Bonfire

soli-sfu was built for bonfire's 3D office, and the integration is optional. Without SOLI_SFU_URL, the office stays a peer-to-peer mesh. With it, conversations larger than SOLI_SFU_THRESHOLD (4 by default) move their media to the SFU.

How it fits

Tokens are minted on the server. An Sfu service mirrors GatherWs.mint_token with the sfu1. prefix and the room spatial:<cid>. The page receives it alongside the gather token.
The page switches past the threshold. reconcileRtc already works out the conversation group every 300 ms. Up to four people it keeps the mesh; from five it closes the mesh legs and opens one SFU connection.
Group changes become PATCH calls. Where the page updates the conversation bar on a membership change, it also sends the new peers.
Tiles do not change. Remote tracks arrive on slots instead of separate connections, and the tiles already key on live, unmuted video tracks.

Office to SFU

In the office	In the SFU
A company's office, `spatial:<cid>`	A room, from the token
A proximity conversation	Each member's `peers` set
Walking away	A `PATCH` without the person who left
Leaving the office	`DELETE`, or ICE reaping
A locked circle	Outsiders absent from members' `peers`; see the note below

A locked circle is only private at the media level if browsers cannot set their own peers. Either route PATCH through bonfire, or give locked circles a room of their own. The security model explains why.

Why not always use the SFU

A one-to-one chat through an SFU adds a server hop and its bandwidth for nothing; the mesh is free and faster.
The mesh is already hardened: deadlock watchdog, away survival, autoplay recovery. The SFU only needs to win where the mesh cannot go.
The switch point is a setting. Move it as real numbers come in.

Signalling stays where it is: the gather WebSocket still carries moves, knocks and circle frames. The SFU only replaces the media legs.