Presentation delivery

Document: SPEC-024. Revision: 1.1. Date: 2026-10-25. Lifecycle: Approved under D-167; adaptation stability requested under D-168. Supersedes: the scoped timing, managed-provider and screen engineering clauses identified below; native microphone and cryptographic guarantees retain their stated scope.

Authority and delivery scope

The human approved all VDR-01–VDR-10 recommendations in the requirements audit, requested specification amendments and a client update before SFU evaluation. This specification distinguishes the pre-SFU native client increment from the managed presentation profile, which is selected for later evaluation and remains unimplemented until provider integration and its final protocol are validated. Approval is not a claim of achieved performance or provider compatibility.

SPEC-023 continues to own capture choices, content/quality intent, policy defaults, admin exceptions and local ducking. SPEC-005 owns client behavior; SPEC-008 owns authoritative permissions/provider operations; SPEC-003/016 own identity/key lifetimes. This successor implements R-032 and refines R-118/R-120/R-043 only within its explicit scope. Webcam and meeting lip sync are unchanged.

Two media timelines — VDR-01/03

Microphone conversation retains its own responsive playout. Presentation video and its optional game/application sound share an independent monotonic timeline. Authenticate source media timestamps as before, but receiver microphone playout is observation/ducking information, not the presentation clock master. Never pause a current decodable video solely because speech arrives first; never delay microphone playback to wait for a screen.

Presentation-sound/video skew has a clean-fixture p95 target of at most 80 ms. Presentation capture-to-display latency has a clean-fixture p95 target of at most 500 ms. These are measurable objectives, not universal network guarantees or unconditional per-frame discard thresholds. Track pauses and dropped frames separately. In particular the old 150 ms microphone-relative moving-frame rejection and universal 200 ms presentation residence are superseded. Native microphone residence remains capped at 200 ms under SPEC-004. Native presentation sound retains at most fifty 20 ms packets (one second), rejects schedules more than one second ahead or more than 20 ms late, and expires queued sound after one second; per-source authority/mute still clears output independently.

For the native increment, anchor the arrival-based presentation clock at 120 ms. Presentation sound may establish the output mapping without cumulatively feeding quantization/output latency back into the clock. A later video arrival must not continually move an active presentation-sound clock. While sound is absent, faster paths may reduce delay and sustained later arrivals may reanchor it; resetting a stale clock after five seconds is permitted. Microphone speech, PTT gaps and ordinary microphone timing cannot shift this mapping. Local audio mute/remove/authority expiry remain immediate at the final worklet gate.

Retain the last good authorized image during ordinary delivery recovery. Source/authority loss, Stop watching and call/account change clear it. A held image is labelled as held and never counted as new video. The existing “paused to keep voice responsive” message is inappropriate for a presentation delay unrelated to voice starvation.

Native delivery improvements before SFU

The native adapter keeps screen-media/1, its signed encrypted fragments, replay checks, original three-second media leases/four-second revocation bound and native hard rate policing. No native permission lifetime changes merely because this document introduces a managed profile.

Fixed client engineering bounds for this increment:

Presentation reassembly/completed-video residence: at most 1,000 ms, preserving four partial frames, twelve completed frames, the 2 MiB encoded queue and existing 192 MiB decoded-output bound. Missing-frame reorder allowance is 120 ms, without extension from later packets. These bounds permit bounded repair; they are not a target of one second added delay.
Encoded output/send queue expires after 500 ms. Drop stale encoded dependencies and recover with a keyframe; decode callbacks from replaced decoders cannot restore state. Discard pictures more than 500 ms late relative to the presentation clock, permit at most 8 ms early rendering, and never reject solely for microphone speech skew.
Reserve the entire frame's bounded queue memory before enqueuing, then meter and pace individual chunks through the existing per-rendition token bucket. A keyframe need not fit the bucket's entire burst capacity at once. Sound may bypass queued video waiting for tokens, but shares its rate budget. Expired fragments invalidate that rendition's dependent output. A budget check that defers a packet must not consume tokens unless it is actually sent.
A verified live direct screen route remains selected during transient microphone/video send backpressure. Queue pressure defers sending within the existing bounded deadline; it cannot repeatedly switch rendition routes or recreate encoders. Voice keeps send priority, screen buffers stay capped and stale/closed/unauthorized peer paths remain ineligible.
Native relay screen backpressure remains bounded. Any nonzero microphone buffered byte count alone must not cause unconditional screen discard. Reserve bounded video work and validate voice residence under concurrent sharing; voice priority is an outcome, not an instruction to starve video.
Allocate the native encoder approximately 80% of the remaining selected budget after the existing sound reservation, accounting for measured serialized framing. Further adaptation never raises the selected ceiling. This replaces the fixed 65% target; the native relay still independently accounts bytes.
Capture cadence preserves fractional timer phase; a 16 ms timer cannot silently round every 15 fps interval up to five ticks. After a stall, encode only the newest source frame rather than a catch-up backlog.
D-168 supersedes the five-second quality recovery rule: require 30 seconds of successful progress without sustained overload before trying one higher quality level. Successful sender encode/enqueue or receiver display must continue, with no gap over 1,500 ms; an idle stream or absent feedback is not evidence of spare capacity. A failed increase within a 15-second probation restores the prior level after three pressure observations, including before the normal one-second reduction interval. Double the next recovery wait on each failed trial (60, 120, then at most 240 seconds), retaining that learned wait for this share/viewer lifetime. This retains a conservative operating point without claiming a measured available-bandwidth estimate. Each route and viewer remains independent; a new share/watch resets the history. Sender and receiver stability windows run concurrently: current receiver demand blocks an increase but does not reset the sender's otherwise successful-progress window on every refresh.
Count pressure at most once per 100 ms, require three observations with no gap over 1,500 ms and lower at most once per second outside failed-trial rollback. A fragment burst or several late frames in one tick cannot count as separate observations. Only a qualified sequence of three observations resets the recovery stability window; occasional isolated hiccups cannot hold quality down indefinitely. Keep existing levels 0–6 and spatial/cadence/bitrate factors from SPEC-023; no rate ceiling increases.
Trusted current shared receiver demand is a minimum adaptation level. Combine it using the least pressured current target so one slow viewer cannot force further reductions on healthy viewers. When demand decreases, a healthy viewer joins or feedback expires, retain the prior workload until the same successful-progress recovery window allows one level upward; do not jump to full quality. Local sender pressure can still reduce work further. Preserve per-recipient keyframe requests. Managed RTP later supplies per-viewer layers.
Label a retained picture as held after 750 ms without a new picture, rather than 250 ms (shorter than one picture interval at the minimum 3 fps). Keyframe-wait and permission states retain their accurate specific status; ordinary recovery never clears the last authorized image.
A bounded five-second native periodic keyframe is a compatibility/recovery fallback, plus explicit feedback/start/encoder-change recovery. The managed profile has no mandated periodic one-second cadence. Do not suppress a required recovery keyframe after a key/codec/context change.

The native profile still has common codec/rendition constraints and no retransmission protocol. These remaining limitations are accurately disclosed until the managed adapter replaces that path. Retiring all native mechanism requirements does not authorize inventing an incompatible intermediate wire format.

Presentation sender readiness requires its own active offer/secret and the specific receiver's active acknowledged key context, not every other receiver's acknowledgment. Unready receivers wait. Microphone fan-out keeps its existing barrier in this increment. Encrypted screen frames still use the current room revision, key lifetime, signature and replay context; no stale epoch can be used to avoid a pause.

Managed RTP profile — VDR-02/04/05/07/08/09/10

The managed profile uses standard WebRTC audio/video tracks through a provider adapter; permit useful retransmission, congestion feedback, pacing and codec recovery. Do not copy the native fragmentation, mandatory zero-retry delivery, tiny buffer constants, adaptation formulas or fixed keyframe cadence into RTP. Negotiate codec/profile/level against actual resolution, cadence and exact endpoint capabilities. Hardware preferences and support probes are not proof of GPU use. Add optional VP9/AV1 only after measured interoperability; no mandatory software AV1 fallback or universal GPU guarantee.

Presentation sound uses native adaptive buffering with final local mute/gain/ducking controls. Application-owned memory/work remains bounded; opaque browser buffers are evaluated by actual latency/continuity rather than an unprovable hard internal residence cap. Microphone migration is a later scope change, with its own timing review.

Authentication, revocation and movement

Retain authenticated admission and every publish/subscribe/change operation, approved devices, immutable room encryption mode, source consent, sender authenticity and replay rejection. Device/permission removal denies new operations immediately and stops conforming local publication/playback. Encrypted membership removal excludes the removed device from replacement keys.

Conforming managed clients use a purpose-bound host-issued authority window of at most 30,000 ms, refreshing every 5,000 ms. Anchor remaining validity at request start; transport time consumes the window. A response can shorten existing validity; duplicate/retried issuance must not manufacture a later deadline. Bound issuance by remaining identity/delegation/key validity. Cached state alone never renews authority. The 30-second window does not extend native voice grants. Final provider integration must complete the exact versioned grant schema before advertising the capability.

Known revocation stops local presentation immediately. On lost refresh/control, conforming clients stop by their already-issued deadline. A transient transport failure within valid authority may reconnect the same still-live consented source; it cannot select a new source or resume after Stop, source loss, explicit revocation or required suspend/lock cleanup.

Backend operations close affected provider tracks, inspect individual results and retry/reconcile ambiguous outcomes. Preserve pending/effective/failed/superseded enforcement states. Provider closure confirmation differs from endpoint silence. There is no universal provider-enforced forwarding cutoff during a control/provider partition. A modified endpoint may continue until the provider closes its tracks; local expiry and rekeying are not evidence of traffic cessation. This explicitly supersedes native hard-partition enforcement equivalence for managed presentation only.

A conflicting cross-host/device presentation move requires confirmed old-provider closure. During an outage the move remains pending, rather than assuming that the native four-second fence terminates managed media. Microphone/native movement retains its current contract. Provider resources belong to exact authority/call/device/publication/role IDs and must be cleaned up after cancellation, late completion or authority change.

Rate and placement guarantees

SPEC-023's admin roles, 4 Mbps client initial preference, 8 Mbps normal server rate and approved exceptions remain. Managed rates are aggregate encoder/layer targets with sound and recovery overhead accounted separately; providers may offer additional enforcement. Without verified provider policing, these are cooperative-client targets rather than hard limits against malicious publishers or invoice caps. Publish the adapter's actual enforcement capability. Retain a compatible native/enforcing adapter for operators requiring independent hard policing.

Use provider-supported admission/usage controls and trusted rate observations for suspension where available. Client-reported measurements are explicitly labelled as such. Exact trusted telemetry, measurement window, allowed transient burst and exceedance response are integration prerequisites, not invented provider capabilities; keep production managed admission disabled until documented. A normal keyframe may exceed instantaneous average bitrate without being malformed. Sum all uploaded layers within a presenter's budget, and count egress copies separately.

Allow provider-managed global media routing. Apply D-216 placement selection where component placement controls exist; preserve existing EU application control/storage until a migration is specified. This does not claim EU-only SFU traffic or hide routing metadata exposure. SFU is always relayed, without P2P bitrate exemptions. Microphone P2P choice is independent. Simultaneous high-rate direct/capped relay presentation renditions may wait until managed delivery is stable.

Provider lifecycle uses bounded owned-resource cleanup and supported renewals/reconnect. The native Container's 60-minute test generation/manual rejoin rule is not imposed on managed resources. No silent duplicate publishing, overlapping calls or capture widening is permitted.

Keys and receiver isolation

Keep mandatory E2EE in private/direct communication and selected encrypted rooms, five-minute key expiry and cryptographic sender authenticity. Protect encoded frames using a separately specified reviewed scheme; per-fragment canonical JSON and Ed25519 are native mechanisms, not a managed wire requirement. SFrame alone does not establish sender authenticity against another key-holding participant. Validate the full scheme before encrypted managed admission; unsupported endpoints fail clearly without plaintext fallback.

Separate cosmetic state revisions, media authorization and cryptographic recipient epochs in the managed protocol. Effective recipient/security changes, rather than unrelated display edits, trigger rekeying. Stage joins without disclosing pre-join content. Removals prohibit old-context overlap. Gate unready listeners individually and coordinate appropriate keyframes after epoch activation. Sender/uplink pressure may reduce all output; a slow receiver chooses a lower layer or pauses its own subscription. Layers share the selected budget and measured encoding capacity.

Configuration

SPEC-023 remains the canonical owner of persisted sharing policy/preferences; no defaults or role rules are duplicated here. No new end-user setting is introduced in the pre-SFU increment. The native timing/queue/allocation/keyframe constants above are fixed versioned engineering rules applied on client reload, with no persistence or operator bypass. Existing native lease, rate, crypto and capture settings retain their owners.

Managed 30,000 ms authority validity and 5,000 ms refresh are fixed profile bounds, not user overrides. Latency and skew numbers are test objectives. Provider App ID/secret, enablement and exact trial allowlists remain deployment-owned under SPEC-008; omitted enablement is false and missing required credentials fail validation. The previously proposed ten-run, 600-second synthetic harness envelope is approved for the later SFU evaluation; no provider resources are provisioned by the native increment.

Before managed implementation, complete grant/capability spelling, trusted measurement/exceedance rules, cryptographic wire format and durable provider operation reconciliation. Unsupported capabilities remain unavailable, not permissive fallbacks. These deferred protocol prerequisites do not block the specified native client increment.

Testing

Unit coverage verifies microphone observations cannot move the presentation clock; audio output does not accumulate device delay; stale/faster/slower route recovery; packet pacing without consuming failed-send tokens; large frames spanning several burst windows; bounds/expiry and stale dependency recovery; receiver-specific key readiness without weakening revocation; adaptation isolation/recovery and ceiling preservation; pressure-burst deduplication, successful-progress gating, rapid failed-trial rollback, bounded exponential retry windows, feedback-expiry hysteresis and conservative long-running capacity fixtures; stable screen routing under transient voice/video buffers while preserving microphone send priority, buffer caps and actual path/authority loss.

Browser/native integration renders real signed encrypted video with paired sound, voice continuing on its independent clock, held-picture/Stop/authority cleanup, large keyframe pacing, reordered/lost fragments and fresh recovery in Chromium/Firefox. Run the unchanged native lease/revocation/crypto cases. Measure native relay voice/video coexistence rather than equating any buffered voice byte with overload. Physical KDE/Windows/GPU evidence remains separate from software fixtures.

Managed tests later cover standard media tracks, exact transform interoperability/sender authenticity, per-viewer layers, global routing disclosure, provider close races/control partition, trusted/cooperative rate distinctions, conflicting moves and no old-source revival. Use the approved trial envelope and record cadence, corruption, latency, presentation-sound skew, microphone alignment, frozen time, CPU/memory and route bytes separately. Missing/frozen frames cannot improve reported performance by being omitted.

Acceptance criteria

Microphone speech can lead a coherent presentation without causing video to pause solely for that skew, and sharing does not enlarge microphone playout buffering.
Presentation video/sound target clean-fixture p95 skew at most 80 ms and capture-to-display latency at most 500 ms; observed failures and pauses are reported separately from transport correctness.
A native keyframe larger than the 250 ms bucket capacity can be paced under the selected sustained budget within bounded memory/residence, without bypassing the native relay's meter.
A receiver missing key acknowledgment cannot stop an independently ready receiver; removed/revoked recipients and expired keys remain excluded.
A single slow receiver cannot force further shared-rendition reductions with a healthy viewer present; decreased demand recovers gradually within selected ceilings. Three pressure observations after a failed upward trial restore the prior level, and repeated failures lengthen the retry wait to at most four minutes. Idle periods and feedback expiry cannot manufacture immediate recovery.
Stop watching remains locally responsive, clears picture/audio, and late callbacks cannot reopen it; ordinary delivery recovery retains a labelled last good authorized frame.
Native relay/microphone admission, hard rate enforcement, key retirement and three/four-second authority contracts still pass their original tests.
Managed deployment cannot claim the native hard partition cutoff or malicious-client bitrate policing without independent proof; global media routing and pending provider closure are disclosed accurately.
A conflicting managed call/device move remains pending until old-provider closure is confirmed; cached authority or a native fence cannot manufacture completion.
Native pre-SFU results, managed integration delivery, synthetic fixtures and physical platform performance are reported distinctly. No successful unit/build result is represented as proven SFU or GPU performance.