SDK Capability and Compatibility

<!-- Generated from OneSay canonical specs. Source SHA-256: b4b9c06106eeaacd9b3d12592b48d82b4247853bea70c203aa8fe5e76500d37f. DO NOT EDIT. -->
# SDK Capability and Compatibility

One page for both SDKs, generated from `specs/sdk/javascript.yaml`, `specs/sdk/esp32.yaml` and `specs/rtc/connections.yaml`. JavaScript support is never inferred for ESP32, and the other way round. Server authority decides every operation; a client capability is never a permission.

## Support matrix

| Capability | JavaScript | ESP32 |
|---|---|---|
| Task voice (WSS, ACK, replay, resume) | Supported (browser, Node) | Supported |
| RTC audio | Publish, subscribe, mute, playback (browser) | RTC audio owner |
| Packets | Send and receive | Send only: the pinned upstream receive callback omits reliable/lossy mode |
| Streams | Send and receive | Receive only: pinned open/write options lack a destination selector |
| RPC | Call and handle | Callee only (answers 1–4 `app.*` methods, replies to the original caller only); no caller: the pinned runtime has no invoke API |
| DataTrack | Supported (`livekit-client` 2.22.3) | Unsupported: no upstream API; no substitute transport |
| Agents | Explicit Agent executions and read-only Agent state | Explicit Agent Control (create, get, stop) |
| State, device, error, release | Session state, quality, microphone selection, OneSay errors, close | Binding and media status, OneSay error codes, close |
| Selected-mode media encryption | Conditional: where the browser can run the packaged worker | Unsupported: any selected value is refused before any request |

Support labels: `supported`; `partial` (one direction or role only); `conditional` (depends on the client environment); `unsupported` (refused explicitly, never a substitute transport). Each ESP32 limitation names its ledger entry in the [ESP32 SDK reference](esp32-sdk.md).

## Unsupported and not exposed

- JavaScript not fully supported: Selected-mode media encryption (conditional).
- JavaScript not exposed: native room, track and participant objects; native token or connection material; native SDK types; an escape hatch to the native SDK.
- ESP32 not fully supported: Packets (partial, `LIM-ESP32-PACKET-RECEIVE-MODE-ABSENT-FBF09EDF`); Streams (partial, `LIM-ESP32-STREAM-TARGETED-SEND-ABSENT-FBF09EDF`); RPC (partial, `LIM-GX09-RPC-OUTBOUND-INVOKE-FBF09EDF`); DataTrack (unsupported, `LIM-ESP32-DATATRACK-API-ABSENT-FBF09EDF`); Selected-mode media encryption (unsupported, `LIM-ESP32-MEDIA-ENCRYPTION-UNSUPPORTED-FBF09EDF`).
- ESP32 not exposed: native room or track handles; native token or connection material; the upstream ESP32 runtime API.

## RTC lifecycle

- Connection material is issued by the current authorized Control API and lives at most 60 s. An SDK never persists it and returns a OneSay session, never a native room or token.
- Revocation is requested as `revoking` and becomes `revoked` only when it is effective. A native delete alone does not prove it, and a terminal connection is never revived.
- JavaScript session states: `connected`, `reconnecting`, `closed`. Recovery clears receive bindings; the original subscription intent is replayed only with its original version and key.
- Media encryption modes: `none`, `e2ee` (default `none`). An unsupported client is refused explicitly, never downgraded.

## Task recovery

- JavaScript: at most 5 reconnect attempts with bounded exponential backoff and jitter; no retry after an authentication or permission failure; a rejected resume ends as `fail`.
- ESP32: at most 5 bounded attempts with jitter and a single-use ticket per attempt; no retry after an authentication failure, a revoked credential or a rejected resume.
- Both: contiguous ACK releases audio, only unacked audio is replayed, and overflow is an explicit `client_buffer_overflow`, never a silent drop.

## Limits and privacy

- Audio: 16000 Hz mono `pcm_s16le`. A JavaScript message carries at most 4096 samples; the ESP32 replays at most 3000 ms (96000 bytes) by default.
- Audio acquisition for Task voice belongs to the caller; neither SDK requests a microphone for it.
- ESP32 diagnostics never carry `wifi_ssid`, `raw_mac_address`, `raw_ip`, `raw_audio`, `transcript`, `credential`, `realtime_ticket`.
- RTC connection material is sensitive and `no-store`; SDK persistence is forbidden.

## Contract-gate labels

| SDK | status | runtime_implemented | publishable |
|---|---|---|---|
| JavaScript | `owner-approved/canonical-pcm-protocol-runtime` | `true` | `false` |
| ESP32 | `owner-approved/protocol-connectivity-local-candidate` | `false` | `false` |

These labels are pinned gates of the canonical specifications, checked by the repository validation. They change only with an Owner decision, never with a local run. For ESP32, `runtime_implemented: false` is the pinned E8 gate: the local component candidate exists and runs on the host, and the matrix above describes it, but the required real-device SDK smoke and native network delivery on hardware are NOT-RUN. Neither SDK is published. Staging NOT-RUN — requires authorized Staging environment.