remainder, native controls, a Back to live action and shared-room invitation links. Integrity uses a site-pinned HTTPS digest catalogue with receiver-local commitment signing. Resource limits and reproduction: https://github.com/forgesworn/forgesworn.dev/blob/main/docs/media-showcase.md. The local runner compares native Sapflow and MediaMTX with the same H.264/AAC source and optionally real RelaySwarm delivery through Spry or coturn over UDP/TCP. Public process results are dated recordings; live origin CPU requires the local runner. Reproduction: https://github.com/forgesworn/forgesworn.dev/blob/main/docs/media-lab.md +- [Deployed 4K playback evidence](https://github.com/forgesworn/forgesworn.dev/blob/main/docs/evidence/public-prepared-adoption-4k-20261026.json): dated 26 October 2026; two fresh Chrome profiles on one M4 Max, actual public assets, 330 seconds each, zero observed post-frame stalls/drops, 21.05% / 45.31% accepted peer media. Startup took 12.979 / 5.030 seconds. Includes report-export interactions and one retained pre-frame abort; no physical-phone, public TURN, independent-network or competitor advantage claim. - [GitHub organisation](https://github.com/forgesworn): public source code - [402.pub](https://402.pub): live directory of Lightning-paid APIs