SMART CONFERENCE ROOM 3.2.3.3 — VALIDATION REPORT
====================================================

1. RELEASE IDENTITY
-------------------
Version          : Smart Conference Room 3.2.3.3
Baseline         : Smart Conference Room 3.2.3.2 Full Source
Release type     : Full Source / org / no SCR license / no Windows Demo Builder
Android STT      : Official 1.1.20.4
Primary scope    : Login & Bootstrap Stability + Org De-license Cleanup

2. LOGIN & BOOTSTRAP CHANGES
----------------------------
- GET /api/scr3/auth/me now returns only authentication/room/theme/service metadata.
- /auth/me no longer calls getSessionPublicState() and no longer returns currentSession.
- Browser bootstrap timeout: 8 seconds; login timeout: 12 seconds.
- PC Server -> Room Agent auth timeout: 10 seconds.
- Room Agent -> Central Server timeout: 8 seconds.
- Explicit failures: PC_SERVER_UNREACHABLE, ROOM_AGENT_UNREACHABLE,
  ROOM_AGENT_TIMEOUT, CENTRAL_UNREACHABLE and CENTRAL_TIMEOUT.
- Successful login opens the app directly without location.reload().
- PC WebSocket starts only after scr304-auth-ready.
- WebSocket authentication expiry stops the reconnect loop and opens login again.
- Re-login resets the auth block and reconnects WebSocket without duplicating permission listeners.
- Dynamic /auth/me representative payload with 80 permissions: 1,257 bytes.

3. ORG DE-LICENSE CLEANUP
-------------------------
Removed from executable SCR source:
- shared/runtime-access;
- LicenseRuntime and ServerMutualAuth;
- SCR activation/license HTTP routes and status fields;
- edition/capability/device-limit gates based on SCR license;
- Android license proof/mutual-auth handshake;
- Room Agent entitlement/delegation synchronization;
- Central/PC/CR/DICENTIS license gating.

Active-source prohibited marker scan: 0 files.
The word "license" in npm package-lock files is third-party open-source license metadata,
not an SCR activation or product-license subsystem. Bosch RequiresLicenseLSVT is a
vendor device attribute and is not SCR licensing.

4. SOURCE VALIDATION
--------------------
JavaScript syntax : 183/183 PASS
Python syntax     : 8/8 PASS
JSON parse        : 15/15 PASS before this report/manifest
Compiled artifacts: 0 __pycache__, *.pyc or *.pyo
Android tree      : 79/79 files byte-identical to SCR 3.2.3.2 baseline

5. REGRESSION RESULTS
---------------------
Targeted release matrix: 15/15 PASS, including:
- login/bootstrap + org de-license contract;
- realtime delta/backpressure;
- inbound STT coalescing;
- incremental SQLite persistence;
- long-meeting architecture and synthetic soak;
- editable minutes lifecycle;
- mic auto-assignment / Chairperson misassignment protection;
- seat + microphone profile;
- room/seat profile;
- compact topbar;
- version consistency;
- Central room service status;
- DICENTIS source isolation and voting domain.

Broad static/unit matrix: 100 PASS.
Not executable in this container because npm dependencies are absent:
- client/dicentis-gateway/tests/health-contract.test.js (missing ws);
- client/pc-server/tests/stt-boundary-test.js (missing ws).
No assertion failure was observed in executable tests.

Android JVM policy tests: 12/12 PASS.
Long-meeting synthetic regression: 3,000 segments and 20,000 partial updates PASS.

6. PRESERVED FUNCTIONALITY
--------------------------
- Long-meeting stability from SCR 3.2.3.1.
- Editable Minutes Lifecycle from SCR 3.2.3.2.
- Seat + microphone profiles from SCR 3.2.3.
- Mic activation assignment protections from SCR 3.2.2.2.
- Voting, CR, DICENTIS business logic and Android STT 1.1.20.4.

7. REMAINING ACCEPTANCE LIMITS
------------------------------
The following require the target Windows environment and were not claimed as completed here:
- full live Central -> Room Agent -> PC Server login with installed npm dependencies;
- native Windows startup/install scripts;
- built EXE packaging;
- real Android/Wi-Fi, DICENTIS hardware, FFmpeg and CR model runtime;
- long-duration Windows soak under the unit's antivirus/storage conditions.

8. RELEASE HYGIENE
------------------
- Current package contains one authoritative validation report and source manifest.
- Historical changelogs are retained; stale historical validation/manifests were removed.
- ZIP CRC and manifest verification are performed after packaging.
