Sync 1080p60: next research plan

22 September 2026 · Independent source and evidence review · No new delivery measurements

This plan supersedes the latest designated 22 September plan, v4 and retains the corrected acceptance contract from the 21 September independent review. The earlier same-day review plan contradicted its Priority 7 status; v4 supersedes it and advances to a cross-platform 30-minute combined soak. V4 moves toward combined load, but its physical-audio and platform-concurrency completion labels still exceed the retained evidence. Fix the accounting and lifecycle prerequisites before retaining that soak as qualification. The next work is to resolve source-publication constraints, shared-file lifetime failures and the strict combined collector before additional platform scaling. Existing reports remain immutable.

1. Objective and constraints

Qualify at least 99% distinct ordered source identities in final rendered pixels while sustaining 1920×1080 at 60 source slots per second and all 32 audio channels concurrently. Preserve Noisedeck A → Sync → Sync Camera → Noisedeck B media effect → final pixels, in web and desktop and each required platform/backend. Neither a native receiver nor an Electron-only route certifies this path. Preserve latency, audio continuity, dimensions, rate, channel count and long-session stability. A 50-FPS diagnostic threshold is not acceptance.

Keep public interfaces and protocol unchanged. The saved checkout fast-forwarded from 983b9b3972f4063a765059df9ce1ef83773883d4 to 67fc2f1f435da506d1b0aee396f60e2488980fc8. All nine incoming commits were reviewed individually with surrounding code. Current upstream CI, camera, downstream notification and release-request workflows succeeded at that exact SHA. These results do not cover the uncommitted local correction. The catalog contains release 0.2.81; that does not identify the running installation or the eventual release of this upstream revision. The predecessor's 0.2.73 deployed-baseline label is not current evidence. Preserve running apps/devices and record actual binary hashes for future measurements.

2. Evidence that determines the next action

All listed files in the thirteen cited experiment bundles matched their published SHA-256 manifests on this run. The first nine bundles also match the prior independent audit byte for byte; their earlier limitations remain applicable. This verifies archived bytes, not experimental provenance. No bundle supplies the complete source-to-final-pixel identity and simultaneous all-channel sample ledgers needed for closure. Read the audit receipt alongside the following corrections.

Evidence	Supported observation	Acceptance limit and decision
E1 native versus Chromium	23,664 native distinct pictures / 599.982 s = 39.441 FPS; 12,335 producer skips; 591 seconds below 50. Chromium accountingValid is false.	Withdraw the 60-FPS/lossless capacity claim and exclusive Chromium root cause. Zero unexplained native losses applies only to the offered rate. E1 measurements.json
E2 sender stages	11.7–12.4 ms is the first-successful-poll readiness upper bound; 0.8 ms is send-call elapsed time.	Not GPU execution or transmission completion. The supplied Sync SHA does not resolve; extensionSha256 has only 32 hex characters. Require exact source receipt and raw trace before causal retention. E2 measurements.json E2 source-identity.json
E3 combined synthetic load	107,999 sends, 107,998 accepted, over 1,800 s; audio counters report zero ring drops/gaps. Final RSS 15,824 KiB, footprint 12,416 KiB.	The collector calls submissions deliveredFps, checks no sample values or final pixels, omits empty time buckets and has no acceptance verdict. The source receipt predates the claimed optimizations; reject combined qualification, retain transport telemetry. E3 measurements.json E3 source-identity.json
E4 Windows architecture	Unit/contract results describe framework support.	Structural coverage is not physical combined parity. The linked source-identity.json is missing (HTTP 404). Restore provenance before broader claims. E4 parity-matrix.json
E5 audio recovery	Fault scenarios are synthetic gates and injected exceptions.	Useful lifecycle coverage, not actual unplug/TCC/hardware qualification. Its source SHA predates the teardown correction. Current code also destroys healthy capture for wrong-source requests; test and separate validation from driver failure. E5 measurements.json E5 source-identity.json
E6 Windows sustained receiver	35,998 new frames, 199,140 repeats over 600 s; WASAPI cable evidence is two channels for two seconds.	Retain native evidence with its observer and boundary counts; no all-32 combined browser/pixel or long-session claim. Full source/binary provenance is absent. E6 measurements.json
E7 web pacing	35,612 distinct / 36,000 target slots = 98.9222%; four seconds below 55.	Below 99%. Baseline copies E1's invalid metrics while describing a changed configuration. No reverse-order pair or raw identity reconciliation; reject the completed label. E7 measurements.json
E8 Electron shared-file bypass	Reported candidate 3,600 distinct pictures / 60.003 s; arrival observer; candidate-only reverseArm.	No reverse baseline, concurrent audio, final-pixel ledger or long soak. Bypasses the required camera/shared web path. Incoming commits now gate shared-file copies on demand and provide a Windows file mapping. The bypass still requires explicit reconciliation with the shared web/desktop architecture constraint. Reopen lifetime, restart and qualification work; a port alone does not satisfy it. E8 measurements.json
E9 discrete audio	Synthetic aggregate channel and timing summaries, no full-channel raw stream.	Source pins 288f06cf, before e955b0ac adds pulses/tones/eager delivery. Native packets are interleaved, not the report's stated planar wire layout. Current test reads one DC and one pulse packet, not the full 3.2-second channel cycle or tone source. Physical qualification remains open. E9 measurements.json E9 source-identity.json
E10 Windows shared-file bypass	Reported 3,600 distinct arrivals in 60.001 s, 7.421875 ms median submit-to-arrival age; candidate-only reverse arm.	No reverse baseline, final-pixel or combined-audio ledger, binary hash or long session. The source receipt pins c6c3f961 and a workflow, but a green unit/contract run does not prove this receiver experiment. Retain as a reported short diagnostic, reopen qualification. E10 measurements; source receipt.
E11 multi-consumer capture	The single-CMIO arm reports 37.39 FPS and 25 low-rate seconds. The two-consumer shared-file arm reports 59.0 FPS with a 47-frame complete second; its concurrent phase reports 58.62 FPS. A later disconnect phase reports 60.0 FPS.	Reject the general zero-starvation/completed label. The three-consumer aggregate 180.61 sums observers of the same source and cannot be a delivery numerator. AVF count and distinct differ (1,831 versus 1,801 in the three-consumer arm), while the displayed rate is 61.0. Reconcile counters, windows and clock domain before judging delivery. No source/binary receipt, raw identity ledger, simultaneous audio or reverse baseline is bundled. A short post-disconnect observation is limited evidence, not full qualification. E11 measurements; complete-second findings.
E12 Windows FSCS/DirectShow concurrency	Reported aggregate 180.52 FPS; two-consumer shared-file count 1,798, distinct 1,780, but its thirty complete-second counts sum to 1,800.	The buckets cannot be distinct deliveries from that same total cohort. Reconcile the observer/window definition before using any fraction or zero-drop claim. No source/binary receipt, raw identity ledger, audio samples or reverse baseline is bundled. Reject the broad UI-lifecycle guarantee and completed physical qualification. E12 counts and buckets; reported measurements.
E13 Linux V4L2/shared-file concurrency	Reported aggregate 179.93 FPS. Two-consumer shared-file count 1,798 and distinct 1,780 conflict with thirty buckets totaling 1,800; both three-consumer shared-file series also exceed their total counts.	Reject platform-parity completion. This is an accounting/provenance gap, not proof of physical drops or their cause. The bundle has no source/binary receipt, per-frame ledger, all-channel samples, separate x86_64/arm64 recordings or matched reverse baseline. The reverse arm changes which consumer disconnects; it is not a reverse-order performance pair. Require corrected ledgers and source-bound platform runs first. E13 counts and buckets; reported measurements.

3. Measurement contract

Acceptance-definition gap: no authoritative numeric jitter epsilon was found in Sync documentation, the retained 11 September plan or Scaffold's Sync soak runbook/collector. The 11 September plan explicitly sets no launch tolerance for missed frames or latency. Preserve the user's ≥99% requirement; do not treat an observed percentile as its tolerance.

Denominator: every 60-Hz source slot with a monotonic deadline in a preregistered half-open steady-state window [t0,t1). For an aligned 1,800 s window this is 108,000. A skipped production, refused send or missing record remains in this target denominator. Also report the secondary offered-source fraction, never substitute it.
Numerator: unique ordered source IDs from that source cohort actually decoded in Noisedeck B final pixels by each slot deadline plus a preregistered maximum delivery latency Lmax. Lmax must come from the adopted latency contract; until that bound is resolved, report a diagnostic ratio without an acceptance verdict. Observe through t1+Lmax so normal in-flight boundary frames are not censored. Report pending cohort IDs at t0/t1, eventual late arrivals and deadline misses separately. Join source session/epoch and monotonic sequence through wrap; repeats, reordered, stale and undecodable IDs add no credit. Keep source, native, browser-arrival and final-pixel ledgers separate. Observer drain may recover recorded observations but must not extend per-ID deadlines.
Window and observer: preregister 10 s startup stabilization and preserve its failures separately; no adaptive warm-up or failed-interval deletion. Keep observer and content fixed across pairs. Retain every complete one-second bucket including zeros, partial endpoints, minimum count, seconds below 60/59.4/55/50 and longest consecutive failing interval. Validate full texture and deliberate one-pixel/identity failure controls, pending/abandoned captures and observer overhead.
Jitter: retain final-observer monotonic arrival intervals in milliseconds, ordered IDs and consecutive-sequence subset. Report mean, sample SD, nearest-rank p50/p95/p99, maximum and absolute deviation from 1000/60 ms, alongside missing-ID gaps and worst intervals. VideoFrame timestamps and native enqueue clocks are separate series. Proposed, not approved or satisfied: p99 absolute final-arrival deviation ≤2 ms; this is about 12% of a frame period, a proposed sub-frame arrival-regularity screen that must exceed verified observer uncertainty. Also propose ≥99% in every aligned ten-second window and no zero-delivery second, to prevent an overall mean hiding stalls. Resolve the authoritative epsilon/statistic and these interval rules before a closure verdict.
Latency: marker insertion to final decode is marker age, not physical display latency. Retain p50/p95/p99/max, source stage clocks and start/end clock anchors with uncertainty/drift. Never claim improvements finer than clock-join error. Keep matched baseline tails as regression bounds; a source-authoritative absolute video latency ceiling is still needed. Preserve the predecessor's audio <20 ms requirement while resolving its endpoints/statistic; read-request RTT alone cannot satisfy it.
Audio: concurrent 32-channel 48 kHz float32 capture; retain actual device/backend/format. Check every sample cursor and all-channel values, identity/order/polarity, channel-isolated pulses across a full cycle and orthogonal tones with explicit RMS/peak/leakage error bounds. Record dropped samples per channel and frame, ring overflows, underruns, sample-rate drift, reconnect gaps and end-to-end latency under the same video window. Require zero audio loss, sample/cursor errors and underruns. Tag synthetic, virtual cable and physical-source evidence separately; fewer than 32 physical inputs cannot qualify 32.

4. Research order

Every action has a bounded discriminator, required evidence and a retain/reject decision. Correctness and valid accounting precede further platform scaling. Native-only or synthetic success never closes the combined target.

Resolve prohibited validation/publication side effects. Existing pairing-store tests create symbolic links and the macOS packager creates an Applications link. The permanent no-symlink rule prevents this run from executing those paths or triggering them through a normal source push. Preserve these tests; do not bypass them or silently weaken their guarantees. Required evidence: an approved, compliant validation and packaging path with equivalent security coverage. Until then retain the reviewed source patch locally, label full checks unavailable, and reject shipped/CI-qualified claims. No source push or manual release occurred in this run.
Retain the bounded macOS writer-ownership correction locally. Two new regular-file regressions reproduced replacement-file deletion and a second sink scrubbing/unlinking the first writer's mapping. The local correction acquires a nonblocking advisory writer lock before mode/size changes and compares open-file versus pathname device/inode before unlinking, holding the lock through cleanup. The 14-test CMIO suite failed 2 tests before and passed all 14 after; a separate 16-test ring suite passed. Required evidence before shipping: compliant required-area checks and exact candidate-SHA CI. This protects cooperating writers and an already-replaced path; it is not an adversarial pathname-race or concurrent-reader teardown proof. The earlier audio sample-ownership correction remains upstream; do not restore the unsafe unlocked copy for a performance claim.
Repair shared-file lifetime and restart behavior across platforms. Windows reopens and resizes an existing file before mapping; a retained external mapping can prevent SetEndOfFile, and no retry is implemented. File type/owner/private access and exclusive producer ownership are not checked. The adopted ring retains a high old-epoch heartbeat that fresh lower timestamps cannot replace; a deterministic in-memory probe reproduced rejected fresh demand. Scrubbing also occurs outside the reader publication protocol. Six further commits through 6a2ff4c3d38bf037ba9bd85dac8f2560c344ae32 add Linux shared-file dispatch and platform tests. Linux repeats the missing producer lock and unconditional pathname unlink; the local macOS correction does not fix Linux. The default Linux tmpfs normally does not retain timestamps across reboot, but an adopted persistent custom path can. New Windows tests cover both direct-write consumers; they still do not cover reader-held producer restart. Linux also accepts padded input stride but forwards it to a packed-only shared-ring writer; require byte-identical output for a padded-stride fixture in both destinations. Use isolated regular-file fixtures, keep a reader mapped through producer restart, seed a previous epoch, test another writer, and force teardown during a paused read. Require intact existing files, one writer, bounded recovery to fresh pixels, no mixed/scrubbed successful reads and no stale accepted demand. Retain only after actual Windows/macOS lifecycle regressions and exact-platform CI. Do not run against a live global camera file. The Windows restart failure is a source/API finding, not a new hardware reproduction.
Restore trustworthy evidence and verdicts. Correct the combined collector's submission-as-delivery label, empty bucket omission, absent sample checks and lack of strict verdict. Join a complete monotonic 60-Hz source-slot ledger to native, browser-arrival and final-rendered-pixel identities, with all-channel sample cursors and values in the same window. Include source revisions, dirty diff, binaries, observer version and clock anchors. Inject one duplicate, omitted identity, torn frame, silent/swapped channel, sample gap, zero second and missing ledger; every relevant strict verdict must fail. Reconcile E11–E13 count versus distinct, complete-second sums, per-arm windows and aggregate rates. Require a full baseline/candidate and candidate/baseline pair; otherwise reject completion and retain diagnostic-only status.
Resolve the acceptance-definition gap. Current Sync docs and the authoritative 11 September plan do not supply a numeric jitter epsilon or absolute video latency bound. Preserve the explicitly labeled 2 ms p99 proposal in section 3; do not adopt it implicitly. Required evidence: a versioned decision stating percentile, units, clock, observer uncertainty, latency endpoints and steady-state/interval rules. Reject closure until that contract exists.
Finish the earlier bounded lifecycle and coverage findings. For Windows retained pixels, force a failed read after partial destination copy and require the last valid image to remain intact; reconcile the sequence with the copied frame. Publish one frame, wait past idle grace and require continued idle until a newer frame; switch RGB32→NV12→RGB32 without new input and validate subtype output. For native audio, wrong-source read/second-open errors must not destroy a healthy capture, while genuine driver failure must release it. Separate pairing-window readiness from the close-latency deadline: the recent 2 s→5 s test relaxation supplies no evidence for a new product latency bound. Correct shipped browser/README.md CI classification without bypassing product checks. Retain each fix only after a failing behavioral regression, required-area checks and exact-platform CI.
Resolve the native Linux pacing limit before a long soak. The V4L2 writer schedules each next unique write at completion plus 17 ms. That bounds sustained native writes to at most 58.824 FPS before write overhead, below the 59.4 FPS required for 99% at 60. This predates the incoming shared-file work; its faster reader rate does not qualify V4L2. First prove the offered/write deadline counts with a controlled monotonic-clock regression, then compare a cadence correction using matched native-camera/final-pixel and concurrent-audio pairs in both orders. Require at least 99% against all source slots with no latency, audio or resource regression; reject SHM-only or averaged callback evidence.
Qualify the intended combined path before expanding concurrency. Noisedeck final-pixel/AudioWorklet and Noisemaker channel modulation remain external-repository dependencies. Reconcile Electron-specific bypass behavior with the shared web/desktop architecture constraint; do not silently substitute paths. Require 32 actual physical inputs per platform, full channel-isolated pulses/orthogonal tones and every sample under 1080p60 video. First run matched 20–30 s screens and a complete reverse pair, then three-minute deterministic-pattern and representative-shader final-pixel checks in each required build/backend. Progress to section 6 only with valid accounting and no audio/latency/resource regression. Retain demonstrated improvements; reject contradictory or inconclusive claims until a new discriminator exists. Windows FSCS/DirectShow and Linux V4L2 plus desktop-reader qualification follow these prerequisites; incoming unit fixtures are useful limited coverage, not completed physical qualification.

5. Short decision cycles

For each candidate, first reproduce correctness failures, then run focused and required-area checks. A timing screen uses identical hardware, content, dimensions, channels, observer, source revisions and environment across baseline→candidate and candidate→baseline. Record source saturation, GPU fence observations, queue ownership/backpressure, actual receiver identities and clock error; change one variable. Stop on changed observer, missing ledger, audio corruption, stale pixels, any worsening tail or memory slope, or inconsistent direction. Performance measurements run serially with no builds or competing probes. Leave occupied hardware and existing soaks untouched.

6. Long-session degradation and completion

The predecessor's 30-minute-only completion rule dropped prior endurance work. Restore the 11 September progression: a 30-minute combined screen, then three hours in both builds; retain the existing eight-hour daemon/camera soak as a separate long-session reliability gate. Protocol/native soaks do not certify final pixels. Escalate only after valid accounting and stable delivery, latency, audio and resources. Retain every intervening failure, five-minute summaries, first/last matched-hour distributions, RSS/physical footprint and resource counts. Preserve the ≤10 KiB/min post-allocation memory-slope screen but also report peaks and uncertainty; it is not proof of bounded framework resources.

Closure is not established today. It requires the adopted jitter/latency contract, ≥99% unique final-pixel delivery against the complete 60-Hz target denominator, all32 audio integrity, supported web/desktop/platform coverage, source-bound reproducibility and sustained stable tails. Require both deterministic-pattern and representative-shader final-pixel results. No release label, green structural CI, synthetic audio, native-only receiver or 50-FPS checkpoint substitutes for those results.

7. Retention and reporting

Review coverage: every commit after 983b9b3972f4063a765059df9ce1ef83773883d4 through 67fc2f1f435da506d1b0aee396f60e2488980fc8, nine commits, with individual diffs and surrounding implementation, tests, workflows and documentation. No incoming commit in that initial range remains unreviewed. A second read-only review covers the six incoming commits after that SHA through 6a2ff4c3d38bf037ba9bd85dac8f2560c344ae32, including remote surrounding source: fifteen commits total. The checkout remains at the tested 67fc2f1f435da506d1b0aee396f60e2488980fc8 base to preserve its local edits; the six newer commits were not built or synchronized. Review scope is frozen at 6a2ff4c3d38bf037ba9bd85dac8f2560c344ae32; later arrivals require another review. The local ownership correction received a separate independent diff review. The newest code adds Windows shared-file publication, POSIX permissions/demand checks, monotonic demand updates, CMIO dual dispatch, a logo update and downstream notification; it does not demonstrate combined acceptance.

Source publication: local-only, uncommitted and unpushed. Required broad native/packaging checks were not run because existing fixtures and packaging create prohibited symbolic links. The new CMIO symlink fixture was replaced with regular-file lifetime regressions; production no-follow protection remains. This does not claim runtime symlink-rejection coverage. No workflows were weakened or dispatched. A normal push would run product CI, camera checks and downstream notification; successful product CI can request the Scaffold installer release. Those effects are the reason a push cannot be treated as a source-only action here.

Verification: strict-warning direct Apple Clang C++20/Objective-C++ builds; CMIO suite 12/14 before (two expected lifetime failures), 14/14 after; frame-ring suite 16/16 passed. Old-epoch fresh-demand probe exited 1 and remains an unresolved defect. Full CTest, packaging and physical combined-load qualification were unavailable/not run. Upstream-only CI, camera, downstream and release request are green at 67fc2f1f435da506d1b0aee396f60e2488980fc8. No exact-candidate CI exists. The six-commit read-only extension also has successful CI, camera, downstream and release-request runs at 6a2ff4c3d38bf037ba9bd85dac8f2560c344ae32; another release-request run was skipped. These are upstream source results, not local-patch validation. Release-request success alone does not verify the automatic installer release. No applications, shared devices or ongoing sessions were stopped or replaced.

See source and verification receipt and bundle audit. All generated research stays outside Git. This immutable successor advances the plan by withdrawing unsupported completion labels and sequencing discriminating correctness/evidence work. Publish through the existing reviewed archive publisher, then verify every served hash, catalog entry, links and desktop/mobile rendering. Combined acceptance remains unqualified.

Evidence references

E1. research-2026-09-18-1080p60-native-avfoundation; linked data and source receipts above.
E2. research-2026-09-18-sender-stage-separation; linked data and source receipts above.
E3. research-2026-09-18-combined-audio-video; linked data and source receipts above.
E4. research-2026-09-18-windows-platform-parity; linked data and source receipts above.
E5. research-2026-09-19-audio-session-recovery; linked data and source receipts above.
E6. research-2026-09-19-windows-sustained-delivery; linked data and source receipts above.
E7. research-2026-09-20-web-native-frame-pacing; linked data and source receipts above.
E8. research-2026-09-21-electron-desktop-native-bypass; linked data and source receipts above.
E9. research-2026-09-21-discrete-multichannel-audio; linked data and source receipts above.
E10. Windows shared-file bypass.
E11. Multi-consumer capture.
E12. Windows concurrency.
E13. Linux concurrency.
11 September measurement and endurance plan.