BACKLOG.md

CoreVideo Pro — ranked backlog

Owner release-scope decision, November 9: defer the legacy scene director tracked under #668. Exclude Set & Forget and old Magic Scene from the first release, including background and remote activation. Preserve CoreVideo Tiles and manual Take. Implementation contract: first-release scene control. This is a release exclusion, not completion of the deferred director's acceptance.

Now — Zoom ISO recording size, November 9

Order	Issue	Scope and acceptance
1	#1203	Record Windows Zoom camera ISOs at the applied camera size from the start. Decode a 360p → 1080p → 360p take to verify the 1080p file retains HD detail when delivered.

Completed — owner-reported Tiles scene shortcut, November 6

The owner requested a quick Tiles scene option immediately after the scene naming fix. The fix merged in #1200. No subagents are authorized.

Order	Issue	Scope and acceptance
1	#1199	Add a named CoreVideo Tiles starter to the New scene chooser, using real Tiles settings, Preview-only creation and persistence. Specification and execution plan are in the issue.

Scene naming #1196 is complete through merged #1198; its 1,999 managed tests, 101 compiled UI checks and 17 hosted checks passed. It is on main and is not yet in the published beta.

The prior window is complete: beta beta-2026-11-06-74495ad is public; #867 and #941 are closed with merged fixes. #1178 remains open after merged diagnostic coverage, and #1180 remains held. Unranked intake: #1195, Metal GPU admission timeout handling; it does not displace #1199.

Unranked intake	Finding
#1197	A new Solo scene becomes unsaved during queued editor initialization before any rename. Reproduced separately; does not displace #1199.
#1201	Stage Volt rundown clips in the Windows media bin, cue them on Preview, and take the confirmed clip to Program.

Active replenishing eight-hour window — November 6, 07:36–15:36 Eastern

The owner explicitly resumed work, ranked Auto first, and authorized replenishing the next batch whenever work finishes early. This supersedes the completed batches below. A completed batch is not the stopping condition. Continue useful authorized work until 15:36 Eastern, unless the owner stops it or every remaining path is concretely blocked. Keep at most three Now items in flight; no subagents are authorized.

Specifications and acceptance: resumed reliability work. Record estimates versus actual active effort, validation time, hosted waiting and external dependencies separately. Reforecast after every item and at least hourly. Hosted CI runs while independent next-item work progresses; local builds/probes never overlap measured media workloads. If the reserve runs out, review current open issues and replenish this queue under the owner's explicit instruction; do not declare completion early.

Rank	State	Issue	Scope	Active effort estimate	Hosted/external time
1	Done	#1146	Stale shell recommendation reproduced, fixed and live-verified warm/cold; #1173 merged. Broader host/share acceptance remains in the open issue.	About 25 min active versus 120 allocated	Hosted checks overlapped next work
2	Await reproduction	#1171	Bounded SDK response evidence and live comparisons complete; #1174 merged after all 17 checks. Original downward transition remains unreproduced; later startup ramp is retained separately.	Diagnostic slice complete within allocation	Requires recurrence or controlled sender/account changes for causal closure
3	Done	#1172	Single multiview placeholder; 1981 shell tests, negative/fixed compiled captures and all 17 hosted checks passed; #1175 merged.	Within the 45 min allocation	CI completed alongside live geometry work
4	Done	#919	#1176 merged after 1991 shell tests, ten failing old-workspace assertions, passing compiled lifecycle checks and all 17 hosted checks.	Within 75 min active upper range including clean-publish recovery	Hosted runner shortage retried with retained evidence; prior Mac performance failure remains #1178
5	Done slice / qualification pending	#1177	Ownership repair #1179 merged. Negative control, 2082 native cases, four CTest suites and all 17 hosted checks passed. The corrected 1800.86-second synthetic Program/eight ISO/SRT identity comparison passes after #1186/#1188/#1189. Spec.	Attribution/repair slice complete	Real SDK, registered camera and bounded end-to-end latency remain unverified; earlier failures retained
6	Await gate	#1074	Actual D3D11 picture fixture and 39 Tiles regressions pass; disabling black painting fails the pixel assertion. #1180 merge held on the actual Mac command p99 failure tracked in #1178.	About 15 min active qualification work	No retry-until-green; remote interruption/owner policy acceptance remain separate
7	Done	#903	#1181 merged after real endpoint evidence, 2090 native cases and 17 hosted checks.	Within allocation	Original unexplained audible event remains separate
8	Conditional	#443 / #989 / #1056	Matched camera/readiness preflight then full output test if prerequisites are met. Preserve failures and NOT JUDGED dependencies.	60 min, range 45–90	30 min measured run plus decode; camera identity/elevation prerequisite
9	Now	#1178	Recurrent Mac command p99 failure blocks #1180. Bounded command/reader timing is in #1182 for one instrumented hosted sample. Spec.	Additional native phase attribution: 30 min, range 20–45	Keep 100 ms gate and all repeat outcomes; local controlled transport checks follow the recording
10	Done	#1183	#1184 merged: all eight ISO counters stopped after departure while Program advanced 1200 pictures; files readable.	Within allocation	Overall rehearsal failed separately on #1186/#1188 and dual source epochs
11	Done slice / qualification pending	#882	Compiled Sources lifecycle passes, wrong-pixel publication fails, restored fixture passes. PR #1185 merged after all 17 checks.	Within 90 min upper range	Sampled evidence does not prove every transitional frame
12	Done	#1186	#1187 merged; whole packaged Program file passes 110536 identities with zero duplicate final picture in the 30-minute rehearsal. Spec.	Within allocation	All 17 exact-head hosted checks passed; issue closed with retained negative and final-file evidence
13	Done	#1188	#1190 merged; original session survives stream-first stop after departure; nine files finalize in one take in short and 30-minute runs. Spec.	About 25 min investigation/implementation plus shared packaged validation	All 17 exact-head checks passed; issue closed with exact-session evidence
14	Done	#1189	#1191 merged; old consumer fails, 2095 native cases pass, and all eight ISO identity judgments pass across 1800.86 seconds with auto-subscribe enabled. Spec.	About 15 min implementation plus 10 min native suite and shared packaged validation	All 17 exact-head checks passed; issue closed with single-epoch arrival/file evidence
15	Await #867	#941	Stop scheduled Program delivery at explicit teardown without hiding active-output failures. Spec.	45 min, range 30–75	Prior head passed all 17 checks; integration hit the existing background-decoder readiness assertion on Metal. Preserve the failure and qualify the repair; excluded from frozen beta
16	Now	#867	Prove the background transport can be logically Live before its asynchronous decoder is constructed; wait for actual first-picture readiness before the existing strict single-decoder assertion. Spec.	20 min, range 15–35	Controlled delayed-worker proof, old-precondition negative control, focused native tests and exact-head hosted gates; keep beta files frozen
Unranked	Intake	#1194	Two-frame internal Program startup records one Unavailable slot at sequence 2 before the measurement baseline; the whole-trace failure is retained.	Not allocated	No causal old-code comparison; distinct from #941 shutdown and outside the frozen beta

12:55 reforecast: 2h41 remain. Local test beta 8c8e15b1qa has been handed to the owner after a 60.1005536-second eight-source Program/ISO/SRT regression and exact-session finalization. All eleven decoded judgments pass; this is not the 30-minute RC gate. The public beta still needs merges, exact main identity and hosted installer qualification. Keep its contents fixed. Use independent capacity for #941 while preserving the owner's local test session; replenish again when that slice finishes.

12:22 reforecast: 3h14 remain. Monitor and departure repairs merged. Use freed capacity for the observed empty-take failure, finish Sources/final-picture acceptance, and preserve time for corrected integrated checks. The Mac diagnostic sample passed but did not explain the earlier failure; #1074 remains held. Replenish again if these slices finish early.

13:55 reforecast: 1h41 remain in the window. #1186 and #1189 repairs are merged after exact-head gates; #1188 is validating their integration. The immutable 30-minute Program/eight ISO/SRT comparison ends about 14:04, then finalize, restore settings and decode every output. Reserve 60–90 minutes for clean public-beta building, final main checks and installer qualification, overlapping independent hosted work. #941 passed 2099 native cases and isolated close traces; its Mac job had a zero-step runner-acquisition cancellation, retained and retried. #1178 adds native phase evidence with unchanged latency limits; its controlled timing tests now pass in hosted CI, while native/hosted causal evidence remains pending. No builds or probes overlap collection; no camera/real-SDK/receiver-latency qualification is inferred. Replenish validation work as capacity frees, keeping the testing beta frozen.

14:23 reforecast: approximately 73 minutes remain. All three recording repairs are merged and closed with the complete 1800.86-second synthetic comparison; all eleven decoded judgments pass. Public beta source is frozen at 74495ade, with a clean self-contained shell publish/runtime probe passed and the production native suite running. Reserve the next 35–55 minutes for packaging, exact-main CI and hosted install/probe/uninstall of immutable draft assets. The public beta is not yet published. Keep #941/#1178 out; reconcile their branches locally while release gates run, then replenish follow-up validation without changing the frozen release. Superseded CI runs are retained and cancelled to free runner capacity; no failing performance result is discarded or retried until green.

Allocation baseline: 20 min baseline/planning, 120 Auto, 90 resolution, 45 empty-state, 45 teardown, 60 Tiles, 60 conditional output work, 40 validation/report/replenishment reserve = 480 min. These are adjustable allocations, not permission to stop after one fixed list. Use blocked conditional time for the next actionable issue. Owner-deferred #513, business/credential acquisition, public-provider posting and speculative feature expansion are not silently resumed.

09:03 reforecast: roughly 6h33 remain. The new recorded output failure #1177 takes the freed #1172 slot under the owner's replenishment instruction. Allocate up to 150 minutes to attribution/fix/validation before reforecast, with #919 hosted work overlapping; reuse remaining capacity for the next unblocked reserve. No full-output pass is claimed from stable input geometry or successful writer startup.

09:40 reforecast: 5h56 remain. Auto and empty-state fixes are merged; resolution evidence and participant lifetime fixes await final hosted gates. The second #1177 recording comparison is running at eight actual 1080p feeds after a documented 720p startup ramp. Narrowed timing places repeated multi-millisecond stalls inside admission, with negligible arrival transfer and leaf-lock wait. Reserve up to 100 further minutes for causal attribution/repair and native validation, then reforecast; preserve 90 minutes for matched packaging/output evidence and use freed capacity for #1074/#903. Record a diagnostic result as such, not as a repaired output deadline.

10:15 reforecast: 5h21 remain. #919 merged and frees the #903 slot. #1177 now has live attribution, a failing old-ownership control and passing corrected focused tests; full native checks are running. Target the next 60–90 minutes for an integrated packaged recording comparison and decoded Program/ISO evidence, while #903 source work progresses without overlapping local builds with measurement. #1074 took less active work than allocated because existing production fixtures were reusable; its freed allocation remains available for #903 and fresh intake after the next milestone. No completed batch ends this window.

Active four-hour follow-on — November 5 23:48 to November 6 03:48 Eastern

The owner-authorized conditional batch is triggered: the initial bounded work finished before 06:00 with four merged fixes, passing regression/package gates, and two failed output warmups. Output acceptance remains failed; the next batch addresses the observed causes. This section is the sole current queue and supersedes the completed investigation order below.

Order	Issue	Work and acceptance	Budget
1	#1168	Reproduce stale missing-source eligibility after same-kind reassignment; repair the focused assignment path and prove eight actual ISO writers. Spec. Warmup alone failed and is not the fix.	45 min
2	#1166	Fix Hide/toggle routing for the active lower-third authority with Guest playlist rows present; retain manual suppression and verify actual packaged output. Spec.	45 min
Done	#1165	Credential-safe harness prerequisite #1167 merged after hosted checks passed.	Within baseline/handoff

Remaining allocation: baseline/spec reconciliation 15 min; matched package/regression 45 min; real rehearsal plus 30-minute output collection/judgment 60 min; evidence/issue reconciliation and exact configuration restoration 30 min (240 min total). No local build overlaps live output collection. The full gate remains #989/#1056/#517/#823; source geometry, physical webcam and registered-camera identity limits must be explicit. Do not waive missing frames or substitute counters for decoded output evidence.

First-batch evidence and limitations. Fresh triage enumerated 131 open issues at 23:34 (uncapped result); #970 and #551 then closed against merged/current evidence, #1168 added. #618 remains dependent on private SDK hosted provisioning. Other issues were title-screened rather than exhaustively audited. No provider feature work, new designer or broad architecture changes in this batch.

Unranked follow-on intake: #1171, all eight ISO writers now start, but actual received Zoom video drops to 1280x720 while the subscription still requests 1080p. Preserve the failed full-workload warmup; no quality downgrade or cause claim. Existing #919 also reproduced its caught participant-list teardown callback during the compiled probe. Neither finding displaces the current batch.

Active eight-hour session — November 5 into November 6, 2026

Owner authorized specifications/plans followed by execution, including local app/device rehearsals, at 21:54 Eastern November 5. The eight-hour endpoint is 05:54 Eastern November 6. This section supersedes older dated queues for the active session. Use the supplied test meeting if populated; otherwise perform labeled local tests. Before 06:00 completion triggers a fresh four-hour issue-triage/spec/plan exercise. One primary issue per implementation PR; at most three active items; GPU/device workloads run serially.

Specifications and per-item execution/acceptance plans: overnight reliability runbook.

Outcome: reduce demonstrated recording/Graphics risk, establish an honest Auto/device/output verdict on one integrated candidate, and leave a reproducible handoff. No new provider, presenter-clock, designer or architecture feature work in this window. Time allocations are investigation limits, not promises to fix unknown causes.

Now — three bounded work items

Order	Primary issue	Scope and done evidence	Limit / stop rule
1	#1143 ISO late-frame loss	Preserve the failed recording and diagnostics; reproduce queue admission at the late-frame/held-frame boundary with controlled scheduling. Distinguish suite interference from a production defect. A fix requires a failing-before/passing-after case, decoded identity/count evidence and zero unexplained dropped frames.	105 min. If the cause is still unknown after 60 min, spend the remainder capturing a minimal reproducer and exact admission/queue evidence. Do not grow queues, relax held-frame accounting, or call an isolated passing retry a fix.
2	#1158 Graphics preparation, with separately tracked #1157 preview rejection	First record admission/eviction/producer state for the second asset and the complete RPC response for the rejected valid preview. Try controlled interleavings and the recorded suite context. Retain bounded residency, charged live leases, explicit-null validation, private Preview isolation and changing-pixel checks.	75 min total: 45 min cache, 30 min preview response/reproduction. They are related investigation topics, not an assumed shared cause. Separate fixes/PRs if both require code. Unresolved evidence is an acceptable bounded outcome; a green isolated rerun is not closure.
3	#1137 monitor retirement fixture	Force the transition between the fixture's two gpuDone reads; show whether it produces inconsistent completed/pending evidence. If confirmed, sample once and prove immutable reader evidence plus eventual idle sleep. Preserve the original TSAN failure and run the sanitizer check on the proposed commit.	45 min. No blanket timeout increases or production worker changes without a reproduced runtime defect. First item to drop if build/reproduction costs exceed budget.

Rehearsal prerequisite and new intake

The four bounded fixes above are merged (#1161–#1164). Continue the authorized rehearsal/output work. #1165 is its required credential-safe harness prerequisite; specification: drill error evidence. No app binary change is included.

Additional output-rehearsal prerequisite: #1168, establish all requested remote source readiness before Record freezes eligible ISO selection; specification and plan. Preserve the initial seven-writer failure and verify every writer after start. This does not relax source geometry or delivery acceptance.

Unranked intake: #1166, live rehearsal reproduces accepted lower-third Hide leaving the legacy graphic on Program when a Guest playlist row exists. Preserve this failed acceptance for the conditional next-batch triage.

Eight-hour allocation

Elapsed window	Minutes	Deliverable
00:00–00:30	30	Baseline: pin current main and CI state; record installed build/profile/devices and active outputs; retain previous installer and restore path. Reconcile the highest-confidence stale issue, #1133, against merged #1132 and its exact-head checks. Confirm remote test guests and source availability before promising the full soak.
00:30–02:15	105	#1143 bounded diagnosis/fix above.
02:15–03:30	75	#1158/#1157 bounded Graphics work above.
03:30–04:15	45	#1137 fixture work, or overrun reserve for the first two items.
04:15–05:15	60	Code freeze. Select only reviewed, passing changes; build the matched native/shell candidate, run the full production suite and relevant managed/compiled probes, and start exact-commit hosted checks. Keep failed candidates isolated. Save commit and executable hashes.
05:15–06:30	75	Installed/local rehearsal: Auto 30 min (#1146); capture disconnect/reconnect and brief Tiles stalls 25 min (#758/#993/#1074); Graphics Cue/Show/Hide and four everyday operator tasks 20 min (#1076, #1157/#1158). Record actual Program/webcam identity and action timings.
06:30–07:30	60	15 min warm/setup, 30 min full-output workload, 15 min finalize/judge: #517/#823/#1056/#989. No builds or unrelated GPU probes during the run. Use existing pixel-identity judges, not only counters or average FPS.
07:30–08:00	30	Publish evidence and issue dispositions, list exact unresolved failures and next actions, restore the agreed installed state, and prepare the reviewed handoff. Publish a beta only if it was requested and every exact-commit/package gate actually completes within the remaining window. Otherwise leave a candidate with a precise pending-check list.

Total: 480 minutes, sequential. The integration block includes build/CI latency; hosted checks may continue during rehearsal, but local compilation must stop before measurement. If code work slips, remove #1137 first, then reduce the second Graphics investigation; protect the final rehearsal and output-test windows. Do not replace a failed test with repeated attempts until green. One causal change or new diagnostic may justify another bounded trial, with the original retained.

Rehearsal acceptance and dependencies

• Auto (#1146): host plus three guests; sustained turns, backchannels, silence, solo/interview/panel, share start/stop, preference changes, disconnect/rejoin, rejected Take, manual override. Capture intended versus actual people on Preview, Program and webcam; no invented captions, duplicate person, host takeover of guest slots or stale-session cut. Measure time from native eligibility separately from speech onset. #668 is already closed; do not reopen it merely to count tonight's work.
• Devices/Tiles: record a real capture unplug/replug with responsive commands and the configured dropout behavior; no fake fresh timestamps on stale pictures. For Tiles, current main already holds brief Zoom stalls for four seconds: verify stable slots during 1–3 s gaps, explicit held status, long-stall removal, immediate video-off/departure and recovery. Four seconds remains a working assumption under #427; do not silently retune it or claim network congestion as a proven root cause.
• Graphics: Cue must stay private; explicit Show/Hide must act on the intended item; a failed preview must expose a useful reason. Time the four #1076 tasks and matching Hide/Clear from the same screen. Only call owner-usability acceptance passed when the owner performs the tasks; an agent rehearsal is technical evidence only.
• Full output gate: the prescribed eight remote feeds plus webcam/screen workload needs actual available source content and confirmed received geometry. Observe Program recording, every selected ISO, registered OS camera and the configured stream simultaneously. Apply the current source-stall/tail-hold exception exactly as recorded in CLAUDE.md; no pipeline loss, unexplained repeats or reordering. Judge desktop UX separately with its established tolerance. A 30-minute run does not close the separate hour-scale idle-crash issue #513.
• Unavailable guests/devices: after the first 30 min, use a labeled local generated-source/device preflight if the required meeting workload cannot be populated. Preserve the same time budget and leave real Zoom/full-load acceptance unverified. Never substitute generated or duplicated guests and call the remote workload passed.
• Local rehearsals are authorized. Before changing the running app, establish that recording/streaming is not active and retain settings/registration. Do not broadcast publicly or send provider chat without the existing controlled-channel authorization and account access.

Next / deferred for this eight-hour session

Bucket	Issues	Treatment
Evidence/closure reconciliation	#1133; review #618 and #551	#1133's supporting PR #1132 is merged and its issue comments already record passing exact-head checks. Verify the acceptance link before closing. #618 and #551 are candidates for source/evidence review, not declared fixed by this audit. Cap bookkeeping at the baseline block.
Implemented, awaiting real behavior	#1146, #1074, #1076, #608, #989, #758/#993	Reuse the rehearsal/soak above; verify current implementation before proposing more code. #608's superseding root-cause comment and merged #656 matter more than its original hypothesis. #989's merged #990 does not prove the full workload.
Credentials or controlled provider access	#1136, #1117, #1118	Hosted SDK build needs an approved private download source/secret; a local SDK is already a workable release path. YouTube/Twitch need controlled accounts/channel and live moderation events. No dependency on them for tonight's core reliability outcome.
Public-release/business dependencies	#423, #424, #425, #426, #435, #437; #427 decisions	Certificate, redistribution answer, reference hardware, feedback/licensing choices and explicit policy decisions are not eight-hour coding promises. Track the actual external dependency.
Feature expansion	#1139, #1119, #1120, #1041, #539	Presenter/authoring expansion, X/LinkedIn, expanded multiview and MXL stay outside tonight's scope.
Other open work	Remaining entries in the unranked inventory	Revalidate current code/evidence before ranking. A recent recurrence of source loss, a crash or output corruption discovered during baseline/rehearsal displaces lower-priority work; do not automatically restart an old investigation from its title.

Inventory and evidence coverage: November 5 issue triage. That file is an unranked snapshot; this backlog remains the only work-order source. No issue is closed by a plan alone. Execution is owner-authorized; measured acceptance and release gates remain required.

Beta release blocker, November 5 — #1154: migrate the two retired macos-14 CI jobs to macos-15 without changing tests or thresholds; required to complete the owner-authorized beta.

Owner-directed Auto timing completion, November 5 — #1150: run continuous person/scene holds concurrently while Preview warms; retain readiness, confidence and manual-control gates. Installed conversation acceptance remains #668.

Owner-directed Auto completion, November 5 — #1148: preserve Take failures for same-scene person changes. Follow with #1149 lifecycle recovery and the timing/rehearsal acceptance in #668. Owner requested completion of these remaining repairs.

Owner-directed Auto repair, November 5 — #1146: keep native shot selection and bindings together, apply operator preferences inside the director, reset interrupted holds, and qualify actual Preview/Take outcomes. Preserve #668 guest identity/manual-control rules. Evidence and installed scenarios: Auto director qualification. Caption defect #1144 remains separately scoped.

Owner-reported Auto defect, November 5 — #1144: Auto creates an enabled caption strip without a transcription source. Remove unsupported enablement, reject legacy enable requests and preserve separately supplied caption cues. Broader Auto scene-choice quality remains a separate acceptance concern.

RC blocker, October 23 — #1030: on the live show with beta-2026-10-23-1072a50 a Zoom ISO participant left mid-recording, Media Foundation throttling blocked his ISO's silence write forever, and the unbounded closeWriters join wedged the recording file-control lane for the rest of the show (second Record press failed; the core missed the shell's close grace). Fix PR #1035: sink-writer throttling disabled for Program and every ISO with held video frames replacing its back-pressure, no silence-fill for a departed participant (roster read outside coreMutex), bounded joins that abandon a stuck writer, and honest loss text. Detail in iso-recording. Acceptance still needs a live departure during a recording: the departed ISO finalizes at its real duration, the re-formed take starts, and Record works again without a restart.

Owner direction, October 23 — first release candidate: the credibility PRs, the engine host (#965) and dependabot were merged and beta-2026-10-23-1072a50 was published WITHOUT a rerun of the 30-minute outputs soak (the test meeting had no remote feeds). The owner then asked for the open-issue inventory before a first RC and chose to start on the code-only items. Merged the same morning: #1026 (#863/#888 short installer staging root), #1027 (#551 regression test; the defect was already fixed by #833), #1024 (#443 scripts/qa/outputs-drill.ps1, never run live yet), #1025 (#1009 local recording without a meeting; changes the #732 crash-resume rule to resume unless the Zoom rejoin failed; owner confirmed the same afternoon). Still code-only and unstarted: #439 GPU-tier defaults (needs the tier policy), #445 teardown audit, #434/#436 production endpoints (need the URL and domain), #433 crash-dump key (owner said yes to HKLM; PR #1033 open, installed acceptance pending). #781 Frame Server refresh on upgrade: implemented on codex/rc-781 (PR open; Setup stops a FrameServer instance still serving another CoreVideo camera DLL, exit 3 + warning if it cannot, real 64-bit Inspect); the live Stop probe and the installed upgrade acceptance are owner-run and pending.

Owner direction, October 22 — credibility before the closed beta: after the 30-minute outputs soak passed and beta-2026-10-22-f96a136 was published, the owner asked how far a public release is and chose to start on the credibility defects first: every panel, control or value is wired to something real or removed, never invented (rule in honest-reporting). Three lanes: shell #1021 (#767 #761 #766 #764), core #1023 (#765 #519 #763 #766 #764), services #1020 (#743). Merge #1021 before #1023. The public-release critical path stays tier 0 (#423 signing certificate, #424 Zoom SDK redistribution, #425 reference machines, #426 feedback channel, #427 rulings) and tier 2 plumbing (#433-#437); none of those are engineering-blocked.

Owner gate ruling, October 22 — release gate is outputs only: Program recording, every ISO, the registered OS camera and any stream must deliver every source frame exactly once over the 30-minute workload (zero tolerance). The on-screen Studio cells are a UX metric judged by scripts/qa/desktop-picture-cadence.py v2 against a tolerance (no hold over 100 ms, omission ratio under 1 %), because Windows composes windowed surfaces at the beat between mixed-refresh monitors for every application; the app-less control reproduced the omission with the media core stopped. Qualify on the real mixed-refresh desk; never ask customers to match refresh rates. Retired: elevated PresentMon/ETW scanout proof, DXGI frame-statistics reconciliation, VBlank phase fitting, NVIDIA profile audits, and buffer/credit/alpha/Present(0) presenter experiments. Sequence: install a1e79e1 (Present(1) restored) → #1013 probe to twelve sessions reserving Program and stream → add a local SRT/RTMP stream to the workload harness → 30-minute soak judged on outputs → merge #1018/#1008, publish, desktop-shortcut acceptance. Detail in CLAUDE.md "What the release gate is, and is not".

Owner Graphics follow-up, October 21 — #1012: finish local logo upload for the declarative logo templates as a dependency of #1007; verify private Preview, explicit Cue/Show and installed camera pixels before acceptance.

Graphics installed dependency — #1011: fast Take/LT in chose a valid outgoing camera from mixed fade attribution. Prefer actual incoming take-in: layers and refuse outgoing-only transition attribution; preserve the failed installed trial and verify immediate camera/screen handoff without sleeping through the failure.

Owner priority, October 21 — #1007: audit Graphics for Zoom-only assumptions and incomplete workflows. Generalize source-bound lower thirds to webcams and screen capture, qualify transparent PNG import/composition and verify the installed desktop-shortcut app before completion. Preserve source lifetime fences, private Cue/Program isolation and independent full-workload performance gates.

Owner beta release direction, October 21 — #974, PR #1008: the latest owner instruction replaces the earlier one-release exception: finish full-workload qualification with local recording and registered virtual camera, fix failures, then merge, build, publish and install. Eight actual live remote feeds, webcam, moving screen capture, Multiview and Preview remain required. Preserve failed and missing evidence; no merge or beta publication until all required checks pass.

Qualification dependency — #1013: the encoder probe stops at eight sessions, below Program plus eight ISOs, forcing the last ISO to software. Measure the full supported encoder inventory without assuming driver capacity, preserve lower-capacity fallback, and verify actual installed hardware placement and unchanged full-workload delivery gates.

Qualification dependency — #1014: remove the measured WGC CPU round trip and investigate remaining exact webcam-selection delays under recording load. Preserve source identities, bounded ownership and independent CPU/ISO consumers. Require per-frame source and mapped display evidence; advancing Program counters cannot qualify stale source pictures. This remains within the owner's #974/#1007 full-workload request.

Qualification test dependency — #1015: scope browser mock environment and keep the native test runner's COM apartment alive across successive real capture fixtures, matching production lifetime. Retain the interrupted capture-enabled run; require actual WGC/browser pixels and the complete suite before accepting #1014.

Source deadline dependency — #1016: integrate source preparation and composition into the existing Program deadline budget. Retain exact selected identities, original deadlines, total buffering and bounded capacity; require causal late-preparation tests and installed full-workload evidence. Scheduling alone did not remove holds. This blocks #1008 merge/publication under the owner's root-cause instruction.

Qualification CI dependency — #1017: synchronize completed observation-reader leases before bounded snapshot slots are reused. Retain the 37-warning ThreadSanitizer failure, fixed capacity and nonblocking publisher refusal; require concurrent reuse coverage and a clean sanitizer job before #1008 merge/publication. This is not yet established as a video-stuttering cause.

Source cadence dependency — #1019: stop latest-arrival sampling from repeating and skipping already prepared webcam pictures. Resolve explicit source cadence within the existing preparation/deadline budget; preserve exact identities, bounded ownership, ISO fidelity and actual-picture gates. The installed short run passed output identities but failed source pictures, so #1008 remains blocked.

Beta CI dependency — #1006: initialize clock publication storage before launching its worker. Keep strict revision/visibility checks while distinguishing bounded controller-busy admission from configuration errors; validate the retained macOS failure and thread-sanitized clock lifetime before releasing #974.

Full-workload gray-source dependency — #1003: Program can stamp consecutive output counters while Zoom/screen GPU preparation is refused and the actual source image is gray. Preserve the live preparation-retiring-generation-capacity failure, reproduce bounded generation ownership and require actual source admissions/pixels in qualification. Fix retirement without raising memory/lease limits; the display move is not established as its cause. No beta publication.

Full-workload screen-capture dependency — #1002: the owner confirms video moves on DISPLAY3 while its CoreVideo input freezes. Retain the engineering run's 41-second source-progress stall and distinguish it from the older installed core's stale API/control stall. Measure capture callback, bounded worker, GPU readiness and publication ownership; require actual moving-screen progress with recording/virtual camera before qualification. No static-desktop waiver or beta publication.

Full-workload UI delivery dependency — #997: native Program deadlines and actual recording/OS-camera/ISO pixels passed the retained 30-minute component run, while UI Present commits remained below 60 per second. Measure readiness between periodic polls, preserve existing deadlines and bounded ownership, and require real UI delivery evidence before publication. This is part of the owner's ongoing root-cause and full-workload qualification request; the replacement eighth remote is now available, but the new eight-remote run failed OS-camera continuity and remains unqualified.

Full-workload camera dependency — #1000: the eight-live-1080p run skipped one Program identity inside the Windows camera source, while its matched recording retained it. Reproduce the consumer/publication phase crossing and preserve bounded ownership and original request deadlines before rerunning the owner-requested full workload. No beta publication.

Unranked finding — #998: investigate slow redaction of one long diagnostic string. Retain the aborted synthetic regression separately from the actual workload allocation evidence; this is not established as the live failure's cause. 2026-10-25 (CI sweep A): root cause found and fixed in the sweep-A PR: the secret-assignment regex began with a greedy \w*, quadratic on a long word run; now linear (tests: 7 long-input shapes redact in well under a second, they took minutes before).

Full-workload camera repeat dependency — #991: registered OS camera pixels exposed one held identity after 27 minutes while native Program counters stayed clean. Preserve that failed run, establish cadence from the first actual fresh emission without extending issued read deadlines, serialize request ownership and test restart fences. Require fresh installed recording/OS-pixel and full-workload evidence before publication.

Full-workload Zoom fidelity dependency — #989: unchanged source epochs exposed hundreds of Zoom frames omitted before ISO recording despite zero writer drops. Preserve selected ISO ingest arrivals before latest-picture playout, reject fallback to older render frames during empty batches, and separately repair/account shared-memory reader loss. Actual source/reader/recorded identities and fresh installed workload evidence are required; the current qualification run cannot pass overall.

Full-workload readout dependency — #987: explicit ISO re-arm after Unassign must refresh the armed count even when persisted intent is unchanged. Preserve engine-reported raw-media facts through the spine/read model so recording preflight follows confirmed capture start/stop instead of a stale join-time warning. Validate the installed controls before publication; do not infer capture from toggle intent.

Full-workload qualification dependency — #984: the owner's requested full-workload checks exposed 1,668 camera arrivals skipped before ISO admission while recording drop counters stayed zero. Preserve actual selected camera arrivals through a bounded ref-only CPU branch, account for pre-ingest loss and rerun the installed workload. Passing Program counter bands cannot substitute for camera source fidelity. This is part of the authorized keep-fixing-failures qualification work; publication remains blocked. Owner-approved UIUX batch, October 20 — #978: audit shipped Graphics/starter/source-text behavior, then finish template-to-Studio guidance, default/custom/hidden guest text and guarded automation editing under #927/#593/#929. Preserve the installed app, GPU, profile and camera registration while the other chat validates #975. Source work, CPU-only tests and hosted CI only; installed/native output acceptance stays separate. #955 owns footer status/alignment.

Owner follow-up, October 21 — #968 within #960: diagnose and fix the decoded audio gaps, then rerun full Studio crash-survival validation for PR #965. This is a blocker in the active #960 lane, not an additional WIP item. Retain failed evidence and require decoded recording and received-stream continuity.

Owner implementation direction, October 19 — #960: merge #964 and start the reconnectable EngineHost vertical slice. #960 is the active stability item; #961–#963 remain dependent. Keep the installed app and live show untouched and use isolated candidate validation. Planning-only language below is superseded for #960, not for default enablement or production rollout.

Owner priority, October 20 — #974: fix camera ISO re-arm synchronization after Unassign, then complete the eight-Zoom/webcam/screen workload with Multiview, Preview, local recording and virtual camera. Retain failed runs and require per-frame delivery evidence before calling qualification passed. Only then build, publish and install the corrected beta using the established local process.

Qualification dependency — #976: recording retry reaches a new requested/preparing session then is cancelled before any frame is written after an earlier failed take. Scope terminal observations to the explicit request's native session; preserve real new-session failure reporting and verify actual Program/ISO progress before resuming #974 combined qualification.

Current beta installation dependency — #971: the owner ended the show and authorized local build, installation and desktop-shortcut camera/Unassign acceptance. Retain the failed exact-asset installer trials, enforce one worker reply, preserve setup errors through rollback and remove owned retry artifacts. Normal installer and actual desktop camera/Unassign checks must succeed before acceptance; per-frame workload qualification remains separate and unverified.

Release preparation dependency — #966: two main CI runs lost a Graphics heading edit before its callback committed. Reproduce through compiled controls, preserve pending edits across model refresh and retire stale bindings; keep the real edit assertion. This blocks the #857/#956 candidate's green-source gate and remains source/hosted-CI work during the owner's show.

Owner release order, October 19 — #956/#857: include #957 and the desktop-user camera registration repair in the next beta. Preserve the running show: no local install, shortcut/profile/registry change, app launch/restart or live camera/input test until the owner ends the show. Prepare source, remote CI and candidate packaging meanwhile. Release acceptance remains pending until the installed app launched from the owner's regular desktop shortcut delivers camera frames and reuses an Unassigned input through its real controls. Source/fixture/clean-runner checks alone do not satisfy that gate.

Owner Sources regression, October 19 — #956: Unassign leaves the input row dead. Keep the empty row's unified source picker reachable and verify repeated same-row source reuse through compiled controls without restarting or changing other inputs/Program.

Owner planning direction, October 19 — engine survival: turn the architecture review into an executable plan, starting with production surviving a WinUI crash. Track the outcome under #959 and the implementation contract. The scoped dependency sequence is recorded in Next below. This authorizes the plan/backlog intake; it does not start four development items, supersede unrelated Now work, enable the feature, or change the installed app. Maximum three active development items remains. #930/#517 delivery acceptance is not waived. Owner Studio review follow-up, October 19 — #954: correct stale output status text, distinguish observed output progress from configuration, remove redundant footer summary text and align production/telemetry baselines. Validate state transitions and compiled bindings as well as fit; preserve the running review app.

Owner review follow-up, October 19 — #951/#927: Studio's bottom controls do not fit at 1080p and the template workflow is still unclear. Restore complete Studio control fit with full-workspace compiled geometry and renders; preserve Studio behavior. Clarify the template-to-Studio workflow against the owner's review feedback. Use API/offscreen checks and preserve the installed review app.

Owner direction, October 19 — #927: fix the rejected Graphics private-preview request and replace the editor-first entry with populated, coordinated show starters. Let operators choose, experiment privately, customize and explicitly add a show look without changing Program or Studio's layout. Validate actual native preview pixels as well as the bounded 1080p controls. Preserve the running installed app and use API/offscreen candidate tests.

Owner direction, October 18: identify and fix the causal #857 webcam ownership failure before publication. Then merge #945 and install the complete Graphics redesign for review. Use the API/background diagnostics. Keep failed trials and the later passing trial distinct; no publication based only on recovery.

Owner approval, October 17 — #942: implement the approved 1080p/100% Graphics workspace and explicit Use in Studio assignment. In Studio, add only the assigned-look label beside the existing lower-third toggle; preserve all other Studio layout and controls. Use isolated API/offscreen validation and leave the installed app, camera registration and production profile alone. This is the current UI implementation priority; existing output acceptance gates and the separate release-blocking #943 remain open.

Owner direction, October 17 — merge and cut beta: integrate the seven open PRs and qualify the immutable Windows assets. Release blocker #940: camera setup must hash its payload without optional PowerShell command discovery; require actual clean-runner install/probe/uninstall before publication. Full-workload frame acceptance remains governed by #930. Post-merge release gate #943: eliminate RPC writer shutdown lost wakes; retain the 900-second failed native run and require a forced-race regression plus fresh beta qualification.

Owner approval, October 16 — first Volt milestone: execute the approved graphics specification through #926 (native first consumer), #927 (complete workspace/migration), #928 (title/bug/clock consumers), then #929 (qualified graphics automation, dependent on #761). Work sequentially through the dependency gates, with at most three active issues. This implementation priority supersedes earlier documentation-only restrictions. Preserve the installed app, camera registration and production profile until the complete feature is ready for review; use isolated API/offscreen tests. Data graphics remains outside this first milestone. Parent/spec: #924.

Owner direction, October 16 — graphics review: reconcile the supplied Volt proposal with #847/#764/#761/#592/#593 and deliver the complete specification and implementation plan under #924. This authorizes documentation for review, not graphics implementation or an app restart. See specification, reconciliation, and implementation dependencies.

Owner direction, October 16, live stutter incident: audit and fix hidden UI dependencies under #930. Validate eight remote feeds, webcam, screen capture, multiview/Preview, local recording and virtual camera. Restarts and administrator tracing are authorized for this incident. Functional success cannot close frame-performance acceptance.

Owner direction, October 16: implement #922 validated RTMP/SRT destination control actions using isolated API tests. Preserve the installed app, meeting and production preferences; no restart or installation.

Owner direction, October 15: diagnose and fix #916 source video delay in Inspect using API/offscreen validation; preserve the running installed app. Owner direction, October 15: implement #920 alongside the #916 source-preview investigation; validate repeated active Join through API/isolated tests without desktop input.

Owner direction, October 15, approved Sources design: implement #590 as the table-first workspace with inline quick source patching, an optional inspector and connected existing grade editor. Preserve every existing source, MV, ISO, audio, adapter and grading capability; the web mockup is not permission to remove controls. Build an isolated review candidate on the submitted UI/UX batch; leave the installed app and production settings untouched. See reference/sources-table-workspace-spec.md.

Owner direction, October 15: finish the full operator UI/UX review batch while the owner is away: starter scenes, Sources identity/clarity, shared adjustments, lower thirds, grading/ROI and Settings/navigation. Work sequentially within the three-item limit. Use API/offscreen dev processes and isolated profiles; leave the installed app, production settings, camera registration and desktop alone. Deliver one coherent review candidate with focused PRs and honest acceptance evidence. This development priority supersedes October 14; media acceptance remains open. Owner priority, October 14: investigate #904 and build the Program display zero-miss repair plan. Use API-only control while the owner uses the PC. Preserve the original three copy skips and distinguish a confirmed loss boundary from an unproven refusal reason. This owner-directed investigation takes the active delivery lane; the other merged-code acceptance gates remain open.

Owner-ranked continuation, October 14: after the implemented #904 copy repairs, address the camera reader under #517 first, then source-generation continuity under #908. These are the next two items in the active delivery lane; API-only control and the existing zero-miss acceptance criteria still apply.

Owner-approved bundle, October 14: work three parallel development tracks: #872 audio monitor lifecycle, #882 source thumbnail identity, and #869 GPU fixture modes. The #872 stale-start fence, #882 source thumbnail isolation and #869 GPU fixture modes are merged through #896, #899 and #895. The #873 bounded staging/off-lock annotation follow-through is staged in #901; installed full-load acceptance remains. The coordinator reconciles shipped versus accepted work, including #857 installed beta/recovery validation. Maximum three development issues in flight. The owner accepted administrator consent: October 14 beta is installed, both camera ownership entries and shortcuts are verified, and the October 13 install was removed. The first OS receiver trial had 28 repeats/missing identities in an old serving DLL. After Frame Server refresh, a serving-identity-qualified 45-second measured trial passed with 2,701 samples and zero identity losses. Both trials remain under #517; the short reference does not close sustained, mixed-load or real-meeting acceptance. Installation is complete; real-meeting and zero-miss output acceptance remain open.

This is the only ordered list of work. Status and detailed evidence live on linked GitHub issues. Rules: AGENTS.md.

Owner UI/UX direction on 2026-10-09: while the grading/framer build awaits the weekend bake, execute the quick setup bundle sequentially: #587 first-click Join, #594 Health inside Settings, then #595 opt-in OHG navigation. Each gets a focused PR and short installed acceptance; sustained media qualification remains separate. Sources/lower-third/starter-scene work follows this bundle.

Owner lower-third direction on 2026-10-09: include appearance and customization #847 in the lower-third batch alongside #592/#593, before starter scenes #591. Deliver polished presets and a shared appearance editor with actual native output effects; source text remains in Sources. Keep short output acceptance and weekend bake distinct.

Owner control-usability direction on 2026-10-09: extend the operator batch with #848: scene, audio, grading and lower-third controls need direct manipulation, meaningful units/ranges, clear defaults/reset and visible feedback. Implement the shared interaction standard through the existing #847/#835/#591 consumers. Owner clarified that sliders with synchronized exact number entry are preferred for continuous adjustments; follow the operator adjustment control specification. This broadens the accepted UI scope without displacing media acceptance or inventing a separate work order.

Owner bundled design request on 2026-10-09: scopes in the grade workspace must optionally analyze only a selected ROI (#835). Bundle that with #847/#848, lower-third text/stability and starter-scene usability under the operator editing specification and implementation plan. ROI changes analysis only, with an editor-only guide; full-source grading/output remains intact.

Owner top priority on 2026-10-08: advanced per-source grading #835, with an optional expanded workspace, editable curves, histogram, waveform and vectorscope. Its first slice includes the grading preview/output consistency repair from #764. This supersedes the earlier code-work order; installed recording acceptance can continue alongside it.

Earlier owner focus on 2026-10-04: accurate output/health reporting, then dropped settings and automation behavior, then operator usability. The review found 90 open issues against main 92e6b1ea. Installed acceptance continues alongside this sequence; the owner's two-hour bake reports positive render and virtual-camera behavior, without closing the remaining measured delivery and lifecycle requirements. The Unranked tables retain issue detail; Now and Next are the work order.

October 10 UI/UX delivery reconciliation: #837, #840, #842–#846, #849 and #855 are merged and included in installed beta-2026-10-10-abb97fb. Remaining issue acceptance is consolidated in the installed UI/UX acceptance protocol. Existing order is unchanged; implemented items awaiting acceptance are not Done.

Owner-requested order review 2026-09-27 against main 0ff22af4 and linked issues: #659, #661, #663 and the #674 implementation slices are merged. The Now/Next tables below replace the exhausted 2026-09-26 Now queue. Earlier #616, #601, #617, #622, #530, #621, and #540 are closed. The owner paused the remaining private-SDK CI work in #618 pending research. Owner promoted and completed source-bus ingest extraction (#540). On 2026-09-26 the owner approved executing the #657 control-state plan before SRT/NDI edge I/O (#538); its three implementation slices are now merged, while parent qualification remains. Owner accepted live lip sync (#579) and first Takes (#555) on beta db9e703. #513 validation remains deferred; #582 range correction is in live validation. #668 speaker-floor director implementation is merged, with installed acceptance open.

Architecture review pin: commit 6f4f025 (2026-09-24). Issues #616–#622 are that review. Live incidents (#615, #608, #624) stay unranked and may preempt this list on a show night.

How to use this file

1. Work the first unblocked Now item. Maximum 3 in flight.
2. New findings get a GitHub issue and an unranked row; the owner ranks them.
3. Close only after a merged fix meets acceptance, or an explicit owner disposition.
4. A fix awaiting live acceptance is not Done. A non-reproducing report is not a confirmed current defect.
5. Build/run guidance lives in CLAUDE.md; design documents are not work queues.

Priority remains show survival, diagnosability, real-show usability, then external installation. Build one source bus before adding more ingest paths. MXL stays parked.

Owner-approved on 2026-10-11: execute #802 production source preparation and expired-ready Program queue recovery, then require zero missed delivery slots while repeatedly loading the 1080p background in the designated test meeting. Preserve the existing session while building; restart/rejoin for candidate validation.

Now — owner-accepted order (2026-10-08)

Owner-ranked work on November 5 (status remains in the linked issues).

Issue	Work
#1118	Moderated Twitch chat next, using the provider design and test-first plan. Each exact version needs approval and a separate Show.
#1131	Make virtual-camera fixture permissions and no-file cleanup self-contained, preserve private slot isolation and report cleanup failures explicitly.
#1135	Reproduce and correct unreadable Graphics builder review captures; preserve geometry evidence separately and inspect 1360×768 and 1600×900 images.

Owner-directed active stability work: #960, reconnectable EngineHost with real opt-in WinUI/native consumer. This is one active item; dependent #961–#963 do not start concurrently.

Issue	Owner-ranked work
#1141	Seed the compiled camera test's inactive history file before the reader opens, preserve sample and pixel checks, and verify pacing with fixed clock ticks.

Owner approved the cross-subsystem isolation plan on October 12. Start its first real status/observation consumer under #870, then the focused #872/#873 crossings. Keep the existing #517/#823 installed delivery qualification and initiating-cause attribution gates; approval does not close them or displace the remaining issue-specific acceptance.

Owner-approved follow-up on 2026-10-10: implement #853, draw-first rectangle/circle scope ROI and collapsed precision controls, before further UI/UX slices. Preserve the running meeting. Zero missed delivery slots remains paramount; the owner is researching the #825/#517 misses separately.

Three lanes, at most one item in flight per lane and three total. Start with #835; the earlier operator-focus rows follow it sequentially. Owner UI/UX focus (October 5): pair #507 transport-layout safety with #759/#610 reporting for the first visible beta milestone; keep the rest of usability after settings/automation. Lane C acceptance can continue alongside that code work; new live failures can still preempt it.

Implementation and acceptance for these three areas are described in the operator reporting and behavior plan. That document explains how; this table remains the only ranked work list.

Owner direction 2026-10-03 after the show: start #517 under the render isolation and delivery specification. It was the active Lane A item ahead of #538. The owner subsequently approved desktop validation after the meeting and the completion plan. Camera attribution/repair and the #781 prerequisite shipped in merged #783; #780 and the capture reconnect fix #785 also shipped. The approved completion plan remains the qualification reference for #517, with installed rollback and failed evidence preserved. The October 4 owner focus below supersedes its code-work priority while the remaining acceptance stays open.

Owner approved prioritizing #804 on October 7 ahead of the remaining #802 admission/health work: isolate optional shell/multiview export API stalls from scheduled Program publication. PR #809 and PR #808 are merged; the failed intermediate cadence/source evidence remains retained. Remaining #802 producer and lifecycle work resumes. Installed validation may resume now that the owner reports the app closed; defaults remain gated by #517.

Owner prioritized #814 on October 8: implement the recording write-queue specification next. Implementation merged in #833 and shipped in installed beta beta-2026-10-08-51d6281; the owner's real-meeting bake is pending. Remaining #802/#823 delivery qualification and the separate #832 thumbnail mutex finding remain open.

Owner ranked #835 first on October 8: "It is my top rank." Deliver Basic/Advanced expansion, a shared native grade path, editable master/R/G/B curves and all three truthful scopes as the first usable slice. The grading portion of #764 is integrated into this work; its other settings findings keep their existing rank. Qualified primary controls, real LUT import/stack and reusable presets extend that same implementation. The source grading specification defines the design and acceptance contract linked from #835. New live incidents may still preempt the queue.

Order	Lane	Issue	Remaining work
RC blocker — October 23 live show	A	#1030	ISO participant leaving mid-recording wedged the recording lane. Fix PR (throttling off, no departed silence-fill, bounded track joins, honest loss text) built and tested on Windows; live acceptance: a participant leaves during a take, the file finalizes at its real duration, the next Record works without a restart.
RC — October 23 gate	A	#935	Software-encoder ISO admission notice failed the headless gate and was invisible to the operator. PR #1045: structured recording.isoAdmission, MEASURED encoder path (read back from the instantiated MFT) for Program and every ISO, operator InfoBar, validator/drill judge placement as a note and Program-on-software as a FAIL (owner D8/D9). Owner acceptance (plan Task 8): validator runs, stall run, 30-minute drill with -ProbeMaxSessions 8.
RC follow-up — October 23 live show	A	#1037	Render tick reads the Zoom roster and speaker before coreMutex; engine-mutex guardrail on the render gather (CI). Measured on the churn harness: render hold p99 8.9–17.7 ms to 2.8–3.4 ms. Live acceptance: no render.display-tick / cmd.handle worst attributable to the engine mutex in a show log.
#1037 follow-up — command lane	A	#1048	#1062 moved spine sync and Zoom snapshot engine work outside coreMutex and fenced the D17 trim prune. The follow-up reuses one roster per session or health response, resolves ISO names from the latest accepted roster, and exposes the guardrail total. Live acceptance: check the next soak's command hold attribution and guardrail delta.
#1037 follow-up — frame group	A	#1049	Draft PR on codex/rc-1049: the frame group is fetched before coreMutex, now the default, with COREVIDEO_RENDER_FRAME_FETCH=under-lock as the rollback. Stub-core A/B: median frame-age delta within ±0.14 ms. Under engine-mutex contention, hold p99 fell from 6-8 ms to 1.6-3.7 ms. Remaining: a live soak, then delete the under-lock path (the last AllowEngineMutexScope).
#1049 live evidence — October 25 soak	A	#1056	beta-2026-10-25-1f697ca, 30-minute clean-picture soak, 10 participants: one Program frame missed inside a 15,127 µs coreMutex hold at render.display-tick; over-budget ticks about once a minute, only the two longest cost a frame. Stream, ISO writers and camera publisher clean. Fails the outputs-only rule on one frame; write-up in docs/qa/rc-beta-acceptance-2026-10-25.md. The codex/rc-1049 draft PR adds [lock-hold-attribution], a per-phase breakdown of every over-budget tick, so no stack is needed. Acceptance: a 30-minute 10-participant soak on that build with zero program-buffer-miss lines. The procedure is in the #1037 design doc's #1049 addendum. 2026-10-30 drill on the #1062 build: three over-budget render-tick holds (worst 11.6 ms), all attributed to the program composite phase with zero engine-mutex wait, no frame lost (one media source, no Zoom feeds); the 10-participant acceptance soak is still owed.
Owner current — October 20 UIUX	B	#978	Graphics workflow clarity and preserved automation drafts; source/CPU-only and hosted checks during #975's quiet GPU window. Companion acceptance under #927/#593/#929 remains independent.
Owner review regression — October 19	B	#951	Reproduce full Studio footer clipping at 1080p; restore visible, non-overlapping production actions with compiled full-workspace geometry and renders.
Owner Sources regression — October 19	B	#956	Keep an unassigned input's unified picker enabled; prove repeated source reassignment restores its controls on the retained row without restart or unintended routing/output changes.
Owner review follow-up — October 19	B	#954	Correct stuck output status text and misleading configured readouts; remove redundant summary and align action/telemetry rows. Prove observed recording/local-stream progress reaches compiled controls.
Owner current — October 19 Graphics feedback	B	#927	Preview/starters merged in #950; review follow-up makes personalization live and joins saved starter adoption to explicit Studio assignment and navigation without putting graphics on air.
Owner current — Volt implementation	A	#926	Native template/instance consumer and bounded preparation with compatibility lower-third pixels.
Volt dependent — after #926	B	#927, #928	Complete workspace/migration and actual title/bug/clock consumers; activate only as dependency gates pass.
Volt dependent — after consumers/#761	B	#929	Scoped participant automation, rehearsal and manual override with native outcome evidence.
Specification merged; implementation ranked above	B	#924	Approved graphics specification merged through #925; implementation follows #926–#929 and their individual acceptance gates.

| Owner first — October 18 release blocker | B | #857 | Capture the failing worker read, fix its cause, validate installed activation and same-process recovery before publication; then integrate #945. | | Owner current — October 16 incident | B | #930 | Remove UI-paced media dependencies and reject false performance passes; validate all requested live inputs with recording and virtual camera. | | Owner current — October 16 | B | #922 | Add validated, persisted RTMP/SRT control actions with no restart, secret echo, automatic stream start or change to an active output. | | Owner current — October 15 | B | #916 | Diagnose select-to-first-present latency, reproduce the exact cause and fix it with API/offscreen evidence; keep the installed app/session untouched. | | Owner current — October 15 | B | #920 | Fix repeated active Join retaining retired SDK subscriptions and held frames; test lifetime fences and fresh re-subscription without desktop input. | | 1 — October 15 UI/UX | B | #591 | Finish stable-input scene creation and layout fallbacks, quick solo/two-person/share starters, preserved custom routes and fresh/upgraded profile evidence. | | 2 — October 15 UI/UX | B | #590, #882 | Sources assignment/offline clarity and identity-safe thumbnail removal/reassignment acceptance. Count one primary development issue per focused PR. | | 3 — October 15 UI/UX | B | #848 | Finish shared adjustment consistency and actual effect/persistence checks, followed by the approved existing lower-third, grading/ROI and navigation consumers. | | 1 — October 14 owner priority | A | #904 | Attribute the real-meeting Program-to-Multiview copy refusals, repair the demonstrated GPU admission/progress path, and qualify per-frame identity/deadline continuity. Cause analysis and repair gates. API-only control; no buffer/quality tradeoff or unsupported zero-miss claim. | | Acceptance | A | #872 | Stale device-start fence merged in #896 with green exact-head CI and deterministic stalled-stop tests. Physical device continuity and installed zero-miss acceptance remain open. | | 2 — October 14 | B | #882 | Per-source GPU publication, incarnation fencing and visible-page bounded export demand merged in #899. Native and managed regression coverage passed; actual packaged Sources-page removal, reorder, reassignment and reconnect acceptance remains open. | | Follow-through — October 14 | C | #873 | Bounded pre-drain resource staging and off-lock grade annotation are staged in #901, including admitted barrier ordering, explicit exhaustion, stalled-pump and shutdown coverage. Merge/CI and installed full-load delivery acceptance remain open. | | Acceptance | B | #889 | Color-binding guard and deferred inspector reconciliation shipped through #890/#892 in October 13 beta. Preserve crash evidence and finish issue-specific installed interaction acceptance; no new implementation is implied by the open issue. | | Acceptance | B | #883 | Root cause REPRODUCED 2026-10-24: a 5.1 helper inheriting a PowerShell 7 PSModulePath cannot resolve Get-FileHash. PR codex/rc-883 pins the helper's module environment (ruling D5) with a diagnostics log, adds the residual version-folder sweep that the registered pass cannot see (one shared metadata list; operator files such as Recordings\ MOVED to a dated backup with a manifest, ruling D4) and a folder-count report. Tests pass on both PowerShell hosts. OPEN: installed acceptance on a real upgrade (plan Task 7, owner): one version folder, one entry, camera and shortcuts on the new install, settings unchanged, summary.retained = 0, backup manifest covering the 12 recording files. Registered entry count alone is insufficient. | | Owner follow-up | B | #879 | Owner approved the Scene Builder workspace and Tiles controls on October 12. Implement the reviewed workspace, mixed-wall layering and controls together; preserve the bake and defer installation until the meeting ends. | | Owner follow-up | B | #884 | October 13 installed review: apply framing and Tiles opacity/background changes immediately to Preview without changing the source; qualify the visual controls through the native compositor and preserve explicit Take to Program. | | Owner follow-up | A | #802 | Owner approved October 11: enable completed source preparation in Windows production, isolate optional exports, repair expired-ready queue retirement, and validate repeated cold 1080p background loads with zero missed delivery slots in the test meeting. | | Owner follow-up | A | #853 | Draw-first rectangle/circle scope ROI, move/resize, cancellation, Clear and collapsed precision settings. Interaction contract. Owner approved this code slice on October 10; preserve live sessions and keep zero-miss delivery acceptance separate. | | Owner top | A | #835 | Advanced source grading: optional expanded workspace, truthful native preview/output path (grading portion of #764), master/R/G/B curves, histogram, waveform and vectorscope. Preserve existing grades, source identity, production cadence and quality; scope analysis must be bounded and asynchronous. Then qualify advanced primaries, real LUT import/stack and presets against the same native transform. | | Owner next | A | #839 | Owner requested a built-in OH Framer on webcam output only after the #835 review rendering, adding a live Program LUFS-S overlay on October 9. Specification. Preserve the supplied PNG alpha and clean Program/Preview/recording/stream pixels; persist an off-by-default camera toggle and qualify camera publication cadence. #835 implementation merged in #837; combined installed acceptance remains open. | | Acceptance | C | #814 | Recording write queues merged in #833; beta beta-2026-10-08-51d6281 is published and installed. Independent Program/ISO queues and Preparing-to-Recording behavior passed local and hosted checks. Owner's real-meeting bake remains open; record actual continuity and final-file evidence without claiming synthetic tests prove live delivery. | | Acceptance | C | #790 | Screen-share teardown callback reentrancy repair shipped; owner reports the installed screen-share test looks good. Longer live meeting acceptance remains. The historical incident priority does not displace #835 unless a new failure is reported. | | 0 | B | #507, #759, #610, #519, #765, #766, #551, #562, #758 | Accurate output/health reporting: distinguish connecting, sending and verified receiver playback; show measured counters and explicit unknown/unavailable states. Finish capture liveness, dropout and diagnostic evidence. Start with #759 and #507 transport stability; then #610 degraded status. | | 1 | B | #764, #763, #761 | Dropped settings and automation behavior: trace each operator setting to its core consumer and observable result. Address discarded settings, NDI group behavior, and Set & Forget / Magic Scene execution; distinguish the merged director slices from unbound automation. | | 2 | B | #587, #592, #593, #847, #591, #590, #594, #595 | Operator usability: stale Join URL, lower-third consistency, text persistence and appearance customization, useful starter scenes, Sources pruning, Health/OHG placement. #507 transport layout accompanies reporting above. Follow reporting and behavior work above, with the owner's October 9 quick-bundle and lower-third direction recorded above. | | 3 | C | Acceptance session | Beta beta-2026-10-04-92e6b1e is published. Continue running docs/qa/installed-acceptance-checklist.md once. Covers #732, #725, #724, #735, #668, #674, #608, #582, #568, #569, #581, #473 and the first live run of the 2026-10-01/02 fixes (#740, #739, #757, #758, #759, #760). Record PASS, FAIL or MISSING_EVIDENCE per row on its issue. | | 4 | A | #517, #781, #784 | Render/camera and capture fixes shipped in #780, #783 and #785. October 6: new live underruns and monitor shedding with isolation disabled; matched synthetic recording A/B corroborates the source-export bottleneck and shows benefit from isolation, without full qualification. Owner requested the updated spec and completion plan. Remaining: complete/qualify isolation before its default change, measured combined delivery, installation/fleet lifecycle and real capture/receiver acceptance. #781 (October 24): the installer Frame Server refresh is implemented (PR for #781, unit/fake-seam tests green); its installed upgrade acceptance (new serving DLL from a new FrameServer PID, plan Task 7) is owner-run and not yet done. Earlier favorable two-hour bake observations remain recorded, not a waiver of the new failures. | | 5 | B | #762, #741 | Merged: the shell refuses Engine on, Record or Join from the core profile with a named reason, and the core refuses Record on a failed encoder and Join with no engine (docs/reference/core-on-air-policy.md). Remaining: first installed run. | | 6 | B | #754 | Request-only handshake and recovery fixtures hardened in merged #902: actual handshake request bounds, readiness-driven startup and per-outcome status/health evidence. Focused 12/12 and full 2,395/2,395 MediaCore tests passed; retained hosted failures do not establish the original intermittent cause. Preserve exact one-outcome/new-roster assertions and recurrence evidence. | | 7 | A | #538 | Previously prioritized September 29; resumes after the operator-focus sequence: one shared hardware Program encode for RTMP/SRT/HLS, compositor-clock video, sample-counted audio, bounded mux queues, decoded sync evidence. #703 (YouTube audio lag) closed as resolved by the owner 2026-10-02; #605, #606, #602 and #612 are done. Remaining is the parent: shared hardware encode evidence and decoded sync across destinations. | | 8 | B | #701, #624, #750 | Live-show media defects. #705 closed 2026-10-03 (media audio reaches Program on current main; the headless harness proves it). #701 now has a per-source frame-delivery trace in mediaSources[] and scripts/qa/media-delivery-trace.py; the reproduction with the owner's clip in a live meeting with a recording running is the next step, with #624 in the same session. #750 needs an owner ruling (latest run: audio lags video by 26 ms median). | | 9 | C | #657 | Qualify the merged control-state slices in an installed live meeting; folded into the acceptance session. If real guest transitions are unavailable, record MISSING_EVIDENCE. | | 10 | A | #536 | Finish honest RTT and codec/packet decode-error health, then validate failure and recovery. Ingest status now reaches the UI (#760). |

Deferred by owner

Issue	Status
#513	Owner reports an overnight run with no recurrence and will validate later. Pooling/teardown fixes and the earlier 151-minute soak remain evidence of reduced exposure, not root-cause closure. Not a blocker for #535.
#618	Owner paused private Zoom SDK CI provisioning pending research. The non-stub Windows adapter compile lane passed in #643; real Zoom CI compile still reports MISSING_EVIDENCE. Keep open. 2026-10-25 (CI sweep A): the Windows production lane exists and is green on main (native-production-windows, COREVIDEO_STUB=OFF plus the shipped adapter flags, run 40256869553); hardware tests that self-skip print MISSING_EVIDENCE. Only the real-Zoom compile remains, blocked on the unset ZOOM_SDK_URL secret (the run prints MISSING_EVIDENCE). Keep open for that and for companion/worker coverage.

Next — in this order

Owner-selected first outcome within the stability initiative: UI-crash survival. Run its slices sequentially once that development lane is activated; existing Now work and the previously ranked Next rows below retain their relative order.

Stability dependency	Issue	Remaining work
Outcome / acceptance parent	#959	Keep the committed show running across UI failure; close only after all child gates, not on a plan or a process staying alive.
Active in Now by October 19 owner direction	#960	On-demand EngineHost, bounded reconnectable control and real opt-in WinUI/native consumer; preserve epochs and output sessions across UI termination.
Depends on #960	#961	Move live synchronization, committed state, control ingress and recovery authority outside WinUI; reuse #657 contracts.
Depends on #960/#961	#962	Move compatibility camera capture into a host-owned helper and prove actual fallback media survives UI death.
Depends on #960–#962	#963	Matched packaging, safe stop/update/rollback and receiver-verified full-workload crash qualification; cross-gate #930/#517/#904/#908/#857.

Live issue reconciliation for this plan: #873, #870 and #947 are closed and are retained groundwork, not new implementation dependencies. Older historical rows remain historical evidence; GitHub carries authoritative issue status.

October 14 follow-through: #873. The bounded pre-drain staging and off-lock grade annotation follow-through is staged in #901. Complete merge/CI and installed full-load acceptance, then return to the remaining order below.

Order	Theme	Issues	Remaining work
0	External install	#423, #424, then #433, #434, #435, #436, #437, #441	Certificate and the Zoom redistribution answer have lead time and are the owner's to start now. Current beta is still unsigned.
1	Cold media Take	#449	A never-cued clip cut to Program still cold-starts into the warming slate. scripts/qa/media-take-ab.py --skip-cue is the falsification control.
2	Cleanup, opportunistic	#768, #611, #505, #512, #649	Only when already touching the seam. #768 also carries the two #738 follow-ups: move the Zoom config JSONs out of src/, and remove studio/ once scripts/app.ps1 no longer builds the core through build-studio.ps1.

Owner rulings outstanding: #743 with #767 (owner direction 2026-10-02: remove the mock licensing and caption panels and the stub services for beta; deployed workers are deleted only on explicit confirmation), #750, #427, #425, #426.

Unranked — show survival and operator findings

• #1088: WinUI adapter conformance has a stale nameplate golden and Windows CI skips the test without a built show engine.

• #1114: Owner-reported Graphics drag feedback. Keep private artwork visible and show completed native revisions while moving or resizing it.

• #1117: Owner-run controlled YouTube chat acceptance. Operator check.

• #1119: Moderated X posts. Confirm project access, budget and deletion evidence before live use.

• #1120: Moderated LinkedIn organization comments. Confirm Community Management access and selected post permissions.

• #1121: Deterministic social moderation races, replay and source replacement.

• #1113: Owner-directed Graphics Phase 3 Slice 6. Review and approve each social item before Show, starting with one public YouTube live chat. Spec and implementation plan.

• #1125: Windows CI intermittently exhausts telemetry consent file replacement retries under synthetic reader contention.

• #968: intermittent decoded PCM gaps found during #960 full Studio crash qualification; blocks its audio-continuity evidence. Owner-authorized October 21 within active #960; retain failed trials.

• #1108: Windows monitor presenter tests can miss fixed timing thresholds despite delivering real pixels.

• #1106: Graphics Phase 3 Slice 4. Typed per-row values and exact data revisions for Shot Layouts, with preflight and one guarded Take. Spec and implementation plan.

• #1110: Graphics Phase 3 Slice 5. Custom API push and pull, reconnect and safe publication. Social adapters and per-item approval continue in #1113. Spec and implementation plan.

| #1070 | Catalog scenes (Intro through Closing) had no delete option (owner, 2026-10-31 live-show prep). codex/scene-delete-1070: any scene that is not on air and not the last scene is removable, catalog or custom; removals persist (RemovedCatalogSceneIds, prefs v15); New scene gains Panel grid + Closing starters and a Restore starter scenes action (scene.restoreStarters); Magic Scene presets fall back to the first scene; the outputs drill verifies its scene via scene.list before cueing. Not live-verified; docs/reference/scenes.md. | | #1076 | Graphics tab not usable (owner, 2026-10-31). Owner approved the playout-model mockups the same day ("lets try this"); codex/graphics-playout-1076 builds the spec's Phase 0 + playlist half of Phase 1 (docs/titler-service-spec.md): playlist with Play In / To Preview / Play Out and hotkeys, Guest name multi-entry from Sources, On Air strip as one truth with the buses, Playout vs Design toggle, compact playlist in the Studio console, control-API graphics.* actions, Shot Layouts first cut. Owner review with test sources next; docs/reference/graphics-playout.md. | | Graphics Designer (titler spec Phase 2, 2026-11-01) | Spec: 2026-11-01-graphics-designer-phase2-design.md; one PR per slice, in order. Slice 1 Designs (codex/graphics-designer-slice1): designs in the show document (schema 3), four blank seeds, start from a look, save as a new version, duplicate, delete (refused while the playlist uses it), install on demand + reinstall on core restart, native graphics-template-remove, Variables panel, Save to playlist; not live-verified. Slice 2 Designer (codex/graphics-designer-slice2): the Designer (layers panel with hide/lock/rename/drag/group/ungroup/add, canvas with safe-area and centre snapping (Ctrl places freely) and Typical / Longest name / Empty title samples, per-layer inspector, Undo / Save / Save to playlist) replaces the old workspace's layer pane; the builder gets Open in Designer and Cues & automation (the old workspace minus layers and design actions); a design's playlist row opens in the Designer; #1087 N1-N5 and (c) fixed, (b) moves to Slice 4; not live-verified (drag/drop, rename, snapping and the preview lease never run against a core). Slice 3 Motion (codex/graphics-designer-slice3): per-layer In/Out, presets, motion strip, private Play preview, and versioned motion from Operate. Covered by automated checks; installed show workflow not live-verified. Slice 4 Content (codex/graphics-designer-slice4): ellipse, line, strokes, text outline and shadow, content widths, PNG/JPEG/SVG import and revision-pinned assets. Encoded asset eviction preserves leases (#1087b). Installed Program workflow awaits live verification. Slice 5 Sources columns (codex/graphics-designer-slice5): show-scoped slot values, row mappings and names-list CSV extra variables. Installed Program workflow awaits live verification. docs/reference/graphics-playout.md (Designs). | | Graphics Phase 3 Slice 1 · #1096 | Owner-requested local CSV/JSON data, native tables and leaderboards, and explicit publication in Operate. Spec and implementation plan. Installed acceptance remains open. | | Graphics Phase 3 Slice 2 · #1098 | Native crawl from local data, private Cue and Program Take, playback controls, and loop-boundary publication. Spec and implementation plan. | | Graphics Phase 3 Slice 3 · #1103 | Remote HTTPS feeds for graphics, freshness and last-good Program behavior. Spec and implementation plan. | | #1071 | Tiles admits local sources (owner, 2026-10-31: "add local sources to Tiles"). PR #1081 (codex/tiles-local-sources-1071): eligible = video-on Zoom + every IN-SHOW slot bound to a local capture source (TilesLocalSourcePolicy); routed mode unchanged; manual slots/never-show take canonical local ids without roster resolution and go stale when the source leaves the show; Members picker lists them under Camera/Screen/...; core admits a local member on hasFrame alone (tilesMemberAgesOut: only Zoom ages out on a frozen frameId), to be folded into #1074's hold logic. Media members deferred: the core opens media only for scene routes (needs the asset path on the tiles wire). docs/reference/tiles-composed-source.md. Not verified live. | | NDI output independent of streaming (2026-11-01) | codex/ndi-independent-output: NDI has its own persisted on/off, footer tile and transport.ndi.* actions, and runs without Stream/Record; stream edits never restart it (native pin AsyncOutputSender.RemovingTheStreamDestinationNeverInterruptsNdi). Spec: 2026-11-01-ndi-independent-output-design.md. Open question: a separate NDI format (today it uses the stream output profile). Not yet verified on a live NDI receiver. | | #1072 | Lower third on Preview did not follow the Take: two pipelines (legacy Program-only key:lower-third overlay vs native graphics instances per bus; the Take copied routes/overlays/captions, never graphics). Fixed on the #1076 branch at the bus: GraphicsInstances::promoteCuedForTake() from beginTakeTransition (cued, ready, rideTake instances show from cue and leave Preview), show-from-cue clears the cue, uncue for Remove; Studio LT button routes into the playlist Guest row. Live acceptance owed in the owner review. | | #1074 | Tiles dropped participants during 1-2 s network stalls that also back-pressured the stream (owner, live show 2026-10-31). Not core render, not subscription churn: Zoom video and the RTMP pipe stopped together, pointing at the uplink. Draft PR #1082 on codex/tiles-hold-1074: a stale zoom: member is HELD (slot kept, held + showing: picture|black in tiles.members[], counted in heldCount/blackCount) until kTilesHoldWindowMs = 4 s instead of dropped at kTilesStaleFrameMs = 1.5 s; dropped on video-off/departure at once; local members never age (same predicate as #1071/#1081); footer FEEDS line Stream ... behind and N Zoom feeds stalled from snapshot fields only; streaming page recommends a lower bitrate / wired uplink. Owner decisions open: the 4 s window itself (#427 still owns the tile-staleness ruling). Already true, not a question: a zoom: source with the black dropout policy goes black on air at 1.5 s inside the hold (the slot stays held until 4 s and the snapshot says showing: black); if the owner wants a held slot to keep its picture regardless of policy, that is a compositor change. Not watched on a real stall. | | #908 | Owner-ranked October 14: follows the #517 camera-reader repair in the active delivery lane. Retained Program frames report unavailable/preparation-stopped source pixels during real SDK epoch transitions; preserve pixels through replacement readiness without retaining removed/reassigned guests. |

| #906 | Attribute the Windows GradePreviewCoordinator disposal-test timeout; preserve the failed gate and verify the initiating condition. Owner rank pending. Sweep B (draft PR, branch codex/ci-flakes-b): no repro in 88/88 local runs (single and 4-way parallel); test wait widened 3 s to 30 s for the thread-pool timer (no assertion relaxed). Initiating condition on the CI runner remains unproven; the owner closes. | | #907 | Identify the native stub TSan gate hang with bounded per-test progress; timeout is not a reported race. Owner rank pending. Sweep B: the missing per-test marker is already on main (RUN markers, 900 s CTest timeout, 28bdf471); no hang since in recent main CI. The three latch waits in the JsonRpcServer response-assembly tests are now bounded so a never-reached latch fails by name. Exact original hang still unproven. |

These can preempt Next on a show night. They do not jump the ranked Now item until the owner says so.

Issue	Remaining work
#1042	Found in #935 Task 1 (2026-10-24): an 8-ISO 1080p60 take armed while the 1080p60 capacity prewarm was still pending, so placement used the unprobed 8-session fallback (7 hardware + 1 software spill) on an RTX 4090 that probes sessions<=9; the late probe result was discarded as overlapping live encoding. Not fixed by #935 (probe semantics out of scope). Implemented on codex/rc-1039 (draft PR, unmerged): start waits up to 5 s for a probe configureRecording already launched (EncoderCapacityCache::awaitProbe, never starts one) BEFORE the take goes live; structured isoAdmission.armWaitMs/armWaitOutcome; audio shed behind the wait is startup loss, not a blocked writer. The 5 s bound is an owner decision. Never run on the 4090 rig with the real probe.
#1039	Found writing the #856 spec: the crash-offer scanner and the support bundle only looked in %LOCALAPPDATA%\CrashDumps, but the installer (#433/#1033) points WER LocalDumps at %LOCALAPPDATA%\CoreVideoPro\crashes, so installed-machine dumps were never offered or listed. Implemented on codex/rc-1039 (draft PR, unmerged): CrashDumpScanner.ResolveDumpDirectories reads DumpFolder from the 64-bit HKLM view (per exe, then the global key), expands it, falls back to the installer default, keeps the per-user folder, de-duplicates; the support bundle dumps.txt lists every folder. Unit-tested against temp folders only; owner step: one real dump on an installed machine must produce the crash offer (needs the #433 installed acceptance).
#915	Node package fixture uses filenames rejected by the production validator. Repair the fixture contract without weakening validation; the actual October 15 beta archive passed.
#920	Repeated active Zoom Join can retain stale subscription bookkeeping and held video; explicit Leave/Join/Engine On restored eight inputs in API reproduction. Needs owner rank and causal ordering regression.
#919	Deferred participant-list clear/rebind can access XAML after its window closes; caught during isolated #916 teardown, unrelated to proven live-video cause. Needs owner rank.
#903	Preserve truthful monitor underrun totals across mute/disable/reenable and distinguish intentional suppression from starvation. Packaged and installed control trials retained; physical continuity remains unverified. Owner rank pending.
#947	October 18 release-validation follow-up under #930: strict absolute-boundary phase test missed the next monitor result; two deadline-bearing monitor workers lack scoped video scheduling. Preserve failure and thresholds; validate role-specific correction with grade previews left background. Related historical timing intake #898 remains distinct.
#898	Mode-correct Release GPU fixture exceeded its 10 ms isolated Program completion bound in a fixed-phase trial on the reference RTX 4090. Retain the failure and measure actual submission, completion and consumer deadlines; consecutive pixels alone do not prove on-time presentation. Unranked intake, separate from the merged #869 fixture repair.
#876	The #870 development meeting interval had zero measured Program-buffer losses, but the Program clock continued emitting source-stage misses during owner teardown after production stopped. Audit the explicit output terminal/drain boundary; retain on-air failures and separate cleanup evidence. Unranked intake.
#877	Native QA's Python JSON-line driver selected Windows cp1252 and failed on valid UTF-8 output. Make protocol decoding explicitly UTF-8 and preserve bounded reads/cleanup. Harness defect; not evidence of an SDK crash. Unranked intake. Sweep B: fixed. Core pins encoding=utf-8 (errors=replace); a UTF-8 response with bytes undefined in cp1252 now reaches its request (test fails before the fix on cp1252).
#878	WGC window discovery returned Windows ANSI title bytes inside UTF-8 status JSON. Unicode title conversion and an actual-window regression test are included in #875 under the approved #870 response contract work; installed verification pending. Separate from #877 and not an SDK crash. Sweep B: already fixed on main by #875 (GetWindowTextW + UTF-8); WgcScreenCapture.WindowTitlesAreUtf8RegardlessOfWindowsAnsiCodePage passes here. Installed status-polling verification still pending.
#864	Owner requested root cause and repair plan for the low-rate multiview Program cell. A/B/A diagnostics confirm keyed-mutex timeout starvation. Implement the completed-snapshot handoff specification and validate Program-cell pixels independently; exact first bad release remains unqualified.
#865	Owner requested installer upgrade retirement and cleanup of accumulated betas. Commit the new installation before retiring verified older payloads/Apps & Features entries; preserve running versions, user files and new webcam ownership.
#856	Installed October 10 beta lost the local Zoom helper at 09:06:24 EDT while shell/core stayed alive. No matching new WER event/dump; exit/IPC cause remains unproven. Capture child exit status and identify the causal path; no network-only or #790 attribution established. Unranked intake.
#857	Recovery retry and fresh user-hive reads merged in #894 and are installed in beta-2026-10-14-e1d355a. Installed ownership/startup checks passed; controlled same-process recovery delivered 300 OS-receiver samples. Original false ownership trigger remains unproven. Independent installed continuity failure remains under #517; keep attribution open.
#834	Windows CI app-exit trace reader can hit a sharing violation while the child appends to trace.txt. Initial main CI failed; unchanged-head retry passed. Make the bounded trace wait tolerate concurrent writes while preserving cleanup assertions. Unranked; not a confirmed production regression. 2026-10-25 (CI sweep A): fixed in the sweep-A PR: trace reads share read/write/delete and retry conflicts within the existing bounded deadline; two new tests fail with the original IOException on the old reader.
#825	Disabled-preparation/inline qualification lost six packets in three pairs: a late Preparing head became expired Ready and remained at the following deadline. Suspected wait-predicate amplification needs deterministic real-GPU reproduction; does not establish why the first preparation was late. Unranked; current #802/#823 work continues.
#823	Remaining owner-approved #517 delivery diagnostics: bounded per-frame trace, native/C#/Swift observations, source/output identity and latency attribution. Continues the parent qualification scope after #802; no independent rank or default change.
#832	Optional Zoom thumbnail event packaging holds the Program frame-fetch mutex for 12–13 ms. Measured overlap and source evidence support moving complete event packaging off-lock with stale-generation validation. Unranked; separate from recording backpressure.
#798	Hosted fake-core initial zoom-snapshot request timed out before polling assertions in #792 CI. Exact PR full suite and targeted hosted rerun passed; failed job retained. Attribution unknown, distinct from #754; needs owner rank. 2026-10-25 (CI sweep A): no repro. The poll class passed 30 of 30 reruns (6 cases each) beside CPU load and the full 2,672-test MediaCore suite passes; no production timeout changed. Left open as unattributed (hosted-load, one occurrence); next failure should capture the fake peer trace.
#802	Approved #517 CPU fallback boundary after merged #797/#801. Merged #805/#806/#808 implement format coexistence, SHM BGRA, decoded I420, strict ready-only admission and sampled source-health evidence. Native UVC arrival/query progress merged in #810; media/still preparation in #812; WGC CPU fallback in #813; same-adapter consumer recovery in #815; browser in #816; NDI/SRT/RTMP decoder arrivals in #818. Capacity reasons and drained-owner recovery merged in #819: 1,503 native tests and 17 final-head CI checks pass, including real 512 MiB refusal/recovery and retained-read tests. Network stalled-held refresh merged in #820; bounded cleanup of expired pending tokens merged in #821. Real local SRT/RTMP before/after recovery tests, 1,506 native tests and 17 final-head CI checks pass. Physical device/adapter recovery, actual latency and installed/receiver/display/A/V qualification remain; WGC sampled age is unqualified. Preserve source playout/guest trim, CPU/ISO and identity. No independent rank change.
#804	#517 measured follow-on: GPU-ready Program packets expired during scheduled shell/multiview export calls (16.6–19.4 ms); retained losses fail release qualification. Owner-promoted repair merged in #809; six matched trials and full native/CI pass. Receiver/display, installed/fleet and lifecycle qualification remain. Remaining #802 work resumes.
#811	Physical native MF HD60 S+ reconnect negotiated 1080p60, then failed before new frames with 0x8007001F during #802 qualification. The same failure reproduces with preparation off in both the candidate and installed October 5 beta. Initial capture passed; failures are retained. Attribution remains open. Unranked; does not independently preempt #802.
#807	macOS Metal full native CI suite segfaulted on #806 after focused checks passed. Attribution unconfirmed; retain the failed trial, identify the test/stack and verify exact-head CI. Unranked; does not replace approved #802 work.
#782	Windows supervisor disposal queried an already-disposed Process in the crash lock-order CI test. Captured stack and run; attribution and focused fix need owner rank. 2026-10-25 (CI sweep A): the exception that failed the run is fixed in the sweep-A PR: DisposeChild called Process.HasExited on a Process that never associated (a failed Process.Start leaves it in _process; a disposed one behaves the same), which threw out of Stop/DisposeAsync. That exception was the mask, not the cause: it hid an earlier failure of the lock-order test, presumed to be its 10 s concurrentSync wait timing out under thread-pool starvation on the hosted runner (unproven). The test's two workers now run on dedicated threads; three regression tests cover the disposal path. 2026-11-06: closed after inspecting all five actual crash-lock/disposal results in the Windows TRX from run 42262314135; every case passed. The presumed masked-timeout cause remains unproven.
#784	Screen/window capture flashes after asynchronous WGC lifecycle change: the shell rejects connecting and auto-retries, repeatedly restarting sessions. Fixed in merged #785 and beta beta-2026-10-04-92e6b1e: accepted pending requests are preserved and repeated connect is idempotent. Owner visual check was positive; installed capture alongside streaming acceptance remains.
#735	Fixed: the CPU-fallback stream path delivered nothing from 2026-09-30 because shared-AAC routing withheld PCM from a sender that was not on the GPU path. Remaining: RTMP was not tested separately from SRT; owner acceptance on a machine without a hardware encoder.
#701	Media playout video can stutter or freeze during a live show; identify decoder versus presentation. Had no row until the 2026-10-02 review.
#732	Recording resumes in a new folder and the stream reconnects after the media core restarts (owner rulings 2026-10-01 and 2026-10-02; PR #746). Remaining: owner acceptance on an installed beta; the stream reconnect was proven against a local SRT sink only, not RTMP or a real platform.
#728	Frame-sized allocations drop a frame instead of terminating the core, proven under a real per-process commit cap at 600 and 300 MB. At 400 to 500 MB the core still dies in Windows thread start-up, which nothing in the core can catch. The core now publishes systemMemory and logs when the machine runs low. Remaining: show that warning to the operator; what exhausted memory on 2026-10-01 is unknown. Owner has not assigned a rank.
#724	Program lost two slots whenever a source, stream or recording was first exported: the render thread created a D3D device (13 to 21 ms). Every export (participant, encoder, multiview, preview) is now created off that thread, and the recorded harness fails on any missed Program slot. Remaining: owner acceptance on an installed beta with a real media Take; the 4-6 slot stall first reported did not reproduce on any build (0 of 42 sessions).
#750	Recorded A/V harness: media audio lands 13 to 18 ms after video, straddling its one-frame limit, so its A/V verdict fails about one run in four. Two sessions in 14 read 34.5 ms. Needs a ruling on whether the steady offset is expected. Owner has not assigned a rank.
#725	Root cause fixed in #727: the shell rejected a respawned core's roster. Owner acceptance on an installed beta remains.
#668	Slices A–D merged (#670–#673): unique guest bindings, host exclusion, talk ledger and Set & Forget holds. Installed host-plus-three-guests, interview, solo and share-priority acceptance remains.
#674	Slices A–F merged (#675–#680), including direct negotiated-format facts and existing Multiview texture crop. Installed no-click video-off, ISO arm, Engine-off transitions and ten-row GPU load remain acceptance; reopened after an early close.
#473	Installed beta ProRes media decoder shows a placeholder while the same code works in a dev launch; reproduce and fix the installed path.
#652	Matched A/B found GoXLR live skew near −240 ms on both accepted beta and prior main, while recorded Program stayed near −20 ms. #655 reduced live skew to −46.2 ms with zero underruns/lost samples over 24 s; real-human and long-show drift acceptance remain.
#649	RTMP demuxer test compares const char* literal addresses; use content comparison so Debug native gate is deterministic. 2026-10-25 (CI sweep A): fixed in the sweep-A PR: all four assertions compare std::string_view content; mutating the av1 demuxer name turns the test red.
#615	RTMP packet amplification is measured and coalesced. Encoder frames that never reached the shed counter are retained (main 61e83ed1). The original PC-wide outage and full-show continuity still need fleet acceptance.
#627	Per-participant audio delay. Capture devices already have setAudioSyncOffset; a Zoom guest does not. Headless clap on the Zoom-audio mailbox build measured one pipeline skew (median -39.0 ms, audio lags video), not a per-person offset.
#608	Root cause isolated: Zoom source mute was copied into durable core mixer mute; #656 fixed that copy. Installed recurrence and natural guest mute/unmute convergence remain unverified; track with #657.
#624	Recover a subscribed Zoom video feed that stops advancing in Tiles.
#599	After the #597 stream stall, Zoom Meeting panel stayed hidden on display 2. Targeted restore worked; need a reliable operator path. Causality with #597 unproven.
#610	Operator-facing degraded-stream readout. Consume the generated observation model; do not hand-write a fourth snapshot.
#590	Simplify and prune Sources for live operation. Coordinate with #505 and #588.
#681	Global Zoom camera resolution request and selectable local maximum frame rate (15/24/25/30/60 fps); preserve actual input Format and verify both choices, churn, and persistence in a real meeting.
#682	Local Windows test:gate App integration worker intermittently stalls; PR #683 CI integration passed, so reproduce and bound before calling this a CI blocker. 2026-10-25 (CI sweep A): obsolete. vitest.integration.config.ts and src/App.test.tsx were deleted with the React prototype (#745); npm run test:unit now finishes in under a second and no integration step remains.
#591	Rework starter Scenes and scene creation; owner sees the same source repeated in defaults.
#592	Lower-third second line refreshes as “Guest” / brief lowercase “g”.
#593	Persist per-source lower-third name and editable secondary line.
#594	Move Health into Settings; replace Diagnose label.
#595	Shipped in PR #843 (Settings opt-in, off by default). Remaining: installed acceptance of restart, disable-while-selected and configured-show preservation.
#565	AV1 streaming explicitly refused until a playable packaged receiver-side stream exists.
#588	Local display/window capture as a first-class Program source.
#582	Speaker-change brightness flashes. Content-aware range correction in live validation; CI and shipping remain.
#587	First Join after editing the meeting URL used the stale placeholder number.
#568	Installed operator sequence: AV1 refusal → explicit HEVC retry without app restart.
#581	Zoom window appears slower than Program; owner validation pending.
#569	H.265 streaming needs repeatable installed receiver acceptance.
#575	Scheduled staging smoke blocked on missing Actions secrets. Not #618. 2026-10-25 (CI sweep A): owner action, not code. Repo Actions secrets hold only CLAUDE_CODE_OAUTH_TOKEN and CLOUDFLARE_API_TOKEN; smoke-staging.yml fails at its first step ("Missing required staging secret COREVIDEO_TELEMETRY_API_KEY", run 40214122167 and every daily run since 2026-10-20). Also note the telemetry/ops hostnames do not resolve yet (owner checklist steps 1 and 5), so adding the key alone may not turn it green.

Unranked — half-wired features (2026-10-02 audit)

Found by reading code on main; none reproduced in the running app unless its issue says so. Order is a suggestion (most likely to hit a normal show first); the owner ranks.

Issue	Remaining work
#758	A disconnected bridged capture device stays on Program as a frozen frame: the shell never sends unregister-capture-shm and the adapter re-emits its last frame. Blackmagic-named UVC devices are forced onto this path.
#759	Output status reads "Live" while the sender is still starting. Stream-only sessions on a current core run the shell's "legacy core" branches because the core omits recording.lifecycle.
#762	The shell accepts any core. A stub encoder (Record shows live, no file written) or no-op compositor in a real build is silent; NativeMediaCoreProfileValidator has no caller. Pair with #741.
#763	PR #1023: ndiGroup reaches p_groups, sender recreated on change. Not verified on a receiver with a group filter.
#761	PR #1021: autoProduction.slotBindings bound and mapped; unit-tested to the coordinator, not live-run.
#764	PRs #1021/#1023: echo-only brand-kit fields, route audioRole, strip inputLevel, ptz removed from both ends. LUT presets were a stale claim; the GPU grade shaders apply them and they stay.
#765	LIVE clock fixed in #792; PRs #1023/#1021: network quality from the SDK (absent until reported), roster audioLevel and caption latency/confidence removed, fallback meters from DSP.
#766	PRs #1021/#1023: first-frame evidence from frame events/spine counters only; empty bundle sections dropped; roster epoch/revision bound; media-mix warning only when true.
#767	PR #1021: License & Plan panel, caption style controls and the no-op OHG title removed; caption cues stay.
#768	Dead code: test-only fail/recover/simulate commands in the production protocol, breakout detection wired only to its simulator, an unused 935-line Zoom SDK adapter, unreferenced C# types. 2026-10-25 (CI sweep A): deferred, not attempted. Gating the test-only commands behind a fault-injection flag and deleting the Zoom adapter touch the protocol, WinUI and the core link line; too large for a hygiene sweep and needs an owner call on breakout detection (feed from SDK or remove).

Unranked — mock code in the shipping path and repo cleanup (2026-10-01 audit)

• #1127: The bundled native runner executes fixtures when asked to list test names.

Found by the 2026-10-01 cleanup audit. Order within this table is a suggestion; the owner ranks.

Issue	Remaining work
#743	PR #1020 removes both stub services and their smoke/deploy references. Owner still has to delete the deployed corevideo-licensing-api and corevideo-caption-broker workers, the LICENSE_KV namespace and the two Actions secrets.

Unranked — open issue inventory restored in this audit

These linked issues already existed with the backlog label but had no row in the sole work list. Their order in this table is not a priority assignment.

Issue	Remaining work
#607	Encoder/sender correctness: the bitstream queue caps are memory bounds used as a latency bound; give it a measured latency bound.
#611	Move test-only virtual methods out of IOutputSender when touching that seam. 2026-10-25 (CI sweep A): done in the sweep-A PR: five seams moved to IBitstreamQueueTestAccess (BitstreamQueueTestAccess.h), reached through createRtmpOutputSenderForTest(); IOutputSender carries none.
#524, #525	GPU encode writer isolation and later recording/ISO/macOS adapter slices; separate from current edge I/O.
#505, #512	Vestigial Sources border controls and residual Tiles-wall polish.
#457, #444, #446	#457 closed 2026-10-23 (owner ruling D12): the post-Exit dispatcher drain fixed by #462; 7 long in-meeting closes, 0 recurrences, dump not retained. Standing gate scripts/qa/graceful-close-check.ps1 added; its live 30-minute in-meeting run is not done yet (owner). #444 churn/resize soak and #446 live Take soak evidence remain.
#443, #445	#443: first live shakeouts 2026-10-25 (local sources, 90 s) found four harness defects, fixed in the drill-fix PR: transport.engine.set refused outside a meeting, refused-action reason dropped, one-ISO list unrolled to a string (judge printed one row per character), no early refusal for an unplugged webcam; the run itself was blocked by the HD60 S+ being a phantom PnP devnode (CM_PROB_PHANTOM, status Unknown: not enumerated at all, so no harness change can ingest from it; re-seat or replug). scripts/qa/outputs-drill.ps1 merged in PR #1024 (unit-tested only; the live run and the preferences restore against a running app are unverified). 2026-10-26: the owner's camera rig is off the bench, so the drill gained -NoWebcam (Webcam source NOT EXERCISED in the summary, no local ISO) so the stamps-on run can go ahead without it; 2026-10-30 owner ruling: its Program source is a staged 1080p60 motion clip from the media bin (-MediaClip, scripts/qa/outputs-drill-clip.ps1), never a screen capture, after the first complete 30-min run (outputs 108034/108034 x3 PASS) failed only its progress rule on a dark, static display. #445: written audit docs/qa/engine-off-teardown-audit-2026-10-30.md (2026-10-30, code at 157add46): rules 2, 3, 5 hold; rule 1 partial (kill paths skip the ordered engine exit; graceful app exit attempts it with a 1 s cap); rule 4 partial (leave-meeting/respawn no longer stop the core; one UI-thread Stop() from the bridge health change); the stdin-EOF teardown finalizes encoder sinks after the engine inside the 2 s grace; reference doc corrected. 2026-10-30 21:10 EDT: first stamps-on verdict on a shipped beta, PASS (beta-2026-10-26-f969935, media-clip source, 30 min, 108,036 frames per output, zero defects; docs/qa/rc-beta-acceptance-2026-10-26.md). Remote-feed/ISO/webcam rows still to run.
#447	Persistent-source migration reconciliation.
#450, #451	Deferred OHG screen integration and live scene-canvas editor design.
#439, #442	#439: GPU-tier defaults implemented (PR for codex/rc-439, owner ruling 2026-10-23): GpuTierPolicy maps the GpuTierProbe band to canvas default/ceiling (under 8 GB: 1080p; 8-16 GB: 1080p default, 4K selectable; 16 GB+: 4K default) and tile ceiling 9/16/25, capped at the product's 10 Show Input slots (so the 16/25 ceilings are not reachable until the wall supports more than 10). Defaults apply only to never-saved profiles; saved values are kept and logged as gpu-tier-defaults tier=... override=... in launch.log; Settings has an "Allow settings above this GPU's recommended limits" switch; unknown VRAM = under-8 GB plus a visible notice. Settings shows the measured tier, ceilings and the 10-slot cap; 1440p counts as above the 1080p ceiling. Unit-tested only (the view-model wiring is not covered by a headless test); not run on real 4/8/16 GB hardware, and the telemetry payload itself is unchanged (it already carries the tier band; the override flag is log-only). #442 reference-hardware sweeps remain open.
#433	PR #1033 open; installed acceptance pending (2026-10-23): installer registers the camera, writes HKLM WER LocalDumps (full, 5, %LOCALAPPDATA%\CoreVideoPro\crashes; owner-approved, non-fatal if refused) and creates the recording folder. Acceptance = one real elevated install showing the keys, the folder, and a dump landing; see installer.
#434, #435, #436, #437	Production telemetry endpoint, beta access, OAuth broker, and signing integration gates. #434: code done in the production-endpoints PR (baked telemetry.corevideo.io, env override kept, Worker custom-domain routes added). #436: the broker stays on corevideo.iamfatness.us (owner ruling 2026-10-25: it is the Zoom app's registered redirect); the shell default was moved back after beta-2026-10-25-ebc974d shipped a dead auth.corevideo.io host. Owner-side still: Cloudflare custom domains, Zoom redirect allow-list, telemetry API-key delivery, one verified real upload. See docs/reference/production-endpoints.md.
#424, #425, #426, #427	Zoom SDK redistribution answer, reference machines, tester feedback channel, and handoff decisions.
#441	First-run wizard design after external-install path is known.

Papercuts and deferred workload gates — existing order

Issue	Remaining work
#562	Capture dropout policy needs adapter liveness via signalPresent.
#551	Already fixed on main by the #833 write-queue work (publishIsoTrack on every async write); PR #1027 adds the missing async-path regression test. Close after one live recording shows advancing counts.
#456	Media In/Out points; UI design still needed.
#521	GPU-direct HEVC shipped in #566. AV1 refused pending #565. Raw fallback and recording/ISO on the encoder seam remain.
#519	PR #1023: bytesSent measured at the FFmpeg stdin pipe; latencyMs removed from the wire.
#509	197 ms participant-rebuild stutter. Command-drop on the same apply graph is #622.
#537	DeckLink/AJA: live frames on the source bus (not probe-only). Parked for beta.
#508	Watch item: multiview label/click mismatch after unassign has not recurred.
#507	Debug text on operator surfaces shifts transport buttons.

Unranked — mac-parity-batch live acceptance (2026-10-09)

The 1080P kind flip (mac-parity-batch commit deb2689e) shipped the capability grant but not its required live-acceptance soak (plan Task 3 Step 6). No GitHub issue exists yet for this row; one will be filed, labeled backlog, when the mac-parity-batch PR goes up, and this row will carry its number.

Issue

Remaining work

(pending — file on PR)

1080P flip live acceptance (mac): owner-meeting soak per docs/mac-parity-plan.md §7 Task 3 Step 6 — (a) subscriptions at 1920-wide delivery for camera-on sources, (b) zoomSubscriptionChurn.fullResolutionDemoted == 0 at ≤8 cameras, (c) camera off→on re-subscribe within one spine sync, (d) sustained render holds frame rate; fallback = revert the one-line kind flip in spineSubscriptionPayloads (restores the 720P fence; budget machinery stays). Evidence source: the core snapshot export (AppModel.swift dumps lastSnapshot/lastZoomSnapshot carrying zoomSubscriptionChurn) — NOT the Diagnostics pane, which doesn't render subscriptions; the stub reports 1280×720 for participant-video, so this is verifiable against the REAL engine only.

Graphics qualification dependency — #1010: local automatic introductions must read accepted native source labels after video reincarnation while refusing stale instance text. This is within the owner-requested #1007 local-source Graphics audit and fix; qualify the actual reconnect, not only a manual Show.

Later — parked

Issue	Unranked finding
#1143	Investigate the full-suite ISO late-frame drop and held-frame count mismatch; isolated current/prior-build reruns pass but do not explain the retained failed recording. Preserve strict output acceptance.
#1157	Investigate a valid private Graphics preview request rejected during the full native run. Capture the RPC response and preserve explicit-null validation and pixel assertions.
#1158	Investigate the full-suite graphics cache failure after a lease is released. The isolated case passed. Preserve charged leases and bounded residency.

Issue	Item
#1009	PR #1025: Record no longer requires a Zoom meeting; the core starts and the encoder is checked before the intent is armed. Leave/rejoin verified by reading the real paths; tests cover the coordinator, the snapshot merge and the stub core. Remaining: installed Studio start/stop with Zoom offline, a finalized playable offline file, (crash-resume rule confirmed by the owner 2026-10-23: resume unless the Zoom rejoin failed).
#539	MXL / ZoomISO Cloud / Kubernetes; parked until the source bus and plant I/O exist.

Parked from the 2026-09-24 architecture review (do not start from that document): MediaCore/StudioViewModel extraction beyond #540, Program/Preview/Multiview thread split, atomic native Take, NDI out of process, enabling DeckLink/AJA before #537 has pixels.

Done — reconciled merged fixes

These rows record specific fixes, not blanket production or fleet reliability.

Issue	Merged fix / acceptance
#949	Merged #950 adds the required animation defaults to imported static logos; actual PNG native import/create/save/restore qualified.
#942	Graphics workspace and explicit Studio assignment merged. Complete Studio footer fit is a separate owner-reported review regression under #951; Graphics-only bounds did not qualify the whole page.
#869	Explicit, scoped GPU fixture modes and independent isolated pixel/label coverage merged in #895; exact-head CI/CodeQL green. Retained timing failures remain under #898/#517; closure is limited to mode-assumption hardening.
#870	GitHub issue closed after merged immutable owner observations and off-lock response assembly. Broader initiating-stall attribution and per-output installed delivery qualification remain under #517/#823; closure is not a blanket zero-miss claim.
#891	Closed by merged #892: inspector selection index tracks tab membership/movement before page reentry. Compiled/installed review probes and page entry passed in the October 13 beta.
#859	Closed by merged #860: idle Stop no longer invents recording finalization or reserves the encoder generation. Repeated Stops and real decoded recording finalization passed; sustained zero-drop recording remains separate.
#854	Closed by merged #855: scope-result coordinate rounding tolerance and pending-preview gesture geometry retention. #853 installed interaction and #517 delivery acceptance remain separate.
#838	Closed by merged #837: mixed-source QA initial/final sampling no longer manufactures a stall before preparation advances. This harness repair does not qualify production delivery.
#794	Maintained mixed-source monitor A/B harness, bounded IPC and failed-trial retention merged in #795. Harness implementation is complete; #517 delivery qualification remains open.
#796	Requested/effective monitor mode, selection, initialization/readiness and bounded failure reporting merged in #799. Default rollout remains gated by #517.
#817	RTMP publisher-restart harness factory repaired in #818; real local reconnect, fresh prepared epochs and source-pattern/audio recording checks pass. Closed October 7.
#797	Bounded SHM CPU preparation, immutable handoff, generation fencing and owner retirement merged in #800. Compositor upload work continues in #802; installed qualification remains under #517.
#801	Source-scoped monitor admission, explicit holds, bounded owner cache/retirement and epoch-aware exports merged in #803. Pixel/fault tests and CI passed. Two isolated delivery trials still failed publication acceptance, retained in #804/#517.
#705	Closed 2026-10-03: the headless media harness on main 88eae0d2 records the media audio (−6.1 dBFS peak, all beeps).
#754	Deadline-based tests became bounded condition waits; meter probe waits for Unloaded-and-timer-stopped.
#612	The supervisor stand-off for an adapter's own retry backoff is fresh and bounded (one tallest rung plus start grace); a stale code escalates with a named reason.
#703	Closed by owner disposition 2026-10-02: the YouTube audio lag is resolved.
#602	A supervisor creates records only for the destinations its own sender serves; restart log lines name the supervisor.
#606, #605	RTMP destinations keep their own codec/fps/bitrate; the stream profile only fills unset fields. #605 (hardware GOP + IDR on demand) had landed in #707.
#762, #741	Core profile gates Engine/Record/Join in the shell; the core refuses Record on a failed encoder and Join with no engine; breakout simulator stub-only. Not yet run installed.
#757	Graphics no longer switch themselves off with capture on: the snapshot write-back of Enabled is removed (#769). Reproduced by test; installed acceptance is on the checklist.
#760	The core's capture-device list is bound on the real-core path, so SRT and RTMP ingest status reaches the UI (#770). Not yet seen against a live feed.
#740	The snapshot mapper starts from a neutral base; SyntheticMediaCore is deleted (#752).
#739	Real cores list real capture devices only; verified against the built core (#755).
#747	Protocol manifests are checked against the core and the C#/Swift shells (#753).
#742	Production module composition split out of StubModules.cpp (#756).
#738	React prototype and Node core simulator removed (#745).
#737	CLAUDE.md is an index; topics live in docs/reference/ (#744).
#453	Worktrees and merged branches pruned 2026-10-01; unmerged tips kept under origin/archive/*.
#665	Live monitor control snapshot fix merged in #666 and shipped in beta 975076b8; installed Off/On applied on GoXLR Game, native monitor muted/playing, and the owner confirmed the button works.
#659, #661, #663	Versioned roster facts, revisioned audio crosspoint edits, and bounded recovery merged in #683/#684/#685; child issues closed. Parent #657 retains combined installed qualification.
#632, #634, #637, #640	Native slate assertion, Zoom passcode parsing, live raw-capture validator, and JSONL handshake test fixes merged; issues closed.
#597	Backpressure issue closed by owner on 2026-09-24. Remaining sender defects (#602/#604–#607/#612), degraded-stream readout (#610), and full-show outage acceptance (#615) have separate open issues.
#540	Source video merge and per-source health projection extracted from MediaCore.cpp into SourceVideoIngress; frame order, Zoom roster, capture end, and still behavior covered by native tests.
#621	Generated observation model and per-view field policies in #648; typed, qualification, and ControlState views covered by contract and shell tests.
#622	Command syncs queue behind one bridge slot while empty polls coalesce; overlap/cancellation tests and live meeting Control API check passed in #645.
#530	Canonical and legacy dual-view modes now select ProgramPreview; invalid values are rejected. Live meeting Control API check passed in #646.
#616	Live dispatcher command admission, protocol failure handling, parity coverage, Program event drain, and bounded response lane merged in #631 and #639.
#601	Live meeting Program 1080p60 recording and local SRT receiver bitrate acceptance merged in #641.
#617	Constructed adapter capability reporting merged in #635.
#579, #578	Clap harness and source-video timing fixes shipped in #577; 32 recorded paired events within 41 ms. Owner reports good live lip sync in their overnight test (2026-09-22).
#555	#554 fix, first-Take checks, and resolution-ramp coverage in #577; owner reports no first-Take oddness in their test (2026-09-22).
#570	Async MFT drain/shutdown in #566. Hardware cycles, installed restarts, sustained run and normal drain/stop passed.
#571	COM lifetime through WIC/module teardown in #566. Reproducing regression and installed orderly shutdown checks passed.
#572	Unobserved startup remains starting in #566. Lifecycle regressions and repeated installed starts passed.
#573	Phase-stable two-clip summing fixture in #566; assertion retained. Repeated local runs and merged-main TSan passed.
#574	GPU readiness moved before publication in #566. Hardware pixel tests and 30m16s installed candidate soak passed with zero new CVP delivery failures. Workload limits remain under #517/#569.
#529, #533	ISO drops/timeline fixes merged and validated in the earlier 24-minute six-ISO recording; shipped September 18.
#516, #526, #518	Earlier render-stall, Program-buffer startup/busy-loop, and audio-log fixes merged and validated; shipped September 18. Later distinct defects retain their own issues.

CI hygiene sweep B (draft PR, branch codex/ci-flakes-b)

Owner closes each issue. Outcome per issue: fixed, no-repro (with hardening), mac-unverified, deferred.

Issue	Outcome	Evidence
#850	mac-unverified, hardened	macOS-only failure; test now judges healthy phases against a 60 s window and shortens it to 60 ms only for the decay phase. 25/25 Windows runs before and after.
#867	Active window, readiness repair	November 6 Metal recurrence retained. #1193 adds controlled delayed-construction evidence, actual-picture readiness and the observed count; historical trials still omit the count.
#877	fixed	utf-8 pinned in monitor_evidence.Core; new test fails before, passes after.
#878	no-repro (fixed on main by #875)	WgcScreenCapture UTF-8 title test passes.
#881	fixed	Reproduced with a held reader (the concurrent-reader test is a stress guard); store now serialises, retries, replaces atomically and never persists a fabricated Enabled=false.
#906	no-repro, hardened	88/88 local runs; wait widened to 30 s.
#907	no-repro, hardened	Per-test RUN markers and 900 s timeout already on main; latch waits bounded.
#933	mac-unverified, diagnostics added	40/40 later runs of native-metal-macos pass the AVFoundation step; CI now retains DiagnosticReports on failure.
#969	fixed (residual)	#1006 already retried first admission; the remaining unconditional conflict check now rides out try_lock backpressure.
#970	hardened, probe not run locally	Fixed 50 ms delays replaced by bounded waits on real control state with actual count and selected id in the failure text.