oficina / meet Public

room.js: codex round 1 - renewal bound to the credential it renews

S3-1: expireUnrenewed exempted any connection whose `renewed` flag was
true, and nothing ever cleared it. One successful renewal exempted a
connection from every later deadline, so a second credential could
expire in silence. The watchdog reads entry.listAt instead — the stamp
of the list a connection is actually on, which moves only on proof.

S3-2: retryRenewal fetched for the whole call, renewed only its own
tile, and reset the shared timers on the way past, leaving every other
connection on a credential about to die. renewOutdated hands a list
that has just arrived to every connection still on an older one, and
both the scheduled renewal and a tile's Retry go through it.

S3-3: with no baseline fragment — including after a rejected getStats —
any succeeded selected pair counted as proof, and '' passed a !== null
check, so a connection could be stamped onto a credential it had never
gathered on. No baseline is no proof now, and '' is not evidence: the
poller takes its own baseline from the first reading after the restart
and then requires a different one, or stays unproven.

S3-4: a successful fetch followed by one failed restart near the old
deadline reported the credential expired, after one attempt of three,
with the replacement in hand. renewOne has no deadline: a fresh
credential buys all three restarts and the verdict is stuck. Expired
belongs to the watchdog, the only place that knows the other case.

S3-5: the gate asserted the client's own cached list length, which
would read the same with iceServers: [] in every constructor. The
connection trap now records every configuration installed — count,
credentialed count and an FNV-1a digest, never a credential — and the
scenarios assert a real connection received the two-entry list, that
none was left on the empty one, and that the renewal installed a
different credential. §13's successful-fetch/failed-restart ending gets
its own scenario, icestuck: three attempts, stuck, not expired.

S3-6: a recording slog.Handler replaces the substring search — exactly
one INFO record with exactly one attribute. S3-7: one test exhausts the
bucket through POST /signal and then asks /ice; another sends an
oversized room id and asserts the log names it invalid and that no
bucket was minted.

W3-7: per-peer candidate counts (gathered, posted, received, added,
pending) in state() and diagnose(). W3-12: a margin under a second is
declined rather than scheduled, so a development TTL cannot turn the
client into a 1 Hz loop against its own server; state().ice.schedulable
says so.

And the residual flake is settled, by the counters, in three losing
runs: one browser gathers no ICE candidate at all and never leaves
`gathering`, while the other gathers, posts every one, and adds every
one it receives. There is nothing left for the client to do on either
side. It is the environment symptom the Makefile already documents,
reaching one Chromium context at a time, and it correlates with load —
every losing run took 560-590s against a healthy 318-420s.

63 node tests, each new one verified failing against the unfixed
source. make browser twice: 26 of 27 with staletarget lost to the
flake, then 27/27 in 417.65s.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CzvnuKhLzudvq7jZ7SvVt2