# Meet slice 2 — the record Branch `slice/2-room`, `77227de..` through the whole-branch fix wave. Spec: `docs/superpowers/specs/2026-09-07-meet-design.md`, revision 9 (§15 is this slice's departures from revision 8). Slice 2 built the room: the hub, `POST /signal`, the SSE stream, the holding screen, the browser client, and a Playwright gate that makes a real call between two real Chromium contexts. This file exists because everything below was, until now, written down only in `.superpowers/`, which is gitignored. The reasoning did not merge and did not survive the worktree. What follows is that ledger's substance: the decisions, why each one was taken, what the reviews found, and what is still open with the slice it belongs to. --- ## 1. Rulings and decisions Eleven of these changed what the spec says and are written into §15 of the spec itself, with their reasoning. They are listed here by name only, so this file stays the index and the spec stays the contract: §15.1 the hub session key · §15.2 the `Accept` gate and its 406 · §15.3 the `?probe=1` resume probe · §15.4 the scoped 410 · §15.5 `/signal`'s refusals before the limiter · §15.6 the narrowed room-page row · §15.7 the resume window enforced without waiting for the tick · §15.8 `leave` is not idempotent · §15.9 the stale-gen 409 carries no gen · §15.10 the four client-only terminal reasons · §15.12 the member's standing re-derived on every request (Codex round 1, §2a). The rest are implementation decisions the spec has no opinion about. **The hub** - A hub method that dereferences `h.rooms[sqid]` must nil-check the room and return `ErrUnknownPeer`. Cost if wrong: a nil-map panic on a bad sqid. - A second resume of an already-attached peer replaces the attachment, and the old stream is told `lost {reason: "replaced"}`. No tombstone is written, so the participation itself continues. Two tabs of one browser are the one-peer-per-session rule, working as intended. - `Kind` is written in exactly one place (`setKindLocked`) and `Admitted` in exactly one (`admitLocked`), because a kind change owes every admitted peer a fresh roster and a second writer would be a second place to forget it. - `StandingFor` is never called under the hub lock. Every caller drops the lock, reads, retakes it, and **re-finds** the participation, because it may have ended while the read was in flight. - An admitted guest is never ended by a grant expiring (ruling 14): the participation is the authority once someone is in. `standingLostLocked` is the one place that decides what a loss of standing costs, because what it costs depends on the kind held. - `Admit` settles the actor's authority completely — found, standing applied, admitted, member — before it looks at the target at all. The other order let any joined participation learn from the shape of the refusal whether a candidate peer id existed in the room. - Headstone rooms are never reaped and `h.rooms` is never deleted from. Any future reaper must wait out `TombstoneLife`; the note sits beside `End`. - `gap` is the highest evicted `seq` per sender above `last[from]` — a deviation from the Task 3 brief, which asked for a simpler test. **The signal endpoint** - The rate limiter is keyed on session + room, never on anything the request body claims, and the key is built before the body is read. Keyed on the claimed peer id, one session could drain another's bucket (peer ids are published in rosters) or evade its own by rotating ids. - `peer` is 32 lowercase hex or 400, and `type` is logged only from a fixed list. Attacker-chosen text never becomes a map key or a log argument. - Hub errors other than the four sentinels are logged and answered 500. `ErrNotYours` and `ErrUnknownPeer` share one byte-identical 404 body including the boot id. **The pages** - The removal confirm page checks fresh member standing *and* an admitted member participation (`hub.PeerNameFor`), and names the person, not the meeting. - After a removal the confirm tab goes to `/m/{sqid}/join` — inert, opens no stream — not back to the room. Both confirm pages' Cancel and back links go there too. - The takeover confirm page 303s to `/join` when this session holds nothing to take over, and re-checks standing before `hub.Takeover`. - Toggle buttons keep a fixed accessible name (`aria-label` Microphone / Camera) with `aria-pressed`, plus a child span carrying the state text — "On"/"Muted", "On"/"Off" — marked `aria-hidden`. Never colour alone, and never a label that changes under the person's cursor. - The three device pickers use `ui/field-select`. AGENTS.md's `[x]` Fields rule is hard: `devices.js` fills the vendored component rather than hand-rolling an equivalent. - Load-time `getUserMedia` on the holding screen stands, with a `visibilityState` guard and a `visibilitychange` retry: it is a page the person navigated to on purpose. **The client** - Every terminal state carries a way out: a link to `/m/{sqid}/join`. - A stream that dies moments after its `hello` has proved nothing: the backoff is cleared only by a stream that stayed open five seconds. - The stall ceiling is gated on time as well as count — eight stalls *and* sixty seconds since the last `hello` — so a room that is merely slow is not declared unreachable. - `terminal()` clears `admitted` and keeps `peer`: the peer id names what this tab held, which is worth having in a diagnosis, and nothing reconnects with it once `stopped` is set. **The gates** - The browser gate reports a client failure as `t.Skip` carrying the exact text, never by deleting or loosening a scenario. - The buffer-overrun scenario pins `SO_SNDBUF` through a custom listener: without it the gate depended on the machine's `tcp_wmem`. - The renewal scenario is production-shaped — a six-second TTL through the development-only `X-Meet-Test-TTL` header, with a floor of four — rather than lowering the client's `HEALTHY_STREAM`. --- ## 2. Whole-branch review findings, and what happened to them Whole-branch review at `cfc0dc0`: 53 files, 13,338 insertions, all three gates green, 48 mutations applied to a throwaway copy — 40 killed, 8 survived, every survivor a test gap rather than a bug. Verdict: merge with W-1 and W-2 fixed first. | # | Finding | Disposition | |---|---|---| | W-1 | The five guest-isolation audience filters (§4.3, ruling 9) are gated by nothing: each could be mutated away with the whole suite green, including two §13 names as slice-2 gates and one the browser `guest` scenario was written to catch | **Fixed in this wave.** Five hub tests, three callstest tests over HTTP, and a `guest` scenario with a second guest left knocking. Every mutation the reviewer lists is now killed. | | W-2 | The branch's whole record lives in a gitignored directory, and the spec was never revised past 8 | **Fixed in this wave.** Spec revision 9 (§15) carries the ten departures with their reasons; this file carries the rest. | | W-3 | Nothing proves the boot id changes across a restart | **Fixed in this wave.** The browser `restart` scenario compares `state().boot` before and after. | | W-4 | Dropping the subject from the hub session key is caught by nothing | **Fixed in this wave**, differently from the suggestion. The reviewer proposed signing out and in again over HTTP; that does not gate the claim, because re-signing-in changes the cookie value too and the key would move with or without the subject. The derivation is now a function of its own (`hubSessionKey`) with a test that changing the subject alone, the salt alone or the cookie alone each changes the key, and that the key is neither the cookie value nor a bare hash of it. | | W-5 | Two guards with no test: `Remove`'s self-target check, `hubStanding`'s ended-meeting early return | **Fixed in this wave.** The first has a test; the second is belt-and-braces behind callers that check `EndedAt` first, and its comment now says so. | | W-6 | `-race` cannot be run the way the repo is configured, on the first slice with real concurrency | **Fixed in this wave**, with a caveat: `make race` exists and AGENTS.md names it as the one exception to the cgo-free rule. The CI step is present but guarded — see §4. | | W-7 | `lost{buffer}` is sent for three endings that are not buffer overruns | **Carried — next fix wave.** See §3. | | W-8 | `TERMINAL.badlast` is unreachable | **Fixed in this wave.** `refused()`'s 400 arm and `TERMINAL.badlast` are gone, with a comment saying why they could not fire: both callers pass a probe response, the stream's only 400 is a `last` it could not parse, and neither probe form sends `last`. The attaching stream's 400 stays invisible to `EventSource` and ends as a stall, which is what already happened. The copy catalogue row is updated. | | W-9 | Three wordings for one move | **Carried — the copy pass.** Already in the tracked copy catalogue. | | W-10 | The test hook ships to production | **Recorded, not fixed.** See §3. | | W-11 | Three hub maps only ever grow | **Recorded, not fixed.** See §3. | | W-12 | The tick has no per-pass deadline and does serial database reads | **Fixed in this wave.** Each pass runs under a deadline of `tickEvery`, with a test that a read which never returns cannot stall the pass. | Mutation survivors the reviewer reported, and where each is killed now: | Predicate | Killed by | |---|---| | `rosterFor`'s member-only waiting queue | hub, callstest, browser | | `rosterFor`'s admitted-only mesh | hub, callstest | | `admitLocked`'s admitted-only `peer` fan-out | hub, callstest, browser | | `refreshRostersLocked`'s admitted-only refresh | hub | | `knock`'s admitted-members audience | hub, callstest, browser | --- ## 2a. Codex round 1, and what happened to it An independent review by Codex, judged at `cfc0dc0` and applied on top of the whole-branch fix wave (`67d0ead`). One P1, six P2s, two P3s; verdict: request changes. Every one is fixed. Line numbers in the original moved by a few lines between `cfc0dc0` and the wave that applied these. | # | Finding | Disposition | Commit | Test | |---|---|---|---|---| | S2-1 (P1) | A removed member keeps relay, reset and resume authority until the tick: `Relay`, `Reset`, `CanResume` and `Resume` check the participation and never re-derive standing, which contradicts §2.5's own paragraph | **Fixed.** The paragraph wins over the table row, and the row is corrected in spec §15.12. All four re-derive standing for a member-kind participation, outside the hub lock, re-find under it, and apply through `standingLostLocked` — so the admitted guest's ruling-14 exemption is untouched. The member is ended with `lost{standing}` and answered 404, byte-identical to an unknown peer's. `CanResume` answers without ending: a probe changes nothing (§15.3). | `3c8c6ac` | `TestAMemberWithNoStandingIsRefusedByTheNextRequestNotTheNextTick` (relay, reset, resume, probe, each before any tick, each checking the other stream sees `gone`) and `TestAnAdmittedGuestWithNoStandingKeepsRelayingResettingAndResuming` | | S2-2 (P2) | A participation past its resume window is refused a resume (§15.7) but still 409s the fresh stream that refusal sends the browser to, until the tick — a false "open in another tab" | **Fixed.** `Open` ends a lapsed participation under the lock and takes its place, on the tick's own terms (`lost` unobservable, departure announced); `LiveForSession` and `LiveKindForSession` no longer count one, so the holding screen's notice and the peerless probe agree with it. Probes stay non-mutating. | `3c8c6ac` | `TestAResumePastItsWindowIsRefusedAndAFreshStreamTakesItsPlace` (renamed from `...BeforeTheTickRemovesIt`) and `TestAFreshStreamAfterALapsedResumeSucceedsBeforeAnyTick` over HTTP | | S2-3 (P2) | `recoverFromNotFound` reads a signal 404 as this participation's ending, when it can equally mean the target left: the client closed a live call, then met 409 from its own participation and showed the takeover screen | **Fixed.** The sender's own participation is probed first: 204 keeps the call, drops that target's queue and resets only if the roster still lists it; 410 is terminal with the tombstone's reason; 404 is the fresh-entry ladder. | `5e8db6c` | browser `staletarget`: A's stream is cut, B leaves, A posts to B, A is answered 404 and stays in the call with its own peer id and no takeover screen, then reconciles from the roster | | S2-4 (P2) | `Sub.terminate`'s eviction receive can block on a channel the reader drained, with `h.mu` held — the hub's one lock, against every room in the process | **Fixed.** The receive is non-blocking and the final send is retried once; two attempts is the ceiling. | `3c8c6ac` | `TestTerminateNeverBlocksOnAChannelTheReaderDrained` — a reader draining concurrently, a per-round deadline, and run under `-race` | | S2-5 (P2) | `requestReset` discards the POST result, so a 429 or a 5xx loses the reset silently — and after an outbound deadline that reset is the only thing that can rebuild the pair | **Fixed.** Bounded retry inside the same thirty seconds, with `Retry-After`, the 429/5xx backoff, the signed-out arm and the 404 ladder. | `5e8db6c` | browser `resetretry`: every POST refused until the deadline fires, then the reset it asks for refused once with 429 — A asks again and the pair comes back | | S2-6 (P2) | The outbound queue's thirty seconds is not enforced across 429s or a hanging fetch, and sleeps are not bounded by it | **Fixed.** An absolute per-message deadline covering requests, backoff and 429s, with an `AbortController` on the fetch at the deadline. | `5e8db6c` | browser `senddeadline` (continuous 429s) and `sendhang` (a route that never settles) | | S2-7 (P2) | Perfect negotiation has no `isSettingRemoteAnswerPending`, so an offer arriving while an answer is being applied reads as glare and the impolite side discards it | **Fixed.** The W3C guard exactly, factored into `offerCollision(entry, signalingState)`. | `5e8db6c` | `test/browser/negotiation.test.mjs` lifts that function out of the shipped source and checks the truth table under `node --test`, wired into `make browser`; the `gap` and `replay` scenarios stay green | | S2-8 (P3) | `join` and the pump process a 200 before checking `signedOut`, so a followed redirect to sign-in reads as success | **Fixed.** `signedOut` is checked first in both. | `5e8db6c` | the browser `signedout` scenario gains a second phase: `/signal` answers 303 to `/signin`, fetch follows it into a 200 HTML page, and the room ends as signed out | | S2-9 (P3) | Two browser assertions pass vacuously: `playfallback` checks only that the button disappears, `devices` only that `srcObject` is truthy | **Fixed.** `playfallback` asserts the tile is paused before the gesture and that frames and the element's clock both advance after it — and the rig now emulates a blocking autoplay policy properly, pausing the element rather than only rejecting the promise, without which the assertion was true before the gesture too. `devices` asserts `videoWidth > 0` and a rising `currentTime`. | commit below | the two scenarios themselves | Every test above was run against the unfixed code and seen to fail: S2-1's four sub-cases with `memberStandingGone` stubbed to "not gone"; S2-2's with `lapsedLocked` disabled, and again with only `Open`'s use of it disabled; S2-4's a few thousand rounds in, with and without `-race`; S2-3, S2-5, S2-6 and S2-8's against `room.js` at `67d0ead`; S2-7's against the old one-line decision; `playfallback`'s against a Play handler that hides the control without calling `startPlaying` (the mutation Codex names), which the old assertion still passed; `devices`' against a preview handed a stream with its video track removed, which the old truthy-`srcObject` check also still passed. --- ## 2b. Codex round 2, and what happened to it The same reviewer, judged at `3eec748` — the round-1 wave — against spec revision 9. Six of the nine round-1 findings are closed. Three came back as new P2s because the fix was right and incomplete: a probe that still wrote, a recovery that recursed, and a recovery that acted on an answer that proved nothing. Two P3 test advisories. No new P1. | # | Finding | Disposition | Commit | Test | |---|---|---|---|---| | S2-10 (P2) | `memberStandingGone(..., end=false)` honoured the flag only when standing was *absent*; with standing present it wrote the kind, so a probe could demote a member to guest — and broadcast a fresh roster to the whole room while doing it | **Fixed.** A probe writes nothing whatever the answer is. The transition is real and is applied by the next mutating request, or by the tick. | `de597c6` | `TestAProbeNeverWritesAKindNorBroadcastsARoster`: a member taken off the team while holding a live grant, probed — kind unchanged and both subscribers silent — then one relay, which demotes and refreshes both rosters | | S2-11 (P2) | A signal 404 whose probe answered 204 asked for a reset to the stale target; that reset was answered 404 too, probed, and asked again — each round with a fresh thirty-second budget | **Fixed.** A target the hub has 404'd is marked stale: `send` drops for it, only the first round may ask for a reset, a reset's own target-404 never asks for another, one reset per target is in flight at a time, and the recovery's retries share the caller's budget. The roster clears the mark and `reconcile` rebuilds the connection if the peer is really there. | `dc614c9` | browser `staletarget` counts every POST A makes while its roster is stale and bounds it: 1 on the fixed client, **450** on the round-1 client | | S2-12 (P2) | A probe answering 429, 5xx or nothing fell through to the fresh-entry ladder — S2-3's failure, reached by another door | **Fixed.** Only the probe's own 404 enters afresh; a transient answer is retried on the stream backoff inside the shared budget, and a recovery that never gets an answer leaves the participation alone. | `dc614c9` | browser `staletarget` refuses the recovery's probe 503 before letting it through: A keeps its peer id and never sees the takeover screen | | S2-13 (P3) | `senddeadline` and `sendhang` accepted anything under sixty seconds, and `sendhang` never showed the request had hung or that the page aborted it | **Fixed.** Both measure from the first intercepted message and require 25–35 s. `sendhang` asserts the hung count and watches `requestfailed` for the cancellation. | commit below | the two scenarios: 30018 ms and 30238 ms on this machine, one cancelled request | | S2-14 (P3) | `TestTheTickDeadlineIsTheTickInterval` asserted a constant equalled itself | **Fixed.** The scheduling path is `tickLoop(ctx, every)` with the pass behind a seam that is nil in production; the test runs the real loop in milliseconds and records the deadline it hands out. | `de597c6` | `TestTheSchedulingPathGivesEachPassTheIntervalAsItsDeadline` | | Negotiation note | The six decision cases would stay green with the handler's flag assignment removed | **Fixed.** `negotiation.test.mjs` also drives `onAnswer` then `onOffer` through a fake connection whose `setRemoteDescription` can be held open. | `dc614c9` | the seventh case fails with the assignment removed | Every test above was run against the unfixed code and seen to fail: S2-10's with the kind write restored ("the probe wrote the kind: guest"); S2-14's with the loop passing three times its interval; S2-12's and S2-11's against `room.js` at `3eec748` — the first ended terminal with `peer: null`, and the second, with the 503 phase disabled so the cycle could run at all, reached 450 POSTs in thirteen seconds. The seventh negotiation case fails on "the answer handler must raise the flag before it awaits". The two round-2 client findings share one shape, and it is worth naming because it will come round again: **a refusal is evidence about exactly one thing.** A 404 from `/signal` is evidence about the target, not about us; a 503 from a probe is evidence about neither. Both bugs were a client treating an answer as if it settled more than it did. --- ## 2c. Codex round 3, and what happened to it Judged at `f1a0f9c`. S2-10, S2-13, S2-14 and the negotiation note are closed. S2-11 and S2-12 came back half-closed as one P2 — the shared budget was named in the commit message and not actually shared — and one P3 on a test predicate. No new P1. | # | Finding | Disposition | Commit | Test | |---|---|---|---|---| | S2-15 (P2) | The recovery's "one budget" was three: the pump passed no deadline (a fresh thirty seconds), a successful diagnosis asked for a reset with another, and `probe()` had no cancellation, so the deadline was checked only between attempts and a hanging probe held its target's pump or reset marked in flight indefinitely | **Fixed.** The message's deadline goes from the queue head through `recoverFromNotFound` and into any reset it initiates; `probe(path, deadline)` bounds the fetch **and** the body read with an `AbortController`; the remaining time is checked before every attempt; and a recovery that runs out marks the target stale and releases it, leaving the next roster to settle it. The resume and fresh-entry probes are bounded too — a hanging probe there would have ended this browser's reconnecting. | `6bd2f00` | browser `probehang`: the 404 is answered twenty seconds late and the probe that follows never answers. The target is let go at **30236 ms** from the first intercepted signal — a restarted clock lands near 50000 — and A stays in the call | | S2-16 (P3) | `staletarget` could call the recovery complete before the stream came back: `s.peers` is local `pcs` keys, and `staleTarget` closes that connection while the stream is still cut | **Fixed.** Reconciliation now requires a stream that actually reattached (the route's own attach counter) and a roster that actually arrived — `state()` gained a roster counter for it — before the final POST bound is checked. | commit below | the strengthened `staletarget`: attaches 1→2, rosters 1→2 | | Negotiation note | Case seven could not tell whose cleanup it watched, because `onOffer` clears the pending-answer flag too | **Fixed.** An eighth case drives an answer with no offer behind it. | `6bd2f00` | `the answer handler clears its own flag` | | `git diff --check` | A blank line at the end of the copy catalogue | **Fixed.** | commit below | `git diff --check` is clean | Verified failing first: `probehang` against `room.js` at `f1a0f9c` — the target was never let go, and the measurement read 70056 ms at the scenario's own ceiling; the strengthened `staletarget` predicate with the stream deliberately left cut — attaches 1→1, rosters 1→1, never true, where the round-2 predicate was satisfied the moment `staleTarget` closed the connection locally; the eighth negotiation case fails with the answer handler's flag assignment removed. Also recorded from this round, not changed: the targeted-404 assumption behind `stale` is exact for the path the client actually walks — an admitted sender addressing a previously admitted, different peer — and the reviewer confirmed the server's other 404s (unadmitted sender, unadmitted target, self-target) are not reachable from it. A stale generation is a 409, not a 404. Slice 3's `/ice` and slice 4's chat should re-check that list before reusing `stale`. --- ## 2d. Codex round 4, and what happened to it Judged at `2f7f63f`. S2-16 closed. S2-15 half-closed through one P2, and it is the same lesson a third time: the budget was threaded correctly and then leaked out of the one exit nobody was watching. | # | Finding | Disposition | Commit | Test | |---|---|---|---|---| | S2-17 (P2) | An aborted probe or a transient refusal that exhausted `waitWithin` returned from `recoverFromNotFound` without releasing the target. The queue survived, the pump's `finally` restarted it, its expired head called `unreachable`, and that opened a reset with a fresh thirty seconds — measured at 31000 for the offer and 61000 for the reset, with zero stale-target calls. Separately `resetLoop` checked the participation before every attempt but never the clock, so one POST could go out past the deadline meant to cover it | **Fixed.** Both loops round back to a single check at the top, which is now the only place a spent budget is answered, and it answers by releasing the target — queue dropped before the pump is released, connection closed, mark set, next roster settles it. `resetLoop` gained the same check. `createPC` clears the mark, because building a connection to a peer means the server has just named it. | `50953f4` | a pure node test — the recovery lifted out of the shipped source, given fifty milliseconds and a probe that never answers, must release its target once and ask for nothing — and `probehang`, which now asserts the offer was the *only* thing A posted, that it is still the only thing ten seconds later, and that A holds the target marked stale | Verified failing first: the node test with the exhaustion `return` restored — "the target must be released exactly once"; `probehang` against `room.js` at `2f7f63f` — **2** POSTs where the fixed client makes 1, and no stale mark at all. The second POST is the fingerprint of the finding: it is the reset that ran on a fresh thirty seconds while the scenario's earlier assertions were all passing. `state()` gained the stale set for this, which is the third thing the gate has needed the client to say about itself (`boot`, `rosters`, `stale`). Each is a fact no DOM shows and no HTTP answer reveals: a client that has *stopped* asking for something looks exactly like one that never had to. --- ## 3. Carried items, and where they go **Next fix wave** - **W-7, `lost{buffer}` for three endings that are not buffer overruns** (`admission.go`'s `Leave`, `hub.go`'s unjoined timeout and lapsed resume window). `buffer` is the one reason the wire contract defines as *not* terminal — "followed by a resume". Today this is harmless because `room.js` sets `stopped` and closes the stream before the event can be read, but the safety lives entirely in the client, and §8's drive surface will have other callers. A peer whose join keeps failing can loop: unjoined timeout → `lost{buffer}` → resume → 404 same boot → fresh stream → join → thirty seconds → repeat, and the stall counter never fires because each round gets a `hello`. **Not fixed here because either fix changes the wire contract** — a new terminal reason, or an ending that sends no event at all — and this wave took no wire-contract changes. Fix it with the client change in the same commit, and re-run the browser gate. - **W-10, the test hook in the release binary.** `window.meet.state()` is defined unconditionally and `TestHandle` compiles into the release build (unreachable without `NewForTest`, which `main` never calls). Neither exposes anything secret, and the CSP keeps third-party script off the page. Confining either one costs more than it buys today: build-tagging `TestHandle` means `make ci` grows a `-tags` argument, and gating `window.meet` on the environment means the browser gate tests a page production does not serve. - **W-11, three hub maps that only grow.** `h.rooms` is never deleted from (declared; `End`'s comment explains why a reaper is dangerous). `h.bySession[sqid]` keeps an empty inner map per room forever, and `h.byPerson` a zero entry per person forever. All three are bounded by real meetings and real people — an outsider cannot mint a room id that reaches `Open`, because standing is checked first — so this is a slow leak on a long-lived process, not an attack surface. It is also invisible while every deploy empties the hub (§4). Fix it with, or after, whatever ends that. - **A just-added member gets 404 from the removal confirm page until the next tick.** Recorded in spec §15.11. - **Watch: the limiter now sits behind a gate that takes the hub lock.** Revisit if hub-lock hold time grows. Recorded in spec §15.5. **The copy pass** - W-9's three wordings for one move: "Use this tab instead" (holding notice and `room.js`'s `wayOut`), "Use this tab" (takeover confirm submit), and "This meeting is already open in another tab" versus "This meeting is open in another tab." - The holding notice's "already open in another tab" is untrue during the resume window; "You are already in this meeting from this browser." is the candidate. - "Remove `` from the call?" reads oddly for a guest who is not in the call yet. All three are in `docs/superpowers/copy/2026-09-10-slice-2-strings.md`. **Slice 3 — relay and `/ice`** - `createPC` passes `{ iceServers: [] }` (`room.js`), with the floor notice keyed on `cfg.RelayConfigured`. Those are the two places to change. - `GET /m/{sqid}/ice` is §2.5's "participation, admitted" row — the same authority as a non-`join` signal. `hub.Find` plus `p.Admitted` is the whole check; do not consult standing (ruling 14). - Renewal (§5.3) needs a timer that survives a resume. The browser gate already has a `renewal` scenario for the *stream* TTL using the development-only `X-Meet-Test-TTL` header; copy that shape for the credential rather than inventing a second one. - ICE restart already has a client path: `restartIce()` with `requestReset` as the fallback, and the `replay` scenario asserts `have-local-offer` to prove it fires. - W-12 is now bounded, but `/ice` adds a per-request credential mint on a path that already does a database read. Watch the tick's deadline. **Slice 4 — chat and screen share** - `chat` and `share` are already named in `messages.go` and refused with 400 in `signal.go`. Removing that arm and adding the fan-out is the whole server change; `broadcastLocked(r, m, admittedPeers)` is the audience. - §4.4's 2 KB chat cap has no code yet. It must be checked against the decoded text, not the body, and it must not read the text for anything else — the captured-log test extends to *accepted* chat in slice 4, which is the first time an accepted message has content worth protecting. - W-1 is fixed, so chat's "arrives at the admitted context and not at a waiting one" is now two lines: extend `internal/calls/hub/isolation_test.go` and `internal/callstest/isolation_test.go`, which exist for exactly this. - Screen share adds a second video track per peer. `tile()` keys on peer id and `renderTiles` rebuilds from `pcs`, so the tile model needs a track dimension **before** the share arrives, not after. --- ## 4. Deploying this slice **Every deploy drops every live call.** The hub is per process and dies with it. This is spec'd (§4.2, §4.5) and not solved: slice 2 is the first release where it has a user-visible cost. What a deploy does to people who are in a meeting: - every browser's resume is refused with a 404 carrying the new boot id; - each one closes every peer connection, then joins afresh; - **members** re-enter at once and negotiate again — a few seconds of black tiles; - **guests go back to waiting** and must be admitted again by a member. So: **deploy outside meeting hours** until slice 3, or until a drain exists. There is no partial mitigation worth the words — the participants are in memory, and the memory goes. Nothing else about a deploy is unusual. Migrations apply at boot, once each; `GET /healthz` and `GET /api/version` are answered by the framework outside app middleware. --- ## 5. The gates, and how to run them | Gate | Command | Notes | |---|---|---| | The one gate | `CGO_ENABLED=0 make ci` | vet, gofmt, tests, migration check. Cgo-free, as AGENTS.md requires. | | Race | `CGO_ENABLED=1 go test -race ./internal/...`, or `make race` | **Needs `CGO_ENABLED=1`**: `-race` requires cgo, and the repo is cgo-free everywhere else. This builds a test binary, never a release, which is why it is the one exception. | | Browser | `make browser` | ~300 s, 23 scenarios, plus one node test (`test/browser/negotiation.test.mjs`, §5.1's glare decision and the handler race it turns on, no browser needed). Needs node, a network fetch of Playwright and Chromium, and **UDP** — inside the Claude Code bash sandbox Chromium gathers zero ICE candidates and every call fails with frames stuck at 0, so **run this target with the sandbox off**. | `make browser` is deliberately not part of `make ci`: the one gate the team runs on every push must not depend on a toolchain the app itself does not use. Run it before every review that touches a page or the client. Nothing enforces that, which is a known weakness and the reason this row is here rather than in a comment. **It is not perfectly stable.** One run in this fix wave had `rosterpair` hang for 120 s and fail, on a tree where it passes in 4.5 s alone and passed 18/18 on the run before and the run after. That scenario cuts a stream mid-call and waits for a resume, so it has the most timing in it of any of them. A single red `rosterpair` is worth re-running before it is worth debugging; two in a row is not. **The race step in CI.** `.amadan/ci.d/50-race` runs `make race` when the runner has a C compiler and prints a skip line when it does not. The guard is there because the cloud runner's provisioning (`amadan/docs/ci-cloud-runner.md`) installs the Go toolchain and Node and never names a C compiler, and a step that fails on every push would be worse than no step. **When somebody confirms `cc` on the runner, delete the guard** — a race gate that can silently skip is half a gate.