From e6b43846535ef6a91f9481f800ec2e473996229f Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 03:02:37 +0800
Subject: [PATCH 001/262] ci(release): isolate Gitee mirror recovery

---
 .github/workflows/gitee-mirror.yml       | 83 ++++++++++++++++++++++++
 .github/workflows/repository-hygiene.yml | 10 ---
 docs/operations/github.md                | 35 +++++++---
 docs/operations/website.md               |  3 +-
 docs/standards/versioning.md             |  4 +-
 docs/todo.md                             | 14 ++--
 scripts/mirror-release.mjs               | 12 ++++
 scripts/release-mirror-source.mjs        | 50 ++++++++++++++
 scripts/release-version.mjs              |  3 +-
 tests/publish-release.test.ts            | 27 +++++++-
 tests/release-automation.test.ts         |  3 +-
 tests/release-mirror-source.test.ts      | 70 ++++++++++++++++++++
 12 files changed, 283 insertions(+), 31 deletions(-)
 create mode 100644 .github/workflows/gitee-mirror.yml
 create mode 100644 scripts/release-mirror-source.mjs
 create mode 100644 tests/release-mirror-source.test.ts

diff --git a/.github/workflows/gitee-mirror.yml b/.github/workflows/gitee-mirror.yml
new file mode 100644
index 000000000..92deb6419
--- /dev/null
+++ b/.github/workflows/gitee-mirror.yml
@@ -0,0 +1,83 @@
+name: Gitee mirror
+
+on:
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      run_id:
+        description: Original CI run that published the current GitHub release
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: gitee-mirror
+  cancel-in-progress: false
+  queue: max
+
+jobs:
+  mirror:
+    if: >-
+      github.repository == 'TNTcraftHIM/Piik' && github.ref == 'refs/heads/main' &&
+      (github.event_name == 'workflow_dispatch' ||
+       (github.event.workflow_run.event == 'push' &&
+        github.event.workflow_run.head_branch == 'main' &&
+        github.event.workflow_run.conclusion == 'success'))
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      # Execute trusted main tooling; upstream artifacts are data, never code.
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: .node-version
+          cache: npm
+      - run: npm ci --ignore-scripts
+      - name: Resolve the published source
+        id: source
+        run: node scripts/release-mirror-source.mjs "$PIIK_SOURCE_RUN_ID"
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PIIK_SOURCE_RUN_ID: ${{ inputs.run_id || github.event.workflow_run.id }}
+      - name: Download original Server artifacts
+        if: steps.source.outputs.mirror == 'true'
+        uses: actions/download-artifact@v8
+        with:
+          github-token: ${{ github.token }}
+          run-id: ${{ steps.source.outputs.run_id }}
+          pattern: piik-server*-${{ steps.source.outputs.revision }}
+          path: ${{ runner.temp }}/mirror-release
+          merge-multiple: true
+      - name: Download original App artifacts
+        if: steps.source.outputs.mirror == 'true'
+        uses: actions/download-artifact@v8
+        with:
+          github-token: ${{ github.token }}
+          run-id: ${{ steps.source.outputs.run_id }}
+          pattern: piik-app-*-${{ steps.source.outputs.revision }}
+          path: ${{ runner.temp }}/mirror-release
+          merge-multiple: true
+      - name: Mirror and verify original packages
+        if: steps.source.outputs.mirror == 'true'
+        run: >-
+          node scripts/mirror-release.mjs
+          "$RUNNER_TEMP/mirror-release" "$PIIK_RELEASE_VERSION" "$PIIK_RELEASE_REVISION"
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GITEE_TOKEN: ${{ secrets.GITEE_TOKEN }}
+          PIIK_RELEASE_VERSION: ${{ steps.source.outputs.version }}
+          PIIK_RELEASE_REVISION: ${{ steps.source.outputs.revision }}
+      - name: Explain recovery
+        if: failure() && steps.source.outputs.mirror == 'true'
+        run: |
+          printf 'Mirror failed; GitHub publication and Website are independent. Retry this workflow with original CI run %s. If artifacts expired, recover the retained original build output; do not rebuild this version. See docs/operations/github.md.\n' "$PIIK_SOURCE_RUN_ID" >> "$GITHUB_STEP_SUMMARY"
+        env:
+          PIIK_SOURCE_RUN_ID: ${{ steps.source.outputs.run_id }}
diff --git a/.github/workflows/repository-hygiene.yml b/.github/workflows/repository-hygiene.yml
index 93f2d04ed..708e5c47c 100644
--- a/.github/workflows/repository-hygiene.yml
+++ b/.github/workflows/repository-hygiene.yml
@@ -290,7 +290,6 @@ jobs:
       # Local descriptors/manifests/checksums are validated before publishing.
       # Release assets contain packages only; checksums appear in the release body.
       - name: Publish packages with release notes and checksums
-        id: github_release
         run: >-
           node scripts/publish-release.mjs
           "$RUNNER_TEMP/publish-release" "$PIIK_RELEASE_VERSION" "$GITHUB_SHA"
@@ -304,12 +303,3 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           PIIK_RELEASE_VERSION: ${{ needs.validate.outputs.version }}
-      - name: Mirror verified release to Gitee
-        if: ${{ !cancelled() && steps.github_release.outcome == 'success' }}
-        run: >-
-          node scripts/mirror-release.mjs
-          "$RUNNER_TEMP/publish-release" "$PIIK_RELEASE_VERSION" "$GITHUB_SHA"
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GITEE_TOKEN: ${{ secrets.GITEE_TOKEN }}
-          PIIK_RELEASE_VERSION: ${{ needs.validate.outputs.version }}
diff --git a/docs/operations/github.md b/docs/operations/github.md
index 6adfd763d..bd28b8682 100644
--- a/docs/operations/github.md
+++ b/docs/operations/github.md
@@ -80,19 +80,34 @@ Image checks, version identity and retries follow
 ## Gitee Download Mirror
 
 [TNTcraftHIM/Piik](https://gitee.com/TNTcraftHIM/Piik) is a public README/Release
-mirror. Source, documentation and issues stay on GitHub. The publishing job uses
-the repository Actions secret `GITEE_TOKEN`, which is configured; rotate it there
+mirror. Source, documentation and issues stay on GitHub. The **Gitee mirror**
+workflow uses the repository Actions secret `GITEE_TOKEN`, which is configured; rotate it there
 when needed. Never put it in source, a remote URL or a distributed package.
 GitHub publication continues to use the workflow's scoped token.
 
-After GitHub publication, the same job runs `scripts/mirror-release.mjs` on the
-original artifacts. Upload failure leaves the Gitee release marked as a preview.
-Rerun the failed publishing job to verify existing files and upload only missing
-ones. GitHub's published release remains unchanged. Both publishers reject
-changing a published package; use a corrected new version if its bytes are wrong.
+After a successful main-push CI run, **Gitee mirror** downloads that run's original
+artifacts and runs `scripts/mirror-release.mjs`. It skips runs that did not publish
+the current GitHub release. GitHub publication and **Website** do not depend on
+mirror success. A mirror failure stays visible in its own failed workflow; an
+unfinished Gitee release remains a preview.
 
-For a local retry, use the release revision's scripts and original complete build
-output retained outside the checkout. Earlier versions can have a different
+Rerun **Gitee mirror** to verify existing files and upload only missing ones.
+For a separate retry, dispatch it on `main` with the **original CI run ID**:
+
+```sh
+gh workflow run gitee-mirror.yml --repo TNTcraftHIM/Piik --ref main -f run_id=RUN_ID
+```
+
+The source must be a completed main-push run of this repository's CI workflow,
+matching the latest published GitHub release. Manual recovery also accepts a
+legacy CI run that failed after GitHub publication. The workflow executes trusted
+main tooling and treats downloaded artifacts only as data. Old retries cannot
+complete a mirror for a superseded release. Both publishers reject changing a
+published package; use a corrected new version if its bytes are wrong.
+
+For a local retry, first let any active mirror workflow finish. Use the release
+revision's scripts and original complete build output retained outside the
+checkout. Earlier versions can have a different
 package set. While the publishing run's artifacts are available, download all packages
 into one directory (replace `RUN_ID`, `FULL_SOURCE_SHA` and `VERSION`):
 
@@ -130,4 +145,6 @@ history. The upload script does not itself delete older attachments.
 
 - [Protected branch availability](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches)
 - [Workflow concurrency and queued runs](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#example-queueing-multiple-pending-runs)
+- [Workflow completion triggers and trust boundaries](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#workflow_run)
+- [Downloading original artifacts from another run](https://github.com/actions/download-artifact#download-artifacts-from-other-workflow-runs-or-repositories)
 - [Immutable release workflow](https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases)
diff --git a/docs/operations/website.md b/docs/operations/website.md
index cbd8684b1..61fae6237 100644
--- a/docs/operations/website.md
+++ b/docs/operations/website.md
@@ -161,7 +161,8 @@ Verify the latest redirects and package checksums after releases.
 4. Accepted main pushes run CI first; success triggers **Website**, which checks
    out that CI run's exact commit. Manual dispatch uses its selected `main` commit.
    Before publishing, both paths skip a build that is no longer current main;
-   dispatch again for the latest commit when needed. Download links resolve through each provider, so
+   dispatch again for the latest commit when needed. The separate Gitee mirror
+   workflow does not gate Website deployment. Download links resolve through each provider, so
    publishing a package or retrying its mirror needs no link refresh.
    Only `build/site/` is uploaded; website work does not package App/Server.
    Verify HTTPS, both languages, relative assets and per-platform download links.
diff --git a/docs/standards/versioning.md b/docs/standards/versioning.md
index d218dd5cc..ed20819d3 100644
--- a/docs/standards/versioning.md
+++ b/docs/standards/versioning.md
@@ -176,7 +176,9 @@ after all required artifacts and checks pass. The publisher verifies matching
 version, source SHA and checksums, then creates/uploads/publishes one GitHub draft.
 When there are no unpublished product changes, CI validates a development build
 and skips packaging and publication; it never assigns an old release version to
-a new source SHA. The separate Website workflow updates the static site after CI.
+a new source SHA. The separate Website and Gitee mirror workflows follow successful
+main CI independently. Mirror failure must remain visible without blocking GitHub
+publication or Website deployment; retries use the original publishing artifacts.
 Failed draft uploads can resume; published artifacts are never overwritten.
 An older draft retried after a newer release cannot take over `latest`.
 
diff --git a/docs/todo.md b/docs/todo.md
index ed06b4afa..a49c9558b 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -1,14 +1,16 @@
 # Current TODO Ledger
 
-Last reviewed: 2026-10-06
+Last reviewed: 2026-10-07
 
 Only **Now** is executable. Product modules own behavior; Git/PRs own completed
 history. A parked idea is not implementation authority.
 
 ## Now
 
-No active implementation work. Deferred proposals and evidence-dependent reports
-remain below; release delivery is tracked by the pipeline and deployment records.
+- [ ] **Independent Gitee mirror recovery.** Implementation and local acceptance
+  are complete. Integrate through the next owner-approved publishing merge and
+  verify the separate workflow with its original CI artifacts. Mirror failure
+  must remain visible without blocking product CI or Website delivery.
 
 ## Held By Owner
 
@@ -206,9 +208,9 @@ works, so a Rust alternative needs a concrete Go limitation.
     and retain Gitee; do not add a self-hosted mirror. Chrome still blocks the
     Gitee attachment when Referer is removed. Reopen for new evidence or a
     provider review; the warning remains unresolved.
-10. **Release-operation policy.** Protected release environments, immutable
-    draft assets and changing mirror-failure policy remain unaccepted proposals;
-    evaluate their benefit before adding release machinery.
+10. **Release-operation policy.** Protected release environments and immutable
+    draft assets remain unaccepted proposals; evaluate their benefit before
+    adding release machinery.
 11. **Automatic local chat history.** Explicit TXT export covers manual retention.
     Reconsider automatic storage only with a stable room-incarnation identity,
     bounded retention and a clear delete control; reusable room codes must not
diff --git a/scripts/mirror-release.mjs b/scripts/mirror-release.mjs
index e881b73ae..bb569c950 100644
--- a/scripts/mirror-release.mjs
+++ b/scripts/mirror-release.mjs
@@ -15,6 +15,15 @@ const api = `https://gitee.com/api/v5/repos/${repository}`;
 const marker = `<!-- piik-source: ${revision} -->`;
 const token = process.env.GITEE_TOKEN?.trim();
 
+function requireLatestSource() {
+  const latest = JSON.parse(execFileSync("gh", ["api", `repos/${repository}/releases/latest`],
+    { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 30_000 }));
+  if (latest.tag_name !== version || latest.target_commitish !== revision ||
+      latest.draft !== false || latest.prerelease !== false) {
+    throw new Error("Only the latest GitHub release may create or complete a Gitee mirror");
+  }
+}
+
 async function fetchResponse(url, options, timeout) {
   const attempts = (options.method ?? "GET") === "GET" ? 3 : 1;
   for (let attempt = 1; ; attempt++) {
@@ -88,6 +97,7 @@ if (option === "--dry-run") {
     throw new Error("Existing mirror release belongs to a different or unknown source revision");
   }
   const body = `${source.body ?? ""}\n\nSource: https://github.com/${repository}/commit/${revision}\n\n${marker}\n`;
+  if (!release || release.prerelease) requireLatestSource();
   if (!release) {
     const repo = await request("");
     if (!repo || repo.private || !repo.default_branch) throw new Error("A public initialized Gitee mirror is required");
@@ -111,6 +121,8 @@ if (option === "--dry-run") {
   }
   // Gitee has no draft API. Its preview flag fences incomplete uploads from checks.
   if (release.prerelease) {
+    // Uploads may take minutes; a newer GitHub release must not be displaced.
+    requireLatestSource();
     const completed = await request(`/releases/${release.id}`, "PATCH", {
       tag_name: version, name: source.name || `Piik ${version}`, body, prerelease: false,
     });
diff --git a/scripts/release-mirror-source.mjs b/scripts/release-mirror-source.mjs
new file mode 100644
index 000000000..f3a8d0a14
--- /dev/null
+++ b/scripts/release-mirror-source.mjs
@@ -0,0 +1,50 @@
+import { execFileSync } from "node:child_process";
+import { appendFileSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+import { isReleaseVersion } from "./release-version.mjs";
+
+const repository = "TNTcraftHIM/Piik";
+const gh = (path) => JSON.parse(execFileSync("gh", ["api", `repos/${repository}/${path}`], {
+  encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 30_000,
+}));
+
+export function resolveMirrorSource(runId, automatic = false) {
+  if (!/^[1-9]\d*$/.test(runId) || !Number.isSafeInteger(Number(runId))) {
+    throw new Error("Provide the original CI run's numeric ID");
+  }
+  const run = gh(`actions/runs/${runId}`);
+  if (run.id !== Number(runId) || run.repository?.full_name !== repository ||
+      run.head_repository?.full_name !== repository || run.event !== "push" ||
+      run.head_branch !== "main" || run.path !== ".github/workflows/repository-hygiene.yml" ||
+      run.status !== "completed" || !/^[a-f0-9]{40}$/.test(run.head_sha) ||
+      (automatic && run.conclusion !== "success")) {
+    throw new Error("Mirror artifacts must come from a completed main push in this repository's CI workflow");
+  }
+  // A legacy CI run may be red because its mirror failed after GitHub published.
+  // The published release, not that aggregate result, owns manual retry identity.
+  const release = gh("releases/latest");
+  if (release.draft !== false || release.prerelease !== false || !isReleaseVersion(release.tag_name) ||
+      !/^[a-f0-9]{40}$/.test(release.target_commitish)) {
+    throw new Error("A published stable GitHub release with a full source SHA is required");
+  }
+  if (release.target_commitish !== run.head_sha) {
+    if (automatic) return null;
+    throw new Error("This CI run does not match the latest GitHub release; use its original publishing run");
+  }
+  return { run_id: String(run.id), version: release.tag_name, revision: run.head_sha };
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const source = resolveMirrorSource(process.argv[2], process.env.GITHUB_EVENT_NAME === "workflow_run");
+  const output = { mirror: source !== null, ...source };
+  if (process.env.GITHUB_OUTPUT) {
+    appendFileSync(process.env.GITHUB_OUTPUT,
+      Object.entries(output).map(([key, value]) => `${key}=${value}\n`).join(""));
+  }
+  if (process.env.GITHUB_STEP_SUMMARY) {
+    appendFileSync(process.env.GITHUB_STEP_SUMMARY, source
+      ? `Mirror ${source.version} from original [CI run ${source.run_id}](https://github.com/${repository}/actions/runs/${source.run_id}).\n`
+      : "This CI run did not publish the current GitHub release; no mirror work is needed.\n");
+  }
+  console.log(JSON.stringify(output));
+}
diff --git a/scripts/release-version.mjs b/scripts/release-version.mjs
index cc1297695..a14bbf39b 100644
--- a/scripts/release-version.mjs
+++ b/scripts/release-version.mjs
@@ -18,7 +18,8 @@ const nonProductPaths = [
   "site/**", "docs/**", "tests/**", ".agents/**", ".codex/**", ".githooks/**",
   "*.md", ".gitignore", ".env.example", "vitest.config.ts",
   "cmd/**/*.md", "internal/**/*.md", "native/**/*.md", "src/**/*.md",
-  ".github/ISSUE_TEMPLATE/**", ".github/pull_request_template.md", ".github/workflows/website.yml",
+  ".github/ISSUE_TEMPLATE/**", ".github/pull_request_template.md",
+  ".github/workflows/website.yml", ".github/workflows/gitee-mirror.yml",
   "scripts/build-website.mjs", "scripts/update-website-hero.mjs", "scripts/check-website-film.js",
   "scripts/check-docs.mjs", "scripts/check-container.mjs", "scripts/markdown-slug.mjs", "scripts/check-project-state.*", "scripts/install-hooks.*",
   "scripts/required-project-paths.txt", "scripts/tsconfig.json",
diff --git a/tests/publish-release.test.ts b/tests/publish-release.test.ts
index db528df62..5e5321c69 100644
--- a/tests/publish-release.test.ts
+++ b/tests/publish-release.test.ts
@@ -45,15 +45,26 @@ describe("Gitee mirror publication", () => {
   });
   async function mirror(options: { existing?: "pending" | "published" | "unknown"; corrupt?: boolean;
     wrongSource?: boolean; wrongDigest?: boolean; missing?: boolean;
+    stale?: boolean; supersededDuringUpload?: boolean;
     fault?: { method: string; remaining: number; status: number | "timeout" } } = {}) {
     const mutations: string[] = [];
     const attachments = sourceAssets.map(({ name, size }) => ({ name, size, browser_download_url: download + name }));
     const present = options.existing === "pending" ? attachments.slice(0, 1) : options.missing ? [] : attachments;
-    command.mockReturnValue(JSON.stringify({
+    const source = {
       ...release(false), html_url: `https://github.com/TNTcraftHIM/Piik/releases/tag/${version}`,
       target_commitish: options.wrongSource ? "b".repeat(40) : revision,
       assets: options.wrongDigest ? sourceAssets.map((asset) => ({ ...asset, digest: "sha256:wrong" })) : sourceAssets,
-    }));
+    };
+    let latestReads = 0;
+    command.mockImplementation((_program, args) => {
+      if (args[1].endsWith("/releases/latest")) {
+        latestReads++;
+        if (options.stale || (options.supersededDuringUpload && latestReads > 1)) {
+          return JSON.stringify({ ...source, tag_name: "v1.1.0", target_commitish: "b".repeat(40) });
+        }
+      } else expect(args[1]).toBe(`repos/TNTcraftHIM/Piik/releases/tags/${version}`);
+      return JSON.stringify(source);
+    });
     vi.stubEnv("GITEE_TOKEN", "fixture-mirror-token");
     vi.stubGlobal("fetch", vi.fn<typeof fetch>(async (input, init) => {
       const url = String(input);
@@ -129,6 +140,18 @@ describe("Gitee mirror publication", () => {
     expect(await mirror({ existing: "published" })).toEqual({ mutations: [], failure: undefined });
   });
 
+  it("prevents stale creation or completion while allowing existing stable verification", async () => {
+    for (const existing of [undefined, "pending"] as const) {
+      const result = await mirror({ existing, stale: true });
+      expect(result.failure).toContain("Only the latest GitHub release");
+      expect(result.mutations).toEqual([]);
+    }
+    const superseded = await mirror({ existing: "pending", supersededDuringUpload: true });
+    expect(superseded.failure).toContain("Only the latest GitHub release");
+    expect(superseded.mutations).not.toContain("PATCH /releases/42");
+    expect(await mirror({ existing: "published", stale: true })).toEqual({ mutations: [], failure: undefined });
+  });
+
   it.each([503, "timeout"] as const)("retries transient read failures (%s) within a fixed bound", async (status) => {
     const fault = { method: "GET", remaining: 2, status };
     expect((await mirror({ existing: "published", fault })).failure).toBeUndefined();
diff --git a/tests/release-automation.test.ts b/tests/release-automation.test.ts
index adc7a70b9..08cbf1832 100644
--- a/tests/release-automation.test.ts
+++ b/tests/release-automation.test.ts
@@ -142,7 +142,8 @@ describe("release automation", () => {
         "scripts/build-website.mjs", "scripts/check-docs.mjs", "scripts/check-container.mjs", "scripts/markdown-slug.mjs", "scripts/release-notes.mjs",
         "scripts/publish-container.mjs",
         "scripts/app-gate-endpoint.ts", "scripts/client-gate-endpoint.ts",
-        "tests/room.test.ts", ".agents/skills/ponytail/SKILL.md", ".github/workflows/website.yml"]) {
+        "tests/room.test.ts", ".agents/skills/ponytail/SKILL.md", ".github/workflows/website.yml",
+        ".github/workflows/gitee-mirror.yml", "scripts/release-mirror-source.mjs"]) {
         mkdirSync(dirname(join(root, path)), { recursive: true });
         writeFileSync(join(root, path), "Peripheral content");
       }
diff --git a/tests/release-mirror-source.test.ts b/tests/release-mirror-source.test.ts
new file mode 100644
index 000000000..85b8c805e
--- /dev/null
+++ b/tests/release-mirror-source.test.ts
@@ -0,0 +1,70 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { resolveMirrorSource } from "../scripts/release-mirror-source.mjs";
+
+const { command } = vi.hoisted(() => ({ command: vi.fn() }));
+vi.mock("node:child_process", () => ({ execFileSync: command }));
+
+const repository = "TNTcraftHIM/Piik";
+const revision = "a".repeat(40);
+const run = {
+  id: 12345, repository: { full_name: repository }, head_repository: { full_name: repository },
+  event: "push", head_branch: "main", head_sha: revision,
+  path: ".github/workflows/repository-hygiene.yml", status: "completed", conclusion: "success",
+};
+const release = { tag_name: "v1.9.2", target_commitish: revision, draft: false, prerelease: false };
+
+function api(source = run, latest = release) {
+  command.mockImplementation((program: string, args: string[]) => {
+    expect(program).toBe("gh");
+    if (args[1] === `repos/${repository}/actions/runs/12345`) return JSON.stringify(source);
+    if (args[1] === `repos/${repository}/releases/latest`) return JSON.stringify(latest);
+    throw new Error(`Unexpected request: ${args.join(" ")}`);
+  });
+}
+
+beforeEach(() => { command.mockReset(); api(); });
+
+describe("mirror source authority", () => {
+  it("binds automatic and manual retries to the published source run", () => {
+    const expected = { run_id: "12345", version: release.tag_name, revision };
+    expect(resolveMirrorSource("12345", true)).toEqual(expected);
+    expect(resolveMirrorSource("12345")).toEqual(expected);
+    api({ ...run, conclusion: "failure" });
+    expect(resolveMirrorSource("12345")).toEqual(expected);
+    expect(() => resolveMirrorSource("12345", true)).toThrow(/completed main push/);
+  });
+
+  it.each(["", "012345", "1e3", "-1", "12345\nmirror=true", "9007199254740992", undefined])
+    ("rejects invalid run IDs before accessing GitHub: %s", (id) => {
+      expect(() => resolveMirrorSource(id)).toThrow(/numeric ID/);
+      expect(command).not.toHaveBeenCalled();
+    });
+
+  it.each([
+    { id: 99 }, { repository: { full_name: "fork/Piik" } },
+    { head_repository: { full_name: "fork/Piik" } }, { event: "pull_request" },
+    { event: "workflow_dispatch" }, { head_branch: "preview" },
+    { path: ".github/workflows/other.yml" }, { status: "in_progress" }, { head_sha: "short" },
+  ])("rejects artifacts from a different authority or unfinished run: %j", (patch) => {
+    api({ ...run, ...patch });
+    expect(() => resolveMirrorSource("12345")).toThrow(/completed main push/);
+    expect(command).toHaveBeenCalledTimes(1);
+  });
+
+  it("skips automatic runs without a current release and refuses an explicit stale retry", () => {
+    api(run, { ...release, target_commitish: "b".repeat(40) });
+    expect(resolveMirrorSource("12345", true)).toBeNull();
+    expect(() => resolveMirrorSource("12345")).toThrow(/does not match the latest/);
+  });
+
+  it.each([{ draft: true }, { prerelease: true }, { tag_name: "preview" }, { target_commitish: "main" }])
+    ("rejects an unverified release: %j", (patch) => {
+      api(run, { ...release, ...patch });
+      expect(() => resolveMirrorSource("12345")).toThrow(/published stable GitHub release/);
+    });
+
+  it("does not turn an API failure into an empty successful mirror", () => {
+    command.mockImplementationOnce(() => { throw new Error("GitHub unavailable"); });
+    expect(() => resolveMirrorSource("12345", true)).toThrow("GitHub unavailable");
+  });
+});

From f213189e412c6590eb0febc34861748ff2dbbaf2 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 04:44:48 +0800
Subject: [PATCH 002/262] test(native): separate mailbox timing from codec work

---
 docs/todo.md                                  |  9 ++++----
 .../capture/windows/capture_control.test.cpp  | 23 ++++++++-----------
 2 files changed, 14 insertions(+), 18 deletions(-)

diff --git a/docs/todo.md b/docs/todo.md
index a49c9558b..18374419a 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -11,6 +11,11 @@ history. A parked idea is not implementation authority.
   are complete. Integrate through the next owner-approved publishing merge and
   verify the separate workflow with its original CI artifacts. Mirror failure
   must remain visible without blocking product CI or Website delivery.
+- [ ] **Windows CI worker-check acceptance.** A constrained-CPU run reproduced
+  the worker test's timeout while its VP8 fixture was still encoding. The mailbox
+  lifecycle check now uses deterministic work; real encode/decode checks remain
+  separate. Verify the change on the hosted Windows runner before closing this
+  item. The earlier CI assertion lacks the phase needed to establish the same cause.
 
 ## Held By Owner
 
@@ -65,10 +70,6 @@ These proposals remain deferred beyond the accepted interaction phase.
 These reports remain unmatched. A local repair or successful test is not proof
 of a reporter's cause; research owns the completed experiments and their limits.
 
-- [ ] **Intermittent native capture self-test failure.** The worker check now
-  records its phase, original exception and per-output progress. A local pass
-  does not explain the earlier CI failure; use the next failed run's diagnostics
-  before changing deadlines or worker behavior.
 - [ ] **macOS and Linux physical capture.** Complete the remaining capture/audio
   checks in [verification status](./verification-status.md#device-evidence-boundary),
   including an Intel Mac with a usable hardware H.264 encoder, an ARM64 Linux
diff --git a/native/capture/windows/capture_control.test.cpp b/native/capture/windows/capture_control.test.cpp
index b94cb9946..9b825e9d8 100644
--- a/native/capture/windows/capture_control.test.cpp
+++ b/native/capture/windows/capture_control.test.cpp
@@ -54,12 +54,12 @@ void CheckOutputPipe() {
   CloseHandle(output);
 }
 
-void CheckWorkers() {
+void CheckMailboxWorkers() {
   struct Input { uint32_t index; };
   using Mailbox = piik::capture::OutputMailbox<Input>;
   std::array<Mailbox, 3> mailboxes{Mailbox(90'000), Mailbox(300'000), Mailbox(1'200'000)};
   std::array<std::thread, 3> workers;
-  std::array<uint32_t, 3> last{}, count{}, retired{};
+  std::array<uint32_t, 3> last{}, count{}, retired{}, bitrate{};
   std::array<bool, 3> recovery{};
   std::mutex mutex;
   std::condition_variable changed;
@@ -71,15 +71,10 @@ void CheckWorkers() {
   for (size_t layer = 0; layer < workers.size(); ++layer) {
     workers[layer] = std::thread([&, layer]() {
       try {
-        const uint32_t width = 160u << layer;
-        const uint32_t height = 90u << layer;
-        std::vector<uint8_t> pixels(static_cast<size_t>(width) * height * 3 / 2, 128);
-        std::unique_ptr<piik::capture::Vp8Encoder> encoder;
         for (;;) {
           const auto work = mailboxes[layer].Take();
           if (work.action == Mailbox::Action::stop) break;
           if (work.action == Mailbox::Action::retire) {
-            encoder.reset();
             std::lock_guard<std::mutex> lock(mutex);
             ++retired[layer];
             changed.notify_one();
@@ -89,14 +84,13 @@ void CheckWorkers() {
             entered.set_value();
             released.wait();
           }
-          if (!encoder) encoder = std::make_unique<piik::capture::Vp8Encoder>(width, height, 30, work.bitrate);
-          encoder->SetBitrate(work.bitrate);
-          const auto output = encoder->Encode(pixels.data(), width,
-              static_cast<uint64_t>(work.input->index) * 10'000'000 / 30, work.recovery);
+          // Test mailbox ordering independently of codec speed. The separate
+          // encode/decode check below exercises real frames and keyframe output.
           if (!mailboxes[layer].Accept(work.generation)) continue;
           std::lock_guard<std::mutex> lock(mutex);
           last[layer] = work.input->index;
-          recovery[layer] = output.key_frame;
+          bitrate[layer] = work.bitrate;
+          recovery[layer] = work.recovery;
           ++count[layer];
           changed.notify_one();
         }
@@ -143,7 +137,7 @@ void CheckWorkers() {
   mailboxes[0].RequestKeyFrame();
   release.set_value();
   wait("pending-recovery", [&]() { return last[0] == 4; });
-  assert(count[0] == 2 && recovery[0]); // New request survived the older keyframe; pending 2/3 were replaced.
+  assert(count[0] == 2 && recovery[0]); // New request survived older work; pending 2/3 were replaced.
   mailboxes[1].SetActive(false);
   mailboxes[2].SetActive(false);
   submit(5);
@@ -154,6 +148,7 @@ void CheckWorkers() {
   submit(6);
   wait("output-reactivation", [&]() { return last[0] == 6 && last[1] == 6 && last[2] == 6; });
   assert(recovery[0] && recovery[1] && recovery[2]);
+  assert(bitrate[0] == 30'000 && bitrate[1] == 300'000 && bitrate[2] == 1'200'000);
   const auto stopped = std::chrono::steady_clock::now();
   for (auto& mailbox : mailboxes) mailbox.Stop();
   for (auto& worker : workers) worker.join();
@@ -263,7 +258,7 @@ int main() {
     const auto decoded = decoder.Decode(output.bytes);
     assert(decoded.width == 160 && decoded.height == 90 && decoded.nv12.size() == pixels.size());
   }
-  CheckWorkers();
+  CheckMailboxWorkers();
   CheckDroppedRecoveryInput();
   CheckIndependentActivation();
   CheckOutputPipe();

From bac1b672293038d610bce7c9ef4f42b0767ef6d5 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 04:53:50 +0800
Subject: [PATCH 003/262] docs: close verified Windows CI follow-up

---
 docs/todo.md | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/docs/todo.md b/docs/todo.md
index 18374419a..2f8dbeee4 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -11,11 +11,6 @@ history. A parked idea is not implementation authority.
   are complete. Integrate through the next owner-approved publishing merge and
   verify the separate workflow with its original CI artifacts. Mirror failure
   must remain visible without blocking product CI or Website delivery.
-- [ ] **Windows CI worker-check acceptance.** A constrained-CPU run reproduced
-  the worker test's timeout while its VP8 fixture was still encoding. The mailbox
-  lifecycle check now uses deterministic work; real encode/decode checks remain
-  separate. Verify the change on the hosted Windows runner before closing this
-  item. The earlier CI assertion lacks the phase needed to establish the same cause.
 
 ## Held By Owner
 

From c5507a077d2f18564ef6ccf9595d005bc8dbb405 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 11:04:28 +0800
Subject: [PATCH 004/262] feat(web): remember applied sharing quality
 preferences

---
 docs/guide/getting-started.md        |  6 ++++
 docs/guide/getting-started.zh-CN.md  |  6 ++++
 docs/standards/media-quality.md      |  8 ++++++
 docs/status.md                       |  8 ++++--
 docs/todo.md                         | 42 +++++++++++++++++++---------
 src/client/lib/quality-preference.ts | 28 +++++++++++++++++++
 src/client/pages/HostPage.tsx        | 10 ++++---
 tests/host-quality-ownership.test.ts | 20 ++++++++++++-
 tests/quality-preference.test.ts     | 36 ++++++++++++++++++++++++
 9 files changed, 143 insertions(+), 21 deletions(-)
 create mode 100644 src/client/lib/quality-preference.ts
 create mode 100644 tests/quality-preference.test.ts

diff --git a/docs/guide/getting-started.md b/docs/guide/getting-started.md
index 7b03b958b..8d69e9c43 100644
--- a/docs/guide/getting-started.md
+++ b/docs/guide/getting-started.md
@@ -146,6 +146,12 @@ The site manages rooms and invitations; the App supplies native capture.
 If its operator has enabled SFU forwarding, turn off **Privacy mode** before
 sharing to allow that fallback. The project's online site uses P2P only.
 
+## Picture and sound settings
+
+Open **Sharing settings** below the picture to adjust picture and audio quality.
+Piik remembers your applied settings in this browser for this site. A new
+temporary public-invite address has separate settings.
+
 ## Add your voice
 
 While sharing, select **Microphone** below the picture and
diff --git a/docs/guide/getting-started.zh-CN.md b/docs/guide/getting-started.zh-CN.md
index 04d6bc1a9..9bfbb7595 100644
--- a/docs/guide/getting-started.zh-CN.md
+++ b/docs/guide/getting-started.zh-CN.md
@@ -129,6 +129,12 @@ Linux 原生采集还需要[系统组件](../../native/capture/linux/README.md)
 如果管理员已启用 SFU 转发，房主可在开始分享前关闭 **隐私模式**，允许使用这条兜底线路。
 项目提供的在线版仅使用 P2P。
 
+## 画面与声音设置
+
+在画面下方打开 **分享设置**，调整画质和音频质量。
+Piik 会在当前浏览器中记住这个站点上已应用的设置；
+公网邀请每次生成的新网址使用独立设置。
+
 ## 加上自己的声音
 
 分享时，点击画面下方的 **麦克风**，并允许访问。
diff --git a/docs/standards/media-quality.md b/docs/standards/media-quality.md
index 999f1e500..21b2033c4 100644
--- a/docs/standards/media-quality.md
+++ b/docs/standards/media-quality.md
@@ -101,6 +101,14 @@ contract. [Status](../status.md) indexes delivery and remaining acceptance.
 
 ## Video Profiles
 
+The Host remembers explicitly applied picture and source-audio quality settings
+in same-origin Browser storage. They seed a new page; authoritative room recovery
+still owns an existing share. Failed or superseded changes and server snapshots
+do not replace the preference. Storage failure falls back to session-only use.
+This does not retain capture permission, device/session identity or microphone
+activation. A different site or temporary public-link origin has separate
+Browser preferences; this is not an App-wide configuration sync.
+
 The three recommended profiles are ceilings, not delivery guarantees:
 
 | Profile | Target | Video bitrate ceiling |
diff --git a/docs/status.md b/docs/status.md
index 5070e0104..a2dab31e6 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -1,6 +1,6 @@
 # Current Status
 
-Last updated: 2026-10-06
+Last updated: 2026-10-07
 
 This is the compact execution/deployment index. Product modules own behavior,
 [verification status](./verification-status.md) owns unresolved physical limits,
@@ -59,8 +59,10 @@ SQLite schema 2 and the 1440p ceiling. Hosted empty-room retention and capacity
 guidance preserve indefinite retention by default. The accepted Demo policy is
 one hour without authenticated participants; the private deployment retains the
 default. Operator records own activation, database and postflight evidence.
-4K and resolution/capability expansion are not planned for this phase.
-Native Magicsock remains a separate experiment, outside product integration.
+The owner reopened 2.0 candidate preparation, including reassessment of 4K,
+codec expansion and Native Magicsock where demonstrated benefit justifies total
+complexity. These experiments do not yet change the accepted contract or product
+transport. Release remains subject to the owner's final acceptance.
 Immutable release artifacts own delivery completion; [TODO](./todo.md#now) owns
 remaining work.
 
diff --git a/docs/todo.md b/docs/todo.md
index 2f8dbeee4..56580e959 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -7,6 +7,35 @@ history. A parked idea is not implementation authority.
 
 ## Now
 
+- [ ] **2.0 candidate review and acceptance.** The owner reopened investigation,
+  useful improvements and outstanding acceptance on 2026-10-07. Prepare one
+  coherent candidate and stop before publication. Preserve the existing product
+  model; evaluate held features against measurable benefit and total complexity
+  before accepting a changed contract.
+- [ ] **App-wide sharing preferences (#460).** Same-origin Browser preferences
+  are implemented. Assess retaining explicit settings across changing App public
+  origins without eagerly claiming Native sessions, adding a second settings
+  owner or persisting live device/session authority. Keep the Browser scope clear
+  if an App-wide bridge is not justified.
+- [ ] **Current issue evidence.** Review #452's public-link/H.264 report and
+  #453's cross-network failure against current startup and ICE behavior. Revisit
+  #432's motion-quality evidence and existing unmatched reports; do not equate a
+  successful local reproduction with resolving a different reporter's cause.
+- [ ] **Current-contract runtime acceptance.** Exercise sharing, source/quality
+  replacement, reconnect, peer/SFU handoff and independent retirement. Repair
+  the obsolete optional `viewer-mbb` canary before using it as evidence. Review
+  responsive interaction and reader documentation against the accepted result;
+  keep unavailable physical-device checks explicit.
+- [ ] **Deferred-work decisions.** Reassess transport, microphone pairing,
+  passive App attachment, hosting and remaining structural proposals in order
+  of demonstrated value. Record accepted scope in the owning modules before
+  implementation; do not turn every proposal into a release requirement.
+- [ ] **4K, codec expansion and Native Magicsock assessment.** Reopened by the
+  owner on 2026-10-07 for 2.0 only where measured benefit justifies a simple
+  implementation. Review the [media extension assessment](./research/native-client-media.md#media-capability-extension-assessment)
+  and [transport comparison](./research/nat-traversal.md#integration-cost-and-recovery-controls)
+  against current main. No changed wire contract or product transport is accepted
+  merely by reopening the experiments.
 - [ ] **Independent Gitee mirror recovery.** Implementation and local acceptance
   are complete. Integrate through the next owner-approved publishing merge and
   verify the separate workflow with its original CI artifacts. Mirror failure
@@ -14,14 +43,6 @@ history. A parked idea is not implementation authority.
 
 ## Held By Owner
 
-- [ ] **4K and resolution/capability expansion.** Not planned for this phase,
-  reaffirmed by the owner on 2026-10-06 because of cost relative to benefit. Keep the
-  public v23/v9/v7 contract and 1440p ceiling. Resume the extensibility audit and
-  [media extension assessment](./research/native-client-media.md#media-capability-extension-assessment)
-  only with a renewed benefit/cost decision. This includes unfinished
-  cross-platform capture and capability negotiation; local tests alone do not
-  authorize a protocol break or a 2.0 release. Retain recoverable Git evidence
-  for the experiment without requiring an active worktree.
 - [ ] **Browser-internal encoder work.** Paused by the owner on 2026-10-01.
   [Comparisons and Chromium traces](./research/browser-local-encoding-pool.md#sustained-h264-recovery)
   own the evidence for synchronous H264 initialization, native adaptation and
@@ -40,11 +61,6 @@ history. A parked idea is not implementation authority.
 
 These proposals remain deferred beyond the accepted interaction phase.
 
-- [ ] **Native Magicsock integration.** The [isolated comparison](./research/nat-traversal.md#integration-cost-and-recovery-controls)
-  establishes Go feasibility and relay-assisted recovery, but no additional
-  direct-reachability class in its tested matrix. Keep product transport unchanged.
-  Reopen integration only for a repeatable benefit on matched networks that
-  justifies the extra identity, readiness, packet-size and relay responsibilities.
 - [ ] **Managed Demo hosting.** Evaluate cost and public UDP support before any
   migration. The assessment remains outside the current product release; keep
   the existing P2P-only Demo deployment until a provider and operating boundary
diff --git a/src/client/lib/quality-preference.ts b/src/client/lib/quality-preference.ts
new file mode 100644
index 000000000..a5b25e8c8
--- /dev/null
+++ b/src/client/lib/quality-preference.ts
@@ -0,0 +1,28 @@
+import {
+  DEFAULT_QUALITY_SETTINGS,
+  qualitySettingsSchema,
+  type QualitySettings,
+} from "../../shared/protocol";
+
+const STORAGE_KEY = "piik:quality-preference:v1";
+
+export function readPreferredQuality(): QualitySettings {
+  try {
+    const stored = window.localStorage.getItem(STORAGE_KEY);
+    const result = qualitySettingsSchema.safeParse(stored ? JSON.parse(stored) : null);
+    if (result.success) return result.data;
+  } catch {
+    // Storage may be unavailable; sharing still works with session settings.
+  }
+  return { ...DEFAULT_QUALITY_SETTINGS };
+}
+
+export function savePreferredQuality(settings: QualitySettings): void {
+  const result = qualitySettingsSchema.safeParse(settings);
+  if (!result.success) return;
+  try {
+    window.localStorage.setItem(STORAGE_KEY, JSON.stringify(result.data));
+  } catch {
+    // Saving a preference must not turn an applied capture change into a failure.
+  }
+}
diff --git a/src/client/pages/HostPage.tsx b/src/client/pages/HostPage.tsx
index 3cfda822f..4a3b0ae26 100644
--- a/src/client/pages/HostPage.tsx
+++ b/src/client/pages/HostPage.tsx
@@ -8,7 +8,6 @@ import {
   type FormEvent,
 } from "react";
 import {
-  DEFAULT_QUALITY_SETTINGS,
   DEFAULT_ROUTE_POLICY,
   MAX_VIEWER_PASSWORD_LENGTH,
   viewerPasswordSchema,
@@ -89,6 +88,7 @@ import {
   saveCreationProfile,
   type HostCreationProfile,
 } from "../lib/creation-profile";
+import { readPreferredQuality, savePreferredQuality } from "../lib/quality-preference";
 import { createOpaqueId } from "../lib/opaque-id";
 import { debugError, debugEvent, debugOperation } from "../lib/debug";
 import {
@@ -377,10 +377,10 @@ export function HostPage({
   const copy = useCopy();
   const { lang, vis, t, titleFrames } = copy;
   const [qualitySettings, setQualitySettings] = useState<QualitySettings>(
-    DEFAULT_QUALITY_SETTINGS,
+    readPreferredQuality,
   );
   const [advancedQuality, setAdvancedQuality] = useState<QualitySettings>(
-    DEFAULT_QUALITY_SETTINGS,
+    qualitySettings,
   );
   const [routePolicy, setRoutePolicy] = useState<RoutePolicy>(
     () => ({
@@ -610,7 +610,7 @@ export function HostPage({
   const sourceSwitchRef = useRef<{ replacingVideo?: MediaStreamTrack; audioOnly?: boolean } | null>(null);
   const qualityChangeRef = useRef<object | null>(null);
   const pendingQualityChangeRef = useRef<QualitySettings | null>(null);
-  const qualitySettingsRef = useRef<QualitySettings>(DEFAULT_QUALITY_SETTINGS);
+  const qualitySettingsRef = useRef<QualitySettings>(qualitySettings);
   const routePolicyRef = useRef<RoutePolicy>(routePolicy);
   const advancedQualityRef = useRef<QualitySettings>(advancedQuality);
   const videoCodecModeRef = useRef<BrowserVideoCodecMode>(videoCodecMode);
@@ -1647,6 +1647,7 @@ export function HostPage({
         return;
       }
       commitQuality(nextProfile);
+      savePreferredQuality(nextProfile);
       return;
     }
     if (qualityChangeRef.current) {
@@ -1718,6 +1719,7 @@ export function HostPage({
       }
 
       commitQuality(appliedProfile);
+      savePreferredQuality(appliedProfile);
       debugEvent("quality", "committed", { generation, applied: appliedProfile });
       outcome = "applied";
       if (nativeUpdate) {
diff --git a/tests/host-quality-ownership.test.ts b/tests/host-quality-ownership.test.ts
index 302ba4dc6..1beeadad1 100644
--- a/tests/host-quality-ownership.test.ts
+++ b/tests/host-quality-ownership.test.ts
@@ -101,7 +101,7 @@ function fixture(launchedByClient = true) {
     nativeEventCleanupRef: ref(null), nativeShareCleanupRef: ref(Promise.resolve()),
     peersRef: ref(new Map([["viewer", peer]])), hostProvisionalChildRef: ref(null), hostSfuRouteRef: ref(route),
     signalRef: ref({ setHostQualitySettings: vi.fn(), send: vi.fn() }),
-    setQualitySettings: vi.fn(), setAdvancedQuality: vi.fn(), setChangingQuality: vi.fn(),
+    setQualitySettings: vi.fn(), setAdvancedQuality: vi.fn(), setChangingQuality: vi.fn(), savePreferredQuality: vi.fn(),
     setNoticeValue: vi.fn(), setNoticeError: vi.fn(), readableError: hostActionErrorNotice,
     setDetails: vi.fn(), setNativeActive: vi.fn(),
     applyCaptureProfile: vi.fn(async (_stream: unknown, profile: QualitySettings) => { physical = profile; }),
@@ -424,6 +424,21 @@ describe("Host room-link copy feedback", () => {
 });
 
 describe("Host quality ownership", () => {
+  it("remembers an explicit pre-share choice without changing room or capture state", async () => {
+    const current = fixture();
+    current.context.phase = "idle";
+    await current.change(lower);
+    expect(current.savePreferredQuality).toHaveBeenCalledWith(lower);
+    expect(current.applyCaptureProfile).not.toHaveBeenCalled();
+    expect(current.signalRef.current.setHostQualitySettings).not.toHaveBeenCalled();
+  });
+
+  it("does not replace a local preference with reauthenticated room settings", () => {
+    const current = fixture();
+    current.reauthenticate();
+    expect(current.savePreferredQuality).not.toHaveBeenCalled();
+  });
+
   it.each([true, false])("resumes the former raw audio input only after an accepted mixed-output resume: %s", (accepted) => {
     const current = fixture(false);
     const source = {} as MediaStream;
@@ -1102,6 +1117,7 @@ describe("Host quality ownership", () => {
     expect(current.physical()).toEqual(lower);
     expect(current.qualitySettingsRef.current).toEqual(lower);
     expect(current.advancedQualityRef.current).toEqual(lower);
+    expect(current.savePreferredQuality).toHaveBeenCalledWith(lower);
     expect(current.peer.updateCaptureProfile).toHaveBeenCalledWith(lower);
     expect(optional.dispose).toHaveBeenCalledOnce();
     expect(current.client.stopReceive).toHaveBeenCalledWith("share");
@@ -1116,6 +1132,7 @@ describe("Host quality ownership", () => {
     current.applyCaptureProfile.mockRejectedValue(new Error("capture rejected"));
     await current.change(lower);
     expect(current.physical()).toEqual(original);
+    expect(current.savePreferredQuality).not.toHaveBeenCalled();
     expect(current.qualitySettingsRef.current).toEqual(original);
     expect(current.advancedQualityRef.current).toEqual(original);
     expect(optional.updateProfile).not.toHaveBeenCalled();
@@ -1160,6 +1177,7 @@ describe("Host quality ownership", () => {
     pending.resolve();
     await changing;
     expect(current.qualitySettingsRef.current).toEqual(original);
+    expect(current.savePreferredQuality).not.toHaveBeenCalled();
     expect(current.signalRef.current.setHostQualitySettings).not.toHaveBeenCalled();
   });
 
diff --git a/tests/quality-preference.test.ts b/tests/quality-preference.test.ts
new file mode 100644
index 000000000..282968565
--- /dev/null
+++ b/tests/quality-preference.test.ts
@@ -0,0 +1,36 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { DEFAULT_QUALITY_SETTINGS } from "../src/shared/protocol";
+import { readPreferredQuality, savePreferredQuality } from "../src/client/lib/quality-preference";
+
+afterEach(() => vi.unstubAllGlobals());
+
+describe("sharing quality preference", () => {
+  it("retains explicit picture and audio settings across reads", () => {
+    const storage = new Map<string, string>();
+    vi.stubGlobal("window", { localStorage: {
+      getItem: (key: string) => storage.get(key) ?? null,
+      setItem: (key: string, value: string) => storage.set(key, value),
+    } });
+    expect(readPreferredQuality()).toEqual(DEFAULT_QUALITY_SETTINGS);
+    const chosen = { ...DEFAULT_QUALITY_SETTINGS, resolution: "1440p" as const,
+      maxFramerate: 60, maxBitrate: 10_000_000, degradationPreference: "maintain-resolution" as const,
+      screenAudioQuality: "very-high" as const };
+    savePreferredQuality(chosen);
+    expect(readPreferredQuality()).toEqual(chosen);
+    savePreferredQuality({ ...chosen, maxBitrate: -1 });
+    expect(readPreferredQuality()).toEqual(chosen);
+  });
+
+  it.each(["{", "null", "{}", JSON.stringify({ ...DEFAULT_QUALITY_SETTINGS, resolution: "2160p" })])(
+    "uses valid defaults when saved settings are malformed or unsupported: %s", stored => {
+      vi.stubGlobal("window", { localStorage: { getItem: () => stored } });
+      expect(readPreferredQuality()).toEqual(DEFAULT_QUALITY_SETTINGS);
+    },
+  );
+
+  it("keeps sharing usable when Browser storage is denied", () => {
+    vi.stubGlobal("window", { get localStorage() { throw new Error("storage denied"); } });
+    expect(readPreferredQuality()).toEqual(DEFAULT_QUALITY_SETTINGS);
+    expect(() => savePreferredQuality(DEFAULT_QUALITY_SETTINGS)).not.toThrow();
+  });
+});

From a11393e05357e85cb136540ba13ee300ffcf695d Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 11:15:50 +0800
Subject: [PATCH 005/262] test(media): align topology gate with current sharing
 owners

---
 docs/todo.md                       |   8 +-
 scripts/peer-assisted-benchmark.ts | 225 +++++------------------------
 2 files changed, 39 insertions(+), 194 deletions(-)

diff --git a/docs/todo.md b/docs/todo.md
index 56580e959..0d40b53b4 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -22,8 +22,7 @@ history. A parked idea is not implementation authority.
   #432's motion-quality evidence and existing unmatched reports; do not equate a
   successful local reproduction with resolving a different reporter's cause.
 - [ ] **Current-contract runtime acceptance.** Exercise sharing, source/quality
-  replacement, reconnect, peer/SFU handoff and independent retirement. Repair
-  the obsolete optional `viewer-mbb` canary before using it as evidence. Review
+  replacement, reconnect, peer/SFU handoff and independent retirement. Review
   responsive interaction and reader documentation against the accepted result;
   keep unavailable physical-device checks explicit.
 - [ ] **Deferred-work decisions.** Reassess transport, microphone pairing,
@@ -123,6 +122,9 @@ of a reporter's cause; research owns the completed experiments and their limits.
   the [runtime evidence](./research/cross-platform-client-runtime.md#public-invitation-startup).
   [#434](https://github.com/TNTcraftHIM/Piik/issues/434) establishes DNS refusal
   during edge discovery, not a cause shared by all startup reports.
+  [#452](https://github.com/TNTcraftHIM/Piik/issues/452) records both QUIC and TCP
+  connection timeouts; compare the same endpoint with/without its accelerator.
+  That startup log contains no evidence for its separate H.264 report.
 - [ ] **Viewer interruptions.** Obtain paired endpoint/upstream-relay diagnostics
   for established viewing returning to P2P connecting, including
   [#429](https://github.com/TNTcraftHIM/Piik/issues/429)'s SFU-to-P2P dropout.
@@ -185,8 +187,6 @@ works, so a Rust alternative needs a concrete Go limitation.
 1. **Representative device/network acceptance.** Resume the remaining matrix in
    [verification status](./verification-status.md#remaining-device-and-network-acceptance)
    when directed, preserving platform deferrals and serial physical checks.
-   Before reusing the optional `viewer-mbb` canary, replace its obsolete
-   Viewer-only trigger and capacity assertions with the sender-owned contract.
 2. **Broader quality work.** Reopen from measured interruptions, failed recovery
    or healthy-sibling degradation at acceptable complexity. The
    [Browser pool comparison](./research/browser-local-encoding-pool.md#balanced-startup-and-recovery)
diff --git a/scripts/peer-assisted-benchmark.ts b/scripts/peer-assisted-benchmark.ts
index 9e41942c5..ecf076490 100644
--- a/scripts/peer-assisted-benchmark.ts
+++ b/scripts/peer-assisted-benchmark.ts
@@ -27,7 +27,6 @@ const PROFILE_SETTINGS = QUALITY_PROFILES;
 type ProfileId = QualityProfileId;
 type PageRole = "host" | "viewer";
 type BenchmarkCodecMode = "vp8" | "auto" | "h264";
-type BenchmarkCanaryMode = "none" | "viewer-mbb";
 
 const ROUTE_TIMING_KEYS = [
   "queueWaitMs",
@@ -54,14 +53,6 @@ type BenchmarkRouteTimingSummary = Record<
   RouteTimingDistribution
 >;
 
-interface ViewerMbbCanaryResult {
-  kind: "viewer-mbb";
-  status: "passed" | "failed";
-  assertions: Record<string, boolean>;
-  counters: Record<string, number>;
-  failureCode?: "topology-unavailable" | "probe-unavailable";
-}
-
 interface BenchmarkConfig {
   chromePath: string;
   viewerCounts: number[];
@@ -78,7 +69,6 @@ interface BenchmarkConfig {
   headless: boolean;
   noSandbox: boolean;
   qualityControlSmoke: boolean;
-  canaryMode: BenchmarkCanaryMode;
 }
 
 interface ExternalServerTarget {
@@ -567,12 +557,6 @@ function parseBoolean(value: string | undefined, fallback: boolean, name: string
   throw new Error(`${name} must be true, false, 1, or 0`);
 }
 
-function parseBenchmarkCanaryMode(value: string | undefined): BenchmarkCanaryMode {
-  const mode = value?.trim() || "none";
-  if (mode === "none" || mode === "viewer-mbb") return mode;
-  throw new Error("BENCHMARK_CANARY must be none or viewer-mbb");
-}
-
 function parseBenchmarkCodecMode(
   value: string | undefined,
 ): BenchmarkCodecMode {
@@ -619,11 +603,8 @@ function parseBenchmarkConfig(
       "BENCHMARK_QUALITY_SMOKE requires a selected viewer count of at least 3",
     );
   }
-  const canaryMode = parseBenchmarkCanaryMode(environment.BENCHMARK_CANARY);
-  if (canaryMode === "viewer-mbb" && !viewerCounts.includes(3)) {
-    throw new Error(
-      "BENCHMARK_CANARY=viewer-mbb requires a selected viewer count of 3",
-    );
+  if (environment.BENCHMARK_CANARY && environment.BENCHMARK_CANARY !== "none") {
+    throw new Error("BENCHMARK_CANARY is obsolete; this gate covers topology and relay-loss recovery");
   }
   const recoveryText = environment.BENCHMARK_RECOVERY_VIEWERS?.trim();
   const recoveryViewerCount = recoveryText ? Number(recoveryText) : null;
@@ -697,7 +678,6 @@ function parseBenchmarkConfig(
       "BENCHMARK_CHROME_NO_SANDBOX",
     ),
     qualityControlSmoke,
-    canaryMode,
   };
 }
 
@@ -1677,12 +1657,18 @@ function buildBenchmarkInitScript(options: {
   height: number;
   frameRate: number;
   expectedEndpointCap: number;
+  qualityControlSmoke?: boolean;
 }): string {
   const serialized = JSON.stringify(options);
   return `(() => {
     if (globalThis.__PIIK_BENCHMARK__) return;
     const options = ${serialized};
     const expectedRoleCap = options.expectedEndpointCap;
+    // The parameter-readback arm exercises ordinary senders. Pool producers
+    // and their independent transport clocks have separate probe coverage.
+    if (options.qualityControlSmoke) {
+      Object.defineProperty(RTCRtpSender.prototype, "createEncodedStreams", { value: undefined, configurable: true });
+    }
     if (options.clearHostRoom) {
       try { localStorage.removeItem("piik:host-room:v1"); } catch {}
     }
@@ -1714,7 +1700,6 @@ function buildBenchmarkInitScript(options: {
     let transitionRevision = -1;
     let transitionPhase = null;
     let plannedRouteAssignment = null;
-    const canary = { prepareUpdates: 0, activeUpdates: 0, routeFailed: 0 };
     const nativeSends = new WeakMap();
     const routeTimingKeys = ${JSON.stringify(ROUTE_TIMING_KEYS)};
     let routeDiagnosticRequested = false;
@@ -1806,8 +1791,6 @@ function buildBenchmarkInitScript(options: {
       transitionRevision = revision;
       transitionPhase = phase;
       plannedRouteAssignment = assignment;
-      if (phase === "prepare") canary.prepareUpdates += 1;
-      else canary.activeUpdates += 1;
       if (phase === "active") {
         state.routeRevision = revision;
         state.routeAssignment = cloneRouteAssignment(assignment);
@@ -1879,8 +1862,6 @@ function buildBenchmarkInitScript(options: {
         return;
       } else if (direction === "out" && message.type === "set-quality-settings") {
         state.qualitySettings = message.qualitySettings;
-      } else if (direction === "out" && message.type === "route-failed") {
-        canary.routeFailed += 1;
       }
       if (direction === "in" && message.type === "authenticated") {
         state.peerId = message.peerId;
@@ -1923,8 +1904,6 @@ function buildBenchmarkInitScript(options: {
         const nativeSend = socket.send;
         nativeSends.set(socket, nativeSend);
         socket.send = function(data) {
-          let parsed = null;
-          if (typeof data === "string") { try { parsed = JSON.parse(data); } catch {} }
           const result = nativeSend.call(socket, data);
           handleSignalMessage(data, "out", socket);
           return result;
@@ -1939,7 +1918,7 @@ function buildBenchmarkInitScript(options: {
       },
     });
 
-    function sendCanaryMessage(message) {
+    function sendDiagnosticMessage(message) {
       const socket = signalingSocket;
       const nativeSend = socket ? nativeSends.get(socket) : null;
       if (!socket || typeof nativeSend !== "function") return false;
@@ -1958,7 +1937,7 @@ function buildBenchmarkInitScript(options: {
         return false;
       }
       routeDiagnosticRequested = true;
-      if (sendCanaryMessage({ type: "request-route-diagnostic" })) {
+      if (sendDiagnosticMessage({ type: "request-route-diagnostic" })) {
         return true;
       }
       routeDiagnosticRequested = false;
@@ -2213,11 +2192,8 @@ function buildBenchmarkInitScript(options: {
       };
     }
 
-    function canarySnapshot() {
-      return { ...canary, connectionCount: connections.length, maxActiveOutboundMediaEdges: state.maxActiveOutboundMediaEdges };
-    }
     function senderDegradationPreferences() {
-      return connections.flatMap(({ connection }) => {
+      return networkConnections().flatMap(({ connection }) => {
         if (
           connection.connectionState === "closed" ||
           connection.connectionState === "failed"
@@ -2227,15 +2203,12 @@ function buildBenchmarkInitScript(options: {
           .map((sender) => sender.getParameters().degradationPreference ?? null);
       });
     }
-    function sendViewerQualityEvidence(message) {
-      return message?.type === "viewer-quality-evidence" && sendCanaryMessage(message);
-    }
     function markShareRequested() {
       state.shareRequestedAtEpochMs = Date.now();
     }
     Object.defineProperty(globalThis, "__PIIK_BENCHMARK__", {
       configurable: false,
-      value: { sample, progress, snapshot, canarySnapshot, senderDegradationPreferences, sendViewerQualityEvidence, markShareRequested, requestRouteDiagnosticSnapshot, routeDiagnosticTimingSamples, stop: () => clearInterval(videoObserver) },
+      value: { sample, progress, snapshot, senderDegradationPreferences, markShareRequested, requestRouteDiagnosticSnapshot, routeDiagnosticTimingSamples, stop: () => clearInterval(videoObserver) },
     });
   })();`;
 }
@@ -2563,17 +2536,18 @@ async function startHost(
     "host controls",
     signal,
   );
+  await evaluate(cdp, page, `(() => {
+    const settings = document.querySelector('button[aria-controls="host-advanced-door"]');
+    if (!(settings instanceof HTMLButtonElement)) throw new Error('Sharing settings button missing');
+    if (settings.getAttribute('aria-expanded') !== 'true') settings.click();
+  })()`);
+  await waitForPage(cdp, page, "document.querySelector('#host-advanced-door .lr-tiles button')",
+    5_000, "sharing settings", signal);
   if (codecMode !== "auto") {
-    await evaluate(
-      cdp,
-      page,
-      `(() => {
-        const advanced = document.querySelector('button[aria-controls="host-advanced-door"]');
-        if (!(advanced instanceof HTMLButtonElement)) throw new Error('Advanced settings button missing');
-        advanced.click();
-        return true;
-      })()`,
-    );
+    await evaluate(cdp, page, `(() => {
+      const technical = document.querySelector('#host-advanced-door details');
+      if (technical instanceof HTMLDetailsElement && !technical.open) technical.querySelector('summary')?.click();
+    })()`);
     await waitForPage(
       cdp,
       page,
@@ -2612,6 +2586,9 @@ async function startHost(
       return true;
     })()`,
   );
+  await waitForPage(cdp, page, "document.querySelector('.lr-source-option.is-browser')",
+    5_000, "Browser capture choice", signal);
+  await evaluate(cdp, page, "document.querySelector('.lr-source-option.is-browser').click()");
   await waitForPage(
     cdp,
     page,
@@ -2896,7 +2873,10 @@ async function runQualityControlSmoke(
           10_000,
           `${preference} sender parameter readback`,
           signal,
-        );
+        ).catch(async error => {
+          const values = await evaluate(cdp, page, "globalThis.__PIIK_BENCHMARK__.senderDegradationPreferences()");
+          throw new Error(`${errorMessage(error)}; expected ${expectedCount} sender(s), received ${JSON.stringify(values)}`);
+        });
         return evaluate<boolean>(cdp, page, `Boolean(${predicate})`);
       }),
     );
@@ -3207,123 +3187,6 @@ async function runRecovery(
   };
 }
 
-async function runViewerMbbCanary(
-  cdp: CdpConnection,
-  pages: PageHandle[],
-  signal: AbortSignal,
-): Promise<ViewerMbbCanaryResult> {
-  const failed = (failureCode: ViewerMbbCanaryResult["failureCode"]): ViewerMbbCanaryResult => ({
-    kind: "viewer-mbb", status: "failed", assertions: {}, counters: {}, failureCode,
-  });
-  let parentHandle: PageHandle | null = null;
-  try {
-    const observations = await Promise.all(pages.map((page) => progressSample(cdp, page)));
-    const byPeer = new Map(observations.flatMap((page) => page.peerId ? [[page.peerId, page] as const] : []));
-    const viewers = observations.filter((page) => page.role === "viewer");
-    const target = viewers.find((page) => {
-      const upstream = page.routeAssignment?.upstream;
-      const parent = upstream?.kind === "peer" ? byPeer.get(upstream.peerId) : null;
-      return page.routeRevision !== null && upstream?.kind === "peer" &&
-        parent?.role === "viewer" && page.routeAssignment?.childPeerIds.length === 0;
-    });
-    const candidate = viewers.find((page) => page !== target && page.peerId &&
-      page.routeAssignment?.childPeerIds.length === 0 && hasAuthoritativeMediaUpstream(page) &&
-      activeVideoEdgeCount(page, "send") === 0);
-    if (!target || !candidate || target.routeAssignment?.upstream.kind !== "peer") return failed("topology-unavailable");
-    const parent = byPeer.get(target.routeAssignment.upstream.peerId);
-    if (!parent) return failed("topology-unavailable");
-    const targetHandle = pages.find((page) => page.label === target.label);
-    parentHandle = pages.find((page) => page.label === parent.label) ?? null;
-    const candidateHandle = pages.find((page) => page.label === candidate.label);
-    const old = target.connections.find((connection) =>
-      connection.hasInboundVideo && connection.connectionState === "connected" &&
-      connection.remotePeerId === parent.peerId && connection.connectionId,
-    );
-    if (!targetHandle || !parentHandle || !candidateHandle || !old || target.routeRevision === null || !target.peerId || !parent.peerId || !old.connectionId) return failed("probe-unavailable");
-    const oldFrames = old.receiveTotals?.framesTotal ?? 0;
-    const revision = target.routeRevision;
-    const send = (page: PageHandle, method: string, message: unknown) =>
-      evaluate<boolean>(cdp, page, `globalThis.__PIIK_BENCHMARK__.${method}(${JSON.stringify(message)})`);
-    let windows = 0;
-    for (let sequence = 0; sequence < 3; sequence += 1) {
-      const windowSent = await send(targetHandle, "sendViewerQualityEvidence", {
-        type: "viewer-quality-evidence", guard: { connectionId: old.connectionId, routeRevision: revision },
-        sequence, windowMs: 2_000,
-        metrics: { width: null, height: null, framesPerSecond: 0, bitrateKbps: 0,
-          packetsReceivedDelta: 100, packetsLostDelta: 0, jitterMs: 0, framesDecodedDelta: 0,
-          framesDroppedDelta: 0, decodeMsPerFrame: 0, freezeCountDelta: 0, freezeDurationMsDelta: null,
-          codec: null, codecProfile: null, codecParameters: null },
-      });
-      if (windowSent) windows += 1;
-      if (sequence < 2) await delay(2_100, signal);
-    }
-    let retained = false, provisional = false, promoted = false, sameIdentity = false, framesAdvanced = false;
-    let newId: string | null = null, newIndex: number | null = null;
-    let targetTelemetry = await canary(cdp, targetHandle);
-    let parentTelemetry = await canary(cdp, parentHandle);
-    let candidateTelemetry = await canary(cdp, candidateHandle);
-    const deadline = Date.now() + 15_000;
-    while (Date.now() < deadline) {
-      const current = await progressSample(cdp, targetHandle);
-      targetTelemetry = await canary(cdp, targetHandle);
-      parentTelemetry = await canary(cdp, parentHandle);
-      candidateTelemetry = await canary(cdp, candidateHandle);
-      const currentOld = current.connections.find((connection) => connection.connectionId === old.connectionId);
-      const currentNew = current.connections.find((connection) => connection.hasInboundVideo && connection.index !== old.index && connection.connectionState === "connected" && connection.connectionId !== old.connectionId);
-      if (currentOld?.connectionState === "connected" && currentNew) {
-        retained = true; provisional = true; newId = currentNew.connectionId; newIndex = currentNew.index;
-      }
-      framesAdvanced ||= (currentOld?.receiveTotals?.framesTotal ?? oldFrames) > oldFrames;
-      const upstream = current.routeAssignment?.upstream;
-      const upstreamPeerId = upstream?.kind === "peer" ? upstream.peerId : null;
-      promoted = current.routeRevision !== null && current.routeRevision !== revision && upstreamPeerId !== null && upstreamPeerId !== parent.peerId;
-      if (promoted) {
-        const active = current.connections.find((connection) => connection.hasInboundVideo && connection.connectionState === "connected" && connection.remotePeerId === upstreamPeerId);
-        sameIdentity = Boolean(active && ((newId && active.connectionId === newId) || (!newId && active.index === newIndex)));
-      }
-      if (promoted && sameIdentity && retained && framesAdvanced) break;
-      await delay(100, signal);
-    }
-    const assertions = {
-      syntheticViewerEvidence: windows === 3,
-      oldEdgeRetained: retained,
-      provisionalPcObserved: provisional,
-      promotedToViewerCandidate: promoted,
-      provisionalIdentityPromoted: sameIdentity,
-      oldMediaFramesAdvanced: framesAdvanced,
-      endpointCapRespected: Math.max(targetTelemetry.maxActiveOutboundMediaEdges, parentTelemetry.maxActiveOutboundMediaEdges, candidateTelemetry.maxActiveOutboundMediaEdges) <= 1,
-      noRouteFailed: targetTelemetry.routeFailed === 0 && parentTelemetry.routeFailed === 0 && candidateTelemetry.routeFailed === 0,
-    };
-    return { kind: "viewer-mbb", status: Object.values(assertions).every(Boolean) ? "passed" : "failed", assertions,
-      counters: { pages: pages.length, evidenceWindows: windows,
-        routePrepareUpdates: targetTelemetry.prepareUpdates + parentTelemetry.prepareUpdates + candidateTelemetry.prepareUpdates,
-        routeActiveUpdates: targetTelemetry.activeUpdates + parentTelemetry.activeUpdates + candidateTelemetry.activeUpdates,
-        maxActiveOutboundEdges: Math.max(targetTelemetry.maxActiveOutboundMediaEdges, parentTelemetry.maxActiveOutboundMediaEdges, candidateTelemetry.maxActiveOutboundMediaEdges),
-        routeFailedMessages: targetTelemetry.routeFailed + parentTelemetry.routeFailed + candidateTelemetry.routeFailed },
-      ...(Object.values(assertions).every(Boolean) ? {} : { failureCode: "probe-unavailable" as const }) };
-  } catch {
-    return failed("probe-unavailable");
-  }
-}
-
-async function canary(cdp: CdpConnection, page: PageHandle): Promise<{
-  prepareUpdates: number; activeUpdates: number; routeFailed: number;
-  maxActiveOutboundMediaEdges: number;
-}> {
-  return evaluate(cdp, page, "globalThis.__PIIK_BENCHMARK__.canarySnapshot()");
-}
-
-function canaryChecks(result: ViewerMbbCanaryResult): RunCheck[] {
-  return [
-    ...Object.entries(result.assertions).map(([name, passed]) => ({
-      name: `viewer-mbb-${name}`, passed, actual: passed, expected: "true",
-    })),
-    ...Object.entries(result.counters).map(([name, actual]) => ({
-      name: `viewer-mbb-counter-${name}`, passed: true, actual, expected: "sanitized counter",
-    })),
-  ];
-}
-
 async function runCase(
   cdp: CdpConnection,
   baseUrl: string,
@@ -3345,6 +3208,7 @@ async function runCase(
       height: captureResolution.height,
       frameRate: capture.maxFramerate,
       expectedEndpointCap: config.expectedEndpointCap,
+      qualityControlSmoke: config.qualityControlSmoke,
     };
     const hostPage = await createPage(cdp, baseUrl, {
       ...commonInit,
@@ -3413,21 +3277,6 @@ async function runCase(
     if (config.settleMs > 0) {
       await delay(config.settleMs, signal);
     }
-    if (config.canaryMode === "viewer-mbb" && viewerCount === 3) {
-      const canaryResult = await runViewerMbbCanary(cdp, pages, signal);
-      return {
-        viewerCount,
-        startedAt: new Date(startedAtMs).toISOString(),
-        completedAt: new Date().toISOString(),
-        status: canaryResult.status,
-        checks: canaryChecks(canaryResult),
-        summary: null,
-        routeTimingSummary,
-        routeTimingStatus,
-        samples: [],
-        recovery: { triggered: false },
-      };
-    }
     const measurementStartedAt = Date.now();
     const deadline = measurementStartedAt + config.durationMs;
     do {
@@ -3668,7 +3517,6 @@ async function main(): Promise<number> {
       headless: config.headless,
       noSandbox: config.noSandbox,
       qualityControlSmoke: config.qualityControlSmoke,
-      canaryMode: config.canaryMode,
       chromeExecutable: basename(config.chromePath),
       output: config.outputPath ?? "stdout",
     },
@@ -3689,7 +3537,8 @@ async function main(): Promise<number> {
         ? "The external server target is exercised as configured; the gate does not infer unavailable transports."
         : "The local runner does not start LiveKit; SFU consistency is reported only when an SFU route is actually observed.",
       "The harness emits raw gate fields and simple invariants; it does not implement a route score or runtime policy.",
-      "BENCHMARK_CANARY=viewer-mbb injects only sanitized control counters; it does not claim detector quality or network performance. Host-candidate and signaling-blackhole canaries remain deferred.",
+      "BENCHMARK_QUALITY_SMOKE disables encoded-stream support to verify ordinary-sender parameter propagation. Browser pool producer/clock settings are checked by browser-local-pool-probe.ts.",
+      "This gate measures initial topology and relay-loss recovery, not sender-quality convergence or synthetic Viewer-triggered handoffs.",
     ],
     runs: [],
   };
@@ -3724,10 +3573,7 @@ async function main(): Promise<number> {
         PUBLIC_BASE_URL: baseUrl,
         ALLOWED_ORIGINS: baseUrl,
         ENDPOINT_MEDIA_COPY_CAPACITY: String(config.expectedEndpointCap),
-        MAX_VIEWERS_PER_ROOM: String(Math.max(
-          ...config.viewerCounts,
-          config.canaryMode === "viewer-mbb" ? 3 : 1,
-        )),
+        MAX_VIEWERS_PER_ROOM: String(Math.max(...config.viewerCounts)),
         // The loopback gate measures peer topology, never a relayed candidate.
         STUN_URLS: "",
       }, profileDirectory);
@@ -3774,8 +3620,7 @@ async function main(): Promise<number> {
       await authenticateExternalServer(cdp, externalServer, abortController.signal);
     }
 
-    const viewerCounts = config.canaryMode === "viewer-mbb" ? [3] : config.viewerCounts;
-    for (const viewerCount of viewerCounts) {
+    for (const viewerCount of config.viewerCounts) {
       abortController.signal.throwIfAborted();
       console.error(`Running peer-topology loopback with ${viewerCount} viewer(s)`);
       report.runs.push(

From 417daee0ddf9adbe259f0e59041eeb5bb9055e65 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 11:20:42 +0800
Subject: [PATCH 006/262] docs: clarify public invitation outbound connectivity

---
 docs/guide/troubleshooting.md                  | 5 +++++
 docs/guide/troubleshooting.zh-CN.md            | 4 ++++
 docs/research/cross-platform-client-runtime.md | 8 ++++++++
 3 files changed, 17 insertions(+)

diff --git a/docs/guide/troubleshooting.md b/docs/guide/troubleshooting.md
index 7203d1270..e13c3544c 100644
--- a/docs/guide/troubleshooting.md
+++ b/docs/guide/troubleshooting.md
@@ -217,6 +217,11 @@ from a page that opens but reports **No media route available**.
    firewall blocks Cloudflare Tunnel; adjust only relevant rules. Ask the
    administrator about a school or workplace network.
 
+For a terminal timeout mentioning `:7844`, check outbound connections from
+`cloudflared`, including proxy or game-accelerator rules.
+[Cloudflare's connectivity checks](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/connectivity-prechecks/)
+cover UDP and TCP on this port. This does not require opening an inbound port on your router.
+
 If it keeps failing, you can share through the [online site or an existing site](./getting-started.md#share-from-an-existing-site).
 Include the App version, failure time and [App diagnostic report](../../cmd/piik-app/README.md#diagnostics)
 in feedback. If the unavailable address is a self-hosted site rather than the App's
diff --git a/docs/guide/troubleshooting.zh-CN.md b/docs/guide/troubleshooting.zh-CN.md
index e69738f0f..d733b2e16 100644
--- a/docs/guide/troubleshooting.zh-CN.md
+++ b/docs/guide/troubleshooting.zh-CN.md
@@ -184,6 +184,10 @@ App 的 **公网邀请** 通过 Cloudflare Tunnel 提供临时网页地址。
 3. **对照网络。** 可用手机热点重试，检查 DNS、代理或防火墙是否阻止 Cloudflare Tunnel。
    只调整相关规则；学校或公司的网络应联系管理员。
 
+如果终端中的超时错误带有 `:7844`，请检查 `cloudflared` 的出站连接，
+包括代理或游戏加速器的规则。[Cloudflare 连接检查](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/connectivity-prechecks/)（英文）
+说明了该端口的 UDP 和 TCP 要求，无需在路由器上开放入站端口。
+
 反复失败时可先通过[在线版或已有站点](./getting-started.zh-CN.md#使用已有站点分享)分享。
 反馈中请附上 App 版本、失败时间和 [App 诊断报告](../../cmd/piik-app/README.zh-CN.md#诊断)。
 如果打不开的是自建站点而非 App 的临时地址，请联系该站点管理员检查服务。
diff --git a/docs/research/cross-platform-client-runtime.md b/docs/research/cross-platform-client-runtime.md
index aee09a9f6..1af2c4ae1 100644
--- a/docs/research/cross-platform-client-runtime.md
+++ b/docs/research/cross-platform-client-runtime.md
@@ -190,6 +190,14 @@ own the dependency behavior. An early-exit fixture confirms fourth-start recover
 and bounded exhaustion; these checks do not identify a reporter's API or network
 failure or guarantee four starts when earlier attempts consume the deadline.
 
+The public App log in [#452](https://github.com/TNTcraftHIM/Piik/issues/452),
+reviewed on 2026-10-07, records a QUIC timeout followed by a TCP port-7844
+connect timeout within that deadline. Thus fallback ran; the report does not
+establish a local port-80/443 collision. Its accelerator dependency remains a
+network-path hypothesis requiring the same endpoint with/without the accelerator.
+The attachment contains no capture start, so it cannot diagnose the separately
+reported H.264 failure.
+
 [HTTP 1033](https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-1xxx-errors/error-1033/)
 means Cloudflare cannot find a healthy tunnel connector. App readiness requires
 both the assigned origin and a registered connection; later reconnection belongs

From 2c755bec242993627cc0db9b103dc8a1abc591a3 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 11:46:35 +0800
Subject: [PATCH 007/262] build(go): apply dependency security updates

---
 go.mod |  8 ++++----
 go.sum | 20 ++++++++++----------
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/go.mod b/go.mod
index a933186be..eaef584e7 100644
--- a/go.mod
+++ b/go.mod
@@ -33,9 +33,9 @@ require (
 	github.com/pion/webrtc/v4 v4.2.19
 	github.com/thesyncim/gopus v0.1.1
 	go.uber.org/zap v1.28.0
-	golang.org/x/crypto v0.54.0
-	golang.org/x/mod v0.38.0
-	golang.org/x/net v0.57.0
+	golang.org/x/crypto v0.56.0
+	golang.org/x/mod v0.40.0
+	golang.org/x/net v0.58.0
 	golang.org/x/sync v0.22.0
 	golang.org/x/text v0.41.0
 	google.golang.org/protobuf v1.36.11
@@ -127,7 +127,7 @@ require (
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
-	google.golang.org/grpc v1.83.0 // indirect
+	google.golang.org/grpc v1.83.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	modernc.org/libc v1.75.6 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
diff --git a/go.sum b/go.sum
index 0a1c4bcda..d5c5957be 100644
--- a/go.sum
+++ b/go.sum
@@ -339,14 +339,14 @@ go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
-golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
+golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
 golang.org/x/exp v0.0.0-20260727155853-b88d891fe743 h1:ex206bKw+v3K0dm3andkrIF+ijyQKJG1pLgwQ2PYdQM=
 golang.org/x/exp v0.0.0-20260727155853-b88d891fe743/go.mod h1:EdfpwwqSu+0Li0mzskwHU6FWDV3t9Q+RZDo3QMUtL3Q=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
-golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
+golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
+golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -362,8 +362,8 @@ golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220923203811-8be639271d50/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220923202941-7f9b1623fab7/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -406,8 +406,8 @@ golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
-golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -417,8 +417,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d h1:
 google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d/go.mod h1:K/+WGbmBY7aNW1HDw1fJnKYo10i0DkAX6pows00dLig=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d h1:IL4hdHzcUv2l/gcg98/Rj3FbtE6axwqslOW8SW0C+S0=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.83.0 h1:JeNZEKJFbQxArAMl+hiytHauacDNqJUllNfmIMmpqnQ=
-google.golang.org/grpc v1.83.0/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=
+google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
+google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

From 2ac9aa5ba1b518f7109443ca7bf181b512cb5b94 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 11:46:39 +0800
Subject: [PATCH 008/262] test(media): allow serialized full-room admission

---
 scripts/peer-assisted-benchmark.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/peer-assisted-benchmark.ts b/scripts/peer-assisted-benchmark.ts
index ecf076490..3348efb39 100644
--- a/scripts/peer-assisted-benchmark.ts
+++ b/scripts/peer-assisted-benchmark.ts
@@ -652,7 +652,8 @@ function parseBenchmarkConfig(
     connectionTimeoutMs:
       parseNumber(
         environment.BENCHMARK_CONNECTION_TIMEOUT_SECONDS,
-        20,
+        // Includes the whole burst's queue: the room admits one child at a time.
+        90,
         "BENCHMARK_CONNECTION_TIMEOUT_SECONDS",
         3,
         120,

From b963ae474d7bf9ba172a2ace57cdd0c025ca6c35 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 12:10:45 +0800
Subject: [PATCH 009/262] feat(app): retain sharing preferences across
 invitation origins

---
 docs/guide/getting-started.md                 |  5 +-
 docs/guide/getting-started.zh-CN.md           |  4 +-
 docs/standards/configuration.md               |  4 +
 docs/standards/media-quality.md               | 17 ++--
 internal/app/app.go                           | 13 +++-
 internal/app/config/config.go                 |  6 +-
 internal/app/config/quality_preference.go     | 76 ++++++++++++++++++
 .../app/config/quality_preference_test.go     | 74 ++++++++++++++++++
 internal/app/loopback/quality_preference.go   | 53 +++++++++++++
 .../app/loopback/quality_preference_test.go   | 78 +++++++++++++++++++
 internal/app/loopback/server.go               | 72 +++++++++--------
 src/client/native/quality-preference.ts       | 65 ++++++++++++++++
 src/client/native/wire.ts                     |  1 +
 src/client/pages/HostPage.tsx                 | 47 ++++++++++-
 tests/host-quality-ownership.test.ts          | 54 ++++++++++++-
 tests/native-quality-preference.test.ts       | 68 ++++++++++++++++
 16 files changed, 586 insertions(+), 51 deletions(-)
 create mode 100644 internal/app/config/quality_preference.go
 create mode 100644 internal/app/config/quality_preference_test.go
 create mode 100644 internal/app/loopback/quality_preference.go
 create mode 100644 internal/app/loopback/quality_preference_test.go
 create mode 100644 src/client/native/quality-preference.ts
 create mode 100644 tests/native-quality-preference.test.ts

diff --git a/docs/guide/getting-started.md b/docs/guide/getting-started.md
index 8d69e9c43..22c8f2665 100644
--- a/docs/guide/getting-started.md
+++ b/docs/guide/getting-started.md
@@ -149,8 +149,9 @@ sharing to allow that fallback. The project's online site uses P2P only.
 ## Picture and sound settings
 
 Open **Sharing settings** below the picture to adjust picture and audio quality.
-Piik remembers your applied settings in this browser for this site. A new
-temporary public-invite address has separate settings.
+Piik remembers your applied settings for the next visit. Browser-only use remembers
+them for the current site; opening Piik through an updated App also keeps them
+when your public-invite address changes.
 
 ## Add your voice
 
diff --git a/docs/guide/getting-started.zh-CN.md b/docs/guide/getting-started.zh-CN.md
index 9bfbb7595..4f6ae532b 100644
--- a/docs/guide/getting-started.zh-CN.md
+++ b/docs/guide/getting-started.zh-CN.md
@@ -132,8 +132,8 @@ Linux 原生采集还需要[系统组件](../../native/capture/linux/README.md)
 ## 画面与声音设置
 
 在画面下方打开 **分享设置**，调整画质和音频质量。
-Piik 会在当前浏览器中记住这个站点上已应用的设置；
-公网邀请每次生成的新网址使用独立设置。
+Piik 会记住已应用的设置，供下次使用。仅用浏览器时，设置保存在当前站点；
+通过新版 App 打开时，更换公网邀请网址也能保留设置。
 
 ## 加上自己的声音
 
diff --git a/docs/standards/configuration.md b/docs/standards/configuration.md
index 040ea29b6..d9b9c32e6 100644
--- a/docs/standards/configuration.md
+++ b/docs/standards/configuration.md
@@ -146,6 +146,10 @@ Command-line options select entry and local runtime behavior:
 
 Share quality, room access policy, language and theme are configured in
 the shared Web UI. Decorative motion follows the system's reduced-motion preference.
+App-wide picture/audio quality preferences use `<config-path>.quality`; removing
+that optional file resets them on the next App launch. It contains no device or
+room credentials. The [media owner](./media-quality.md#video-profiles) defines when
+preferences apply; older Apps ignore the file and keep reading `client.json`.
 
 ## Diagnostics
 
diff --git a/docs/standards/media-quality.md b/docs/standards/media-quality.md
index 21b2033c4..d8d81387d 100644
--- a/docs/standards/media-quality.md
+++ b/docs/standards/media-quality.md
@@ -101,13 +101,16 @@ contract. [Status](../status.md) indexes delivery and remaining acceptance.
 
 ## Video Profiles
 
-The Host remembers explicitly applied picture and source-audio quality settings
-in same-origin Browser storage. They seed a new page; authoritative room recovery
-still owns an existing share. Failed or superseded changes and server snapshots
-do not replace the preference. Storage failure falls back to session-only use.
-This does not retain capture permission, device/session identity or microphone
-activation. A different site or temporary public-link origin has separate
-Browser preferences; this is not an App-wide configuration sync.
+The Host remembers explicitly applied picture and source-audio quality settings.
+Browser-only use stores them per origin. An App-opened page uses the running,
+authorized App's optional preference store when available, including across
+temporary public-link origins; older or unavailable Apps retain Browser storage.
+These preferences seed a new page, never an active share. Explicit edits and
+authoritative room recovery win over a late preference read. Failed or superseded
+changes and server snapshots do not replace the preference; pending saves retain
+only the latest applied choice. Storage failure never fails capture or startup.
+This does not retain capture permission, device/session identity, routing policy
+or microphone activation, and reading settings claims no Native media session.
 
 The three recommended profiles are ceilings, not delivery guarantees:
 
diff --git a/internal/app/app.go b/internal/app/app.go
index f65036af5..c70859f3b 100644
--- a/internal/app/app.go
+++ b/internal/app/app.go
@@ -158,11 +158,16 @@ func Run(ctx context.Context, options Options) (returnedErr error) {
 			"softwareVP8", nativeMedia.capabilities.SoftwareVP8, diagnostics.Error(nativeMedia.discoveryErr))
 	}
 	recordContext(options, config)
+	qualityPreference, preferenceErr := appconfig.LoadQualityPreference(configPath)
+	if preferenceErr != nil {
+		slog.Debug("piik-client", "event", "quality-preference-load-failed", diagnostics.Error(preferenceErr))
+	}
 	control, err := loopback.Start(ctx, loopback.Options{
-		AllowedOrigins: allowedOrigins(config.Site, options.Port),
-		NativeMedia:    nativeMedia.capabilities,
-		NewControl:     nativeMedia.controlFactory(),
-		Presentation:   options.console.setLanguage,
+		AllowedOrigins:    allowedOrigins(config.Site, options.Port),
+		NativeMedia:       nativeMedia.capabilities,
+		NewControl:        nativeMedia.controlFactory(),
+		Presentation:      options.console.setLanguage,
+		QualityPreference: qualityPreference,
 	})
 	if err != nil {
 		return fmt.Errorf("Piik App native control could not start: %w", err)
diff --git a/internal/app/config/config.go b/internal/app/config/config.go
index 62583a33d..d6b096d26 100644
--- a/internal/app/config/config.go
+++ b/internal/app/config/config.go
@@ -72,7 +72,11 @@ func Save(path string, config Config) error {
 	if err != nil {
 		return err
 	}
-	if err = os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
+	return saveFile(path, payload)
+}
+
+func saveFile(path string, payload []byte) error {
+	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
 		return fmt.Errorf("create App configuration directory: %w", err)
 	}
 	// Keep the last readable configuration until the replacement is complete.
diff --git a/internal/app/config/quality_preference.go b/internal/app/config/quality_preference.go
new file mode 100644
index 000000000..e289a0ca1
--- /dev/null
+++ b/internal/app/config/quality_preference.go
@@ -0,0 +1,76 @@
+package config
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+	"os"
+	"sync"
+
+	"github.com/TNTcraftHIM/Piik/internal/server/protocol"
+)
+
+const MaxQualityPreferenceBytes = 1024
+
+// QualityPreference owns optional App-wide settings, not a live capture profile.
+// A separate file leaves the strict configuration readable by published Apps.
+type QualityPreference struct {
+	mu    sync.Mutex
+	path  string
+	value *protocol.QualitySettings
+}
+
+// A missing or unreadable preference must not prevent the App from starting.
+// Even on error the returned store can accept the user's next explicit choice.
+func LoadQualityPreference(configPath string) (*QualityPreference, error) {
+	p := &QualityPreference{path: configPath + ".quality"}
+	file, err := os.Open(p.path)
+	if errors.Is(err, os.ErrNotExist) {
+		return p, nil
+	}
+	if err != nil {
+		return p, err
+	}
+	defer file.Close()
+	payload, err := io.ReadAll(io.LimitReader(file, MaxQualityPreferenceBytes+1))
+	if err != nil {
+		return p, err
+	}
+	var quality protocol.QualitySettings
+	if len(payload) > MaxQualityPreferenceBytes || json.Unmarshal(payload, &quality) != nil {
+		return p, errors.New("invalid saved sharing quality")
+	}
+	p.value = &quality
+	return p, nil
+}
+
+func (p *QualityPreference) Read() *protocol.QualitySettings {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if p.value == nil {
+		return nil
+	}
+	value := *p.value
+	return &value
+}
+
+func (p *QualityPreference) Save(quality protocol.QualitySettings) error {
+	payload, err := json.Marshal(quality)
+	if err != nil {
+		return err
+	}
+	// Reuse the wire validator instead of a second list of accepted settings.
+	if err := json.Unmarshal(payload, &quality); err != nil {
+		return err
+	}
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if p.value != nil && *p.value == quality {
+		return nil
+	}
+	if err := saveFile(p.path, append(payload, '\n')); err != nil {
+		return err
+	}
+	p.value = &quality
+	return nil
+}
diff --git a/internal/app/config/quality_preference_test.go b/internal/app/config/quality_preference_test.go
new file mode 100644
index 000000000..10527de3b
--- /dev/null
+++ b/internal/app/config/quality_preference_test.go
@@ -0,0 +1,74 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/TNTcraftHIM/Piik/internal/server/protocol"
+)
+
+func TestQualityPreferencePersistsWithoutChangingAppConfiguration(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "client.json")
+	if _, err := LoadOrCreate(path); err != nil {
+		t.Fatal(err)
+	}
+	original, _ := os.ReadFile(path)
+	p, err := LoadQualityPreference(path)
+	if err != nil || p.Read() != nil {
+		t.Fatalf("initial preference: %v, %v", p.Read(), err)
+	}
+	quality := protocol.DefaultQualitySettings
+	quality.Resolution, quality.ScreenAudioQuality = "1440p", "very-high"
+	if err := p.Save(quality); err != nil {
+		t.Fatal(err)
+	}
+	loaded, err := LoadQualityPreference(path)
+	if err != nil || loaded.Read() == nil || *loaded.Read() != quality {
+		t.Fatalf("restored: %v, %v", loaded.Read(), err)
+	}
+	copy := loaded.Read()
+	copy.Resolution = "480p"
+	if *loaded.Read() != quality {
+		t.Fatal("caller modified stored settings")
+	}
+	current, _ := os.ReadFile(path)
+	if string(current) != string(original) {
+		t.Fatal("preference changed strict App configuration")
+	}
+	invalid := quality
+	invalid.Resolution = "2160p"
+	if p.Save(invalid) == nil || *p.Read() != quality {
+		t.Fatal("invalid choice changed preference")
+	}
+	if err := os.Remove(path + ".quality"); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Mkdir(path+".quality", 0700); err != nil {
+		t.Fatal(err)
+	}
+	quality.Resolution = "720p"
+	if p.Save(quality) == nil || p.Read().Resolution != "1440p" {
+		t.Fatal("failed write replaced saved preference")
+	}
+}
+
+func TestUnavailableQualityPreferenceCanAcceptTheNextChoice(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "client.json")
+	for _, payload := range []string{"null", "{}", "{", strings.Repeat(" ", MaxQualityPreferenceBytes+1)} {
+		if err := os.WriteFile(path+".quality", []byte(payload), 0600); err != nil {
+			t.Fatal(err)
+		}
+		p, err := LoadQualityPreference(path)
+		if err == nil || p == nil || p.Read() != nil {
+			t.Fatalf("invalid preference: %v, %v", p, err)
+		}
+		if err := p.Save(protocol.DefaultQualitySettings); err != nil {
+			t.Fatal(err)
+		}
+		if p.Read() == nil {
+			t.Fatal("choice was not saved")
+		}
+	}
+}
diff --git a/internal/app/loopback/quality_preference.go b/internal/app/loopback/quality_preference.go
new file mode 100644
index 000000000..2f8527ff4
--- /dev/null
+++ b/internal/app/loopback/quality_preference.go
@@ -0,0 +1,53 @@
+package loopback
+
+import (
+	"encoding/json"
+	"io"
+	"log/slog"
+	"net/http"
+
+	appconfig "github.com/TNTcraftHIM/Piik/internal/app/config"
+	"github.com/TNTcraftHIM/Piik/internal/server/protocol"
+)
+
+func (server *Server) handleQualityPreference(response http.ResponseWriter, request *http.Request) {
+	if server.qualityPreference == nil {
+		http.NotFound(response, request)
+		return
+	}
+	response.Header().Set("Cache-Control", "no-store")
+	if request.Method == http.MethodOptions {
+		response.Header().Set("Access-Control-Allow-Methods", "GET, PUT")
+		response.Header().Set("Access-Control-Allow-Headers", "Content-Type, X-Piik-Instance")
+		allowPrivateNetwork(response, request)
+		response.WriteHeader(http.StatusNoContent)
+		return
+	}
+	if request.Method != http.MethodGet && request.Method != http.MethodPut {
+		response.Header().Set("Allow", "GET, PUT, OPTIONS")
+		http.Error(response, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	// Origin/Host are checked by ServeHTTP. Bind reads and writes to this App run.
+	if request.Header.Get("X-Piik-Instance") != server.endpoint.InstanceToken {
+		http.Error(response, "invalid App instance", http.StatusForbidden)
+		return
+	}
+	if request.Method == http.MethodGet {
+		writeJSON(response, http.StatusOK, server.qualityPreference.Read())
+		return
+	}
+	request.Body = http.MaxBytesReader(response, request.Body, appconfig.MaxQualityPreferenceBytes)
+	decoder := json.NewDecoder(request.Body)
+	var quality protocol.QualitySettings
+	if decoder.Decode(&quality) != nil || decoder.Decode(&struct{}{}) != io.EOF {
+		http.Error(response, "invalid sharing quality", http.StatusBadRequest)
+		return
+	}
+	if err := server.qualityPreference.Save(quality); err != nil {
+		slog.Debug("piik-client", "event", "quality-preference-save-failed", "error", err)
+		http.Error(response, "sharing preference could not be saved", http.StatusInternalServerError)
+		return
+	}
+	response.WriteHeader(http.StatusNoContent)
+}
diff --git a/internal/app/loopback/quality_preference_test.go b/internal/app/loopback/quality_preference_test.go
new file mode 100644
index 000000000..c5d167243
--- /dev/null
+++ b/internal/app/loopback/quality_preference_test.go
@@ -0,0 +1,78 @@
+package loopback
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	appconfig "github.com/TNTcraftHIM/Piik/internal/app/config"
+	"github.com/TNTcraftHIM/Piik/internal/server/protocol"
+)
+
+func TestQualityPreferenceRequiresCurrentOriginAndInstanceWithoutClaimingControl(t *testing.T) {
+	p, err := appconfig.LoadQualityPreference(filepath.Join(t.TempDir(), "client.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	server := startTestServerWithOptions(t, Options{AllowedOrigins: []string{testOrigin}, QualityPreference: p})
+	endpoint := server.Endpoint()
+	response := doHealthRequest(t, endpoint, endpoint.Host, testOrigin)
+	var health Health
+	if err := json.NewDecoder(response.Body).Decode(&health); err != nil {
+		t.Fatal(err)
+	}
+	response.Body.Close()
+	if !health.QualityPreference {
+		t.Fatal("optional preference was not advertised")
+	}
+	payload, _ := json.Marshal(protocol.DefaultQualitySettings)
+	for _, input := range []struct {
+		method, origin, token, body string
+		status                      int
+	}{
+		{"OPTIONS", testOrigin, "", "", http.StatusNoContent},
+		{"OPTIONS", "https://other.example", "", "", http.StatusForbidden},
+		{"GET", testOrigin, "", "", http.StatusForbidden},
+		{"PUT", testOrigin, "old-instance", string(payload), http.StatusForbidden},
+		{"PUT", "https://other.example", endpoint.InstanceToken, string(payload), http.StatusForbidden},
+		{"PUT", testOrigin, endpoint.InstanceToken, `{}`, http.StatusBadRequest},
+		{"PUT", testOrigin, endpoint.InstanceToken, `null`, http.StatusBadRequest},
+		{"PUT", testOrigin, endpoint.InstanceToken, string(payload) + `{}`, http.StatusBadRequest},
+		{"PUT", testOrigin, endpoint.InstanceToken, strings.Repeat(" ", 1025) + string(payload), http.StatusBadRequest},
+		{"POST", testOrigin, endpoint.InstanceToken, string(payload), http.StatusMethodNotAllowed},
+		{"PUT", testOrigin, endpoint.InstanceToken, string(payload), http.StatusNoContent},
+		{"GET", testOrigin, endpoint.InstanceToken, "", http.StatusOK},
+	} {
+		request, _ := http.NewRequest(input.method, endpoint.URL+"/quality-preference", strings.NewReader(input.body))
+		request.Header.Set("Origin", input.origin)
+		request.Header.Set("X-Piik-Instance", input.token)
+		request.Header.Set("Access-Control-Request-Private-Network", "true")
+		response, err := http.DefaultClient.Do(request)
+		if err != nil {
+			t.Fatal(err)
+		}
+		body, _ := io.ReadAll(response.Body)
+		response.Body.Close()
+		if response.StatusCode != input.status {
+			t.Fatalf("%s: status %d, want %d", input.method, response.StatusCode, input.status)
+		}
+		if input.status == http.StatusOK {
+			var quality protocol.QualitySettings
+			if err := json.Unmarshal(body, &quality); err != nil || quality != protocol.DefaultQualitySettings {
+				t.Fatalf("saved quality: %v, %v", quality, err)
+			}
+		}
+		if input.method == "OPTIONS" && input.status == http.StatusNoContent &&
+			(response.Header.Get("Access-Control-Allow-Methods") != "GET, PUT" || response.Header.Get("Access-Control-Allow-Private-Network") != "true") {
+			t.Fatal("invalid preflight")
+		}
+	}
+	server.mu.Lock()
+	defer server.mu.Unlock()
+	if server.claimed != 0 {
+		t.Fatal("preference claimed media control")
+	}
+}
diff --git a/internal/app/loopback/server.go b/internal/app/loopback/server.go
index a2f4e66e8..8efc580d0 100644
--- a/internal/app/loopback/server.go
+++ b/internal/app/loopback/server.go
@@ -16,6 +16,7 @@ import (
 	"sync"
 	"time"
 
+	appconfig "github.com/TNTcraftHIM/Piik/internal/app/config"
 	"github.com/coder/websocket"
 )
 
@@ -29,12 +30,13 @@ const (
 )
 
 type Options struct {
-	PortStart      int
-	PortEnd        int
-	AllowedOrigins []string
-	NativeMedia    NativeMediaCapabilities
-	NewControl     func() ControlSession
-	Presentation   func(language string)
+	PortStart         int
+	PortEnd           int
+	AllowedOrigins    []string
+	NativeMedia       NativeMediaCapabilities
+	NewControl        func() ControlSession
+	Presentation      func(language string)
+	QualityPreference *appconfig.QualityPreference
 }
 
 type ControlSession interface {
@@ -61,11 +63,12 @@ type Endpoint struct {
 }
 
 type Health struct {
-	Protocol      int                     `json:"protocol"`
-	Service       string                  `json:"service"`
-	Port          int                     `json:"port"`
-	InstanceToken string                  `json:"instanceToken"`
-	NativeMedia   NativeMediaCapabilities `json:"nativeMedia"`
+	Protocol          int                     `json:"protocol"`
+	Service           string                  `json:"service"`
+	Port              int                     `json:"port"`
+	InstanceToken     string                  `json:"instanceToken"`
+	NativeMedia       NativeMediaCapabilities `json:"nativeMedia"`
+	QualityPreference bool                    `json:"qualityPreference,omitempty"`
 }
 
 type NativeMediaCapabilities struct {
@@ -81,16 +84,17 @@ type NativeMediaCapabilities struct {
 }
 
 type Server struct {
-	ctx            context.Context
-	cancel         context.CancelFunc
-	listener       net.Listener
-	httpServer     *http.Server
-	endpoint       Endpoint
-	allowedOrigins []string
-	nativeMedia    NativeMediaCapabilities
-	newControl     func() ControlSession
-	presentation   func(string)
-	done           chan error
+	ctx               context.Context
+	cancel            context.CancelFunc
+	listener          net.Listener
+	httpServer        *http.Server
+	endpoint          Endpoint
+	allowedOrigins    []string
+	nativeMedia       NativeMediaCapabilities
+	newControl        func() ControlSession
+	presentation      func(string)
+	qualityPreference *appconfig.QualityPreference
+	done              chan error
 
 	mu          sync.Mutex
 	connections map[*websocket.Conn]struct{}
@@ -129,12 +133,13 @@ func Start(parent context.Context, options Options) (*Server, error) {
 			Port:          address.Port,
 			InstanceToken: instanceToken,
 		},
-		allowedOrigins: normalizedOrigins(options.AllowedOrigins),
-		nativeMedia:    options.NativeMedia,
-		newControl:     options.NewControl,
-		presentation:   options.Presentation,
-		done:           make(chan error, 1),
-		connections:    make(map[*websocket.Conn]struct{}),
+		allowedOrigins:    normalizedOrigins(options.AllowedOrigins),
+		nativeMedia:       options.NativeMedia,
+		newControl:        options.NewControl,
+		presentation:      options.Presentation,
+		qualityPreference: options.QualityPreference,
+		done:              make(chan error, 1),
+		connections:       make(map[*websocket.Conn]struct{}),
 	}
 	server.httpServer = &http.Server{
 		Handler:           server,
@@ -216,6 +221,8 @@ func (server *Server) ServeHTTP(response http.ResponseWriter, request *http.Requ
 		server.handleControl(response, request)
 	case "/presentation":
 		server.handlePresentation(response, request)
+	case "/quality-preference":
+		server.handleQualityPreference(response, request)
 	default:
 		http.NotFound(response, request)
 	}
@@ -265,11 +272,12 @@ func (server *Server) handleHealth(response http.ResponseWriter, request *http.R
 	}
 	response.Header().Set("Cache-Control", "no-store")
 	writeJSON(response, http.StatusOK, Health{
-		Protocol:      ProtocolVersion,
-		Service:       ServiceName,
-		Port:          server.endpoint.Port,
-		InstanceToken: server.endpoint.InstanceToken,
-		NativeMedia:   server.nativeMedia,
+		Protocol:          ProtocolVersion,
+		Service:           ServiceName,
+		Port:              server.endpoint.Port,
+		InstanceToken:     server.endpoint.InstanceToken,
+		NativeMedia:       server.nativeMedia,
+		QualityPreference: server.qualityPreference != nil,
 	})
 }
 
diff --git a/src/client/native/quality-preference.ts b/src/client/native/quality-preference.ts
new file mode 100644
index 000000000..82d186f3a
--- /dev/null
+++ b/src/client/native/quality-preference.ts
@@ -0,0 +1,65 @@
+import { qualitySettingsSchema, type QualitySettings } from "../../shared/protocol";
+import { debugError } from "../lib/debug";
+import { discoverNativeHealth } from "./client";
+import type { NativeHealth } from "./wire";
+
+/** Optional App storage; never claims a media control session or delays sharing. */
+export class AppQualityPreference {
+  private pending: QualitySettings | null = null;
+  private writing = false;
+
+  private constructor(
+    private readonly health: NativeHealth,
+    private readonly signal: AbortSignal,
+  ) {}
+
+  static async connect(signal: AbortSignal): Promise<AppQualityPreference | null> {
+    if (signal.aborted) return null;
+    const health = await discoverNativeHealth();
+    return health?.qualityPreference && !signal.aborted
+      ? new AppQualityPreference(health, signal) : null;
+  }
+
+  async read(): Promise<QualitySettings | null> {
+    const value: unknown = await (await this.request()).json();
+    return value === null ? null : qualitySettingsSchema.parse(value);
+  }
+
+  save(settings: QualitySettings): void {
+    if (this.signal.aborted) return;
+    this.pending = settings;
+    if (!this.writing) void this.flush();
+  }
+
+  private async flush(): Promise<void> {
+    this.writing = true;
+    try {
+      // A slider can change during a write. Keep only its latest applied choice.
+      while (this.pending && !this.signal.aborted) {
+        const settings = this.pending;
+        this.pending = null;
+        try {
+          await this.request(settings);
+        } catch (error) {
+          if (!this.signal.aborted) debugError("native", "quality-preference-save-failed", error);
+        }
+      }
+    } finally {
+      this.pending = null;
+      this.writing = false;
+    }
+  }
+
+  private async request(settings?: QualitySettings): Promise<Response> {
+    const response = await fetch(`http://127.0.0.1:${this.health.port}/quality-preference`, {
+      method: settings ? "PUT" : "GET",
+      headers: { "Content-Type": "application/json", "X-Piik-Instance": this.health.instanceToken },
+      ...(settings ? { body: JSON.stringify(settings) } : {}),
+      cache: "no-store",
+      signal: AbortSignal.any([this.signal, AbortSignal.timeout(4_000)]),
+      targetAddressSpace: "loopback",
+    } as RequestInit);
+    if (!response.ok) throw new Error(`Piik App preference request failed (${response.status})`);
+    return response;
+  }
+}
diff --git a/src/client/native/wire.ts b/src/client/native/wire.ts
index 8f4542aa6..49db1be37 100644
--- a/src/client/native/wire.ts
+++ b/src/client/native/wire.ts
@@ -26,6 +26,7 @@ export const nativeDiscoveryIdentitySchema = z.object({
 
 export const nativeHealthSchema = nativeDiscoveryIdentitySchema.extend({
   protocol: z.literal(NATIVE_CLIENT_PROTOCOL),
+  qualityPreference: z.boolean().optional(),
   instanceToken: z
     .string()
     .length(43)
diff --git a/src/client/pages/HostPage.tsx b/src/client/pages/HostPage.tsx
index 4a3b0ae26..2ba9e932e 100644
--- a/src/client/pages/HostPage.tsx
+++ b/src/client/pages/HostPage.tsx
@@ -89,6 +89,7 @@ import {
   type HostCreationProfile,
 } from "../lib/creation-profile";
 import { readPreferredQuality, savePreferredQuality } from "../lib/quality-preference";
+import { AppQualityPreference } from "../native/quality-preference";
 import { createOpaqueId } from "../lib/opaque-id";
 import { debugError, debugEvent, debugOperation } from "../lib/debug";
 import {
@@ -611,6 +612,9 @@ export function HostPage({
   const qualityChangeRef = useRef<object | null>(null);
   const pendingQualityChangeRef = useRef<QualitySettings | null>(null);
   const qualitySettingsRef = useRef<QualitySettings>(qualitySettings);
+  const appQualityPreferenceRef = useRef<AppQualityPreference | null>(null);
+  const qualityPreferenceEditedRef = useRef(false);
+  const pendingAppQualityPreferenceRef = useRef<QualitySettings | null>(null);
   const routePolicyRef = useRef<RoutePolicy>(routePolicy);
   const advancedQualityRef = useRef<QualitySettings>(advancedQuality);
   const videoCodecModeRef = useRef<BrowserVideoCodecMode>(videoCodecMode);
@@ -666,6 +670,18 @@ export function HostPage({
       ? resolvedVideoCodec
       : videoCodecMode;
 
+  useEffect(() => {
+    if (!launchedByClient) return;
+    const controller = new AbortController();
+    void loadAppQualityPreference(controller.signal).catch(error => {
+      if (!controller.signal.aborted) debugError("native", "quality-preference-load-failed", error);
+    });
+    return () => {
+      controller.abort();
+      appQualityPreferenceRef.current = null;
+    };
+  }, [launchedByClient]);
+
   useEffect(() => {
     if (videoRef.current) {
       videoRef.current.srcObject = stream;
@@ -1602,6 +1618,32 @@ export function HostPage({
     setAdvancedQuality(visibleSettings);
   }
 
+  function rememberQuality(settings: QualitySettings): void {
+    const preference = appQualityPreferenceRef.current;
+    if (preference) preference.save(settings);
+    else {
+      pendingAppQualityPreferenceRef.current = settings;
+      savePreferredQuality(settings);
+    }
+  }
+
+  async function loadAppQualityPreference(signal: AbortSignal): Promise<void> {
+    const initial = qualitySettingsRef.current;
+    const preference = await AppQualityPreference.connect(signal);
+    if (!preference || signal.aborted) return;
+    appQualityPreferenceRef.current = preference;
+    // An explicit choice made during discovery wins, even before permission resolves.
+    const pending = pendingAppQualityPreferenceRef.current;
+    pendingAppQualityPreferenceRef.current = null;
+    if (pending) preference.save(pending);
+    const saved = await preference.read();
+    if (!signal.aborted && saved && !qualityPreferenceEditedRef.current &&
+      qualitySettingsRef.current === initial && activeGenerationRef.current === null &&
+      roomMutationRef.current === null) {
+      commitQuality(saved);
+    }
+  }
+
   function changeScreenAudioQuality(
     screenAudioQuality: ScreenAudioQuality,
   ): void {
@@ -1640,6 +1682,7 @@ export function HostPage({
   }
 
   async function changeQuality(nextProfile: QualitySettings): Promise<void> {
+    qualityPreferenceEditedRef.current = true;
     advancedQualityRef.current = nextProfile;
     setAdvancedQuality(nextProfile);
     if (phase !== "live") {
@@ -1647,7 +1690,7 @@ export function HostPage({
         return;
       }
       commitQuality(nextProfile);
-      savePreferredQuality(nextProfile);
+      rememberQuality(nextProfile);
       return;
     }
     if (qualityChangeRef.current) {
@@ -1719,7 +1762,7 @@ export function HostPage({
       }
 
       commitQuality(appliedProfile);
-      savePreferredQuality(appliedProfile);
+      rememberQuality(appliedProfile);
       debugEvent("quality", "committed", { generation, applied: appliedProfile });
       outcome = "applied";
       if (nativeUpdate) {
diff --git a/tests/host-quality-ownership.test.ts b/tests/host-quality-ownership.test.ts
index 1beeadad1..359a3d44f 100644
--- a/tests/host-quality-ownership.test.ts
+++ b/tests/host-quality-ownership.test.ts
@@ -19,7 +19,7 @@ import { hostActionErrorNotice, hostFailureCode, isCapturePermissionFailure } fr
 const source = ts.createSourceFile("HostPage.tsx", readFileSync(
   new URL("../src/client/pages/HostPage.tsx", import.meta.url), "utf8",
 ), ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
-const owners = new Set(["changeQuality", "commitQuality", "handleSignalMessage",
+const owners = new Set(["changeQuality", "commitQuality", "rememberQuality", "loadAppQualityPreference", "handleSignalMessage",
   "switchSource", "watchCaptureEnd", "switchNativeSource", "finishSourceSwitch", "replaceBrowserStream", "recoverBrowserFanout", "disposeNativeShare",
   "acquireNativeClient", "requestSharing", "startNativeShare", "startBrowserNativeIngress",
   "ownNativeClient", "discardNativeClient", "releaseUnusedNativeClient", "closeCaptureSourcePicker",
@@ -91,6 +91,8 @@ function fixture(launchedByClient = true) {
     NativeMediaBridge: vi.fn(function (_shareId: string, _client: unknown, _onFailed: () => void) { return bridge; }), manualVideoCodecPreference: vi.fn(),
     phase: "live", qualitySettingsRef: ref<QualitySettings>(original), advancedQualityRef: ref<QualitySettings>(original),
     qualityChangeRef: ref<object | null>(null), pendingQualityChangeRef: ref<QualitySettings | null>(null),
+    appQualityPreferenceRef: ref<{ save: (quality: QualitySettings) => void } | null>(null),
+    qualityPreferenceEditedRef: ref(false), pendingAppQualityPreferenceRef: ref<QualitySettings | null>(null),
     activeGenerationRef: ref<number | null>(1), streamRef: ref<typeof stream | null>(stream), sourceSwitchRef: ref<object | null>(null),
     nativeSourceAudioRef: ref<boolean | undefined>(undefined), setMicrophoneEnabled: vi.fn(),
     microphoneVoiceProcessing: true, setMicrophoneVoiceProcessing: vi.fn(),
@@ -424,6 +426,56 @@ describe("Host room-link copy feedback", () => {
 });
 
 describe("Host quality ownership", () => {
+  it("restores App preferences without acquiring media or changing a room", async () => {
+    const current = fixture();
+    current.activeGenerationRef.current = null;
+    const preference = { read: vi.fn(async () => lower), save: vi.fn() };
+    current.context.AppQualityPreference = { connect: vi.fn(async () => preference) };
+    await current.context.loadAppQualityPreference(new AbortController().signal);
+    expect(current.qualitySettingsRef.current).toEqual(lower);
+    expect(current.NativeClient.connect).not.toHaveBeenCalled();
+    expect(current.signalRef.current.setHostQualitySettings).not.toHaveBeenCalled();
+    expect(preference.save).not.toHaveBeenCalled();
+  });
+
+  it.each(["explicit", "room", "sharing", "creating", "retired"])(
+    "does not let a late App preference override %s ownership", async (owner) => {
+      const current = fixture();
+      current.activeGenerationRef.current = null;
+      const pending = deferred<QualitySettings>();
+      const preference = { read: vi.fn(() => pending.promise), save: vi.fn() };
+      current.context.AppQualityPreference = { connect: vi.fn(async () => preference) };
+      const controller = new AbortController();
+      const loading = current.context.loadAppQualityPreference(controller.signal);
+      await Promise.resolve();
+      if (owner === "explicit") current.qualityPreferenceEditedRef.current = true;
+      if (owner === "room") current.context.commitQuality({ ...original });
+      if (owner === "sharing") current.activeGenerationRef.current = 2;
+      if (owner === "creating") current.roomMutationRef.current = {};
+      if (owner === "retired") controller.abort();
+      pending.resolve(lower);
+      await loading;
+      expect(current.qualitySettingsRef.current).toEqual(original);
+      expect(preference.save).not.toHaveBeenCalled();
+    },
+  );
+
+  it("carries an applied choice across delayed App discovery without persisting room snapshots", async () => {
+    const current = fixture();
+    current.context.phase = "idle";
+    current.activeGenerationRef.current = null;
+    const preference = { read: vi.fn(async () => original), save: vi.fn() };
+    current.context.AppQualityPreference = { connect: vi.fn(async () => preference) };
+    await current.change(lower);
+    await current.context.loadAppQualityPreference(new AbortController().signal);
+    expect(preference.save).toHaveBeenCalledExactlyOnceWith(lower);
+    expect(current.qualitySettingsRef.current).toEqual(lower);
+    current.context.commitQuality(original);
+    expect(preference.save).toHaveBeenCalledOnce();
+    await current.change(lower);
+    expect(preference.save).toHaveBeenCalledTimes(2);
+  });
+
   it("remembers an explicit pre-share choice without changing room or capture state", async () => {
     const current = fixture();
     current.context.phase = "idle";
diff --git a/tests/native-quality-preference.test.ts b/tests/native-quality-preference.test.ts
new file mode 100644
index 000000000..9e0fc9f33
--- /dev/null
+++ b/tests/native-quality-preference.test.ts
@@ -0,0 +1,68 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { DEFAULT_QUALITY_SETTINGS } from "../src/shared/protocol";
+import { AppQualityPreference } from "../src/client/native/quality-preference";
+import { discoverNativeHealth } from "../src/client/native/client";
+import { nativeHealthSchema, NATIVE_CLIENT_PROTOCOL, NATIVE_CLIENT_PORT_START } from "../src/client/native/wire";
+
+vi.mock("../src/client/native/client", () => ({ discoverNativeHealth: vi.fn() }));
+afterEach(() => { vi.unstubAllGlobals(); vi.clearAllMocks(); });
+
+const health = nativeHealthSchema.parse({
+  protocol: NATIVE_CLIENT_PROTOCOL, service: "piik-client", port: NATIVE_CLIENT_PORT_START,
+  instanceToken: "a".repeat(43), qualityPreference: true,
+});
+
+describe("App quality preference transport", () => {
+  it("leaves older Apps alone and does not discover after retirement", async () => {
+    const fetcher = vi.fn();
+    vi.stubGlobal("fetch", fetcher);
+    const controller = new AbortController();
+    vi.mocked(discoverNativeHealth).mockResolvedValue({ ...health, qualityPreference: undefined });
+    expect(await AppQualityPreference.connect(controller.signal)).toBeNull();
+    controller.abort();
+    expect(await AppQualityPreference.connect(controller.signal)).toBeNull();
+    expect(discoverNativeHealth).toHaveBeenCalledOnce();
+    expect(fetcher).not.toHaveBeenCalled();
+  });
+
+  it("uses the advertised App instance and bounds writes to the latest applied choice", async () => {
+    vi.mocked(discoverNativeHealth).mockResolvedValue(health);
+    let finish!: (value: Response) => void;
+    const pending = new Promise<Response>(resolve => { finish = resolve; });
+    const fetcher = vi.fn()
+      .mockResolvedValueOnce(new Response(JSON.stringify(DEFAULT_QUALITY_SETTINGS)))
+      .mockReturnValueOnce(pending)
+      .mockResolvedValue(new Response(null, { status: 204 }));
+    vi.stubGlobal("fetch", fetcher);
+    const controller = new AbortController();
+    const preference = (await AppQualityPreference.connect(controller.signal))!;
+    expect(await preference.read()).toEqual(DEFAULT_QUALITY_SETTINGS);
+    preference.save(DEFAULT_QUALITY_SETTINGS);
+    preference.save({ ...DEFAULT_QUALITY_SETTINGS, maxBitrate: 4_000_000 });
+    const latest = { ...DEFAULT_QUALITY_SETTINGS, maxBitrate: 5_000_000 };
+    preference.save(latest);
+    expect(fetcher).toHaveBeenCalledTimes(2);
+    finish(new Response(null, { status: 204 }));
+    await vi.waitFor(() => expect(fetcher).toHaveBeenCalledTimes(3));
+    expect(fetcher).toHaveBeenLastCalledWith(`http://127.0.0.1:${health.port}/quality-preference`, expect.objectContaining({
+      method: "PUT", body: JSON.stringify(latest), cache: "no-store",
+      headers: expect.objectContaining({ "X-Piik-Instance": health.instanceToken }),
+    }));
+    controller.abort();
+    preference.save(DEFAULT_QUALITY_SETTINGS);
+    expect(fetcher).toHaveBeenCalledTimes(3);
+  });
+
+  it("rejects invalid replies and treats failed writes as optional", async () => {
+    vi.mocked(discoverNativeHealth).mockResolvedValue(health);
+    const fetcher = vi.fn().mockResolvedValueOnce(new Response("{}"))
+      .mockResolvedValueOnce(new Response(null, { status: 500 }))
+      .mockResolvedValue(new Response(null, { status: 204 }));
+    vi.stubGlobal("fetch", fetcher);
+    const preference = (await AppQualityPreference.connect(new AbortController().signal))!;
+    await expect(preference.read()).rejects.toThrow();
+    preference.save(DEFAULT_QUALITY_SETTINGS);
+    preference.save({ ...DEFAULT_QUALITY_SETTINGS, maxBitrate: 4_000_000 });
+    await vi.waitFor(() => expect(fetcher).toHaveBeenCalledTimes(3));
+  });
+});

From bf7213ca16c631732367e3816300375d858284b1 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 12:27:08 +0800
Subject: [PATCH 010/262] test(media): distinguish source cadence from SFU
 readiness

---
 docs/operations/website.md           | 15 ++++++++++
 docs/research/nat-traversal.md       |  2 +-
 docs/research/native-client-media.md | 29 +++++++++++++++++++
 docs/todo.md                         | 42 +++++++++++-----------------
 scripts/embedded-sfu-gate.ts         | 20 ++++++++++++-
 scripts/embedded-sfu-page.ts         |  2 +-
 6 files changed, 82 insertions(+), 28 deletions(-)

diff --git a/docs/operations/website.md b/docs/operations/website.md
index 61fae6237..9899e2951 100644
--- a/docs/operations/website.md
+++ b/docs/operations/website.md
@@ -24,6 +24,21 @@ GitHub Pages can serve the complete website: it hosts
 The demo also needs the Go service for room authority, WebSocket signaling and
 UDP STUN, so it runs on the separate US server rather than Pages.
 
+### Managed Hosting Assessment
+
+Reviewed 2026-10-07. Keep the current deployment for this candidate. A managed
+container can reduce host administration, but must preserve public UDP, stable
+room authority and SQLite storage. [Fly.io supports public UDP](https://docs.fly.io/networking/udp-and-tcp)
+with a dedicated IPv4 address and a specific UDP bind address; external and
+internal UDP ports must match. Its [dedicated IPv4 charge](https://docs.fly.io/about/pricing)
+is $2/month before compute, storage and transfer. This is a possible deployment
+target, not an established cost saving over the current server.
+
+[Cloudflare Containers disks are ephemeral by default](https://developers.cloudflare.com/containers/faq/#is-disk-persistent-what-happens-to-my-disk-when-my-container-sleeps).
+Snapshots or object-backed storage are not a drop-in replacement for the current
+live SQLite contract. No provider migration is accepted; compare the complete
+cost and verify storage, UDP and restart behavior before changing the Demo.
+
 ## Public Demo Configuration
 
 The chosen demo allows entry without a site password and provides P2P sharing
diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index cee29a1ae..d7f6e1e5a 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -353,7 +353,7 @@ increasing only the fixture's ICE budget recovered media. The ordinary Pion
 loss control recovered without that override. Do not adopt packet prefixes,
 diagnostic Ping polling or wider product deadlines as integration shortcuts.
 
-Current recommendation: keep the transport isolated. Go reuse is feasible, but
+Reassessed on 2026-10-07: keep the transport isolated. Go reuse is feasible, but
 new key authorization/revocation, underlay readiness, packet-size limits and
 relay operation have no demonstrated direct-coverage benefit sufficient for
 product integration. A future trial needs matched networks with a repeatable
diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 8da28b7e4..708e5f0a8 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -357,6 +357,25 @@ that result nor the allocation timings establish the reported system-wide lag's
 cause. Retain the existing implementation; reopen optimization from a matched
 bottleneck.
 
+### Virtual-Display Acceptance Limit
+
+On 2026-10-07, the local Native H.264 SFU gate initially passed its two-room
+check, then missed its unchanged 300-frame/30-second requirement. The repeat
+environment exposed only a GameViewer virtual display. Current main reproduced
+the failure with its own App and capture binary: video/audio arrived, but video
+was roughly 4–7 fps without receiver loss or decode drops. A source-window draw
+counter advanced about 133 times per second; that counts drawing attempts, not
+Windows capture delivery.
+
+Temporary capture instrumentation observed about 3–4 WGC frame-arrival events
+per second. Queue draining was bounded in the observation, conversion/submission
+took less than a millisecond, and encoder diagnostics showed small encode times
+without CPU/quality adaptation. Bringing the source window forward did not
+restore cadence. This localizes the limit before encoding but does not establish
+the virtual driver's cause or diagnose a field report. Retain the gate's
+threshold and compare a physical display before changing capture scheduling,
+encoder policy or route behavior.
+
 ## Native H.264 Motion Quality
 
 Issue [#432](https://github.com/TNTcraftHIM/Piik/issues/432) reports more visible
@@ -534,6 +553,16 @@ inherently require a major; breaking an existing public contract does. Evaluate
 the Browser/App/Server and mixed-peer flows before freezing a replacement
 contract; avoid a general compatibility framework.
 
+The 2026-10-07 candidate review does not recommend adding these extensions to
+the current release. A 4K path must change the three platform capture/decoder
+bounds, encoded-frame limits and SFU admission together; Windows H.264's current
+level ceiling also does not cover 4K60. The existing Main/High comparison shows
+a modest synthetic quality gain, but Firefox's receiver gap prevents treating
+it as a transparent upgrade. Keep the current formats and limits until a
+specific use case justifies that coordinated change. This is a scope
+recommendation, not a claim that 4K is impossible or that the current geometry
+should become a permanent protocol rule.
+
 ## Implementation Boundary
 
 - `nativecapture` owns the child process, source identity, and bounded frame protocol.
diff --git a/docs/todo.md b/docs/todo.md
index 0d40b53b4..36ad1f19d 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -12,29 +12,12 @@ history. A parked idea is not implementation authority.
   coherent candidate and stop before publication. Preserve the existing product
   model; evaluate held features against measurable benefit and total complexity
   before accepting a changed contract.
-- [ ] **App-wide sharing preferences (#460).** Same-origin Browser preferences
-  are implemented. Assess retaining explicit settings across changing App public
-  origins without eagerly claiming Native sessions, adding a second settings
-  owner or persisting live device/session authority. Keep the Browser scope clear
-  if an App-wide bridge is not justified.
-- [ ] **Current issue evidence.** Review #452's public-link/H.264 report and
-  #453's cross-network failure against current startup and ICE behavior. Revisit
-  #432's motion-quality evidence and existing unmatched reports; do not equate a
-  successful local reproduction with resolving a different reporter's cause.
 - [ ] **Current-contract runtime acceptance.** Exercise sharing, source/quality
   replacement, reconnect, peer/SFU handoff and independent retirement. Review
   responsive interaction and reader documentation against the accepted result;
-  keep unavailable physical-device checks explicit.
-- [ ] **Deferred-work decisions.** Reassess transport, microphone pairing,
-  passive App attachment, hosting and remaining structural proposals in order
-  of demonstrated value. Record accepted scope in the owning modules before
-  implementation; do not turn every proposal into a release requirement.
-- [ ] **4K, codec expansion and Native Magicsock assessment.** Reopened by the
-  owner on 2026-10-07 for 2.0 only where measured benefit justifies a simple
-  implementation. Review the [media extension assessment](./research/native-client-media.md#media-capability-extension-assessment)
-  and [transport comparison](./research/nat-traversal.md#integration-cost-and-recovery-controls)
-  against current main. No changed wire contract or product transport is accepted
-  merely by reopening the experiments.
+  keep unavailable physical-device checks explicit. The local Native SFU
+  throughput rerun is limited by [low WGC arrival cadence](./research/native-client-media.md#virtual-display-acceptance-limit)
+  reproduced on unchanged main; do not lower its frame requirement to report a pass.
 - [ ] **Independent Gitee mirror recovery.** Implementation and local acceptance
   are complete. Integrate through the next owner-approved publishing merge and
   verify the separate workflow with its original CI artifacts. Mirror failure
@@ -58,12 +41,19 @@ history. A parked idea is not implementation authority.
 
 ## Deferred Feature Work
 
-These proposals remain deferred beyond the accepted interaction phase.
+These proposals remain outside the current candidate. Reassessment on
+2026-10-07 did not establish enough benefit for their added owners and operating
+cost. The media and transport assessments below remain recommendations for the
+owner's final scope review, not permanent prohibitions.
 
-- [ ] **Managed Demo hosting.** Evaluate cost and public UDP support before any
-  migration. The assessment remains outside the current product release; keep
-  the existing P2P-only Demo deployment until a provider and operating boundary
-  are accepted.
+- [ ] **4K and additional codecs.** The [media assessment](./research/native-client-media.md#media-capability-extension-assessment)
+  recommends retaining current limits for this candidate. Reopen with a concrete
+  source/receiver use case that justifies coordinated capture, forwarding and
+  resource bounds; keep UI presets separate from those bounds in any new design.
+
+- [ ] **Managed Demo hosting.** The [provider assessment](./operations/website.md#managed-hosting-assessment)
+  identifies UDP/storage requirements but establishes no cost saving. Keep the
+  existing P2P-only Demo until a provider and operating boundary are accepted.
 - [ ] **Phone as a Host microphone: assess after the current work.** Explore an
   opt-in link that pairs a phone's microphone with the Host's existing audio
   mixer. Evaluate pairing/revocation, latency/echo, browser background limits
@@ -108,6 +98,8 @@ of a reporter's cause; research owns the completed experiments and their limits.
   [#443](https://github.com/TNTcraftHIM/Piik/issues/443) lacks a connected Native
   edge and its paired Viewer/App transport report;
   [#448](https://github.com/TNTcraftHIM/Piik/issues/448) only reaches route allocation.
+  [#453](https://github.com/TNTcraftHIM/Piik/issues/453) has no matched endpoint
+  reports to distinguish network reachability from a product failure.
   The v1.6.3 candidate-timeout report lacks share-start and SDP/ICE evidence.
 - [ ] **Camera and Host microphone device coverage.** Check real audio levels,
   echo, device replacement/native mixing and phone camera permission, orientation
diff --git a/scripts/embedded-sfu-gate.ts b/scripts/embedded-sfu-gate.ts
index b18e8bd7a..47b7c5b4f 100644
--- a/scripts/embedded-sfu-gate.ts
+++ b/scripts/embedded-sfu-gate.ts
@@ -104,6 +104,7 @@ async function main(): Promise<void> {
     host: null as Snapshot | null, viewer: null as Snapshot | null,
     displayLifecycle: null as { hiddenFrames: number; hiddenElapsedMs: number; lowLayerDecoded: boolean; resumed: boolean; replaced: boolean } | null,
     mediaDiagnostics: null as unknown,
+    sourceDrawing: null as { draws: number; elapsedMs: number; visibility: string } | null,
     publicationRetired: false, subscriptionRecovered: false, nativeShareStopped: !nativeArm, udpReleased: false, cleanup: false, error: null as string | null };
   let server: ChildProcessWithoutNullStreams | null = null;
   let chrome: ChildProcessWithoutNullStreams | null = null;
@@ -118,6 +119,7 @@ async function main(): Promise<void> {
   let nativePort = 0;
   let sourceChrome: ChildProcessWithoutNullStreams | null = null;
   let sourceCdp: CdpConnection | null = null;
+  let sourcePage: PageHandle | null = null;
   let sourceHTTP: Awaited<ReturnType<typeof sourceServer>> | null = null;
   const call = async <T>(page: PageHandle, expression: string, timeout = 25_000): Promise<T> => {
     const value = await evaluate<{ value?: T; error?: string }>(cdp!, page,
@@ -195,6 +197,7 @@ async function main(): Promise<void> {
       if (!target) throw new Error("Gate source page is unavailable");
       const attached = await sourceCdp.call<{ sessionId: string }>("Target.attachToTarget",
         { targetId: target.targetId, flatten: true }, undefined, Date.now() + 5_000);
+      sourcePage = attached;
       const audioState = await evaluate<string>(sourceCdp, attached, `(async () => {
         const audio = new AudioContext(), tone = audio.createOscillator(), gain = audio.createGain();
         gain.gain.value = 0.01; tone.connect(gain).connect(audio.destination); tone.start();
@@ -256,7 +259,21 @@ async function main(): Promise<void> {
     result.stage = "simulcast-first-frame";
     await cdp.call("Page.bringToFront", {}, viewer.sessionId, Date.now() + 3_000);
     result.host = await call(host, "gate.snapshot()");
-    result.high = await call(viewer, nativeArm ? "gate.waitForFrames(1280, 720, 300)" : "gate.waitForFrames(1280, 720)", nativeArm ? 32_000 : 25_000);
+    const sourceSample = async () => sourceCdp && sourcePage
+      ? await evaluate<{ draws: number; at: number; visibility: string }>(sourceCdp, sourcePage,
+        "({ draws: n, at: performance.now(), visibility: document.visibilityState })", Date.now() + 3_000)
+      : null;
+    const sourceBefore = await sourceSample();
+    try {
+      result.high = await call(viewer, nativeArm ? "gate.waitForFrames(1280, 720, 300)" : "gate.waitForFrames(1280, 720)", nativeArm ? 32_000 : 25_000);
+    } finally {
+      const sourceAfter = await sourceSample().catch(() => null);
+      if (sourceBefore && sourceAfter) result.sourceDrawing = {
+        draws: sourceAfter.draws - sourceBefore.draws,
+        elapsedMs: sourceAfter.at - sourceBefore.at,
+        visibility: sourceAfter.visibility,
+      };
+    }
     result.stage = "decoded-audio-energy";
     await waitForSample(() => call<number>(viewer!, "gate.audioEnergy()", 3_000),
       (energy) => { result.audioEnergy.high = energy; return energy > 0; }, 5_000);
@@ -337,6 +354,7 @@ async function main(): Promise<void> {
     if (cdp) result.mediaDiagnostics = await Promise.all([host, viewer].map(page => page ?
       evaluate(cdp!, page, "window.__piikGateMediaStats?.()", Date.now() + 3_000).catch(() => null) : null));
     if (viewer && cdp) result.viewer = await call<Snapshot>(viewer, "gate.snapshot()", 3_000).catch(() => null);
+    if (host && cdp) result.host = await call<Snapshot>(host, "gate.snapshot()", 3_000).catch(() => null);
     if (viewer && cdp && result.stage === "decoded-audio-energy") result.audioDiagnostics = await evaluate(
       cdp, viewer, "window.__piikGateAudioStats ?? null", Date.now() + 3_000).catch(() => null);
     if (serverError) result.error += `; server: ${serverError}`;
diff --git a/scripts/embedded-sfu-page.ts b/scripts/embedded-sfu-page.ts
index 207de8ebb..a6d588119 100644
--- a/scripts/embedded-sfu-page.ts
+++ b/scripts/embedded-sfu-page.ts
@@ -337,7 +337,7 @@ export async function waitForFrames(width: number, height: number, minimumFrames
     let callback = 0;
     const timer = setTimeout(() => {
       target.cancelVideoFrameCallback(callback);
-      reject(new Error(`Viewer did not decode ${width}x${height}; current ${target.videoWidth}x${target.videoHeight}; ${frames} frame callbacks; ${document.visibilityState}; ${error ?? "no signaling error"}`));
+      reject(new Error(`Viewer did not reach ${minimumFrames} decoded frame callbacks at ${width}x${height}; current ${target.videoWidth}x${target.videoHeight}; ${frames} matching callbacks; ${document.visibilityState}; ${error ?? "no signaling error"}`));
     }, minimumFrames > 15 ? 30_000 : 20_000);
     const next = () => {
       callback = target.requestVideoFrameCallback(() => {

From 56593285d597d1608076e2e5d13de665b6a6c912 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 12:43:17 +0800
Subject: [PATCH 011/262] docs(media): bound the local capture cadence finding

---
 docs/research/native-client-media.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 708e5f0a8..cc46f0a61 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -371,7 +371,9 @@ Temporary capture instrumentation observed about 3–4 WGC frame-arrival events
 per second. Queue draining was bounded in the observation, conversion/submission
 took less than a millisecond, and encoder diagnostics showed small encode times
 without CPU/quality adaptation. Bringing the source window forward did not
-restore cadence. This localizes the limit before encoding but does not establish
+restore cadence. A capture-only control, without the App or SFU, also delivered
+about 3.9 fps from both Chrome and a separate animated Windows Forms window.
+This localizes the limit before encoding but does not establish
 the virtual driver's cause or diagnose a field report. Retain the gate's
 threshold and compare a physical display before changing capture scheduling,
 encoder policy or route behavior.

From 921196bfc6ddd459819bdf0d019c8b9f3d0c7127 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 13:10:43 +0800
Subject: [PATCH 012/262] test(media): use public invitations for remote
 acceptance

---
 cmd/piik-app/README.md               | 23 +++-------
 cmd/piik-app/README.zh-CN.md         | 17 ++------
 cmd/piik-peer-gate/main.go           |  9 +++-
 cmd/piik-peer-gate/main_test.go      | 44 +++++++++++++++++++
 docs/research/native-client-media.md | 10 +++--
 internal/app/app.go                  |  5 +--
 internal/app/app_test.go             |  4 +-
 scripts/app-native-host-gate.ts      | 65 ++++------------------------
 8 files changed, 81 insertions(+), 96 deletions(-)

diff --git a/cmd/piik-app/README.md b/cmd/piik-app/README.md
index 7e487a5a2..ad5bb8ec9 100644
--- a/cmd/piik-app/README.md
+++ b/cmd/piik-app/README.md
@@ -258,16 +258,6 @@ CHROME_PATH=/path/to/chrome \
 PIIK_GO=/path/to/go \
 npm run gate:app-native-host
 
-PIIK_CLIENT_NATIVE_HOST_GATE=true \
-PIIK_CLIENT_CROSS_NAT_GATE=true \
-CHROME_PATH=/path/to/chrome \
-PIIK_GO=/path/to/go \
-PIIK_REMOTE_HOST=<public-test-host> \
-PIIK_REMOTE_USER=<ssh-user> \
-PIIK_REMOTE_SSH_KEY=/path/to/key \
-PIIK_CLIENT_GATE_STUN_URLS=stun:<stun-host>:3478 \
-npm run gate:app-native-host
-
 PIIK_CLIENT_NATIVE_HOST_GATE=true \
 PIIK_CLIENT_LINK_MEDIA_GATE=true \
 CHROME_PATH=/path/to/chrome \
@@ -291,11 +281,12 @@ The Windows media gate proves one hardware-H.264
 capture generation, shared Pion source, Browser decode, PLI recovery, and STUN
 candidate gathering. The native Host gate proves room creation and native video
 delivery through the current route; native audio is included when the capability
-probe and target OS support it. The cross-NAT variant uses a temporary reverse
-SSH path for signaling only and requires a selected `srflx` or `prflx` media pair;
-media never travels through SSH. The one-link media variant instead carries the
-same signaling through the App's temporary public origin and requires direct
-media delivery to an independent Linux peer. Native P2P quality evidence and
-embedded SFU delivery have explicit gates. macOS and Linux capture still
+probe and target OS support it. The one-link media variant carries signaling
+through the App's temporary public origin and requires direct video RTP delivery
+to an independent Linux peer, with a selected `srflx` or `prflx` candidate.
+SSH only runs the remote probe; media never travels through it. Without a remote
+host, this variant checks decoded media in a local Browser through the public
+invitation; that does not establish cross-network connectivity. Native P2P
+quality evidence and embedded SFU delivery have explicit gates. macOS and Linux capture still
 require physical desktop/media gates; CI compilation and package smoke do not
 substitute for them.
diff --git a/cmd/piik-app/README.zh-CN.md b/cmd/piik-app/README.zh-CN.md
index 8555b0fa5..a10268846 100644
--- a/cmd/piik-app/README.zh-CN.md
+++ b/cmd/piik-app/README.zh-CN.md
@@ -213,16 +213,6 @@ CHROME_PATH=/path/to/chrome \
 PIIK_GO=/path/to/go \
 npm run gate:app-native-host
 
-PIIK_CLIENT_NATIVE_HOST_GATE=true \
-PIIK_CLIENT_CROSS_NAT_GATE=true \
-CHROME_PATH=/path/to/chrome \
-PIIK_GO=/path/to/go \
-PIIK_REMOTE_HOST=<public-test-host> \
-PIIK_REMOTE_USER=<ssh-user> \
-PIIK_REMOTE_SSH_KEY=/path/to/key \
-PIIK_CLIENT_GATE_STUN_URLS=stun:<stun-host>:3478 \
-npm run gate:app-native-host
-
 PIIK_CLIENT_NATIVE_HOST_GATE=true \
 PIIK_CLIENT_LINK_MEDIA_GATE=true \
 CHROME_PATH=/path/to/chrome \
@@ -246,7 +236,8 @@ Windows media gate 验证一个硬件 H.264 采集代次、共享 Pion 来源、
 STUN 候选收集。native Host gate 验证房间创建及当前路由上的原生视频传输；
 能力探测与目标系统支持时，也包含原生音频。
 
-跨 NAT 变体仅将临时反向 SSH 路径用于信令，并要求选中的媒体候选对包含 `srflx` 或 `prflx`；
-媒体不会经过 SSH。公网邀请媒体变体通过 App 临时公网来源传送相同信令，
-并要求将媒体直接传给独立的 Linux 对端。原生 P2P 质量证据与内嵌 SFU 传输有各自的验证入口。
+公网邀请媒体变体通过 App 临时公网地址传送信令，要求将视频 RTP 直接传给独立的 Linux 对端，
+且选中的候选对包含 `srflx` 或 `prflx`。SSH 仅运行远端探针，媒体不会经过 SSH。
+不配置远端主机时，该变体在本机浏览器中通过公网邀请检查解码画面，不能据此认定跨网络连通。
+原生 P2P 质量证据与内嵌 SFU 传输有各自的验证入口。
 macOS 和 Linux 采集仍需实机桌面与媒体验证，CI 编译及程序包冒烟检查不能替代这些验证。
diff --git a/cmd/piik-peer-gate/main.go b/cmd/piik-peer-gate/main.go
index 50d2065f7..85a7c56c5 100644
--- a/cmd/piik-peer-gate/main.go
+++ b/cmd/piik-peer-gate/main.go
@@ -68,6 +68,7 @@ type incoming struct {
 	Revision     int    `json:"revision"`
 	ConnectionID string `json:"connectionId"`
 	Phase        string `json:"phase"`
+	State        string `json:"state"`
 	Candidate    struct {
 		ConnectionID string `json:"connectionId"`
 	} `json:"candidate"`
@@ -316,7 +317,7 @@ func run(ctx context.Context, config gateConfig) gateResult {
 					return gateResult{Error: "receiver signaling failed"}
 				}
 			case "route-status":
-				if message.Phase == "failed" {
+				if message.State == "failed" {
 					return gateResult{Error: "route assignment failed"}
 				}
 			}
@@ -384,10 +385,14 @@ func (receiver *receiver) createPeer(raw []wireICEServer) error {
 	pc.OnTrack(func(track *webrtc.TrackRemote, rtpReceiver *webrtc.RTPReceiver) {
 		receiver.recordSelectedPair(rtpReceiver)
 		for {
-			_, _, readErr := track.ReadRTP()
+			packet, _, readErr := track.ReadRTP()
 			if readErr != nil {
 				return
 			}
+			// Audio or padding alone cannot prove video delivery.
+			if track.Kind() != webrtc.RTPCodecTypeVideo || len(packet.Payload) == 0 {
+				continue
+			}
 			receiver.packetMu.Lock()
 			receiver.packets++
 			count := receiver.packets
diff --git a/cmd/piik-peer-gate/main_test.go b/cmd/piik-peer-gate/main_test.go
index 26e4e3997..a7d66e861 100644
--- a/cmd/piik-peer-gate/main_test.go
+++ b/cmd/piik-peer-gate/main_test.go
@@ -1,10 +1,54 @@
 package main
 
 import (
+	"context"
 	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
 	"testing"
+	"time"
+
+	"github.com/TNTcraftHIM/Piik/internal/server/protocol"
+	"github.com/coder/websocket"
+	"github.com/coder/websocket/wsjson"
 )
 
+func TestRunReportsRouteFailure(t *testing.T) {
+	done := make(chan struct{})
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		conn, err := websocket.Accept(w, r, nil)
+		if err != nil {
+			t.Error(err)
+			return
+		}
+		defer conn.CloseNow()
+		var auth json.RawMessage
+		if err := wsjson.Read(r.Context(), conn, &auth); err != nil {
+			t.Error(err)
+			return
+		}
+		if err := wsjson.Write(r.Context(), conn, protocol.RouteStatusMessage{
+			Type: "route-status", Revision: 1, State: "failed", Reason: "route-exhausted",
+		}); err != nil {
+			t.Error(err)
+			return
+		}
+		<-done
+	}))
+	defer server.Close()
+	defer close(done)
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	result := run(ctx, gateConfig{
+		SignalURL: "ws" + strings.TrimPrefix(server.URL, "http"),
+		Origin:    server.URL, RoomID: "1234", ClientID: "remote_test", ViewerGrant: "test",
+	})
+	if result.Passed || result.Error != "route assignment failed" {
+		t.Fatalf("expected the route failure, got %+v", result)
+	}
+}
+
 func TestIncomingUsesCurrentWireFieldNames(t *testing.T) {
 	payload := []byte(`{
 		"type":"route-update",
diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index cc46f0a61..274c441dd 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -373,9 +373,13 @@ took less than a millisecond, and encoder diagnostics showed small encode times
 without CPU/quality adaptation. Bringing the source window forward did not
 restore cadence. A capture-only control, without the App or SFU, also delivered
 about 3.9 fps from both Chrome and a separate animated Windows Forms window.
-This localizes the limit before encoding but does not establish
-the virtual driver's cause or diagnose a field report. Retain the gate's
-threshold and compare a physical display before changing capture scheduling,
+A separate minimal WGC program, using only Windows APIs and no Piik code,
+reproduced about 3.8 fps while that Forms window painted about 32 fps.
+Default, 4 ms and 1 ms capture intervals returned the same rate, including with
+the source kept topmost; property readback confirmed each requested interval.
+This localizes the limit to platform capture delivery in this environment but
+does not establish the virtual driver's cause or diagnose a field report.
+Retain the gate's threshold and compare a physical display before changing capture scheduling,
 encoder policy or route behavior.
 
 ## Native H.264 Motion Quality
diff --git a/internal/app/app.go b/internal/app/app.go
index c70859f3b..9535d5b07 100644
--- a/internal/app/app.go
+++ b/internal/app/app.go
@@ -641,9 +641,8 @@ func discoverNativeMedia(ctx context.Context, configuredPath string) nativeRunti
 
 // localSTUNURLs is the Local room authority's ICE configuration. Only --link
 // has a public path, so only --link configures public STUN and the bounded NAT
-// prediction survey. The lists are literals on purpose: a gate that sets
-// STUN_URLS is configuring the App's own Pion edge, and that value must not
-// reach the room server (which is why serverconfig.Local reads no environment).
+// prediction survey. Native edges receive ICE configuration from that authority;
+// serverconfig.Local deliberately does not inherit Hosted environment settings.
 func localSTUNURLs(link bool) (stunURLs []string, natPredictionSTUNURLs []string) {
 	if !link {
 		return nil, nil
diff --git a/internal/app/app_test.go b/internal/app/app_test.go
index 2b17851cc..885abf1a4 100644
--- a/internal/app/app_test.go
+++ b/internal/app/app_test.go
@@ -699,8 +699,8 @@ func TestLinkModeKeepsOneLocalAuthority(t *testing.T) {
 	}
 }
 
-// The Local room authority owns its ICE configuration: a STUN_URLS meant for
-// the App's own Pion edge must not reach it, and only --link is public.
+// The Local room authority owns its ICE configuration independently of Hosted
+// environment settings, and only --link is public.
 func TestLocalServerOwnsItsSTUNConfiguration(t *testing.T) {
 	t.Setenv("STUN_URLS", "stun:inherited.example:3478")
 	for _, testCase := range []struct {
diff --git a/scripts/app-native-host-gate.ts b/scripts/app-native-host-gate.ts
index 33b752c5e..9683c6975 100644
--- a/scripts/app-native-host-gate.ts
+++ b/scripts/app-native-host-gate.ts
@@ -31,7 +31,7 @@ const ROOT = resolve(import.meta.dirname, "..");
 const BUILD_ROOT = join(ROOT, "build", "go-check");
 export const SOURCE_TITLE = "Piik Native Gate Source";
 
-type GateMode = "local" | "cross-nat" | "one-link";
+type GateMode = "local" | "one-link";
 type VideoCodec = "h264" | "vp8";
 
 const CODEC_PROBE = `(() => {
@@ -92,7 +92,6 @@ interface GateResult {
   remoteRemoteCandidateType: string;
   remoteNatPath: boolean;
   remotePeerExited: boolean | null;
-  reverseSignalTunnelClosed: boolean | null;
   sourceFailureEndedShare: boolean | null;
   replacementViewerConnected: boolean | null;
   replacementViewerFrames: number | null;
@@ -110,7 +109,6 @@ interface RemoteGateOptions {
   host: string;
   user: string;
   key: string;
-  signalPort: number;
   bindAddress: string | null;
 }
 
@@ -273,18 +271,15 @@ function remoteOptions(): RemoteGateOptions {
   const host = process.env.PIIK_REMOTE_HOST?.trim();
   const user = process.env.PIIK_REMOTE_USER?.trim() || "root";
   const key = process.env.PIIK_REMOTE_SSH_KEY?.trim();
-  const signalPortText = process.env.PIIK_REMOTE_SIGNAL_PORT?.trim() || "49721";
-  const signalPort = Number(signalPortText);
-  if (!host || !key || !Number.isInteger(signalPort) || signalPort < 1024 || signalPort > 65_535) {
+  if (!host || !key) {
     throw new Error(
-      "PIIK_REMOTE_HOST, PIIK_REMOTE_SSH_KEY, and a valid PIIK_REMOTE_SIGNAL_PORT are required",
+      "PIIK_REMOTE_HOST and PIIK_REMOTE_SSH_KEY are required",
     );
   }
   return {
     host,
     user,
     key,
-    signalPort,
     bindAddress: process.env.PIIK_REMOTE_BIND_ADDRESS?.trim() || null,
   };
 }
@@ -574,16 +569,8 @@ async function main(): Promise<void> {
   if (process.env.PIIK_CLIENT_NATIVE_HOST_GATE !== "true") {
     throw new Error("PIIK_CLIENT_NATIVE_HOST_GATE=true is required");
   }
-  const crossNat = process.env.PIIK_CLIENT_CROSS_NAT_GATE === "true";
   const linkMedia = process.env.PIIK_CLIENT_LINK_MEDIA_GATE === "true";
-  if (crossNat && linkMedia) {
-    throw new Error("Cross-NAT and one-link gate modes are mutually exclusive");
-  }
-  const mode: GateMode = linkMedia ? "one-link" : crossNat ? "cross-nat" : "local";
-  const gateStunUrls = process.env.PIIK_CLIENT_GATE_STUN_URLS?.trim();
-  if (mode === "cross-nat" && !gateStunUrls) {
-    throw new Error("PIIK_CLIENT_GATE_STUN_URLS is required for the cross-NAT gate");
-  }
+  const mode: GateMode = linkMedia ? "one-link" : "local";
   const crashGate =
     process.env.PIIK_CLIENT_NATIVE_HOST_CRASH_GATE === "true";
   if (crashGate && mode !== "local") {
@@ -597,7 +584,7 @@ async function main(): Promise<void> {
   if (requestedCodec !== "auto" && requestedCodec !== "h264" && requestedCodec !== "vp8") {
     throw new Error("PIIK_CLIENT_NATIVE_HOST_CODEC must be auto, h264, or vp8");
   }
-  const remote = mode === "cross-nat" || mode === "one-link" &&
+  const remote = mode === "one-link" &&
     Boolean(process.env.PIIK_REMOTE_HOST?.trim() || process.env.PIIK_REMOTE_SSH_KEY?.trim())
       ? remoteOptions() : null;
   const chromePath = process.env.CHROME_PATH?.trim();
@@ -627,7 +614,6 @@ async function main(): Promise<void> {
   let chrome: ChildProcessWithoutNullStreams | null = null;
   let cdp: CdpConnection | null = null;
   let nativePort = 0;
-  let remoteTunnel: ChildProcess | null = null;
   let stage = "setup";
   const result: GateResult = {
     passed: false,
@@ -656,7 +642,6 @@ async function main(): Promise<void> {
     remoteRemoteCandidateType: "",
     remoteNatPath: false,
     remotePeerExited: null,
-    reverseSignalTunnelClosed: mode === "cross-nat" ? false : null,
     sourceFailureEndedShare: mode === "local" ? false : null,
     replacementViewerConnected: mode === "local" ? false : null,
     replacementViewerFrames: mode === "local" ? 0 : null,
@@ -727,37 +712,12 @@ async function main(): Promise<void> {
         ...process.env,
         PIIK_DEBUG: "",
         PIIK_CLIENT_GATE_NO_BROWSER: "true",
-        // STUN_URLS reaches only the App's own Pion edge: the in-process
-        // room server never reads it, so the cross-NAT arm stays isolated.
-        ...(mode === "cross-nat" && gateStunUrls
-          ? { STUN_URLS: gateStunUrls }
-          : {}),
       },
     });
     app.stderr.resume();
     stage = "app-ready";
     const appInfo = await readAppEndpoint(app, mode === "one-link");
     nativePort = appInfo.endpoint.port;
-    if (mode === "cross-nat" && remote) {
-      stage = "signaling-tunnel";
-      const tunnel = spawn(
-        process.env.PIIK_SSH?.trim() || "ssh",
-        [
-          "-N", "-T",
-          ...remoteTransportOptions(remote),
-          "-o", "ExitOnForwardFailure=yes",
-          "-R", `127.0.0.1:${remote.signalPort}:127.0.0.1:${appPort}`,
-          `${remote.user}@${remote.host}`,
-        ],
-        { stdio: "ignore", windowsHide: true },
-      );
-      remoteTunnel = tunnel;
-      tunnel.on("error", () => undefined);
-      await new Promise((resolveTunnel) => setTimeout(resolveTunnel, 300));
-      if (tunnel.exitCode !== null) {
-        throw new Error("signaling tunnel could not start");
-      }
-    }
     stage = "local-server-ready";
     await waitForValue(
       async () => {
@@ -893,19 +853,14 @@ async function main(): Promise<void> {
     }
     if (remote) {
       stage = "remote-viewer";
-      const signalUrl = mode === "one-link"
-        ? new URL("/signal", appInfo.publicOrigin!).toString().replace(/^http/, "ws")
-        : `ws://127.0.0.1:${remote.signalPort}/signal`;
-      const signalOrigin = mode === "one-link"
-        ? appInfo.publicOrigin!
-        : `http://localhost:${appPort}`;
+      const signalUrl = new URL("/signal", appInfo.publicOrigin!).toString().replace(/^http/, "ws");
       const remoteResult = await runRemotePeerGate(
         remoteBinary,
         remote,
         signalUrl,
         roomMatch[1],
         viewerGrant,
-        signalOrigin,
+        appInfo.publicOrigin!,
       );
       result.remoteViewerConnected = remoteResult.passed;
       result.remoteViewerPackets = remoteResult.packets;
@@ -1467,9 +1422,6 @@ async function main(): Promise<void> {
     result.error = error instanceof Error ? error.message : String(error);
     result.stage = stage;
   } finally {
-    if (remoteTunnel) {
-      result.reverseSignalTunnelClosed = await stopChild(remoteTunnel);
-    }
     if (sourceChrome && sourceCdp) {
       await closeSourceBrowser(sourceChrome, sourceCdp);
       sourceChrome = null;
@@ -1505,8 +1457,7 @@ async function main(): Promise<void> {
     result.hostInvite &&
     (remote
       ? result.remoteViewerConnected && result.remoteViewerPackets >= 30 &&
-        result.remoteNatPath && result.remotePeerExited === true &&
-        (mode !== "cross-nat" || result.reverseSignalTunnelClosed === true)
+        result.remoteNatPath && result.remotePeerExited === true
       : mode === "one-link"
         ? result.publicViewerPage && result.publicViewerSignal && result.viewerConnected &&
           result.viewerFrames >= 30 && result.viewerWidth === 1920 && result.viewerHeight === 1080 && result.codecPreserved

From bc7485bb80670b2f4bcafb8057676de68966f3f8 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 13:32:43 +0800
Subject: [PATCH 013/262] docs: narrow remaining candidate acceptance

---
 docs/todo.md                       | 11 +++++------
 scripts/peer-assisted-benchmark.ts |  2 +-
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/docs/todo.md b/docs/todo.md
index 36ad1f19d..4957e481c 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -12,12 +12,11 @@ history. A parked idea is not implementation authority.
   coherent candidate and stop before publication. Preserve the existing product
   model; evaluate held features against measurable benefit and total complexity
   before accepting a changed contract.
-- [ ] **Current-contract runtime acceptance.** Exercise sharing, source/quality
-  replacement, reconnect, peer/SFU handoff and independent retirement. Review
-  responsive interaction and reader documentation against the accepted result;
-  keep unavailable physical-device checks explicit. The local Native SFU
-  throughput rerun is limited by [low WGC arrival cadence](./research/native-client-media.md#virtual-display-acceptance-limit)
-  reproduced on unchanged main; do not lower its frame requirement to report a pass.
+- [ ] **Native capture cadence acceptance.** The local Native SFU throughput
+  rerun is limited by [low WGC arrival cadence](./research/native-client-media.md#virtual-display-acceptance-limit)
+  reproduced on unchanged main and a separate Windows-API-only capture probe.
+  Compare on a physical display before claiming current Native throughput
+  acceptance; do not lower the unchanged 300-frame/30-second requirement.
 - [ ] **Independent Gitee mirror recovery.** Implementation and local acceptance
   are complete. Integrate through the next owner-approved publishing merge and
   verify the separate workflow with its original CI artifacts. Mirror failure
diff --git a/scripts/peer-assisted-benchmark.ts b/scripts/peer-assisted-benchmark.ts
index 3348efb39..2d951d313 100644
--- a/scripts/peer-assisted-benchmark.ts
+++ b/scripts/peer-assisted-benchmark.ts
@@ -3536,7 +3536,7 @@ async function main(): Promise<number> {
       "CDP SystemInfo exposes no resident-set field, so peakResidentSetBytes is null; GPU, NIC, glass-to-glass latency, generational visual quality, mobile browsers, and SFU require other measurement.",
       externalServer
         ? "The external server target is exercised as configured; the gate does not infer unavailable transports."
-        : "The local runner does not start LiveKit; SFU consistency is reported only when an SFU route is actually observed.",
+        : "The local runner does not enable embedded SFU; SFU consistency is reported only when an SFU route is actually observed.",
       "The harness emits raw gate fields and simple invariants; it does not implement a route score or runtime policy.",
       "BENCHMARK_QUALITY_SMOKE disables encoded-stream support to verify ordinary-sender parameter propagation. Browser pool producer/clock settings are checked by browser-local-pool-probe.ts.",
       "This gate measures initial topology and relay-loss recovery, not sender-quality convergence or synthetic Viewer-triggered handoffs.",

From bf16776a8c4de88c53baabe26960e911c2cdc004 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 14:18:44 +0800
Subject: [PATCH 014/262] test(server): verify storage failure and cross-room
 isolation boundaries

---
 docs/research/server-consolidation.md |  28 +++---
 docs/todo.md                          |  98 +++++++++++++--------
 internal/server/room/database_test.go | 120 ++++++++++++++++++++++++++
 internal/server/signal/server_test.go |  65 ++++++++++++++
 4 files changed, 260 insertions(+), 51 deletions(-)

diff --git a/docs/research/server-consolidation.md b/docs/research/server-consolidation.md
index 54c1c855a..167c1c9f0 100644
--- a/docs/research/server-consolidation.md
+++ b/docs/research/server-consolidation.md
@@ -1,8 +1,9 @@
 # Server Consolidation
 
-- Reviewed: 2026-09-06
-- Status: implemented in the candidate; the acceptance list below is the
-  remaining boundary
+- Reviewed: 2026-10-07
+- Status: published; current physical limits are in
+  [verification status](../verification-status.md). The before/after measurements
+  below describe the original 2026-09-06 consolidation, not current package cost.
 - Scope: one shared Go backend for Hosted and self-contained App operation
 
 ## Current Ownership
@@ -13,9 +14,10 @@ reachability, and lifecycle policy. Within that scope `protocol` owns wire types
 strict decoding, and shared scalars; `config` owns environment validation plus
 the Hosted and Local compositions; `room` owns room authority, participants, and
 the SQLite database; `route` decides graph transitions without I/O; `signal`
-executes signaling and SFU effects under one lock; `sfu` owns admission, LiveKit
-room control, and token issue; `app` owns HTTP composition, site access, static
-assets, and lifecycle; and `webassets` carries the embedded Browser bundle.
+executes signaling and SFU effects under one lock; `sfu` owns admission and
+embedded media through the shared Pion/LiveKit adapter; `app` owns HTTP
+composition, site access, static assets, and lifecycle; and `webassets` carries
+the embedded Browser bundle.
 `internal/app` keeps the native, launcher, and platform boundaries and
 supervises no server process. These are useful boundaries, not duplication to
 remove.
@@ -39,7 +41,8 @@ requires a concrete ownership gain before further extraction.
 
 The graph controller is now universal. The former rollout switch and ordinary
 Host-star signaling path were removed together, so Hosted and Local
-share one route authority and LiveKit remains an optional fallback of that graph.
+share one route authority. Embedded SFU remains an optional fallback of that graph
+under [ADR-0013](../adr/0013-embedded-node-local-media.md).
 
 ## Target Composition
 
@@ -59,8 +62,8 @@ own their defaults, reachability and lifecycle policy.
 
 Each room keeps one serialized state owner. Go HTTP/WebSocket handlers must not
 mutate room, share and route maps independently. Run password derivation and
-LiveKit I/O outside that owner, then apply results only while the exact session,
-share and operation identities still match. Preserve the existing distinction
+media-transport I/O outside that owner, then apply results only while the exact
+session, share and operation identities still match. Preserve the existing distinction
 between decisions and effects rather than replacing Node serialization with
 unrelated locks around each map.
 
@@ -70,10 +73,9 @@ unrelated locks around each map.
   [`embed`](https://pkg.go.dev/embed) serve HTTP and the built assets.
 - Signaling reuses the App's
   [`coder/websocket`](https://pkg.go.dev/github.com/coder/websocket).
-- LiveKit room control and tokens use the standard library only: HS256 JWTs and
-  Twirp JSON requests. The official
-  [LiveKit Go SDK](https://github.com/livekit/server-sdk-go) adds a large module
-  and license surface for a handful of call shapes and is not used.
+- Embedded SFU and Native media share `internal/media/forwarding`, which reuses
+  Pion transport and LiveKit media components. SDP/ICE uses the authenticated room
+  WebSocket; no external LiveKit room API or media-token service remains.
 - Room persistence keeps the current schema and transactions on the pure-Go
   [`modernc.org/sqlite`](https://pkg.go.dev/modernc.org/sqlite) driver, which
   builds without cgo and holds one exclusive connection; no ORM is needed.
diff --git a/docs/todo.md b/docs/todo.md
index 4957e481c..01a84d735 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -2,16 +2,46 @@
 
 Last reviewed: 2026-10-07
 
-Only **Now** is executable. Product modules own behavior; Git/PRs own completed
-history. A parked idea is not implementation authority.
+The current 2.0 preparation includes independent investigation across this
+ledger. Explicit owner holds remain in force; an investigation does not itself
+accept a new feature or architecture. A missing device or reporter trace blocks
+only that evidence claim, not unrelated work. Product modules own behavior;
+Git/PRs own completed history.
 
 ## Now
 
-- [ ] **2.0 candidate review and acceptance.** The owner reopened investigation,
+- [ ] **2.0 candidate preparation and acceptance.** The owner reopened investigation,
   useful improvements and outstanding acceptance on 2026-10-07. Prepare one
   coherent candidate and stop before publication. Preserve the existing product
   model; evaluate held features against measurable benefit and total complexity
   before accepting a changed contract.
+- [ ] **Optional interaction compatibility.** Apply the owner's chosen rule:
+  an unknown received reaction skips that visual effect while chat and sharing
+  continue. Current command/event decoding shares a strict reaction enum and a
+  decode error terminates signaling. Separate presentation support from malformed
+  or unauthorized traffic at the existing protocol owner; preserve bounded
+  payloads, membership/target validation and strict outgoing commands. Verify
+  the old/new reader boundary before adding another registered reaction.
+- [ ] **Signaling execution and fairness.** Measure signaling-lock contention,
+  synchronous persistence, presence fan-out, diagnostic I/O and cross-room
+  password work before changing the lock or execution model. Start from the
+  existing bounded owners; do not introduce per-room actors without evidence.
+- [ ] **Storage fault boundaries.** Extend real SQLite fault checks to disk I/O
+  failure during COMMIT/ROLLBACK. Write rejection, page-capacity exhaustion and
+  deferred-constraint COMMIT rejection are covered by the room tests. Verify
+  durable and in-memory room authority remain consistent and the next operation
+  has a defined outcome before choosing a recovery change; do not add
+  catch-and-continue retries.
+- [ ] **Lifecycle ownership review.** Trace reachable per-share Host/Viewer,
+  source replacement, signaling recovery and media retirement paths under
+  [engineering review](./standards/engineering.md#ablation-and-review).
+  Reproduce C=3 structural-intent or multi-child evidence concerns before changing
+  their ownership. Keep Native bridge failure distinct from network failure;
+  account for preview, quality candidates, SFU updates and track-ended consumers
+  before changing Host loopback retirement. Simplify only for a concrete gain.
+- [ ] **Documentation consistency.** Check the remaining guides, research and
+  owner links against current behavior; remove obsolete service/API descriptions
+  while retaining the scope and date of historical measurements.
 - [ ] **Native capture cadence acceptance.** The local Native SFU throughput
   rerun is limited by [low WGC arrival cadence](./research/native-client-media.md#virtual-display-acceptance-limit)
   reproduced on unchanged main and a separate Windows-API-only capture probe.
@@ -38,26 +68,33 @@ history. A parked idea is not implementation authority.
 - [ ] **Windows ARM64 App.** Deferred by the owner on 2026-10-03. Keep Windows
   App packages and website downloads x64-only until this work is reopened.
 
-## Deferred Feature Work
+## Feature Assessments
 
-These proposals remain outside the current candidate. Reassessment on
-2026-10-07 did not establish enough benefit for their added owners and operating
-cost. The media and transport assessments below remain recommendations for the
-owner's final scope review, not permanent prohibitions.
+Assess these proposals against the owner's benefit/complexity condition.
+Existing negative results narrow the next experiment; they do not freeze the
+whole candidate or require another version-number decision before other work.
+Implementation needs a concrete useful result within the product model.
 
 - [ ] **4K and additional codecs.** The [media assessment](./research/native-client-media.md#media-capability-extension-assessment)
-  recommends retaining current limits for this candidate. Reopen with a concrete
-  source/receiver use case that justifies coordinated capture, forwarding and
-  resource bounds; keep UI presets separate from those bounds in any new design.
-
+  recommends retaining current limits. Assess concrete source/receiver cases
+  before accepting coordinated capture, forwarding and resource-bound changes;
+  keep UI presets separate from those bounds in any new design. Additional
+  formats must account for late Viewers and relays that cannot decode or forward
+  the published format; codec negotiation alone does not transcode it.
+- [ ] **Native Magicsock.** Go reuse is feasible, but the
+  [matched comparisons](./research/nat-traversal.md#integration-cost-and-recovery-controls)
+  have not established improved direct reachability. Seek a repeatable benefit
+  before accepting peer-key authorization/revocation, underlay readiness and
+  relay operation. Keep the isolated experiment separate from product routing;
+  the P2P evidence work below owns the network/interop acceptance boundary.
 - [ ] **Managed Demo hosting.** The [provider assessment](./operations/website.md#managed-hosting-assessment)
   identifies UDP/storage requirements but establishes no cost saving. Keep the
   existing P2P-only Demo until a provider and operating boundary are accepted.
-- [ ] **Phone as a Host microphone: assess after the current work.** Explore an
-  opt-in link that pairs a phone's microphone with the Host's existing audio
-  mixer. Evaluate pairing/revocation, latency/echo, browser background limits
+- [ ] **Phone as a Host microphone.** Assess an opt-in link that pairs a phone's
+  microphone with the Host's existing audio mixer. Evaluate pairing/revocation,
+  latency/echo, browser background limits
   and Browser/native input ownership before accepting an implementation. This
-  proposal does not reopen room voice or change the current release scope.
+  proposal does not reopen room voice; establish feasibility before accepting it.
 - [ ] **Passive App attachment: design hold.** Site mode authorizes one selected
   origin and supplies native media without starting a local room server. A
   passive replacement needs an accepted site-consent/discovery flow; it must not
@@ -183,42 +220,27 @@ works, so a Rust alternative needs a concrete Go limitation.
    [Browser pool comparison](./research/browser-local-encoding-pool.md#balanced-startup-and-recovery)
    owns cold-encoder tradeoffs; low resolution alone is not a defect. Check
    whether a proposed move merely shifts pressure to another parent's siblings.
-3. **Signaling execution model.** Measure signaling-lock contention, synchronous
-   persistence, presence fan-out, diagnostic I/O and cross-room password-work
-   fairness before changing the lock or execution model.
-4. **Reachable ownership/refactor work.** With related behavior changes, evaluate
-   per-share Host and Viewer route ownership under
-   [engineering review](./standards/engineering.md#ablation-and-review).
-   Reopen C=3 structural-intent retention or multi-child evidence ownership only
-   with current-contract reproductions. Shared recovery must preserve Native
-   bridge versus network-failure semantics. Before changing Host loopback-failure
-   retirement, account for its preview, Browser quality candidates, quality/SFU
-   updates and track-ended consumers; independent Native publication alone does
-   not make ignoring the failure safe. This is not a diagnosed field cause.
-5. **Storage fault recovery.** Choose and verify a damaged-disk/COMMIT/ROLLBACK
-   recovery policy before adding catch-and-continue or retries. This failure
-   boundary remains unestablished after ordinary persistence checks.
-6. **Platform output.** Reopen for a registered receiver acting as an ordinary
+3. **Platform output.** Reopen for a registered receiver acting as an ordinary
    Viewer only after the [platform-output gate](./research/platform-output.md)
    passes.
-7. **Additional languages.** Review community catalogs and their rendered UI
+4. **Additional languages.** Review community catalogs and their rendered UI
    following the [translation guide](./guide/translating.md), including names,
    menu navigation, text direction and layout.
-8. **Windows code signing.** Revisit after enrollment in a trusted signing
+5. **Windows code signing.** Revisit after enrollment in a trusted signing
     service. Sign executables before archive checksums; publisher identity does
     not guarantee that antivirus cloud scanning stops.
-9. **Gitee download-source warning.** Paused by the owner. Keep GitHub primary
+6. **Gitee download-source warning.** Paused by the owner. Keep GitHub primary
     and retain Gitee; do not add a self-hosted mirror. Chrome still blocks the
     Gitee attachment when Referer is removed. Reopen for new evidence or a
     provider review; the warning remains unresolved.
-10. **Release-operation policy.** Protected release environments and immutable
+7. **Release-operation policy.** Protected release environments and immutable
     draft assets remain unaccepted proposals; evaluate their benefit before
     adding release machinery.
-11. **Automatic local chat history.** Explicit TXT export covers manual retention.
+8. **Automatic local chat history.** Explicit TXT export covers manual retention.
     Reconsider automatic storage only with a stable room-incarnation identity,
     bounded retention and a clear delete control; reusable room codes must not
     combine conversations. No new history service or wire field is authorized.
-12. **Direct OBS input (#436).** Reopen for a measured virtual-camera limitation.
+9. **Direct OBS input (#436).** Reopen for a measured virtual-camera limitation.
     The [capture assessment](./research/camera-and-microphone.md) records raw-frame
     output and the WHIP boundary; virtual camera alone is not a second encode.
     Do not add an RTMP/WHIP listener without an accepted publication owner.
diff --git a/internal/server/room/database_test.go b/internal/server/room/database_test.go
index ac33dceab..3ed405fc1 100644
--- a/internal/server/room/database_test.go
+++ b/internal/server/room/database_test.go
@@ -4,12 +4,17 @@ import (
 	"bytes"
 	"crypto/sha256"
 	"database/sql"
+	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 	"reflect"
 	"strings"
 	"testing"
 
+	"modernc.org/sqlite"
+	sqlite3 "modernc.org/sqlite/lib"
+
 	"github.com/TNTcraftHIM/Piik/internal/server/protocol"
 )
 
@@ -91,6 +96,121 @@ func TestDoesNotPersistARoomWhenPasswordDerivationIsBusy(t *testing.T) {
 	}
 }
 
+func TestRoomCreationStorageFailuresPreserveAuthority(t *testing.T) {
+	for _, testCase := range []struct {
+		name    string
+		install string
+		remove  string
+		code    int
+	}{
+		{
+			name: "read-only connection", install: "PRAGMA query_only = ON",
+			remove: "PRAGMA query_only = OFF", code: sqlite3.SQLITE_READONLY,
+		},
+		{
+			// The room INSERT succeeds; a deferred constraint rejects COMMIT.
+			// Temporary objects leave the production schema unchanged.
+			name: "commit rejection",
+			install: `PRAGMA foreign_keys = ON;
+				CREATE TEMP TABLE fault_parent (id INTEGER PRIMARY KEY);
+				CREATE TEMP TABLE fault_child (
+					id INTEGER REFERENCES fault_parent(id) DEFERRABLE INITIALLY DEFERRED
+				);
+				CREATE TEMP TRIGGER reject_commit AFTER INSERT ON main.rooms
+				BEGIN INSERT INTO fault_child VALUES (1); END;`,
+			remove: "DROP TRIGGER temp.reject_commit",
+			code:   sqlite3.SQLITE_CONSTRAINT_FOREIGNKEY,
+		},
+	} {
+		t.Run(testCase.name, func(t *testing.T) {
+			path := databasePath(t)
+			store := stableStore(t, path, Options{})
+			createRoom(t, store, protocol.CodeEntryOpen, "", "4321")
+			before, err := store.database.readStoredRooms()
+			if err != nil {
+				t.Fatal(err)
+			}
+			free := len(store.freeRoomCodes)
+			if _, err := store.database.exec(testCase.install); err != nil {
+				t.Fatal(err)
+			}
+			_, err = tryCreateRoom(store, protocol.CodeEntryOpen, "", "5678")
+			var sqliteErr *sqlite.Error
+			if !errors.As(err, &sqliteErr) || sqliteErr.Code() != testCase.code {
+				t.Fatalf("create error = %v, want SQLite code %d", err, testCase.code)
+			}
+			after, err := store.database.readStoredRooms()
+			if err != nil || !reflect.DeepEqual(before, after) || store.Size() != 1 || len(store.freeRoomCodes) != free {
+				t.Fatalf("failed write changed authority: rooms=%d, free=%d, error=%v", store.Size(), len(store.freeRoomCodes), err)
+			}
+			if _, err := store.database.exec(testCase.remove); err != nil {
+				t.Fatal(err)
+			}
+			created := createRoom(t, store, protocol.CodeEntryOpen, "", "5678")
+			if created.RoomID != "5678" {
+				t.Fatalf("failed write did not release room code: %s", created.RoomID)
+			}
+			if err := store.Close(); err != nil {
+				t.Fatal(err)
+			}
+			restored := stableStore(t, path, Options{})
+			if restored.Size() != 2 {
+				t.Fatalf("restored rooms = %d, want 2", restored.Size())
+			}
+			if _, err := restored.HostManagedRoom(created.RoomID, created.HostToken); err != nil {
+				t.Fatalf("restored Host authority: %v", err)
+			}
+		})
+	}
+}
+
+func TestDatabaseFullDoesNotConsumeRoomAuthorityOrPreventLaterWrites(t *testing.T) {
+	path := databasePath(t)
+	store := stableStore(t, path, Options{MaxRooms: 1000})
+	initialFree := len(store.freeRoomCodes)
+	pages, err := store.database.readPragmaInteger("page_count")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := store.database.exec(fmt.Sprintf("PRAGMA max_page_count = %d", pages)); err != nil {
+		t.Fatal(err)
+	}
+	for n := 0; n < 1000; n++ {
+		roomID := fmt.Sprintf("%04d", 1000+n)
+		_, err := tryCreateRoom(store, protocol.CodeEntryOpen, "", roomID)
+		if err == nil {
+			continue
+		}
+		var sqliteErr *sqlite.Error
+		if !errors.As(err, &sqliteErr) || sqliteErr.Code() != sqlite3.SQLITE_FULL {
+			t.Fatalf("create error = %v, want SQLITE_FULL", err)
+		}
+		rows, err := store.database.readStoredRooms()
+		if err != nil || len(rows) != n || store.Size() != n || len(store.freeRoomCodes) != initialFree-n {
+			t.Fatalf("full database changed authority: rows=%d, rooms=%d, free=%d, error=%v", len(rows), store.Size(), len(store.freeRoomCodes), err)
+		}
+		if _, err := store.database.exec("PRAGMA max_page_count = 1000"); err != nil {
+			t.Fatal(err)
+		}
+		created := createRoom(t, store, protocol.CodeEntryOpen, "", roomID)
+		if created.RoomID != roomID {
+			t.Fatalf("recovered room code = %s, want %s", created.RoomID, roomID)
+		}
+		if err := store.Close(); err != nil {
+			t.Fatal(err)
+		}
+		restored := stableStore(t, path, Options{MaxRooms: 1000})
+		if restored.Size() != n+1 {
+			t.Fatalf("restored rooms = %d, want %d", restored.Size(), n+1)
+		}
+		if _, err := restored.HostManagedRoom(created.RoomID, created.HostToken); err != nil {
+			t.Fatalf("restored Host authority: %v", err)
+		}
+		return
+	}
+	t.Fatal("bounded database did not reach SQLITE_FULL")
+}
+
 func TestRestoresTheExactAuthorityAggregateWithoutParticipants(t *testing.T) {
 	path := databasePath(t)
 	first := stableStore(t, path, Options{})
diff --git a/internal/server/signal/server_test.go b/internal/server/signal/server_test.go
index 79db2d308..092fe005d 100644
--- a/internal/server/signal/server_test.go
+++ b/internal/server/signal/server_test.go
@@ -72,6 +72,71 @@ func TestCreateRoomReleasesLockWhenDerivationOrCommitPanics(t *testing.T) {
 	}
 }
 
+func TestPasswordPreparationDoesNotBlockAnotherRoom(t *testing.T) {
+	for _, update := range []bool{false, true} {
+		t.Run(fmt.Sprintf("update=%v", update), func(t *testing.T) {
+			started, release := make(chan struct{}), make(chan struct{})
+			var hold atomic.Bool
+			var releaseOnce sync.Once
+			unblock := func() { releaseOnce.Do(func() { close(release) }) }
+			t.Cleanup(unblock)
+			store, err := room.New(room.Options{
+				MaxRooms: 3, MaxViewersPerRoom: 1,
+				Random: func(size int) []byte {
+					// Hold the existing salt source in the unlocked password phase.
+					if hold.CompareAndSwap(true, false) {
+						close(started)
+						<-release
+					}
+					return bytes.Repeat([]byte{byte(size)}, size)
+				},
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+			server := &Server{store: store}
+			original, err := server.CreateRoom(protocol.CodeEntryOpen, nil, "1234")
+			if err != nil {
+				t.Fatal(err)
+			}
+			hold.Store(true)
+			done := make(chan error, 1)
+			go func() {
+				password := "room-password"
+				var err error
+				if update {
+					_, err = server.UpdateRoomAccess(original.RoomID, original.HostToken,
+						protocol.SetViewerPasswordRequest{Password: &password})
+				} else {
+					_, err = server.CreateRoom(protocol.CodeEntryPrivate, &password, "2345")
+				}
+				done <- err
+			}()
+			select {
+			case <-started:
+			case <-time.After(defaultWait):
+				t.Fatal("password preparation did not start")
+			}
+			if !server.mu.TryLock() {
+				t.Fatal("password work blocks signaling for other rooms")
+			}
+			server.mu.Unlock()
+			if _, err := server.CreateRoom(protocol.CodeEntryOpen, nil, "3456"); err != nil {
+				t.Fatalf("independent room creation: %v", err)
+			}
+			unblock()
+			select {
+			case err := <-done:
+				if err != nil {
+					t.Fatalf("password operation: %v", err)
+				}
+			case <-time.After(defaultWait):
+				t.Fatal("password operation did not finish")
+			}
+		})
+	}
+}
+
 func TestStopSharingDoesNotWriteRoomAuthority(t *testing.T) {
 	database, err := room.NewDatabase(filepath.Join(t.TempDir(), "rooms.sqlite"))
 	if err != nil {

From c2d32bae8df8ec468d201b34548610a368a0e9ba Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 16:34:43 +0800
Subject: [PATCH 015/262] fix(interactions): ignore unsupported reaction
 effects

---
 docs/research/room-interactions.md        |  8 ++++++-
 docs/standards/rooms-access.md            |  7 ++++++
 docs/standards/versioning.md              | 10 +++++---
 docs/todo.md                              |  7 ------
 internal/server/protocol/contract_test.go | 20 ++++++++++++++++
 internal/server/protocol/interactions.go  | 18 ++++++++++----
 src/client/lib/room-interactions.ts       | 22 ++++++++++-------
 src/shared/protocol.ts                    | 23 ++++++++++++------
 src/shared/room-interactions.ts           |  2 +-
 tests/fixtures/wire-samples.json          | 10 ++++++++
 tests/protocol.test.ts                    | 16 +++++++++++++
 tests/signaling-admission.test.ts         | 29 +++++++++++++++++++++++
 12 files changed, 141 insertions(+), 31 deletions(-)

diff --git a/docs/research/room-interactions.md b/docs/research/room-interactions.md
index a639269d8..82a56df1d 100644
--- a/docs/research/room-interactions.md
+++ b/docs/research/room-interactions.md
@@ -60,9 +60,15 @@ ends that service; merely leaving the Host page does not.
   session.
 - The viewer discovers this optional capability independently of first-picture
   startup. Late capability discovery enables data on the existing connection.
-- A strict payload union admits plain chat text or a registered reaction. Chat is
+- A strict command payload union admits plain chat text or a registered reaction. Chat is
   at most 280 Unicode code points, normalized to NFC, without control/bidi
   characters. It renders as text, with no markup, links, attachments or commands.
+- Received reaction names are bounded lowercase ASCII identifiers, not arbitrary
+  HTML, assets or commands. The page ignores an unsupported effect after protocol
+  validation; malformed events still fail validation. This follows the command/
+  response distinction in [Azure's extensible-enum guidance](https://github.com/microsoft/api-guidelines/blob/vNext/azure/Guidelines.md#enums--sdks-client-libraries),
+  checked on 2026-10-07. Existing strict pages still reject new names, so this
+  reader change alone does not authorize sending new reactions to those pages.
 - The server accepts at most one interaction per 800 ms per connection. It
   validates identity, subscription and target before fan-out. A slow recipient's
   data is skipped at 16 KiB queued output, reserving the existing bounded queue
diff --git a/docs/standards/rooms-access.md b/docs/standards/rooms-access.md
index d40a5b354..2431119fa 100644
--- a/docs/standards/rooms-access.md
+++ b/docs/standards/rooms-access.md
@@ -132,6 +132,13 @@ for participants still connected to the same room. Interaction subscriptions
 inherit existing membership, replacement and revocation checks; they grant no
 additional authority and do not modify media routes.
 
+Sending a reaction requires a registered identifier. Received reaction events
+validate their envelope, identity, target and bounded identifier, then the page
+skips effects it cannot display. An unknown effect does not terminate signaling,
+enter history, clear a draft or confirm a pending send. Unknown message kinds,
+extra fields and malformed identities remain invalid; this presentation rule
+does not make commands or access checks extensible.
+
 Delivery is transient and bounded. The server keeps no message history; each
 page keeps only a bounded set of received messages and effects, without writing
 them to storage or diagnostics. Re-admission to the same room may retain that
diff --git a/docs/standards/versioning.md b/docs/standards/versioning.md
index ed20819d3..5b86801b5 100644
--- a/docs/standards/versioning.md
+++ b/docs/standards/versioning.md
@@ -63,8 +63,10 @@ parallel authority writers or blanket old-client fallback paths.
 
 ## Extending Interfaces
 
-Command/event JSON objects still reject unknown keys and enums, and required
-fields reject omissions. Therefore even adding a field can break the other side.
+Command/event JSON objects still reject unknown keys, and required fields reject
+omissions. Most enums remain closed; the bounded display-only reaction identifier
+has an explicit [receive-side exception](./rooms-access.md#room-interactions).
+Therefore even adding a field can break the other side.
 The former required `sfu` addition to strict `/api/capabilities` demonstrated
 both directions of this problem; an unchanged signaling identifier does not
 cover HTTP compatibility.
@@ -75,7 +77,9 @@ capability means unavailable. Commands, credentials and authority checks remain
 strict. A new
 message type, enum value or behavior-changing field is emitted only after the
 other side advertises support; accepting unknown metadata is not permission to
-execute unknown commands. Verify both readers before calling a change additive.
+execute unknown commands. A more tolerant reader does not update already-released
+readers: do not emit a new reaction to legacy pages merely because current pages
+can skip it. Verify both readers before calling a change additive.
 
 Native discovery distinguishes an incompatible Piik App from an absent App and
 reports protocol numbers to local diagnostics; the source picker offers update/
diff --git a/docs/todo.md b/docs/todo.md
index 01a84d735..4cd537ab1 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -15,13 +15,6 @@ Git/PRs own completed history.
   coherent candidate and stop before publication. Preserve the existing product
   model; evaluate held features against measurable benefit and total complexity
   before accepting a changed contract.
-- [ ] **Optional interaction compatibility.** Apply the owner's chosen rule:
-  an unknown received reaction skips that visual effect while chat and sharing
-  continue. Current command/event decoding shares a strict reaction enum and a
-  decode error terminates signaling. Separate presentation support from malformed
-  or unauthorized traffic at the existing protocol owner; preserve bounded
-  payloads, membership/target validation and strict outgoing commands. Verify
-  the old/new reader boundary before adding another registered reaction.
 - [ ] **Signaling execution and fairness.** Measure signaling-lock contention,
   synchronous persistence, presence fan-out, diagnostic I/O and cross-room
   password work before changing the lock or execution model. Start from the
diff --git a/internal/server/protocol/contract_test.go b/internal/server/protocol/contract_test.go
index a3d74d33f..9e127ef29 100644
--- a/internal/server/protocol/contract_test.go
+++ b/internal/server/protocol/contract_test.go
@@ -159,6 +159,26 @@ func assertServerMessage(t *testing.T, name string, data []byte, want bool) {
 	})
 }
 
+func TestFutureReactionEventsKeepPayloadAndAuthorityBounds(t *testing.T) {
+	for _, payload := range []string{
+		`{"kind":"reaction","reaction":""}`,
+		`{"kind":"reaction","reaction":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}`,
+		`{"kind":"reaction","reaction":"future effect"}`,
+		`{"kind":"reaction","reaction":"👋"}`,
+		`{"kind":"reaction","reaction":"future-effect","targetPeerId":"bad"}`,
+		`{"kind":"reaction","reaction":"future-effect","text":"hidden command"}`,
+		`{"kind":"reaction","reaction":"tomato"}`,
+		`{"kind":"future-kind","reaction":"wave"}`,
+	} {
+		raw := `{"type":"room-interaction","id":"event_future_1234","requestId":"request_future_1234","occurredAt":1,` +
+			`"sender":{"peerId":"sender_peer_1234","role":"viewer","displayName":"Friend"},"payload":` + payload + `}`
+		assertServerMessage(t, payload, []byte(raw), false)
+	}
+	assertServerMessage(t, "future reaction with invalid sender", []byte(
+		`{"type":"room-interaction","id":"event_future_1234","requestId":"request_future_1234","occurredAt":1,`+
+			`"sender":{"peerId":"bad","role":"viewer","displayName":"Friend"},"payload":{"kind":"reaction","reaction":"future-effect"}}`), false)
+}
+
 func assertClientMessage(t *testing.T, name string, data []byte, want bool) {
 	t.Helper()
 	t.Run(name, func(t *testing.T) {
diff --git a/internal/server/protocol/interactions.go b/internal/server/protocol/interactions.go
index 51f987ffe..737b78658 100644
--- a/internal/server/protocol/interactions.go
+++ b/internal/server/protocol/interactions.go
@@ -2,6 +2,7 @@ package protocol
 
 import (
 	"errors"
+	"regexp"
 	"strings"
 	"unicode/utf8"
 
@@ -11,6 +12,8 @@ import (
 const MaxChatCodePoints = 280
 const InteractionIntervalMs = 800
 
+var reactionIDPattern = regexp.MustCompile(`^[a-z][a-z0-9-]{0,31}$`)
+
 type InteractionPayload struct {
 	Kind         string `json:"kind"`
 	Text         string `json:"text,omitempty"`
@@ -44,7 +47,8 @@ func (payload *InteractionPayload) UnmarshalJSON(data []byte) error {
 		if err = fields.optional("targetPeerId"); err != nil {
 			return err
 		}
-		if fields.has("text") || (fields.has("targetPeerId") && !ValidOpaqueID(value.TargetPeerID)) {
+		if fields.has("text") || !reactionIDPattern.MatchString(value.Reaction) ||
+			(fields.has("targetPeerId") && !ValidOpaqueID(value.TargetPeerID)) {
 			return errors.New("invalid reaction payload")
 		}
 		switch value.Reaction {
@@ -52,9 +56,6 @@ func (payload *InteractionPayload) UnmarshalJSON(data []byte) error {
 			if !ValidOpaqueID(value.TargetPeerID) {
 				return errors.New("throwing a prop requires a participant")
 			}
-		case "wave", "heart", "clap", "laugh", "wow", "party", "fire", "eyes", "star", "sleep":
-		default:
-			return errors.New("unknown reaction")
 		}
 	default:
 		return errors.New("unknown interaction kind")
@@ -93,6 +94,15 @@ func decodeSendRoomInteraction(data []byte) (ClientMessage, error) {
 	if !ValidOpaqueID(message.RequestID) {
 		return nil, errors.New("invalid interaction requestId")
 	}
+	// Only received presentation events are extensible. An unregistered command
+	// must never acquire meaning merely because its identifier is well-formed.
+	if message.Payload.Kind == "reaction" {
+		switch message.Payload.Reaction {
+		case "wave", "heart", "clap", "laugh", "wow", "party", "fire", "eyes", "star", "sleep", "tomato", "poop":
+		default:
+			return nil, errors.New("unknown reaction")
+		}
+	}
 	return message, nil
 }
 
diff --git a/src/client/lib/room-interactions.ts b/src/client/lib/room-interactions.ts
index 073c41fb1..3f4d05397 100644
--- a/src/client/lib/room-interactions.ts
+++ b/src/client/lib/room-interactions.ts
@@ -3,7 +3,9 @@ import { INTERACTION_INTERVAL_MS, REACTION_DURATION_MS } from "../../shared/room
 import { createOpaqueId } from "./opaque-id";
 import { identityHash } from "./identity-hash";
 
-export type RoomInteraction = Extract<ServerMessage, { type: "room-interaction" }>;
+export type RoomInteraction = Omit<Extract<ServerMessage, { type: "room-interaction" }>, "payload"> & {
+  payload: InteractionPayload;
+};
 type Rejection = Extract<ServerMessage, { type: "room-interaction-rejected" }>["reason"];
 export type InteractionError = Rejection | "offline" | "unconfirmed";
 export const CHAT_OVERLAY_DURATION_MS = 6000;
@@ -62,25 +64,29 @@ export class RoomInteractionSession {
     this.sendMessage({ type: "subscribe-room-interactions" });
   }
 
-  receive(message: ServerMessage): boolean {
+  receive(event: ServerMessage): boolean {
     if (this.closed) return false;
-    if (message.type === "room-interactions-ready") {
+    if (event.type === "room-interactions-ready") {
       if (this.subscriptionStartedAt === null) return true;
       // One connection-scoped midpoint estimate; arrivals never move the clock.
-      this.serverOffset = message.serverTime - (this.subscriptionStartedAt + this.now()) / 2;
+      this.serverOffset = event.serverTime - (this.subscriptionStartedAt + this.now()) / 2;
       this.subscriptionStartedAt = null;
       this.update({ ready: true });
       return true;
     }
-    if (message.type === "room-interaction-rejected") {
-      if (message.requestId === this.state.pending?.requestId) {
+    if (event.type === "room-interaction-rejected") {
+      if (event.requestId === this.state.pending?.requestId) {
         clearTimeout(this.pendingTimer);
-        this.update({ pending: null, error: message.reason });
+        this.update({ pending: null, error: event.reason });
       }
       return true;
     }
-    if (message.type !== "room-interaction") return false;
+    if (event.type !== "room-interaction") return false;
     if (!this.state.ready) return true;
+    const payload = interactionPayloadSchema.safeParse(event.payload);
+    // Unsupported decoration is not a signaling failure or a send confirmation.
+    if (!payload.success) return true;
+    const message: RoomInteraction = { ...event, payload: payload.data };
     const now = this.now();
     // Clock uncertainty may put a fresh event slightly ahead. Never extend its
     // lifetime beyond one full effect, and never replay an expired effect.
diff --git a/src/shared/protocol.ts b/src/shared/protocol.ts
index dbadef197..9a6b2cc7e 100644
--- a/src/shared/protocol.ts
+++ b/src/shared/protocol.ts
@@ -66,13 +66,22 @@ const opaqueIdSchema = z
   .max(128)
   .regex(/^[A-Za-z0-9_-]+$/);
 
-export const interactionPayloadSchema = z.discriminatedUnion("kind", [
-  z.object({ kind: z.literal("chat"), text: z.string().min(1).max(MAX_CHAT_CODE_POINTS * 2)
-    .refine(value => normalizeChatText(value) === value) }).strict(),
-  z.object({ kind: z.literal("reaction"), reaction: z.enum(REACTION_IDS),
-    targetPeerId: opaqueIdSchema.optional() }).strict(),
-]).refine(payload => payload.kind !== "reaction" || !isThrow(payload.reaction) || !!payload.targetPeerId,
+const chatPayloadSchema = z.object({ kind: z.literal("chat"),
+  text: z.string().min(1).max(MAX_CHAT_CODE_POINTS * 2)
+    .refine(value => normalizeChatText(value) === value) }).strict();
+const reactionPayloadSchema = z.object({ kind: z.literal("reaction"),
+  reaction: z.string().min(1).max(32).regex(/^[a-z][a-z0-9-]*$/),
+  targetPeerId: opaqueIdSchema.optional() }).strict()
+  .refine(payload => !isThrow(payload.reaction) || !!payload.targetPeerId,
   { message: "Throwing a prop requires a participant" });
+// Commands require a registered effect; received events may carry a future
+// display-only identifier. Identity, payload shape and target bounds stay strict.
+export const interactionPayloadSchema = z.discriminatedUnion("kind", [
+  chatPayloadSchema, reactionPayloadSchema.safeExtend({ reaction: z.enum(REACTION_IDS) }),
+]);
+const receivedInteractionPayloadSchema = z.discriminatedUnion("kind", [
+  chatPayloadSchema, reactionPayloadSchema,
+]);
 export type InteractionPayload = z.infer<typeof interactionPayloadSchema>;
 
 const noMediaRouteUpstreamSchema = z
@@ -1051,7 +1060,7 @@ export const serverMessageSchema = z.union([
   z.object({ type: z.literal("room-interaction"), id: opaqueIdSchema, requestId: opaqueIdSchema,
     occurredAt: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
     sender: z.object({ peerId: opaqueIdSchema, role: z.enum(["host", "viewer"]), displayName: displayNameSchema }).strict(),
-    payload: interactionPayloadSchema }).strict(),
+    payload: receivedInteractionPayloadSchema }).strict(),
   authenticatedMessageSchema,
   z.object({
     type: z.literal("sharing-start-failed"),
diff --git a/src/shared/room-interactions.ts b/src/shared/room-interactions.ts
index aa21f6d60..f0131fca6 100644
--- a/src/shared/room-interactions.ts
+++ b/src/shared/room-interactions.ts
@@ -4,7 +4,7 @@ export const INTERACTION_INTERVAL_MS = 800;
 export const REACTION_DURATION_MS = 2400;
 export const REACTION_IDS = ["wave", "heart", "clap", "laugh", "wow", "party", "fire", "eyes", "star", "sleep", "tomato", "poop"] as const;
 export type ReactionId = typeof REACTION_IDS[number];
-export const isThrow = (reaction: ReactionId) => reaction === "tomato" || reaction === "poop";
+export const isThrow = (reaction: string) => reaction === "tomato" || reaction === "poop";
 export const REACTION_GLYPHS: Record<ReactionId, string> = {
   wave: "👋", heart: "❤️", clap: "👏", laugh: "😂", wow: "🤯", party: "🎉",
   fire: "🔥", eyes: "👀", star: "⭐", sleep: "😴", tomato: "🍅", poop: "💩",
diff --git a/tests/fixtures/wire-samples.json b/tests/fixtures/wire-samples.json
index 12e6c6ee7..2d929e46d 100644
--- a/tests/fixtures/wire-samples.json
+++ b/tests/fixtures/wire-samples.json
@@ -40,6 +40,12 @@
     "interactionIntervalMs": 800
   },
   "clientMessages": [
+    {
+      "name": "send-unregistered-reaction",
+      "schema": "client",
+      "json": "{\"type\":\"send-room-interaction\",\"requestId\":\"request_12345678\",\"payload\":{\"kind\":\"reaction\",\"reaction\":\"future-effect\"}}",
+      "valid": false
+    },
     {
       "name": "authenticate-host-minimal",
       "schema": "client",
@@ -1050,6 +1056,10 @@
     }
   ],
   "serverMessages": [
+    {
+      "name": "room-interaction-future-reaction",
+      "json": "{\"type\":\"room-interaction\",\"id\":\"event_12345678\",\"requestId\":\"request_12345678\",\"occurredAt\":1700000000010,\"sender\":{\"peerId\":\"peer_12345678\",\"role\":\"host\",\"displayName\":\"Piik friend\"},\"payload\":{\"kind\":\"reaction\",\"reaction\":\"future-effect\",\"targetPeerId\":\"target_12345678\"}}"
+    },
     {
       "name": "authenticated-host-minimal",
       "json": "{\"type\":\"authenticated\",\"protocol\":\"piik-v23\",\"peerId\":\"host_12345678\",\"maxViewers\":8,\"endpointMediaCopyCapacity\":2,\"hostOnline\":true,\"connectionId\":null,\"iceConfig\":{\"iceServers\":[],\"natPredictionStunUrls\":[]},\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false},\"codeEntryPolicy\":\"open\",\"viewerAuthorizationGeneration\":\"viewer_generation_12345678\",\"mediaMode\":\"peer-assisted\",\"shareGeneration\":\"share_generation_12345678\",\"routeRevision\":0,\"routeAssignment\":{\"upstream\":{\"kind\":\"none\"},\"childPeerIds\":[],\"sfuPublicationGeneration\":null},\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"screenAudioQuality\":\"music\"},\"role\":\"host\",\"viewerPasswordEnabled\":false}"
diff --git a/tests/protocol.test.ts b/tests/protocol.test.ts
index aeffaf411..28ce6b697 100644
--- a/tests/protocol.test.ts
+++ b/tests/protocol.test.ts
@@ -27,6 +27,22 @@ import {
 const token = "a".repeat(43);
 const roomId = "1234";
 const viewerGrant = `${"b".repeat(21)}g`;
+
+it("accepts bounded future reaction events while keeping commands and known prop targets strict", () => {
+  const event = { type: "room-interaction", id: "event_future_1234", requestId: "request_future_1234", occurredAt: 1,
+    sender: { peerId: "sender_peer_1234", role: "viewer", displayName: "Friend" },
+    payload: { kind: "reaction", reaction: "future-effect", targetPeerId: "target_peer_1234" } };
+  expect(serverMessageSchema.safeParse(event).success).toBe(true);
+  expect(clientMessageSchema.safeParse({ type: "send-room-interaction", requestId: event.requestId, payload: event.payload }).success).toBe(false);
+  for (const payload of [
+    { kind: "reaction", reaction: "" }, { kind: "reaction", reaction: "a".repeat(33) },
+    { kind: "reaction", reaction: "future effect" }, { kind: "reaction", reaction: "👋" },
+    { kind: "reaction", reaction: "future-effect", targetPeerId: "bad" },
+    { kind: "reaction", reaction: "future-effect", text: "hidden command" },
+    { kind: "reaction", reaction: "tomato" }, { kind: "future-kind", reaction: "wave" },
+  ]) expect(serverMessageSchema.safeParse({ ...event, payload }).success).toBe(false);
+  expect(serverMessageSchema.safeParse({ ...event, sender: { ...event.sender, peerId: "bad" } }).success).toBe(false);
+});
 const qualitySettings = {
   resolution: "1080p",
   maxFramerate: 60,
diff --git a/tests/signaling-admission.test.ts b/tests/signaling-admission.test.ts
index f90dc9562..2fe5e8a60 100644
--- a/tests/signaling-admission.test.ts
+++ b/tests/signaling-admission.test.ts
@@ -1,3 +1,4 @@
+import { readFileSync } from "node:fs";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { SignalingClient } from "../src/client/lib/signaling";
 import { DEFAULT_ROUTE_POLICY } from "../src/shared/protocol";
@@ -37,6 +38,34 @@ function fixture(role: "host" | "viewer" = "host") {
 }
 
 describe("room authentication and site admission", () => {
+  it("skips an unknown reaction without interrupting chat, media messages or a pending send", () => {
+    const { signal, sockets, events } = fixture();
+    const interactions = signal.interactions!;
+    const wire = JSON.parse(readFileSync(new URL("./fixtures/wire-samples.json", import.meta.url), "utf8"));
+    const authenticated = JSON.parse(wire.serverMessages.find(
+      (sample: { name: string }) => sample.name === "authenticated-host-minimal").json);
+    sockets[0]!.receive(authenticated);
+    sockets[0]!.receive({ type: "room-interactions-ready", serverTime: Date.now() });
+    expect(interactions.send({ kind: "chat", text: "keep my draft" })).toBe(true);
+    const before = interactions.getSnapshot();
+    const event = { type: "room-interaction", id: "future_event_1234", requestId: before.pending!.requestId,
+      occurredAt: Date.now(), sender: { peerId: authenticated.peerId, role: "host", displayName: "Friend" },
+      payload: { kind: "reaction", reaction: "future-effect" } };
+    sockets[0]!.receive(event);
+    expect(interactions.getSnapshot()).toBe(before);
+    sockets[0]!.receive({ ...event, id: "chat_event_1234", payload: { kind: "chat", text: "keep my draft" } });
+    expect(interactions.getSnapshot().messages).toHaveLength(1);
+    expect(interactions.getSnapshot().pending).toBeNull();
+    const media = { type: "host-status", online: true, paused: false };
+    sockets[0]!.receive(media);
+    expect(events.onMessage).toHaveBeenCalledWith(media);
+    expect(events.onTerminated).not.toHaveBeenCalled();
+    expect(sockets[0]!.close).not.toHaveBeenCalled();
+    expect(sockets).toHaveLength(1);
+    signal.stop();
+    expect(vi.getTimerCount()).toBe(0);
+  });
+
   it("keeps one connection when starting the room during reconnect backoff", async () => {
     const { signal, sockets, events } = fixture();
     sockets[0]!.dispatchEvent(Object.assign(new Event("close"), { code: 1006 }));

From bbc176e51de1d4548909f515ea2004eb0d424817 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 16:48:15 +0800
Subject: [PATCH 016/262] refactor(storage): let SQLite own transaction state

---
 docs/research/cross-restart-room-recovery.md | 18 ++++++++
 docs/todo.md                                 |  6 ---
 internal/server/room/database.go             | 48 ++++++--------------
 3 files changed, 32 insertions(+), 40 deletions(-)

diff --git a/docs/research/cross-restart-room-recovery.md b/docs/research/cross-restart-room-recovery.md
index 7a5c833d0..1d13677c9 100644
--- a/docs/research/cross-restart-room-recovery.md
+++ b/docs/research/cross-restart-room-recovery.md
@@ -101,6 +101,24 @@ compatibility path. The completed cutover is retained in Git; current
 7. Surviving Host/Viewer tabs reauthenticate and rebuild a fresh route; no test
    labels that bounded rebuild as uninterrupted media.
 
+### SQLite I/O Failure Boundary
+
+On 2026-10-07, the current pure-Go driver was exercised in an isolated Linux VM
+with 600 synthetic rooms. Syscall fault injection rejected journal/database
+`pwrite64` and `fsync` during commit and rollback, including spilled dirty pages
+and sustained failures. Rejected writes did not become accepted authority;
+while the fault persisted, further writes failed. After removing the fault,
+reads, a new mutation and reopening the database retained the expected rows.
+Read-only, page-capacity and deferred-constraint failures are also covered by
+the ordinary room tests. This is not power-loss or filesystem-durability proof.
+
+SQLite can roll back automatically after an I/O or capacity error, so a separate
+application transaction flag cannot reliably describe it. The owner now issues
+one best-effort rollback on failure, preserves the original error and adds no
+retry/reopen mechanism. This follows [SQLite's transaction error guidance](https://sqlite.org/lang_transaction.html#response_to_errors_within_a_transaction);
+the experiment used [strace syscall fault injection](https://man7.org/linux/man-pages/man1/strace.1.html)
+on disposable files, not production data.
+
 ## Primary Sources
 
 - [Node.js SQLite](https://nodejs.org/docs/latest-v24.x/api/sqlite.html)
diff --git a/docs/todo.md b/docs/todo.md
index 4cd537ab1..5637ee027 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -19,12 +19,6 @@ Git/PRs own completed history.
   synchronous persistence, presence fan-out, diagnostic I/O and cross-room
   password work before changing the lock or execution model. Start from the
   existing bounded owners; do not introduce per-room actors without evidence.
-- [ ] **Storage fault boundaries.** Extend real SQLite fault checks to disk I/O
-  failure during COMMIT/ROLLBACK. Write rejection, page-capacity exhaustion and
-  deferred-constraint COMMIT rejection are covered by the room tests. Verify
-  durable and in-memory room authority remain consistent and the next operation
-  has a defined outcome before choosing a recovery change; do not add
-  catch-and-continue retries.
 - [ ] **Lifecycle ownership review.** Trace reachable per-share Host/Viewer,
   source replacement, signaling recovery and media retirement paths under
   [engineering review](./standards/engineering.md#ablation-and-review).
diff --git a/internal/server/room/database.go b/internal/server/room/database.go
index 94657c0f7..199203f64 100644
--- a/internal/server/room/database.go
+++ b/internal/server/room/database.go
@@ -89,9 +89,6 @@ type Database struct {
 	path string
 	db   *sql.DB
 	conn *sql.Conn
-	// inTransaction reproduces DatabaseSync.isTransaction, which the driver
-	// does not expose; the ROLLBACK guard depends on it.
-	inTransaction bool
 }
 
 // NewDatabase is the RoomDatabase constructor.
@@ -141,16 +138,16 @@ func (d *Database) Initialize() (restored []StoredRoomAuthority, err error) {
 	if lockingMode != "exclusive" {
 		return nil, errors.New("Room database could not acquire exclusive locking mode")
 	}
-	if err = d.begin("BEGIN EXCLUSIVE"); err != nil {
+	if _, err = d.exec("BEGIN EXCLUSIVE"); err != nil {
 		return nil, err
 	}
 	restored, err = d.recover()
 	if err != nil {
-		d.rollbackIfNeeded()
+		d.rollback()
 		return nil, err
 	}
-	if err = d.finish("COMMIT"); err != nil {
-		d.rollbackIfNeeded()
+	if _, err = d.exec("COMMIT"); err != nil {
+		d.rollback()
 		return nil, err
 	}
 	return restored, nil
@@ -330,7 +327,7 @@ func (d *Database) Close() error {
 
 func (d *Database) closeHandles() error {
 	conn, db := d.conn, d.db
-	d.conn, d.db, d.inTransaction = nil, nil, false
+	d.conn, d.db = nil, nil
 	var connError error
 	if conn != nil {
 		connError = conn.Close()
@@ -531,42 +528,25 @@ func (d *Database) transaction(operation func() error) error {
 	if d.conn == nil {
 		return errors.New("Room database is not initialized")
 	}
-	if err := d.begin("BEGIN IMMEDIATE"); err != nil {
+	if _, err := d.exec("BEGIN IMMEDIATE"); err != nil {
 		return err
 	}
 	if err := operation(); err != nil {
-		d.rollbackIfNeeded()
+		d.rollback()
 		return err
 	}
-	if err := d.finish("COMMIT"); err != nil {
-		d.rollbackIfNeeded()
+	if _, err := d.exec("COMMIT"); err != nil {
+		d.rollback()
 		return err
 	}
 	return nil
 }
 
-func (d *Database) begin(statement string) error {
-	if _, err := d.conn.ExecContext(context.Background(), statement); err != nil {
-		return err
-	}
-	d.inTransaction = true
-	return nil
-}
-
-func (d *Database) finish(statement string) error {
-	if _, err := d.conn.ExecContext(context.Background(), statement); err != nil {
-		return err
-	}
-	d.inTransaction = false
-	return nil
-}
-
-// rollbackIfNeeded is `if (database.isTransaction) database.exec("ROLLBACK")`:
-// a ROLLBACK with no active transaction is itself an error.
-func (d *Database) rollbackIfNeeded() {
-	if d.inTransaction {
-		_ = d.finish("ROLLBACK")
-	}
+// SQLite may already have rolled back after an I/O or capacity error. An
+// explicit rollback is harmless then; SQLite, not a Go mirror, owns that state.
+// Preserve the original failure rather than replacing it with "no transaction".
+func (d *Database) rollback() {
+	_, _ = d.exec("ROLLBACK")
 }
 
 func (d *Database) exec(query string, args ...any) (int64, error) {

From b994c7b84de2140c0b90363128bdbe2b11e80993 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 16:59:27 +0800
Subject: [PATCH 017/262] docs(signal): record bounded-load execution evidence

---
 docs/research/server-consolidation.md | 25 +++++++++++++++++++++++++
 docs/todo.md                          | 14 ++++++--------
 internal/server/signal/server.go      |  9 +++++----
 3 files changed, 36 insertions(+), 12 deletions(-)

diff --git a/docs/research/server-consolidation.md b/docs/research/server-consolidation.md
index 167c1c9f0..9a76c68e1 100644
--- a/docs/research/server-consolidation.md
+++ b/docs/research/server-consolidation.md
@@ -101,6 +101,31 @@ and [ADR-0010](../adr/0010-cross-platform-client-runtime.md) as amended by
 
 ## Measured Before And After
 
+### Signaling Execution Check
+
+On 2026-10-07, an isolated Windows loopback check used 10 rooms with one Host and
+20 Viewers each. Nine Hosts changed their display names 10 times/s, exercising
+presence encoding and fan-out; another task changed room policy 10 times/s,
+and four password tasks ran once/s outside the signaling lock. The diagnostic
+variant additionally wrote 200 synthetic route records/s through the real file
+sink under that lock. Each run measured 200 requests from a separate room.
+
+| Storage / diagnostics | Signaling lock wait P95 | Request round-trip P95 | Retained connections |
+| --- | ---: | ---: | ---: |
+| Memory | Below clock resolution | 6.5 ms | 210/210 |
+| SQLite | 1.0 ms | 5.9 ms | 210/210 |
+| SQLite + diagnostic sink | 3.0 ms | 7.0 ms | 210/210 |
+
+These short local checks do not establish WAN, slow-disk or maximum-capacity
+performance. A separate overload run at 900 name changes/s and 40 password
+tasks/s reached 205 ms request P95 and lost 12 connections while bounded queues
+were exercised; it is not a passing workload. The ordinary workload provides
+no reason to introduce room actors or another mutation owner. Preserve the
+bounded queues and unlocked password/media work; measure synchronous storage
+and diagnostic sinks before changing execution for a larger deployment.
+
+### Original Package Consolidation
+
 One machine, 2026-09-06: Windows 11, Node 24.15.0, Go 1.26.6. A script spawned
 each server with the same production configuration (`PORT=18787`, HTTPS public
 origin, site-access password, one STUN URL, loopback listen host), polled
diff --git a/docs/todo.md b/docs/todo.md
index 5637ee027..9fe87f199 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -15,10 +15,6 @@ Git/PRs own completed history.
   coherent candidate and stop before publication. Preserve the existing product
   model; evaluate held features against measurable benefit and total complexity
   before accepting a changed contract.
-- [ ] **Signaling execution and fairness.** Measure signaling-lock contention,
-  synchronous persistence, presence fan-out, diagnostic I/O and cross-room
-  password work before changing the lock or execution model. Start from the
-  existing bounded owners; do not introduce per-room actors without evidence.
 - [ ] **Lifecycle ownership review.** Trace reachable per-share Host/Viewer,
   source replacement, signaling recovery and media retirement paths under
   [engineering review](./standards/engineering.md#ablation-and-review).
@@ -29,6 +25,12 @@ Git/PRs own completed history.
 - [ ] **Documentation consistency.** Check the remaining guides, research and
   owner links against current behavior; remove obsolete service/API descriptions
   while retaining the scope and date of historical measurements.
+- [ ] **Windows 11 capture border remains visible.** Reopened by a new report
+  on 2026-10-07. Recheck App/Browser capture ownership, border permission/API
+  results, live setting changes and concurrent captures before attributing this
+  to Windows. Obtain the affected version/path/build when available; the report
+  does not yet identify them. [Capture evidence](./research/native-client-lifecycle.md#windows-capture-borders)
+  owns the prior graceful-retirement and concurrent-capture checks.
 - [ ] **Native capture cadence acceptance.** The local Native SFU throughput
   rerun is limited by [low WGC arrival cadence](./research/native-client-media.md#virtual-display-acceptance-limit)
   reproduced on unchanged main and a separate Windows-API-only capture probe.
@@ -146,10 +148,6 @@ of a reporter's cause; research owns the completed experiments and their limits.
   Separately retest the v1.5.0 App public-link report where one Viewer drops
   immediately after connection details appear while others work. Distinguish
   first-frame admission, signaling grace and current-edge recovery.
-- [ ] **Windows 11 capture border remains visible.** Identify the App/Browser
-  capture path, Windows build, permission result and other active captures.
-  [Capture evidence](./research/native-client-lifecycle.md#windows-capture-borders)
-  owns the graceful-retirement and concurrent-capture checks.
 - [ ] **App discovery and share-start failures.** Retest missing sources and
   unreachable App reports across authorization, browser permissions, control
   capacity, enumeration and startup. For the v1.6.5 Auto-to-VP8 report, obtain
diff --git a/internal/server/signal/server.go b/internal/server/signal/server.go
index 38cdaba03..51d7b766f 100644
--- a/internal/server/signal/server.go
+++ b/internal/server/signal/server.go
@@ -6,10 +6,11 @@
 //
 // Server.mu is the one lock of the effect layer: it guards every field of
 // the server and the router, the room.Store and the route controllers. Every
-// handler, timer callback and goroutine takes it; it is released only around
-// I/O (the password KDF and media transport), after which current session,
+// handler, timer callback and goroutine takes it; password KDF and media
+// transport work run unlocked, after which current session,
 // room and operation identities must be revalidated. Router methods and hooks are
-// called with mu held and never lock.
+// called with mu held and never lock. Room persistence and the optional route
+// diagnostic sink are synchronous and belong in this lock's latency budget.
 package signal
 
 import (
@@ -45,7 +46,7 @@ const (
 	defaultMaxSignalConnections          = 2_048
 	defaultMaxUnauthenticatedConnections = 256
 	// minSignalingChallengeIntervalMs is MIN_SIGNALING_CHALLENGE_INTERVAL_MS:
-	// the floor between two password challenges on one connection.
+	// the floor between two liveness challenges on one connection.
 	minSignalingChallengeIntervalMs = int64(1_000)
 	// serviceRestartCloseGrace is SERVICE_RESTART_CLOSE_GRACE_MS: how long a
 	// peer has to acknowledge close{1012} before the socket is terminated.

From 4854ffb2a55621decb58377d03d1fa0f59838ca3 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 17:04:01 +0800
Subject: [PATCH 018/262] fix(capture): retain border preference across
 permission changes

---
 docs/research/native-client-lifecycle.md | 11 +++++++++++
 native/capture/windows/capture_border.h  |  4 +++-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/docs/research/native-client-lifecycle.md b/docs/research/native-client-lifecycle.md
index 08303c358..4595b74e8 100644
--- a/docs/research/native-client-lifecycle.md
+++ b/docs/research/native-client-lifecycle.md
@@ -309,6 +309,17 @@ starts at build 20348, beyond consumer Windows 10 build 19045. The current
 capture helper therefore retains the system border there. Browser capture
 indicators remain Browser-owned.
 
+The helper submits `IsBorderRequired(false)` after the access request completes,
+including a denied result, as in the
+[Windows capture sample](https://github.com/robmikh/Win32CaptureSample/blob/master/Win32CaptureSample/App.cpp).
+Windows enforces permission and can honor the preference if consent changes
+during capture. The earlier `Allowed` guard incorrectly made the first
+permission result decide the session's lasting preference. The 2026-10-07 review
+removed that guard; native checks and local capture/stop cycles with the border
+preference off/on/off passed. A visible denied-to-allowed transition and the new
+reporter's setup remain unverified; this correction does not establish the
+reported cause or guarantee border visibility.
+
 On Windows 11 build 26200, a 2026-09-21 controlled native-window check confirmed
 borderless permission was allowed and the default capture had no border. A
 second session explicitly requiring a border made it visible; gracefully ending
diff --git a/native/capture/windows/capture_border.h b/native/capture/windows/capture_border.h
index 433b30ff5..29e79627b 100644
--- a/native/capture/windows/capture_border.h
+++ b/native/capture/windows/capture_border.h
@@ -47,7 +47,9 @@ class CaptureBorder final {
     try {
       if (access_.Status() == winrt::Windows::Foundation::AsyncStatus::Started) return;
       const auto access = access_.GetResults();
-      if (access == AccessStatus::Allowed) session.IsBorderRequired(false);
+      // Store the request even when consent is denied. Windows enforces current
+      // permission and can honor this preference if consent changes mid-share.
+      session.IsBorderRequired(false);
       std::osyncstream(std::cerr) << "capture-border-access="
           << (access == AccessStatus::Allowed ? "allowed" : "not-allowed")
           << " status=" << static_cast<int>(access) << '\n';

From 8bfffbd448b26689ca11b4207d0435155c2cb7af Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 17:10:11 +0800
Subject: [PATCH 019/262] test(route): verify bounded root convergence and
 failure ownership

---
 docs/standards/presentation-lifecycle.md      |  8 ++
 docs/todo.md                                  |  7 --
 .../server/route/root_convergence_test.go     | 81 +++++++++++++++++++
 3 files changed, 89 insertions(+), 7 deletions(-)
 create mode 100644 internal/server/route/root_convergence_test.go

diff --git a/docs/standards/presentation-lifecycle.md b/docs/standards/presentation-lifecycle.md
index 519136346..dc55a650c 100644
--- a/docs/standards/presentation-lifecycle.md
+++ b/docs/standards/presentation-lifecycle.md
@@ -241,6 +241,14 @@ use Browser reception; existing healthy peers are not torn down by this choice.
 Parent-network failure alone is not evidence that the local Native capability
 is unavailable.
 
+The Native Host's local bridge remains required by its Browser share owner:
+the stream supplies preview and Browser quality candidates and participates in
+source and quality changes. A terminal failure retires that share through the
+existing Host lifecycle; it is not merely a missing preview. An individual
+downstream network failure instead recovers that edge and does not retire the
+bridge or capture. Browser capture's optional Native fanout can fall back to
+Browser senders because the Browser still owns its source.
+
 ## Presence And Diagnostics
 
 Host and Viewer pages show the authoritative online Viewer count and roster,
diff --git a/docs/todo.md b/docs/todo.md
index 9fe87f199..52479718b 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -15,13 +15,6 @@ Git/PRs own completed history.
   coherent candidate and stop before publication. Preserve the existing product
   model; evaluate held features against measurable benefit and total complexity
   before accepting a changed contract.
-- [ ] **Lifecycle ownership review.** Trace reachable per-share Host/Viewer,
-  source replacement, signaling recovery and media retirement paths under
-  [engineering review](./standards/engineering.md#ablation-and-review).
-  Reproduce C=3 structural-intent or multi-child evidence concerns before changing
-  their ownership. Keep Native bridge failure distinct from network failure;
-  account for preview, quality candidates, SFU updates and track-ended consumers
-  before changing Host loopback retirement. Simplify only for a concrete gain.
 - [ ] **Documentation consistency.** Check the remaining guides, research and
   owner links against current behavior; remove obsolete service/API descriptions
   while retaining the scope and date of historical measurements.
diff --git a/internal/server/route/root_convergence_test.go b/internal/server/route/root_convergence_test.go
new file mode 100644
index 000000000..bcbe5d5cd
--- /dev/null
+++ b/internal/server/route/root_convergence_test.go
@@ -0,0 +1,81 @@
+package route
+
+import (
+	"fmt"
+	"testing"
+)
+
+func TestRootConvergenceRetainsCommittedRoutesUntilExactProof(t *testing.T) {
+	for _, capacity := range []int{2, 3} {
+		for childCount := 2; childCount <= capacity; childCount++ {
+			for _, outcome := range []string{"commit", "failure", "timeout", "session-replaced", "availability-preempts"} {
+				t.Run(fmt.Sprintf("capacity=%d/children=%d/%s", capacity, childCount, outcome), func(t *testing.T) {
+					routes := newController(capacity, Options{QualityConvergenceEnabled: true})
+					addViewer(routes, B, capacity, nil)
+					routes.hydrateEdge(B, peerEdge(HOST, "b_from_host"))
+					children := []string{C, D, E}[:childCount]
+					for _, child := range children {
+						addViewer(routes, child, 0, nil)
+						routes.hydrateEdge(child, peerEdge(B, child+"_from_b"))
+					}
+					addViewer(routes, A, capacity, ms(10))
+					routes.Reconcile(10)
+					commitCurrent(t, routes, 11, "a_from_host")
+					op := must(t, routes.Reconcile(13).Operation)
+					eq(t, op.Reason, DemandRootConvergence)
+					prepared := beginOperation(t, routes, BeginInput{
+						NowMs: 14, ConnectionID: "root_candidate", Reservation: direct(),
+					})
+					guard := CandidateGuard{ChildPeerID: op.ChildPeerID, ChildSessionID: op.ChildSessionID,
+						Revision: prepared.Current.Revision, ConnectionID: "root_candidate"}
+
+					// Another child's report cannot authorize the prepared child, even
+					// when it names the candidate's revision and physical connection.
+					other := children[0]
+					if other == op.ChildPeerID {
+						other = children[1]
+					}
+					eq(t, routes.ObserveSenderQualityEvidence(senderSample(A, other,
+						prepared.Current.Revision, "root_candidate", "candidate-sender",
+						SenderQualityHealthy, 15), nil).Accepted, false)
+					ready := routes.CandidateReady(guard, 16, nil, CandidateProof{})
+					eq(t, ready.Accepted, true)
+					eq(t, ready.Committed, false)
+
+					switch outcome {
+					case "commit":
+						eq(t, routes.ObserveSenderQualityEvidence(senderSample(A, op.ChildPeerID,
+							prepared.Current.Revision, "root_candidate", "candidate-sender",
+							SenderQualityHealthy, 17), nil).Committed, true)
+					case "failure":
+						eq(t, routes.CandidateFailed(guard, 17).Accepted, true)
+					case "timeout":
+						eq(t, routes.OperationExpired(op.DeadlineAtMs).Accepted, true)
+					case "session-replaced":
+						routes.UpsertParticipant(viewerInput(A, "replacement_session", capacity), ms(17))
+						eq(t, routes.CandidateReady(guard, 18, nil, CandidateProof{}).Accepted, false)
+					case "availability-preempts":
+						addViewer(routes, F, 0, ms(17))
+						next := must(t, routes.Reconcile(18).Operation)
+						eq(t, next.ChildPeerID, F)
+						eq(t, next.Reason, DemandJoin)
+						eq(t, routes.CandidateReady(guard, 19, nil, CandidateProof{}).Accepted, false)
+					}
+					for _, child := range children {
+						edge := edgeOf(t, routes, child)
+						if child == op.ChildPeerID && outcome == "commit" {
+							eq(t, edge.ParentPeerID, A)
+							eq(t, edge.ConnectionID, "root_candidate")
+						} else {
+							eq(t, edge.ParentPeerID, B)
+							eq(t, edge.ConnectionID, child+"_from_b")
+						}
+						eq(t, edge.Usable, true)
+						eq(t, edge.PhysicalActive, true)
+					}
+					routes.assertGraph()
+				})
+			}
+		}
+	}
+}

From 3204ca6f8af9072ef90f186a554c3c7a10be1f64 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 17:17:57 +0800
Subject: [PATCH 020/262] docs: align capture and deployment guidance with
 current owners

---
 cmd/piik-app/README.md          | 4 ++--
 cmd/piik-app/README.zh-CN.md    | 2 +-
 docs/standards/configuration.md | 7 +++----
 docs/status.md                  | 4 ++--
 docs/todo.md                    | 3 ---
 5 files changed, 8 insertions(+), 12 deletions(-)

diff --git a/cmd/piik-app/README.md b/cmd/piik-app/README.md
index ad5bb8ec9..8b54e39e7 100644
--- a/cmd/piik-app/README.md
+++ b/cmd/piik-app/README.md
@@ -59,8 +59,8 @@ An App-opened Site remembers native activation, so later pages there may reuse
 the running App. Browser capture remains available without the App; see the
 [entry workflow](../../docs/standards/presentation-lifecycle.md#product-surface).
 
-The Host page offers Browser capture and available native windows or screens;
-select the source explicitly. Windows native capture offers VP8/Auto/H264;
+The Host page offers Browser and Camera capture alongside available native
+windows or screens; select the source explicitly. Windows native capture offers VP8/Auto/H264;
 Auto chooses one codec for the share. macOS and Linux native capture require
 hardware H264. Source and audio support vary by platform; their setup is covered
 in the [Windows](../../native/capture/windows/README.md),
diff --git a/cmd/piik-app/README.zh-CN.md b/cmd/piik-app/README.zh-CN.md
index a10268846..707768d50 100644
--- a/cmd/piik-app/README.zh-CN.md
+++ b/cmd/piik-app/README.zh-CN.md
@@ -47,7 +47,7 @@ App 会在启动时再次检查所选地址；它只影响本地邀请链接，
 通过 App 打开的站点会记住原生功能的启用选择，之后打开该站点的页面可继续使用正在运行的 App。
 没有 App 时仍可使用浏览器采集，详见[进入流程](../../docs/standards/presentation-lifecycle.md#product-surface)。
 
-房主页面提供浏览器采集及可用的原生窗口或屏幕，请明确选择来源。
+房主页面提供浏览器、摄像头采集，以及可用的原生窗口或屏幕，请明确选择来源。
 Windows 原生采集提供 VP8/Auto/H264，Auto 会为本次分享选定一种编码。
 macOS 和 Linux 原生采集需要硬件 H264。可选来源与音频支持取决于平台，设置要求见
 [Windows](../../native/capture/windows/README.md)、[macOS](../../native/capture/darwin/README.md)
diff --git a/docs/standards/configuration.md b/docs/standards/configuration.md
index d9b9c32e6..e121012e0 100644
--- a/docs/standards/configuration.md
+++ b/docs/standards/configuration.md
@@ -275,12 +275,11 @@ When `NAT_PREDICTION_ENABLED=true`, the server derives
 `stun:<same-hostname>:3479` and `:3480` from the first ordinary STUN authority
 on UDP 3478. The Host sees a pre-share switch that defaults on and may disable
 it. The capability adds no media route or third-party service. It needs both
-cloud security-group rules and the host's `/etc/nftables.conf` rule. Piik
+cloud security-group rules and the host firewall. Piik
 binds every required UDP listener before opening room persistence or accepting
 signaling; a bind failure rolls back all newly owned sockets. Close and End
-retire these listeners with the application. Existing coturn listeners must
-be retired in the coordinated deployment because two processes cannot own the
-same ports. Opening a cloud port without a listener has no effect, and local
+retire these listeners with the application. No other service may own the same
+listening ports. Opening a cloud port without a listener has no effect, and local
 binding alone does not prove external reachability. Disable the capability
 before removing firewall rules. Same-IP ports
 expose destination-port allocation behavior; a full RFC 5780 alternate-address
diff --git a/docs/status.md b/docs/status.md
index a2dab31e6..60690fee5 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -75,8 +75,8 @@ record own exact identity and postflight results.
 
 The existing deployment uses one Go process for Web, room authority/signaling,
 Binding-only STUN on UDP 3478/3479/3480 and optional SFU on UDP 7882. nginx owns
-HTTPS; external LiveKit/coturn services remain disabled. Participants, routes and
-media remain process-only. This private service is not a public demonstration.
+HTTPS. Participants, routes and media remain process-only. This private service
+is not a public demonstration.
 
 The separate US [public demo](https://demo.piik.tv) is deployed with open site
 entry, persistent room authority and P2P-only media. Cloudflare fronts HTTP/WSS
diff --git a/docs/todo.md b/docs/todo.md
index 52479718b..61915449d 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -15,9 +15,6 @@ Git/PRs own completed history.
   coherent candidate and stop before publication. Preserve the existing product
   model; evaluate held features against measurable benefit and total complexity
   before accepting a changed contract.
-- [ ] **Documentation consistency.** Check the remaining guides, research and
-  owner links against current behavior; remove obsolete service/API descriptions
-  while retaining the scope and date of historical measurements.
 - [ ] **Windows 11 capture border remains visible.** Reopened by a new report
   on 2026-10-07. Recheck App/Browser capture ownership, border permission/API
   results, live setting changes and concurrent captures before attributing this

From 8292f72a20cbeb6ecb6d07289d7112b823d02bde Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 17:40:00 +0800
Subject: [PATCH 021/262] docs(audio): assess phone microphone integration
 boundaries

---
 docs/research/camera-and-microphone.md | 22 ++++++++++++++++++++++
 docs/todo.md                           | 10 +++++-----
 2 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/docs/research/camera-and-microphone.md b/docs/research/camera-and-microphone.md
index 9d5ea5225..b6d6eca69 100644
--- a/docs/research/camera-and-microphone.md
+++ b/docs/research/camera-and-microphone.md
@@ -124,6 +124,28 @@ ordinary invitation in another browser tab. Use headphones for same-device
 microphone tests. Browser-emulated mobile layout and synthetic devices do not
 establish actual iOS/Android permission, orientation, background or audio behavior.
 
+## Phone Microphone Assessment
+
+The proposed phone link would supply one Host audio input, not give Viewers a
+room-voice permission. Web Audio can mix a received `MediaStream` into the
+Browser Host's existing output. The native mixer instead consumes fixed PCM
+from local capture processes; it has no authenticated remote-input boundary.
+Room signaling authorizes assigned parent/child connections, so an ordinary
+Viewer invitation must not become permission to publish audio into the Host.
+
+A coherent implementation therefore needs a Host-scoped, revocable pairing
+grant, one incoming audio connection and a decoded/resampled input for native
+mixing. The existing Host share must own that input's mute, replacement and
+retirement; input loss must leave healthy picture/source audio running. Phone
+capture still requires a secure origin and explicit microphone permission.
+The transport adds latency, and physical phone echo/background/lock behavior
+is not established by Browser emulation or a loopback audio test.
+
+This is a source/API assessment, not an implemented or device-verified feature.
+Keep it outside the current candidate until a concrete use case justifies that
+pairing and input ownership. An audio device already exposed by the operating
+system can use Piik's existing microphone selector without this extension.
+
 ## Primary Technical References
 
 - [Google Meet audio controls](https://support.google.com/meet/answer/10409699?hl=en)
diff --git a/docs/todo.md b/docs/todo.md
index 61915449d..b1927466e 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -69,11 +69,11 @@ Implementation needs a concrete useful result within the product model.
 - [ ] **Managed Demo hosting.** The [provider assessment](./operations/website.md#managed-hosting-assessment)
   identifies UDP/storage requirements but establishes no cost saving. Keep the
   existing P2P-only Demo until a provider and operating boundary are accepted.
-- [ ] **Phone as a Host microphone.** Assess an opt-in link that pairs a phone's
-  microphone with the Host's existing audio mixer. Evaluate pairing/revocation,
-  latency/echo, browser background limits
-  and Browser/native input ownership before accepting an implementation. This
-  proposal does not reopen room voice; establish feasibility before accepting it.
+- [ ] **Phone as a Host microphone.** The [input assessment](./research/camera-and-microphone.md#phone-microphone-assessment)
+  identifies pairing/revocation and native decoded-input ownership beyond the
+  existing device selector. Keep it outside this candidate until a concrete
+  use case justifies that boundary and physical latency/echo/background checks.
+  This proposal does not reopen room voice.
 - [ ] **Passive App attachment: design hold.** Site mode authorizes one selected
   origin and supplies native media without starting a local room server. A
   passive replacement needs an accepted site-consent/discovery flow; it must not

From e7cced717ab3574852d06ab8e14d5cc12e3a9979 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 17:49:01 +0800
Subject: [PATCH 022/262] docs(media): close physical-display throughput
 acceptance

---
 docs/research/native-client-media.md | 13 +++++++++++--
 docs/todo.md                         |  5 -----
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 274c441dd..003f617ad 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -379,8 +379,17 @@ Default, 4 ms and 1 ms capture intervals returned the same rate, including with
 the source kept topmost; property readback confirmed each requested interval.
 This localizes the limit to platform capture delivery in this environment but
 does not establish the virtual driver's cause or diagnose a field report.
-Retain the gate's threshold and compare a physical display before changing capture scheduling,
-encoder policy or route behavior.
+No capture scheduling, encoder policy or gate threshold was changed.
+
+Later on the same day, Windows reported an active physical AOC display. The
+unchanged Windows-API-only probe delivered about 32 fps, matching its GDI source,
+at the default, 4 ms and 1 ms intervals. The candidate's Native H.264 two-room
+SFU gate then passed the original 300-frame/30-second requirement, live profile
+change, decoded audio, subscription recovery and retirement. Stopping the first
+room preserved another 30 decoded frames and continuing audio in the second;
+all owned processes, profiles and ports were released. This closes that local
+throughput acceptance gap. It does not isolate the virtual driver's cause or
+establish physical HDR, game-load or other-device performance.
 
 ## Native H.264 Motion Quality
 
diff --git a/docs/todo.md b/docs/todo.md
index b1927466e..adc4292d5 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -21,11 +21,6 @@ Git/PRs own completed history.
   to Windows. Obtain the affected version/path/build when available; the report
   does not yet identify them. [Capture evidence](./research/native-client-lifecycle.md#windows-capture-borders)
   owns the prior graceful-retirement and concurrent-capture checks.
-- [ ] **Native capture cadence acceptance.** The local Native SFU throughput
-  rerun is limited by [low WGC arrival cadence](./research/native-client-media.md#virtual-display-acceptance-limit)
-  reproduced on unchanged main and a separate Windows-API-only capture probe.
-  Compare on a physical display before claiming current Native throughput
-  acceptance; do not lower the unchanged 300-frame/30-second requirement.
 - [ ] **Independent Gitee mirror recovery.** Implementation and local acceptance
   are complete. Integrate through the next owner-approved publishing merge and
   verify the separate workflow with its original CI artifacts. Mirror failure

From cea9eb21f0dcb9f2059fa37dc52344059584cc10 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 18:11:55 +0800
Subject: [PATCH 023/262] docs(server): describe current ownership and
 lifecycle invariants

---
 internal/server/room/database.go      |   8 +-
 internal/server/room/password.go      |  35 ++++-----
 internal/server/room/store.go         | 109 ++++++++++++--------------
 internal/server/route/api.go          |  66 +++++++---------
 internal/server/route/candidates.go   |   7 +-
 internal/server/route/controller.go   |  81 ++++++++-----------
 internal/server/route/graph.go        |   7 +-
 internal/server/route/operation.go    |   8 +-
 internal/server/route/quality.go      |   4 +-
 internal/server/route/timing.go       |   7 +-
 internal/server/signal/presence.go    |   9 +--
 internal/server/signal/router.go      |  60 ++++++--------
 internal/server/signal/router_pump.go |   7 +-
 internal/server/signal/server.go      | 108 +++++++++----------------
 internal/server/signal/session.go     |  27 +++----
 15 files changed, 228 insertions(+), 315 deletions(-)

diff --git a/internal/server/room/database.go b/internal/server/room/database.go
index 199203f64..e57c04c15 100644
--- a/internal/server/room/database.go
+++ b/internal/server/room/database.go
@@ -170,7 +170,7 @@ func (d *Database) recover() ([]StoredRoomAuthority, error) {
 	return d.readStoredRooms()
 }
 
-// InsertRoom is insertRoom.
+// InsertRoom persists one validated authority record atomically.
 func (d *Database) InsertRoom(room StoredRoomAuthority) error {
 	if err := assertStoredRoom(room); err != nil {
 		return err
@@ -190,7 +190,7 @@ func (d *Database) InsertRoom(room StoredRoomAuthority) error {
 	})
 }
 
-// SetViewerPassword is setViewerPassword; nil material clears the password.
+// SetViewerPassword updates the exact Host's room; nil material clears the password.
 func (d *Database) SetViewerPassword(
 	roomID string, hostTokenDigest, viewerPasswordMaterial []byte,
 ) error {
@@ -213,7 +213,7 @@ func (d *Database) SetViewerPassword(
 	})
 }
 
-// SetCodeEntryPolicy is setCodeEntryPolicy.
+// SetCodeEntryPolicy persists code admission for the exact Host's room.
 func (d *Database) SetCodeEntryPolicy(
 	roomID string, hostTokenDigest []byte, codeEntryPolicy protocol.CodeEntryPolicy,
 ) error {
@@ -236,7 +236,7 @@ func (d *Database) SetCodeEntryPolicy(
 	})
 }
 
-// SetViewerGrant is setViewerGrant.
+// SetViewerGrant atomically replaces the grant digest and authorization generation.
 func (d *Database) SetViewerGrant(
 	roomID string, hostTokenDigest, viewerGrantDigest []byte,
 	viewerAuthorizationGeneration string,
diff --git a/internal/server/room/password.go b/internal/server/room/password.go
index 17841d264..5776a8d95 100644
--- a/internal/server/room/password.go
+++ b/internal/server/room/password.go
@@ -26,25 +26,21 @@ const (
 	gatePendingLimit = 16
 )
 
-// errDerivationCancelled is the AsyncGate "cancelled" outcome. Callers never
-// inspect it: they hand it to the commit method, which maps it the way the
-// TypeScript call site did.
+// errDerivationCancelled means the queued caller lost authority before its
+// derivation started. The caller maps it to the operation's error.
 var errDerivationCancelled = errors.New("password derivation was cancelled")
 
-// isGateOutcome reports whether err is one of the two AsyncGate outcomes rather
-// than a thrown error. The TypeScript returned busy and cancelled as values,
-// which its post-await checks inspected after re-reading the room; everything
-// else threw out of the await.
+// isGateOutcome identifies admission results that the commit boundary resolves
+// after rechecking room authority. Other derivation errors return immediately.
 func isGateOutcome(err error) bool {
 	return errors.Is(err, errDerivationCancelled) || hasCode(err, CodeRoomBusy)
 }
 
-// DeriveViewerPasswordMaterial is createViewerPasswordMaterial: it validates the
-// password, draws a fresh salt and returns salt||verifier. Call it WITHOUT the
-// caller's lock held and hand both results to CreateRoom, ReplaceRoom or
-// SetViewerPassword unchanged; those reproduce the TypeScript order in which a
-// busy or cancelled outcome is turned into an error. mayStart may be nil, which
-// is the TypeScript default of `() => true`.
+// DeriveViewerPasswordMaterial validates the password, draws a fresh salt and
+// returns salt||verifier. Call it without the caller's lock held and pass both
+// results to CreateRoom, ReplaceRoom or SetViewerPassword unchanged so those
+// commits can recheck authority before reporting busy/cancelled admission.
+// A nil mayStart permits derivation once the gate admits it.
 func (s *Store) DeriveViewerPasswordMaterial(
 	password string, mayStart func() bool,
 ) ([]byte, error) {
@@ -62,10 +58,9 @@ func (s *Store) DeriveViewerPasswordMaterial(
 	return slices.Concat(salt, verifier), nil
 }
 
-// DeriveViewerPassword is the unlocked middle of connectViewerWithPassword: it
-// derives the verifier for the salt ViewerPasswordChallenge returned. Unlike
-// DeriveViewerPasswordMaterial it maps both gate outcomes itself, because the
-// TypeScript threw them immediately after the await, before re-reading the room.
+// DeriveViewerPassword is the unlocked password-admission step: it derives the
+// verifier for the salt ViewerPasswordChallenge returned. Gate failures return
+// before the room commit; cancelled admission is reported as an invalid token.
 func (s *Store) DeriveViewerPassword(
 	password string, salt []byte, mayConnect func() bool,
 ) ([]byte, error) {
@@ -89,7 +84,7 @@ func (s *Store) deriveViewerPassword(
 	})
 }
 
-// gate is AsyncGate: at most limit derivations run at once and at most
+// gate admits at most limit concurrent derivations and at most
 // pendingLimit wait, first in first out. A saturated gate answers ROOM_BUSY.
 type gate struct {
 	mu           sync.Mutex
@@ -128,8 +123,8 @@ func (g *gate) acquire() bool {
 	return true
 }
 
-// release hands the slot to the first waiter instead of decrementing, which is
-// what `const next = this.waiters.shift(); if (next) { next(); return; }` did.
+// release transfers the active slot to the first waiter, keeping new callers
+// behind already queued derivations.
 func (g *gate) release() {
 	g.mu.Lock()
 	if len(g.waiters) > 0 {
diff --git a/internal/server/room/store.go b/internal/server/room/store.go
index 34f79a73c..6c4dd5f30 100644
--- a/internal/server/room/store.go
+++ b/internal/server/room/store.go
@@ -18,15 +18,15 @@ import (
 	"github.com/TNTcraftHIM/Piik/internal/server/protocol"
 )
 
-// Capacity is ROOM_CAPACITY: every four-digit room code.
+// Capacity is the number of four-digit room codes without a leading zero.
 const Capacity = 9_000
 
 const roomCodeFirst = 1_000
 
-// ErrorCode is RoomStoreErrorCode.
+// ErrorCode identifies a room authority or admission failure.
 type ErrorCode string
 
-// The RoomStoreErrorCode set.
+// Room authority and admission errors.
 const (
 	CodeInvalidToken         ErrorCode = "INVALID_TOKEN"
 	CodeRoomAccessDenied     ErrorCode = "ROOM_ACCESS_DENIED"
@@ -37,12 +37,12 @@ const (
 	CodeRoomLimit            ErrorCode = "ROOM_LIMIT"
 )
 
-// Error is RoomStoreError. Its message is the code, as `super(code)` made it.
+// Error carries a room authority or admission error code.
 type Error struct {
 	Code ErrorCode
 }
 
-// Error returns the code, which is the message `super(code)` produced.
+// Error returns the code.
 func (e *Error) Error() string { return string(e.Code) }
 
 func codeError(code ErrorCode) error { return &Error{Code: code} }
@@ -61,15 +61,14 @@ const (
 type participant struct {
 	clientID string
 	peerID   string
-	// sessionID is "" where the TypeScript left sessionId undefined. Session
-	// IDs are opaque IDs of at least 8 characters, so "" cannot collide.
+	// An empty sessionID means offline; validated wire IDs are never empty.
 	sessionID  string
 	admittedBy string
 }
 
 // Room is one room's authority plus its participants. It has no exported
 // members: callers hold the pointer only to compare identity across the
-// unlocked password derivation, as the TypeScript compared room objects.
+// unlocked password derivation.
 type Room struct {
 	roomID                        string
 	hostTokenDigest               []byte
@@ -81,12 +80,12 @@ type Room struct {
 	// Process-local: restored rooms receive a fresh reconnect window. Only the
 	// last authenticated departure updates this; failed admission cannot renew it.
 	emptySinceMs int64
-	// ordering: JS Map insertion order decides viewer presence order, the
+	// Insertion order decides viewer presence order, the
 	// closed-session list and the router's participant order.
 	viewers ordered.Map[string, *participant]
 }
 
-// CreatedRoom is CreatedRoom. ViewerGrant is "" where the TypeScript had null.
+// CreatedRoom carries newly issued Host authority and an optional Viewer grant.
 type CreatedRoom struct {
 	RoomID          string
 	HostToken       string
@@ -94,8 +93,8 @@ type CreatedRoom struct {
 	ViewerGrant     string
 }
 
-// ConnectParticipantInput is ConnectParticipantInput; Token is read for a host
-// and ViewerGrant for a viewer, "" meaning the key was absent.
+// ConnectParticipantInput uses Token for a Host and ViewerGrant for a Viewer.
+// Empty credentials are absent.
 type ConnectParticipantInput struct {
 	RoomID      string
 	Role        protocol.Role
@@ -105,7 +104,7 @@ type ConnectParticipantInput struct {
 	SessionID   string
 }
 
-// ConnectViewerWithPasswordInput is ConnectViewerWithPasswordInput. Password is
+// ConnectViewerWithPasswordInput supplies Viewer password admission. Password is
 // consumed by the caller's DeriveViewerPassword call, not by the commit.
 type ConnectViewerWithPasswordInput struct {
 	RoomID    string
@@ -114,8 +113,8 @@ type ConnectViewerWithPasswordInput struct {
 	SessionID string
 }
 
-// ConnectedParticipant is ConnectedParticipant. ReplacedSessionID is "" where
-// the TypeScript omitted replacedSessionId.
+// ConnectedParticipant records admission and any session it superseded.
+// ReplacedSessionID is empty when no connected session was replaced.
 type ConnectedParticipant struct {
 	RoomID                        string
 	Role                          protocol.Role
@@ -127,39 +126,35 @@ type ConnectedParticipant struct {
 	ViewerAuthorizationGeneration string
 }
 
-// DisconnectedParticipant is DisconnectedParticipant.
 type DisconnectedParticipant struct {
 	RoomID string
 	Role   protocol.Role
 	PeerID string
 }
 
-// ConnectedPeer is ConnectedPeer.
 type ConnectedPeer struct {
 	PeerID    string
 	SessionID string
 }
 
-// ClosedRoom is ClosedRoom.
 type ClosedRoom struct {
 	RoomID     string
 	SessionIDs []string
 }
 
-// ReplacedRoom is ReplacedRoom.
 type ReplacedRoom struct {
 	Created CreatedRoom
 	Closed  ClosedRoom
 }
 
-// RevokedViewer is RevokedViewer; SessionID is "" where the TypeScript omitted
-// sessionId.
+// RevokedViewer identifies revoked admission. SessionID is empty for an offline Viewer.
 type RevokedViewer struct {
 	PeerID    string
 	SessionID string
 }
 
-// ViewerGrantUpdate is ViewerGrantUpdate. ViewerGrant is "" for a revoke.
+// ViewerGrantUpdate carries a grant change and affected Viewers; ViewerGrant is
+// empty when the invitation was revoked.
 type ViewerGrantUpdate struct {
 	ViewerGrant                           string
 	ViewerAuthorizationGeneration         string
@@ -167,13 +162,12 @@ type ViewerGrantUpdate struct {
 	RevokedViewers                        []RevokedViewer
 }
 
-// CodeEntryUpdate is CodeEntryUpdate.
 type CodeEntryUpdate struct {
 	CodeEntryPolicy       protocol.CodeEntryPolicy
 	ViewerPasswordEnabled bool
 }
 
-// Options is RoomStoreOptions.
+// Options configures capacity, optional persistence and injectable entropy/time.
 type Options struct {
 	MaxRooms          int
 	MaxViewersPerRoom int
@@ -182,9 +176,9 @@ type Options struct {
 	Now               func() int64
 }
 
-// Store is RoomStore. See the package comment for the locking contract.
+// Store owns room authority. See the package comment for the locking contract.
 type Store struct {
-	// ordering: JS Map insertion order decides AbandonAllRooms.
+	// Insertion order determines the order returned by AbandonAllRooms.
 	rooms             ordered.Map[string, *Room]
 	freeRoomCodes     []string
 	random            func(size int) []byte
@@ -193,13 +187,11 @@ type Store struct {
 	initialized       bool
 	maxRooms          int
 	maxViewersPerRoom int
-	// gate is per store; the TypeScript module-level gate was shared by every
-	// RoomStore in a process, of which there was one.
+	// The derivation gate bounds work across every room in this store.
 	gate gate
 }
 
-// New is the RoomStore constructor; the TypeScript threw where this returns an
-// error.
+// New validates limits and prepares a Store; Initialize loads persisted authority.
 func New(options Options) (*Store, error) {
 	if options.MaxRooms <= 0 || options.MaxRooms > Capacity {
 		return nil, fmt.Errorf("Room limit must be an integer between 1 and %d", Capacity)
@@ -318,7 +310,7 @@ func (s *Store) BeginCreateRoom() error {
 	return nil
 }
 
-// CreateRoom is the commit half of createRoom. material and derived are the
+// CreateRoom commits room creation. material and derived are the
 // results of DeriveViewerPasswordMaterial (both zero when no password was
 // given).
 func (s *Store) CreateRoom(
@@ -327,7 +319,7 @@ func (s *Store) CreateRoom(
 	derived error,
 	preferredRoomID string,
 ) (CreatedRoom, error) {
-	// createViewerPasswordMaterial threw before any of the checks below.
+	// Derivation failures precede admission checks; gate outcomes are resolved below.
 	if derived != nil && !isGateOutcome(derived) {
 		return CreatedRoom{}, derived
 	}
@@ -359,8 +351,8 @@ func (s *Store) CreateRoom(
 	return created, nil
 }
 
-// HostManagedRoom is getHostManagedRoom: the room the exact Host token owns.
-// It is the pre-KDF half of replaceRoom and setViewerPassword.
+// HostManagedRoom returns the room owned by the exact Host token. The caller
+// retains its identity while deriving password material outside the lock.
 func (s *Store) HostManagedRoom(roomID, hostToken string) (*Room, error) {
 	if err := s.ensureInitialized(); err != nil {
 		return nil, err
@@ -368,7 +360,7 @@ func (s *Store) HostManagedRoom(roomID, hostToken string) (*Room, error) {
 	return s.getHostManagedRoom(roomID, hostToken)
 }
 
-// HostStillOwnsRoom is the mayStart closure replaceRoom and setViewerPassword
+// HostStillOwnsRoom is the mayStart closure ReplaceRoom and SetViewerPassword
 // hand to the KDF gate: the room must still be the same object and the token
 // must still own it. Call it with the lock held.
 func (s *Store) HostStillOwnsRoom(roomID, hostToken string, current *Room) bool {
@@ -376,7 +368,7 @@ func (s *Store) HostStillOwnsRoom(roomID, hostToken string, current *Room) bool
 	return ok && room == current && verifyDigest(hostToken, room.hostTokenDigest)
 }
 
-// ReplaceRoom is the commit half of replaceRoom. current is the room
+// ReplaceRoom commits a replacement. current is the room
 // HostManagedRoom returned before the derivation.
 func (s *Store) ReplaceRoom(
 	roomID, hostToken string,
@@ -385,7 +377,7 @@ func (s *Store) ReplaceRoom(
 	derived error,
 	current *Room,
 ) (ReplacedRoom, error) {
-	// createViewerPasswordMaterial threw before the second getHostManagedRoom.
+	// Derivation failures return before rechecking authority; gate outcomes do not.
 	if derived != nil && !isGateOutcome(derived) {
 		return ReplacedRoom{}, derived
 	}
@@ -438,7 +430,7 @@ func (s *Store) replaceRoom(
 	return ReplacedRoom{Created: created, Closed: closed}, nil
 }
 
-// SetViewerPassword is the commit half of setViewerPassword; it reports whether
+// SetViewerPassword commits a password change; it reports whether
 // a password is now set. current is the room HostManagedRoom returned before
 // the derivation.
 func (s *Store) SetViewerPassword(
@@ -447,7 +439,7 @@ func (s *Store) SetViewerPassword(
 	derived error,
 	current *Room,
 ) (bool, error) {
-	// createViewerPasswordMaterial threw before the second getHostManagedRoom.
+	// Derivation failures return before rechecking authority; gate outcomes do not.
 	if derived != nil && !isGateOutcome(derived) {
 		return false, derived
 	}
@@ -474,7 +466,7 @@ func (s *Store) SetViewerPassword(
 	return material != nil, nil
 }
 
-// SetCodeEntryPolicy is setCodeEntryPolicy.
+// SetCodeEntryPolicy updates code admission under exact Host authority.
 func (s *Store) SetCodeEntryPolicy(
 	roomID string,
 	policy protocol.CodeEntryPolicy,
@@ -500,7 +492,7 @@ func (s *Store) SetCodeEntryPolicy(
 	}, nil
 }
 
-// SetViewerGrant is setViewerGrant; action is "rotate" or "revoke".
+// SetViewerGrant rotates or revokes invitations and removes grant-admitted Viewers.
 func (s *Store) SetViewerGrant(
 	roomID, action, hostToken string,
 ) (ViewerGrantUpdate, error) {
@@ -550,7 +542,7 @@ func (s *Store) SetViewerGrant(
 	room.viewerGrantDigest = viewerGrantDigest
 	room.viewerAuthorizationGeneration = generation
 	wasOccupied := roomOccupied(room)
-	// ordering: delete during iteration, which a JS Map allows.
+	// ordered.Map.All permits removal without skipping surviving entries.
 	for clientID, viewer := range room.viewers.All() {
 		if viewer.admittedBy == admittedByGrant {
 			room.viewers.Delete(clientID)
@@ -567,7 +559,7 @@ func (s *Store) SetViewerGrant(
 	}, nil
 }
 
-// ConnectParticipant is connectParticipant.
+// ConnectParticipant authenticates a Host token, Viewer grant or open code entry.
 func (s *Store) ConnectParticipant(input ConnectParticipantInput) (ConnectedParticipant, error) {
 	if err := s.ensureInitialized(); err != nil {
 		return ConnectedParticipant{}, err
@@ -599,7 +591,7 @@ func (s *Store) ConnectParticipant(input ConnectParticipantInput) (ConnectedPart
 	return s.connectViewer(room, input.ClientID, input.SessionID, admittedByCode)
 }
 
-// ViewerGrantMayEnter is viewerGrantMayEnter.
+// ViewerGrantMayEnter validates an invitation without admitting a participant.
 func (s *Store) ViewerGrantMayEnter(roomID, grant string) (bool, error) {
 	if err := s.ensureInitialized(); err != nil {
 		return false, err
@@ -615,12 +607,12 @@ func (s *Store) ViewerGrantMayEnter(roomID, grant string) (bool, error) {
 	return viewerGrantIsValid(room, grant), nil
 }
 
-// ViewerPasswordChallenge is the locked first half of connectViewerWithPassword:
+// ViewerPasswordChallenge is the locked first half of password admission:
 // it returns the salt to derive against, a copy of the material to compare with
 // and the room reference to re-check afterwards. A missing room and a room
 // without a private password both answer with the same 48 zero
-// bytes so the derivation cost does not reveal which. The only error is the
-// `ensureInitialized()` the TypeScript ran before the password check.
+// bytes so the derivation cost does not reveal which. An uninitialized store
+// fails before this check.
 func (s *Store) ViewerPasswordChallenge(
 	roomID string,
 ) (salt, expectedMaterial []byte, room *Room, err error) {
@@ -639,7 +631,7 @@ func (s *Store) ViewerPasswordChallenge(
 	return expectedMaterial[:viewerPasswordSaltBytes], expectedMaterial, found, nil
 }
 
-// ConnectViewerWithPassword is the commit half of connectViewerWithPassword.
+// ConnectViewerWithPassword commits password admission after derivation.
 // derived is the DeriveViewerPassword result; expectedMaterial and room come
 // from ViewerPasswordChallenge; mayConnect is evaluated with the lock held.
 func (s *Store) ConnectViewerWithPassword(
@@ -678,8 +670,8 @@ func (s *Store) ConnectViewerWithPassword(
 	return connected, err
 }
 
-// DisconnectParticipant is disconnectParticipant; it returns nil where the
-// TypeScript returned undefined.
+// DisconnectParticipant clears only the matching session and returns nil when
+// the room, peer or current session no longer matches.
 func (s *Store) DisconnectParticipant(
 	roomID, peerID, sessionID string,
 ) (*DisconnectedParticipant, error) {
@@ -715,7 +707,7 @@ func (s *Store) DisconnectParticipant(
 		RoomID: roomID, Role: protocol.RoleViewer, PeerID: peerID}, nil
 }
 
-// RemoveDisconnectedViewer is removeDisconnectedViewer.
+// RemoveDisconnectedViewer removes a Viewer only if it has no current session.
 func (s *Store) RemoveDisconnectedViewer(roomID, peerID string) bool {
 	room, ok := s.rooms.Get(roomID)
 	if !ok {
@@ -728,7 +720,7 @@ func (s *Store) RemoveDisconnectedViewer(roomID, peerID string) bool {
 	return room.viewers.Delete(viewer.clientID)
 }
 
-// GetConnectedHost is getConnectedHost.
+// GetConnectedHost returns only a Host with a current session.
 func (s *Store) GetConnectedHost(roomID string) (ConnectedPeer, bool) {
 	room, ok := s.rooms.Get(roomID)
 	if !ok || room.host == nil || room.host.sessionID == "" {
@@ -737,7 +729,7 @@ func (s *Store) GetConnectedHost(roomID string) (ConnectedPeer, bool) {
 	return ConnectedPeer{PeerID: room.host.peerID, SessionID: room.host.sessionID}, true
 }
 
-// GetConnectedViewer is getConnectedViewer.
+// GetConnectedViewer returns only a Viewer with a current session.
 func (s *Store) GetConnectedViewer(roomID, peerID string) (ConnectedPeer, bool) {
 	room, ok := s.rooms.Get(roomID)
 	if !ok {
@@ -779,8 +771,7 @@ func (s *Store) GetConnectedViewers(roomID string) []ConnectedPeer {
 	return connected
 }
 
-// AbandonRoom is abandonRoom; it returns nil where the TypeScript returned
-// undefined.
+// AbandonRoom retires room authority, returning nil if the room is already absent.
 func (s *Store) AbandonRoom(roomID string) (*ClosedRoom, error) {
 	closed, err := s.abandonRooms([]string{roomID})
 	if err != nil || len(closed) == 0 {
@@ -940,9 +931,8 @@ func (s *Store) takeRoomCode(preferredRoomID string) (string, error) {
 }
 
 // uniformIndex draws a uniform index below count from 8 random bytes, rejecting
-// the values above the largest multiple of count. The TypeScript computed the
-// limit in BigInt as 2^64 - 2^64 % count; (MaxUint64 % count + 1) % count is
-// the same remainder without the uint64 wrap at a power-of-two count.
+// the incomplete final bucket of the 2^64 possible values.
+// (MaxUint64 % count + 1) % count computes 2^64 % count without overflowing.
 func uniformIndex(count int, random func(size int) []byte) (int, error) {
 	span := uint64(count)
 	remainder := (math.MaxUint64%span + 1) % span
@@ -1063,8 +1053,7 @@ func (s *Store) ensureInitialized() error {
 	return nil
 }
 
-// writeDatabase runs a stable-authority write when a database is configured,
-// which is the TypeScript `this.options.database?.write(...)`.
+// writeDatabase runs a stable-authority write when a database is configured.
 func (s *Store) writeDatabase(write func() error) error {
 	if s.database == nil {
 		return nil
diff --git a/internal/server/route/api.go b/internal/server/route/api.go
index 9c41d2de6..1311e950d 100644
--- a/internal/server/route/api.go
+++ b/internal/server/route/api.go
@@ -6,9 +6,8 @@ import (
 )
 
 // Resource is the caller-owned SFU/overlap allocation the controller stores,
-// moves between collections and compares by pointer identity (TS: the bare
-// Resource type parameter, always used through JS Set semantics). The
-// controller never reads its fields; they exist for the router and tests.
+// moves between collections and compares by pointer identity. The controller
+// never reads its fields; the router owns their meaning and release.
 type Resource struct {
 	Kind ResourceKind
 	// EndpointPeerID is set for ResourceOverlap.
@@ -25,7 +24,7 @@ type Resource struct {
 	Released bool
 }
 
-// ResourceKind is the RouteResource discriminator of hybrid-media-router.ts.
+// ResourceKind identifies the allocation owned by the router.
 type ResourceKind string
 
 // Resource kinds.
@@ -36,7 +35,7 @@ const (
 )
 
 // UpstreamKind discriminates CandidateTuple, CommittedEdge, committedEdgeSeed
-// and QualityUpstream (TS kind: "peer" | "sfu").
+// and QualityUpstream.
 type UpstreamKind string
 
 // Upstream kinds.
@@ -45,7 +44,7 @@ const (
 	UpstreamSfu  UpstreamKind = "sfu"
 )
 
-// Transport is the edge transport (TS transport: "direct" | "sfu").
+// Transport is the edge transport.
 type Transport string
 
 // Transports.
@@ -54,7 +53,7 @@ const (
 	TransportSfu    Transport = "sfu"
 )
 
-// PublicationPlan is the SFU tuple action (TS publication: "reuse" | "create" | "replace").
+// PublicationPlan is the SFU tuple action.
 type PublicationPlan string
 
 // Publication plans.
@@ -93,8 +92,7 @@ const (
 	TransitionBoundedGap TransitionKind = "bounded-gap"
 )
 
-// SenderQualityState is the sender-side health sample state
-// (TS "unknown" | "healthy" | "degraded").
+// SenderQualityState is the sender-side health sample state.
 type SenderQualityState string
 
 // Sender quality states.
@@ -158,7 +156,7 @@ const (
 // CandidateTuple is one route candidate: a direct edge from ParentPeerID
 // (Kind UpstreamPeer, Transport always TransportDirect, Regenerate = rebuild
 // the same edge with a fresh connection) or an SFU edge (Kind UpstreamSfu,
-// Publication set). TS: CandidateTuple.
+// Publication set).
 type CandidateTuple struct {
 	Kind         UpstreamKind
 	ParentPeerID string
@@ -171,7 +169,7 @@ type CandidateTuple struct {
 // BeginCurrentCandidate. Edge/Publication are set per Kind
 // (direct: neither; sfu-reuse: Edge, Borrowed when it is another holder's
 // live subscription and must not be released; sfu-create: Edge and
-// Publication). Overlap is optional for every kind. TS: CandidateReservation.
+// Publication). Overlap is optional for every kind.
 type CandidateReservation struct {
 	Kind        ReservationKind
 	Edge        *Resource
@@ -183,7 +181,7 @@ type CandidateReservation struct {
 // EndpointRetirement is the producer retirement a bounded-gap transition
 // requires: an existing direct edge (RetireEdge: Child*/Parent*/Transport/
 // ConnectionID) or the Host publication (RetirePublication: HostSessionID/
-// Generation/ConnectionID). TS: EndpointRetirement.
+// Generation/ConnectionID).
 type EndpointRetirement struct {
 	Kind            RetirementKind
 	ChildPeerID     string
@@ -198,15 +196,14 @@ type EndpointRetirement struct {
 
 // EndpointTransition says how the producer's copy budget absorbs the
 // candidate. ProducerPeerID is nil only for TransitionNone on an sfu/reuse
-// plan (TS omitted it there and endpointTransitionEquals compares it).
-// Retire is set only for TransitionBoundedGap. TS: EndpointTransition.
+// plan. Retire is set only for TransitionBoundedGap.
 type EndpointTransition struct {
 	Kind           TransitionKind
 	ProducerPeerID *string
 	Retire         *EndpointRetirement
 }
 
-// CandidatePlan is a tuple with its endpoint transition. TS: CandidatePlan.
+// CandidatePlan is a tuple with its endpoint transition.
 type CandidatePlan struct {
 	Tuple              CandidateTuple
 	EndpointTransition EndpointTransition
@@ -215,7 +212,7 @@ type CandidatePlan struct {
 // CommittedEdge is a child's one upstream edge in the committed graph.
 // Peer edges (Kind UpstreamPeer) set ParentPeerID/ParentSessionID and leave
 // Resource nil; SFU edges (Kind UpstreamSfu) set PublicationGeneration and
-// Resource. TS: CommittedEdge.
+// Resource.
 type CommittedEdge struct {
 	Kind                  UpstreamKind
 	ChildSessionID        string
@@ -229,7 +226,7 @@ type CommittedEdge struct {
 	Resource              *Resource
 }
 
-// HostPublication is the single live SFU ingress. TS: HostPublication.
+// HostPublication is the single live SFU ingress.
 type HostPublication struct {
 	Generation     string
 	HostSessionID  string
@@ -246,7 +243,7 @@ type ConnectionAttemptProgress struct {
 	Total   int
 }
 
-// CurrentAttempt is OperationSnapshot.current: the live candidate attempt.
+// CurrentAttempt describes the operation's live candidate attempt.
 // ConnectionAttempt is nil when the attempt has no NAT opportunity.
 type CurrentAttempt struct {
 	Tuple             CandidateTuple
@@ -256,7 +253,7 @@ type CurrentAttempt struct {
 }
 
 // OperationSnapshot is a deep copy of the in-flight operation plus the
-// derived WakeAtMs. Current is nil without a live attempt. TS: OperationSnapshot.
+// derived WakeAtMs. Current is nil without a live attempt.
 type OperationSnapshot struct {
 	ChildPeerID    string
 	ChildSessionID string
@@ -283,7 +280,7 @@ type RouteSnapshot struct {
 	Operation        *OperationSnapshot
 }
 
-// ReconcileResult is the scheduler outcome. TS: ReconcileResult.
+// ReconcileResult is the scheduler outcome.
 type ReconcileResult struct {
 	Operation      *OperationSnapshot
 	RemovedPeerIDs []string
@@ -292,8 +289,7 @@ type ReconcileResult struct {
 }
 
 // SettleResult is the outcome of candidate settlement or active replacement.
-// Committed is true only when CandidateReady committed the attempt (TS: optional
-// committed, read as truthy by the router). TS: SettleResult.
+// Committed is true only when CandidateReady committed the attempt.
 type SettleResult struct {
 	Accepted       bool
 	Committed      bool
@@ -302,9 +298,7 @@ type SettleResult struct {
 	Released       []*Resource
 }
 
-// SenderQualityEvidenceResult is the outcome of the two sender-side
-// observers. TS declares it separately with a required committed flag; the
-// Go shape is identical to SettleResult.
+// SenderQualityEvidenceResult is the settlement outcome of sender-side evidence.
 type SenderQualityEvidenceResult = SettleResult
 
 // BeginResult is the outcome of the cursor-guarded candidate calls.
@@ -315,7 +309,7 @@ type BeginResult struct {
 	Released      []*Resource
 }
 
-// ParticipantInput describes a connected participant. TS: ParticipantInput.
+// ParticipantInput describes a connected participant.
 type ParticipantInput struct {
 	PeerID                      string
 	Role                        protocol.Role
@@ -325,7 +319,7 @@ type ParticipantInput struct {
 
 // EdgeGuard identifies one committed edge exactly. ParentSessionID is only
 // compared for peer edges; callers pass the edge's own ParentSessionID for
-// those and leave it empty for SFU edges. TS: EdgeGuard.
+// those and leave it empty for SFU edges.
 type EdgeGuard struct {
 	ChildPeerID     string
 	ChildSessionID  string
@@ -342,8 +336,7 @@ type ParentEdgeGuard struct {
 	ConnectionID    string
 }
 
-// PublicationGuard identifies the Host publication exactly. TS: the inline
-// guard of invalidateHostPublication and retireHostPublication.
+// PublicationGuard identifies the Host publication exactly.
 type PublicationGuard struct {
 	HostSessionID string
 	RouteRevision int64
@@ -352,13 +345,13 @@ type PublicationGuard struct {
 }
 
 // AdoptDirectConnectionInput is an EdgeGuard plus the replacement
-// connection. TS: EdgeGuard & { newConnectionId }.
+// connection.
 type AdoptDirectConnectionInput struct {
 	EdgeGuard
 	NewConnectionID string
 }
 
-// CandidateGuard identifies the live attempt exactly. TS: CandidateGuard.
+// CandidateGuard identifies the live attempt exactly.
 type CandidateGuard struct {
 	ChildPeerID    string
 	ChildSessionID string
@@ -368,7 +361,7 @@ type CandidateGuard struct {
 
 // CandidateCursorGuard identifies one candidate slot of the current
 // operation: it must still be at Cursor with an equal Plan, built at
-// FactVersion on BaseRevision. TS: CandidateCursorGuard.
+// FactVersion on BaseRevision.
 type CandidateCursorGuard struct {
 	ChildPeerID    string
 	ChildSessionID string
@@ -380,8 +373,7 @@ type CandidateCursorGuard struct {
 
 // BeginInput is the BeginCurrentCandidate input. PublicationGeneration and
 // PublicationConnectionID are required for sfu create/replace tuples;
-// HostSessionID is required for every SFU tuple (empty = TS undefined,
-// rejected the same way). TS: the inline input of beginCurrentCandidate.
+// HostSessionID is required for every SFU tuple.
 type BeginInput struct {
 	Guard                   CandidateCursorGuard
 	NowMs                   int64
@@ -398,7 +390,7 @@ type CandidateProof struct {
 }
 
 // QualityUpstream names the upstream a receiver-side window was measured
-// on: PeerID is set only for UpstreamPeer. TS: RouteQualityEvidenceInput.upstream.
+// on: PeerID is set only for UpstreamPeer.
 type QualityUpstream struct {
 	Kind   UpstreamKind
 	PeerID string
@@ -445,7 +437,7 @@ type SfuPublisherQualityEvidenceInput struct {
 }
 
 // Options configures a Controller. DebugRoomID empty disables the sanitised
-// route debug events. TS: ControllerOptions.
+// route debug events.
 type Options struct {
 	HostPeerID  string
 	DebugRoomID string
@@ -498,5 +490,5 @@ type Controller struct {
 	retiringPublicationGenerations    ordered.Map[string, struct{}]
 	sfuBootstrapIntent                *sfuBootstrapIntent
 	consumedSfuBootstrapOpportunities ordered.Map[string, int]
-	rootConvergenceRootPeerID         string // "" = TS undefined
+	rootConvergenceRootPeerID         string
 }
diff --git a/internal/server/route/candidates.go b/internal/server/route/candidates.go
index 931e3d8d0..b6afa2ab8 100644
--- a/internal/server/route/candidates.go
+++ b/internal/server/route/candidates.go
@@ -353,8 +353,7 @@ func (c *Controller) descendantsOf(peerID string) []string {
 	return descendants
 }
 
-// withSelf ports `this.descendantsOf(peerId).add(peerId)`: the peer itself
-// is appended last unless the walk already reached it.
+// withSelf appends the peer itself unless the descendant walk already reached it.
 func withSelf(descendants []string, peerID string) []string {
 	if slices.Contains(descendants, peerID) {
 		return descendants
@@ -508,8 +507,8 @@ func stringPtrEquals(left, right *string) bool {
 	return *left == *right
 }
 
-// In endpointTransitionEquals, `undefined !== HOST` matters for the
-// none producer, hence the pointer comparison.
+// endpointTransitionEquals distinguishes an absent producer from every peer,
+// including the Host, even when no retirement is needed.
 func endpointTransitionEquals(left, right EndpointTransition) bool {
 	if left.Kind != right.Kind {
 		return false
diff --git a/internal/server/route/controller.go b/internal/server/route/controller.go
index 6463d7327..221b902be 100644
--- a/internal/server/route/controller.go
+++ b/internal/server/route/controller.go
@@ -20,18 +20,15 @@ const (
 	persistentDegradedWindows       = int64(protocol.PersistentNativeEdgeDegradedWindows)
 )
 
-// candidateOpportunity is one consumed-ledger entry (TS CandidateOpportunity).
+// candidateOpportunity records the attempts consumed at one candidate rank.
 type candidateOpportunity struct {
 	rank            int
 	startedAttempts int
 	exhausted       bool
 }
 
-// participant is a known peer (TS Participant). sessionID "" is the TS
-// null: disconnected but in grace, or departed. Wire session IDs are
-// validated opaque IDs, so an empty string never names a live session;
-// bootstrapFailureReported and sfuFirstAtNextRoute are TS `true | undefined`
-// and only ever compared to true, so a bool is exact.
+// participant is a known peer. An empty sessionID means disconnected but in
+// grace, or departed; validated wire IDs never name a live session with "".
 type participant struct {
 	peerID                         string
 	role                           protocol.Role
@@ -45,13 +42,12 @@ type participant struct {
 	sfuFirstAtNextRoute            bool
 }
 
-// sessionIs ports `participant.sessionId === id`: a disconnected
-// participant (TS null) never equals any session string.
+// sessionIs never matches a disconnected participant, including an empty id.
 func (p *participant) sessionIs(id string) bool {
 	return p.sessionID != "" && p.sessionID == id
 }
 
-// senderQualityIdentity is TS SenderQualityIdentity.
+// senderQualityIdentity scopes quality evidence to one physical sender.
 type senderQualityIdentity struct {
 	childSessionID  string
 	parentPeerID    string
@@ -60,10 +56,8 @@ type senderQualityIdentity struct {
 	senderIdentity  string
 }
 
-// attempt is the live candidate (TS Attempt). The optional strings use ""
-// for undefined (they are only ever set to non-empty values or compared
-// after a truthiness check); the optional timestamps are pointers because
-// 0 is a legal accepted/sample time and `!== undefined` is semantic.
+// attempt is the live candidate. Optional identities use ""; optional
+// timestamps use pointers because zero is a valid accepted/sample time.
 type attempt struct {
 	tuple                                   CandidateTuple
 	revision                                int64
@@ -78,16 +72,16 @@ type attempt struct {
 	transportConnected                      bool
 	mediaReady                              bool
 	connectionAttempt                       *ConnectionAttemptProgress
-	senderQualityState                      SenderQualityState // "" = undefined
+	senderQualityState                      SenderQualityState
 	senderQualityAcceptedAtMs               *int64
-	senderQualityConsecutiveHealthyWindows  int64 // read only through `?? 0`
-	senderQualityConsecutiveDegradedWindows int64 // read only through `?? 0`
+	senderQualityConsecutiveHealthyWindows  int64
+	senderQualityConsecutiveDegradedWindows int64
 	senderQualitySampleTimestampMs          *int64
-	senderQualityIdentity                   string // "" = undefined
+	senderQualityIdentity                   string
 	relativeQualityApprovedAtMs             *int64
 }
 
-// operation is the single in-flight route operation (TS ChildOperation).
+// operation is the single in-flight route operation.
 type operation struct {
 	childPeerID           string
 	childSessionID        string
@@ -105,9 +99,8 @@ type operation struct {
 	current               *attempt
 }
 
-// planAt ports `operation.candidates[index]`: nil when out of range. It
-// returns a copy because the candidate array is spliced in place and TS
-// plan objects are never mutated after construction.
+// planAt returns nil when out of range and otherwise copies the plan so callers
+// do not retain a pointer into the candidate slice while it is reordered.
 func (o *operation) planAt(index int) *CandidatePlan {
 	if index < 0 || index >= len(o.candidates) {
 		return nil
@@ -116,13 +109,13 @@ func (o *operation) planAt(index int) *CandidatePlan {
 	return &plan
 }
 
-// planAtOrLast ports `operation.candidates[Math.min(cursor, length - 1)]`,
-// which is undefined (nil) for an empty array.
+// planAtOrLast returns the cursor's plan, the final plan if exhausted, or nil
+// when there are no candidates.
 func (o *operation) planAtOrLast() *CandidatePlan {
 	return o.planAt(min(o.cursor, len(o.candidates)-1))
 }
 
-// currentTuple ports `operation.current?.tuple ?? operation.candidates[operation.cursor]?.tuple`.
+// currentTuple prefers the live attempt over the next planned candidate.
 func (o *operation) currentTuple() *CandidateTuple {
 	if o.current != nil {
 		tuple := o.current.tuple
@@ -134,8 +127,7 @@ func (o *operation) currentTuple() *CandidateTuple {
 	return nil
 }
 
-// directContinuation is TS DirectContinuation; parentPeerIDs is the retry
-// order and is spliced in place.
+// directContinuation retains the remaining parent retry order behind an SFU edge.
 type directContinuation struct {
 	childSessionID        string
 	sfuConnectionID       string
@@ -154,8 +146,8 @@ type sfuBootstrapCarrier struct {
 	carrierPeerID   string
 }
 
-// routeTimingRecord is TS RouteTimingRecord; the optional timestamps are
-// pointers (undefined = never happened, distinct from 0).
+// routeTimingRecord uses nil timestamps for events that have not happened;
+// zero is a valid event time.
 type routeTimingRecord struct {
 	demandAtMs            int64
 	reason                DemandReason
@@ -167,8 +159,8 @@ type routeTimingRecord struct {
 	rejectionBucket       RejectionBucket
 }
 
-// routeQualityObservation is TS RouteQualityObservation. upstreamPeerID is
-// "" for the sfu upstream (TS null); lastDecodedProgressAtMs nil is TS null.
+// routeQualityObservation belongs to one receiver edge and presentation epoch.
+// upstreamPeerID is empty for SFU; nil lastDecodedProgressAtMs means no progress.
 type routeQualityObservation struct {
 	childSessionID          string
 	upstreamKind            UpstreamKind
@@ -186,8 +178,8 @@ type routeQualityObservation struct {
 	lastDecodedProgressAtMs *int64
 }
 
-// senderQualityObservation is TS SenderQualityObservation. The consumed
-// ledger is a pointer because `{...previous}` copies carry the same Map.
+// senderQualityObservation copies share the consumed-candidate ledger, so a new
+// sample on the same physical sender cannot reopen an exhausted opportunity.
 type senderQualityObservation struct {
 	childSessionID             string
 	parentPeerID               string
@@ -210,7 +202,7 @@ type sfuPublisherQualityObservation struct {
 	lastAcceptedAtMs          int64
 }
 
-// resourceSet is a JS Set<Resource>: pointer identity plus insertion order.
+// resourceSet deduplicates by pointer identity and preserves insertion order.
 type resourceSet struct {
 	seen map[*Resource]struct{}
 	list []*Resource
@@ -234,12 +226,12 @@ func (s *resourceSet) has(resource *Resource) bool {
 	return ok
 }
 
-// resources returns a fresh slice in insertion order (`[...set]`).
+// resources returns a fresh slice in insertion order.
 func (s *resourceSet) resources() []*Resource {
 	return append([]*Resource{}, s.list...)
 }
 
-// concatResources ports `[...a, ...b]` into a fresh, never-nil slice.
+// concatResources concatenates into a fresh, never-nil slice.
 func concatResources(parts ...[]*Resource) []*Resource {
 	out := []*Resource{}
 	for _, part := range parts {
@@ -248,7 +240,7 @@ func concatResources(parts ...[]*Resource) []*Resource {
 	return out
 }
 
-// dedupeStrings ports `[...new Set(values)]`: first occurrence wins.
+// dedupeStrings retains each value's first occurrence.
 func dedupeStrings(values []string) []string {
 	seen := make(map[string]struct{}, len(values))
 	out := make([]string, 0, len(values))
@@ -262,8 +254,7 @@ func dedupeStrings(values []string) []string {
 	return out
 }
 
-// New ports the constructor: panics with "Endpoint media copy capacity must
-// be 1, 2, or 3" or "Route operation timeout must be a positive integer".
+// New constructs a controller and panics on invalid capacity, timeout or SFU policy.
 func New(options Options) *Controller {
 	if err := protocol.AssertEndpointMediaCopyCapacity(options.EndpointMediaCopyCapacity); err != nil {
 		panic(err)
@@ -476,7 +467,7 @@ func (c *Controller) UpsertParticipant(input ParticipantInput, nowMs *int64) []*
 		}
 		return released
 	}
-	// A new key appends to the insertion order (TS Map.set at 573).
+	// New participants append to the scheduling order.
 	c.participants.Set(input.PeerID, &participant{
 		peerID:                      input.PeerID,
 		role:                        input.Role,
@@ -899,15 +890,13 @@ func (c *Controller) allocateRevision() int64 {
 	return c.latestRevision
 }
 
-// isSafeInteger is Number.isSafeInteger for a value that is already integral.
+// isSafeInteger keeps values exactly representable by the Browser's number type.
 func isSafeInteger(value int64) bool {
 	return value >= -maxSafeInteger && value <= maxSafeInteger
 }
 
-// joinOrder is allocated once per participant and preserved across
-// rebindHostIdentity, so two live
-// participants never share one and the TS localeCompare (ICU) tiebreak is
-// unreachable; strings.Compare stands in for it.
+// compareParticipant preserves join order, including across Host rebinding.
+// Live participants have unique orders; peer ID breaks ties in synthetic inputs.
 func compareParticipant(left, right *participant) int {
 	if left.joinOrder != right.joinOrder {
 		if left.joinOrder < right.joinOrder {
@@ -929,9 +918,7 @@ func stablePairRank(childPeerID, parentPeerID string) int64 {
 	return rank
 }
 
-// JS Math.round is half-up while math.Round is half-away-from-zero;
-// they differ only for negative halves, which the
-// `rounded < 0` branch drops either way. NaN and +/-Inf drop the window.
+// safeAdd ignores invalid rounded deltas and saturates at the wire integer bound.
 func safeAdd(total int64, delta float64) int64 {
 	rounded := math.Round(delta)
 	if math.IsNaN(rounded) || math.IsInf(rounded, 0) || rounded < 0 || rounded > float64(maxSafeInteger) {
diff --git a/internal/server/route/graph.go b/internal/server/route/graph.go
index 124c01933..97b9aa501 100644
--- a/internal/server/route/graph.go
+++ b/internal/server/route/graph.go
@@ -53,7 +53,7 @@ func (c *Controller) pruneDepartedLeaves(released *[]*Resource) []string {
 	changed := true
 	for changed {
 		changed = false
-		// Live iteration: deleting the visited entry is JS-safe (ordered.Map.All).
+		// ordered.Map.All permits deleting the visited entry during iteration.
 		for _, current := range c.participants.All() {
 			if current.role != protocol.RoleViewer || !current.departureConfirmed || len(c.childrenOf(current.peerID)) > 0 {
 				continue
@@ -167,8 +167,7 @@ func (c *Controller) removePublicationGeneration(generation string) []*Resource
 	return released
 }
 
-// retainsAnchor is the TS default argument of retireSfuEdge
-// (`this.childrenOf(viewerPeerId).length > 0`), evaluated at call time.
+// retainsAnchor keeps a retiring SFU edge while it still has peer children.
 func (c *Controller) retainsAnchor(viewerPeerID string) bool {
 	return len(c.childrenOf(viewerPeerID)) > 0
 }
@@ -191,7 +190,7 @@ func (c *Controller) retireSfuEdge(viewerPeerID string, edge *CommittedEdge, rel
 }
 
 // hasRetiringAnchor reports whether an inactive SFU edge still references
-// the generation (the `some` at 4816 and 4880).
+// the generation.
 func (c *Controller) hasRetiringAnchor(generation string) bool {
 	for _, edge := range c.upstreamByViewer.Values() {
 		if edge.Kind == UpstreamSfu && !edge.PhysicalActive && edge.PublicationGeneration == generation {
diff --git a/internal/server/route/operation.go b/internal/server/route/operation.go
index 00588ec76..10bc58fb0 100644
--- a/internal/server/route/operation.go
+++ b/internal/server/route/operation.go
@@ -9,7 +9,7 @@ import (
 // validation is the private validateOrAdvance result.
 type validation struct {
 	released             []*Resource
-	exhaustedChildPeerID string // "" = undefined
+	exhaustedChildPeerID string
 	expired              bool
 	consumedGuard        bool
 }
@@ -353,7 +353,7 @@ func (c *Controller) NoteCurrentCandidateRejection(guard CandidateCursorGuard, b
 }
 
 // SkipCurrentCandidate consumes the guarded candidate and advances the
-// cursor (TS defaulted bucket to "stale"; Go callers pass RejectionStale).
+// cursor, recording the caller's rejection reason.
 func (c *Controller) SkipCurrentCandidate(guard CandidateCursorGuard, nowMs int64, bucket RejectionBucket) BeginResult {
 	validation := c.validateOrAdvance(nowMs, nil)
 	op := c.operation
@@ -1163,7 +1163,7 @@ func (c *Controller) replanRemaining(op *operation, firstTuple, restoreTuple *Ca
 }
 
 // operationSnapshot returns a deep copy plus the derived wakeAtMs;
-// Current omits ConnectionAttempt when undefined.
+// Current omits ConnectionAttempt when the attempt has no NAT opportunity.
 func (c *Controller) operationSnapshot() *OperationSnapshot {
 	op := c.operation
 	if op == nil {
@@ -1440,7 +1440,7 @@ func (c *Controller) consumeDirectContinuationCandidate(op *operation) {
 	if len(continuation.parentPeerIDs) == 0 {
 		c.directContinuations.Delete(op.childPeerID)
 	} else {
-		// TS delete + set: the entry moves to the tail (round-robin state).
+		// Give the next continuation a turn before retrying this child.
 		c.directContinuations.MoveToBack(op.childPeerID, continuation)
 	}
 }
diff --git a/internal/server/route/quality.go b/internal/server/route/quality.go
index 5ac7dacbf..e8c9fce42 100644
--- a/internal/server/route/quality.go
+++ b/internal/server/route/quality.go
@@ -386,7 +386,7 @@ func (c *Controller) ObserveSfuPublisherQualityEvidence(input SfuPublisherQualit
 }
 
 // settleCandidateQuality folds a sender sample into the live
-// candidate and fails or commits it. senderIdentity "" is the TS null.
+// candidate and fails or commits it. An empty senderIdentity means unknown.
 func (c *Controller) settleCandidateQuality(op *operation, att *attempt, state SenderQualityState, acceptedAtMs int64, senderIdentity string, sampleTimestampMs *int64, commitReservation func(CandidateReservation) bool) SenderQualityEvidenceResult {
 	if att.senderQualityState != state {
 		c.debug("candidate-quality-observed",
@@ -796,7 +796,7 @@ func qualityUpstreamMatches(edge *CommittedEdge, upstream QualityUpstream) bool
 	return upstream.Kind == UpstreamSfu
 }
 
-// qualityObservationMatchesEdge treats an empty upstreamPeerID as TypeScript null.
+// qualityObservationMatchesEdge requires an empty upstreamPeerID for SFU.
 func qualityObservationMatchesEdge(observation *routeQualityObservation, edge *CommittedEdge) bool {
 	if edge.Kind == UpstreamPeer {
 		return observation.upstreamKind == UpstreamPeer && observation.upstreamPeerID == edge.ParentPeerID
diff --git a/internal/server/route/timing.go b/internal/server/route/timing.go
index 495bf7230..28d09f677 100644
--- a/internal/server/route/timing.go
+++ b/internal/server/route/timing.go
@@ -140,7 +140,7 @@ func (c *Controller) diagnosticParent(edge *CommittedEdge, ordinals map[string]i
 	return protocol.RouteDiagnosticParent{Kind: "viewer", Ordinal: protocol.Int(ordinal)}
 }
 
-// diagnosticQuality returns nil (TS null) unless the observation is
+// diagnosticQuality returns nil unless the observation is
 // fresh, non-empty and still describes the current edge.
 func (c *Controller) diagnosticQuality(childPeerID string, edge *CommittedEdge, nowMs int64) *protocol.RouteDiagnosticQuality {
 	observation := c.qualityObservations[childPeerID]
@@ -170,9 +170,8 @@ func (c *Controller) diagnosticQuality(childPeerID string, edge *CommittedEdge,
 	}
 }
 
-// elapsedMs returns nil (TS null) when the end precedes the start or
-// the difference is not a safe integer; the inputs are integral so
-// Math.floor is the identity.
+// elapsedMs returns nil when the end precedes the start or the difference
+// exceeds the wire integer bound.
 func elapsedMs(startedAtMs, endedAtMs int64) *protocol.Int {
 	elapsed := endedAtMs - startedAtMs
 	if !isSafeInteger(elapsed) || elapsed < 0 {
diff --git a/internal/server/signal/presence.go b/internal/server/signal/presence.go
index 5859ba6ef..94f484a58 100644
--- a/internal/server/signal/presence.go
+++ b/internal/server/signal/presence.go
@@ -14,9 +14,7 @@ import (
 	"github.com/TNTcraftHIM/Piik/internal/server/room"
 )
 
-// viewerKey is the TS `${roomId}:${peerId}` used by the grace timers and the
-// viewer quality evidence maps (viewerGraceKey and viewerConnectionKey were
-// the same expression).
+// viewerKey scopes grace timers and quality evidence to one room participant.
 func viewerKey(roomID, peerID string) string { return roomID + ":" + peerID }
 
 // sendViewerPresence lists the host entry first
@@ -158,9 +156,8 @@ func (s *Server) handleDisconnect(sess *session) {
 
 	s.sendViewerPresence(disconnected.RoomID)
 
-	// The viewer grace timer. The registered-pointer check stands in
-	// for clearTimeout; the store's removeDisconnectedViewer is the identity
-	// guard against a viewer that reconnected meanwhile.
+	// The registered pointer rejects stale grace callbacks; the store then
+	// guards against removing a Viewer that has already reconnected.
 	roomID, peerID := disconnected.RoomID, disconnected.PeerID
 	key := viewerKey(roomID, peerID)
 	timer := &graceTimer{}
diff --git a/internal/server/signal/router.go b/internal/server/signal/router.go
index f6cda6bba..701a4ebed 100644
--- a/internal/server/signal/router.go
+++ b/internal/server/signal/router.go
@@ -1,7 +1,7 @@
 package signal
 
 // The router owns no lock. signal.Server.mu (routerOptions.mu) is held by the
-// caller of every method except close, hooks are called with it held, and the
+// caller of every method, hooks are called with it held, and the
 // goroutines the router starts (pump driver, media prepares, drains and timer
 // callbacks) take it themselves. After unlocked I/O, revalidate the owning
 // room, operation and resource before committing effects under the lock.
@@ -52,16 +52,16 @@ func routeDebugSink() func(string, ...any) {
 	return slog.Info
 }
 
-// sfuFallback is SfuFallbackOptions. A zero timeout means the TS default.
+// sfuFallback supplies embedded media and admission; zero selects the default timeout.
 type sfuFallback struct {
 	media            sfu.Runtime
 	admission        *sfu.Admission
 	prepareTimeoutMs int64
 }
 
-// routerHooks are the signaling server callbacks of HybridMediaRouterOptions.
+// routerHooks are callbacks into the signaling server.
 // Every hook is called with mu held and must not block. shareGeneration
-// returns "" where the TS returned undefined; routesChanged may be nil.
+// returns "" when no share exists; routesChanged may be nil.
 type routerHooks struct {
 	sendToSession   func(sessionID string, message protocol.ServerMessage)
 	shareGeneration func(roomID string) string
@@ -81,8 +81,7 @@ type routerOptions struct {
 	afterFunc                 func(time.Duration, func()) func() bool
 }
 
-// authenticatedRouteParticipant is AuthenticatedRouteParticipant; routePolicy
-// is nil where the TS key was absent.
+// authenticatedRouteParticipant carries admitted identity and optional Host policy.
 type authenticatedRouteParticipant struct {
 	roomID      string
 	role        protocol.Role
@@ -91,22 +90,21 @@ type authenticatedRouteParticipant struct {
 	routePolicy *protocol.RoutePolicy
 }
 
-// hybridAuthenticationState is HybridAuthenticationState.
+// hybridAuthenticationState supplies the joining session's route assignment.
 type hybridAuthenticationState struct {
 	routeRevision   int64
 	routeAssignment protocol.ParticipantRouteAssignment
 }
 
-// activeViewerMediaEdge is ActiveViewerMediaEdge; upstream is peer or sfu.
+// activeViewerMediaEdge identifies one Viewer's active Peer or SFU upstream.
 type activeViewerMediaEdge struct {
 	revision     int64
 	connectionID string
 	upstream     protocol.MediaRouteUpstream
 }
 
-// signalAuthorization is the `boolean | "probe" | undefined` result of
-// peerSignalAuthorization. signalAuthorizationUnassigned is the TS undefined:
-// the signaling server falls back to the committed-edge assignment.
+// signalAuthorization is the peerSignalAuthorization result. Unassigned makes
+// the signaling server check the committed-edge assignment.
 type signalAuthorization int
 
 const (
@@ -116,8 +114,8 @@ const (
 	signalAuthorizationProbe
 )
 
-// peerSignalInput is the peerSignalAuthorization input; descriptionType is
-// "" where the TS key was absent.
+// peerSignalInput supplies session/connection identity for signal authorization.
+// descriptionType is empty for signals without an SDP description.
 type peerSignalInput struct {
 	roomID          string
 	sourcePeerID    string
@@ -129,8 +127,7 @@ type peerSignalInput struct {
 	descriptionType string
 }
 
-// peerSignalDebugInput is the debugPeerSignal input; candidateOrigin and
-// descriptionType are "" where the TS keys were absent.
+// peerSignalDebugInput supplies signal provenance; optional fields are empty.
 type peerSignalDebugInput struct {
 	roomID          string
 	sourcePeerID    string
@@ -141,8 +138,8 @@ type peerSignalDebugInput struct {
 	authorization   signalAuthorization
 }
 
-// roomRuntime is RoomRuntime. pumping is the `pump` promise used as a
-// single-flight token; deadlineGeneration is bumped by every clearDeadline so
+// roomRuntime owns one controller. pumping prevents concurrent drivers;
+// deadlineGeneration is bumped by every clearDeadline so
 // a callback that lost the Stop race sees it is stale.
 type roomRuntime struct {
 	hostPeerID string
@@ -155,7 +152,7 @@ type roomRuntime struct {
 	deadlineGeneration         uint64
 }
 
-// router is HybridMediaRouter.
+// router applies controller decisions through room signaling and media resources.
 type router struct {
 	mu        *sync.Mutex
 	store     *room.Store
@@ -172,13 +169,12 @@ type router struct {
 	resourceWaiters ordered.Map[string, struct{}]
 	sfuDrainTasks   ordered.Map[sfu.SubscriptionFence, *sfuDrainTask]
 	// inflight counts the goroutines that will re-acquire mu: the pump
-	// drivers, fresh SFU config issues and drains. It is the TS microtask
-	// backlog; tests wait for it to reach zero where the TS awaited.
+	// drivers, fresh SFU config issues and drains.
 	inflight int
 	closing  bool
 }
 
-// newRouter is the HybridMediaRouter constructor.
+// newRouter shares the server's lock and supplies clock defaults.
 func newRouter(options routerOptions) *router {
 	if err := protocol.AssertEndpointMediaCopyCapacity(options.endpointMediaCopyCapacity); err != nil {
 		panic(err)
@@ -205,12 +201,9 @@ func newRouter(options routerOptions) *router {
 	return r
 }
 
-// io is one TS `await` on external work: mu is released around fn and always
-// re-acquired, including while a panic unwinds. That last part is the reason
-// this is a helper rather than an inline Unlock/Lock pair: recoverPump turns a
-// panic raised inside such a window into the TS pump rejection, and its
-// caller's `defer r.mu.Unlock()` would otherwise unlock a mutex nobody holds
-// (an unrecoverable runtime error). Nothing may touch router state inside fn.
+// io releases mu for external work and reacquires it even while a panic unwinds.
+// This keeps the caller's deferred unlock valid when recoverPump catches the
+// failure. Nothing may touch router state inside fn.
 func (r *router) io(fn func()) {
 	r.mu.Unlock()
 	defer r.mu.Lock()
@@ -266,9 +259,7 @@ func (r *router) connectParticipant(input authenticatedRouteParticipant) hybridA
 		if rm.controller != nil && rm.hostPeerID != input.peerID {
 			r.clearDeadline(rm)
 			// rm.hostPeerID always equals the controller's, so this branch
-			// takes RebindHostIdentity's clearing path: every committed edge
-			// goes, which is what the TS per-viewer deleteConnectionId loop
-			// then restated into the mirror.
+			// takes RebindHostIdentity's clearing path: every committed edge goes.
 			r.releaseResources(rm.controller.RebindHostIdentity(input.peerID, input.sessionID, r.nowPtr()))
 		}
 		rm.hostPeerID = input.peerID
@@ -1089,7 +1080,7 @@ func (r *router) assignments(
 		publicationGeneration = snapshot.HostPublication.Generation
 	}
 	if candidate != nil && candidateChildPeerID != "" {
-		// TS delete-then-set: the candidate child moves to the back.
+		// The replacement candidate follows the surviving committed children.
 		edges.Delete(candidateChildPeerID)
 		if candidate.Kind == route.UpstreamPeer {
 			edges.Set(candidateChildPeerID, assignmentEdge{kind: route.UpstreamPeer, parentPeerID: candidate.ParentPeerID})
@@ -1292,8 +1283,8 @@ type qualitySample struct {
 	hostSessionID         string
 }
 
-// qualityCopyContext is QualityCopyContext; operationReason and
-// candidateTransition are "" where the TS had null.
+// qualityCopyContext attributes copy demand to committed and candidate work;
+// operationReason and candidateTransition are empty when no such work exists.
 type qualityCopyContext struct {
 	committedCopies         int
 	candidateReservedCopies int
@@ -1519,8 +1510,7 @@ func nullable[T any](value protocol.Nullable[T]) any {
 	return *value.Value
 }
 
-// nullString is the debug value of a string that is "" where the TS had
-// null or undefined.
+// nullString emits absent debug identities as null.
 func nullString(value string) any {
 	if value == "" {
 		return nil
diff --git a/internal/server/signal/router_pump.go b/internal/server/signal/router_pump.go
index 3b4b8c1e6..7a93ba413 100644
--- a/internal/server/signal/router_pump.go
+++ b/internal/server/signal/router_pump.go
@@ -12,7 +12,7 @@ import (
 	"github.com/TNTcraftHIM/Piik/internal/server/sfu"
 )
 
-// preparedCandidate is PreparedCandidate; the optional TS keys are "" / nil.
+// preparedCandidate holds the allocations and signaling needed to begin an attempt.
 type preparedCandidate struct {
 	reservation             route.CandidateReservation
 	connectionID            string
@@ -446,9 +446,8 @@ func (r *router) sendPrepareMessages(
 	}
 }
 
-// scheduleDeadline registers a callback that verifies it is
-// still the registered deadline through the room's generation counter, which
-// clearDeadline bumps: a cleared TS timer never fired.
+// scheduleDeadline fences callbacks by the room's deadline generation.
+// clearDeadline invalidates even a callback that already won the timer Stop race.
 func (r *router) scheduleDeadline(roomID string, rm *roomRuntime, operation *route.OperationSnapshot) {
 	r.clearDeadline(rm)
 	wakeInMs := max(int64(0), operation.WakeAtMs-r.now())
diff --git a/internal/server/signal/server.go b/internal/server/signal/server.go
index 51d7b766f..ca0fc8c25 100644
--- a/internal/server/signal/server.go
+++ b/internal/server/signal/server.go
@@ -36,19 +36,17 @@ import (
 // Connection admission, queue and timeout bounds limit the signaling resources
 // a stalled or unauthenticated peer can retain.
 const (
-	// maxBufferedSignalBytes is MAX_BUFFERED_SIGNAL_BYTES: once a connection's
-	// unsent queue passes it the peer is not draining and the connection is
-	// terminated, so one stalled reader cannot grow the server's heap.
+	// maxBufferedSignalBytes bounds unsent data per connection; exceeding it
+	// terminates a stalled reader before it can grow the server's heap.
 	maxBufferedSignalBytes = 256 * 1024
 	// defaultMaxSignalConnections and defaultMaxUnauthenticatedConnections are
-	// the DEFAULT_MAX_* admission ceilings: 20 viewers plus a host across 9_000
+	// admission ceilings: 20 viewers plus a host across 9_000
 	// room codes is far above either, so they bound abuse, not capacity.
 	defaultMaxSignalConnections          = 2_048
 	defaultMaxUnauthenticatedConnections = 256
-	// minSignalingChallengeIntervalMs is MIN_SIGNALING_CHALLENGE_INTERVAL_MS:
-	// the floor between two liveness challenges on one connection.
+	// minSignalingChallengeIntervalMs bounds liveness challenge frequency.
 	minSignalingChallengeIntervalMs = int64(1_000)
-	// serviceRestartCloseGrace is SERVICE_RESTART_CLOSE_GRACE_MS: how long a
+	// serviceRestartCloseGrace is how long a
 	// peer has to acknowledge close{1012} before the socket is terminated.
 	serviceRestartCloseGrace = 1_000 * time.Millisecond
 
@@ -97,12 +95,12 @@ type Options struct {
 	MaxUnauthenticatedConnections int
 	// AfterFunc is the timer factory; nil uses time.AfterFunc.
 	AfterFunc func(time.Duration, func()) func() bool
-	// Logger receives the three console.error records; nil uses slog.Default().
+	// Logger receives signaling failures; nil uses slog.Default().
 	Logger *slog.Logger
 }
 
-// viewerQualityEvidenceGate is ViewerQualityEvidenceGate; upstreamPeerID is
-// "" where the TS had null.
+// viewerQualityEvidenceGate rejects stale or repeated evidence for the current
+// edge and presentation epoch. upstreamPeerID is empty for SFU.
 type viewerQualityEvidenceGate struct {
 	viewerSessionID   string
 	upstreamKind      string
@@ -112,32 +110,16 @@ type viewerQualityEvidenceGate struct {
 	sequence          int64
 }
 
-// viewerQualityEvidenceAttempt is viewerQualityEvidenceAttemptAtMs plus the
-// committed-edge connection the stamp was taken under. Tagging replaces the
-// TS setViewerConnectionId reset: a viewer whose media identity changed is
-// never held back by the previous route's stamp.
-//
-// Deviation: it does not replace the deleteViewerConnectionId reset, which
-// broadcastActive also ran when a viewer's path stopped being physical. A
-// viewer whose path breaks and heals on the same committed connection without
-// sending evidence in between keeps its stamp here, where the TypeScript had
-// cleared it, so one frame inside the 2 s window can be dropped that the
-// TypeScript accepted. Unobservable: the reporter's own
-// VIEWER_QUALITY_EVIDENCE_INTERVAL_MS gate means its next send is already at
-// least that far from the last accepted one. The epoch/sequence gate below
-// cannot be affected the same way, because a committed edge that loses
-// physicalActive is never reactivated - its replacement carries a new
-// connectionID, so sameEdge is false.
+// viewerQualityEvidenceAttempt scopes the rate window to a committed connection.
+// A replacement connection is not held back by its predecessor's timestamp.
+// Reports for the same connection remain subject to the existing window.
 type viewerQualityEvidenceAttempt struct {
 	connectionID string
 	atMs         int64
 }
 
-// roomShare is one Host share of one room. Its zero value is the TS state
-// where none of the four per-room share maps had an entry, so reads need no
-// presence check: generation and pausedGeneration are never stored empty
-// (authenticate falls back to the session id), which is what made the TS
-// `undefined === undefined` comparisons meaningful.
+// roomShare owns one room's Host publication intent. Its zero value means no
+// intent; active generations are nonempty, falling back to the Host session ID.
 type roomShare struct {
 	// generation survives stopSharing; only closeRoom drops the whole
 	// record.
@@ -150,19 +132,18 @@ type roomShare struct {
 	pausedGeneration string
 }
 
-// senderQualityRateWindow is SenderQualityRateWindow.
 type senderQualityRateWindow struct {
 	startedAtMs int64
 	count       int
 }
 
-// graceTimer is one viewerGraceTimers entry; the callback compares the
-// registered pointer with its own (a cleared TS timer never fired).
+// graceTimer callbacks compare their registered pointer so replacement or
+// cancellation invalidates a callback even after its timer has fired.
 type graceTimer struct {
 	stop func() bool
 }
 
-// Server is SignalingServer.
+// Server owns room signaling and serializes its effects.
 type Server struct {
 	// ponytail: global lock, per-room locks if throughput matters
 	mu sync.Mutex
@@ -200,9 +181,7 @@ type Server struct {
 	viewerQualityEvidenceGates    map[string]viewerQualityEvidenceGate
 	viewerQualityEvidenceAttempts map[string]viewerQualityEvidenceAttempt
 	senderQualityRateBySession    map[string]*senderQualityRateWindow
-	// shares owns the whole per-room share lifecycle (TS
-	// shareGenerationsByRoom, qualitySettingsByRoom, routePolicyByRoom and
-	// pausedShareGenerationsByRoom).
+	// shares keeps generation, settings, route policy and pause intent together.
 	shares                      map[string]roomShare
 	deferredViewerPresenceRooms map[string]struct{}
 
@@ -210,8 +189,7 @@ type Server struct {
 	closing       bool
 }
 
-// New is the SignalingServer constructor. It performs no I/O; the heartbeat
-// ticker starts immediately.
+// New creates the signaling owner and starts its heartbeat timer.
 func New(options Options) (*Server, error) {
 	if err := protocol.AssertEndpointMediaCopyCapacity(options.EndpointMediaCopyCapacity); err != nil {
 		return nil, err
@@ -318,9 +296,8 @@ func orDefault(value, fallback int) int {
 	return value
 }
 
-// InviteURL is viewerInviteUrl / the inviteUrl of createRoomResponse:
-// new URL(`/r/${roomId}`, publicBaseUrl) with the Viewer grant in the
-// fragment only. viewerGrant "" is the TypeScript null.
+// InviteURL adds an optional Viewer grant only in the URL fragment, keeping it
+// out of HTTP requests. Existing base URL query/fragment values are discarded.
 func InviteURL(publicBaseURL *url.URL, roomID, viewerGrant string) string {
 	invite := *publicBaseURL
 	invite.Opaque = ""
@@ -340,20 +317,16 @@ func InviteURL(publicBaseURL *url.URL, roomID, viewerGrant string) string {
 // upgrade
 // ---------------------------------------------------------------------------
 
-// ServeHTTP is the "upgrade" listener: the TS rejection ladder, then the
-// accept.
+// ServeHTTP validates the signaling endpoint, origin and capacity before upgrade.
 func (s *Server) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
-	// accepts a scheme-relative target such as "//[" as a plain path, so
-	// the WHATWG authority parse is re-run on the raw target.
+	// HTTP parsing accepts scheme-relative targets as paths; reject malformed
+	// authorities such as "//[" before checking the endpoint.
 	if _, err := url.Parse(request.RequestURI); err != nil {
 		rejectUpgrade(writer, http.StatusBadRequest)
 		return
 	}
-	// EscapedPath, not Path: the WHATWG pathname the TS compared is not
-	// percent-decoded, so "/%73ignal" was a 404 there, while URL.Path decodes
-	// it to "/signal" and would give the endpoint an alias the TS never had.
-	// This is the path notion the sibling HTTP router already uses
-	// (app/json.go requestPath), with the same dot-segment deviation.
+	// Match the literal endpoint, rejecting encoded aliases such as "/%73ignal",
+	// just as the sibling HTTP router's requestPath does.
 	if request.URL.EscapedPath() != "/signal" || request.URL.RawQuery != "" {
 		rejectUpgrade(writer, http.StatusNotFound)
 		return
@@ -374,15 +347,14 @@ func (s *Server) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
 		rejectUpgrade(writer, http.StatusServiceUnavailable)
 		return
 	}
-	// The TS counted the slot synchronously inside handleUpgrade; Accept
-	// performs I/O, so the slot is reserved across it.
+	// Reserve capacity before Accept performs I/O outside the lock.
 	s.pendingConnections++
 	s.mu.Unlock()
 
 	siteAccessAuthenticated := s.siteAccessAtUpgrade(request)
 	var sess *session
 	// Origin was verified above with the exact isAllowedOrigin rule, so the
-	// library's own check is skipped; the TS ws server never compressed.
+	// library's own check is skipped.
 	conn, err := websocket.Accept(writer, request, &websocket.AcceptOptions{
 		InsecureSkipVerify: true,
 		CompressionMode:    websocket.CompressionDisabled,
@@ -572,10 +544,9 @@ func (s *Server) UpdateRoomAccess(
 	return nil, fmt.Errorf("unknown room access request %T", request)
 }
 
-// deriveViewerPasswordMaterial is the unlocked KDF window of replaceRoom and
-// setViewerPassword; mayStart is the TS `rooms.get(roomId) === current &&
-// verifyDigest(hostToken)` closure. mu must be held; it is released only
-// while the derivation runs. A nil password derives nothing.
+// deriveViewerPasswordMaterial releases mu for password derivation, rechecking
+// exact room/Host authority when the gate admits the work. The caller holds mu;
+// a nil or empty password derives nothing.
 func (s *Server) deriveViewerPasswordMaterial(
 	roomID, hostToken string, password *string, current *room.Room,
 ) (material []byte, derived error) {
@@ -619,8 +590,8 @@ func (s *Server) ReplaceRoom(
 	return replacement.Created, nil
 }
 
-// CreateRoom is the roomStore.createRoom call of app.ts, run under mu with
-// the KDF unlocked (the room package's documented sequence).
+// CreateRoom serializes room admission and commit, releasing mu for password
+// derivation according to the room package's locking contract.
 func (s *Server) CreateRoom(
 	codeEntryPolicy protocol.CodeEntryPolicy,
 	roomPassword *string,
@@ -907,7 +878,7 @@ func (s *Server) authenticationFailed(sess *session, request authRequest, err er
 func (s *Server) completeAuthentication(sess *session, request authRequest, participant room.ConnectedParticipant) {
 	if s.closing || !s.sessions.Has(sess) || sess.revoked || !sess.open() {
 		if _, err := s.store.DisconnectParticipant(participant.RoomID, participant.PeerID, sess.sessionID); err != nil {
-			// The TS threw out of the async function; there is no catcher.
+			// Failing to retire the aborted admission is an internal invariant failure.
 			panic(fmt.Errorf("room store failed while releasing an aborted authentication: %w", err))
 		}
 		return
@@ -1093,8 +1064,7 @@ func (s *Server) settleHostShare(roomID, sessionID string, request authRequest)
 	if currentGeneration != "" && currentGeneration != shareGeneration {
 		s.stopSharing(roomID)
 	}
-	// stopSharing may have cleared the record, so the survivors are read
-	// after it, exactly as the TS map reads were.
+	// stopSharing may have cleared fields, so read the surviving intent afterwards.
 	share := s.shares[roomID]
 	if request.shareGeneration != "" &&
 		(currentGeneration != shareGeneration || share.qualitySettings == nil) {
@@ -1150,9 +1120,8 @@ func authenticatedDisplayName(request authRequest) *string {
 	return &name
 }
 
-// connectRouteParticipant is the try/catch around
-// hybridMediaRouter.connectParticipant: a controller assertion panics with
-// the TS message, which the TS catch swallowed.
+// connectRouteParticipant leaves the participant unassigned if a controller
+// assertion prevents route admission.
 func (s *Server) connectRouteParticipant(participant authenticatedRouteParticipant) (state hybridAuthenticationState, assigned bool) {
 	defer func() {
 		if recover() != nil {
@@ -1471,7 +1440,7 @@ func (s *Server) handleViewerQualityEvidence(sess *session, source *authenticate
 	}
 
 	// The committed edge owns the viewer's media identity; connectionID is
-	// "" while the viewer has no physical path (the TS mirror was absent).
+	// empty while the viewer has no physical path.
 	edge, hasEdge := s.router.resolveActiveViewerMediaEdge(source.roomID, source.peerID)
 	connectionID := ""
 	if hasEdge {
@@ -1701,8 +1670,7 @@ func (s *Server) routePeerAssistedSignal(sess *session, source *authenticatedSes
 		return
 	}
 
-	// TS setViewerConnectionId here only ever restated the committed edge:
-	// an authorized non-probe offer either matches edge.connectionId or was
+	// An authorized non-probe offer either matches the committed connection or was
 	// adopted into it by peerSignalAuthorization.
 	s.sendToSession(target.SessionID, protocol.ServerSignalMessage{
 		Type:       "signal",
diff --git a/internal/server/signal/session.go b/internal/server/signal/session.go
index e6c169ce8..ca4585ec9 100644
--- a/internal/server/signal/session.go
+++ b/internal/server/signal/session.go
@@ -35,14 +35,13 @@ type outbound struct {
 	reason string
 }
 
-// session is SocketState plus the connection it belongs to. Every field is
+// session owns one signaling connection and its admission state. Every field is
 // guarded by Server.mu except conn, ctx, cancel, wake and readerDone, which
 // are immutable after accept.
 type session struct {
 	conn *websocket.Conn
 	// ctx is cancelled by terminate(); coder/websocket closes the socket
-	// when the context of a pending Read or Write expires, which is the
-	// `socket.terminate()` of the TS.
+	// when the context of a pending Read or Write expires.
 	ctx    context.Context
 	cancel context.CancelFunc
 
@@ -51,7 +50,7 @@ type session struct {
 	siteAccessAuthenticated bool
 	revoked                 bool
 	authenticating          bool
-	// challenged is `lastSignalingChallengeAtMs !== undefined`.
+	// challenged distinguishes no challenge yet from a timestamp of zero.
 	challenged                 bool
 	lastSignalingChallengeAtMs int64
 	authenticated              *authenticatedSession
@@ -59,17 +58,17 @@ type session struct {
 	nextInteractionAtMs        int64
 
 	// authStop stops the authentication deadline; authGeneration is
-	// bumped whenever the TS cleared the timer so a callback that lost the
+	// bumped whenever the timer is cleared so a callback that lost the
 	// Stop race sees it is stale.
 	authStop       func() bool
 	authGeneration uint64
 
-	// queue is the ws send buffer; queuedBytes is its bufferedAmount.
+	// queuedBytes accounts for pending outbound text frames.
 	queue       []outbound
 	queuedBytes int
 	wake        chan struct{}
-	// closeQueued is readyState !== OPEN once close() was called: later
-	// sends are dropped and later closes are no-ops, as with ws.
+	// closeQueued stops further sends and repeated close requests while the
+	// writer completes the existing queue and close handshake.
 	closeQueued bool
 	terminated  bool
 	readerDone  chan struct{}
@@ -89,7 +88,7 @@ func newSession(conn *websocket.Conn, siteAccessAuthenticated bool) *session {
 	}
 }
 
-// open is `socket.readyState === WebSocket.OPEN`.
+// open reports whether this session still accepts outgoing messages.
 func (sess *session) open() bool {
 	return !sess.closeQueued && !sess.terminated
 }
@@ -108,7 +107,7 @@ func (sess *session) enqueue(encoded []byte) {
 	sess.notify()
 }
 
-// close is socket.close(code, reason): a no-op unless the socket is open.
+// close queues a close handshake only while the socket is open.
 // mu must be held.
 func (sess *session) close(code websocket.StatusCode, reason string) {
 	if !sess.open() {
@@ -119,7 +118,7 @@ func (sess *session) close(code websocket.StatusCode, reason string) {
 	sess.notify()
 }
 
-// terminate is socket.terminate(): abrupt, no close frame. Cancelling the
+// terminate closes abruptly without a close frame. Cancelling the
 // context closes the socket from inside the library, so nothing touches the
 // connection under mu. mu must be held.
 func (sess *session) terminate() {
@@ -130,7 +129,7 @@ func (sess *session) terminate() {
 	sess.cancel()
 }
 
-// clearAuthenticationTimer is clearTimeout(state.authenticationTimer).
+// clearAuthenticationTimer invalidates pending and already-fired callbacks.
 func (sess *session) clearAuthenticationTimer() {
 	if sess.authStop != nil {
 		sess.authStop()
@@ -155,8 +154,8 @@ func (s *Server) accept(conn *websocket.Conn, siteAccessAuthenticated bool) *ses
 	return sess
 }
 
-// armAuthenticationTimer is the setTimeout of accept(). The TS timer
-// fired blind; the generation check stands in for clearTimeout.
+// armAuthenticationTimer bounds admission time. The generation check rejects
+// a stale callback even when stopping the timer lost the race.
 func (s *Server) armAuthenticationTimer(sess *session) {
 	generation := sess.authGeneration
 	sess.authStop = s.afterFunc(time.Duration(s.authenticationTimeoutMs)*time.Millisecond, func() {

From 5084cca95a497a7ea49491cdcdafd5ff757c30c4 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 19:10:42 +0800
Subject: [PATCH 024/262] docs(todo): include thumbnail retirement in capture
 border review

---
 docs/todo.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/docs/todo.md b/docs/todo.md
index adc4292d5..eb2da4b06 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -17,8 +17,9 @@ Git/PRs own completed history.
   before accepting a changed contract.
 - [ ] **Windows 11 capture border remains visible.** Reopened by a new report
   on 2026-10-07. Recheck App/Browser capture ownership, border permission/API
-  results, live setting changes and concurrent captures before attributing this
-  to Windows. Obtain the affected version/path/build when available; the report
+  results, live setting changes, concurrent captures and source-thumbnail
+  cancellation/retirement before attributing this to Windows. Obtain the
+  affected version/path/build when available; the report
   does not yet identify them. [Capture evidence](./research/native-client-lifecycle.md#windows-capture-borders)
   owns the prior graceful-retirement and concurrent-capture checks.
 - [ ] **Independent Gitee mirror recovery.** Implementation and local acceptance

From 9079c7c5050a443333b1d7cfda9674be1347d2c4 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 19:19:05 +0800
Subject: [PATCH 025/262] docs(transport): reconcile isolated Magicsock
 acceptance evidence

---
 docs/research/nat-traversal.md | 71 +++++++++++++++++++++++++++++-----
 1 file changed, 61 insertions(+), 10 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index d7f6e1e5a..968c0a723 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1,6 +1,6 @@
 # Browser And Native NAT Traversal
 
-Last reviewed: 2026-10-04
+Last reviewed: 2026-10-07
 
 This document owns evidence for improving direct ICE without adding a
 new relay or a custom transport. The current product contract remains standard
@@ -319,8 +319,8 @@ isolated branch; production dependencies and routing remain unchanged.
 
 ### Integration Cost And Recovery Controls
 
-The 2026-10-06 assessment retains the probes on `spike/magicsock-assessment`
-at `fea0587f`, based on current main. These nested Go modules are outside Piik's
+The isolated `spike/magicsock-assessment` branch retains the comparison probes.
+These nested Go modules are outside Piik's
 build and dependency graph. Repeated local Tailcat bootstrap, peer denial,
 revocation and synthetic SRTP media checks passed; the raw magicsock direct-path
 matrix again found the same reachable classes as fresh Pion ICE. Retired shared
@@ -353,13 +353,64 @@ increasing only the fixture's ICE budget recovered media. The ordinary Pion
 loss control recovered without that override. Do not adopt packet prefixes,
 diagnostic Ping polling or wider product deadlines as integration shortcuts.
 
-Reassessed on 2026-10-07: keep the transport isolated. Go reuse is feasible, but
-new key authorization/revocation, underlay readiness, packet-size limits and
-relay operation have no demonstrated direct-coverage benefit sufficient for
-product integration. A future trial needs matched networks with a repeatable
-benefit, separate direct/relayed/first-media results, and current room/route
-ownership. IPv6, gateway mapping, Piik prediction, physical routers, decoded
-playback and mixed Browser/Native fanout remain outside this comparison.
+Keep product integration conditional on a repeatable benefit on matched networks,
+with direct coverage, relay coverage, recovery and first picture measured
+separately. Go feasibility alone does not establish that benefit. Gateway
+mapping, Piik prediction, physical routers and the full mixed Piik topology
+remain outside the comparison. The isolated controls below do not change that
+adoption boundary.
+
+### Isolated Connection-Layer Acceptance
+
+The 2026-10-07 experiment through `f0ca8056` keeps Pion's ICE/DTLS/SRTP over
+Tailcat. Each physical connection owns a virtual UDP tuple and mux; its one-shot
+listener retires after admission. Connections to one authorized peer may share
+the tunnel. Closing or aborting one flow preserves healthy siblings; revoking
+the fixture peer key denies admission and disconnects that tunnel. These checks
+do not implement Piik room grants or endpoint exchange.
+
+Repeated lifecycle and Linux race checks cover overlapping media preparation,
+rollback, replacement, canceled preparation followed by retry, bounded datagrams
+and blocked-reader retirement. A 350 ms interruption of one flow preserved its
+sibling and recovered without replacing SDP. Piik's actual encoded source,
+LiveKit forwarder and pacer also carried a small VP8/Opus fixture over ordinary
+Pion and Tailcat, including TWCC and keyframe requests. Tailcat recovered an
+injected missing video packet through existing NACK handling after DERP closed.
+This is forwarding evidence, not throughput or room-controller acceptance.
+
+A separate real Chrome control decoded H.264/Opus and VP8/Opus from a generated
+640×360 picture and tone through Browser WebRTC → Pion/Tailcat/Pion → Browser
+WebRTC without re-encoding. Picture and decoded audio continued after DERP
+closure and stopped after peer revocation. It uses ordinary Browser WebRTC,
+not Browser-native Magicsock, physical capture or cross-browser acceptance.
+
+The 1200-byte Native packetization envelope with TWCC and short MID/RID headers
+produced at most 1228-byte encrypted datagrams across Pion's three default SRTP
+profiles. Only four bytes remain below Tailcat's 1232-byte ceiling; larger
+headers and maximum compound RTCP remain integration checks. The small actual
+forwarder fixture does not establish those limits.
+
+Kernel gateway rebinding retained full WebRTC sessions. With DERP available,
+fresh media resumed in about 6.4–6.5 seconds and ICE reported `connected` in about
+7.1–8.1 seconds, without new SDP. With DERP closed, neither gateway direction
+recovered within 20 seconds. Fresh media and ICE state are separate observations;
+Piik's disconnected grace, restart and retirement need a full integration
+control before adoption. Underlay preparation must fit the existing operation
+deadline, not start a second budget. Local cold setup of about 3.3 seconds for
+Tailcat versus 0.2 seconds for Pion disabled STUN/gateway mapping and is not a WAN
+startup comparison.
+
+Dual-stack namespace controls enabled STUN and alternately blocked IPv4 UDP or
+IPv6 forwarding. Both stacks used the working family; Tailcat's direct proof
+required fresh bidirectional delivery after DERP closed. One side reporting a
+direct address did not establish that both directions were direct. IPv4 TCP
+still supplied bootstrap, so this is not an IPv6-only or physical ISP check.
+These controls add no demonstrated direct-reachability advantage for Magicsock.
+
+The experiment's README owns commands and fixture boundaries; raw output remains
+ignored. Further product work needs a measurable network benefit and accepted
+room authorization, resource and relay-operation owners, not more loopback
+successes.
 
 ## Native Mapping Cache And Retry Lifetimes
 

From 74bb1b8df3c0bd26eaf7f2f49b757b599f9bc15f Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 19:50:36 +0800
Subject: [PATCH 026/262] docs(transport): record feedback boundary for
 Magicsock adoption

---
 docs/research/nat-traversal.md | 16 ++++++++++++++++
 docs/todo.md                   |  5 +++--
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 968c0a723..0a8555cd7 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -390,6 +390,22 @@ profiles. Only four bytes remain below Tailcat's 1232-byte ceiling; larger
 headers and maximum compound RTCP remain integration checks. The small actual
 forwarder fixture does not establish those limits.
 
+A feedback control found a concrete mismatch: Pion's TWCC recorder generated
+a 1244-byte encrypted report and a 1268-byte compound batch. Ordinary Pion
+delivered both; the bounded adapter rejected them, and unwrapped Tailcat did
+not deliver either within two seconds. A 1144-byte report arrived before and
+after. Windows and Linux race checks repeated this result three times each.
+Pion ICE treats non-close socket write errors as packet loss, so `WriteRTCP`
+returning no error did not prove delivery. This does not establish how often
+Piik would produce these batches. Tailcat's
+[documented payload bound](https://github.com/tailscale/tailcat/blob/b4dc28e8aa8936f0a90a41ad8293a64e3d6b645f/tailcat.go#L574)
+needs a supported feedback-size boundary before integration; reducing RTP
+packetization alone does not bound RTCP. No product transport or custom packet
+fragmentation was added for this check.
+The related [Pion feedback-MTU report](https://github.com/pion/interceptor/issues/416)
+remains open as of 2026-10-07. Its out-of-order packet evidence does not establish
+the cause of any Piik field report; the pinned recorder has no byte-size option.
+
 Kernel gateway rebinding retained full WebRTC sessions. With DERP available,
 fresh media resumed in about 6.4–6.5 seconds and ICE reported `connected` in about
 7.1–8.1 seconds, without new SDP. With DERP closed, neither gateway direction
diff --git a/docs/todo.md b/docs/todo.md
index eb2da4b06..df9357014 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -60,8 +60,9 @@ Implementation needs a concrete useful result within the product model.
   [matched comparisons](./research/nat-traversal.md#integration-cost-and-recovery-controls)
   have not established improved direct reachability. Seek a repeatable benefit
   before accepting peer-key authorization/revocation, underlay readiness and
-  relay operation. Keep the isolated experiment separate from product routing;
-  the P2P evidence work below owns the network/interop acceptance boundary.
+  relay operation. The isolated feedback check also requires a supported RTCP
+  size boundary for the tunnel's MTU. Keep the experiment separate from product
+  routing; the P2P evidence work below owns the network/interop acceptance boundary.
 - [ ] **Managed Demo hosting.** The [provider assessment](./operations/website.md#managed-hosting-assessment)
   identifies UDP/storage requirements but establishes no cost saving. Keep the
   existing P2P-only Demo until a provider and operating boundary are accepted.

From a9e8ceefc505cd6dcf3c2530dd100d87b25ee860 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 7 Oct 2026 20:02:08 +0800
Subject: [PATCH 027/262] docs(capture): include display changes in border
 investigation

---
 docs/research/native-client-lifecycle.md | 6 ++++++
 docs/todo.md                             | 6 +++---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/docs/research/native-client-lifecycle.md b/docs/research/native-client-lifecycle.md
index 4595b74e8..291a7adfb 100644
--- a/docs/research/native-client-lifecycle.md
+++ b/docs/research/native-client-lifecycle.md
@@ -343,6 +343,12 @@ This establishes a retirement defect and its local repair, not the cause of
 every reported Windows 11 border: denied consent and other active captures
 remain distinct Windows-owned limits.
 
+The upstream [display-resolution change report](https://github.com/robmikh/Win32CaptureSample/issues/59)
+is still open as of 2026-10-07: it reports borderless display capture losing that
+preference after a mode change. It gives neither a current Windows build nor a
+verified repair. Include display-mode changes in physical reproduction; this
+report alone does not justify toggling the property or restarting capture.
+
 An unofficial WGC-preserving option exists:
 [Windhawk's DWM Custom Projection Border](https://github.com/ramensoftware/windhawk-mods/blob/main/mods/dwm-custom-projection-border.wh.cpp)
 documents disabling the border on Windows 10 21H2. Source inspection confirms
diff --git a/docs/todo.md b/docs/todo.md
index df9357014..5752d56ff 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -17,9 +17,9 @@ Git/PRs own completed history.
   before accepting a changed contract.
 - [ ] **Windows 11 capture border remains visible.** Reopened by a new report
   on 2026-10-07. Recheck App/Browser capture ownership, border permission/API
-  results, live setting changes, concurrent captures and source-thumbnail
-  cancellation/retirement before attributing this to Windows. Obtain the
-  affected version/path/build when available; the report
+  results, live setting changes, display-mode changes, concurrent captures and
+  source-thumbnail cancellation/retirement before attributing this to Windows.
+  Obtain the affected version/path/build when available; the report
   does not yet identify them. [Capture evidence](./research/native-client-lifecycle.md#windows-capture-borders)
   owns the prior graceful-retirement and concurrent-capture checks.
 - [ ] **Independent Gitee mirror recovery.** Implementation and local acceptance

From eca1c6a373675f981b898e6ee0daf409ebafab13 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Thu, 8 Oct 2026 06:03:56 +0800
Subject: [PATCH 028/262] fix(capture): retain signals for in-flight Windows
 callbacks

Keep callback event handles alive through asynchronous WinRT dispatch in both capture and thumbnail paths. Remove the redundant stack-owned close flag and verify late callbacks cannot signal a replacement capture.
---
 native/capture/windows/capture_event.h        | 19 ++++++++++
 native/capture/windows/capture_target.cpp     | 17 ++++-----
 .../capture/windows/capture_target.test.cpp   | 31 ++++++++++++++++
 native/capture/windows/main.cpp               | 36 ++++++++-----------
 4 files changed, 70 insertions(+), 33 deletions(-)
 create mode 100644 native/capture/windows/capture_event.h

diff --git a/native/capture/windows/capture_event.h b/native/capture/windows/capture_event.h
new file mode 100644
index 000000000..c89861685
--- /dev/null
+++ b/native/capture/windows/capture_event.h
@@ -0,0 +1,19 @@
+#pragma once
+
+#include <windows.h>
+#include <winrt/base.h>
+
+#include <memory>
+#include <utility>
+
+namespace piik::capture {
+
+// Revocation does not join an in-flight WinRT callback. Let the delegate retain
+// its signal until the final callback returns, without retaining the capture.
+inline auto CaptureEventHandler(std::shared_ptr<winrt::handle> event) {
+  return [event = std::move(event)](const auto&, const auto&) {
+    SetEvent(event->get());
+  };
+}
+
+}  // namespace piik::capture
diff --git a/native/capture/windows/capture_target.cpp b/native/capture/windows/capture_target.cpp
index f9a789cc5..158a23823 100644
--- a/native/capture/windows/capture_target.cpp
+++ b/native/capture/windows/capture_target.cpp
@@ -18,6 +18,7 @@
 
 #include "capture_target.h"
 #include "capture_border.h"
+#include "capture_event.h"
 #include "capture_geometry.h"
 #include "capture_sdr.h"
 
@@ -489,7 +490,8 @@ HRESULT CaptureWithWgc(TargetKind kind, UINT64 source_id,
   Direct3D11CaptureFramePool pool{nullptr};
   GraphicsCaptureSession session{nullptr};
   CaptureBorder border;
-  HANDLE frame_ready = CreateEventW(nullptr, FALSE, FALSE, nullptr);
+  auto frame_ready = std::make_shared<winrt::handle>(
+      CreateEventW(nullptr, FALSE, FALSE, nullptr));
   winrt::event_token frame_token{};
   bool subscribed = false;
   HRESULT result = S_OK;
@@ -498,7 +500,7 @@ HRESULT CaptureWithWgc(TargetKind kind, UINT64 source_id,
     if (SUCCEEDED(result)) result = CreateWgcItem(kind, source_id, &item);
     if (SUCCEEDED(result)) {
       auto size = item.Size();
-      if (size.Width <= 0 || size.Height <= 0 || frame_ready == nullptr) {
+      if (size.Width <= 0 || size.Height <= 0 || !*frame_ready) {
         result = HRESULT_FROM_WIN32(ERROR_INVALID_DATA);
       } else {
         windows::CaptureDisplayColor display_color(kind, source_id);
@@ -508,15 +510,11 @@ HRESULT CaptureWithWgc(TargetKind kind, UINT64 source_id,
             capture_device, static_cast<DirectXPixelFormat>(color.Format()), 1,
             size);
         session = pool.CreateCaptureSession(item);
-        frame_token = pool.FrameArrived(
-            [frame_ready](const Direct3D11CaptureFramePool&,
-                          const winrt::Windows::Foundation::IInspectable&) {
-              if (frame_ready != nullptr) SetEvent(frame_ready);
-            });
+        frame_token = pool.FrameArrived(CaptureEventHandler(frame_ready));
         subscribed = true;
         border.Start(session);
         session.StartCapture();
-        const DWORD wait = WaitForSingleObject(frame_ready, 1'500);
+        const DWORD wait = WaitForSingleObject(frame_ready->get(), 1'500);
         border.Apply(session);
         if (wait != WAIT_OBJECT_0) {
           result = wait == WAIT_TIMEOUT
@@ -603,9 +601,6 @@ HRESULT CaptureWithWgc(TargetKind kind, UINT64 source_id,
   capture_device = nullptr;
   context.Reset();
   device.Reset();
-  if (frame_ready != nullptr) {
-    CloseHandle(frame_ready);
-  }
   if (uninitialize) {
     CoUninitialize();
   }
diff --git a/native/capture/windows/capture_target.test.cpp b/native/capture/windows/capture_target.test.cpp
index b3d9895cc..9f293fcc2 100644
--- a/native/capture/windows/capture_target.test.cpp
+++ b/native/capture/windows/capture_target.test.cpp
@@ -1,4 +1,8 @@
 #include "capture_target.h"
+#include "capture_event.h"
+
+#include <winrt/Windows.Foundation.h>
+#include <winrt/Windows.Graphics.Capture.h>
 
 #include <cassert>
 #include <iostream>
@@ -7,6 +11,32 @@
 
 namespace {
 
+void CheckInFlightCaptureEvent() {
+  using namespace winrt::Windows::Graphics::Capture;
+  using namespace winrt::Windows::Foundation;
+  // A dispatched delegate can outlive both revocation and the capture owner.
+  // Exercise the handler shared by streaming capture and source thumbnails.
+  for (const bool manual_reset : {false, true}) {
+    auto signal = std::make_shared<winrt::handle>(
+        CreateEventW(nullptr, manual_reset, FALSE, nullptr));
+    assert(*signal);
+    const HANDLE handle = signal->get();
+    std::weak_ptr<winrt::handle> lifetime = signal;
+    TypedEventHandler<Direct3D11CaptureFramePool, IInspectable> in_flight{
+        piik::capture::CaptureEventHandler(signal)};
+    signal.reset();
+    assert(!lifetime.expired());
+
+    winrt::handle replacement{CreateEventW(nullptr, FALSE, FALSE, nullptr)};
+    assert(replacement);
+    in_flight(nullptr, nullptr);
+    assert(WaitForSingleObject(handle, 0) == WAIT_OBJECT_0);
+    assert(WaitForSingleObject(replacement.get(), 0) == WAIT_TIMEOUT);
+    in_flight = nullptr;
+    assert(lifetime.expired());
+  }
+}
+
 void CheckOwnedApplicationWindow() {
   HWND owner = CreateWindowExW(0, L"STATIC", L"Piik enumeration owner",
       WS_OVERLAPPEDWINDOW, 0, 0, 320, 180, nullptr, nullptr, nullptr, nullptr);
@@ -57,6 +87,7 @@ int wmain(int count, wchar_t** arguments) {
     };
     return result == 0 && listed(arguments[2]) && !listed(arguments[3]) ? 0 : 1;
   }
+  CheckInFlightCaptureEvent();
   CheckOwnedApplicationWindow();
   // Enumeration and preview are separate operations. A once-listed window may
   // become hidden before WGC creates its item. Unsupported capture may return
diff --git a/native/capture/windows/main.cpp b/native/capture/windows/main.cpp
index 839e6b3d5..640a40c6c 100644
--- a/native/capture/windows/main.cpp
+++ b/native/capture/windows/main.cpp
@@ -31,6 +31,7 @@
 
 #include "capture_target.h"
 #include "capture_border.h"
+#include "capture_event.h"
 #include "capture_geometry.h"
 #include "capture_color.h"
 #include "capture_sdr.h"
@@ -1855,24 +1856,17 @@ void RunVideoCapture(ProductArguments arguments) {
   EnableFastCaptureUpdates(capture_session);
   piik::capture::CaptureBorder border;
 
-  UniqueHandle shutdown(CreateEventW(nullptr, TRUE, FALSE, nullptr));
-  UniqueHandle frame_ready(CreateEventW(nullptr, FALSE, FALSE, nullptr));
-  if (shutdown.get() == nullptr || frame_ready.get() == nullptr) {
+  auto shutdown = std::make_shared<winrt::handle>(
+      CreateEventW(nullptr, TRUE, FALSE, nullptr));
+  auto frame_ready = std::make_shared<winrt::handle>(
+      CreateEventW(nullptr, FALSE, FALSE, nullptr));
+  if (!*shutdown || !*frame_ready) {
     Check(HRESULT_FROM_WIN32(GetLastError()), "capture-events");
   }
 
-  std::atomic<bool> item_closed{false};
   auto frame_token = pool.FrameArrived(
-      [event = frame_ready.get()](const Direct3D11CaptureFramePool&,
-                                  const winrt::Windows::Foundation::IInspectable&) {
-        SetEvent(event);
-      });
-  auto closed_token = item.Closed(
-      [event = shutdown.get(), &item_closed](const GraphicsCaptureItem&,
-                                              const winrt::Windows::Foundation::IInspectable&) {
-        item_closed.store(true);
-        SetEvent(event);
-      });
+      piik::capture::CaptureEventHandler(frame_ready));
+  auto closed_token = item.Closed(piik::capture::CaptureEventHandler(shutdown));
   std::vector<std::unique_ptr<OutputWorker>> workers;
   std::atomic<bool> active_status_written{false};
   std::mutex failure_mutex;
@@ -1882,10 +1876,10 @@ void RunVideoCapture(ProductArguments arguments) {
       std::lock_guard<std::mutex> lock(failure_mutex);
       if (!failure) failure = error;
     }
-    SetEvent(shutdown.get());
+    SetEvent(shutdown->get());
   };
   auto cleanup = [&]() noexcept {
-    SetEvent(shutdown.get());
+    SetEvent(shutdown->get());
     writer.Stop();
     for (auto& worker : workers) worker->Stop();
     try {
@@ -1942,8 +1936,8 @@ void RunVideoCapture(ProductArguments arguments) {
       refresh_input = false;
     };
     const HANDLE window_waits[] = {
-        process.get(), shutdown.get(), frame_ready.get()};
-    const HANDLE display_waits[] = {shutdown.get(), frame_ready.get()};
+        process.get(), shutdown->get(), frame_ready->get()};
+    const HANDLE display_waits[] = {shutdown->get(), frame_ready->get()};
     bool source_was_minimized = false;
     for (;;) {
       if (window_target && IsIconic(reinterpret_cast<HWND>(
@@ -1976,10 +1970,8 @@ void RunVideoCapture(ProductArguments arguments) {
           std::lock_guard<std::mutex> lock(failure_mutex);
           if (failure) std::rethrow_exception(failure);
         }
-        if (item_closed.load()) {
-          Fail("capture-closed", "selected source stopped capture");
-        }
-        Fail("capture-stopped", "source capture stopped");
+        // A worker failure was handled above; the other live wake is item.Closed.
+        Fail("capture-closed", "selected source stopped capture");
       }
       if (wait == WAIT_TIMEOUT) {
         // An explicit output/control request may reuse a quiet source; silence is not EOF.

From 21afb4decee255483e146756d32cbb5d75ce7fd0 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Thu, 8 Oct 2026 06:09:58 +0800
Subject: [PATCH 029/262] fix(capture): queue Linux failures on the pipeline
 bus

Keep startup failures pending until the main loop dispatches them. Use the existing GStreamer bus lifetime instead of a callback that can run before startup or outlive shutdown.
---
 native/capture/linux/main.c      | 17 +++++++++--------
 native/capture/linux/main.test.c | 19 ++++++++++++++++++-
 2 files changed, 27 insertions(+), 9 deletions(-)

diff --git a/native/capture/linux/main.c b/native/capture/linux/main.c
index 855140635..dd6c75427 100644
--- a/native/capture/linux/main.c
+++ b/native/capture/linux/main.c
@@ -596,18 +596,16 @@ static NalSummary inspect_h264(const guint8 *data, gsize size) {
   return summary;
 }
 
-static gboolean quit_loop(gpointer data) {
-  CaptureRun *run = data;
-  g_main_loop_quit(run->loop);
-  return G_SOURCE_REMOVE;
-}
-
 static void fail_run(CaptureRun *run, const char *message) {
   g_mutex_lock(&run->lock);
   gboolean first = run->failure == NULL;
   if (first) run->failure = g_strdup(message);
   g_mutex_unlock(&run->lock);
-  if (first) g_main_context_invoke(NULL, quit_loop, run);
+  // MainContext.invoke can execute immediately before the loop starts, losing
+  // quit(). The pipeline bus queues the failure and owns its callback lifetime.
+  if (first) gst_element_post_message(run->pipeline,
+      gst_message_new_application(GST_OBJECT(run->pipeline),
+          gst_structure_new_empty("piik-capture-failed")));
 }
 
 static void fail_output(VideoOutput *output, const char *message) {
@@ -895,7 +893,10 @@ static GstPadProbeReturn output_input_frame(GstPad *pad, GstPadProbeInfo *info,
 static gboolean bus_message(GstBus *bus, GstMessage *message, gpointer data) {
   (void)bus;
   CaptureRun *run = data;
-  if (GST_MESSAGE_TYPE(message) == GST_MESSAGE_ERROR) {
+  if (GST_MESSAGE_TYPE(message) == GST_MESSAGE_APPLICATION &&
+      gst_message_has_name(message, "piik-capture-failed")) {
+    g_main_loop_quit(run->loop);
+  } else if (GST_MESSAGE_TYPE(message) == GST_MESSAGE_ERROR) {
     GError *error = NULL;
     char *debug = NULL;
     gst_message_parse_error(message, &error, &debug);
diff --git a/native/capture/linux/main.test.c b/native/capture/linux/main.test.c
index 591b59e84..142a04748 100644
--- a/native/capture/linux/main.test.c
+++ b/native/capture/linux/main.test.c
@@ -62,8 +62,15 @@ static void check_encoder_admission_and_control(void) {
   gst_object_unref(encoder);
 }
 
+static gboolean capture_failure_timeout(gpointer data) {
+  (void)data;
+  g_error("capture failure was lost before the main loop started");
+  return G_SOURCE_REMOVE;
+}
+
 static void check_bus_error_retains_primary_cause(void) {
-  CaptureRun run = {.loop = g_main_loop_new(NULL, FALSE), .output_count = 1};
+  CaptureRun run = {.loop = g_main_loop_new(NULL, FALSE), .output_count = 1,
+                    .pipeline = gst_pipeline_new(NULL)};
   g_mutex_init(&run.lock);
   run.outputs[0].run = &run;
   run.outputs[0].encoder = gst_element_factory_make("identity", NULL);
@@ -85,9 +92,19 @@ static void check_bus_error_retains_primary_cause(void) {
   unlink(frame_path);
   g_free(frame_path);
   g_assert_cmpstr(run.failure, ==, error->message);
+  // Startup callbacks can fail before the bus watch/main loop is running.
+  // The recorded failure must still retire the pipeline once dispatch starts.
+  GstBus *bus = gst_element_get_bus(run.pipeline);
+  guint watch = gst_bus_add_watch(bus, bus_message, &run);
+  guint timeout = g_timeout_add(500, capture_failure_timeout, NULL);
+  g_main_loop_run(run.loop);
+  g_source_remove(timeout);
+  g_source_remove(watch);
+  gst_object_unref(bus);
   gst_message_unref(message);
   g_error_free(error);
   gst_object_unref(run.outputs[0].encoder);
+  gst_object_unref(run.pipeline);
   g_free(run.failure);
   g_main_loop_unref(run.loop);
   g_mutex_clear(&run.lock);

From f9d3d450f760313b8277c3026bd04caf313a45d7 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Thu, 8 Oct 2026 06:26:30 +0800
Subject: [PATCH 030/262] docs(server): explain current HTTP and service
 ownership

---
 internal/server/app/access.go | 16 +++++--------
 internal/server/app/app.go    | 45 ++++++++++++++---------------------
 internal/server/app/json.go   | 26 +++++++-------------
 internal/server/app/routes.go | 29 ++++++++--------------
 internal/server/app/static.go | 24 +++++++------------
 5 files changed, 50 insertions(+), 90 deletions(-)

diff --git a/internal/server/app/access.go b/internal/server/app/access.go
index f2a2b1ec8..ae5451052 100644
--- a/internal/server/app/access.go
+++ b/internal/server/app/access.go
@@ -68,7 +68,7 @@ func (s *Server) siteAccessForRequest(request *http.Request) *siteAccessGate {
 	return &access
 }
 
-// newSiteAccess mirrors the SiteAccess constructor, including its TTL check.
+// newSiteAccess creates one process-scoped cookie authority.
 func newSiteAccess(options siteAccessOptions) (*siteAccessGate, error) {
 	ttlSeconds := options.TTLSeconds
 	if ttlSeconds == 0 {
@@ -100,13 +100,12 @@ func (a *siteAccessGate) required() bool {
 	return a.password != ""
 }
 
-// passwordMatches mirrors passwordMatches: an unset password accepts anything,
-// a set password needs a non-empty exact match.
+// An unset password permits entry; a configured password requires an exact match.
 func (a *siteAccessGate) passwordMatches(value string) bool {
 	return !a.required() || (value != "" && secretMatches(value, a.password))
 }
 
-// isAuthenticated mirrors isAuthenticated over a raw Cookie request header.
+// isAuthenticated verifies the cookie signature and expiry when access is required.
 func (a *siteAccessGate) isAuthenticated(cookieHeader string) bool {
 	if !a.required() {
 		return true
@@ -134,8 +133,7 @@ func (a *siteAccessGate) isAuthenticated(cookieHeader string) bool {
 	return secretMatches(segments[2], a.sign(segments[0]+"."+segments[1]))
 }
 
-// createCookie mirrors createCookie and returns the Set-Cookie header value,
-// or "" where TS returned undefined (site access is not required).
+// createCookie returns a Set-Cookie value, or "" when access is not required.
 func (a *siteAccessGate) createCookie() string {
 	if !a.required() {
 		return ""
@@ -143,7 +141,6 @@ func (a *siteAccessGate) createCookie() string {
 	expiresAt := floorSeconds(a.now()) + int64(a.ttlSeconds)
 	payload := cookieVersion + "." + strconv.FormatInt(expiresAt, 10)
 	value := payload + "." + a.sign(payload)
-	// Attribute order is the TS array order; the app writes it verbatim.
 	attributes := []string{
 		a.cookieName() + "=" + value,
 		"Path=/",
@@ -180,8 +177,7 @@ func floorSeconds(milliseconds int64) int64 {
 	return seconds
 }
 
-// readCookie mirrors the TS reader: the first part whose trimmed name matches
-// wins, and an empty value counts as absent.
+// readCookie uses the first matching name; an empty value counts as absent.
 func readCookie(header string, name string) string {
 	for _, part := range strings.Split(header, ";") {
 		separator := strings.IndexByte(part, '=')
@@ -193,7 +189,7 @@ func readCookie(header string, name string) string {
 }
 
 // secretMatches compares through SHA-256 digests so the comparison is constant
-// time regardless of length, exactly as the TS helper does.
+// time regardless of length.
 func secretMatches(actual string, expected string) bool {
 	actualDigest := sha256.Sum256([]byte(actual))
 	expectedDigest := sha256.Sum256([]byte(expected))
diff --git a/internal/server/app/app.go b/internal/server/app/app.go
index 1255087f0..4f3e75b47 100644
--- a/internal/server/app/app.go
+++ b/internal/server/app/app.go
@@ -41,21 +41,19 @@ import (
 
 // HTTP request, header and keep-alive deadlines.
 const (
-	requestTimeout   = 10 * time.Second // httpServer.requestTimeout
-	headersTimeout   = 15 * time.Second // httpServer.headersTimeout
-	keepAliveTimeout = 5 * time.Second  // httpServer.keepAliveTimeout
+	requestTimeout   = 10 * time.Second
+	headersTimeout   = 15 * time.Second
+	keepAliveTimeout = 5 * time.Second
 )
 
-// Options is CreateServerOptions. Every zero value means the TS `undefined`.
+// Options supplies service configuration and optional lifecycle dependencies.
 type Options struct {
 	// Config is the loaded server configuration; cmd owns config.Load / Local.
 	Config config.Config
 	// Listener is optional prebound TCP ownership transferred on successful New.
-	// It lets the Local Client reserve its HTTP port before opening a tunnel.
+	// It lets the Local App reserve its HTTP port before opening a tunnel.
 	Listener *net.TCPListener
-	// Assets is the built Browser UI. A nil FS serves the API only, which is
-	// the TS frontend mode "none"; webassets.FS() returns nil the same way
-	// when no build was embedded.
+	// Assets is the built Browser UI. A nil FS serves the API only.
 	Assets fs.FS
 	// Now returns Unix milliseconds; nil uses the wall clock.
 	Now func() int64
@@ -75,7 +73,7 @@ type Options struct {
 	RoomStore *room.Store
 }
 
-// Server is PiikServer.
+// Server owns one shared HTTP, room-authority and media service lifecycle.
 type Server struct {
 	config        config.Config
 	store         *room.Store
@@ -108,9 +106,7 @@ type Server struct {
 	shutdownErr  error
 }
 
-// New is createPiikServer minus the listening: it builds the SFU fallback,
-// the room store, the site-access issuer, the frontend handler and the HTTP
-// server, none of which performs I/O.
+// New composes the service without binding sockets or opening the room database.
 func New(options Options) (*Server, error) {
 	configuration := options.Config
 	now := options.Now
@@ -156,9 +152,7 @@ func New(options Options) (*Server, error) {
 		EndpointMediaCopyCapacity: configuration.EndpointMediaCopyCapacity,
 		SfuOnly:                   configuration.SFU != nil && configuration.SFU.Only,
 		Ice:                       config.IceConfig(configuration),
-		// The TS signaling server read natPredictionEnabled off the same
-		// `ice` options object it forwarded; the Go IceConfig is already the
-		// wire shape, so the capability travels beside it.
+		// The prediction capability is separate from the wire-shaped ICE settings.
 		NATPredictionEnabled: configuration.NATPredictionEnabled,
 		AllowedOrigins:       configuration.AllowedOrigins,
 		SiteAccessAtUpgrade: func(request *http.Request) bool {
@@ -180,13 +174,13 @@ func New(options Options) (*Server, error) {
 		ReadHeaderTimeout: headersTimeout,
 		ReadTimeout:       requestTimeout,
 		IdleTimeout:       keepAliveTimeout,
-		// No WriteTimeout: Node had none, and it would cut long downloads.
+		// No WriteTimeout: a fixed deadline would cut long asset downloads.
 	}
 	return server, nil
 }
 
-// newRoomStore builds the room store createPiikServer would otherwise take
-// from Options.RoomStore. An empty RoomDatabasePath is the memory-only mode.
+// newRoomStore uses the injected store or creates one from configuration.
+// An empty RoomDatabasePath selects memory-only authority.
 func newRoomStore(options Options) (*room.Store, error) {
 	if options.RoomStore != nil {
 		return options.RoomStore, nil
@@ -332,9 +326,8 @@ func (s *Server) reconcile() error {
 	if err := s.store.Initialize(); err != nil {
 		return err
 	}
-	// Holding mu across the check and the two stores is what made the TS
-	// single thread safe here: a shutdown that already set closing must never
-	// see traffic re-enabled behind it.
+	// Serialize publication with shutdown; once closing is set, startup must
+	// never re-enable traffic.
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	if s.closing {
@@ -355,14 +348,13 @@ func (s *Server) Close(ctx context.Context) error {
 	return s.shutdown(ctx, false)
 }
 
-// End is Close preceded by ending every room. The Client uses it, because its
+// End is Close preceded by ending every room. The Local App uses it, because its
 // authority dies with the process.
 func (s *Server) End(ctx context.Context) error {
 	return s.shutdown(ctx, true)
 }
 
-// shutdown is memoised exactly as the TS shutdownOperation was: the second
-// caller joins the first and gets its result, whichever entry point it used.
+// Every shutdown caller joins the first operation and receives the same result.
 func (s *Server) shutdown(ctx context.Context, endRooms bool) error {
 	s.shutdownOnce.Do(func() { s.shutdownErr = s.runShutdown(ctx, endRooms) })
 	return s.shutdownErr
@@ -398,9 +390,8 @@ func (s *Server) runShutdown(ctx context.Context, endRooms bool) error {
 	return nil
 }
 
-// endAllRooms is the TS `signaling ? signaling.endAllRooms() :
-// roomStore.abandonAllRooms()`: without a signaling server nobody is connected,
-// so the store can be closed down directly.
+// Without signaling no participant is connected, so room authority can be
+// retired directly; otherwise signaling owns participant and media teardown.
 func (s *Server) endAllRooms(signaling *signal.Server) error {
 	if signaling != nil {
 		return signaling.EndAllRooms()
diff --git a/internal/server/app/json.go b/internal/server/app/json.go
index c5affdc74..5226ba0c1 100644
--- a/internal/server/app/json.go
+++ b/internal/server/app/json.go
@@ -35,7 +35,7 @@ type siteAccessBody struct {
 func sendJSON(writer http.ResponseWriter, status int, body any) {
 	var buffer bytes.Buffer
 	encoder := json.NewEncoder(&buffer)
-	// JSON.stringify does not escape HTML either.
+	// Responses have a JSON content type and are never embedded into HTML.
 	encoder.SetEscapeHTML(false)
 	if err := encoder.Encode(body); err != nil {
 		panic(err)
@@ -75,21 +75,13 @@ func hasRequestBody(request *http.Request) bool {
 	return len(request.TransferEncoding) > 0 || request.ContentLength != 0
 }
 
-// requestPath is the WHATWG `url.pathname` app.ts routed and logged on. It is
-// the escaped path on purpose: `new URL()` does not percent-decode, so
-// "/api%2frooms" must not reach the /api/rooms route.
-//
-// Deviation: `new URL()` also resolves "." and ".." segments, which net/http
-// leaves in the path. "/x/../api/rooms" therefore reaches the frontend handler
-// here where TypeScript routed it to room creation. Only stricter: a raw path
-// that already names a route still matches, so nothing can slip past an origin,
-// cookie or token check that way.
+// requestPath matches API routes without decoding separators or normalizing
+// dot segments: "/api%2frooms" and "/x/../api/rooms" cannot alias /api/rooms.
 func requestPath(request *http.Request) string {
 	return request.URL.EscapedPath()
 }
 
-// cookieHeader rebuilds the single Cookie header value the Node parser handed
-// to access-session.ts; Go keeps repeated Cookie headers apart.
+// cookieHeader joins repeated Cookie headers before the shared cookie reader.
 func cookieHeader(request *http.Request) string {
 	return strings.Join(request.Header.Values("Cookie"), "; ")
 }
@@ -104,10 +96,8 @@ func bearerToken(request *http.Request) string {
 	return strings.TrimPrefix(authorization, "Bearer ")
 }
 
-// isUpgradeRequest reproduces the condition under which Node emitted "upgrade"
-// instead of "request": the parser needs both a Connection: upgrade token and
-// an Upgrade header. The SignalingServer, not this router, owns the rejection
-// ladder for a path or query that is not exactly /signal.
+// Upgrades require both a Connection: upgrade token and an Upgrade header.
+// Signaling owns validation of the exact /signal path, query and admission.
 func isUpgradeRequest(request *http.Request) bool {
 	if request.Header.Get("Upgrade") == "" {
 		return false
@@ -120,8 +110,8 @@ func isUpgradeRequest(request *http.Request) bool {
 	return false
 }
 
-// responseRecorder tracks response.headersSent so the recover wrapper can pick
-// between the JSON 500 and destroying the connection, as app.ts did.
+// responseRecorder lets panic recovery send JSON only before a response starts;
+// a partial response must instead abort the connection.
 type responseRecorder struct {
 	http.ResponseWriter
 	wrote bool
diff --git a/internal/server/app/routes.go b/internal/server/app/routes.go
index 278f51820..7a69e23fb 100644
--- a/internal/server/app/routes.go
+++ b/internal/server/app/routes.go
@@ -48,8 +48,7 @@ func (s *Server) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
 	}
 	signaling := s.signaling.Load()
 	if isUpgradeRequest(request) {
-		// Node routed every upgrade to the SignalingServer's "upgrade"
-		// listener, which was attached only while traffic was accepted.
+		// Signaling owns every upgrade, including rejection of invalid paths.
 		signaling.ServeHTTP(recorder, request)
 		return
 	}
@@ -122,8 +121,7 @@ func (s *Server) route(
 	notFoundJSON(writer, request)
 }
 
-// notFoundJSON is the fallthrough app.ts handed to sirv as its next()
-// callback and used when no frontend is composed at all.
+// notFoundJSON handles missing assets and requests without a composed frontend.
 func notFoundJSON(writer http.ResponseWriter, _ *http.Request) {
 	sendJSON(writer, http.StatusNotFound, errorBody{"Not found"})
 }
@@ -145,7 +143,7 @@ func allowMethod(writer http.ResponseWriter, request *http.Request, allowed stri
 	return false
 }
 
-// handleSiteAccess is handleSiteAccessRequest of app.ts.
+// handleSiteAccess reports or grants site access without claiming room authority.
 func (s *Server) handleSiteAccess(writer http.ResponseWriter, request *http.Request) {
 	noStoreJSON(writer)
 	access := s.siteAccessForRequest(request)
@@ -156,8 +154,7 @@ func (s *Server) handleSiteAccess(writer http.ResponseWriter, request *http.Requ
 			Authenticated: access.isAuthenticated(cookieHeader(request)),
 		}
 		if status.Required && status.Authenticated {
-			// The Set-Cookie value is written verbatim, in the TS attribute
-			// order.
+			// Authenticated visits renew the site's idle access lifetime.
 			writer.Header().Set("Set-Cookie", access.createCookie())
 		}
 		sendJSON(writer, http.StatusOK, status)
@@ -312,13 +309,8 @@ func (s *Server) handleRoomCreation(
 		sendJSON(writer, http.StatusBadRequest, errorBody{"Invalid room request"})
 		return
 	}
-	// TS called roomStore.createRoom directly; the store is now guarded by the
-	// signaling server's global mutex, so creation goes through it. There is
-	// no `signaling == nil` answer here, because app.ts had no getSignaling()
-	// check on this route: reconcile stores the signaling server before it
-	// sets acceptingTraffic and never clears it again, so reaching a handler
-	// at all means the pointer is set (the two sibling room routes keep their
-	// 503 only because the TypeScript had one).
+	// Signaling owns room mutations. Startup publishes it before accepting
+	// traffic, and shutdown retains the pointer for requests already admitted.
 	created, err := signaling.CreateRoom(
 		parsed.CodeEntryPolicy,
 		parsed.RoomPassword.Value,
@@ -335,8 +327,8 @@ func (s *Server) handleRoomCreation(
 	sendJSON(writer, http.StatusCreated, s.createRoomResponse(created))
 }
 
-// authorizedRoomHostToken of app.ts: origin, then site access, then the bearer
-// Host token, each with its own terminal response.
+// authorizedRoomHostToken checks origin, site access and the bearer Host token
+// in that order, each with its own terminal response.
 func (s *Server) authorizedRoomHostToken(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -424,8 +416,7 @@ func roomErrorCode(err error) room.ErrorCode {
 	return ""
 }
 
-// replacementFailure maps replaceRoom errors; an unmapped error rethrows into
-// the 500 handler, as the TS `throw error` did.
+// replacementFailure maps room replacement errors; unmapped errors reach the 500 handler.
 func replacementFailure(err error) (int, string, bool) {
 	switch roomErrorCode(err) {
 	case room.CodeRoomLimit:
@@ -439,7 +430,7 @@ func replacementFailure(err error) (int, string, bool) {
 }
 
 // accessFailure maps updateRoomAccess errors. Unlike the other two tables,
-// every remaining RoomStoreError is a 404; only a non-store error rethrows.
+// every remaining RoomStoreError is a 404; non-store errors reach the 500 handler.
 func accessFailure(err error) (int, string, bool) {
 	switch code := roomErrorCode(err); code {
 	case "":
diff --git a/internal/server/app/static.go b/internal/server/app/static.go
index 9c17f1171..24aaa83b3 100644
--- a/internal/server/app/static.go
+++ b/internal/server/app/static.go
@@ -16,7 +16,7 @@ import (
 // depend on the machine; with X-Content-Type-Options: nosniff a wrong type on a
 // font or a webmanifest is user visible.
 var staticContentTypes = map[string]string{
-	".html":        "text/html;charset=utf-8", // sirv appends ";charset=utf-8" with no space
+	".html":        "text/html;charset=utf-8",
 	".htm":         "text/html;charset=utf-8",
 	".js":          "text/javascript",
 	".mjs":         "text/javascript",
@@ -39,7 +39,7 @@ var staticContentTypes = map[string]string{
 	".webmanifest": "application/manifest+json",
 	".bin":         "application/octet-stream",
 	".xml":         "text/xml",
-	".ico":         "", // mrmime has no .ico, so sirv sends an EMPTY Content-Type
+	".ico":         "", // Preserve the published empty type without sniffing.
 }
 
 // staticHandler serves embedded assets and falls back to index.html for SPA
@@ -78,13 +78,11 @@ func staticHandler(assets fs.FS, notFound http.Handler) http.Handler {
 			return true
 		}
 
-		// sirv strips a trailing "/" before the lookup, and its FILES map holds
-		// files only, so "/assets/" can never hit a file.
+		// A trailing slash cannot name an asset file.
 		if !strings.HasSuffix(request.URL.Path, "/") && serve(name) {
 			return
 		}
-		// opts.single: fall back to index.html unless the request matches one
-		// of sirv's two default ignores.
+		// Route-like paths use the SPA; files and .well-known requests do not.
 		if !looksLikeFile(cleaned) && !strings.Contains(cleaned, "/.well-known") {
 			if serve("index.html") {
 				return
@@ -94,9 +92,7 @@ func staticHandler(assets fs.FS, notFound http.Handler) http.Handler {
 	})
 }
 
-// hasDotSegment reports whether any path segment starts with '.', reproducing
-// totalist's filter `!opts.dotfiles && /(^\.|[\\+|\/+]\.)/.test(name)` together
-// with the `/\.well-known[\\+\/]/` exemption that runs before it.
+// hasDotSegment excludes hidden assets, with the published .well-known exemption.
 func hasDotSegment(name string) bool {
 	if strings.Contains(name, ".well-known/") {
 		return false
@@ -109,13 +105,9 @@ func hasDotSegment(name string) bool {
 	return false
 }
 
-// looksLikeFile ports sirv's default "any extn" ignore,
-// /[/]([A-Za-z\s\d~$._-]+\.\w+){1,}$/. Because the character class excludes
-// "/" and the match is anchored at the end, only the last path segment can
-// match: it must contain a dot with a non-empty [A-Za-z0-9_] extension after
-// it, and everything before that dot must be in the class. The class is
-// ASCII-only, so "/文件.js" and "/café.css" are NOT ignored and do get the
-// index.html fallback.
+// looksLikeFile preserves the published SPA fallback boundary: the last path
+// segment needs an ASCII-style basename and a nonempty alphanumeric/underscore
+// extension. Names such as "/文件.js" and "/café.css" still reach the SPA.
 func looksLikeFile(pathname string) bool {
 	slash := strings.LastIndexByte(pathname, '/')
 	if slash < 0 {

From 16d6b397a7dcbceb5d0f4e02a48456cb6dd687c0 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Thu, 8 Oct 2026 12:19:16 +0800
Subject: [PATCH 031/262] docs(nat): clarify outstanding Magicsock integration
 gates

---
 docs/research/nat-traversal.md | 20 ++++++++++++++++++++
 docs/todo.md                   | 10 +++++++---
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 0a8555cd7..d80fe1116 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -406,6 +406,26 @@ The related [Pion feedback-MTU report](https://github.com/pion/interceptor/issue
 remains open as of 2026-10-07. Its out-of-order packet evidence does not establish
 the cause of any Piik field report; the pinned recorder has no byte-size option.
 
+A 2026-10-08 reordering control flushed twelve 100-arrival reports, then supplied
+one delayed packet. The recorder included already reported history and generated
+a 1248-byte encrypted report from that one new arrival. Shortening the feedback
+interval alone cannot bound its size. Windows and three Linux race repetitions
+passed the reproduction. The latest tagged
+[interceptor v0.1.49 recorder](https://github.com/pion/interceptor/blob/v0.1.49/pkg/twcc/twcc.go)
+is byte-identical to the pinned recorder; Tailcat's
+[October 7 revision](https://github.com/tailscale/tailcat/blob/52fbad323e9d352f1febb623e0975368e9a8cbdd/tailcat.go#L574) retains
+the same payload limit and Tailscale dependency. A dependency bump does not
+supply the missing per-report and compound-batch size boundary.
+
+The same Linux kernel lab also compared established Pion and Tailcat SRTP under
+delay/jitter, 5% packet loss, reordering and a 350 ms complete interruption.
+DERP was closed before these phases. Both retained their session and resumed
+fresh media after restoration in three race-detector repetitions. Fresh payload
+tags and unique sequence counts exclude queued or duplicate-packet success.
+The original NAT and rebinding matrix repeated its prior outcomes. These controls
+add bounded weak-network recovery evidence, not decoded quality or a demonstrated
+direct-reachability advantage.
+
 Kernel gateway rebinding retained full WebRTC sessions. With DERP available,
 fresh media resumed in about 6.4–6.5 seconds and ICE reported `connected` in about
 7.1–8.1 seconds, without new SDP. With DERP closed, neither gateway direction
diff --git a/docs/todo.md b/docs/todo.md
index 5752d56ff..2c8dbfe90 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -1,6 +1,6 @@
 # Current TODO Ledger
 
-Last reviewed: 2026-10-07
+Last reviewed: 2026-10-08
 
 The current 2.0 preparation includes independent investigation across this
 ledger. Explicit owner holds remain in force; an investigation does not itself
@@ -61,8 +61,12 @@ Implementation needs a concrete useful result within the product model.
   have not established improved direct reachability. Seek a repeatable benefit
   before accepting peer-key authorization/revocation, underlay readiness and
   relay operation. The isolated feedback check also requires a supported RTCP
-  size boundary for the tunnel's MTU. Keep the experiment separate from product
-  routing; the P2P evidence work below owns the network/interop acceptance boundary.
+  size boundary for the tunnel's MTU, including reordered-history reports and
+  compound batches; shorter feedback intervals and the checked upstream updates
+  do not supply it. Kernel NAT, dual-stack, mapping replacement and bounded
+  loss/reordering checks exist, but do not establish that benefit. Keep the
+  experiment separate from product routing; the P2P evidence work below owns
+  the network/interop acceptance boundary.
 - [ ] **Managed Demo hosting.** The [provider assessment](./operations/website.md#managed-hosting-assessment)
   identifies UDP/storage requirements but establishes no cost saving. Keep the
   existing P2P-only Demo until a provider and operating boundary are accepted.

From d918bb53eb5a3114fba995f6baf6401a459c83d1 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Thu, 8 Oct 2026 12:54:46 +0800
Subject: [PATCH 032/262] fix(presentation): align docs branding and clarify
 SFU diagnostics

---
 docs/research/nat-traversal.md                   | 12 ++++++++++++
 docs/todo.md                                     |  7 ++++++-
 internal/server/signal/router.go                 |  3 ++-
 internal/server/signal/router_sfu_signal_test.go |  3 +++
 site/assets/brand.css                            |  6 +++---
 site/assets/brand.js                             |  6 +++++-
 site/docs/.vitepress/config.mjs                  |  1 +
 site/docs/.vitepress/theme/index.js              |  6 +++---
 site/docs/.vitepress/theme/style.css             |  3 +--
 9 files changed, 36 insertions(+), 11 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index d80fe1116..9ab773b60 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -417,6 +417,18 @@ is byte-identical to the pinned recorder; Tailcat's
 the same payload limit and Tailscale dependency. A dependency bump does not
 supply the missing per-report and compound-batch size boundary.
 
+A local upstream-layer repair candidate now bounds TWCC reports through the
+existing recorder split loop and sends them separately before encryption. Its
+fixed 1200-byte plaintext budget is experimental, not a supported upstream
+option. Unit checks preserve loss, reordered history, wrapped sequence numbers
+and arrival times; restoring either old recorder or writer fails its regression
+check. A real interceptor-to-Tailcat control delivered all 1500 statuses in two
+reports after DERP closed, with a largest encrypted datagram of 1212 bytes.
+Windows and three Linux race repetitions passed, as did the upstream TWCC suite
+with the candidate. The isolated probe retains the opt-in patch and reproduction;
+production dependencies are unchanged. This narrows one integration obstacle,
+not the missing direct-reachability benefit or other feedback producers' bounds.
+
 The same Linux kernel lab also compared established Pion and Tailcat SRTP under
 delay/jitter, 5% packet loss, reordering and a 350 ms complete interruption.
 DERP was closed before these phases. Both retained their session and resumed
diff --git a/docs/todo.md b/docs/todo.md
index 2c8dbfe90..d170af38d 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -63,7 +63,9 @@ Implementation needs a concrete useful result within the product model.
   relay operation. The isolated feedback check also requires a supported RTCP
   size boundary for the tunnel's MTU, including reordered-history reports and
   compound batches; shorter feedback intervals and the checked upstream updates
-  do not supply it. Kernel NAT, dual-stack, mapping replacement and bounded
+  do not supply it. An isolated upstream repair candidate passes actual encrypted
+  feedback and race checks; it is not a supported or adopted dependency change.
+  Kernel NAT, dual-stack, mapping replacement and bounded
   loss/reordering checks exist, but do not establish that benefit. Keep the
   experiment separate from product routing; the P2P evidence work below owns
   the network/interop acceptance boundary.
@@ -117,6 +119,9 @@ of a reporter's cause; research owns the completed experiments and their limits.
   [#453](https://github.com/TNTcraftHIM/Piik/issues/453) has no matched endpoint
   reports to distinguish network reachability from a product failure.
   The v1.6.3 candidate-timeout report lacks share-start and SDP/ICE evidence.
+  A self-hosted SFU report supplies only a screenshot of a third-party diagnosis;
+  obtain the original Viewer decode/`route-ready` events and matching Server
+  revision before attributing timeout to the committed-publication flag.
 - [ ] **Camera and Host microphone device coverage.** Check real audio levels,
   echo, device replacement/native mixing and phone camera permission, orientation
   and background behavior. Include OBS virtual-camera/audio-input sound quality
diff --git a/internal/server/signal/router.go b/internal/server/signal/router.go
index 701a4ebed..a0951e2b8 100644
--- a/internal/server/signal/router.go
+++ b/internal/server/signal/router.go
@@ -714,6 +714,7 @@ func (r *router) handleRouteReady(participant authenticatedRouteParticipant, mes
 		"participant", r.debugPeer(participant.roomID, participant.peerID),
 		"revision", revision,
 		"accepted", settled.Accepted,
+		"committed", settled.Committed,
 		"exhausted", len(settled.FailedPeerIDs) > 0)
 	r.releaseResources(settled.Released)
 	if settled.Committed && settled.Accepted {
@@ -1189,7 +1190,7 @@ func (r *router) broadcastActive(roomID string, rm *roomRuntime) {
 		r.debug(roomID, "active-topology",
 			"revision", snapshot.Revision,
 			"paused", snapshot.Paused,
-			"hostPublication", snapshot.HostPublication != nil && snapshot.HostPublication.PhysicalActive,
+			"committedHostPublication", snapshot.HostPublication != nil && snapshot.HostPublication.PhysicalActive,
 			"routes", routes)
 	}
 	assignments := r.assignments(roomID, snapshot, nil, "", "")
diff --git a/internal/server/signal/router_sfu_signal_test.go b/internal/server/signal/router_sfu_signal_test.go
index cfa4f6130..7b0487b97 100644
--- a/internal/server/signal/router_sfu_signal_test.go
+++ b/internal/server/signal/router_sfu_signal_test.go
@@ -221,6 +221,9 @@ func TestEmbeddedSfuAuthenticatedWebSocketCarriesActualRTP(t *testing.T) {
 		if room.controller.Operation() == nil {
 			t.Fatal("transport/RTP arrival committed without client decoded-frame proof")
 		}
+		if room.controller.Publication() != nil {
+			t.Fatal("preparing media was advertised as a committed Host publication")
+		}
 	})
 	viewer.sendJSON(map[string]any{"type": "route-ready", "revision": viewerConfig.Revision, "phase": "prepare"})
 	if !waitFor(t, time.Second, func() bool {
diff --git a/site/assets/brand.css b/site/assets/brand.css
index 15cc66772..4f078e784 100644
--- a/site/assets/brand.css
+++ b/site/assets/brand.css
@@ -1,8 +1,8 @@
-.identity { display:flex; gap:11px; align-items:center; text-decoration:none; font-size:32px; font-weight:800; letter-spacing:-.065em; line-height:1; color:inherit; }
+.identity { display:flex; gap:11px; align-items:baseline; text-decoration:none; font-size:32px; font-weight:800; letter-spacing:-.065em; line-height:1; color:inherit; }
 .identity .mascot { width:37px; height:37px; overflow:visible; }
 /* Align the feet with the wordmark baseline, allowing for the SVG's bottom inset. */
-.identity[data-brand],.footer-identity { align-items:baseline; }
-.identity[data-brand] .mascot,.footer-identity > svg { translate:0 .1em; }
+.footer-identity { align-items:baseline; }
+.identity .mascot,.footer-identity > svg { translate:0 .1em; }
 .identity-dot { color:#e4572e; }
 .identity .mascot-face,.identity .mascot-eye-open,.identity .mascot-sparkles { transform-box:fill-box; transform-origin:center; }
 @media (prefers-reduced-motion:no-preference) {
diff --git a/site/assets/brand.js b/site/assets/brand.js
index c2594636a..ee710100e 100644
--- a/site/assets/brand.js
+++ b/site/assets/brand.js
@@ -15,9 +15,13 @@ export function mascotMarkup(id, fill = 'none') {
     </g></g>`;
 }
 
+export function brandMarkup(id) {
+  return `<svg class="mascot" viewBox="0 0 32 32" aria-hidden="true">${mascotMarkup(id)}</svg><span>Piik<span class="identity-dot">.</span></span>`;
+}
+
 export function mountBrands() {
   document.querySelectorAll('[data-brand]').forEach((link, index) => {
-    link.innerHTML = `<svg class="mascot" viewBox="0 0 32 32" aria-hidden="true">${mascotMarkup(`brand-${index}`)}</svg><span>Piik<span class="identity-dot">.</span></span>`;
+    link.innerHTML = brandMarkup(`brand-${index}`);
     const replay = () => link.getAnimations({ subtree: true }).forEach(animation => { animation.currentTime = 0; });
     link.addEventListener('pointerenter', replay);
     link.addEventListener('focus', replay);
diff --git a/site/docs/.vitepress/config.mjs b/site/docs/.vitepress/config.mjs
index d889cc3c7..67d30a3e2 100644
--- a/site/docs/.vitepress/config.mjs
+++ b/site/docs/.vitepress/config.mjs
@@ -48,6 +48,7 @@ export default defineConfig({
     },
   },
   themeConfig: {
+    siteTitle: false,
     nav: [{ text: 'Website', link: 'https://piik.tv/?lang=en' }, { text: 'Use online', link: 'https://demo.piik.tv' }],
     socialLinks: [{ icon: 'github', link: repository }],
     outline: [2, 3],
diff --git a/site/docs/.vitepress/theme/index.js b/site/docs/.vitepress/theme/index.js
index 5035c263a..0f8681128 100644
--- a/site/docs/.vitepress/theme/index.js
+++ b/site/docs/.vitepress/theme/index.js
@@ -1,7 +1,7 @@
 import DefaultTheme from 'vitepress/theme-without-fonts';
 import { useData, withBase } from 'vitepress';
 import { h } from 'vue';
-import { mascotMarkup } from '../../../assets/brand.js';
+import { brandMarkup } from '../../../assets/brand.js';
 import { initialLanguage, rememberLanguage } from '../../../assets/language.js';
 import '../../../assets/brand.css';
 import './style.css';
@@ -11,8 +11,8 @@ export default {
   Layout() {
     const { lang } = useData();
     return h(DefaultTheme.Layout, null, {
-      'nav-bar-title-before': () => h('span', { class: 'identity', 'aria-hidden': 'true',
-        innerHTML: `<svg class="mascot" viewBox="0 0 32 32">${mascotMarkup('docs-brand')}</svg>` }),
+      'nav-bar-title-before': () => h('span', { class: 'identity',
+        innerHTML: brandMarkup('docs-brand') }),
       'doc-bottom': () => h('p', { class: 'docs-license' }, [
         h('a', { href: withBase('/third-party-licenses.txt') },
           lang.value === 'zh-CN' ? '第三方软件许可' : 'Third-party licenses'),
diff --git a/site/docs/.vitepress/theme/style.css b/site/docs/.vitepress/theme/style.css
index 978131391..a68df7e05 100644
--- a/site/docs/.vitepress/theme/style.css
+++ b/site/docs/.vitepress/theme/style.css
@@ -26,8 +26,7 @@
   --vp-c-divider: #3b5155;
   --vp-code-block-bg: #14232b;
 }
-.VPNavBarTitle .title { gap: 8px; font-size: 24px; font-weight: 800; letter-spacing: -.045em; }
-.VPNavBarTitle .title::after { content: "."; margin-left: -8px; color: #e4572e; }
+.VPNavBarTitle .identity { gap: 8px; font-size: 24px; letter-spacing: -.045em; }
 .VPNavBarTitle .mascot { width: 30px; height: 30px; }
 .vp-doc h1 { letter-spacing: -.035em; }
 .vp-doc p, .vp-doc li { line-height: 1.85; }

From ebff6382312468038a203875cffbd1a480664d49 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Thu, 8 Oct 2026 13:10:56 +0800
Subject: [PATCH 033/262] docs(media): record feedback and capture-border
 evidence limits

---
 docs/research/nat-traversal.md           | 10 +++++++++-
 docs/research/native-client-lifecycle.md |  8 ++++++++
 docs/todo.md                             | 15 ++++++++-------
 3 files changed, 25 insertions(+), 8 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 9ab773b60..5c59e0dae 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -427,7 +427,15 @@ reports after DERP closed, with a largest encrypted datagram of 1212 bytes.
 Windows and three Linux race repetitions passed, as did the upstream TWCC suite
 with the candidate. The isolated probe retains the opt-in patch and reproduction;
 production dependencies are unchanged. This narrows one integration obstacle,
-not the missing direct-reachability benefit or other feedback producers' bounds.
+not the missing direct-reachability benefit or a supported upstream MTU contract.
+
+The current Go feedback paths were also traced end to end. Pion's default NACK
+generator retains a 512-packet window and writes one report per media SSRC;
+a full-loss/wrapped-gap control with two SSRCs stays within 156 encrypted bytes.
+Normal sender/receiver reports are written separately per stream. Piik's SFU
+ingress callback forwards only PLI/FIR, and LiveKit's reachable XR response contains one
+DLRR block. No additional oversized producer was found in these paths; this
+does not bound arbitrary caller-created RTCP batches or future configurations.
 
 The same Linux kernel lab also compared established Pion and Tailcat SRTP under
 delay/jitter, 5% packet loss, reordering and a 350 ms complete interruption.
diff --git a/docs/research/native-client-lifecycle.md b/docs/research/native-client-lifecycle.md
index 291a7adfb..b6e2e30a5 100644
--- a/docs/research/native-client-lifecycle.md
+++ b/docs/research/native-client-lifecycle.md
@@ -343,6 +343,14 @@ This establishes a retirement defect and its local repair, not the cause of
 every reported Windows 11 border: denied consent and other active captures
 remain distinct Windows-owned limits.
 
+The source-preview call chain has a separate, finite lifetime. Closing the
+picker invalidates queued thumbnails and their results; it does not kill the
+in-flight helper. That helper closes its WGC session before writing the bitmap.
+Control-session loss or the three-second preview deadline can still terminate
+it through `CommandContext`. The 2026-10-08 review did not reproduce a retained
+border from this path. Its desktop-pixel control could not see the controlled
+source, so capture/permission logs alone were not accepted as visual evidence.
+
 The upstream [display-resolution change report](https://github.com/robmikh/Win32CaptureSample/issues/59)
 is still open as of 2026-10-07: it reports borderless display capture losing that
 preference after a mode change. It gives neither a current Windows build nor a
diff --git a/docs/todo.md b/docs/todo.md
index d170af38d..30c175b4a 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -15,13 +15,6 @@ Git/PRs own completed history.
   coherent candidate and stop before publication. Preserve the existing product
   model; evaluate held features against measurable benefit and total complexity
   before accepting a changed contract.
-- [ ] **Windows 11 capture border remains visible.** Reopened by a new report
-  on 2026-10-07. Recheck App/Browser capture ownership, border permission/API
-  results, live setting changes, display-mode changes, concurrent captures and
-  source-thumbnail cancellation/retirement before attributing this to Windows.
-  Obtain the affected version/path/build when available; the report
-  does not yet identify them. [Capture evidence](./research/native-client-lifecycle.md#windows-capture-borders)
-  owns the prior graceful-retirement and concurrent-capture checks.
 - [ ] **Independent Gitee mirror recovery.** Implementation and local acceptance
   are complete. Integrate through the next owner-approved publishing merge and
   verify the separate workflow with its original CI artifacts. Mirror failure
@@ -88,6 +81,14 @@ Implementation needs a concrete useful result within the product model.
 These reports remain unmatched. A local repair or successful test is not proof
 of a reporter's cause; research owns the completed experiments and their limits.
 
+- [ ] **Windows 11 capture border remains visible.** The new report does not
+  identify the affected version, capture path or Windows build. The reviewed
+  picker/start/source-change paths preserve the border preference; no additional
+  confirmed defect was found. [Capture evidence](./research/native-client-lifecycle.md#windows-capture-borders)
+  owns the permission correction, retirement checks and preview-cancellation
+  boundary. Visible permission changes, display-mode changes and the reporter's
+  setup still need matched physical evidence; API success does not prove that
+  Windows hid the border.
 - [ ] **macOS and Linux physical capture.** Complete the remaining capture/audio
   checks in [verification status](./verification-status.md#device-evidence-boundary),
   including an Intel Mac with a usable hardware H.264 encoder, an ARM64 Linux

From d9251c6364e0dd6cac5daa4ade449025c072c3f4 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Thu, 8 Oct 2026 13:48:24 +0800
Subject: [PATCH 034/262] docs(nat): record Magicsock authorization blockers

---
 docs/research/nat-traversal.md | 47 +++++++++++++++++++++++++++-------
 docs/todo.md                   |  6 ++++-
 2 files changed, 43 insertions(+), 10 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 5c59e0dae..05c6372af 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -320,14 +320,14 @@ isolated branch; production dependencies and routing remain unchanged.
 ### Integration Cost And Recovery Controls
 
 The isolated `spike/magicsock-assessment` branch retains the comparison probes.
-These nested Go modules are outside Piik's
-build and dependency graph. Repeated local Tailcat bootstrap, peer denial,
-revocation and synthetic SRTP media checks passed; the raw magicsock direct-path
-matrix again found the same reachable classes as fresh Pion ICE. Retired shared
-mapping-cache reproductions remain causal controls, not the current baseline.
+The nested modules are outside Piik's build. Local bootstrap, peer denial and
+synthetic SRTP media checks passed. Initial withdrawal checks observed stopped
+outbound media; the stronger authorization checks below found revocation defects.
+The raw magicsock direct-path matrix found the same reachable classes as fresh
+Pion ICE. Retired mapping-cache reproductions remain controls, not the baseline.
 
 [Tailcat](https://github.com/tailscale/tailcat/blob/b4dc28e8aa8936f0a90a41ad8293a64e3d6b645f/README.md)
-provides a supported Go reuse lead: magicsock plus WireGuard, with DERP bootstrap
+provides an upstream Go reuse candidate: magicsock plus WireGuard, with DERP bootstrap
 and relay fallback. Its Browser path at that pin is relay-only. In the isolated
 Linux kernel NAT comparison on 2026-10-05, both stacks connected directly through
 ordinary/ordinary and open/hard gateways in either direction. Neither delivered
@@ -365,9 +365,10 @@ adoption boundary.
 The 2026-10-07 experiment through `f0ca8056` keeps Pion's ICE/DTLS/SRTP over
 Tailcat. Each physical connection owns a virtual UDP tuple and mux; its one-shot
 listener retires after admission. Connections to one authorized peer may share
-the tunnel. Closing or aborting one flow preserves healthy siblings; revoking
-the fixture peer key denies admission and disconnects that tunnel. These checks
-do not implement Piik room grants or endpoint exchange.
+the tunnel. Closing or aborting one flow preserves healthy siblings. Initial
+revocation checks stopped outbound media and denied a fresh client; they did not
+prove that the old client's inbound traffic was rejected. These checks do not
+implement Piik room grants or endpoint exchange.
 
 Repeated lifecycle and Linux race checks cover overlapping media preparation,
 rollback, replacement, canceled preparation followed by retry, bounded datagrams
@@ -468,6 +469,34 @@ ignored. Further product work needs a measurable network benefit and accepted
 room authorization, resource and relay-operation owners, not more loopback
 successes.
 
+### Peer Authorization Boundary
+
+The 2026-10-08 three-peer control found that Tailcat forgets a revoked key but
+leaves its WireGuard session alive: fresh inbound UDP still arrives after
+`DisconnectClient` returns and `PeerKey` no longer recognizes it. A separate
+controlled race lets a late positive `AllowClient` result re-admit a revoked
+key. Both defects were independently reproduced; Tailcat's checked
+[October 7 source](https://github.com/tailscale/tailcat/blob/52fbad323e9d352f1febb623e0975368e9a8cbdd/tailcat.go)
+retains both mechanisms. Piik's current transport does not use this dependency.
+
+An opt-in patch syncs the existing engine after releasing the backend lock and
+invalidates late results in the existing pending-hook map. Three Windows and
+Linux race repetitions reject both traffic directions and new admission,
+preserve two healthy peers' media, and permit a later explicit grant. Removing
+either correction fails its regression; upstream admission/disconnect checks
+pass. This is a partial repair, not safe-to-adopt authorization.
+
+A deeper unit reproduction pauses WireGuard's lazy peer-config lookup, withdraws
+authority and calls `RemovePeer`, then releases the old result. `LookupPeer`
+still installs an active peer. Both the pinned `0a83b87f7908` and
+[October 2 revision](https://github.com/tailscale/wireguard-go/blob/18e99eba5393b8c9ea513ab7a1db1a12625422ca/device/device.go)
+reproduce it, including three Windows and Linux race repetitions on the newer
+version. This proves an authority/install race, not an end-to-end Piik exploit.
+A supported atomic retirement/creation boundary remains necessary below Tailcat;
+its partial patch cannot close that race. The probe retains the patch and failing
+reproduction. Piik deny lists or repeated resets are not substitutes. This,
+feedback sizing and unproven direct-reachability gains block product adoption.
+
 ## Native Mapping Cache And Retry Lifetimes
 
 Pion ICE `v4.4.0` caches a shared socket's STUN mapping by destination for 25
diff --git a/docs/todo.md b/docs/todo.md
index 30c175b4a..af53972e4 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -53,7 +53,11 @@ Implementation needs a concrete useful result within the product model.
   [matched comparisons](./research/nat-traversal.md#integration-cost-and-recovery-controls)
   have not established improved direct reachability. Seek a repeatable benefit
   before accepting peer-key authorization/revocation, underlay readiness and
-  relay operation. The isolated feedback check also requires a supported RTCP
+  relay operation. The [authorization assessment](./research/nat-traversal.md#peer-authorization-boundary)
+  reproduces stale WireGuard sessions, late admission and a deeper lazy-peer
+  creation race. Two isolated Tailcat corrections pass bounded checks; the
+  lower-level race remains unresolved, so product adoption stays blocked.
+  The isolated feedback check also requires a supported RTCP
   size boundary for the tunnel's MTU, including reordered-history reports and
   compound batches; shorter feedback intervals and the checked upstream updates
   do not supply it. An isolated upstream repair candidate passes actual encrypted

From 08e97d7721328307236c580a0055139803da42ed Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Thu, 8 Oct 2026 14:09:10 +0800
Subject: [PATCH 035/262] docs(nat): record combined transport repair evidence

---
 docs/research/nat-traversal.md | 49 +++++++++++++++++-----------------
 docs/todo.md                   |  5 ++--
 2 files changed, 28 insertions(+), 26 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 05c6372af..a3ecfbd6d 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -304,18 +304,13 @@ hold endpoint pairs, NAT/filtering, IPv6, network transitions and relay policy
 constant, measuring direct success, relay use and first media separately.
 No new transport or universal success-rate claim is accepted by this review.
 
-The isolated `spike/magicsock-feasibility` Go experiment on 2026-10-04 carried
-Pion ICE/DTLS and matching synthetic audio/video RTP payloads over magicsock,
-then delivered new payloads after both UDP endpoints changed without new SDP.
-Loopback and separate address-and-port-filtering NATs passed, including five
-race-detector repetitions. The fixture supplied authenticated peer identities
-and endpoint updates; it did not test automatic OS network-change detection,
-decoded playback or real routers. A separate seven-pair NAT matrix found the
-same direct reachability as Pion within four-second windows, not a field success
-rate. Go integration is feasible; no Rust requirement was found. Product use
-still needs room-authorized key/endpoint exchange, MTU/resource limits and mixed
-Browser/Native behavior. The nested probe module and full evidence stay on that
-isolated branch; production dependencies and routing remain unchanged.
+The initial Go control carried Pion ICE/DTLS/SRTP over magicsock and delivered
+fresh media after both UDP endpoints changed without new SDP. Loopback and
+separate address-and-port-filtering NATs passed five race repetitions. The
+fixture supplied peer identities and endpoint updates; it did not prove automatic
+OS network-change detection, decoded playback or real-router behavior. Its
+seven-pair direct matrix matched Pion within four-second windows. Go reuse is
+feasible; product integration and network benefit require the controls below.
 
 ### Integration Cost And Recovery Controls
 
@@ -479,23 +474,29 @@ key. Both defects were independently reproduced; Tailcat's checked
 [October 7 source](https://github.com/tailscale/tailcat/blob/52fbad323e9d352f1febb623e0975368e9a8cbdd/tailcat.go)
 retains both mechanisms. Piik's current transport does not use this dependency.
 
-An opt-in patch syncs the existing engine after releasing the backend lock and
-invalidates late results in the existing pending-hook map. Three Windows and
-Linux race repetitions reject both traffic directions and new admission,
-preserve two healthy peers' media, and permit a later explicit grant. Removing
-either correction fails its regression; upstream admission/disconnect checks
-pass. This is a partial repair, not safe-to-adopt authorization.
+An opt-in Tailcat patch syncs the existing engine after releasing the backend
+lock and invalidates late results in its pending-hook map. Three Windows
+repetitions and three Linux race runs reject both traffic directions and new
+admission, preserve two healthy peers' media and permit a later explicit grant.
+Removing either correction fails its regression; upstream admission/disconnect
+checks pass. This repairs the Tailcat layer only.
 
 A deeper unit reproduction pauses WireGuard's lazy peer-config lookup, withdraws
 authority and calls `RemovePeer`, then releases the old result. `LookupPeer`
 still installs an active peer. Both the pinned `0a83b87f7908` and
 [October 2 revision](https://github.com/tailscale/wireguard-go/blob/18e99eba5393b8c9ea513ab7a1db1a12625422ca/device/device.go)
-reproduce it, including three Windows and Linux race repetitions on the newer
-version. This proves an authority/install race, not an end-to-end Piik exploit.
-A supported atomic retirement/creation boundary remains necessary below Tailcat;
-its partial patch cannot close that race. The probe retains the patch and failing
-reproduction. Piik deny lists or repeated resets are not substitutes. This,
-feedback sizing and unproven direct-reachability gains block product adoption.
+reproduce it. An isolated patch on the newer version fences late installation
+by the peer table's generation and starts lazy peers under that same lock.
+Removal, lookup replacement, close and regrant checks pass; removing the fence
+reproduces the failure. The full device suite passes on Windows and Linux
+(race detection on Linux), and its lock-order analyzer passes. Combined Tailcat/
+WireGuard media and bounded TWCC checks pass three repetitions on both platforms.
+The combined patches also preserve the kernel NAT, dual-stack, rebinding and
+weak-network results in the Linux race run.
+One removal also invalidates other pending lookups; existing media is untouched.
+This coarse experimental fence needs review before adoption. The probe retains
+the patches; supported dependency contracts and demonstrated network benefit
+remain open. Piik's production dependencies and routing are unchanged.
 
 ## Native Mapping Cache And Retry Lifetimes
 
diff --git a/docs/todo.md b/docs/todo.md
index af53972e4..141a2a31c 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -55,8 +55,9 @@ Implementation needs a concrete useful result within the product model.
   before accepting peer-key authorization/revocation, underlay readiness and
   relay operation. The [authorization assessment](./research/nat-traversal.md#peer-authorization-boundary)
   reproduces stale WireGuard sessions, late admission and a deeper lazy-peer
-  creation race. Two isolated Tailcat corrections pass bounded checks; the
-  lower-level race remains unresolved, so product adoption stays blocked.
+  creation race. Isolated Tailcat/WireGuard corrections pass bounded checks;
+  supported upstream fixes and the coarse generation fence's admission impact
+  still need review before product adoption.
   The isolated feedback check also requires a supported RTCP
   size boundary for the tunnel's MTU, including reordered-history reports and
   compound batches; shorter feedback intervals and the checked upstream updates

From 77e293fb0612d84551b9d28aaa90a624914333b5 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Thu, 8 Oct 2026 14:33:48 +0800
Subject: [PATCH 036/262] docs(nat): record scoped admission isolation evidence

---
 docs/research/nat-traversal.md | 24 ++++++++++++------------
 docs/todo.md                   |  4 ++--
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index a3ecfbd6d..1e771d94b 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -485,18 +485,18 @@ A deeper unit reproduction pauses WireGuard's lazy peer-config lookup, withdraws
 authority and calls `RemovePeer`, then releases the old result. `LookupPeer`
 still installs an active peer. Both the pinned `0a83b87f7908` and
 [October 2 revision](https://github.com/tailscale/wireguard-go/blob/18e99eba5393b8c9ea513ab7a1db1a12625422ca/device/device.go)
-reproduce it. An isolated patch on the newer version fences late installation
-by the peer table's generation and starts lazy peers under that same lock.
-Removal, lookup replacement, close and regrant checks pass; removing the fence
-reproduces the failure. The full device suite passes on Windows and Linux
-(race detection on Linux), and its lock-order analyzer passes. Combined Tailcat/
-WireGuard media and bounded TWCC checks pass three repetitions on both platforms.
-The combined patches also preserve the kernel NAT, dual-stack, rebinding and
-weak-network results in the Linux race run.
-One removal also invalidates other pending lookups; existing media is untouched.
-This coarse experimental fence needs review before adoption. The probe retains
-the patches; supported dependency contracts and demonstrated network benefit
-remain open. Piik's production dependencies and routing are unchanged.
+reproduce it. An isolated patch on the newer version tracks in-flight config
+lookups at the peer table and starts lazy peers under that same lock. Removing
+a key retires only its pending calls; lookup replacement and close retire all.
+Tokens are reclaimed on completion without accumulating historical keys.
+An unrelated-key control rejects a global generation fence: it cancels valid
+concurrent admission. Scoped tokens preserve that admission, overlapping grants
+and cleanup; removing the retirement check reproduces stale installation.
+The full device suite and lock-order analyzer pass, including three Linux race
+runs. Combined media and TWCC checks pass on Windows and Linux; the Linux kernel
+NAT, dual-stack, rebinding and weak-network controls also pass. Supported dependency
+contracts and demonstrated network benefit remain open. The probe retains the
+isolated patches; Piik's production transport is unchanged.
 
 ## Native Mapping Cache And Retry Lifetimes
 
diff --git a/docs/todo.md b/docs/todo.md
index 141a2a31c..7b5b00e0d 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -56,8 +56,8 @@ Implementation needs a concrete useful result within the product model.
   relay operation. The [authorization assessment](./research/nat-traversal.md#peer-authorization-boundary)
   reproduces stale WireGuard sessions, late admission and a deeper lazy-peer
   creation race. Isolated Tailcat/WireGuard corrections pass bounded checks;
-  supported upstream fixes and the coarse generation fence's admission impact
-  still need review before product adoption.
+  the scoped lookup fence also preserves unrelated concurrent admission.
+  Supported upstream fixes still need review before product adoption.
   The isolated feedback check also requires a supported RTCP
   size boundary for the tunnel's MTU, including reordered-history reports and
   compound batches; shorter feedback intervals and the checked upstream updates

From 213ffa5b18d38ac022eaaf19f6bbdcd12ffe3e97 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Thu, 8 Oct 2026 15:21:40 +0800
Subject: [PATCH 037/262] docs(nat): record native capability comparisons

---
 docs/research/nat-traversal.md | 27 +++++++++++++++++++++++----
 docs/todo.md                   |  5 +++--
 2 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 1e771d94b..6d2e88379 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -350,10 +350,9 @@ diagnostic Ping polling or wider product deadlines as integration shortcuts.
 
 Keep product integration conditional on a repeatable benefit on matched networks,
 with direct coverage, relay coverage, recovery and first picture measured
-separately. Go feasibility alone does not establish that benefit. Gateway
-mapping, Piik prediction, physical routers and the full mixed Piik topology
-remain outside the comparison. The isolated controls below do not change that
-adoption boundary.
+separately. Go feasibility alone does not establish that benefit. The actual
+Native-engine controls below cover gateway mapping, prediction and IPv6;
+physical routers and the full mixed Piik topology remain outside the comparison.
 
 ### Isolated Connection-Layer Acceptance
 
@@ -459,6 +458,26 @@ direct address did not establish that both directions were direct. IPv4 TCP
 still supplied bootstrap, so this is not an IPv6-only or physical ISP check.
 These controls add no demonstrated direct-reachability advantage for Magicsock.
 
+The actual Native `mediaedge.Engine` Host/Viewer now runs through the same kernel
+gateways, including local playback and the unchanged TypeScript survey predictor.
+Three Linux race repetitions received ten distinct RTP packets containing the
+generated VP8 frame, excluding padding/duplicates. With no gateway service,
+mapping enabled did not hold ordinary media behind discovery: delivery took
+about 0.8 seconds. Either usable IP family also carried media. Sequential-port
+NAT failed without prediction and delivered through a predicted candidate when
+enabled; random-port NAT remained unreachable in the bounded checks. A real
+MiniUPnPd gateway made a hard/hard pair reachable when mapping was enabled.
+These are encoded-media checks, not capture, Browser decode or room admission.
+
+Tailcat's matched controls explicitly link its [optional portmapper feature](https://github.com/tailscale/tailscale/blob/a0e471a35b8f/feature/portmapper/portmapper.go);
+clearing its disable flag alone does not register that optional feature. Gateway
+mapping then passed three race repetitions after DERP closure. The 20-second
+comparison distinguishes fresh direct SRTP from relay delivery and retains the
+same gateway filtering. Without mapping service, Tailcat's random and sequential
+pairs remained relay-only; no extra direct-reachability class over Piik was found.
+Its relay bootstrap and Piik's local playback differ, so their startup timings
+are not a first-picture benchmark. Product dependencies and routing are unchanged.
+
 The experiment's README owns commands and fixture boundaries; raw output remains
 ignored. Further product work needs a measurable network benefit and accepted
 room authorization, resource and relay-operation owners, not more loopback
diff --git a/docs/todo.md b/docs/todo.md
index 7b5b00e0d..2b96fa26d 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -63,8 +63,9 @@ Implementation needs a concrete useful result within the product model.
   compound batches; shorter feedback intervals and the checked upstream updates
   do not supply it. An isolated upstream repair candidate passes actual encrypted
   feedback and race checks; it is not a supported or adopted dependency change.
-  Kernel NAT, dual-stack, mapping replacement and bounded
-  loss/reordering checks exist, but do not establish that benefit. Keep the
+  Kernel checks now include Piik's actual Native engine, shared predictor and
+  real gateway mapping alongside dual-stack, mapping replacement and bounded
+  loss/reordering. They still do not establish extra direct reachability. Keep the
   experiment separate from product routing; the P2P evidence work below owns
   the network/interop acceptance boundary.
 - [ ] **Managed Demo hosting.** The [provider assessment](./operations/website.md#managed-hosting-assessment)

From be269532878376df6ac130353e9f3d39eacf4c60 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Thu, 8 Oct 2026 15:59:49 +0800
Subject: [PATCH 038/262] docs(nat): qualify multi-destination traversal
 evidence

---
 docs/research/nat-traversal.md | 22 +++++++++++++++++-----
 docs/todo.md                   |  7 ++++---
 2 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 6d2e88379..aee1453b4 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -465,7 +465,8 @@ generated VP8 frame, excluding padding/duplicates. With no gateway service,
 mapping enabled did not hold ordinary media behind discovery: delivery took
 about 0.8 seconds. Either usable IP family also carried media. Sequential-port
 NAT failed without prediction and delivered through a predicted candidate when
-enabled; random-port NAT remained unreachable in the bounded checks. A real
+enabled, with the changing-port gateway on either endpoint; random-port NAT
+remained unreachable in the bounded checks. A real
 MiniUPnPd gateway made a hard/hard pair reachable when mapping was enabled.
 These are encoded-media checks, not capture, Browser decode or room admission.
 
@@ -473,10 +474,21 @@ Tailcat's matched controls explicitly link its [optional portmapper feature](htt
 clearing its disable flag alone does not register that optional feature. Gateway
 mapping then passed three race repetitions after DERP closure. The 20-second
 comparison distinguishes fresh direct SRTP from relay delivery and retains the
-same gateway filtering. Without mapping service, Tailcat's random and sequential
-pairs remained relay-only; no extra direct-reachability class over Piik was found.
-Its relay bootstrap and Piik's local playback differ, so their startup timings
-are not a first-picture benchmark. Product dependencies and routing are unchanged.
+same gateway filtering. Its relay bootstrap and Piik's local playback differ,
+so startup timings are not a first-picture benchmark.
+
+A 2026-10-08 fairness control found that Tailcat's single bootstrap region leaves
+`MappingVariesByDestIP` unknown even with three STUN addresses: upstream
+[netcheck](https://github.com/tailscale/tailscale/blob/a0e471a35b8f/net/netcheck/netcheck.go)
+cancels the region's other probes after its first reply. A lab-only map projection
+gives those real addresses independent probe regions and pins the original relay;
+it is not a supported Tailcat option. Twelve Linux race cases verify classification
+on the actual media socket, keep media flowing until relay closure at 12 seconds,
+and require a fresh payload before the 20-second bound. Random/sequential pairs
+remain relay-only in both directions, with or without an absent-gateway mapping
+probe; an available gateway still establishes direct media. No extra direct path
+over Piik was found. Physical routers and field success rates remain unmeasured.
+Product dependencies and routing are unchanged.
 
 The experiment's README owns commands and fixture boundaries; raw output remains
 ignored. Further product work needs a measurable network benefit and accepted
diff --git a/docs/todo.md b/docs/todo.md
index 2b96fa26d..dda565d39 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -63,9 +63,10 @@ Implementation needs a concrete useful result within the product model.
   compound batches; shorter feedback intervals and the checked upstream updates
   do not supply it. An isolated upstream repair candidate passes actual encrypted
   feedback and race checks; it is not a supported or adopted dependency change.
-  Kernel checks now include Piik's actual Native engine, shared predictor and
-  real gateway mapping alongside dual-stack, mapping replacement and bounded
-  loss/reordering. They still do not establish extra direct reachability. Keep the
+  Kernel checks now include Piik's actual Native engine, shared predictor,
+  real gateway mapping and verified multi-destination netcheck alongside
+  dual-stack, mapping replacement and bounded loss/reordering. They still do not
+  establish extra direct reachability. Keep the
   experiment separate from product routing; the P2P evidence work below owns
   the network/interop acceptance boundary.
 - [ ] **Managed Demo hosting.** The [provider assessment](./operations/website.md#managed-hosting-assessment)

From 9e6f2a22cd3082655dd510e43a0bb545bfd4047d Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Thu, 8 Oct 2026 16:23:05 +0800
Subject: [PATCH 039/262] docs(nat): record bounded recovery lifecycle evidence

---
 docs/research/nat-traversal.md | 35 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 18 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index aee1453b4..ab1336822 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -432,24 +432,23 @@ ingress callback forwards only PLI/FIR, and LiveKit's reachable XR response cont
 DLRR block. No additional oversized producer was found in these paths; this
 does not bound arbitrary caller-created RTCP batches or future configurations.
 
-The same Linux kernel lab also compared established Pion and Tailcat SRTP under
-delay/jitter, 5% packet loss, reordering and a 350 ms complete interruption.
-DERP was closed before these phases. Both retained their session and resumed
-fresh media after restoration in three race-detector repetitions. Fresh payload
-tags and unique sequence counts exclude queued or duplicate-packet success.
-The original NAT and rebinding matrix repeated its prior outcomes. These controls
-add bounded weak-network recovery evidence, not decoded quality or a demonstrated
-direct-reachability advantage.
-
-Kernel gateway rebinding retained full WebRTC sessions. With DERP available,
-fresh media resumed in about 6.4–6.5 seconds and ICE reported `connected` in about
-7.1–8.1 seconds, without new SDP. With DERP closed, neither gateway direction
-recovered within 20 seconds. Fresh media and ICE state are separate observations;
-Piik's disconnected grace, restart and retirement need a full integration
-control before adoption. Underlay preparation must fit the existing operation
-deadline, not start a second budget. Local cold setup of about 3.3 seconds for
-Tailcat versus 0.2 seconds for Pion disabled STUN/gateway mapping and is not a WAN
-startup comparison.
+Kernel queue controls compare established Pion and Tailcat SRTP under delay,
+jitter, 5% loss and reordering with DERP closed. Both retained their session and
+resumed after a 350 ms blackout in three race repetitions, and after a separate
+nine-second blackout. Fresh tags and unique sequences exclude queued/duplicate
+success. These are bounded recovery checks, not decoded quality or field coverage.
+
+Kernel gateway rebinding retained full WebRTC: DERP restored fresh media in about
+6.4–6.5 seconds and ICE `connected` in 7.1–8.1 seconds, without new SDP. Its recorded
+disconnected interval was about two seconds, inside Piik's three-second grace;
+the nine-second blackout reached about four seconds disconnected. Actual Native
+Viewer-owner replays cancel grace or request one restart, clear recovery on
+connection and retain the receiver. They mock App events, so do not exercise the
+restart exchange over Tailcat or prove full integration. With DERP closed, neither
+gateway direction recovered within 20 seconds. Fresh media, ICE state and a
+unilateral direct address are separate facts. Underlay setup must fit the existing
+operation deadline. Local cold setup of about 3.3 seconds for Tailcat versus 0.2
+seconds for Pion disabled STUN/gateway mapping; it is not a WAN startup comparison.
 
 Dual-stack namespace controls enabled STUN and alternately blocked IPv4 UDP or
 IPv6 forwarding. Both stacks used the working family; Tailcat's direct proof

From 0fcf709601bb129cbdf1a81d97d59dcc89c46759 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Thu, 8 Oct 2026 19:51:41 +0800
Subject: [PATCH 040/262] docs(media): qualify new connection reports and local
 fallback evidence

---
 docs/research/browser-local-encoding-pool.md | 16 ++++++++++++++++
 docs/todo.md                                 | 16 +++++++++++++---
 2 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/docs/research/browser-local-encoding-pool.md b/docs/research/browser-local-encoding-pool.md
index 873c44832..a462562cd 100644
--- a/docs/research/browser-local-encoding-pool.md
+++ b/docs/research/browser-local-encoding-pool.md
@@ -101,6 +101,22 @@ around fallback was 271 ms for H264 and 80 ms for VP8. Source-wide fallback
 therefore has a measurable handoff cost, even without a resolution drop or
 connection failure. This does not establish low-end hardware capacity.
 
+### Local Connection Failure Control
+
+On 2026-10-08, Windows headless Chrome 154 ran the actual `HostPeer` and pool
+with a moving 640x360 VP8 source. mDNS host candidates supported one producer
+and two receivers. Discarding only the producer's ICE candidates triggered its
+eight-second timeout; both existing P2P connections then delivered 30 ordinary
+decoded frames each, retaining the source and no producer groups.
+
+This loopback-origin diagnostic does not test public-origin permission,
+Chrome/Firefox LAN interoperability or public-path quality. In
+[#465](https://github.com/TNTcraftHIM/Piik/issues/465), the successful repeat
+changed permission and IP masking together. Neither is an isolated cause;
+[HTTP App discovery](https://developer.chrome.com/blog/local-network-access)
+and [WebRTC connectivity](https://chromestatus.com/feature/5065884686876672)
+need separate evidence. This control is not a release acceptance gate.
+
 ### Balanced Startup And Recovery
 
 Serial Chrome 152 checks on 2026-09-25 reproduced two composition defects in
diff --git a/docs/todo.md b/docs/todo.md
index dda565d39..a2132b116 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -127,9 +127,19 @@ of a reporter's cause; research owns the completed experiments and their limits.
   [#453](https://github.com/TNTcraftHIM/Piik/issues/453) has no matched endpoint
   reports to distinguish network reachability from a product failure.
   The v1.6.3 candidate-timeout report lacks share-start and SDP/ICE evidence.
-  A self-hosted SFU report supplies only a screenshot of a third-party diagnosis;
-  obtain the original Viewer decode/`route-ready` events and matching Server
-  revision before attributing timeout to the committed-publication flag.
+  [#464](https://github.com/TNTcraftHIM/Piik/issues/464) adds Server/Host excerpts
+  to the self-hosted SFU screenshot report, but still lacks the matched Viewer
+  ICE, decode and `route-ready` trace. Healthy publication ingress and a bound
+  subscription do not establish delivered frames; the committed-publication
+  flag alone cannot identify why the candidate timed out.
+  [#465](https://github.com/TNTcraftHIM/Piik/issues/465) reports Chrome/Firefox
+  LAN asymmetry, local-pool timeout and separate public-path quality loss.
+  Its successful repeat changed both local-network permission and IP masking.
+  [Local controls](./research/browser-local-encoding-pool.md#local-connection-failure-control)
+  retain P2P through producer timeout; isolate the settings and compare paired
+  reports before changing routing or advising users to disable IP masking.
+  [#463](https://github.com/TNTcraftHIM/Piik/issues/463) lacks the Browser-only
+  Mac/phone attempt details needed to distinguish capture, entry and media failure.
 - [ ] **Camera and Host microphone device coverage.** Check real audio levels,
   echo, device replacement/native mixing and phone camera permission, orientation
   and background behavior. Include OBS virtual-camera/audio-input sound quality

From 171dd1c757602f05940e10109c0ab14a03ea9756 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Thu, 8 Oct 2026 20:38:23 +0800
Subject: [PATCH 041/262] docs(transport): record ICE restart composition
 boundary

---
 docs/research/nat-traversal.md | 22 ++++++++++++++++++++++
 docs/todo.md                   |  5 ++++-
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index ab1336822..df57a32f7 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -450,6 +450,28 @@ unilateral direct address are separate facts. Underlay setup must fit the existi
 operation deadline. Local cold setup of about 3.3 seconds for Tailcat versus 0.2
 seconds for Pion disabled STUN/gateway mapping; it is not a WAN startup comparison.
 
+A subsequent actual ICE-restart control on 2026-10-08 exposed a composition
+failure. After the same nine-second kernel blackout, ordinary Pion resumed
+media, but default Tailcat sometimes sent eight inner Binding requests without
+receiving any, then remained unavailable through Pion's failed state. In the
+captured failure, outer discovery resumed about 2.4 seconds after restoration,
+after the inner check budget had already been spent. Pion's
+[candidate-pair check budget](https://github.com/pion/ice/blob/v4.4.0/agent.go#L790)
+and Magicsock's
+[rate-limited discovery](https://github.com/tailscale/tailscale/blob/a0e471a35b8f/wgengine/magicsock/endpoint.go#L1421)
+are independent; a restored outer path does not restart exhausted inner checks.
+Keeping the accepted flow's listener open did not resolve the failure. A new
+ICE generation after underlay recovery delivered three fresh packets in about
+63 ms. Increasing only the fixture's Binding budget to 64 recovered in about
+1.9 seconds; both controls retained the same sockets, keys and NAT mappings.
+These distinguish underlay/check scheduling from permanent resource retirement.
+The isolated authorization and feedback patches retain the same restart failure.
+The pinned default restart assertion remains a reproducible integration failure,
+not a passing gate or a diagnosis of an existing Piik user report. Do not widen
+product timeouts or add diagnostic Ping polling to hide it. An actual local
+ICE restart on a shared tunnel also preserved continuous sibling audio/video;
+that healthy-network control does not establish impaired-network recovery.
+
 Dual-stack namespace controls enabled STUN and alternately blocked IPv4 UDP or
 IPv6 forwarding. Both stacks used the working family; Tailcat's direct proof
 required fresh bidirectional delivery after DERP closed. One side reporting a
diff --git a/docs/todo.md b/docs/todo.md
index a2132b116..7b2b24026 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -66,7 +66,10 @@ Implementation needs a concrete useful result within the product model.
   Kernel checks now include Piik's actual Native engine, shared predictor,
   real gateway mapping and verified multi-destination netcheck alongside
   dual-stack, mapping replacement and bounded loss/reordering. They still do not
-  establish extra direct reachability. Keep the
+  establish extra direct reachability. Actual ICE restart after a kernel blackout
+  also exposes an inner-check/underlay-recovery timing conflict; the default
+  Tailcat gate does not reliably pass. A wider fixture budget identifies the cause,
+  not an accepted timeout change. Keep the
   experiment separate from product routing; the P2P evidence work below owns
   the network/interop acceptance boundary.
 - [ ] **Managed Demo hosting.** The [provider assessment](./operations/website.md#managed-hosting-assessment)

From 65ccb5e4f7a2116009efb78db1ae10eff5c69e28 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Thu, 8 Oct 2026 21:16:00 +0800
Subject: [PATCH 042/262] docs(transport): qualify underlay rediscovery
 candidate

---
 docs/research/nat-traversal.md | 29 ++++++++++++++++++++++++++++-
 docs/todo.md                   |  8 ++++++--
 2 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index df57a32f7..3218bc02b 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -323,7 +323,10 @@ Pion ICE. Retired mapping-cache reproductions remain controls, not the baseline.
 
 [Tailcat](https://github.com/tailscale/tailcat/blob/b4dc28e8aa8936f0a90a41ad8293a64e3d6b645f/README.md)
 provides an upstream Go reuse candidate: magicsock plus WireGuard, with DERP bootstrap
-and relay fallback. Its Browser path at that pin is relay-only. In the isolated
+and relay fallback. Its Browser path at that pin is relay-only. Tailscale's open
+[Browser P2P proposal](https://github.com/tailscale/tailscale/issues/21027) uses
+WebRTC because the Browser cannot expose raw UDP; it is not an implemented
+Browser Magicsock hole-puncher. In the isolated
 Linux kernel NAT comparison on 2026-10-05, both stacks connected directly through
 ordinary/ordinary and open/hard gateways in either direction. Neither delivered
 fresh direct payloads through ordinary/hard, hard/ordinary, hard/hard or blocked
@@ -472,6 +475,30 @@ product timeouts or add diagnostic Ping polling to hide it. An actual local
 ICE restart on a shared tunnel also preserved continuous sibling audio/video;
 that healthy-network control does not establish impaired-network recovery.
 
+A narrower control kept a three-second recovery window and used Pion's existing
+`SetICEMaxBindingRequests(16)`. The nine-second blackout recovered in about
+1.9 seconds across three default-library repetitions, but changing the outage
+to eleven seconds produced no media before the same deadline. The isolated
+authorization/feedback candidate reproduced both outcomes. Other checked outage
+phases took up to about 2.9 seconds. Increasing the inner request count therefore
+does not ensure recovery inside Piik's current opportunity. Explicitly retiring
+that failed flow after three seconds preserved a sibling's continuous audio/video
+under the race detector. These fixture windows start after network restoration;
+they do not run Piik's complete disconnect-grace, restart and rebuild schedule.
+A separate one-shot `Client.DiscoPing` before ICE restart also retained failures
+with the default inner budget, despite a successful diagnostic reply.
+That diagnostic response alone does not prove bidirectional encrypted media
+readiness. Neither counterfactual is an accepted transport adapter.
+
+An isolated follow-up mirrored that discovery call on Tailcat's Server for the
+existing fixture peer. Calling both sides once before ICE restart recovered the
+nine- and eleven-second controls twice under the race detector, within the same
+three-second budget including rediscovery and SDP exchange. Pion retained its
+default request count. This supports coordinating underlay revalidation with the
+existing restart owner instead of widening deadlines. The Server hook is not an
+upstream API, and this probe does not validate concurrent revocation, failed
+rediscovery, the complete Piik recovery schedule or additional NAT reachability.
+
 Dual-stack namespace controls enabled STUN and alternately blocked IPv4 UDP or
 IPv6 forwarding. Both stacks used the working family; Tailcat's direct proof
 required fresh bidirectional delivery after DERP closed. One side reporting a
diff --git a/docs/todo.md b/docs/todo.md
index 7b2b24026..55b0ecb3f 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -68,8 +68,12 @@ Implementation needs a concrete useful result within the product model.
   dual-stack, mapping replacement and bounded loss/reordering. They still do not
   establish extra direct reachability. Actual ICE restart after a kernel blackout
   also exposes an inner-check/underlay-recovery timing conflict; the default
-  Tailcat gate does not reliably pass. A wider fixture budget identifies the cause,
-  not an accepted timeout change. Keep the
+  Tailcat gate does not reliably pass. A wider fixture budget identifies the cause;
+  a larger request count within the unchanged three-second opportunity still
+  fails at another outage phase. Explicit bilateral rediscovery recovers the
+  tested phases with default Pion, but requires an experimental Server hook;
+  its cancellation/revocation and complete recovery lifecycle need validation.
+  No timeout change or transport integration is accepted. Keep the
   experiment separate from product routing; the P2P evidence work below owns
   the network/interop acceptance boundary.
 - [ ] **Managed Demo hosting.** The [provider assessment](./operations/website.md#managed-hosting-assessment)

From 092b83a626d56e77e61e5c83f0ca1385d0c266cf Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Thu, 8 Oct 2026 21:42:38 +0800
Subject: [PATCH 043/262] docs(transport): record rediscovery lifecycle
 evidence

---
 docs/research/nat-traversal.md | 18 ++++++++++++------
 docs/todo.md                   |  3 ++-
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 3218bc02b..009783147 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -492,12 +492,18 @@ readiness. Neither counterfactual is an accepted transport adapter.
 
 An isolated follow-up mirrored that discovery call on Tailcat's Server for the
 existing fixture peer. Calling both sides once before ICE restart recovered the
-nine- and eleven-second controls twice under the race detector, within the same
-three-second budget including rediscovery and SDP exchange. Pion retained its
-default request count. This supports coordinating underlay revalidation with the
-existing restart owner instead of widening deadlines. The Server hook is not an
-upstream API, and this probe does not validate concurrent revocation, failed
-rediscovery, the complete Piik recovery schedule or additional NAT reachability.
+nine- and eleven-second controls in three retained race-detector repetitions.
+The unchanged three-second budget includes rediscovery and SDP exchange. Pion
+retained its default request count. This supports coordinating underlay revalidation with the
+existing restart owner instead of widening deadlines. Separate repeated checks
+cover both callers' pending cancellation/deadline, revocation during a Server
+probe, and unknown-peer rejection while sibling audio/video continues. Caller
+cancellation ends the wait, not the upstream ping packets: existing five-second
+discovery and ten-second TSMP timers bound their callback retention.
+The opt-in fixture retains its isolated Server patch and leaves the default
+failure controls intact. This hook is not an upstream API; these checks do not
+establish room-authorized integration, the complete Piik recovery schedule or
+additional NAT reachability.
 
 Dual-stack namespace controls enabled STUN and alternately blocked IPv4 UDP or
 IPv6 forwarding. Both stacks used the working family; Tailcat's direct proof
diff --git a/docs/todo.md b/docs/todo.md
index 55b0ecb3f..ab5b19a81 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -72,7 +72,8 @@ Implementation needs a concrete useful result within the product model.
   a larger request count within the unchanged three-second opportunity still
   fails at another outage phase. Explicit bilateral rediscovery recovers the
   tested phases with default Pion, but requires an experimental Server hook;
-  its cancellation/revocation and complete recovery lifecycle need validation.
+  bounded cancellation, revocation and sibling isolation pass repeated checks.
+  Room-authorized integration and the complete recovery lifecycle remain unverified.
   No timeout change or transport integration is accepted. Keep the
   experiment separate from product routing; the P2P evidence work below owns
   the network/interop acceptance boundary.

From 8dba7b23001a43d5dda9e20d4dbab04ad546d312 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Thu, 8 Oct 2026 22:18:04 +0800
Subject: [PATCH 044/262] fix(app): retain public invitation failure details

---
 docs/guide/troubleshooting.md                 |  5 +--
 docs/guide/troubleshooting.zh-CN.md           |  5 +--
 .../research/cross-platform-client-runtime.md | 15 ++++++--
 docs/todo.md                                  |  3 ++
 internal/app/publictunnel/process.go          | 32 ++++++++++++++---
 internal/app/publictunnel/process_test.go     | 35 ++++++++++++++++++-
 6 files changed, 82 insertions(+), 13 deletions(-)

diff --git a/docs/guide/troubleshooting.md b/docs/guide/troubleshooting.md
index e13c3544c..7b0136270 100644
--- a/docs/guide/troubleshooting.md
+++ b/docs/guide/troubleshooting.md
@@ -210,8 +210,9 @@ from a page that opens but reports **No media route available**.
 1. **Viewers: confirm the link.** Ask the host to check that the App is running
    and the computer is awake, then send the current invitation. Use a new link
    after the App restarts; the old address may no longer work.
-2. **Hosts: read the terminal error.** Check that the complete App package was
-   extracted. Save the full startup error and try again with **Debug launch**
+2. **Hosts: read the failure details.** Check that the complete App package was
+   extracted. Save the full error from the launch page or terminal, including
+   any detail after the exit code, and try again with **Debug launch**
    enabled. The App retries early tunnel-process exits within its startup deadline.
 3. **Compare networks.** Try a phone hotspot. Check whether DNS, a proxy or a
    firewall blocks Cloudflare Tunnel; adjust only relevant rules. Ask the
diff --git a/docs/guide/troubleshooting.zh-CN.md b/docs/guide/troubleshooting.zh-CN.md
index d733b2e16..bfaccb219 100644
--- a/docs/guide/troubleshooting.zh-CN.md
+++ b/docs/guide/troubleshooting.zh-CN.md
@@ -179,8 +179,9 @@ App 的 **公网邀请** 通过 Cloudflare Tunnel 提供临时网页地址。
 
 1. **观众先确认链接。** 请房主确认 App 仍在运行、电脑未休眠，并发送当前邀请。
    App 重新启动后应使用新链接，旧地址可能失效。
-2. **房主查看终端原因。** 确认已完整解压 App 程序包；启动失败时，保留终端的完整错误，
-   开启 **诊断启动** 后再试。App 会在启动时限内重试提前退出的隧道进程。
+2. **房主查看错误详情。** 确认已完整解压 App 程序包；保留启动页面或终端的完整错误，
+   包括退出码后的详细信息。开启 **诊断启动** 后再试。
+   App 会在启动时限内重试提前退出的隧道进程。
 3. **对照网络。** 可用手机热点重试，检查 DNS、代理或防火墙是否阻止 Cloudflare Tunnel。
    只调整相关规则；学校或公司的网络应联系管理员。
 
diff --git a/docs/research/cross-platform-client-runtime.md b/docs/research/cross-platform-client-runtime.md
index 1af2c4ae1..125dc0a74 100644
--- a/docs/research/cross-platform-client-runtime.md
+++ b/docs/research/cross-platform-client-runtime.md
@@ -167,9 +167,11 @@ the existing 30-second startup budget. This affects HTTP/WebSocket control only;
 media routes, tunnel identity and ordered shutdown keep their existing owners.
 DNS failures, API rejection and networks blocking both transports can still fail.
 The preceding Quick Tunnel allocation is a single HTTPS request with a 15-second
-dependency timeout; failure exits before transport fallback applies. The App's
-pre-readiness exit message and exit code do not identify that cause. Match the
-same run's `public-tunnel` dependency diagnostics before classifying a report.
+dependency timeout; failure exits before transport fallback applies. The exit
+code alone does not identify that cause. An abnormal exit now retains the latest
+sanitized dependency error or plain stderr detail in the existing failure result.
+This is the last reported observation, not a classification or a complete log;
+match the same run's `public-tunnel` diagnostics when the detail is insufficient.
 Piik retries a child that exits before readiness, up to four starts with a
 one-second pause between starts, all within the same 30-second acquisition
 deadline. The previous child, output readers and temporary config retire before
@@ -190,6 +192,13 @@ own the dependency behavior. An early-exit fixture confirms fourth-start recover
 and bounded exhaustion; these checks do not identify a reporter's API or network
 failure or guarantee four starts when earlier attempts consume the deadline.
 
+A 2026-10-08 Windows check against a deliberately refused local allocation API
+confirmed that cloudflared 2026.8.3 emits its final allocation error as plain
+stderr even with `--output json`. A JSON-only error reader therefore misses it.
+The process boundary retains that detail without changing retries or shutdown;
+normal cancellation still stays clean, and late cleanup cannot erase an already
+observed failure. The launcher applies its existing redaction and display limit.
+
 The public App log in [#452](https://github.com/TNTcraftHIM/Piik/issues/452),
 reviewed on 2026-10-07, records a QUIC timeout followed by a TCP port-7844
 connect timeout within that deadline. Thus fallback ran; the report does not
diff --git a/docs/todo.md b/docs/todo.md
index ab5b19a81..d15c4cdad 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -164,6 +164,9 @@ of a reporter's cause; research owns the completed experiments and their limits.
   [#452](https://github.com/TNTcraftHIM/Piik/issues/452) records both QUIC and TCP
   connection timeouts; compare the same endpoint with/without its accelerator.
   That startup log contains no evidence for its separate H.264 report.
+  [#466](https://github.com/TNTcraftHIM/Piik/issues/466) supplies only an early-exit
+  screenshot. Retaining dependency failure details improves the next report;
+  it does not establish or resolve this attempt's cause.
 - [ ] **Viewer interruptions.** Obtain paired endpoint/upstream-relay diagnostics
   for established viewing returning to P2P connecting, including
   [#429](https://github.com/TNTcraftHIM/Piik/issues/429)'s SFU-to-P2P dropout.
diff --git a/internal/app/publictunnel/process.go b/internal/app/publictunnel/process.go
index d1f4f6c09..749c66ec0 100644
--- a/internal/app/publictunnel/process.go
+++ b/internal/app/publictunnel/process.go
@@ -43,8 +43,9 @@ type Process struct {
 	done   chan struct{}
 	once   sync.Once
 
-	mu  sync.Mutex
-	err error
+	mu         sync.Mutex
+	err        error
+	lastDetail string
 }
 
 func PackagedExecutable() string {
@@ -166,7 +167,15 @@ func startAttempt(parent context.Context, executable, localOrigin string) (*Proc
 	var connectOnce sync.Once
 	var outputDone sync.WaitGroup
 	outputDone.Add(2)
-	readOutput := func(reader io.Reader) {
+	recordDetail := func(text string) {
+		// One line is bounded by the scanner. Redact before UI truncation.
+		if text = diagnostics.SafeText(strings.TrimSpace(text)); text != "" {
+			process.mu.Lock()
+			process.lastDetail = text
+			process.mu.Unlock()
+		}
+	}
+	readOutput := func(reader io.Reader, stderr bool) {
 		defer outputDone.Done()
 		scanner := bufio.NewScanner(reader)
 		scanner.Buffer(make([]byte, 4096), maxLogLineBytes)
@@ -178,8 +187,16 @@ func startAttempt(parent context.Context, executable, localOrigin string) (*Proc
 				Error   string `json:"error"`
 			}
 			if json.Unmarshal([]byte(line), &entry) != nil {
+				// cloudflared's CLI also returns plain stderr errors, including
+				// Quick Tunnel allocation failures before a transport exists.
+				if stderr {
+					recordDetail(line)
+				}
 				slog.Debug("public-tunnel", "event", "dependency-output", "message", diagnostics.SafeText(line))
 			} else if entry.Level == "error" || entry.Level == "warn" || entry.Level == "fatal" {
+				if entry.Level != "warn" {
+					recordDetail(strings.Join([]string{entry.Message, entry.Error}, "\n"))
+				}
 				slog.Debug("public-tunnel", "event", "dependency-output", "level", entry.Level,
 					"message", diagnostics.SafeText(entry.Message), "cause", diagnostics.SafeText(entry.Error))
 			}
@@ -194,8 +211,8 @@ func startAttempt(parent context.Context, executable, localOrigin string) (*Proc
 			slog.Debug("public-tunnel", "event", "output-read-failed", diagnostics.Error(err))
 		}
 	}
-	go readOutput(stdout)
-	go readOutput(stderr)
+	go readOutput(stdout, false)
+	go readOutput(stderr, true)
 	go func() {
 		waitErr := child.Wait()
 		// Classify the observed exit before draining logs: later owner cleanup
@@ -209,6 +226,11 @@ func startAttempt(parent context.Context, executable, localOrigin string) (*Proc
 		// Wait closes the pipe readers; join them before App closes its recorder.
 		// Do not wait before Wait: that would bypass its bounded pipe shutdown.
 		outputDone.Wait()
+		process.mu.Lock()
+		if process.err != nil && process.lastDetail != "" {
+			process.err = fmt.Errorf("%w\nlast public invitation detail: %s", process.err, process.lastDetail)
+		}
+		process.mu.Unlock()
 		_ = os.Remove(configPath)
 		close(process.done)
 	}()
diff --git a/internal/app/publictunnel/process_test.go b/internal/app/publictunnel/process_test.go
index f5d7bb3c7..23322c9a3 100644
--- a/internal/app/publictunnel/process_test.go
+++ b/internal/app/publictunnel/process_test.go
@@ -19,6 +19,11 @@ import (
 
 func TestMain(tests *testing.M) {
 	if mode := os.Getenv("PIIK_TUNNEL_FIXTURE"); mode != "" {
+		if mode == "plain-exit" {
+			fmt.Fprintln(os.Stderr, "failed to request quick Tunnel: connect timeout token=fixture-secret")
+			fmt.Fprintln(os.Stdout, "trailing ordinary output")
+			os.Exit(7)
+		}
 		if record := os.Getenv("PIIK_TUNNEL_FIXTURE_ATTEMPTS"); record != "" {
 			previous, _ := os.ReadFile(record)
 			var paths []string
@@ -46,7 +51,10 @@ func TestMain(tests *testing.M) {
 			}
 			failures, _ := strconv.Atoi(os.Getenv("PIIK_TUNNEL_FIXTURE_FAILURES"))
 			if len(paths) < failures {
-				fmt.Fprintln(os.Stderr, "fixture allocation unavailable")
+				fmt.Fprintln(os.Stderr, `{"level":"error","message":"older recovered failure"}`)
+				fmt.Fprintln(os.Stderr, `{"level":"error","message":"fixture allocation unavailable","error":"connect timeout token=fixture-secret"}`)
+				fmt.Fprintln(os.Stderr, `{"level":"warn","message":"cleanup warning"}`)
+				fmt.Fprintln(os.Stderr, `{"level":"info","message":"cleanup complete"}`)
 				code, _ := strconv.Atoi(os.Getenv("PIIK_TUNNEL_FIXTURE_EXIT_CODE"))
 				os.Exit(code)
 			}
@@ -83,6 +91,23 @@ func TestMain(tests *testing.M) {
 	os.Exit(tests.Run())
 }
 
+func TestStartupRetainsPlainDependencyFailure(t *testing.T) {
+	executable, err := os.Executable()
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("PIIK_TUNNEL_FIXTURE", "plain-exit")
+	process, err := startAttempt(t.Context(), executable, "http://127.0.0.1:8787")
+	var failure *exec.ExitError
+	if process != nil || !errors.Is(err, errStartupExited) || !errors.As(err, &failure) || failure.ExitCode() != 7 {
+		t.Fatalf("plain dependency failure lost its exit status: %v, %v", process, err)
+	}
+	if !strings.Contains(err.Error(), "failed to request quick Tunnel: connect timeout token=[redacted]") ||
+		strings.Contains(err.Error(), "fixture-secret") || strings.Contains(err.Error(), "ordinary output") {
+		t.Fatalf("plain dependency failure was omitted, unsafe or overwritten: %v", err)
+	}
+}
+
 func TestStartupRetriesOnlyRetiredPreReadyChildren(t *testing.T) {
 	executable, err := os.Executable()
 	if err != nil {
@@ -120,6 +145,11 @@ func TestStartupRetriesOnlyRetiredPreReadyChildren(t *testing.T) {
 					if !errors.As(err, &failure) || failure.ExitCode() != sample.exitCode {
 						t.Fatalf("latest dependency exit was lost: %v", err)
 					}
+					if !strings.Contains(err.Error(), "fixture allocation unavailable\nconnect timeout token=[redacted]") ||
+						strings.Contains(err.Error(), "fixture-secret") || strings.Contains(err.Error(), "older recovered failure") ||
+						strings.Contains(err.Error(), "cleanup") {
+						t.Fatalf("latest sanitized dependency cause was lost or replaced: %v", err)
+					}
 				}
 			}
 			assertRetiredAttempts(t, record, 4)
@@ -318,6 +348,9 @@ func TestCloseKeepsAnObservedFailureWhileLogsDrain(t *testing.T) {
 		if !errors.As(err, &failure) || failure.ExitCode() != 7 {
 			t.Fatalf("late owner cancellation lost the observed dependency failure: %v", err)
 		}
+		if !strings.Contains(err.Error(), "fixture exit failure") {
+			t.Fatalf("late output lost the dependency detail: %v", err)
+		}
 	case <-time.After(2 * time.Second):
 		t.Fatal("tunnel did not retire after its logs drained")
 	}

From 7a370922f521882e83c803a79c703e2e3c4c443f Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Thu, 8 Oct 2026 22:18:09 +0800
Subject: [PATCH 045/262] docs(transport): qualify discovery-retained recovery
 evidence

---
 docs/research/nat-traversal.md | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 009783147..ae497bf8d 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -505,6 +505,22 @@ failure controls intact. This hook is not an upstream API; these checks do not
 establish room-authorized integration, the complete Piik recovery schedule or
 additional NAT reachability.
 
+A discovery-retained control on 2026-10-08 addresses a limit of closing DERP:
+closure also removes its endpoint exchange. The upstream relay's packet-class
+counters distinguish discovery from WireGuard traffic. A 500 ms window with
+connected WebRTC, at least three fresh tagged SRTP packets and no non-discovery
+relay packets proves direct media while keeping endpoint exchange available.
+Ordinary NAT passes that proof; blocked UDP correctly remains relay-only. Both
+orientations of the hard-NAT pair deliver through DERP without a proved direct
+window in 20 seconds. After either gateway mapping changes, media returns in
+about six seconds. Default-library repetitions do not prove direct recovery in
+20 seconds. The combined isolated candidate proves it once per direction at
+about 17 seconds, but neither of two further repetitions per direction does.
+This variation does not establish a repeatable candidate advantage or an extra
+reachable class. The control makes no explicit rediscovery call; its passing
+result validates the measurement and available-media baseline, not universal
+direct recovery. It does not run Piik's complete reconnect schedule.
+
 Dual-stack namespace controls enabled STUN and alternately blocked IPv4 UDP or
 IPv6 forwarding. Both stacks used the working family; Tailcat's direct proof
 required fresh bidirectional delivery after DERP closed. One side reporting a

From 90c9be35184c89503b19b08d9460bf91994dc87a Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Thu, 8 Oct 2026 22:47:36 +0800
Subject: [PATCH 046/262] docs(transport): clarify recovery and acceptance
 limits

---
 docs/research/nat-traversal.md | 89 ++++++++++++++++------------------
 docs/todo.md                   |  9 +++-
 2 files changed, 48 insertions(+), 50 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index ae497bf8d..e5bca61d2 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -453,57 +453,50 @@ unilateral direct address are separate facts. Underlay setup must fit the existi
 operation deadline. Local cold setup of about 3.3 seconds for Tailcat versus 0.2
 seconds for Pion disabled STUN/gateway mapping; it is not a WAN startup comparison.
 
-A subsequent actual ICE-restart control on 2026-10-08 exposed a composition
-failure. After the same nine-second kernel blackout, ordinary Pion resumed
-media, but default Tailcat sometimes sent eight inner Binding requests without
-receiving any, then remained unavailable through Pion's failed state. In the
-captured failure, outer discovery resumed about 2.4 seconds after restoration,
-after the inner check budget had already been spent. Pion's
+Actual ICE-restart controls on 2026-10-08 exposed a composition failure.
+After a nine-second kernel blackout, ordinary Pion resumed media, but default
+Tailcat sometimes exhausted eight inner Binding requests before outer discovery
+recovered about 2.4 seconds after restoration. Pion's
 [candidate-pair check budget](https://github.com/pion/ice/blob/v4.4.0/agent.go#L790)
 and Magicsock's
 [rate-limited discovery](https://github.com/tailscale/tailscale/blob/a0e471a35b8f/wgengine/magicsock/endpoint.go#L1421)
-are independent; a restored outer path does not restart exhausted inner checks.
-Keeping the accepted flow's listener open did not resolve the failure. A new
-ICE generation after underlay recovery delivered three fresh packets in about
-63 ms. Increasing only the fixture's Binding budget to 64 recovered in about
-1.9 seconds; both controls retained the same sockets, keys and NAT mappings.
-These distinguish underlay/check scheduling from permanent resource retirement.
-The isolated authorization and feedback patches retain the same restart failure.
-The pinned default restart assertion remains a reproducible integration failure,
-not a passing gate or a diagnosis of an existing Piik user report. Do not widen
-product timeouts or add diagnostic Ping polling to hide it. An actual local
-ICE restart on a shared tunnel also preserved continuous sibling audio/video;
-that healthy-network control does not establish impaired-network recovery.
-
-A narrower control kept a three-second recovery window and used Pion's existing
-`SetICEMaxBindingRequests(16)`. The nine-second blackout recovered in about
-1.9 seconds across three default-library repetitions, but changing the outage
-to eleven seconds produced no media before the same deadline. The isolated
-authorization/feedback candidate reproduced both outcomes. Other checked outage
-phases took up to about 2.9 seconds. Increasing the inner request count therefore
-does not ensure recovery inside Piik's current opportunity. Explicitly retiring
-that failed flow after three seconds preserved a sibling's continuous audio/video
-under the race detector. These fixture windows start after network restoration;
-they do not run Piik's complete disconnect-grace, restart and rebuild schedule.
-A separate one-shot `Client.DiscoPing` before ICE restart also retained failures
-with the default inner budget, despite a successful diagnostic reply.
-That diagnostic response alone does not prove bidirectional encrypted media
-readiness. Neither counterfactual is an accepted transport adapter.
-
-An isolated follow-up mirrored that discovery call on Tailcat's Server for the
-existing fixture peer. Calling both sides once before ICE restart recovered the
-nine- and eleven-second controls in three retained race-detector repetitions.
-The unchanged three-second budget includes rediscovery and SDP exchange. Pion
-retained its default request count. This supports coordinating underlay revalidation with the
-existing restart owner instead of widening deadlines. Separate repeated checks
-cover both callers' pending cancellation/deadline, revocation during a Server
-probe, and unknown-peer rejection while sibling audio/video continues. Caller
-cancellation ends the wait, not the upstream ping packets: existing five-second
-discovery and ten-second TSMP timers bound their callback retention.
-The opt-in fixture retains its isolated Server patch and leaves the default
-failure controls intact. This hook is not an upstream API; these checks do not
-establish room-authorized integration, the complete Piik recovery schedule or
-additional NAT reachability.
+are independent: outer recovery does not restart exhausted inner checks.
+Keeping the accepted listener open did not help; a new ICE generation after
+underlay recovery delivered three fresh packets in about 63 ms. This distinguishes
+check scheduling from permanently retired resources. The isolated authorization
+and feedback patches retain this failure.
+
+The following counterfactuals preserve sockets, keys and NAT mappings. Unless
+noted, recovery starts after network restoration; none runs Piik's complete
+disconnect-grace, restart and rebuild schedule.
+
+| Tailcat recovery control | Observation |
+| --- | --- |
+| Increase only the fixture's Binding request budget to 64 | Media recovered in about 1.9 seconds inside the fixture's eight-second window. This does not accept a product timeout change. |
+| 16 Binding requests, three-second recovery window | Nine-second blackout recovered in about 1.9 seconds across three default-library repetitions; eleven seconds did not recover in budget. Other checked phases reached about 2.9 seconds. The authorization/feedback candidate reproduced both outcomes. |
+| One client-side `DiscoPing` before default-Pion restart | Failures remained even after a diagnostic reply; that reply does not prove bidirectional encrypted media readiness. |
+| One probe on each side before default-Pion restart | Nine- and eleven-second blackouts recovered in three race-detector repetitions, including both probes and SDP exchange inside three seconds. This requires an isolated, unsupported Server hook. |
+| Same bilateral probe begins while the network is still down | After eight seconds of blackout, restoration one or two seconds into the probe still left it waiting until its three-second deadline in repeated race checks. Post-restoration controls continued to pass. |
+
+The last control limits the bilateral proposal: a
+[`DiscoPing` call](https://github.com/tailscale/tailcat/blob/b4dc28e8aa8936f0a90a41ad8293a64e3d6b645f/tailcat.go#L2258)
+waits for its own diagnostic reply, not an ongoing connection-readiness event.
+Later network restoration cannot guarantee that a lost probe completes.
+The earlier passing phase therefore does not establish a universal recovery
+barrier. These controls use fixture SDP exchange; they do not diagnose the
+product's Trickle ICE or an existing user's failure.
+
+Separate checks preserve continuous sibling audio/video through a local ICE
+restart, failed-flow retirement, both callers' pending cancellation/deadline,
+revocation during a Server probe and unknown-peer rejection. Canceling a probe
+ends the caller's wait, not upstream packets: existing five-second discovery and
+ten-second TSMP timers bound callback retention. These local checks do not prove
+impaired-network recovery.
+
+The opt-in experiment retains the failing default and pre-restoration assertions.
+It is not an all-green acceptance gate or a supported transport adapter. Do not
+widen product timeouts or add diagnostic Ping polling to hide these failures.
+Room-authorized integration and the complete recovery lifecycle remain unverified.
 
 A discovery-retained control on 2026-10-08 addresses a limit of closing DERP:
 closure also removes its endpoint exchange. The upstream relay's packet-class
diff --git a/docs/todo.md b/docs/todo.md
index d15c4cdad..0266bfcfa 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -15,6 +15,9 @@ Git/PRs own completed history.
   coherent candidate and stop before publication. Preserve the existing product
   model; evaluate held features against measurable benefit and total complexity
   before accepting a changed contract.
+  Windows full Go acceptance needs a runner that permits its test executables;
+  the current run stopped before the Browser-launcher package tests with an OS
+  access denial. Separate native checks and Linux checks do not close that gap.
 - [ ] **Independent Gitee mirror recovery.** Implementation and local acceptance
   are complete. Integrate through the next owner-approved publishing merge and
   verify the separate workflow with its original CI artifacts. Mirror failure
@@ -71,8 +74,10 @@ Implementation needs a concrete useful result within the product model.
   Tailcat gate does not reliably pass. A wider fixture budget identifies the cause;
   a larger request count within the unchanged three-second opportunity still
   fails at another outage phase. Explicit bilateral rediscovery recovers the
-  tested phases with default Pion, but requires an experimental Server hook;
-  bounded cancellation, revocation and sibling isolation pass repeated checks.
+  tested post-restoration phases with default Pion, but requires an experimental
+  Server hook and fails when called before network restoration. Bounded
+  cancellation, revocation and sibling isolation pass repeated checks;
+  a diagnostic reply is not a general underlay-readiness contract.
   Room-authorized integration and the complete recovery lifecycle remain unverified.
   No timeout change or transport integration is accepted. Keep the
   experiment separate from product routing; the P2P evidence work below owns

From 92825f084c5b79a79c830ae836461b358da06964 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Thu, 8 Oct 2026 23:20:58 +0800
Subject: [PATCH 047/262] docs(transport): distinguish failed probes from
 failed media

---
 docs/research/nat-traversal.md | 6 ++++--
 docs/todo.md                   | 3 ++-
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index e5bca61d2..55b239611 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -477,13 +477,15 @@ disconnect-grace, restart and rebuild schedule.
 | One client-side `DiscoPing` before default-Pion restart | Failures remained even after a diagnostic reply; that reply does not prove bidirectional encrypted media readiness. |
 | One probe on each side before default-Pion restart | Nine- and eleven-second blackouts recovered in three race-detector repetitions, including both probes and SDP exchange inside three seconds. This requires an isolated, unsupported Server hook. |
 | Same bilateral probe begins while the network is still down | After eight seconds of blackout, restoration one or two seconds into the probe still left it waiting until its three-second deadline in repeated race checks. Post-restoration controls continued to pass. |
+| Lost bilateral probes, retain the existing media connection | In six race checks, both probes expired while WebRTC was already connected; a subsequent observation received fresh SRTP without new SDP, sockets or credentials. The separate three-second observation is not a product recovery extension. |
 
-The last control limits the bilateral proposal: a
+These controls limit the bilateral proposal: a
 [`DiscoPing` call](https://github.com/tailscale/tailcat/blob/b4dc28e8aa8936f0a90a41ad8293a64e3d6b645f/tailcat.go#L2258)
 waits for its own diagnostic reply, not an ongoing connection-readiness event.
 Later network restoration cannot guarantee that a lost probe completes.
 The earlier passing phase therefore does not establish a universal recovery
-barrier. These controls use fixture SDP exchange; they do not diagnose the
+barrier, and probe expiry does not establish media failure or justify replacing
+healthy media. These controls use fixture SDP exchange; they do not diagnose the
 product's Trickle ICE or an existing user's failure.
 
 Separate checks preserve continuous sibling audio/video through a local ICE
diff --git a/docs/todo.md b/docs/todo.md
index 0266bfcfa..fd812660d 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -75,7 +75,8 @@ Implementation needs a concrete useful result within the product model.
   a larger request count within the unchanged three-second opportunity still
   fails at another outage phase. Explicit bilateral rediscovery recovers the
   tested post-restoration phases with default Pion, but requires an experimental
-  Server hook and fails when called before network restoration. Bounded
+  Server hook. Its proposed readiness gate fails when called before network
+  restoration; probe expiry can coexist with recovered media. Bounded
   cancellation, revocation and sibling isolation pass repeated checks;
   a diagnostic reply is not a general underlay-readiness contract.
   Room-authorized integration and the complete recovery lifecycle remain unverified.

From ccf30bc9a34562cb5423139f213edcd29140fd52 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Thu, 8 Oct 2026 23:47:19 +0800
Subject: [PATCH 048/262] fix(diagnostics): distinguish SFU endpoint
 connectivity

---
 docs/guide/troubleshooting.md                    |  3 +++
 docs/guide/troubleshooting.zh-CN.md              |  2 ++
 docs/operations/self-hosting.md                  |  3 ++-
 docs/operations/self-hosting.zh-CN.md            |  1 +
 docs/standards/configuration.md                  |  2 +-
 docs/todo.md                                     | 13 ++++++++-----
 internal/server/signal/router_sfu_signal.go      | 12 +++++++-----
 internal/server/signal/router_sfu_signal_test.go | 10 ++++++++++
 8 files changed, 34 insertions(+), 12 deletions(-)

diff --git a/docs/guide/troubleshooting.md b/docs/guide/troubleshooting.md
index 7b0136270..350551cfe 100644
--- a/docs/guide/troubleshooting.md
+++ b/docs/guide/troubleshooting.md
@@ -301,6 +301,9 @@ explains discovery and connection checks in more technical detail.
 If these steps do not help, collect a [Debug report](../../cmd/piik-app/README.md#diagnostics)
 from the affected Viewer and, if possible, the Host for the same attempt. Include
 the time, Piik version and network type when reporting the problem.
+For a self-hosted site using SFU, also include the Server report. Successful Host
+upload or subscription setup alone does not establish that the Viewer received
+and decoded the picture; the reports from both sides help locate the failing step.
 
 ### Browser WebRTC restrictions
 
diff --git a/docs/guide/troubleshooting.zh-CN.md b/docs/guide/troubleshooting.zh-CN.md
index bfaccb219..7b499f6ea 100644
--- a/docs/guide/troubleshooting.zh-CN.md
+++ b/docs/guide/troubleshooting.zh-CN.md
@@ -247,6 +247,8 @@ NAT（网络地址转换）让多台设备共用一个上网地址。不同路
 
 仍然失败时，收集出现问题的观众端与房主端同一次尝试的
 [诊断报告](../../cmd/piik-app/README.zh-CN.md#诊断)，反馈时附上发生时间、Piik 版本和所用网络类型。
+自部署站点使用 SFU 时，也请附上服务端报告。房主上传成功或订阅建立，并不代表观众已经收到并解码画面；
+两端报告能帮助判断具体卡在哪一步。
 
 ### 浏览器限制了 WebRTC
 
diff --git a/docs/operations/self-hosting.md b/docs/operations/self-hosting.md
index 64389b11d..ce2ea916a 100644
--- a/docs/operations/self-hosting.md
+++ b/docs/operations/self-hosting.md
@@ -144,7 +144,8 @@ configuration uses P2P media, so participants need a usable UDP path.
 
 Add `SFU_UDP_PORT=7882` to `.env`, allow UDP 7882, and restart Piik to enable
 automatic SFU fallback. When the server is behind NAT, also set `SFU_PUBLIC_IP`
-to its reachable public IPv4 address. The same binary provides the fallback.
+to its reachable public IPv4 address and forward the same external and internal
+UDP port as `SFU_UDP_PORT`. The same binary provides the fallback.
 Allow server forwarding capacity and outbound bandwidth for Viewers actually
 using the SFU.
 The Host must turn off **Privacy mode** before sharing to allow this route.
diff --git a/docs/operations/self-hosting.zh-CN.md b/docs/operations/self-hosting.zh-CN.md
index f91fa1cfc..1e8a05977 100644
--- a/docs/operations/self-hosting.zh-CN.md
+++ b/docs/operations/self-hosting.zh-CN.md
@@ -130,6 +130,7 @@ TCP 8787 仅供本机反向代理访问。STUN 域名需要直接解析到服务
 
 在 `.env` 中添加 `SFU_UDP_PORT=7882`，放行 UDP 7882，再重启 Piik，即可启用自动 SFU 兜底。
 如果服务器处于 NAT 后方，还需将 `SFU_PUBLIC_IP` 设置为外部可达的公网 IPv4 地址。
+公网和内部映射的 UDP 端口都应与 `SFU_UDP_PORT` 一致。
 这项功能由同一个服务端程序提供。
 服务器需要为实际经由 SFU 观看的观众承担转发负载和出口带宽。
 房主需要在开始分享前关闭 **隐私模式**，才会允许使用这条线路。
diff --git a/docs/standards/configuration.md b/docs/standards/configuration.md
index e121012e0..23afca7a2 100644
--- a/docs/standards/configuration.md
+++ b/docs/standards/configuration.md
@@ -65,7 +65,7 @@ Automatic SFU fallback runs inside the Hosted process when `SFU_UDP_PORT` is set
 | --- | --- |
 | `SFU_UDP_PORT` | Optional UDP media port `1..65535`; unset or blank disables SFU and fixes Privacy mode on for every room. Set `7882` for the standard public listener and allow the Host to choose Privacy mode. |
 | `SFU_LISTEN_HOST` | IPv4 bind address, default `0.0.0.0`; independent of HTTP `LISTEN_HOST`. Read only when SFU is enabled. |
-| `SFU_PUBLIC_IP` | Optional explicit IPv4 advertised-address override for a host behind NAT. Read only when SFU is enabled. |
+| `SFU_PUBLIC_IP` | Optional explicit IPv4 advertised-address override for a host behind NAT. It changes the advertised address, not the port: forward the same UDP port as `SFU_UDP_PORT`. Read only when SFU is enabled. |
 | `SFU_ONLY` | `false` by default. `true` requires `SFU_UDP_PORT` and sends every room through SFU, without Peer candidates or background P2P convergence. Applies after Server restart. |
 
 SFU control uses the application's authenticated signaling connection. No
diff --git a/docs/todo.md b/docs/todo.md
index fd812660d..950ef10bb 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -141,11 +141,14 @@ of a reporter's cause; research owns the completed experiments and their limits.
   [#453](https://github.com/TNTcraftHIM/Piik/issues/453) has no matched endpoint
   reports to distinguish network reachability from a product failure.
   The v1.6.3 candidate-timeout report lacks share-start and SDP/ICE evidence.
-  [#464](https://github.com/TNTcraftHIM/Piik/issues/464) adds Server/Host excerpts
-  to the self-hosted SFU screenshot report, but still lacks the matched Viewer
-  ICE, decode and `route-ready` trace. Healthy publication ingress and a bound
-  subscription do not establish delivered frames; the committed-publication
-  flag alone cannot identify why the candidate timed out.
+  [#464](https://github.com/TNTcraftHIM/Piik/issues/464) and the supplied report
+  identify v1.9.2, a NAT-hosted Server, Native Host, and the same timeout under
+  `SFU_ONLY`. They still lack the matched Viewer ICE, decode and `route-ready`
+  trace. The cited Host failure follows the operation deadline; healthy ingress
+  and a bound subscription do not establish delivered frames or its cause.
+  The local Native H264/SFU-only control passes, but does not reproduce the
+  reporter's network. Correlate transport-state diagnostics with the affected
+  Viewer before changing admission or recovery.
   [#465](https://github.com/TNTcraftHIM/Piik/issues/465) reports Chrome/Firefox
   LAN asymmetry, local-pool timeout and separate public-path quality loss.
   Its successful repeat changed both local-network permission and IP masking.
diff --git a/internal/server/signal/router_sfu_signal.go b/internal/server/signal/router_sfu_signal.go
index ceff44b73..b817be574 100644
--- a/internal/server/signal/router_sfu_signal.go
+++ b/internal/server/signal/router_sfu_signal.go
@@ -225,7 +225,7 @@ func (r *router) handleSfuMediaEvent(event sfu.MediaEvent) {
 	peer, connected := r.connectedPeer(event.Fence.RoomID, peerID)
 	snapshot := rm.controller.Snapshot()
 	participant := authenticatedRouteParticipant{roomID: event.Fence.RoomID, role: role, peerID: peerID, sessionID: peer.SessionID}
-	_, revision := sfuConnectionPhase(snapshot, role, peerID, event.Fence.PublicationGeneration, event.ConnectionID)
+	phase, revision := sfuConnectionPhase(snapshot, role, peerID, event.Fence.PublicationGeneration, event.ConnectionID)
 	message := protocol.SfuSignalMessage{Type: "sfu-signal", Kind: "candidate", Revision: protocol.Int(revision), PublicationGeneration: event.Fence.PublicationGeneration, ConnectionID: event.ConnectionID}
 	if !connected && role == protocol.RoleHost && event.State == webrtc.PeerConnectionStateFailed {
 		publication := snapshot.HostPublication
@@ -245,11 +245,13 @@ func (r *router) handleSfuMediaEvent(event sfu.MediaEvent) {
 		r.hooks.sendToSession(participant.sessionID, message)
 		return
 	}
-	if event.State == webrtc.PeerConnectionStateFailed {
-		r.failSfuConnection(participant, message)
-		return
-	}
 	if event.State != webrtc.PeerConnectionStateUnknown {
+		r.debug(participant.roomID, "sfu-transport-state",
+			"participant", r.debugPeer(participant.roomID, participant.peerID),
+			"role", role, "phase", phase, "revision", revision, "state", event.State.String())
+		if event.State == webrtc.PeerConnectionStateFailed {
+			r.failSfuConnection(participant, message)
+		}
 		return
 	}
 	if event.Candidate != nil {
diff --git a/internal/server/signal/router_sfu_signal_test.go b/internal/server/signal/router_sfu_signal_test.go
index 7b0487b97..f8068c576 100644
--- a/internal/server/signal/router_sfu_signal_test.go
+++ b/internal/server/signal/router_sfu_signal_test.go
@@ -66,6 +66,7 @@ func TestEmbeddedSfuSignalsRequireExactAdmittedConnectionAndCurrentSession(t *te
 }
 
 func TestEmbeddedSfuAuthenticatedWebSocketCarriesActualRTP(t *testing.T) {
+	diagnostics := captureRouteDebug(t)
 	ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
 	defer cancel()
 	check := func(err error) {
@@ -216,6 +217,15 @@ func TestEmbeddedSfuAuthenticatedWebSocketCarriesActualRTP(t *testing.T) {
 	if !waitFor(t, 3*time.Second, func() bool { return received.Load() >= 3 }) {
 		t.Fatal("authenticated signaling did not produce forwarded video RTP")
 	}
+	if !waitFor(t, time.Second, func() bool {
+		return diagnostics.calledWith(h.room.RoomID, "sfu-transport-state", map[string]any{
+			"role": "host", "phase": "prepare", "revision": int64(hostConfig.Revision), "state": "connected",
+		}) && diagnostics.calledWith(h.room.RoomID, "sfu-transport-state", map[string]any{
+			"role": "viewer", "phase": "prepare", "revision": int64(viewerConfig.Revision), "state": "connected",
+		})
+	}) {
+		t.Fatal("SFU diagnostics did not distinguish connected ingress and egress before route commit")
+	}
 	h.locked(func() {
 		room, _ := h.server.router.rooms.Get(h.room.RoomID)
 		if room.controller.Operation() == nil {

From fad248f73e07498615e6e20d0483b7a565429306 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 00:21:04 +0800
Subject: [PATCH 049/262] docs: consolidate transport recovery evidence

---
 docs/research/nat-traversal.md | 25 ++++++++++++++++++++--
 docs/todo.md                   | 39 +++++++++-------------------------
 2 files changed, 33 insertions(+), 31 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 55b239611..0be016afd 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -488,6 +488,27 @@ barrier, and probe expiry does not establish media failure or justify replacing
 healthy media. These controls use fixture SDP exchange; they do not diagnose the
 product's Trickle ICE or an existing user's failure.
 
+A follow-up kernel fixture on 2026-10-09 matches the committed Viewer's two
+three-second recovery opportunities: restart ICE, then rebuild only if still
+not connected at the first deadline. It retains tunnel identity and outer NAT
+mappings, creates a new inner flow for replacement, and keeps default Pion checks
+without an explicit discovery hook. Setup consumes its opportunity; fresh SRTP
+is checked separately after connection meets the deadline. Post-restoration
+controls cover eight-, nine- and eleven-second blackouts; Tailcat also starts
+recovery one or two seconds before restoration. All five Tailcat cases pass two
+further race-detector repetitions, recovering through restart or replacement;
+the ordinary Pion controls also pass. Failure of the first ICE generation alone
+therefore does not establish failure of both existing recovery opportunities.
+
+The fixture's replacement flow repeats an initial datagram until the SDP exchange
+confirms listener acceptance, bounded by that same opportunity. A lone lost
+preface had blocked setup before ICE could run. This fixture handshake is not an
+accepted product protocol or proof of media readiness. Its complete-gathering
+SDP exchange also stalls ordinary Pion when started before network restoration;
+that result is not Piik's Trickle ICE behavior. The passing controls narrow the
+integration question but do not run the actual Viewer scheduler, room authority
+or Browser decoder, and do not establish additional direct reachability.
+
 Separate checks preserve continuous sibling audio/video through a local ICE
 restart, failed-flow retirement, both callers' pending cancellation/deadline,
 revocation during a Server probe and unknown-peer rejection. Canceling a probe
@@ -495,8 +516,8 @@ ends the caller's wait, not upstream packets: existing five-second discovery and
 ten-second TSMP timers bound callback retention. These local checks do not prove
 impaired-network recovery.
 
-The opt-in experiment retains the failing default and pre-restoration assertions.
-It is not an all-green acceptance gate or a supported transport adapter. Do not
+The opt-in experiment retains the failing single-restart and blocking-probe
+assertions. It is not an all-green acceptance gate or a supported adapter. Do not
 widen product timeouts or add diagnostic Ping polling to hide these failures.
 Room-authorized integration and the complete recovery lifecycle remain unverified.
 
diff --git a/docs/todo.md b/docs/todo.md
index 950ef10bb..643031529 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -1,6 +1,6 @@
 # Current TODO Ledger
 
-Last reviewed: 2026-10-08
+Last reviewed: 2026-10-09
 
 The current 2.0 preparation includes independent investigation across this
 ledger. Explicit owner holds remain in force; an investigation does not itself
@@ -55,34 +55,15 @@ Implementation needs a concrete useful result within the product model.
 - [ ] **Native Magicsock.** Go reuse is feasible, but the
   [matched comparisons](./research/nat-traversal.md#integration-cost-and-recovery-controls)
   have not established improved direct reachability. Seek a repeatable benefit
-  before accepting peer-key authorization/revocation, underlay readiness and
-  relay operation. The [authorization assessment](./research/nat-traversal.md#peer-authorization-boundary)
-  reproduces stale WireGuard sessions, late admission and a deeper lazy-peer
-  creation race. Isolated Tailcat/WireGuard corrections pass bounded checks;
-  the scoped lookup fence also preserves unrelated concurrent admission.
-  Supported upstream fixes still need review before product adoption.
-  The isolated feedback check also requires a supported RTCP
-  size boundary for the tunnel's MTU, including reordered-history reports and
-  compound batches; shorter feedback intervals and the checked upstream updates
-  do not supply it. An isolated upstream repair candidate passes actual encrypted
-  feedback and race checks; it is not a supported or adopted dependency change.
-  Kernel checks now include Piik's actual Native engine, shared predictor,
-  real gateway mapping and verified multi-destination netcheck alongside
-  dual-stack, mapping replacement and bounded loss/reordering. They still do not
-  establish extra direct reachability. Actual ICE restart after a kernel blackout
-  also exposes an inner-check/underlay-recovery timing conflict; the default
-  Tailcat gate does not reliably pass. A wider fixture budget identifies the cause;
-  a larger request count within the unchanged three-second opportunity still
-  fails at another outage phase. Explicit bilateral rediscovery recovers the
-  tested post-restoration phases with default Pion, but requires an experimental
-  Server hook. Its proposed readiness gate fails when called before network
-  restoration; probe expiry can coexist with recovered media. Bounded
-  cancellation, revocation and sibling isolation pass repeated checks;
-  a diagnostic reply is not a general underlay-readiness contract.
-  Room-authorized integration and the complete recovery lifecycle remain unverified.
-  No timeout change or transport integration is accepted. Keep the
-  experiment separate from product routing; the P2P evidence work below owns
-  the network/interop acceptance boundary.
+  before accepting room-scoped peer keys, flow admission and relay operation.
+  Product adoption still needs supported
+  [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary)
+  and RTCP/MTU boundaries, plus verification through the actual Viewer recovery
+  owner and mixed Browser/Native routes. Keep isolated dependency patches and
+  recovery counterfactuals outside product routing; a diagnostic reply is not
+  media-readiness authority. Research owns the experiments and their limits.
+  No timeout change or transport integration is accepted; the P2P evidence work
+  below owns the network/interop acceptance boundary.
 - [ ] **Managed Demo hosting.** The [provider assessment](./operations/website.md#managed-hosting-assessment)
   identifies UDP/storage requirements but establishes no cost saving. Keep the
   existing P2P-only Demo until a provider and operating boundary are accepted.

From d1680e0a2f2dcc9022b11aabe0a905c1aa3f6dd6 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 01:25:20 +0800
Subject: [PATCH 050/262] fix(media): preserve viewer recovery budget across
 replacement

---
 docs/standards/routing-transport.md     |  5 ++-
 src/client/native/native-viewer-peer.ts | 47 +++++++++++---------
 src/client/webrtc/viewer-peer.ts        | 45 +++++++++++--------
 tests/native-viewer-peer.test.ts        | 34 +++++++++++++--
 tests/viewer-peer-generation.test.ts    | 57 +++++++++++++++----------
 5 files changed, 124 insertions(+), 64 deletions(-)

diff --git a/docs/standards/routing-transport.md b/docs/standards/routing-transport.md
index c84ede8a5..a2a97ac6f 100644
--- a/docs/standards/routing-transport.md
+++ b/docs/standards/routing-transport.md
@@ -119,8 +119,11 @@ deadline or start an independent recovery loop.
 When NAT traversal enhancement is enabled, another operation may use the
 remaining connection-attempt budget after rollback. The waiting display uses the actual
 server-issued attempt ordinal; it never counts time as an attempted connection.
-Committed Browser P2P recovery first restarts ICE on the same connection, then
+Committed P2P recovery first restarts ICE on the same connection, then
 rebuilds that connection if necessary, within the existing two-request budget.
+The budget belongs to the current parent and survives physical connection or
+Browser/Native backend replacement. Only a connected transport or a new parent
+resets it; replacing an unconnected backend cannot renew recovery indefinitely.
 Capable Native receivers also renegotiate that connection while retaining the
 encoded source, local playback and downstream edges when its codec/audio shape
 is unchanged. Pion owns ICE restart; each actual gathering owns fresh supplemental
diff --git a/src/client/native/native-viewer-peer.ts b/src/client/native/native-viewer-peer.ts
index 5233373e8..aaea00220 100644
--- a/src/client/native/native-viewer-peer.ts
+++ b/src/client/native/native-viewer-peer.ts
@@ -15,6 +15,8 @@ import {
   ViewerPeer,
   type ViewerPeerEvents,
   type ViewerPeerOptions,
+  type ViewerRecoveryBudget,
+  createViewerRecoveryBudget,
 } from "../webrtc/viewer-peer";
 import {
   iceServersWithNatPrediction,
@@ -61,6 +63,10 @@ export class NativeCapableViewerPeer implements ViewerMediaPeer {
     private readonly edgeCapacity: number,
   ) {
     this.currentIceConfig = iceConfig;
+    this.options = {
+      ...options,
+      recoveryBudget: options.recoveryBudget ?? createViewerRecoveryBudget(),
+    };
   }
 
   acceptSignal(parentPeerId: string, payload: SignalPayload): Promise<void> {
@@ -87,6 +93,9 @@ export class NativeCapableViewerPeer implements ViewerMediaPeer {
         ) {
           this.backend?.dispose();
           this.backend = null;
+          if (this.identity && this.identity.parentPeerId !== parentPeerId) {
+            this.options = { ...this.options, recoveryBudget: createViewerRecoveryBudget() };
+          }
           this.identity = nextIdentity;
         }
         if (!this.backend) {
@@ -198,8 +207,7 @@ class NativeViewerPeer implements ViewerMediaPeer {
   private disconnectTimer: number | null = null;
   private initialConnectionTimer: number | null = null;
   private recoveryTimer: number | null = null;
-  private automaticRecoveryRequests = 0;
-  private recoveryExhaustedReported = false;
+  private readonly recoveryBudget: ViewerRecoveryBudget;
   private state: RTCPeerConnectionState = "new";
   private localCandidateType: RTCIceCandidateType | null = null;
   private remoteCandidateType: RTCIceCandidateType | null = null;
@@ -236,6 +244,7 @@ class NativeViewerPeer implements ViewerMediaPeer {
   ) {
     this.currentIceConfig = iceConfig;
     this.recoveryOwner = options.recoveryOwner ?? "viewer";
+    this.recoveryBudget = options.recoveryBudget ?? createViewerRecoveryBudget();
     this.natPredictionEnabled = options.natPredictionEnabled ?? false;
     this.unsubscribe = client.onEvent((event) => this.onEvent(event));
     this.unsubscribeClose = client.onClose(() => {
@@ -291,8 +300,9 @@ class NativeViewerPeer implements ViewerMediaPeer {
     );
     if (sent) {
       this.clearInitialConnectionTimer();
-      this.automaticRecoveryRequests = Math.max(
-        this.automaticRecoveryRequests,
+      this.recoveryBudget.exhaustedReported = false;
+      this.recoveryBudget.requests = Math.max(
+        this.recoveryBudget.requests,
         rebuild ? VIEWER_MAX_AUTOMATIC_RECOVERY_REQUESTS : 1,
       );
       this.scheduleRecoveryDeadline();
@@ -364,7 +374,6 @@ class NativeViewerPeer implements ViewerMediaPeer {
       }
       this.parentPeerId = parentPeerId;
       this.connectionId = connectionId;
-      this.resetAutomaticRecovery();
     } else if (!retainSource) {
       this.disposeBridge();
     }
@@ -478,8 +487,8 @@ class NativeViewerPeer implements ViewerMediaPeer {
       );
       if (this.recoveryOwner === "route") {
         this.reportRecoveryExhausted();
-      } else if (!this.requestRecovery(true)) {
-        this.reportRecoveryExhausted();
+      } else {
+        this.attemptAutomaticRecovery(true);
       }
       return;
     }
@@ -650,41 +659,41 @@ class NativeViewerPeer implements ViewerMediaPeer {
       this.reportRecoveryExhausted();
       return;
     }
-    if (!this.requestRecovery(true)) {
-      this.reportRecoveryExhausted();
-    }
+    this.attemptAutomaticRecovery(true);
   }
 
-  private attemptAutomaticRecovery(): void {
+  private attemptAutomaticRecovery(forceRebuild = false): void {
     this.clearInitialConnectionTimer();
     if (
       this.disposed ||
       this.recoveryTimer !== null ||
-      this.recoveryExhaustedReported ||
+      this.recoveryBudget.exhaustedReported ||
       !this.connectionId ||
       !this.parentPeerId
     ) {
       return;
     }
     if (
-      this.automaticRecoveryRequests >=
+      this.recoveryBudget.requests >=
       VIEWER_MAX_AUTOMATIC_RECOVERY_REQUESTS
     ) {
       this.reportRecoveryExhausted();
       return;
     }
-    const rebuild = this.automaticRecoveryRequests > 0;
+    const rebuild = forceRebuild || this.recoveryBudget.requests > 0;
     if (!this.events.sendRestartRequest(this.parentPeerId, this.connectionId, rebuild)) {
       this.reportRecoveryExhausted();
       return;
     }
-    this.automaticRecoveryRequests += 1;
+    this.recoveryBudget.requests = rebuild
+      ? VIEWER_MAX_AUTOMATIC_RECOVERY_REQUESTS
+      : this.recoveryBudget.requests + 1;
     this.scheduleRecoveryDeadline();
   }
 
   private reportRecoveryExhausted(): void {
     if (
-      this.recoveryExhaustedReported ||
+      this.recoveryBudget.exhaustedReported ||
       !this.parentPeerId ||
       !this.connectionId
     ) return;
@@ -693,7 +702,7 @@ class NativeViewerPeer implements ViewerMediaPeer {
       this.parentPeerId,
       this.connectionId,
     ) ?? true;
-    if (reported) this.recoveryExhaustedReported = true;
+    if (reported) this.recoveryBudget.exhaustedReported = true;
     else this.scheduleRecoveryDeadline();
   }
 
@@ -721,8 +730,8 @@ class NativeViewerPeer implements ViewerMediaPeer {
 
   private resetAutomaticRecovery(): void {
     this.clearRecoveryTimer();
-    this.automaticRecoveryRequests = 0;
-    this.recoveryExhaustedReported = false;
+    this.recoveryBudget.requests = 0;
+    this.recoveryBudget.exhaustedReported = false;
   }
 
   private disposeBridge(): void {
diff --git a/src/client/webrtc/viewer-peer.ts b/src/client/webrtc/viewer-peer.ts
index 0c1cf5c56..cd3f70138 100644
--- a/src/client/webrtc/viewer-peer.ts
+++ b/src/client/webrtc/viewer-peer.ts
@@ -53,6 +53,17 @@ export interface ViewerPeerEvents {
 export interface ViewerPeerOptions {
   natPredictionEnabled?: boolean;
   recoveryOwner?: "viewer" | "route";
+  recoveryBudget?: ViewerRecoveryBudget;
+}
+
+// Physical replacement does not make an unreachable parent healthy again.
+export interface ViewerRecoveryBudget {
+  requests: number;
+  exhaustedReported: boolean;
+}
+
+export function createViewerRecoveryBudget(): ViewerRecoveryBudget {
+  return { requests: 0, exhaustedReported: false };
 }
 
 export interface ViewerMediaPeer {
@@ -89,9 +100,7 @@ export class ViewerPeer implements ViewerMediaPeer {
   private disconnectTimer: number | null = null;
   private initialConnectionTimer: number | null = null;
   private recoveryTimer: number | null = null;
-  private offerRecoveryAttempts = 0;
-  private automaticRecoveryRequests = 0;
-  private recoveryExhaustedReported = false;
+  private readonly recoveryBudget: ViewerRecoveryBudget;
   private disposed = false;
   private currentIceConfig: PeerIceConfig;
   private localIceCandidates: NatPredictionCandidateEmitter | null = null;
@@ -108,6 +117,7 @@ export class ViewerPeer implements ViewerMediaPeer {
     this.currentIceConfig = iceConfig;
     this.natPredictionEnabled = options.natPredictionEnabled ?? false;
     this.recoveryOwner = options.recoveryOwner ?? "viewer";
+    this.recoveryBudget = options.recoveryBudget ?? createViewerRecoveryBudget();
   }
 
   async acceptSignal(
@@ -185,8 +195,9 @@ export class ViewerPeer implements ViewerMediaPeer {
     );
     if (sent) {
       this.clearInitialConnectionTimer();
-      this.automaticRecoveryRequests = Math.max(
-        this.automaticRecoveryRequests,
+      this.recoveryBudget.exhaustedReported = false;
+      this.recoveryBudget.requests = Math.max(
+        this.recoveryBudget.requests,
         rebuild ? VIEWER_MAX_AUTOMATIC_RECOVERY_REQUESTS : 1,
       );
       this.scheduleRecoveryDeadline();
@@ -248,7 +259,6 @@ export class ViewerPeer implements ViewerMediaPeer {
       this.parentPeerId !== null && this.parentPeerId !== parentPeerId;
     this.disposeConnection();
     if (parentChanged) {
-      this.offerRecoveryAttempts = 0;
       this.resetAutomaticRecovery();
     }
     this.parentPeerId = parentPeerId;
@@ -396,7 +406,6 @@ export class ViewerPeer implements ViewerMediaPeer {
         throw new Error("signal send rejected");
       }
       this.clearRecoveryTimer();
-      this.offerRecoveryAttempts = 0;
       this.scheduleInitialConnectionDeadline(connection, connectionId);
     } catch (error) {
       if (!this.isCurrentConnection(connection, connectionId)) {
@@ -410,11 +419,11 @@ export class ViewerPeer implements ViewerMediaPeer {
     this.setError(error, "host.fail.connection");
     if (
       this.recoveryOwner === "viewer" &&
-      this.offerRecoveryAttempts < 1 &&
+      !this.recoveryBudget.exhaustedReported &&
+      this.recoveryBudget.requests < VIEWER_MAX_AUTOMATIC_RECOVERY_REQUESTS &&
       this.events.sendRestartRequest(parentPeerId, connectionId, true)
     ) {
-      this.offerRecoveryAttempts += 1;
-      this.automaticRecoveryRequests = VIEWER_MAX_AUTOMATIC_RECOVERY_REQUESTS;
+      this.recoveryBudget.requests = VIEWER_MAX_AUTOMATIC_RECOVERY_REQUESTS;
       this.scheduleRecoveryDeadline();
     } else {
       this.reportRecoveryExhausted();
@@ -479,18 +488,18 @@ export class ViewerPeer implements ViewerMediaPeer {
     if (
       this.disposed ||
       this.recoveryTimer !== null ||
-      this.recoveryExhaustedReported ||
+      this.recoveryBudget.exhaustedReported ||
       this.connection?.connectionState === "connected" ||
       !this.connectionId ||
       !this.parentPeerId
     ) {
       return;
     }
-    if (this.automaticRecoveryRequests >= VIEWER_MAX_AUTOMATIC_RECOVERY_REQUESTS) {
+    if (this.recoveryBudget.requests >= VIEWER_MAX_AUTOMATIC_RECOVERY_REQUESTS) {
       this.reportRecoveryExhausted();
       return;
     }
-    const rebuild = this.automaticRecoveryRequests > 0;
+    const rebuild = this.recoveryBudget.requests > 0;
     if (
       !this.events.sendRestartRequest(
         this.parentPeerId,
@@ -501,7 +510,7 @@ export class ViewerPeer implements ViewerMediaPeer {
       this.reportRecoveryExhausted();
       return;
     }
-    this.automaticRecoveryRequests += 1;
+    this.recoveryBudget.requests += 1;
     this.scheduleRecoveryDeadline();
   }
 
@@ -547,7 +556,7 @@ export class ViewerPeer implements ViewerMediaPeer {
 
   private reportRecoveryExhausted(): void {
     if (
-      this.recoveryExhaustedReported ||
+      this.recoveryBudget.exhaustedReported ||
       !this.parentPeerId ||
       !this.connectionId
     ) {
@@ -560,7 +569,7 @@ export class ViewerPeer implements ViewerMediaPeer {
         this.connectionId,
       ) ?? true;
     if (reported) {
-      this.recoveryExhaustedReported = true;
+      this.recoveryBudget.exhaustedReported = true;
     } else {
       this.scheduleRecoveryDeadline();
     }
@@ -568,8 +577,8 @@ export class ViewerPeer implements ViewerMediaPeer {
 
   private resetAutomaticRecovery(): void {
     this.clearRecoveryTimer();
-    this.automaticRecoveryRequests = 0;
-    this.recoveryExhaustedReported = false;
+    this.recoveryBudget.requests = 0;
+    this.recoveryBudget.exhaustedReported = false;
   }
 
   private queueCandidate(
diff --git a/tests/native-viewer-peer.test.ts b/tests/native-viewer-peer.test.ts
index 105af08a4..89f26a8fc 100644
--- a/tests/native-viewer-peer.test.ts
+++ b/tests/native-viewer-peer.test.ts
@@ -541,7 +541,7 @@ it.each([
   }
 });
 
-it.each([false, true])("keeps committed route recovery across backend replacement (replaced=%s)", async (replaced) => {
+it.each(["first", "replacement", "failed-offer"])("keeps committed route recovery and its budget across backend replacement (%s)", async (scenario) => {
   vi.useFakeTimers();
   vi.stubGlobal("window", globalThis);
   vi.stubGlobal("MediaStream", class { getTracks() { return []; } });
@@ -550,8 +550,9 @@ it.each([false, true])("keeps committed route recovery across backend replacemen
   vi.spyOn(NativeMediaBridge.prototype, "collectMetrics").mockResolvedValue({ ...EMPTY_METRICS });
   vi.spyOn(NativeMediaBridge.prototype, "decodedVideoFrames").mockResolvedValue(null);
   let onEvent!: (event: NativeClientEvent) => void;
+  const receiveOffer = vi.fn(async () => ({ answer: { type: "answer", sdp: "v=0\r\n" }, audio: false, codec: "vp8" }));
   const client = {
-    receiveOffer: async () => ({ answer: { type: "answer", sdp: "v=0\r\n" }, audio: false, codec: "vp8" }),
+    receiveOffer,
     onEvent: (fn: typeof onEvent) => { onEvent = fn; return () => undefined; },
     onClose: () => () => undefined,
     closeReceiver: vi.fn(async () => undefined), closeEdge: vi.fn(async () => undefined),
@@ -573,13 +574,38 @@ it.each([false, true])("keeps committed route recovery across backend replacemen
     state("first", "connected");
     peer.activatePreparedRoute();
     expect(options.recoveryOwner).toBe("route"); // Caller options are not mutable route state.
-    const connectionId = replaced ? "replacement" : "first";
-    if (replaced) {
+    const connectionId = scenario === "replacement" ? "replacement" : "first";
+    if (scenario === "replacement") {
       await peer.acceptSignal("parent", offer(connectionId));
       state(connectionId, "connected");
     }
     state(connectionId, "failed");
     expect(restart).toHaveBeenCalledExactlyOnceWith("parent", connectionId, false);
     expect(exhausted).not.toHaveBeenCalled();
+    await vi.advanceTimersByTimeAsync(VIEWER_AUTOMATIC_RECOVERY_TIMEOUT_MS);
+    expect(restart).toHaveBeenNthCalledWith(2, "parent", connectionId, true);
+
+    // A new physical ID is the requested rebuild, not a recovered parent.
+    const retiredEvent = onEvent;
+    if (scenario === "failed-offer") receiveOffer.mockRejectedValueOnce(new Error("receiver unavailable"));
+    await peer.acceptSignal("parent", offer("rebuilt"));
+    retiredEvent({ version: 9, shareId: "session", connectionId, type: "edge-state", state: "connected" });
+    state("rebuilt", "failed");
+    expect(restart).toHaveBeenCalledTimes(2);
+    expect(exhausted).toHaveBeenCalledExactlyOnceWith("parent", "rebuilt");
+
+    // Explicit retry owns a new bounded request and must report its outcome.
+    expect(peer.requestRecovery(true)).toBe(true);
+    await vi.advanceTimersByTimeAsync(VIEWER_AUTOMATIC_RECOVERY_TIMEOUT_MS);
+    expect(exhausted).toHaveBeenCalledTimes(2);
+
+    // Only actual recovery or a different parent gives a fresh budget.
+    await peer.acceptSignal("parent", offer("healthy"));
+    state("healthy", "connected");
+    state("healthy", "failed");
+    expect(restart).toHaveBeenNthCalledWith(4, "parent", "healthy", false);
+    await peer.acceptSignal("other-parent", offer("other-connection"));
+    state("other-connection", "failed");
+    expect(restart).toHaveBeenNthCalledWith(5, "other-parent", "other-connection", false);
   } finally { peer.dispose(); }
 });
diff --git a/tests/viewer-peer-generation.test.ts b/tests/viewer-peer-generation.test.ts
index 0a9d92c33..9f40f2f6e 100644
--- a/tests/viewer-peer-generation.test.ts
+++ b/tests/viewer-peer-generation.test.ts
@@ -2,8 +2,9 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import type { IceConfig, SignalPayload } from "../src/shared/protocol.ts";
 import type { PeerSnapshot } from "../src/client/types.ts";
-import { ViewerPeer } from "../src/client/webrtc/viewer-peer.ts";
+import { ViewerPeer, type ViewerPeerEvents } from "../src/client/webrtc/viewer-peer.ts";
 import { ViewerSfuRoute } from "../src/client/media/viewer-sfu-route";
+import { NativeCapableViewerPeer } from "../src/client/native/native-viewer-peer";
 
 interface Deferred<T> {
   promise: Promise<T>;
@@ -304,9 +305,9 @@ describe("ViewerPeer connection generations", () => {
       expect(peer.hasConnectionId(id)).toBe(true);
       return true;
     });
-    const peer = new ViewerPeer({ iceServers: [] }, { sendSignal, sendRestartRequest,
+    const peer = new NativeCapableViewerPeer({ iceServers: [] }, { sendSignal, sendRestartRequest,
       onStream: () => undefined, onUpdate: () => undefined, onRecoveryExhausted: exhausted },
-      { recoveryOwner });
+      { recoveryOwner }, async () => null, () => undefined, "session", 2);
     FakePeerConnection.plans.push({ constructorError: new DOMException("Allocation failed", "UnknownError") });
     await expect(peer.acceptSignal("host", offer("first"))).resolves.toBeUndefined();
     expect(peer.hasConnection()).toBe(false);
@@ -724,29 +725,30 @@ describe("ViewerPeer connection generations", () => {
     expect(timeoutDelays).toEqual(new Map());
   });
 
-  it("reports one exhausted edge after bounded restart and rebuild attempts", async () => {
+  it.each([false, true])("bounds recovery across rebuilt Browser connections (native wrapper=%s)", async (wrapped) => {
     const restartRequests: Array<{
       peerId: string;
       connectionId: string;
       rebuild: boolean;
     }> = [];
     const exhausted: Array<{ peerId: string; connectionId: string }> = [];
-    const peer = new ViewerPeer(
-      { iceServers: [] },
-      {
-        sendSignal: () => true,
-        sendRestartRequest: (peerId, connectionId, rebuild) => {
-          restartRequests.push({ peerId, connectionId, rebuild });
-          return true;
-        },
-        onStream: () => undefined,
-        onUpdate: () => undefined,
-        onRecoveryExhausted: (peerId, connectionId) => {
-          exhausted.push({ peerId, connectionId });
-          return true;
-        },
+    const events: ViewerPeerEvents = {
+      sendSignal: () => true,
+      sendRestartRequest: (peerId, connectionId, rebuild) => {
+        restartRequests.push({ peerId, connectionId, rebuild });
+        return true;
       },
-    );
+      onStream: () => undefined,
+      onUpdate: () => undefined,
+      onRecoveryExhausted: (peerId, connectionId) => {
+        exhausted.push({ peerId, connectionId });
+        return true;
+      },
+    };
+    const peer = wrapped
+      ? new NativeCapableViewerPeer({ iceServers: [] }, events, {}, async () => null,
+          () => undefined, "session", 2)
+      : new ViewerPeer({ iceServers: [] }, events);
     await peer.acceptSignal("relay-parent", offer("failed-connection"));
     const connection = FakePeerConnection.instances[0]!;
     connection.connectionState = "failed";
@@ -765,14 +767,25 @@ describe("ViewerPeer connection generations", () => {
       connectionId: "failed-connection",
       rebuild: true,
     });
-    timeoutCallbacks.get(3)!();
+    await peer.acceptSignal("relay-parent", offer("rebuilt-connection"));
+    expect(timeoutCallbacks.has(3)).toBe(false);
+    connection.connectionState = "connected";
+    connection.dispatchEvent(new Event("connectionstatechange"));
+    const rebuilt = FakePeerConnection.instances.at(-1)!;
+    rebuilt.connectionState = "failed";
+    rebuilt.dispatchEvent(new Event("connectionstatechange"));
     expect(exhausted).toEqual([
-      { peerId: "relay-parent", connectionId: "failed-connection" },
+      { peerId: "relay-parent", connectionId: "rebuilt-connection" },
     ]);
 
-    connection.dispatchEvent(new Event("connectionstatechange"));
+    rebuilt.dispatchEvent(new Event("connectionstatechange"));
     expect(restartRequests).toHaveLength(2);
     expect(exhausted).toHaveLength(1);
+    expect(peer.requestRecovery(true)).toBe(true);
+    [...timeoutCallbacks.values()].at(-1)!();
+    expect(restartRequests).toHaveLength(3);
+    expect(exhausted).toHaveLength(2);
+    peer.dispose();
   });
 
   it("retries delivery of an exhausted edge after signaling reconnects", async () => {

From 80c34d6bb18c26315b07fa2af064b7b230e5739d Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 01:39:05 +0800
Subject: [PATCH 051/262] docs(transport): record recovery owner and timing
 limits

---
 docs/research/nat-traversal.md | 58 ++++++++++++++++++++++------------
 docs/todo.md                   |  4 +--
 2 files changed, 39 insertions(+), 23 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 0be016afd..7433b41ff 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1,6 +1,6 @@
 # Browser And Native NAT Traversal
 
-Last reviewed: 2026-10-07
+Last reviewed: 2026-10-09
 
 This document owns evidence for improving direct ICE without adding a
 new relay or a custom transport. The current product contract remains standard
@@ -488,26 +488,42 @@ barrier, and probe expiry does not establish media failure or justify replacing
 healthy media. These controls use fixture SDP exchange; they do not diagnose the
 product's Trickle ICE or an existing user's failure.
 
-A follow-up kernel fixture on 2026-10-09 matches the committed Viewer's two
-three-second recovery opportunities: restart ICE, then rebuild only if still
-not connected at the first deadline. It retains tunnel identity and outer NAT
-mappings, creates a new inner flow for replacement, and keeps default Pion checks
-without an explicit discovery hook. Setup consumes its opportunity; fresh SRTP
-is checked separately after connection meets the deadline. Post-restoration
-controls cover eight-, nine- and eleven-second blackouts; Tailcat also starts
-recovery one or two seconds before restoration. All five Tailcat cases pass two
-further race-detector repetitions, recovering through restart or replacement;
-the ordinary Pion controls also pass. Failure of the first ICE generation alone
-therefore does not establish failure of both existing recovery opportunities.
-
-The fixture's replacement flow repeats an initial datagram until the SDP exchange
-confirms listener acceptance, bounded by that same opportunity. A lone lost
-preface had blocked setup before ICE could run. This fixture handshake is not an
-accepted product protocol or proof of media readiness. Its complete-gathering
-SDP exchange also stalls ordinary Pion when started before network restoration;
-that result is not Piik's Trickle ICE behavior. The passing controls narrow the
-integration question but do not run the actual Viewer scheduler, room authority
-or Browser decoder, and do not establish additional direct reachability.
+Manually phased replacement controls give ICE restart and inner-flow replacement
+three seconds each, retaining the tunnel, outer mappings and default Pion checks.
+Post-restoration controls pass after eight-, nine- and eleven-second blackouts;
+two Tailcat controls starting before restoration also pass two further race
+repetitions. These windows are stricter than a replacement receiver's actual
+15-second initial-connection deadline, not a reproduction of the Viewer schedule.
+A bounded repeated fixture preface prevents a lost first UDP packet from blocking
+listener acceptance before ICE. It is not product signaling or media-health proof.
+
+A separate fixture feeds kernel connection states into the actual
+`NativeCapableViewerPeer`. Each rebuild gets a new connection ID, as in the
+product, while preserving the parent's recovery budget. Renewing that budget
+on replacement hid the nine-second outage: three repetitions recovered only
+after a third automatic request, outside the two-request contract. The corrected
+owner and fixture retain the count across Native and Browser backend replacement.
+This independent recovery defect does not establish the self-hosted SFU report's cause.
+
+With that correction, two-second interruptions recover without restart;
+permanent loss exhausts recovery and disposal cancels it. Seven- and eleven-second
+Tailcat interruptions pass in the checked run. Nine seconds exhausts the budget:
+the replacement sends eight inner Binding checks, receives none, and delivers no
+fresh SRTP during its initial deadline or a separate three-second observation
+after exhaustion. That observation grants no additional recovery. Native control
+and local decoding are stubbed, events are sampled within 100 ms, and SDP waits
+for complete gathering. These limits prevent claiming full App integration or
+diagnosing a field failure; the composition gap remains an adoption concern.
+
+The existing [Pion Binding-request setting](https://github.com/pion/webrtc/blob/v4.2.19/settingengine.go#L506)
+was then varied without changing the owner, timers or outer tunnel. Both 16-
+and 64-check controls initially recovered nine- and eleven-second interruptions.
+Six further 16-check cases recovered three times and failed three times during
+replacement setup, before its SDP exchange completed. Three narrower reruns with
+stage diagnostics passed; the setup failures' precise cause remains unconfirmed.
+Increasing inner checks can bridge one discovery phase but has not established
+reliable composition. It is not an accepted product setting or reason to add a
+second readiness owner, discovery loop or longer deadline.
 
 Separate checks preserve continuous sibling audio/video through a local ICE
 restart, failed-flow retirement, both callers' pending cancellation/deadline,
diff --git a/docs/todo.md b/docs/todo.md
index 643031529..2d04fa7ed 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -58,8 +58,8 @@ Implementation needs a concrete useful result within the product model.
   before accepting room-scoped peer keys, flow admission and relay operation.
   Product adoption still needs supported
   [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary)
-  and RTCP/MTU boundaries, plus verification through the actual Viewer recovery
-  owner and mixed Browser/Native routes. Keep isolated dependency patches and
+  and RTCP/MTU boundaries, resolution of recovery failures under the actual Viewer
+  owner, and mixed Browser/Native verification. Keep isolated dependency patches and
   recovery counterfactuals outside product routing; a diagnostic reply is not
   media-readiness authority. Research owns the experiments and their limits.
   No timeout change or transport integration is accepted; the P2P evidence work

From 66d2a085e12e3349d39698d32c4d00c93c59b3c9 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 02:06:33 +0800
Subject: [PATCH 052/262] docs(transport): record listener isolation boundary

---
 docs/research/nat-traversal.md | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 7433b41ff..21612fc68 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -376,6 +376,16 @@ Pion and Tailcat, including TWCC and keyframe requests. Tailcat recovered an
 injected missing video packet through existing NACK handling after DERP closed.
 This is forwarding evidence, not throughput or room-controller acceptance.
 
+A 2026-10-09 inbound-only control found that opening or closing an unrelated
+Tailcat listener discards an accepted UDP flow's filter state. The unchanged
+control passes; both listener changes stop delivery. Continuous outbound media
+can recreate the reverse-flow entry, explaining why bidirectional checks alone
+miss this boundary. The isolated repair passes the previous filter to Tailscale's
+[existing shared-state API](https://github.com/tailscale/tailscale/blob/a0e471a35b8f/wgengine/filter/filter.go#L218).
+Three race repetitions, the copied Tailcat listener suite and the combined
+revocation/isolation controls pass. The patch remains experimental; it neither
+changes Piik nor fixes the independent inner-ICE recovery failure below.
+
 A separate real Chrome control decoded H.264/Opus and VP8/Opus from a generated
 640×360 picture and tone through Browser WebRTC → Pion/Tailcat/Pion → Browser
 WebRTC without re-encoding. Picture and decoded audio continued after DERP
@@ -507,7 +517,7 @@ This independent recovery defect does not establish the self-hosted SFU report's
 
 With that correction, two-second interruptions recover without restart;
 permanent loss exhausts recovery and disposal cancels it. Seven- and eleven-second
-Tailcat interruptions pass in the checked run. Nine seconds exhausts the budget:
+Tailcat interruptions pass in the checked run. Nine seconds can exhaust the budget:
 the replacement sends eight inner Binding checks, receives none, and delivers no
 fresh SRTP during its initial deadline or a separate three-second observation
 after exhaustion. That observation grants no additional recovery. Native control
@@ -521,7 +531,11 @@ and 64-check controls initially recovered nine- and eleven-second interruptions.
 Six further 16-check cases recovered three times and failed three times during
 replacement setup, before its SDP exchange completed. Three narrower reruns with
 stage diagnostics passed; the setup failures' precise cause remains unconfirmed.
-Increasing inner checks can bridge one discovery phase but has not established
+With the separate listener-state repair, paired counters still reproduce a
+default-budget failure: the server receives the client's inner STUN packets,
+while the client receives none. Four additional 16-check controls recover;
+they do not resolve the earlier setup failures. Increasing inner checks can
+bridge one discovery phase but has not established
 reliable composition. It is not an accepted product setting or reason to add a
 second readiness owner, discovery loop or longer deadline.
 

From 90d005f06f88b6a5217e1a3bc8199b2011bfc57b Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 02:44:04 +0800
Subject: [PATCH 053/262] fix(routing): preserve new-session recovery
 opportunities

---
 docs/research/nat-traversal.md                |  1 +
 docs/standards/routing-transport.md           |  3 +
 docs/todo.md                                  | 11 ++-
 internal/server/route/api.go                  |  2 +
 internal/server/route/controller.go           |  3 +
 internal/server/route/harness_test.go         |  3 +
 internal/server/route/operation.go            |  2 +
 internal/server/route/opportunities.go        | 22 ++---
 .../server/route/session_opportunity_test.go  | 64 +++++++++++++
 internal/server/signal/router_failure_test.go | 91 +++++++++++++++++++
 scripts/embedded-sfu-gate.ts                  | 12 ++-
 scripts/embedded-sfu-page.ts                  | 15 ++-
 12 files changed, 211 insertions(+), 18 deletions(-)
 create mode 100644 internal/server/route/session_opportunity_test.go

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 21612fc68..de723193f 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -488,6 +488,7 @@ disconnect-grace, restart and rebuild schedule.
 | One probe on each side before default-Pion restart | Nine- and eleven-second blackouts recovered in three race-detector repetitions, including both probes and SDP exchange inside three seconds. This requires an isolated, unsupported Server hook. |
 | Same bilateral probe begins while the network is still down | After eight seconds of blackout, restoration one or two seconds into the probe still left it waiting until its three-second deadline in repeated race checks. Post-restoration controls continued to pass. |
 | Lost bilateral probes, retain the existing media connection | In six race checks, both probes expired while WebRTC was already connected; a subsequent observation received fresh SRTP without new SDP, sockets or credentials. The separate three-second observation is not a product recovery extension. |
+| New flow confirms encrypted UDP in both directions before inner ICE | With the listener-state repair and actual Viewer owner, one of four nine-/eleven-second controls recovered; three timed out in the existing three-second preparation, before SDP. The bounded fixture echo changes where waiting occurs, not the underlying recovery limit. |
 
 These controls limit the bilateral proposal: a
 [`DiscoPing` call](https://github.com/tailscale/tailcat/blob/b4dc28e8aa8936f0a90a41ad8293a64e3d6b645f/tailcat.go#L2258)
diff --git a/docs/standards/routing-transport.md b/docs/standards/routing-transport.md
index a2a97ac6f..4397c54b9 100644
--- a/docs/standards/routing-transport.md
+++ b/docs/standards/routing-transport.md
@@ -217,6 +217,9 @@ An active configuration describes that connection; it cannot create a replacemen
 Browser subscriber. Replacement needs the controller's prepared subscription and
 first-frame proof. Reauthentication during an unfinished restart also returns
 that subscription to its route owner; sending an answer is not connection proof.
+Retained media keeps its original acquisition opportunity when signaling sessions
+change. Its failure cannot consume a new session's untried opportunity; a new
+physical connection binds the current one. This applies to Peer and SFU edges.
 An exhausted opportunity remains an explicit failure until an eligible new fact
 reopens acquisition. Source capture remains Host-owned throughout.
 
diff --git a/docs/todo.md b/docs/todo.md
index 2d04fa7ed..a65e471d3 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -15,9 +15,6 @@ Git/PRs own completed history.
   coherent candidate and stop before publication. Preserve the existing product
   model; evaluate held features against measurable benefit and total complexity
   before accepting a changed contract.
-  Windows full Go acceptance needs a runner that permits its test executables;
-  the current run stopped before the Browser-launcher package tests with an OS
-  access denial. Separate native checks and Linux checks do not close that gap.
 - [ ] **Independent Gitee mirror recovery.** Implementation and local acceptance
   are complete. Integrate through the next owner-approved publishing merge and
   verify the separate workflow with its original CI artifacts. Mirror failure
@@ -130,6 +127,14 @@ of a reporter's cause; research owns the completed experiments and their limits.
   The local Native H264/SFU-only control passes, but does not reproduce the
   reporter's network. Correlate transport-state diagnostics with the affected
   Viewer before changing admission or recovery.
+  [#468](https://github.com/TNTcraftHIM/Piik/issues/468) needs the complete join
+  trace to distinguish a new Viewer from reauthentication with lost local media;
+  its excerpt starts with an already committed SFU edge. Retest the affected
+  deployment with the repaired retained-connection opportunity accounting.
+  [#467](https://github.com/TNTcraftHIM/Piik/issues/467)'s Viewer report reaches
+  four preparations and exhaustion in about 170 ms, without local peer creation
+  or a Viewer failure report. Obtain the paired Host/App rejection before
+  attributing this attempt to NAT or extending its network timeout.
   [#465](https://github.com/TNTcraftHIM/Piik/issues/465) reports Chrome/Firefox
   LAN asymmetry, local-pool timeout and separate public-path quality loss.
   Its successful repeat changed both local-network permission and IP masking.
diff --git a/internal/server/route/api.go b/internal/server/route/api.go
index 1311e950d..bb9633e80 100644
--- a/internal/server/route/api.go
+++ b/internal/server/route/api.go
@@ -224,6 +224,8 @@ type CommittedEdge struct {
 	Usable                bool
 	PhysicalActive        bool
 	Resource              *Resource
+	// The acquisition's session key stays fixed when signaling ownership rebinds.
+	opportunityKey string
 }
 
 // HostPublication is the single live SFU ingress.
diff --git a/internal/server/route/controller.go b/internal/server/route/controller.go
index 221b902be..a180f07d6 100644
--- a/internal/server/route/controller.go
+++ b/internal/server/route/controller.go
@@ -742,6 +742,9 @@ func (c *Controller) AdoptDirectConnection(input AdoptDirectConnectionInput, now
 	}
 	c.clearQualityForParticipant(input.ChildPeerID)
 	edge.ConnectionID = input.NewConnectionID
+	edge.opportunityKey = c.candidateOpportunityBase(input.ChildPeerID, CandidatePlan{
+		Tuple: CandidateTuple{Kind: edge.Kind, ParentPeerID: edge.ParentPeerID},
+	})
 	if child, ok := c.participants.Get(input.ChildPeerID); ok {
 		child.availabilityExhausted = false
 	}
diff --git a/internal/server/route/harness_test.go b/internal/server/route/harness_test.go
index 82261b1ff..0041a5565 100644
--- a/internal/server/route/harness_test.go
+++ b/internal/server/route/harness_test.go
@@ -242,6 +242,9 @@ func (c *Controller) hydrateEdge(childPeerID string, edge committedEdgeSeed) {
 		Usable:                edge.Usable,
 		PhysicalActive:        edge.PhysicalActive,
 		Resource:              edge.Resource,
+		opportunityKey: c.candidateOpportunityBase(childPeerID, CandidatePlan{
+			Tuple: CandidateTuple{Kind: edge.Kind, ParentPeerID: edge.ParentPeerID},
+		}),
 	}
 	if edge.Kind == UpstreamPeer {
 		if parent, ok := c.participants.Get(edge.ParentPeerID); ok {
diff --git a/internal/server/route/operation.go b/internal/server/route/operation.go
index 10bc58fb0..ce9742570 100644
--- a/internal/server/route/operation.go
+++ b/internal/server/route/operation.go
@@ -948,6 +948,7 @@ func (c *Controller) commitAttempt(op *operation, att *attempt) []*Resource {
 			ConnectionID:    att.connectionID,
 			Usable:          true,
 			PhysicalActive:  true,
+			opportunityKey:  c.candidateOpportunityBase(op.childPeerID, CandidatePlan{Tuple: att.tuple}),
 		})
 		c.directContinuations.Delete(op.childPeerID)
 	} else {
@@ -981,6 +982,7 @@ func (c *Controller) commitAttempt(op *operation, att *attempt) []*Resource {
 			Usable:                true,
 			PhysicalActive:        true,
 			Resource:              att.reservation.Edge,
+			opportunityKey:        c.candidateOpportunityBase(op.childPeerID, CandidatePlan{Tuple: att.tuple}),
 		})
 		var remainingParentPeerIDs []string
 		if op.reason == DemandSfuBootstrap && oldPeer && old.Usable && old.PhysicalActive {
diff --git a/internal/server/route/opportunities.go b/internal/server/route/opportunities.go
index 8407d805e..96e2645db 100644
--- a/internal/server/route/opportunities.go
+++ b/internal/server/route/opportunities.go
@@ -165,19 +165,19 @@ func (c *Controller) consumeQualityOperationCandidates(op *operation) {
 
 // consumeActiveEdgeOpportunity exhausts the invalidated edge's exact tuple at rank 0.
 func (c *Controller) consumeActiveEdgeOpportunity(child *participant, edge *CommittedEdge) {
-	if edge.Kind == UpstreamPeer {
-		key := "peer:" + edge.ParentPeerID + "\x00" + child.sessionID + "\x00" + edge.ParentSessionID
-		previous, _ := child.consumedCandidateOpportunities.Get(key)
-		child.consumedCandidateOpportunities.Set(key, candidateOpportunity{
-			rank:            0,
-			startedAttempts: previous.startedAttempts,
-			exhausted:       true,
-		})
+	key := c.candidateOpportunityBase(child.peerID, CandidatePlan{
+		Tuple: CandidateTuple{Kind: edge.Kind, ParentPeerID: edge.ParentPeerID},
+	})
+	// A retained connection can fail after reauthentication. Its old acquisition
+	// must not exhaust the replacement session's still-untried opportunity.
+	if edge.opportunityKey != key {
 		return
 	}
-	c.consumeCandidateOpportunity(child.peerID, CandidatePlan{
-		Tuple:              CandidateTuple{Kind: UpstreamSfu, Publication: PublicationReuse},
-		EndpointTransition: EndpointTransition{Kind: TransitionNone},
+	previous, _ := child.consumedCandidateOpportunities.Get(key)
+	child.consumedCandidateOpportunities.Set(key, candidateOpportunity{
+		rank:            0,
+		startedAttempts: previous.startedAttempts,
+		exhausted:       true,
 	})
 }
 
diff --git a/internal/server/route/session_opportunity_test.go b/internal/server/route/session_opportunity_test.go
new file mode 100644
index 000000000..4450fdc8a
--- /dev/null
+++ b/internal/server/route/session_opportunity_test.go
@@ -0,0 +1,64 @@
+package route
+
+import "testing"
+
+func TestRetainedEdgeFailurePreservesNewSessionOpportunity(t *testing.T) {
+	for _, upstream := range []UpstreamKind{UpstreamPeer, UpstreamSfu} {
+		for _, changed := range []string{"none", "child", "host"} {
+			t.Run(string(upstream)+"/"+changed, func(t *testing.T) {
+				routes := newController(2, Options{SfuEnabled: true})
+				addViewer(routes, A, 0, nil)
+				if upstream == UpstreamSfu {
+					routes.hydrateHostPublication("publication", res("publication_resource"), "")
+					routes.hydrateEdge(A, sfuEdge("publication", "retained_connection", "subscription"))
+				} else {
+					routes.hydrateEdge(A, peerEdge(HOST, "retained_connection"))
+				}
+				switch changed {
+				case "child":
+					routes.UpsertParticipant(viewerInput(A, "replacement_child_session", 0), nil)
+				case "host":
+					routes.UpsertParticipant(hostInput("replacement_host_session", 2), nil)
+				}
+				// Reauthentication keeps healthy media and its physical identity.
+				edge := edgeOf(t, routes, A)
+				eq(t, edge.Usable, true)
+				eq(t, edge.ConnectionID, "retained_connection")
+				noOperation(t, routes.Reconcile(0).Operation)
+				eq(t, routes.InvalidateEdge(EdgeGuard{
+					ChildPeerID: A, ChildSessionID: edge.ChildSessionID,
+					ParentSessionID: edge.ParentSessionID,
+					RouteRevision:   routes.Snapshot().Revision, ConnectionID: edge.ConnectionID,
+				}, ms(1)), true)
+				operation := must(t, routes.Reconcile(1).Operation)
+				eq(t, hasTuple(operation, func(tuple CandidateTuple) bool {
+					return tuple.Kind == upstream
+				}), changed != "none")
+			})
+		}
+	}
+}
+
+func TestRebuiltDirectConnectionConsumesCurrentSessionOpportunity(t *testing.T) {
+	routes := newController(2, Options{SfuEnabled: true})
+	addViewer(routes, A, 0, ms(0))
+	routes.Reconcile(0)
+	commitCurrent(t, routes, 1, "original_connection")
+	routes.UpsertParticipant(viewerInput(A, "replacement_child_session", 0), nil)
+	edge := edgeOf(t, routes, A)
+	result := routes.AdoptDirectConnection(AdoptDirectConnectionInput{
+		EdgeGuard: EdgeGuard{
+			ChildPeerID: A, ChildSessionID: edge.ChildSessionID,
+			ParentSessionID: edge.ParentSessionID, RouteRevision: routes.Snapshot().Revision,
+			ConnectionID: edge.ConnectionID,
+		},
+		NewConnectionID: "rebuilt_connection",
+	}, 3)
+	eq(t, result.Accepted, true)
+	eq(t, routes.InvalidateEdge(EdgeGuard{
+		ChildPeerID: A, ChildSessionID: edge.ChildSessionID,
+		ParentSessionID: edge.ParentSessionID, RouteRevision: result.ActiveRevision,
+		ConnectionID: "rebuilt_connection",
+	}, ms(4)), true)
+	eq(t, hasTuple(must(t, routes.Reconcile(4).Operation), isPeer), false)
+}
diff --git a/internal/server/signal/router_failure_test.go b/internal/server/signal/router_failure_test.go
index cc092abfd..000ce5705 100644
--- a/internal/server/signal/router_failure_test.go
+++ b/internal/server/signal/router_failure_test.go
@@ -4,8 +4,99 @@ import (
 	"testing"
 
 	"github.com/TNTcraftHIM/Piik/internal/server/protocol"
+	"github.com/TNTcraftHIM/Piik/internal/server/room"
+	"github.com/TNTcraftHIM/Piik/internal/server/sfu"
 )
 
+func TestRouterPreparesSfuForNewAndReauthenticatedViewers(t *testing.T) {
+	for _, reauthenticate := range []bool{false, true} {
+		name := "new-viewer"
+		if reauthenticate {
+			name = "lost-retained-media"
+		}
+		t.Run(name, func(t *testing.T) {
+			h := newRouterHarness(t, routerHarnessOptions{capacity: 1, withSfu: true, fakeTimers: true})
+			created := h.createRoom()
+			_, first, sibling := h.establishSfuRoom(created)
+			viewer := first
+			if reauthenticate {
+				viewer.sessionID = "replacement_viewer_session_12345678"
+				h.locked(func() {
+					connected, err := h.store.ConnectParticipant(room.ConnectParticipantInput{
+						RoomID: created.RoomID, Role: protocol.RoleViewer,
+						ViewerGrant: created.ViewerGrant,
+						ClientID:    "viewer_client_sfu-root-" + created.RoomID + "_12345678",
+						SessionID:   viewer.sessionID,
+					})
+					if err != nil || connected.PeerID != first.peerID {
+						t.Fatalf("viewer replacement changed identity: %v", err)
+					}
+				})
+			} else {
+				viewer = h.connectViewer(created, "late-viewer")
+			}
+			var retained activeViewerMediaEdge
+			h.locked(func() {
+				if reauthenticate {
+					retained = h.doMustEdge(created.RoomID, viewer.peerID)
+				}
+				state := h.doComplete(viewer)
+				expected := protocol.NoUpstream()
+				if reauthenticate {
+					expected = protocol.SfuUpstream()
+				}
+				if state.routeAssignment.Upstream != expected {
+					t.Fatalf("authentication upstream = %v, want %v", state.routeAssignment.Upstream, expected)
+				}
+			})
+			if reauthenticate {
+				h.settle()
+				if sfuConfigCount(h.messages(viewer.sessionID)) != 1 {
+					t.Fatal("healthy retained media must receive its current configuration")
+				}
+				for _, message := range h.messages(viewer.sessionID) {
+					if _, ok := message.(protocol.RouteUpdatePrepareMessage); ok {
+						t.Fatal("reauthentication alone must not replace healthy media")
+					}
+				}
+				h.routeFailed(viewer, routeFailedMessage(retained.revision, "active", retained.connectionID))
+			}
+			prepared := h.waitPreparedTransport(viewer.sessionID, "sfu")
+			if prepared.Candidate.ConnectionID == retained.connectionID {
+				t.Fatal("replacement must allocate a new physical connection")
+			}
+			preparedSeen, configured := false, false
+			for _, message := range h.messages(viewer.sessionID) {
+				switch value := message.(type) {
+				case protocol.RouteUpdatePrepareMessage:
+					preparedSeen = value.Candidate.ConnectionID == prepared.Candidate.ConnectionID
+				case protocol.SfuConfigMessage:
+					if value.ConnectionID == prepared.Candidate.ConnectionID {
+						if !preparedSeen {
+							t.Fatal("new subscription configuration preceded its preparation")
+						}
+						configured = true
+					}
+				}
+			}
+			if !configured {
+				t.Fatal("prepared subscription has no configuration")
+			}
+			h.routeReady(viewer, int64(prepared.Revision))
+			h.locked(func() {
+				if h.doMustEdge(created.RoomID, sibling.peerID).upstream != protocol.SfuUpstream() {
+					t.Fatal("healthy sibling lost its SFU route")
+				}
+			})
+			egress := 3
+			if reauthenticate {
+				egress = 2
+			}
+			h.waitUsage(sfu.Usage{Ingress: 1, Egress: egress})
+		})
+	}
+}
+
 func TestRouterFencesDelayedActiveFailureByPhysicalConnection(t *testing.T) {
 	for _, transport := range []string{"peer", "sfu"} {
 		for _, role := range []string{"host", "viewer"} {
diff --git a/scripts/embedded-sfu-gate.ts b/scripts/embedded-sfu-gate.ts
index 47b7c5b4f..38d1bb78c 100644
--- a/scripts/embedded-sfu-gate.ts
+++ b/scripts/embedded-sfu-gate.ts
@@ -105,7 +105,7 @@ async function main(): Promise<void> {
     displayLifecycle: null as { hiddenFrames: number; hiddenElapsedMs: number; lowLayerDecoded: boolean; resumed: boolean; replaced: boolean } | null,
     mediaDiagnostics: null as unknown,
     sourceDrawing: null as { draws: number; elapsedMs: number; visibility: string } | null,
-    publicationRetired: false, subscriptionRecovered: false, nativeShareStopped: !nativeArm, udpReleased: false, cleanup: false, error: null as string | null };
+    publicationRetired: false, subscriptionRecovered: false, pageReloadRecovered: false, nativeShareStopped: !nativeArm, udpReleased: false, cleanup: false, error: null as string | null };
   let server: ChildProcessWithoutNullStreams | null = null;
   let chrome: ChildProcessWithoutNullStreams | null = null;
   let vite: ViteDevServer | null = null;
@@ -315,6 +315,14 @@ async function main(): Promise<void> {
     result.low = await call(viewer, "gate.waitForFrames(854, 480)");
     await waitForSample(() => call<number>(viewer!, "gate.audioEnergy()", 3_000),
       (energy) => { result.audioEnergy.low = energy; return energy > result.audioEnergy.high; }, 5_000);
+    result.stage = "viewer-media-reload";
+    const retainedSubscription = (await call<Snapshot>(viewer, "gate.snapshot()")).connectionId;
+    // A reload loses local media before reporting failure, while room authority
+    // still retains the old committed edge inside the reconnect grace period.
+    await call(viewer, `gate.reconnectViewer(${JSON.stringify(room)}, true)`);
+    await until(viewer, value => value.committed && value.connectionId !== retainedSubscription && value.audioKbps > 0);
+    await call(viewer, "gate.waitForFrames(854, 480)");
+    result.pageReloadRecovered = true;
     result.stage = "committed-subscription-recovery";
     const previousSubscription = await call<string>(viewer, "gate.failSubscription()");
     // Terminal failure consumes this exact opportunity. A new authenticated
@@ -384,7 +392,7 @@ async function main(): Promise<void> {
     (nativeArm || result.stereoSeparationDb?.every(db => db > 20) === true) &&
     result.viewer.audioKbps > 0 && result.audioEnergy.high > 0 && result.audioEnergy.low > result.audioEnergy.high &&
     result.high !== null && result.low !== null && result.audioEnergy.recovered > 0 &&
-    result.publicationRetired && result.subscriptionRecovered && result.cleanup && result.nativeShareStopped &&
+    result.publicationRetired && result.subscriptionRecovered && result.pageReloadRecovered && result.cleanup && result.nativeShareStopped &&
     (!displayArm || result.displayLifecycle?.hiddenFrames === 150 && result.displayLifecycle.lowLayerDecoded &&
       result.displayLifecycle.resumed && result.displayLifecycle.replaced) &&
     (!result.secondRoom || result.secondRoom.connected && result.secondRoom.framesAfterFirstStopped >= 30 &&
diff --git a/scripts/embedded-sfu-page.ts b/scripts/embedded-sfu-page.ts
index a6d588119..43f3a2060 100644
--- a/scripts/embedded-sfu-page.ts
+++ b/scripts/embedded-sfu-page.ts
@@ -157,7 +157,9 @@ async function accept(message: ServerMessage, host: boolean): Promise<void> {
     }
   }
   if (message.type === "sfu-config") {
-    configuration = message;
+    // A late refresh can describe the old edge after a newer prepare. The route
+    // owner rejects it; the fixture's reported identity must not move backward.
+    if (!configuration || message.revision >= configuration.revision) configuration = message;
     if (host) {
       await hostRoute?.acceptConfig(message);
       published = publisher !== null;
@@ -173,6 +175,7 @@ async function connect(room: CreateRoomResponse, host: boolean): Promise<void> {
   socket = new WebSocket(new URL("/signal", location.href).href.replace(/^http/, "ws"));
   const connection = socket;
   socket.addEventListener("message", ({ data }) => {
+    if (socket !== connection) return;
     messageTail = messageTail.then(() => accept(decodeServerMessage(String(data)), host)).catch(failed);
   });
   socket.addEventListener("error", () => failed("Room WebSocket failed"));
@@ -295,10 +298,18 @@ export async function startViewer(room: CreateRoomResponse): Promise<void> {
   await connect(room, false);
 }
 
-export async function reconnectViewer(room: CreateRoomResponse): Promise<void> {
+export async function reconnectViewer(room: CreateRoomResponse, discardMedia = false): Promise<void> {
   const previous = socket;
   socket = null;
   previous?.close();
+  if (discardMedia) {
+    await messageTail;
+    await viewerRoute?.disconnect();
+    viewerRoute = null;
+    video?.remove();
+    video = null;
+    decoded = committed = false;
+  }
   authenticated = false;
   await connect(room, false);
 }

From 11005952aee3271280b3b6035e8e7c4cb6eaea73 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 03:04:54 +0800
Subject: [PATCH 054/262] docs(network): qualify transport recovery evidence

---
 docs/research/nat-traversal.md | 16 ++++++++++++++++
 docs/todo.md                   |  3 ++-
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index de723193f..34720f9d6 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -526,6 +526,22 @@ and local decoding are stubbed, events are sampled within 100 ms, and SDP waits
 for complete gathering. These limits prevent claiming full App integration or
 diagnosing a field failure; the composition gap remains an adoption concern.
 
+Matched plain-Pion controls through that same owner recover two- and nine-second
+outages in two repetitions. Both eleven-second controls instead reach the
+fixture's three-second complete-gathering limit: the ICE restart begins while
+the network is still unavailable. Piik uses Trickle ICE, so this is a fixture
+limit, not an established product failure or Tailcat advantage. Full comparative
+recovery claims require matching that signaling behavior first.
+
+Bounded anonymous traces further localize two Tailcat encrypted-echo failures.
+The replacement flow is accepted and its client preface read at the server,
+but the reverse read expires after three seconds before SDP. The server selects
+its direct path near the end of that window; the client has selected its path
+about two seconds earlier. No filter-drop event was observed, which is not
+packet-delivery proof. Other timing phases recover. This supports a directional
+underlay scheduling limit; it does not establish a new authorization defect,
+a safe readiness barrier, or a reason to widen product deadlines.
+
 The existing [Pion Binding-request setting](https://github.com/pion/webrtc/blob/v4.2.19/settingengine.go#L506)
 was then varied without changing the owner, timers or outer tunnel. Both 16-
 and 64-check controls initially recovered nine- and eleven-second interruptions.
diff --git a/docs/todo.md b/docs/todo.md
index a65e471d3..467ee7f60 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -56,7 +56,8 @@ Implementation needs a concrete useful result within the product model.
   Product adoption still needs supported
   [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary)
   and RTCP/MTU boundaries, resolution of recovery failures under the actual Viewer
-  owner, and mixed Browser/Native verification. Keep isolated dependency patches and
+  owner with Trickle ICE rather than the fixture's complete-gathering wait, and
+  mixed Browser/Native verification. Keep isolated dependency patches and
   recovery counterfactuals outside product routing; a diagnostic reply is not
   media-readiness authority. Research owns the experiments and their limits.
   No timeout change or transport integration is accepted; the P2P evidence work

From 7d20e477e78abc046092772df7aa14d3abfa0c1b Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 03:30:06 +0800
Subject: [PATCH 055/262] docs(transport): record matched trickle recovery
 boundary

---
 docs/research/nat-traversal.md | 34 ++++++++++++++++++----------------
 docs/todo.md                   |  6 +++---
 2 files changed, 21 insertions(+), 19 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 34720f9d6..f9925d254 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -516,22 +516,24 @@ after a third automatic request, outside the two-request contract. The corrected
 owner and fixture retain the count across Native and Browser backend replacement.
 This independent recovery defect does not establish the self-hosted SFU report's cause.
 
-With that correction, two-second interruptions recover without restart;
-permanent loss exhausts recovery and disposal cancels it. Seven- and eleven-second
-Tailcat interruptions pass in the checked run. Nine seconds can exhaust the budget:
-the replacement sends eight inner Binding checks, receives none, and delivers no
-fresh SRTP during its initial deadline or a separate three-second observation
-after exhaustion. That observation grants no additional recovery. Native control
-and local decoding are stubbed, events are sampled within 100 ms, and SDP waits
-for complete gathering. These limits prevent claiming full App integration or
-diagnosing a field failure; the composition gap remains an adoption concern.
-
-Matched plain-Pion controls through that same owner recover two- and nine-second
-outages in two repetitions. Both eleven-second controls instead reach the
-fixture's three-second complete-gathering limit: the ICE restart begins while
-the network is still unavailable. Piik uses Trickle ICE, so this is a fixture
-limit, not an established product failure or Tailcat advantage. Full comparative
-recovery claims require matching that signaling behavior first.
+The actual-owner fixture now supports incremental SDP/candidate exchange,
+matching Piik's [Trickle ICE generation boundary](https://www.rfc-editor.org/rfc/rfc8838.html#section-13).
+With this enabled, ordinary Pion recovers two-, nine- and eleven-second outages
+in three runs each. Without it, the same eleven-second control still fails at
+the fixture's three-second gathering barrier while the network is unavailable.
+That negative control is a fixture limitation, not a product defect.
+
+In the matched Trickle run with the isolated listener-state repair, Tailcat
+recovers two- and seven-second interruptions. Nine- and eleven-second outages
+exhaust recovery: the replacement sends eight inner Binding checks, receives
+none, and delivers no fresh SRTP during its initial deadline or a separate
+three-second observation after exhaustion. Both 16-check cases pass; one
+64-check replacement instead fails before SDP while awaiting its inner flow.
+Permanent loss exhausts the existing budget and disposal cancels recovery.
+No observation grants another attempt or extends a deadline. Native control
+and local decoding remain stubs, and events are sampled within 100 ms. These
+limits prevent claiming full App integration or diagnosing a field failure;
+the composition gap remains an adoption concern.
 
 Bounded anonymous traces further localize two Tailcat encrypted-echo failures.
 The replacement flow is accepted and its client preface read at the server,
diff --git a/docs/todo.md b/docs/todo.md
index 467ee7f60..94b628d15 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -55,9 +55,9 @@ Implementation needs a concrete useful result within the product model.
   before accepting room-scoped peer keys, flow admission and relay operation.
   Product adoption still needs supported
   [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary)
-  and RTCP/MTU boundaries, resolution of recovery failures under the actual Viewer
-  owner with Trickle ICE rather than the fixture's complete-gathering wait, and
-  mixed Browser/Native verification. Keep isolated dependency patches and
+  and RTCP/MTU boundaries, resolution of the reproduced recovery failures under
+  the actual Viewer owner with Trickle ICE, and mixed Browser/Native verification.
+  Keep isolated dependency patches and
   recovery counterfactuals outside product routing; a diagnostic reply is not
   media-readiness authority. Research owns the experiments and their limits.
   No timeout change or transport integration is accepted; the P2P evidence work

From c1c9c18bfbc87a17ee38c7520c3ea82a1718c93e Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 03:52:20 +0800
Subject: [PATCH 056/262] docs(transport): qualify retained-flow recovery
 candidate

---
 docs/research/nat-traversal.md | 33 ++++++++++++++++++++-------------
 docs/todo.md                   |  5 +++--
 2 files changed, 23 insertions(+), 15 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index f9925d254..2dd58eccb 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -544,19 +544,26 @@ packet-delivery proof. Other timing phases recover. This supports a directional
 underlay scheduling limit; it does not establish a new authorization defect,
 a safe readiness barrier, or a reason to widen product deadlines.
 
-The existing [Pion Binding-request setting](https://github.com/pion/webrtc/blob/v4.2.19/settingengine.go#L506)
-was then varied without changing the owner, timers or outer tunnel. Both 16-
-and 64-check controls initially recovered nine- and eleven-second interruptions.
-Six further 16-check cases recovered three times and failed three times during
-replacement setup, before its SDP exchange completed. Three narrower reruns with
-stage diagnostics passed; the setup failures' precise cause remains unconfirmed.
-With the separate listener-state repair, paired counters still reproduce a
-default-budget failure: the server receives the client's inner STUN packets,
-while the client receives none. Four additional 16-check controls recover;
-they do not resolve the earlier setup failures. Increasing inner checks can
-bridge one discovery phase but has not established
-reliable composition. It is not an accepted product setting or reason to add a
-second readiness owner, discovery loop or longer deadline.
+Varying the existing [Pion Binding-request setting](https://github.com/pion/webrtc/blob/v4.2.19/settingengine.go#L506)
+can bridge a discovery delay, but repeated controls also fail before SDP during
+new-flow setup. Paired counters separately show the server receiving inner STUN
+while the client receives none. More checks cannot repair every setup failure;
+neither a new readiness owner nor a longer product deadline is accepted.
+
+A retained-flow counterfactual reuses Pion's existing
+[UDP mux](https://github.com/pion/ice/blob/v4.4.0/udp_mux.go) after closing the old
+PeerConnection. It keeps the accepted Tailcat flow and replaces ICE/DTLS/SRTP,
+without another listener or preparation exchange. Setup falls from about 913 ms
+to 11–20 ms, but only three of six default-check nine-/eleven-second controls
+recover. The other three exhaust inner checks without fresh SRTP. This removes
+flow creation from those failures; it does not by itself resolve recovery.
+Combining retained flow with 16 checks still fails two of six cases. With 64
+checks, all six nine-/eleven-second cases recover; permanent loss still exhausts
+the existing two-request budget after the replacement's 15-second initial
+deadline, and disposal cancels recovery. This identifies a bounded composition
+candidate without another timer or readiness probe. The fixture remains serial:
+it does not establish safe overlapping connections, a room-authorized retained-flow
+owner, full App interoperability or any additional direct-reachability benefit.
 
 Separate checks preserve continuous sibling audio/video through a local ICE
 restart, failed-flow retirement, both callers' pending cancellation/deadline,
diff --git a/docs/todo.md b/docs/todo.md
index 94b628d15..d7f212368 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -55,8 +55,9 @@ Implementation needs a concrete useful result within the product model.
   before accepting room-scoped peer keys, flow admission and relay operation.
   Product adoption still needs supported
   [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary)
-  and RTCP/MTU boundaries, resolution of the reproduced recovery failures under
-  the actual Viewer owner with Trickle ICE, and mixed Browser/Native verification.
+  and RTCP/MTU boundaries, retained-flow recovery beyond the passing serial
+  Trickle/64-check experiment, and mixed Browser/Native verification. Default
+  inner checks still fail; no new product setting or flow owner is accepted.
   Keep isolated dependency patches and
   recovery counterfactuals outside product routing; a diagnostic reply is not
   media-readiness authority. Research owns the experiments and their limits.

From 03c80ff3a824632381118260643aad92db27fd66 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 04:01:21 +0800
Subject: [PATCH 057/262] docs(transport): record retained-flow isolation
 evidence

---
 docs/research/nat-traversal.md | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 2dd58eccb..60ebeda2a 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -561,9 +561,12 @@ Combining retained flow with 16 checks still fails two of six cases. With 64
 checks, all six nine-/eleven-second cases recover; permanent loss still exhausts
 the existing two-request budget after the replacement's 15-second initial
 deadline, and disposal cancels recovery. This identifies a bounded composition
-candidate without another timer or readiness probe. The fixture remains serial:
-it does not establish safe overlapping connections, a room-authorized retained-flow
-owner, full App interoperability or any additional direct-reachability benefit.
+candidate without another timer or readiness probe. Each retained flow is serial:
+overlapping connections still use separate flows. Three local race controls keep
+sibling audio/video flowing through two retained-flow replacements and another
+flow's rollback; peer revocation stops fresh media on both remaining flows.
+These checks do not define room-grant integration or establish full App
+interoperability or any additional direct-reachability benefit.
 
 Separate checks preserve continuous sibling audio/video through a local ICE
 restart, failed-flow retirement, both callers' pending cancellation/deadline,

From 9b67045a3833c4f12a36ec38291af7fd7bb29241 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 04:14:28 +0800
Subject: [PATCH 058/262] docs(network): qualify SFU forwarding behind NAT

---
 docs/research/nat-traversal.md | 17 +++++++++++++++++
 docs/todo.md                   |  6 ++++--
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 60ebeda2a..4815d956c 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -27,6 +27,23 @@ configured, Chromium emitted one deduplicated srflx candidate. No raw address or
 port was retained. This proves endpoint reachability and candidate
 deduplication; it does not classify the NAT or prove another direct path.
 
+### SFU Behind Server NAT
+
+An isolated Linux kernel-NAT control on 2026-10-09 places the current Server
+behind same-port UDP forwarding with `SFU_PUBLIC_IP`; direct access to its private
+address is blocked. Chromium 152 Host/Viewer pages use the real SFU route owners
+and authenticated signaling under `SFU_ONLY`. VP8/Opus reception, 720p-to-480p
+changes, fresh decoding after Viewer reauthentication and retirement all pass.
+
+Blocking only the Viewer process's UDP preserves connected Host ingress and
+LiveKit's `downtrack bound`, but the Viewer remains connecting without RTP or
+decoded frames. Its transport fails after about 15 seconds and the controller
+rejects that candidate without committing a publication. Thus binding plus
+healthy ingress cannot establish Viewer readiness or a controller defect.
+This does not reproduce the reported Native/phone attempt or its 20-second
+deadline: matched Viewer transport/decode evidence is still required. The control
+changes no product deadline, retry or first-frame rule.
+
 ## Browser Prediction Preflight
 
 A 2026-09-01 Chrome 151 preflight repeated the combined self-hosted plus
diff --git a/docs/todo.md b/docs/todo.md
index d7f212368..e437c7331 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -126,8 +126,10 @@ of a reporter's cause; research owns the completed experiments and their limits.
   `SFU_ONLY`. They still lack the matched Viewer ICE, decode and `route-ready`
   trace. The cited Host failure follows the operation deadline; healthy ingress
   and a bound subscription do not establish delivered frames or its cause.
-  The local Native H264/SFU-only control passes, but does not reproduce the
-  reporter's network. Correlate transport-state diagnostics with the affected
+  Local Native H264 and [kernel-NAT Browser SFU controls](./research/nat-traversal.md#sfu-behind-server-nat)
+  pass, but do not reproduce the reporter's network. The blocked-Viewer control
+  preserves healthy ingress and a bound track without usable Viewer media.
+  Correlate transport-state diagnostics with the affected
   Viewer before changing admission or recovery.
   [#468](https://github.com/TNTcraftHIM/Piik/issues/468) needs the complete join
   trace to distinguish a new Viewer from reauthentication with lost local media;

From 86e53aabd8e35afc965dda48d63d5f90be56cf2e Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 04:40:06 +0800
Subject: [PATCH 059/262] docs(network): verify native SFU and media-loss
 boundaries

---
 docs/research/nat-traversal.md | 16 +++++++++++++---
 docs/todo.md                   |  7 ++++---
 2 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 4815d956c..1331fa0d2 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -34,15 +34,22 @@ behind same-port UDP forwarding with `SFU_PUBLIC_IP`; direct access to its priva
 address is blocked. Chromium 152 Host/Viewer pages use the real SFU route owners
 and authenticated signaling under `SFU_ONLY`. VP8/Opus reception, 720p-to-480p
 changes, fresh decoding after Viewer reauthentication and retirement all pass.
+Windows Native H264/Opus also passes through QEMU UDP forwarding and the Linux
+NAT, decoding 300 720p frames in Chrome 154, changing to 480p, recovering its
+subscription and reauthenticating after local media loss. The App captures a
+dedicated generated window; this does not reproduce a phone or carrier network.
 
 Blocking only the Viewer process's UDP preserves connected Host ingress and
 LiveKit's `downtrack bound`, but the Viewer remains connecting without RTP or
 decoded frames. Its transport fails after about 15 seconds and the controller
 rejects that candidate without committing a publication. Thus binding plus
 healthy ingress cannot establish Viewer readiness or a controller defect.
-This does not reproduce the reported Native/phone attempt or its 20-second
-deadline: matched Viewer transport/decode evidence is still required. The control
-changes no product deadline, retry or first-frame rule.
+A separate control discards only the Viewer's RTP/RTCP datagrams while allowing
+STUN and DTLS. Both endpoints connect and the exact subscription binds, but no
+Viewer frames arrive; the existing 20-second operation deadline then expires.
+Thus even the reported timeout order does not identify a unique cause. Matched
+Viewer transport/decode evidence is still required. Neither control changes a
+product deadline, retry or first-frame rule.
 
 ## Browser Prediction Preflight
 
@@ -582,6 +589,9 @@ candidate without another timer or readiness probe. Each retained flow is serial
 overlapping connections still use separate flows. Three local race controls keep
 sibling audio/video flowing through two retained-flow replacements and another
 flow's rollback; peer revocation stops fresh media on both remaining flows.
+The combined listener-state, Tailcat/WireGuard revocation and bounded-TWCC
+candidates also pass Linux race checks for those isolation boundaries and the
+retained-flow/64-check nine-/eleven-second, permanent-loss and retirement cases.
 These checks do not define room-grant integration or establish full App
 interoperability or any additional direct-reachability benefit.
 
diff --git a/docs/todo.md b/docs/todo.md
index e437c7331..803a12f26 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -126,9 +126,10 @@ of a reporter's cause; research owns the completed experiments and their limits.
   `SFU_ONLY`. They still lack the matched Viewer ICE, decode and `route-ready`
   trace. The cited Host failure follows the operation deadline; healthy ingress
   and a bound subscription do not establish delivered frames or its cause.
-  Local Native H264 and [kernel-NAT Browser SFU controls](./research/nat-traversal.md#sfu-behind-server-nat)
-  pass, but do not reproduce the reporter's network. The blocked-Viewer control
-  preserves healthy ingress and a bound track without usable Viewer media.
+  Native H264 and Browser [SFU controls behind kernel NAT](./research/nat-traversal.md#sfu-behind-server-nat)
+  pass, but do not reproduce the reporter's network. Blocking Viewer media alone
+  preserves connected endpoints and a bound track until the operation deadline;
+  that log sequence does not identify a unique cause.
   Correlate transport-state diagnostics with the affected
   Viewer before changing admission or recovery.
   [#468](https://github.com/TNTcraftHIM/Piik/issues/468) needs the complete join

From fa01a00d78c90b10f27120dfc1434c7b93eec922 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 05:00:28 +0800
Subject: [PATCH 060/262] docs(transport): record full-size media boundary

---
 docs/research/nat-traversal.md | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 1331fa0d2..9f3f50e46 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -410,11 +410,16 @@ Three race repetitions, the copied Tailcat listener suite and the combined
 revocation/isolation controls pass. The patch remains experimental; it neither
 changes Piik nor fixes the independent inner-ICE recovery failure below.
 
-A separate real Chrome control decoded H.264/Opus and VP8/Opus from a generated
-640×360 picture and tone through Browser WebRTC → Pion/Tailcat/Pion → Browser
-WebRTC without re-encoding. Picture and decoded audio continued after DERP
-closure and stopped after peer revocation. It uses ordinary Browser WebRTC,
-not Browser-native Magicsock, physical capture or cross-browser acceptance.
+Real Browser controls forward generated H.264/Opus and VP8/Opus through Browser
+WebRTC → Pion/Tailcat/Pion → Browser WebRTC without re-encoding. Both decode at
+640×360 and, with the combined dependency candidate, 1920×1080. The larger input
+requests 60 fps with a 6 Mbps ceiling and fixed dimensions; actual encoding
+cadence varies, so it establishes neither 1080p60 delivery nor a throughput
+advantage. Fresh picture/audio arrive in each two-second window across eight
+seconds after DERP closure and stop after revocation. At about 3.6–4.3 Mbps,
+reported RTP loss is zero and the largest Tailcat datagram is 1208 bytes, with
+no size rejection. This does not bound all RTCP workloads or establish physical
+capture, Browser-native Magicsock or complete Piik relay interoperability.
 
 The 1200-byte Native packetization envelope with TWCC and short MID/RID headers
 produced at most 1228-byte encrypted datagrams across Pion's three default SRTP

From d2195efced2383bed68fffdb869729b67bfc53c9 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 05:13:23 +0800
Subject: [PATCH 061/262] docs(network): verify published SFU startup behind
 NAT

---
 docs/research/nat-traversal.md | 7 +++++++
 docs/todo.md                   | 3 ++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 9f3f50e46..51ff14795 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -39,6 +39,13 @@ NAT, decoding 300 720p frames in Chrome 154, changing to 480p, recovering its
 subscription and reauthenticating after local media loss. The App captures a
 dedicated generated window; this does not reproduce a phone or carrier network.
 
+The published v1.9.2 Windows App/capture and Linux Server artifacts, verified
+against their release hashes and paired with that revision's Browser source,
+also pass this Native H264/Opus startup control: 300 decoded 720p frames, a 480p
+change, subscription recovery and retirement. This original-release control
+excludes reauthentication after lost local media, which has a separate confirmed
+repair below. It does not establish the cause of the reported phone failure.
+
 Blocking only the Viewer process's UDP preserves connected Host ingress and
 LiveKit's `downtrack bound`, but the Viewer remains connecting without RTP or
 decoded frames. Its transport fails after about 15 seconds and the controller
diff --git a/docs/todo.md b/docs/todo.md
index 803a12f26..4d06e6cc7 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -127,7 +127,8 @@ of a reporter's cause; research owns the completed experiments and their limits.
   trace. The cited Host failure follows the operation deadline; healthy ingress
   and a bound subscription do not establish delivered frames or its cause.
   Native H264 and Browser [SFU controls behind kernel NAT](./research/nat-traversal.md#sfu-behind-server-nat)
-  pass, but do not reproduce the reporter's network. Blocking Viewer media alone
+  pass, including Native H264 on published v1.9.2, but do not reproduce the
+  reporter's network. Blocking Viewer media alone
   preserves connected endpoints and a bound track until the operation deadline;
   that log sequence does not identify a unique cause.
   Correlate transport-state diagnostics with the affected

From 30e60276d33e649f96bb9391e2b15758d179c82a Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 05:19:12 +0800
Subject: [PATCH 062/262] docs(media): record audio preset compatibility gate

---
 docs/todo.md | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/docs/todo.md b/docs/todo.md
index 4d06e6cc7..a1861e71b 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -43,12 +43,17 @@ Existing negative results narrow the next experiment; they do not freeze the
 whole candidate or require another version-number decision before other work.
 Implementation needs a concrete useful result within the product model.
 
-- [ ] **4K and additional codecs.** The [media assessment](./research/native-client-media.md#media-capability-extension-assessment)
+- [ ] **4K, additional codecs and audio presets.** The [media assessment](./research/native-client-media.md#media-capability-extension-assessment)
   recommends retaining current limits. Assess concrete source/receiver cases
   before accepting coordinated capture, forwarding and resource-bound changes;
   keep UI presets separate from those bounds in any new design. Additional
   formats must account for late Viewers and relays that cannot decode or forward
   the published format; codec negotiation alone does not transcode it.
+  Review [#462](https://github.com/TNTcraftHIM/Piik/pull/462)'s 256/320 kbps Opus
+  presets under the same compatibility boundary: v1.9.2 rejects the new enums
+  in Viewer authentication and Native control, terminating those sessions.
+  Establish an audible benefit and a supported mixed-version policy before
+  adopting its additional controls; its current non-breaking claim is incorrect.
 - [ ] **Native Magicsock.** Go reuse is feasible, but the
   [matched comparisons](./research/nat-traversal.md#integration-cost-and-recovery-controls)
   have not established improved direct reachability. Seek a repeatable benefit

From 5956830cc4004ec87178ab54da4f4f41e41d68cf Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 13:20:12 +0800
Subject: [PATCH 063/262] docs: retire resolved reports from pending work

Retire the owner-confirmed deployment incident and stale closed-issue follow-ups. Consolidate device acceptance references while retaining independent reports and the limits of the SFU controls.
---
 docs/research/nat-traversal.md | 10 +++---
 docs/todo.md                   | 61 ++++++++++------------------------
 2 files changed, 23 insertions(+), 48 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 51ff14795..7a0cba49f 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -44,7 +44,8 @@ against their release hashes and paired with that revision's Browser source,
 also pass this Native H264/Opus startup control: 300 decoded 720p frames, a 480p
 change, subscription recovery and retirement. This original-release control
 excludes reauthentication after lost local media, which has a separate confirmed
-repair below. It does not establish the cause of the reported phone failure.
+repair below. The desktop control does not establish physical phone or carrier
+network coverage.
 
 Blocking only the Viewer process's UDP preserves connected Host ingress and
 LiveKit's `downtrack bound`, but the Viewer remains connecting without RTP or
@@ -54,9 +55,9 @@ healthy ingress cannot establish Viewer readiness or a controller defect.
 A separate control discards only the Viewer's RTP/RTCP datagrams while allowing
 STUN and DTLS. Both endpoints connect and the exact subscription binds, but no
 Viewer frames arrive; the existing 20-second operation deadline then expires.
-Thus even the reported timeout order does not identify a unique cause. Matched
-Viewer transport/decode evidence is still required. Neither control changes a
-product deadline, retry or first-frame rule.
+Connected endpoints, a bound track and an operation timeout do not identify a
+unique cause; diagnosis requires the affected Viewer's transport/decode evidence.
+Neither control changes a product deadline, retry or first-frame rule.
 
 ## Browser Prediction Preflight
 
@@ -550,7 +551,6 @@ product, while preserving the parent's recovery budget. Renewing that budget
 on replacement hid the nine-second outage: three repetitions recovered only
 after a third automatic request, outside the two-request contract. The corrected
 owner and fixture retain the count across Native and Browser backend replacement.
-This independent recovery defect does not establish the self-hosted SFU report's cause.
 
 The actual-owner fixture now supports incremental SDP/candidate exchange,
 matching Piik's [Trickle ICE generation boundary](https://www.rfc-editor.org/rfc/rfc8838.html#section-13).
diff --git a/docs/todo.md b/docs/todo.md
index a1861e71b..4c3e7c10b 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -95,19 +95,15 @@ of a reporter's cause; research owns the completed experiments and their limits.
   boundary. Visible permission changes, display-mode changes and the reporter's
   setup still need matched physical evidence; API success does not prove that
   Windows hid the border.
-- [ ] **macOS and Linux physical capture.** Complete the remaining capture/audio
-  checks in [verification status](./verification-status.md#device-evidence-boundary),
-  including an Intel Mac with a usable hardware H.264 encoder, an ARM64 Linux
-  desktop, and Linux systems beyond the PR author's Hyprland/NVIDIA result.
-- [ ] **Signaling recovery on passwordless sites (#446).** Verify the admission
-  correction against a matched Host/Server attempt; identify the event preceding
-  the handshake failure rather than inferring password denial from `AUTH_REQUIRED`.
-- [ ] **HDR, audio-exclusion and mobile interaction device coverage.** Complete
-  the [physical matrix](./verification-status.md#device-evidence-boundary):
-  HDR/mixed displays, voice-app process trees across playback devices and phone
-  keyboard/theater/participant-menu interaction. Browser HDR overexposure is an
-  accepted limitation with [documented alternatives](./guide/troubleshooting.md#hdr-picture-looks-too-bright-or-washed-out);
-  reopen conversion work only with new evidence and an accepted implementation.
+- [ ] **Physical device and network acceptance.** Complete the remaining
+  [device checks](./verification-status.md#device-evidence-boundary) and
+  [network/endurance matrix](./verification-status.md#remaining-device-and-network-acceptance),
+  preserving platform deferrals and serial physical checks. Include macOS/Linux
+  capture, HDR/mixed displays, audio exclusion across real process trees and
+  playback devices, and mobile keyboard/theater/participant controls. The
+  [camera and microphone assessment](./research/camera-and-microphone.md)
+  additionally owns levels, echo, device replacement/native mixing, OBS input
+  A/V synchronization and phone camera permission/orientation/background limits.
 - [ ] **Native H.264 motion quality (#432).** Obtain matched source/decoded
   pictures and bitstream for the original 720p30 game comparison. Retain current
   codec parameters. The [evidence review](./research/native-client-media.md#native-h264-motion-quality)
@@ -126,18 +122,6 @@ of a reporter's cause; research owns the completed experiments and their limits.
   [#453](https://github.com/TNTcraftHIM/Piik/issues/453) has no matched endpoint
   reports to distinguish network reachability from a product failure.
   The v1.6.3 candidate-timeout report lacks share-start and SDP/ICE evidence.
-  [#464](https://github.com/TNTcraftHIM/Piik/issues/464) and the supplied report
-  identify v1.9.2, a NAT-hosted Server, Native Host, and the same timeout under
-  `SFU_ONLY`. They still lack the matched Viewer ICE, decode and `route-ready`
-  trace. The cited Host failure follows the operation deadline; healthy ingress
-  and a bound subscription do not establish delivered frames or its cause.
-  Native H264 and Browser [SFU controls behind kernel NAT](./research/nat-traversal.md#sfu-behind-server-nat)
-  pass, including Native H264 on published v1.9.2, but do not reproduce the
-  reporter's network. Blocking Viewer media alone
-  preserves connected endpoints and a bound track until the operation deadline;
-  that log sequence does not identify a unique cause.
-  Correlate transport-state diagnostics with the affected
-  Viewer before changing admission or recovery.
   [#468](https://github.com/TNTcraftHIM/Piik/issues/468) needs the complete join
   trace to distinguish a new Viewer from reauthentication with lost local media;
   its excerpt starts with an already committed SFU edge. Retest the affected
@@ -154,11 +138,6 @@ of a reporter's cause; research owns the completed experiments and their limits.
   reports before changing routing or advising users to disable IP masking.
   [#463](https://github.com/TNTcraftHIM/Piik/issues/463) lacks the Browser-only
   Mac/phone attempt details needed to distinguish capture, entry and media failure.
-- [ ] **Camera and Host microphone device coverage.** Check real audio levels,
-  echo, device replacement/native mixing and phone camera permission, orientation
-  and background behavior. Include OBS virtual-camera/audio-input sound quality
-  and A/V synchronization. The [capture assessment](./research/camera-and-microphone.md)
-  owns current behavior and the accepted physical limits.
 - [ ] **Public-invitation startup and HTTP 1033.** Obtain version and matched
   diagnostics for creation failures, Demo access and a stream stalling before
   reload returns 1033. Distinguish connector recovery/exit, DNS/provider failure
@@ -174,8 +153,7 @@ of a reporter's cause; research owns the completed experiments and their limits.
   screenshot. Retaining dependency failure details improves the next report;
   it does not establish or resolve this attempt's cause.
 - [ ] **Viewer interruptions.** Obtain paired endpoint/upstream-relay diagnostics
-  for established viewing returning to P2P connecting, including
-  [#429](https://github.com/TNTcraftHIM/Piik/issues/429)'s SFU-to-P2P dropout.
+  for established viewing returning to P2P connecting.
   Separately retest the v1.5.0 App public-link report where one Viewer drops
   immediately after connection details appear while others work. Distinguish
   first-frame admission, signaling grace and current-edge recovery.
@@ -228,35 +206,32 @@ works, so a Rust alternative needs a concrete Go limitation.
 
 ## Parked Product Work
 
-1. **Representative device/network acceptance.** Resume the remaining matrix in
-   [verification status](./verification-status.md#remaining-device-and-network-acceptance)
-   when directed, preserving platform deferrals and serial physical checks.
-2. **Broader quality work.** Reopen from measured interruptions, failed recovery
+1. **Broader quality work.** Reopen from measured interruptions, failed recovery
    or healthy-sibling degradation at acceptable complexity. The
    [Browser pool comparison](./research/browser-local-encoding-pool.md#balanced-startup-and-recovery)
    owns cold-encoder tradeoffs; low resolution alone is not a defect. Check
    whether a proposed move merely shifts pressure to another parent's siblings.
-3. **Platform output.** Reopen for a registered receiver acting as an ordinary
+2. **Platform output.** Reopen for a registered receiver acting as an ordinary
    Viewer only after the [platform-output gate](./research/platform-output.md)
    passes.
-4. **Additional languages.** Review community catalogs and their rendered UI
+3. **Additional languages.** Review community catalogs and their rendered UI
    following the [translation guide](./guide/translating.md), including names,
    menu navigation, text direction and layout.
-5. **Windows code signing.** Revisit after enrollment in a trusted signing
+4. **Windows code signing.** Revisit after enrollment in a trusted signing
     service. Sign executables before archive checksums; publisher identity does
     not guarantee that antivirus cloud scanning stops.
-6. **Gitee download-source warning.** Paused by the owner. Keep GitHub primary
+5. **Gitee download-source warning.** Paused by the owner. Keep GitHub primary
     and retain Gitee; do not add a self-hosted mirror. Chrome still blocks the
     Gitee attachment when Referer is removed. Reopen for new evidence or a
     provider review; the warning remains unresolved.
-7. **Release-operation policy.** Protected release environments and immutable
+6. **Release-operation policy.** Protected release environments and immutable
     draft assets remain unaccepted proposals; evaluate their benefit before
     adding release machinery.
-8. **Automatic local chat history.** Explicit TXT export covers manual retention.
+7. **Automatic local chat history.** Explicit TXT export covers manual retention.
     Reconsider automatic storage only with a stable room-incarnation identity,
     bounded retention and a clear delete control; reusable room codes must not
     combine conversations. No new history service or wire field is authorized.
-9. **Direct OBS input (#436).** Reopen for a measured virtual-camera limitation.
+8. **Direct OBS input (#436).** Reopen for a measured virtual-camera limitation.
     The [capture assessment](./research/camera-and-microphone.md) records raw-frame
     output and the WHIP boundary; virtual camera alone is not a second encode.
     Do not add an RTMP/WHIP listener without an accepted publication owner.

From 650953f17a1ee6d591a8f3c65046de533495c401 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 13:35:03 +0800
Subject: [PATCH 064/262] docs(media): plan bounded capability design for 2.0

Hold maintenance delivery for the 2.0 candidate. Separate UI presets, numeric requests, capabilities and actual media in the proposed design; assess audio PR 462 through that boundary and retain the incomplete Magicsock integration and external-test gates.
---
 docs/research/native-client-media.md | 99 ++++++++++++++++++++++------
 docs/status.md                       | 13 ++--
 docs/todo.md                         | 39 +++++++----
 3 files changed, 111 insertions(+), 40 deletions(-)

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 003f617ad..85dc24b8a 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -510,8 +510,10 @@ a corrected SDP interpretation, not evidence that all Firefox sharing lost audio
 
 ## Media Capability Extension Assessment
 
-Proposal assessed 2026-10-04 for a possible 2.0 phase; this does not change the
-current contract or the profile decision above. Resolution enums are enforced
+Planning direction reviewed 2026-10-09 for 2.0; the design below is a proposal,
+not a replacement for the current contract or profile decision above. The owner
+reopened numeric media requests and capability negotiation as one coherent
+extension. Resolution enums are enforced
 by both signaling readers and Native control, while capture admission separately
 bounds dimensions. Native capture, forwarding and SFU declarations also admit
 specific encoded formats. Removing one validator would leave these consumers
@@ -535,21 +537,45 @@ These are different meanings. Keep explicit resource ceilings, but assess them
 separately from presets and device capability; arbitrary numbers are not the
 replacement contract.
 
-The smallest proposed extension separates UI presets from numeric media limits
-and uses existing WebRTC codec negotiation. The
-[Media Capture specification](https://www.w3.org/TR/mediacapture-streams/)
-distinguishes requested constraints, supported ranges and actual settings;
-[WebRTC capabilities](https://www.w3.org/TR/webrtc/#rtcrtpsender-interface)
-advertise optimistic codec support, not guaranteed hardware execution. Preserve
-actual encoder admission and validate dimensions, pixel counts, frame sizes and
-resource bounds at their existing owners.
+The proposed boundary follows the
+[Media Capture specification](https://www.w3.org/TR/mediacapture-streams/#constrainable-interface):
+requested constraints, supported capabilities and actual settings have different
+owners. Capability ranges cannot describe every combination of resolution and
+frame rate; [WebRTC codec discovery](https://www.w3.org/TR/webrtc/#rtcrtpsender-interface)
+is optimistic and reserves no hardware resources. An advertised capability is
+therefore not proof that a particular encoder configuration can start.
+
+| Meaning | Proposed Piik owner and representation |
+| --- | --- |
+| Quick presets | UI-local labels mapping to numeric picture/audio requests; adding a label does not extend the wire |
+| Host intent | One validated numeric size, frame-rate and bitrate request, distinct from measured output |
+| Available capability | Existing capture/receive/forward adapters report supported operations and bounded formats; unknown descriptive formats are unavailable |
+| Applied configuration | The existing share owner commits an admitted result under its current generation; failed or stale changes do not become saved preferences |
+| Live output | Existing capture and receiver evidence; WebRTC/LiveKit still own network adaptation |
+
+Dimensions, pixel counts/rates, encoded-frame bytes, allocations and concurrent
+outputs remain bounded before resource use. Remote capability claims cannot raise
+local limits. Reject malformed values and unauthorized commands; unsupported
+well-formed requests need a scoped failure, not an unrelated room disconnect.
+Use the existing generation and route operation, not a capability polling loop,
+general constraint solver or second recovery owner. Numeric limits describe
+ceilings, not a promise of a constant rate or resolution. A receiver's limits
+constrain its edge or existing local output group, not every Viewer in the room.
 
 Codec support must distinguish encoding, decoding and encoded forwarding,
-including profile/packetization and SFU admission. AV1 and VP9 are candidates to
+including profile/packetization and SFU admission. Reuse SDP codec matching;
+describe only Native control and forwarding limits that it cannot express,
+instead of negotiating the same format twice. AV1 and VP9 are candidates to
 evaluate, not promised product formats. A late Viewer or relay that cannot
 receive the current encoded source needs an explicit policy; SDP negotiation
 alone cannot convert that source. Per-Viewer transcodes or room-wide codec
-switches are not implied by this proposal.
+switches are not implied by this proposal. This is also explicit in
+[mediasoup's producer/consumer capabilities](https://mediasoup.org/documentation/v3/mediasoup/rtp-parameters-and-capabilities/).
+[LiveKit's backup codec policy](https://github.com/livekit/client-sdk-js/blob/main/src/room/track/options.ts)
+uses another encoding or switches the publication; that compatibility has real
+CPU/bandwidth or continuity costs. Piik's embedded LiveKit components do not
+automatically provide its complete SDK policy. Keep H.264/VP8 as the initial
+compatibility path; admit a new format only with its whole-route evidence.
 
 Current discovery couples format to implementation (`hardwareH264` and
 `softwareVP8`), and Browser preference uses a VP8-specific fallback flag.
@@ -568,15 +594,46 @@ inherently require a major; breaking an existing public contract does. Evaluate
 the Browser/App/Server and mixed-peer flows before freezing a replacement
 contract; avoid a general compatibility framework.
 
-The 2026-10-07 candidate review does not recommend adding these extensions to
-the current release. A 4K path must change the three platform capture/decoder
-bounds, encoded-frame limits and SFU admission together; Windows H.264's current
-level ceiling also does not cover 4K60. The existing Main/High comparison shows
-a modest synthetic quality gain, but Firefox's receiver gap prevents treating
-it as a transparent upgrade. Keep the current formats and limits until a
-specific use case justifies that coordinated change. This is a scope
-recommendation, not a claim that 4K is impossible or that the current geometry
-should become a permanent protocol rule.
+### Audio And UI Proposal
+
+[#462](https://github.com/TNTcraftHIM/Piik/pull/462) requests 256/320 kbps Opus.
+The values are permitted by [RFC 7587](https://www.rfc-editor.org/rfc/rfc7587.html#section-6.1),
+whose receive-rate parameter spans 6,000..510,000 bit/s. This is a codec boundary,
+not a recommended default or proof of audible benefit. The current preset names
+also travel in authentication and Native commands: adding its two enum values
+causes the actual v1.9.2 readers to terminate those sessions. The PR's compatible
+release claim is therefore incorrect even though its audio use case is valid.
+
+For 2.0, prototype one numeric audio-bitrate ceiling through capture, sender,
+receiver and SFU; derive existing preset labels locally. Align receive admission
+with codec support instead of the largest UI shortcut. Keep the existing default
+while comparing actual Opus output and listening results for higher ceilings.
+[LiveKit's AudioPreset](https://docs.livekit.io/reference/client-sdk-js/interfaces/AudioPreset.html)
+likewise contains a numeric maximum bitrate; its
+[high-fidelity example](https://docs.livekit.io/transport/media/advanced/#hi-fi-audio)
+also considers stereo, source processing and redundancy. Raising bitrate alone
+does not establish studio quality, losslessness or multi-channel output.
+
+Keep Piik's compact presets and existing picture/sound settings disclosure.
+Expose custom numeric values with units and valid ranges there, without adding
+a permanent row for each new preset. Use supported-format selection for codecs,
+not an arbitrary text field. Preserve source aspect ratio without upscaling;
+distinguish selected limits from actual capture/decoded dimensions in existing
+details. Capability-related restrictions explain a real limitation briefly.
+The [OBS settings guide](https://obsproject.com/kb/obs-studio-overview#settings)
+supports a simple/default entry with further controls; Piik need not reproduce
+OBS's full output configuration. Existing visual/tooltip owners still apply,
+including narrow screens, both themes and visual mode.
+
+Start with numeric audio through the existing pipeline, then portrait/ultrawide
+geometry and 4K as a second concrete use case. A 4K path must review all platform
+capture/decoder bounds, encoded-frame limits and SFU admission; Windows H.264's
+current level ceiling does not cover 4K60. Admission and output must be tested
+at the actual profile, not inferred from a codec list. Check live changes,
+late/limited Viewers and relays, failure cleanup and resource rejection before
+freezing the 2.0 contract. Prefer a clear 1.x mismatch over a general legacy
+adapter. Future presets inside supported numeric semantics need no new enum;
+new formats still require actual implementation and an advertised capability.
 
 ## Implementation Boundary
 
diff --git a/docs/status.md b/docs/status.md
index 60690fee5..5e3507f31 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -1,6 +1,6 @@
 # Current Status
 
-Last updated: 2026-10-07
+Last updated: 2026-10-09
 
 This is the compact execution/deployment index. Product modules own behavior,
 [verification status](./verification-status.md) owns unresolved physical limits,
@@ -59,10 +59,13 @@ SQLite schema 2 and the 1440p ceiling. Hosted empty-room retention and capacity
 guidance preserve indefinite retention by default. The accepted Demo policy is
 one hour without authenticated participants; the private deployment retains the
 default. Operator records own activation, database and postflight evidence.
-The owner reopened 2.0 candidate preparation, including reassessment of 4K,
-codec expansion and Native Magicsock where demonstrated benefit justifies total
-complexity. These experiments do not yet change the accepted contract or product
-transport. Release remains subject to the owner's final acceptance.
+The owner is holding the unpublished maintenance changes for 2.0. Preparation
+includes separating media presets from numeric requests and bounded capabilities,
+with audio presets, 4K and additional codecs assessed through that boundary.
+Native Magicsock remains an isolated experiment with incomplete product
+integration and unresolved recovery cases. These proposals do not yet change
+the accepted contract or transport. A small external test is proposed before
+release; publication remains subject to the owner's final acceptance.
 Immutable release artifacts own delivery completion; [TODO](./todo.md#now) owns
 remaining work.
 
diff --git a/docs/todo.md b/docs/todo.md
index 4c3e7c10b..e699d9003 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -11,9 +11,10 @@ Git/PRs own completed history.
 ## Now
 
 - [ ] **2.0 candidate preparation and acceptance.** The owner reopened investigation,
-  useful improvements and outstanding acceptance on 2026-10-07. Prepare one
-  coherent candidate and stop before publication. Preserve the existing product
-  model; evaluate held features against measurable benefit and total complexity
+  useful improvements and outstanding acceptance on 2026-10-07, and on 2026-10-09
+  chose to hold the maintenance changes for 2.0 rather than publish them separately.
+  Prepare one coherent candidate and stop before publication. Preserve the existing
+  product model; evaluate held features against measurable benefit and total complexity
   before accepting a changed contract.
 - [ ] **Independent Gitee mirror recovery.** Implementation and local acceptance
   are complete. Integrate through the next owner-approved publishing merge and
@@ -43,17 +44,18 @@ Existing negative results narrow the next experiment; they do not freeze the
 whole candidate or require another version-number decision before other work.
 Implementation needs a concrete useful result within the product model.
 
-- [ ] **4K, additional codecs and audio presets.** The [media assessment](./research/native-client-media.md#media-capability-extension-assessment)
-  recommends retaining current limits. Assess concrete source/receiver cases
-  before accepting coordinated capture, forwarding and resource-bound changes;
-  keep UI presets separate from those bounds in any new design. Additional
-  formats must account for late Viewers and relays that cannot decode or forward
-  the published format; codec negotiation alone does not transcode it.
-  Review [#462](https://github.com/TNTcraftHIM/Piik/pull/462)'s 256/320 kbps Opus
-  presets under the same compatibility boundary: v1.9.2 rejects the new enums
-  in Viewer authentication and Native control, terminating those sessions.
-  Establish an audible benefit and a supported mixed-version policy before
-  adopting its additional controls; its current non-breaking claim is incorrect.
+- [ ] **Media parameters and capabilities for 2.0.** Follow the
+  [media assessment](./research/native-client-media.md#media-capability-extension-assessment):
+  separate UI presets, numeric requests, bounded implementation capabilities and
+  actual output. Prototype numeric audio bitrate first using
+  [#462](https://github.com/TNTcraftHIM/Piik/pull/462)'s use case, then
+  source-aspect-preserving geometry and 4K through the same owners. Preserve
+  safety limits and framework-owned adaptation. New codecs need complete
+  encode/decode/forward support and a late-Viewer policy before inclusion;
+  selecting a codec cannot transcode an existing publication. Confirm live
+  changes, relay/SFU paths, older 2.x capability subsets and explicit 1.x
+  mismatch before accepting the replacement contract. The current 1.x enums
+  remain; the PR is not a compatible enum-only extension of v1.9.2.
 - [ ] **Native Magicsock.** Go reuse is feasible, but the
   [matched comparisons](./research/nat-traversal.md#integration-cost-and-recovery-controls)
   have not established improved direct reachability. Seek a repeatable benefit
@@ -68,6 +70,15 @@ Implementation needs a concrete useful result within the product model.
   media-readiness authority. Research owns the experiments and their limits.
   No timeout change or transport integration is accepted; the P2P evidence work
   below owns the network/interop acceptance boundary.
+- [ ] **Small external test before 2.0.** First use the isolated transport
+  experiment on the same difficult network pairs as current Piik, measuring
+  direct success separately from relay delivery, first-picture time, recovery
+  and added resource cost. This evidence can precede other feature work.
+  A combined product test package requires room-scoped authorization/revocation,
+  mixed Browser/Native behavior and bounded recovery to pass first. Freeze and
+  identify each test build; do not describe the present Magicsock experiment as
+  a feature-complete product awaiting only acceptance. The final candidate then
+  receives the combined feature/UI and regression check.
 - [ ] **Managed Demo hosting.** The [provider assessment](./operations/website.md#managed-hosting-assessment)
   identifies UDP/storage requirements but establishes no cost saving. Keep the
   existing P2P-only Demo until a provider and operating boundary are accepted.

From 3b47b50c65956e6614d82271939d816253a4b9ad Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 14:12:11 +0800
Subject: [PATCH 065/262] refactor(media): decouple audio sender limits from
 presets

---
 docs/research/browser-screen-audio-quality.md | 39 +++++++++++++++++++
 docs/research/native-client-media.md          |  3 ++
 docs/todo.md                                  |  8 +++-
 internal/app/nativeaudio/encoder_test.go      | 30 ++++++++++++--
 src/client/media/quality.ts                   |  3 +-
 src/client/sfu/publisher.ts                   |  2 +-
 src/client/webrtc/host-peer.ts                |  3 +-
 tests/quality.test.ts                         | 18 ++++-----
 8 files changed, 87 insertions(+), 19 deletions(-)

diff --git a/docs/research/browser-screen-audio-quality.md b/docs/research/browser-screen-audio-quality.md
index 1aaad6a70..a856332aa 100644
--- a/docs/research/browser-screen-audio-quality.md
+++ b/docs/research/browser-screen-audio-quality.md
@@ -55,6 +55,45 @@ weak-network behavior, real-game A/V synchronization, or mobile playback.
 - Lossy Wi-Fi/cellular concealment and Opus FEC behavior with current options.
 - macOS, Android, and iOS capture/playback behavior.
 
+## Numeric Bitrate Assessment
+
+Checked 2026-10-09 for the proposed 2.0 media boundary. The current product still
+uses its published presets; these experiments do not accept a new wire format or
+raise its audio ceiling. The shared Browser sender primitive now takes a numeric
+ceiling, with current direct/SFU callers resolving their existing preset first.
+
+The existing Go Opus encoder accepted live 128/192/256/320/96/128 kbps changes
+without replacement. A 48 kHz stereo tone/noise input continued decoding into
+960 samples per channel; the existing deterministic tests also verify stereo
+separation at 256/320 kbps and rejection of invalid updates without replacing
+the last setting. This establishes encoding continuity, not audible benefit.
+
+A Chrome 152 loopback used the actual sender primitive, generated stereo audio,
+and decoded PCM measurement. The same PeerConnections remained connected while
+changing those ceilings. Received payload tracked approximately 96/128/192/256/320
+kbps, with decoded samples advancing and nonzero waveform energy. This is a
+local Browser check, not relay/SFU, mobile, impaired-network or listening acceptance.
+
+Two controls constrain the replacement design:
+
+- Chrome retained `maxaveragebitrate=192000` in the remote answer and sender
+  codec parameters, yet later `setParameters()` calls produced approximately
+  256/320 kbps. Repeating with a 510000 answer also passed. This scoped runtime
+  counterexample does not change [RFC 7587's receive-limit semantics](https://www.rfc-editor.org/rfc/rfc7587.html#section-7.1).
+  A numeric sender setting must respect the admitted receiver limit; do not
+  assume SDP presence or successful parameter readback proves enforcement.
+- With native 20 ms frames, the tone/noise check produced maximum Opus payloads
+  of 641 bytes at 256 kbps and 801 at 320 kbps. At 510 kbps, all 150 frames
+  produced RTP packets larger than a 1200-byte packetizer budget. Pinned
+  [Pion's Opus payloader](https://github.com/pion/rtp/blob/v1.10.2/codecs/opus_packet.go)
+  keeps each Opus payload intact. This is a packet-size result, not measured
+  network loss; accepting the codec's maximum requires a transport/packet-duration
+  decision. Do not equate the codec range with every route's safe operating range.
+
+The [media extension proposal](./native-client-media.md#audio-and-ui-proposal)
+owns the planned UI and contract. Complete admitted receive limits, native control,
+preference storage and live relay/SFU verification before exposing custom values.
+
 ## Primary Sources
 
 - [Screen Capture](https://www.w3.org/TR/screen-capture/)
diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 85dc24b8a..7beb9cde6 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -608,6 +608,9 @@ For 2.0, prototype one numeric audio-bitrate ceiling through capture, sender,
 receiver and SFU; derive existing preset labels locally. Align receive admission
 with codec support instead of the largest UI shortcut. Keep the existing default
 while comparing actual Opus output and listening results for higher ceilings.
+The [numeric audio controls](./browser-screen-audio-quality.md#numeric-bitrate-assessment)
+establish local 256/320 kbps encoding and Browser reception, with separate
+receive-limit enforcement and high-rate packet-size boundaries still to resolve.
 [LiveKit's AudioPreset](https://docs.livekit.io/reference/client-sdk-js/interfaces/AudioPreset.html)
 likewise contains a numeric maximum bitrate; its
 [high-fidelity example](https://docs.livekit.io/transport/media/advanced/#hi-fi-audio)
diff --git a/docs/todo.md b/docs/todo.md
index e699d9003..b12a638dd 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -47,10 +47,14 @@ Implementation needs a concrete useful result within the product model.
 - [ ] **Media parameters and capabilities for 2.0.** Follow the
   [media assessment](./research/native-client-media.md#media-capability-extension-assessment):
   separate UI presets, numeric requests, bounded implementation capabilities and
-  actual output. Prototype numeric audio bitrate first using
+  actual output. Complete numeric audio bitrate admission and storage first using
   [#462](https://github.com/TNTcraftHIM/Piik/pull/462)'s use case, then
   source-aspect-preserving geometry and 4K through the same owners. Preserve
-  safety limits and framework-owned adaptation. New codecs need complete
+  safety limits and framework-owned adaptation. The
+  [audio controls](./research/browser-screen-audio-quality.md#numeric-bitrate-assessment)
+  require explicit receive-limit enforcement and a packet-size decision before
+  exposing higher numeric ceilings; add live relay/SFU acceptance to the local
+  encoding/Browser evidence. New codecs need complete
   encode/decode/forward support and a late-Viewer policy before inclusion;
   selecting a codec cannot transcode an existing publication. Confirm live
   changes, relay/SFU paths, older 2.x capability subsets and explicit 1.x
diff --git a/internal/app/nativeaudio/encoder_test.go b/internal/app/nativeaudio/encoder_test.go
index 074405420..fb8008aad 100644
--- a/internal/app/nativeaudio/encoder_test.go
+++ b/internal/app/nativeaudio/encoder_test.go
@@ -86,7 +86,7 @@ func TestEncodePreservesAudiblePCM(t *testing.T) {
 }
 
 func TestEncodePreservesStereoSeparation(t *testing.T) {
-	for _, bitrate := range []int{64_000, 128_000, 192_000} {
+	for _, bitrate := range []int{64_000, 128_000, 192_000, 256_000, 320_000} {
 		encoder, err := NewEncoder(bitrate)
 		if err != nil {
 			t.Fatal(err)
@@ -150,13 +150,35 @@ func TestEncoderUpdatesBitrateWithinTheSameGeneration(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	for _, bitrate := range []int{64_000, 192_000, DefaultBitrate} {
+	decoder, err := gopus.NewDecoder(gopus.DefaultDecoderConfig(SampleRate, Channels))
+	if err != nil {
+		t.Fatal(err)
+	}
+	pcm := make([]byte, FrameBytes)
+	decoded := make([]int16, FrameSamples*Channels)
+	for _, bitrate := range []int{64_000, 192_000, 256_000, 320_000, 96_000, DefaultBitrate} {
 		if err = encoder.SetBitrate(bitrate); err != nil {
 			t.Fatalf("SetBitrate(%d) = %v", bitrate, err)
 		}
+		if encoder.Bitrate() != bitrate {
+			t.Fatalf("SetBitrate(%d) readback = %d", bitrate, encoder.Bitrate())
+		}
+		packet, err := encoder.Encode(pcm)
+		if err != nil {
+			t.Fatal(err)
+		}
+		count, err := decoder.DecodeInt16(packet, decoded)
+		if err != nil || count != FrameSamples {
+			t.Fatalf("decode after bitrate %d: %d samples, %v", bitrate, count, err)
+		}
 	}
-	if err = encoder.SetBitrate(0); err == nil {
-		t.Fatal("invalid live bitrate was accepted")
+	for _, bitrate := range []int{0, 5_999, 510_001} {
+		if err = encoder.SetBitrate(bitrate); err == nil {
+			t.Fatalf("invalid live bitrate %d was accepted", bitrate)
+		}
+		if encoder.Bitrate() != DefaultBitrate {
+			t.Fatalf("rejected bitrate %d replaced the active setting", bitrate)
+		}
 	}
 }
 
diff --git a/src/client/media/quality.ts b/src/client/media/quality.ts
index cc5602a5c..bf98bf565 100644
--- a/src/client/media/quality.ts
+++ b/src/client/media/quality.ts
@@ -400,7 +400,7 @@ export async function configureVideoSender(
 
 export async function configureScreenAudioSender(
   sender: RTCRtpSender,
-  quality?: ScreenAudioQuality,
+  requestedMaxBitrate: number,
 ): Promise<AudioSenderParameterReadback> {
   const current = sender.getParameters();
   const parameters = {
@@ -410,7 +410,6 @@ export async function configureScreenAudioSender(
   if (parameters.encodings.length === 0) {
     parameters.encodings = [{}];
   }
-  const requestedMaxBitrate = screenAudioBitrate(quality);
   parameters.encodings[0]!.maxBitrate = requestedMaxBitrate;
   await sender.setParameters(parameters);
   const appliedMaxBitrate =
diff --git a/src/client/sfu/publisher.ts b/src/client/sfu/publisher.ts
index bdc66d1fa..8f79aa124 100644
--- a/src/client/sfu/publisher.ts
+++ b/src/client/sfu/publisher.ts
@@ -510,7 +510,7 @@ export class SfuPublisher {
     try {
       const audio = await peer.waitForOperation(() => configureScreenAudioSender(
         audioSender,
-        profile.screenAudioQuality,
+        screenAudioBitrate(profile.screenAudioQuality),
       ));
       if (this.peer !== peer) return false;
       this.audioWarning = audioSenderParameterWarning(audio);
diff --git a/src/client/webrtc/host-peer.ts b/src/client/webrtc/host-peer.ts
index d89c399bf..ad8fbecbb 100644
--- a/src/client/webrtc/host-peer.ts
+++ b/src/client/webrtc/host-peer.ts
@@ -12,6 +12,7 @@ import {
   configureVideoSender,
   needsStartupVideoProfile,
   resolveScreenAudioQuality,
+  screenAudioBitrate,
   screenAudioQualityEqual,
   STARTUP_VIDEO_ENCODED_FRAMES,
   startupVideoProfile,
@@ -924,7 +925,7 @@ export class HostPeer {
         try {
           audioSenderParameters = await this.waitForOperation(() => configureScreenAudioSender(
             audioSender,
-            profile.screenAudioQuality,
+            screenAudioBitrate(profile.screenAudioQuality),
           ));
         } catch (error) {
           if (this.disposed) return false;
diff --git a/tests/quality.test.ts b/tests/quality.test.ts
index c3c491789..12000d778 100644
--- a/tests/quality.test.ts
+++ b/tests/quality.test.ts
@@ -12,7 +12,7 @@ import {
   QUALITY_PROFILES,
   QUALITY_RESOLUTIONS,
   qualitySettingsEqual,
-  SCREEN_AUDIO_BITRATES,
+  screenAudioBitrate,
   senderParameterWarning,
   setMediaPaused,
   startupVideoProfile,
@@ -294,6 +294,7 @@ describe("realtime quality controls", () => {
   });
 
   it.each([
+    [undefined, 128_000],
     ["saver", 64_000],
     ["music", 128_000],
     ["very-high", 192_000],
@@ -306,16 +307,15 @@ describe("realtime quality controls", () => {
       }),
     } as unknown as RTCRtpSender;
 
-    await expect(configureScreenAudioSender(sender, quality)).resolves.toEqual({
+    await expect(configureScreenAudioSender(sender, screenAudioBitrate(quality))).resolves.toEqual({
       requestedMaxBitrate: bitrate,
       appliedMaxBitrate: bitrate,
       mismatch: false,
     });
     expect(applied.encodings).toEqual([{ maxBitrate: bitrate }]);
-    expect(SCREEN_AUDIO_BITRATES[quality]).toBe(bitrate);
   });
 
-  it("uses the music ceiling for a setting without an audio preset", async () => {
+  it.each([96_000, 256_000, 320_000])("applies a numeric %i audio ceiling without a preset", async (bitrate) => {
     let applied = { encodings: [] } as unknown as RTCRtpSendParameters;
     const sender = {
       getParameters: () => applied,
@@ -324,9 +324,9 @@ describe("realtime quality controls", () => {
       }),
     } as unknown as RTCRtpSender;
 
-    await expect(configureScreenAudioSender(sender)).resolves.toEqual({
-      requestedMaxBitrate: 128_000,
-      appliedMaxBitrate: 128_000,
+    await expect(configureScreenAudioSender(sender, bitrate)).resolves.toEqual({
+      requestedMaxBitrate: bitrate,
+      appliedMaxBitrate: bitrate,
       mismatch: false,
     });
   });
@@ -342,7 +342,7 @@ describe("realtime quality controls", () => {
       setParameters: vi.fn(async () => undefined),
     } as unknown as RTCRtpSender;
 
-    const readback = await configureScreenAudioSender(sender, "music");
+    const readback = await configureScreenAudioSender(sender, 128_000);
 
     expect(readback).toEqual({
       requestedMaxBitrate: 128_000,
@@ -367,7 +367,7 @@ describe("realtime quality controls", () => {
     } as unknown as RTCRtpSender;
 
     await expect(
-      configureScreenAudioSender(sender, "very-high"),
+      configureScreenAudioSender(sender, 192_000),
     ).rejects.toThrow("rejected");
     expect(applied.encodings[0]?.maxBitrate).toBe(128_000);
   });

From 38ed8b47e4765944fd2f3d2957840a1f88cde672 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 15:15:27 +0800
Subject: [PATCH 066/262] feat(media)!: support numeric audio bitrate ceilings

Keep presets local to the UI and validate bounded numeric requests in the 2.0 candidate. Advertise and enforce Opus receive limits without reducing shared sources; preserve media continuity during audio-only updates.
---
 docs/project-memory.md                        |   6 +-
 docs/research/browser-screen-audio-quality.md |  33 ++++-
 docs/research/media-fidelity.md               |   4 +-
 docs/research/native-client-media.md          |   5 +-
 docs/standards/media-quality.md               |  20 ++-
 docs/status.md                                |  10 +-
 docs/todo.md                                  |  16 +-
 internal/app/app.go                           |   2 +
 .../app/config/quality_preference_test.go     |   2 +-
 internal/app/loopback/protocol.go             |   4 +-
 internal/app/loopback/protocol_test.go        |  18 +--
 internal/app/loopback/server.go               |   1 +
 internal/app/mediaedge/edge.go                |   6 +
 internal/app/mediaedge/edge_test.go           |   6 +-
 internal/app/mediaedge/publication.go         |   1 +
 internal/app/mediaedge/receiver.go            |   3 +-
 internal/app/mediaedge/receiver_test.go       |   2 +-
 internal/app/nativeaudio/encoder.go           |  20 ++-
 .../nativecontrol/operation_failure_test.go   |  28 ++--
 internal/app/nativecontrol/session.go         |  31 ++--
 internal/app/nativecontrol/session_test.go    |  62 ++++----
 internal/app/nativecontrol/wire.go            |   9 +-
 internal/app/nativehost/profile.go            |   9 +-
 internal/media/forwarding/audio.go            |  52 +++++++
 internal/media/forwarding/audio_test.go       |  34 +++++
 internal/server/protocol/constants.go         |  10 +-
 internal/server/protocol/contract_test.go     |   8 +-
 internal/server/protocol/types.go             |   9 +-
 internal/server/sfu/media.go                  |   9 +-
 internal/server/sfu/media_test.go             |  12 ++
 internal/server/signal/server_test.go         |  12 +-
 scripts/app-media-gate.ts                     |   8 +-
 scripts/browser-local-pool-page.js            |   5 +-
 scripts/browser-local-pool-probe.ts           |   6 +-
 scripts/embedded-sfu-gate.ts                  |  14 ++
 scripts/embedded-sfu-page.ts                  |  12 +-
 src/client/locales/en.ts                      |   4 +-
 src/client/locales/zh.ts                      |   4 +-
 src/client/media/quality.ts                   |  67 ++++++---
 src/client/native/wire.ts                     |   7 +-
 src/client/pages/HostPage.tsx                 |  68 +++++++--
 src/client/sfu/publisher.ts                   |  17 ++-
 src/client/styles.css                         |   2 +
 src/client/webrtc/host-peer.ts                |  35 +++--
 src/shared/protocol.ts                        |  15 +-
 tests/browser-debug.test.ts                   |  10 +-
 tests/client-state.test.ts                    |   4 +-
 tests/fixtures/wire-samples.json              | 140 +++++++++++++-----
 tests/host-peer-tracks.test.ts                |  36 ++++-
 tests/host-quality-ownership.test.ts          |   4 +-
 tests/native-client.test.ts                   |  46 +++---
 tests/native-media-bridge.test.ts             |  14 +-
 tests/native-sender-edge.test.ts              |  16 +-
 tests/native-sender-peer.test.ts              |   4 +-
 tests/native-sfu-publisher.test.ts            |  12 +-
 tests/native-viewer-peer.test.ts              |   8 +-
 tests/protocol.test.ts                        |  22 +--
 tests/quality-preference.test.ts              |   2 +-
 tests/quality.test.ts                         |  43 +++++-
 tests/screen-audio-sdp.test.ts                |   8 +-
 tests/sfu-client.test.ts                      |   4 +-
 tests/viewer-peer-generation.test.ts          |   2 +-
 62 files changed, 742 insertions(+), 341 deletions(-)
 create mode 100644 internal/media/forwarding/audio.go
 create mode 100644 internal/media/forwarding/audio_test.go

diff --git a/docs/project-memory.md b/docs/project-memory.md
index d49572375..4ca8d2b6a 100644
--- a/docs/project-memory.md
+++ b/docs/project-memory.md
@@ -1,6 +1,6 @@
 # Project Memory
 
-Last updated: 2026-10-06
+Last updated: 2026-10-09
 
 Piik is private, low-latency screen sharing for one Host and up to 20
 authenticated friends. The current product surface is Web Host, Web Viewer, and
@@ -92,7 +92,9 @@ implementation and routine UI detail.
   periodic rebalance is accepted.
 - Browser video uses `motion`; each share chooses H.264 with VP8 fallback through
   an actual sender probe unless the Host explicitly selects VP8 or H264. Screen
-  audio uses 64/128/192 kbps ceilings with 128 default.
+  audio retains its compact presets and 128 kbps default. The 2.0 candidate
+  separates numeric bitrate requests from those UI shortcuts; implementation
+  limits and admission remain in the media-quality owner.
 - Viewer playback uses one native video element. Presentation and recovery are
   fenced by current route/media identity and current-frame proof; hidden-page
   time alone is not media-failure evidence or a keepalive guarantee.
diff --git a/docs/research/browser-screen-audio-quality.md b/docs/research/browser-screen-audio-quality.md
index a856332aa..02341fbcc 100644
--- a/docs/research/browser-screen-audio-quality.md
+++ b/docs/research/browser-screen-audio-quality.md
@@ -57,10 +57,10 @@ weak-network behavior, real-game A/V synchronization, or mobile playback.
 
 ## Numeric Bitrate Assessment
 
-Checked 2026-10-09 for the proposed 2.0 media boundary. The current product still
-uses its published presets; these experiments do not accept a new wire format or
-raise its audio ceiling. The shared Browser sender primitive now takes a numeric
-ceiling, with current direct/SFU callers resolving their existing preset first.
+Checked 2026-10-09 for the 2.0 candidate. The published 1.x product retains its
+preset contract. Candidate numeric requests and supported limits are owned by
+[media quality](../standards/media-quality.md#screen-audio); these measurements
+do not establish audible improvement or accept a public release.
 
 The existing Go Opus encoder accepted live 128/192/256/320/96/128 kbps changes
 without replacement. A 48 kHz stereo tone/noise input continued decoding into
@@ -91,8 +91,29 @@ Two controls constrain the replacement design:
   decision. Do not equate the codec range with every route's safe operating range.
 
 The [media extension proposal](./native-client-media.md#audio-and-ui-proposal)
-owns the planned UI and contract. Complete admitted receive limits, native control,
-preference storage and live relay/SFU verification before exposing custom values.
+owns the UI and contract rationale. The candidate enforces a Browser sender's
+negotiated Opus limit, and admits unchanged Native/SFU forwarding only when the
+receiver's declared limit accommodates the full shared format. A codec-valid
+native setting beyond the current sender ceiling remains an operational failure.
+Browser and App preference stores round-trip custom numeric values; those stores
+were not part of published v1.9.2, so no legacy preset migration is required.
+
+The retained SFU gate passed for both Browser and Windows native publication:
+live 320/96 kbps changes retained the same subscription, with advancing decoded
+audio energy and video frames. Video profile changes, reload, recovery and
+retirement also passed; the Browser run measured stereo separation. An ordinary
+Browser relay forwarded received tracks to two children at 320 kbps, with
+advancing decoded audio and successful cleanup. A direct Browser control now
+keeps requested 256/320 kbps below an explicit 192 kbps receive limit, while a
+510 kbps receiver permits both rates. These are local runtime checks; impaired
+networks, mobile playback and physical listening remain open.
+
+RFC 7587 gives an omitted receive bitrate a mode-dependent default, not an
+unrestricted value, and asks receivers to ignore out-of-range preferences.
+All candidate Piik receivers therefore declare the full Opus range explicitly.
+Browser sender enforcement uses [libwebrtc's existing default calculation](https://webrtc.googlesource.com/src/+/refs/heads/main/modules/audio_coding/codecs/opus/audio_encoder_opus.cc)
+when a peer omits a valid limit. Unchanged forwarding requires an explicit
+sufficient limit; it cannot turn down the shared source for one receiver.
 
 ## Primary Sources
 
diff --git a/docs/research/media-fidelity.md b/docs/research/media-fidelity.md
index 2f95f1a99..34f2c67b0 100644
--- a/docs/research/media-fidelity.md
+++ b/docs/research/media-fidelity.md
@@ -9,8 +9,8 @@ all-device acceptance or full HDR support.
 Browser display capture requests two channels without speech processing. The
 Host mixer uses a stereo Web Audio destination; Native capture and mixing use
 48 kHz, two-channel PCM16. Native Opus uses the audio application mode. Browser,
-Native and SFU receivers request stereo. The existing 64/128/192 kbps choices
-are ceilings, not a lossless-audio promise.
+Native and SFU receivers request stereo. Audio settings are bitrate ceilings,
+not a lossless-audio promise; the media-quality owner defines the current controls.
 
 `opus/48000/2` alone does not prove stereo content: Opus permits mono packets
 under that declaration. [RFC 7587](https://www.rfc-editor.org/rfc/rfc7587.html#section-7)
diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 7beb9cde6..adffac81f 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -604,13 +604,14 @@ also travel in authentication and Native commands: adding its two enum values
 causes the actual v1.9.2 readers to terminate those sessions. The PR's compatible
 release claim is therefore incorrect even though its audio use case is valid.
 
-For 2.0, prototype one numeric audio-bitrate ceiling through capture, sender,
+The 2.0 candidate uses one numeric audio-bitrate ceiling through capture, sender,
 receiver and SFU; derive existing preset labels locally. Align receive admission
 with codec support instead of the largest UI shortcut. Keep the existing default
 while comparing actual Opus output and listening results for higher ceilings.
 The [numeric audio controls](./browser-screen-audio-quality.md#numeric-bitrate-assessment)
 establish local 256/320 kbps encoding and Browser reception, with separate
-receive-limit enforcement and high-rate packet-size boundaries still to resolve.
+receive-limit enforcement and a 320 kbps implementation ceiling. Full-range
+Opus wire validation remains independent of that current packet-size choice.
 [LiveKit's AudioPreset](https://docs.livekit.io/reference/client-sdk-js/interfaces/AudioPreset.html)
 likewise contains a numeric maximum bitrate; its
 [high-fidelity example](https://docs.livekit.io/transport/media/advanced/#hi-fi-audio)
diff --git a/docs/standards/media-quality.md b/docs/standards/media-quality.md
index d8d81387d..980d0b8ec 100644
--- a/docs/standards/media-quality.md
+++ b/docs/standards/media-quality.md
@@ -336,10 +336,22 @@ application-defined whole-room lowest-common-denominator target.
 
 ## Screen Audio
 
-Display audio uses `contentHint = "music"`. The live sender ceilings are 64,
-128, and 192 kbps with 128 kbps default. Browser and Native Peer answers request
-Opus stereo and a 192 kbps receive ceiling, including renegotiation. These are
-local receive preferences, independent of the offer's receive preferences.
+Display audio uses `contentHint = "music"`. The 2.0 candidate keeps 64/128/192 kbps
+shortcuts and the 128 kbps default, with a custom numeric ceiling in the same
+sound settings. Current Browser/native senders support 6..320 kbps; the numeric
+wire format uses Opus's 6..510 kbps bounds independently of those shortcuts.
+The current native 20 ms sender ceiling leaves packet-size headroom; a larger
+codec-valid request fails that operation without retiring native control.
+An audio-only update retains capture, media connections and video startup state.
+
+Browser, Native and SFU receive answers request Opus stereo and the full Opus
+receive range, including renegotiation. Browser senders enforce a smaller
+negotiated receive limit on their own encoding, falling back to libwebrtc's
+mode-dependent default when no valid limit is declared. Native/SFU unchanged forwarding
+requires a receiver that can accept the shared source's full range; a smaller
+or undeclared limit rejects that edge before binding, without reducing the source or
+its healthy siblings. An omitted preference does not mean unrestricted reception.
+These receive preferences are independent of the offer's receive preferences.
 The SFU publication uses stereo, DTX disabled, and RED
 disabled; this accepts less burst-loss resilience in exchange for bounded
 publisher traffic. The Browser and source still decide whether an audio track
diff --git a/docs/status.md b/docs/status.md
index 5e3507f31..c99d58de8 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -8,7 +8,7 @@ and Git/PRs own completed history.
 
 ## Accepted Release Contract
 
-- Browser/server v23, Native control v9 and capture v7 form the current contract.
+- Browser/server v23, Native control v9 and capture v7 form the published contract.
   [Versioning](./standards/versioning.md#public-compatibility-promise) owns
   compatibility between published Web/App/Server versions.
 - Hosted Server defaults to SQLite schema 2. Room authority has no inactivity
@@ -60,8 +60,12 @@ guidance preserve indefinite retention by default. The accepted Demo policy is
 one hour without authenticated participants; the private deployment retains the
 default. Operator records own activation, database and postflight evidence.
 The owner is holding the unpublished maintenance changes for 2.0. Preparation
-includes separating media presets from numeric requests and bounded capabilities,
-with audio presets, 4K and additional codecs assessed through that boundary.
+includes separating media presets from numeric requests and bounded capabilities.
+Numeric audio is implemented in the unpublished candidate: Browser/server v24
+and Native control v10 replace the preset field; capture v7 and SQLite schema 2
+remain unchanged. Matched candidate App/Web/Server builds are required;
+1.x participants are rejected by the existing compatibility checks.
+Geometry, 4K and additional codecs are still assessed through the media boundary.
 Native Magicsock remains an isolated experiment with incomplete product
 integration and unresolved recovery cases. These proposals do not yet change
 the accepted contract or transport. A small external test is proposed before
diff --git a/docs/todo.md b/docs/todo.md
index b12a638dd..68e04f187 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -47,19 +47,21 @@ Implementation needs a concrete useful result within the product model.
 - [ ] **Media parameters and capabilities for 2.0.** Follow the
   [media assessment](./research/native-client-media.md#media-capability-extension-assessment):
   separate UI presets, numeric requests, bounded implementation capabilities and
-  actual output. Complete numeric audio bitrate admission and storage first using
-  [#462](https://github.com/TNTcraftHIM/Piik/pull/462)'s use case, then
+  actual output. Numeric audio admission, storage and the compact custom input
+  implement [#462](https://github.com/TNTcraftHIM/Piik/pull/462)'s use case, with
+  local Browser/direct/relay and Browser/native SFU evidence. Next assess
   source-aspect-preserving geometry and 4K through the same owners. Preserve
   safety limits and framework-owned adaptation. The
   [audio controls](./research/browser-screen-audio-quality.md#numeric-bitrate-assessment)
-  require explicit receive-limit enforcement and a packet-size decision before
-  exposing higher numeric ceilings; add live relay/SFU acceptance to the local
-  encoding/Browser evidence. New codecs need complete
+  retain explicit receive-limit enforcement and the current 320 kbps sender
+  ceiling; physical listening and impaired-network evidence remain open.
+  New codecs need complete
   encode/decode/forward support and a late-Viewer policy before inclusion;
   selecting a codec cannot transcode an existing publication. Confirm live
   changes, relay/SFU paths, older 2.x capability subsets and explicit 1.x
-  mismatch before accepting the replacement contract. The current 1.x enums
-  remain; the PR is not a compatible enum-only extension of v1.9.2.
+  mismatch before accepting the replacement contract. The published 1.x enums
+  remain that major's baseline; the PR is not a compatible enum-only extension
+  of v1.9.2.
 - [ ] **Native Magicsock.** Go reuse is feasible, but the
   [matched comparisons](./research/nat-traversal.md#integration-cost-and-recovery-controls)
   have not established improved direct reachability. Seek a repeatable benefit
diff --git a/internal/app/app.go b/internal/app/app.go
index 9535d5b07..63b748e07 100644
--- a/internal/app/app.go
+++ b/internal/app/app.go
@@ -20,6 +20,7 @@ import (
 	"github.com/TNTcraftHIM/Piik/internal/app/lan"
 	"github.com/TNTcraftHIM/Piik/internal/app/launcher"
 	"github.com/TNTcraftHIM/Piik/internal/app/loopback"
+	"github.com/TNTcraftHIM/Piik/internal/app/nativeaudio"
 	"github.com/TNTcraftHIM/Piik/internal/app/nativecapture"
 	"github.com/TNTcraftHIM/Piik/internal/app/nativecontrol"
 	"github.com/TNTcraftHIM/Piik/internal/app/publictunnel"
@@ -626,6 +627,7 @@ func discoverNativeMedia(ctx context.Context, configuredPath string) nativeRunti
 		captureProcess: path,
 		capture:        capabilities,
 		capabilities: loopback.NativeMediaCapabilities{
+			MaxAudioBitrate:       nativeaudio.MaxSendBitrate,
 			ReceiverReuse:         true,
 			Video:                 summary.Video,
 			CaptureBorderControl:  summary.CaptureBorderControl,
diff --git a/internal/app/config/quality_preference_test.go b/internal/app/config/quality_preference_test.go
index 10527de3b..a9c6dcb8f 100644
--- a/internal/app/config/quality_preference_test.go
+++ b/internal/app/config/quality_preference_test.go
@@ -20,7 +20,7 @@ func TestQualityPreferencePersistsWithoutChangingAppConfiguration(t *testing.T)
 		t.Fatalf("initial preference: %v, %v", p.Read(), err)
 	}
 	quality := protocol.DefaultQualitySettings
-	quality.Resolution, quality.ScreenAudioQuality = "1440p", "very-high"
+	quality.Resolution, quality.MaxAudioBitrate = "1440p", 320_000
 	if err := p.Save(quality); err != nil {
 		t.Fatal(err)
 	}
diff --git a/internal/app/loopback/protocol.go b/internal/app/loopback/protocol.go
index ef7c0423d..8bd148095 100644
--- a/internal/app/loopback/protocol.go
+++ b/internal/app/loopback/protocol.go
@@ -9,9 +9,9 @@ import (
 )
 
 const (
-	ProtocolVersion        = 9
+	ProtocolVersion        = 10
 	ServiceName            = "piik-client"
-	ControlSubprotocol     = "piik-client-v9"
+	ControlSubprotocol     = "piik-client-v10"
 	MaxControlMessageBytes = 256 << 10
 	DefaultPortStart       = 39721
 	DefaultPortEnd         = 39730
diff --git a/internal/app/loopback/protocol_test.go b/internal/app/loopback/protocol_test.go
index 5caf5ca00..9d354602a 100644
--- a/internal/app/loopback/protocol_test.go
+++ b/internal/app/loopback/protocol_test.go
@@ -7,8 +7,8 @@ import (
 
 func TestDecodeRequestAcceptsOnlyTheCurrentShape(t *testing.T) {
 	valid := []string{
-		`{"version":9,"id":"request_hello","type":"hello"}`,
-		`{"version":9,"id":"request_ping","type":"ping"}`,
+		`{"version":10,"id":"request_hello","type":"hello"}`,
+		`{"version":10,"id":"request_ping","type":"ping"}`,
 	}
 	for _, payload := range valid {
 		if _, err := decodeRequest([]byte(payload)); err != nil {
@@ -17,10 +17,10 @@ func TestDecodeRequestAcceptsOnlyTheCurrentShape(t *testing.T) {
 	}
 	invalid := []string{
 		`{"version":3,"id":"request_ping","type":"ping"}`,
-		`{"version":9,"id":"short","type":"ping"}`,
-		`{"version":9,"id":"request_ping","type":"ping","extra":true}`,
-		`{"version":9,"id":"request_hello","type":"hello","nonce":"obsolete"}`,
-		`{"version":9,"id":"request_ping","type":"ping"} trailing`,
+		`{"version":10,"id":"short","type":"ping"}`,
+		`{"version":10,"id":"request_ping","type":"ping","extra":true}`,
+		`{"version":10,"id":"request_hello","type":"hello","nonce":"obsolete"}`,
+		`{"version":10,"id":"request_ping","type":"ping"} trailing`,
 	}
 	for _, payload := range invalid {
 		if _, err := decodeRequest([]byte(payload)); err == nil {
@@ -34,11 +34,11 @@ func TestDecodeRequestUsesTheSharedIdentifierBoundary(t *testing.T) {
 	if len(identifier) != 256 {
 		t.Fatalf("test identifier length = %d", len(identifier))
 	}
-	payload := []byte(`{"version":9,"id":"` + identifier + `","type":"ping"}`)
+	payload := []byte(`{"version":10,"id":"` + identifier + `","type":"ping"}`)
 	if _, err := decodeRequest(payload); err != nil {
 		t.Fatalf("maximum identifier was rejected: %v", err)
 	}
-	tooLong := []byte(`{"version":9,"id":"` + identifier + `a","type":"ping"}`)
+	tooLong := []byte(`{"version":10,"id":"` + identifier + `a","type":"ping"}`)
 	if _, err := decodeRequest(tooLong); err == nil {
 		t.Fatal("identifier beyond the boundary was accepted")
 	}
@@ -62,7 +62,7 @@ func TestValidateMessagesRequireTheExpectedPhase(t *testing.T) {
 }
 
 func TestEnvelopeAllowsAnExtensionToOwnItsStrictShape(t *testing.T) {
-	payload := []byte(`{"version":9,"id":"request_extension","type":"extension","value":1}`)
+	payload := []byte(`{"version":10,"id":"request_extension","type":"extension","value":1}`)
 	message, err := decodeEnvelope(payload)
 	if err != nil || message.Type != "extension" {
 		t.Fatalf("extension envelope = %+v, %v", message, err)
diff --git a/internal/app/loopback/server.go b/internal/app/loopback/server.go
index 8efc580d0..5a888f30e 100644
--- a/internal/app/loopback/server.go
+++ b/internal/app/loopback/server.go
@@ -72,6 +72,7 @@ type Health struct {
 }
 
 type NativeMediaCapabilities struct {
+	MaxAudioBitrate       int  `json:"maxAudioBitrate,omitempty"`
 	ReceiverReuse         bool `json:"receiverReuse,omitempty"`
 	Video                 bool `json:"video"`
 	CaptureBorderControl  bool `json:"captureBorderControl,omitempty"`
diff --git a/internal/app/mediaedge/edge.go b/internal/app/mediaedge/edge.go
index 53580a4d3..16bd3dc24 100644
--- a/internal/app/mediaedge/edge.go
+++ b/internal/app/mediaedge/edge.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 	"sync"
 
+	"github.com/TNTcraftHIM/Piik/internal/app/nativeaudio"
 	"github.com/TNTcraftHIM/Piik/internal/diagnostics"
 	"github.com/TNTcraftHIM/Piik/internal/media/forwarding"
 	"github.com/pion/ice/v4"
@@ -256,6 +257,11 @@ func (edge *Edge) SetAnswer(answer webrtc.SessionDescription) error {
 		return nil
 	}
 	edge.mu.Unlock()
+	if edge.audioSource != nil {
+		if err := forwarding.CheckAudioReceiveLimit(answer.SDP, nativeaudio.MaxBitrate); err != nil {
+			return err
+		}
+	}
 	if err := edge.connection.SetRemoteDescription(answer); err != nil {
 		return err
 	}
diff --git a/internal/app/mediaedge/edge_test.go b/internal/app/mediaedge/edge_test.go
index d969bfea2..ac65c02b6 100644
--- a/internal/app/mediaedge/edge_test.go
+++ b/internal/app/mediaedge/edge_test.go
@@ -783,13 +783,11 @@ func connectEdgeToReceiver(
 		t.Fatal(err)
 	}
 	gatherAnswer := webrtc.GatheringCompletePromise(receiver)
-	answer, err := receiver.CreateAnswer(nil)
+	// Use the product's receive preferences rather than Pion's generic defaults.
+	_, err := (&Receiver{connection: receiver}).createAnswer()
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err = receiver.SetLocalDescription(answer); err != nil {
-		t.Fatal(err)
-	}
 	waitSignal(t, gatherAnswer, "answer ICE gathering")
 	if err = edge.SetAnswer(*receiver.LocalDescription()); err != nil {
 		t.Fatal(err)
diff --git a/internal/app/mediaedge/publication.go b/internal/app/mediaedge/publication.go
index c04127450..a860e08c6 100644
--- a/internal/app/mediaedge/publication.go
+++ b/internal/app/mediaedge/publication.go
@@ -84,6 +84,7 @@ func (engine *Engine) NewPublication(source *Source, options EdgeOptions) (*Publ
 	publication.transport = transport
 	transport.SetAudioBitrate(options.Audio.configuredBitrate())
 	publication.signaling.connection = transport.PC
+	publication.signaling.audioSource = options.Audio
 	publication.signaling.localCandidates = newLocalCandidateGathering(socket, options.ICEServers, nil, options.Events.LocalCandidate)
 	transport.PC.OnICECandidate(publication.signaling.localCandidates.addPion)
 	transport.PC.OnConnectionStateChange(func(state webrtc.PeerConnectionState) {
diff --git a/internal/app/mediaedge/receiver.go b/internal/app/mediaedge/receiver.go
index d9810593d..4ca2a18f9 100644
--- a/internal/app/mediaedge/receiver.go
+++ b/internal/app/mediaedge/receiver.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 	"sync"
 
+	"github.com/TNTcraftHIM/Piik/internal/app/nativeaudio"
 	"github.com/TNTcraftHIM/Piik/internal/media/encoded"
 	"github.com/pion/rtcp"
 	"github.com/pion/sdp/v3"
@@ -249,7 +250,7 @@ func (receiver *Receiver) createAnswer() (webrtc.SessionDescription, error) {
 			if !strings.EqualFold(codec.MimeType, webrtc.MimeTypeOpus) {
 				continue
 			}
-			codec.SDPFmtpLine = opusSDPFmtpLine + ";stereo=1;maxaveragebitrate=192000"
+			codec.SDPFmtpLine = opusSDPFmtpLine + ";stereo=1;maxaveragebitrate=" + strconv.Itoa(nativeaudio.MaxBitrate)
 			if err := transceiver.SetCodecPreferences([]webrtc.RTPCodecParameters{codec}); err != nil {
 				return webrtc.SessionDescription{}, err
 			}
diff --git a/internal/app/mediaedge/receiver_test.go b/internal/app/mediaedge/receiver_test.go
index 0c6b1b394..af8ecc8dd 100644
--- a/internal/app/mediaedge/receiver_test.go
+++ b/internal/app/mediaedge/receiver_test.go
@@ -108,7 +108,7 @@ func TestReceiverAdvertisesLocalStereoPreference(t *testing.T) {
 						continue
 					}
 					for _, attribute := range media.Attributes {
-						if attribute.Key == "fmtp" && strings.Contains(attribute.Value, "stereo=1") && strings.Contains(attribute.Value, "maxaveragebitrate=192000") {
+						if attribute.Key == "fmtp" && strings.Contains(attribute.Value, "stereo=1") && strings.Contains(attribute.Value, "maxaveragebitrate=510000") {
 							found = true
 						}
 					}
diff --git a/internal/app/nativeaudio/encoder.go b/internal/app/nativeaudio/encoder.go
index d037d088c..08fad30df 100644
--- a/internal/app/nativeaudio/encoder.go
+++ b/internal/app/nativeaudio/encoder.go
@@ -8,12 +8,16 @@ import (
 )
 
 const (
-	SampleRate        = 48_000
-	Channels          = 2
-	FrameSamples      = 960
-	FrameBytes        = FrameSamples * Channels * 2
-	MaxPacketBytes    = 4_000
-	DefaultBitrate    = 128_000
+	SampleRate     = 48_000
+	Channels       = 2
+	FrameSamples   = 960
+	FrameBytes     = FrameSamples * Channels * 2
+	MaxPacketBytes = 4_000
+	DefaultBitrate = 128_000
+	MinBitrate     = 6_000
+	MaxBitrate     = 510_000
+	// The 20 ms sender leaves RTP/SRTP headroom within an ordinary 1200-byte packet.
+	MaxSendBitrate    = 320_000
 	defaultComplexity = 5
 )
 
@@ -29,14 +33,14 @@ type Encoder struct {
 func (encoder *Encoder) Bitrate() int { return encoder.codec.Bitrate() }
 
 func (encoder *Encoder) SetBitrate(bitrate int) error {
-	if encoder == nil || encoder.codec == nil || bitrate < 6_000 || bitrate > 510_000 {
+	if encoder == nil || encoder.codec == nil || bitrate < MinBitrate || bitrate > MaxBitrate {
 		return errors.New("native audio bitrate is outside the Opus range")
 	}
 	return encoder.codec.SetBitrate(bitrate)
 }
 
 func NewEncoder(bitrate int) (*Encoder, error) {
-	if bitrate < 6_000 || bitrate > 510_000 {
+	if bitrate < MinBitrate || bitrate > MaxBitrate {
 		return nil, errors.New("native audio bitrate is outside the Opus range")
 	}
 	codec, err := gopus.NewEncoder(gopus.EncoderConfig{
diff --git a/internal/app/nativecontrol/operation_failure_test.go b/internal/app/nativecontrol/operation_failure_test.go
index 490f88cae..4a69ba5bd 100644
--- a/internal/app/nativecontrol/operation_failure_test.go
+++ b/internal/app/nativecontrol/operation_failure_test.go
@@ -62,7 +62,7 @@ func TestSourceProbesRetireWithTheirControlConnection(t *testing.T) {
 					t.Fatal(err)
 				}
 				defer connection.CloseNow()
-				if err = wsjson.Write(ctx, connection, json.RawMessage(`{"version":9,"id":"request_hello","type":"hello"}`)); err != nil {
+				if err = wsjson.Write(ctx, connection, json.RawMessage(`{"version":10,"id":"request_hello","type":"hello"}`)); err != nil {
 					t.Fatal(err)
 				}
 				var ready struct{ Type string }
@@ -78,7 +78,7 @@ func TestSourceProbesRetireWithTheirControlConnection(t *testing.T) {
 						t.Error("native probe fixture did not retire")
 					}
 				}()
-				payload := fmt.Sprintf(`{"version":9,"id":"request_probe","type":%q%s}`, request.kind, request.fields)
+				payload := fmt.Sprintf(`{"version":10,"id":"request_probe","type":%q%s}`, request.kind, request.fields)
 				if err = wsjson.Write(ctx, connection, json.RawMessage(payload)); err != nil {
 					t.Fatal(err)
 				}
@@ -150,7 +150,7 @@ func TestOperationalFailureAndIdempotentStopKeepTheRealControlConnection(t *test
 		{"ping", "", "pong"},
 	} {
 		id := fmt.Sprintf("request_%d", index)
-		payload := fmt.Sprintf(`{"version":9,"id":%q,"type":%q%s}`, id, command.kind, command.fields)
+		payload := fmt.Sprintf(`{"version":10,"id":%q,"type":%q%s}`, id, command.kind, command.fields)
 		if err := wsjson.Write(ctx, connection, json.RawMessage(payload)); err != nil {
 			t.Fatal(err)
 		}
@@ -164,7 +164,7 @@ func TestOperationalFailureAndIdempotentStopKeepTheRealControlConnection(t *test
 		}
 	}
 	// A gone target must not bypass strict publication validation.
-	if err := wsjson.Write(ctx, connection, json.RawMessage(`{"version":9,"id":"request_invalid","type":"close-publication","shareId":"missing_share","publicationGeneration":"publication_123","connectionId":"edge_123456","extra":true}`)); err != nil {
+	if err := wsjson.Write(ctx, connection, json.RawMessage(`{"version":10,"id":"request_invalid","type":"close-publication","shareId":"missing_share","publicationGeneration":"publication_123","connectionId":"edge_123456","extra":true}`)); err != nil {
 		t.Fatal(err)
 	}
 	if _, _, err := connection.Read(ctx); websocket.CloseStatus(err) != websocket.StatusPolicyViolation {
@@ -180,7 +180,7 @@ func TestFailedEdgeAndLateStopDoNotRetireAnotherShare(t *testing.T) {
 	t.Setenv("PIIK_QUIET_CAPTURE_FIXTURE", t.TempDir())
 	session := New(executable, nativecapture.Capabilities{SoftwareVP8: true}, false)
 	defer session.Close()
-	const start = `{"version":9,"id":"request_start","type":"start-share","shareId":"share_123456","source":{"kind":"display","sourceId":"1","title":"Fixture"},"audio":false,"edgeCapacity":1,"codec":"vp8","profile":{"resolution":"1080p","maxFramerate":30,"maxBitrate":5000000,"degradationPreference":"balanced"}}`
+	const start = `{"version":10,"id":"request_start","type":"start-share","shareId":"share_123456","source":{"kind":"display","sourceId":"1","title":"Fixture"},"audio":false,"edgeCapacity":1,"codec":"vp8","profile":{"resolution":"1080p","maxFramerate":30,"maxBitrate":5000000,"degradationPreference":"balanced"}}`
 	if value, err := awaitControlResponse(t, session, []byte(start)); err != nil {
 		t.Fatal(err)
 	} else if _, ok := value.(shareStartedResponse); !ok {
@@ -190,14 +190,14 @@ func TestFailedEdgeAndLateStopDoNotRetireAnotherShare(t *testing.T) {
 	if host == nil {
 		t.Fatal("share was not installed")
 	}
-	const edge = `{"version":9,"id":"request_edge","type":"prepare-local-edge","shareId":"share_123456","connectionId":"edge_123456"}`
+	const edge = `{"version":10,"id":"request_edge","type":"prepare-local-edge","shareId":"share_123456","connectionId":"edge_123456"}`
 	if value, err := session.Handle(t.Context(), []byte(edge)); err != nil {
 		t.Fatal(err)
 	} else if _, ok := value.(edgeOfferResponse); !ok {
 		t.Fatalf("edge preparation failed: %#v", value)
 	}
 	assertOperationFailure(t, session, edge)
-	assertOperationFailure(t, session, `{"version":9,"id":"request_edge","type":"prepare-edge","shareId":"stale_share","connectionId":"edge_123456","iceServers":[]}`)
+	assertOperationFailure(t, session, `{"version":10,"id":"request_edge","type":"prepare-edge","shareId":"stale_share","connectionId":"edge_123456","iceServers":[]}`)
 	for _, text := range []string{strings.Repeat("界", 4096), strings.Repeat("界", 4097)} {
 		candidate, _ := json.Marshal(map[string]any{"candidate": text})
 		var upstream protocol.IceCandidate
@@ -209,7 +209,7 @@ func TestFailedEdgeAndLateStopDoNotRetireAnotherShare(t *testing.T) {
 			if kind == "publication-candidate" {
 				fields = `,"publicationGeneration":"publication_123"`
 			}
-			payload := fmt.Sprintf(`{"version":9,"id":"request_remote","type":%q,"shareId":"share_123456","connectionId":"edge_123456","candidate":%s%s}`, kind, candidate, fields)
+			payload := fmt.Sprintf(`{"version":10,"id":"request_remote","type":%q,"shareId":"share_123456","connectionId":"edge_123456","candidate":%s%s}`, kind, candidate, fields)
 			if len([]rune(text)) > 4096 {
 				assertOperationFailure(t, session, payload)
 			} else if _, err := session.Handle(t.Context(), []byte(payload)); err != nil {
@@ -233,8 +233,8 @@ func TestFailedEdgeAndLateStopDoNotRetireAnotherShare(t *testing.T) {
 		t.Fatal(err)
 	}
 	for range 2 {
-		value, err := session.Handle(t.Context(), []byte(`{"version":9,"id":"request_stop","type":"stop-share","shareId":"share_123456"}`))
-		if err != nil || value != response(requestEnvelope{Version: 9, ID: "request_stop"}, "share-stopped") {
+		value, err := session.Handle(t.Context(), []byte(`{"version":10,"id":"request_stop","type":"stop-share","shareId":"share_123456"}`))
+		if err != nil || value != response(requestEnvelope{Version: 10, ID: "request_stop"}, "share-stopped") {
 			t.Fatalf("late stop: %#v, %v", value, err)
 		}
 	}
@@ -274,7 +274,7 @@ func TestCaptureStartupAndReplacementRemainCancellable(t *testing.T) {
 			}
 			session := New(executable, nativecapture.Capabilities{SoftwareVP8: true}, false)
 			defer session.Close()
-			start := `{"version":9,"id":"request_start","type":"start-share","shareId":"share_123456","source":{"kind":"display","sourceId":"1","title":"Fixture"},"edgeCapacity":1,"codec":"vp8","profile":{"resolution":"1080p","maxFramerate":30,"maxBitrate":5000000,"degradationPreference":"balanced"}}`
+			start := `{"version":10,"id":"request_start","type":"start-share","shareId":"share_123456","source":{"kind":"display","sourceId":"1","title":"Fixture"},"edgeCapacity":1,"codec":"vp8","profile":{"resolution":"1080p","maxFramerate":30,"maxBitrate":5000000,"degradationPreference":"balanced"}}`
 			payload := strings.Replace(start, "1080p", "720p", 1)
 			if kind == "replace-share-source" {
 				if value, err := awaitControlResponse(t, session, []byte(start)); err != nil {
@@ -282,7 +282,7 @@ func TestCaptureStartupAndReplacementRemainCancellable(t *testing.T) {
 				} else if _, ok := value.(shareStartedResponse); !ok {
 					t.Fatalf("start: %#v", value)
 				}
-				payload = `{"version":9,"id":"request_replace","type":"replace-share-source","shareId":"share_123456","source":{"kind":"display","sourceId":"2","title":"Fixture"},"audio":false}`
+				payload = `{"version":10,"id":"request_replace","type":"replace-share-source","shareId":"share_123456","source":{"kind":"display","sourceId":"2","title":"Fixture"},"audio":false}`
 			}
 			t.Setenv("PIIK_PENDING_CAPTURE_FIXTURE", "true")
 			if value, err := session.Handle(t.Context(), []byte(payload)); value != nil || err != nil {
@@ -300,12 +300,12 @@ func TestCaptureStartupAndReplacementRemainCancellable(t *testing.T) {
 			}
 			// No unbounded parallel initialization while the first is still waiting.
 			assertOperationFailure(t, session, payload)
-			if _, err := session.Handle(t.Context(), []byte(`{"version":9,"id":"request_ice","type":"edge-candidate","shareId":"share_123456","connectionId":"missing_edge","candidate":null}`)); err != nil {
+			if _, err := session.Handle(t.Context(), []byte(`{"version":10,"id":"request_ice","type":"edge-candidate","shareId":"share_123456","connectionId":"missing_edge","candidate":null}`)); err != nil {
 				t.Fatalf("capture initialization blocked independent control: %v", err)
 			}
 			stopped := make(chan error, 1)
 			go func() {
-				_, err := session.Handle(t.Context(), []byte(`{"version":9,"id":"request_stop","type":"stop-share","shareId":"share_123456"}`))
+				_, err := session.Handle(t.Context(), []byte(`{"version":10,"id":"request_stop","type":"stop-share","shareId":"share_123456"}`))
 				stopped <- err
 			}()
 			select {
diff --git a/internal/app/nativecontrol/session.go b/internal/app/nativecontrol/session.go
index 40a59a71f..f3e8e3ab6 100644
--- a/internal/app/nativecontrol/session.go
+++ b/internal/app/nativecontrol/session.go
@@ -178,10 +178,12 @@ func (session *Session) Handle(ctx context.Context, payload []byte) (result any,
 			!identityPattern.MatchString(request.ShareID) ||
 			!request.Source.Valid() ||
 			request.EdgeCapacity < 1 || request.EdgeCapacity > maxEdgeCapacity ||
-			(request.Codec != "auto" && request.Codec != "h264" && request.Codec != "vp8") ||
-			!validQualitySettings(request.Profile) {
+			(request.Codec != "auto" && request.Codec != "h264" && request.Codec != "vp8") {
 			return nil, protocolViolation("native start-share request is invalid")
 		}
+		if !nativeQualityProfile(request.Profile).Valid() {
+			return nil, errors.New("native sharing profile is unsupported")
+		}
 		if err := session.validateAudioExclusion(request.Source, request.Audio, request.ExcludeAudio); err != nil {
 			return nil, err
 		}
@@ -226,11 +228,13 @@ func (session *Session) Handle(ctx context.Context, payload []byte) (result any,
 		var request updateShareRequest
 		if err := decodeStrict(payload, &request); err != nil ||
 			request.Type != envelope.Type ||
-			!validIdentities(request.ShareID) ||
-			!validQualitySettings(request.Profile) {
+			!validIdentities(request.ShareID) {
 			return nil, protocolViolation("native update-share request is invalid")
 		}
 		profile := nativeQualityProfile(request.Profile)
+		if !profile.Valid() {
+			return nil, errors.New("native sharing profile is unsupported")
+		}
 		slog.Debug("piik-client", "event", "native-profile-requested", "requestId", envelope.ID,
 			"share", diagnostics.ID(request.ShareID), "profile", profile)
 		var err error
@@ -636,10 +640,6 @@ func (session *Session) startShare(
 	}, nil
 }
 
-func validQualitySettings(settings qualitySettings) bool {
-	return nativeQualityProfile(settings).Valid()
-}
-
 func nativeQualityProfile(settings qualitySettings) nativehost.QualityProfile {
 	width, height := uint32(0), uint32(0)
 	switch settings.Resolution {
@@ -652,21 +652,16 @@ func nativeQualityProfile(settings qualitySettings) nativehost.QualityProfile {
 	case "1440p":
 		width, height = 2560, 1440
 	}
-	audioBitrate := 0
-	switch settings.ScreenAudioQuality {
-	case "", "music":
-		audioBitrate = 128_000
-	case "saver":
-		audioBitrate = 64_000
-	case "very-high":
-		audioBitrate = 192_000
+	audioBitrate := int(settings.MaxAudioBitrate)
+	if audioBitrate == 0 {
+		audioBitrate = int(protocol.DefaultQualitySettings.MaxAudioBitrate)
 	}
 	return nativehost.QualityProfile{
 		Video: nativecapture.VideoProfile{
 			Width:      width,
 			Height:     height,
-			Framerate:  settings.MaxFramerate,
-			Bitrate:    settings.MaxBitrate,
+			Framerate:  uint32(settings.MaxFramerate),
+			Bitrate:    uint32(settings.MaxBitrate),
 			Preference: settings.DegradationPreference,
 		},
 		AudioBitrate: audioBitrate,
diff --git a/internal/app/nativecontrol/session_test.go b/internal/app/nativecontrol/session_test.go
index d626d45c2..de572e1e8 100644
--- a/internal/app/nativecontrol/session_test.go
+++ b/internal/app/nativecontrol/session_test.go
@@ -67,7 +67,7 @@ func TestReceiveOfferReusePreservesLegacyResponseShape(t *testing.T) {
 	session := New("", nativecapture.Capabilities{}, false)
 	t.Cleanup(func() { _ = session.Close() })
 	for _, reuse := range []bool{false, true} {
-		request := receiveOfferRequest{Version: 9, ID: "request_offer", Type: "receive-offer", ShareID: "viewer_session",
+		request := receiveOfferRequest{Version: 10, ID: "request_offer", Type: "receive-offer", ShareID: "viewer_session",
 			ConnectionID: "connection_1234", EdgeCapacity: 2, SDP: offer.SDP, ReuseReceiver: reuse}
 		payload, _ := json.Marshal(request)
 		value, err := session.Handle(t.Context(), payload)
@@ -142,7 +142,7 @@ func TestSourceListFitsTheControlEnvelope(t *testing.T) {
 		session := New(executable, nativecapture.Capabilities{}, false)
 		defer session.Close()
 		value, err := awaitControlResponse(t, session,
-			[]byte(`{"version":9,"id":"request_sources","type":"list-sources"}`))
+			[]byte(`{"version":10,"id":"request_sources","type":"list-sources"}`))
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -250,7 +250,7 @@ func TestMicrophoneOptInPreservesLegacyAndOrdersStateBeforeCompletion(t *testing
 			}
 			session := New(executable, nativecapture.Capabilities{VideoCapture: true, SoftwareVP8: true, Microphone: true}, false)
 			defer session.Close()
-			request := startShareRequest{Version: 9, ID: "request_start", Type: "start-share", ShareID: "share_123456",
+			request := startShareRequest{Version: 10, ID: "request_start", Type: "start-share", ShareID: "share_123456",
 				Source:           nativecapture.CaptureTarget{Kind: "display", SourceID: "1", Title: "Fixture"},
 				MicrophoneMixing: optIn, EdgeCapacity: 1, Codec: "vp8",
 				Profile: qualitySettings{Resolution: "1080p", MaxFramerate: 30, MaxBitrate: 5_000_000, DegradationPreference: "balanced"}}
@@ -264,7 +264,7 @@ func TestMicrophoneOptInPreservesLegacyAndOrdersStateBeforeCompletion(t *testing
 			if started.Audio != optIn || bytes.Contains(encoded, []byte(`"sourceAudio"`)) != optIn {
 				t.Fatalf("mixed output leaked across opt-in: %s", encoded)
 			}
-			result, err = session.Handle(t.Context(), []byte(`{"version":9,"id":"request_mic","type":"set-microphone","shareId":"share_123456","enabled":true,"volume":1}`))
+			result, err = session.Handle(t.Context(), []byte(`{"version":10,"id":"request_mic","type":"set-microphone","shareId":"share_123456","enabled":true,"volume":1}`))
 			if !optIn {
 				if _, failed := result.(requestFailedResponse); err != nil || !failed {
 					t.Fatalf("non-opted share admitted mic: %v %#v", err, result)
@@ -332,7 +332,7 @@ func TestCaptureBorderPreferenceFollowsSourceAndProfile(t *testing.T) {
 					t.Fatalf("capture border intent lost: %v", arguments)
 				}
 			}
-			start := startShareRequest{Version: 9, ID: "request_start", Type: "start-share", ShareID: "share_123456",
+			start := startShareRequest{Version: 10, ID: "request_start", Type: "start-share", ShareID: "share_123456",
 				Source:            nativecapture.CaptureTarget{Kind: "display", SourceID: "1", Title: "Fixture"},
 				ShowCaptureBorder: true, EdgeCapacity: 1, Codec: "vp8",
 				Profile: qualitySettings{Resolution: "1080p", MaxFramerate: 30, MaxBitrate: 5_000_000, DegradationPreference: "balanced"}}
@@ -340,7 +340,7 @@ func TestCaptureBorderPreferenceFollowsSourceAndProfile(t *testing.T) {
 			assertBorder(supported)
 			profile := start.Profile
 			profile.Resolution = "480p"
-			handle(updateShareRequest{Version: 9, ID: "request_update", Type: "update-share", ShareID: start.ShareID, Profile: profile})
+			handle(updateShareRequest{Version: 10, ID: "request_update", Type: "update-share", ShareID: start.ShareID, Profile: profile})
 			session.mu.Lock()
 			done := session.updateDone
 			session.mu.Unlock()
@@ -353,11 +353,11 @@ func TestCaptureBorderPreferenceFollowsSourceAndProfile(t *testing.T) {
 			}
 			assertBorder(supported)
 			for _, show := range []bool{false, true} {
-				handle(replaceShareSourceRequest{Version: 9, ID: "request_replace", Type: "replace-share-source", ShareID: start.ShareID,
+				handle(replaceShareSourceRequest{Version: 10, ID: "request_replace", Type: "replace-share-source", ShareID: start.ShareID,
 					Source: nativecapture.CaptureTarget{Kind: "display", SourceID: "2", Title: "Other fixture"}, ShowCaptureBorder: show})
 				assertBorder(show && supported)
 			}
-			handle(stopShareRequest{Version: 9, ID: "request_stop", Type: "stop-share", ShareID: start.ShareID})
+			handle(stopShareRequest{Version: 10, ID: "request_stop", Type: "stop-share", ShareID: start.ShareID})
 		})
 	}
 }
@@ -393,9 +393,9 @@ func TestQuietHostUpdatePreservesControlAndCancelsCleanly(t *testing.T) {
 				}
 				return value
 			}
-			const start = `{"version":9,"id":"request_start","type":"start-share","shareId":"share_123456","source":{"kind":"display","sourceId":"1","title":"Fixture"},"audio":false,"adapterIndex":0,"encoderIndex":0,"edgeCapacity":1,"codec":"vp8","profile":{"resolution":"1080p","maxFramerate":30,"maxBitrate":5000000,"degradationPreference":"balanced"}}`
+			const start = `{"version":10,"id":"request_start","type":"start-share","shareId":"share_123456","source":{"kind":"display","sourceId":"1","title":"Fixture"},"audio":false,"adapterIndex":0,"encoderIndex":0,"edgeCapacity":1,"codec":"vp8","profile":{"resolution":"1080p","maxFramerate":30,"maxBitrate":5000000,"degradationPreference":"balanced"}}`
 			handle(start)
-			const update = `{"version":9,"id":"request_update","type":"update-share","shareId":"share_123456","profile":{"resolution":"720p","maxFramerate":30,"maxBitrate":3000000,"degradationPreference":"balanced"}}`
+			const update = `{"version":10,"id":"request_update","type":"update-share","shareId":"share_123456","profile":{"resolution":"720p","maxFramerate":30,"maxBitrate":3000000,"degradationPreference":"balanced"}}`
 			if value := handle(update); value != nil {
 				t.Fatalf("Host update did not defer: %#v", value)
 			}
@@ -414,15 +414,15 @@ func TestQuietHostUpdatePreservesControlAndCancelsCleanly(t *testing.T) {
 			}
 			for _, payload := range []string{
 				strings.Replace(update, "request_update", "request_duplicate", 1),
-				`{"version":9,"id":"request_replace","type":"replace-share-source","shareId":"share_123456","source":{"kind":"display","sourceId":"1","title":"Fixture"},"audio":false,"adapterIndex":0,"encoderIndex":0}`,
+				`{"version":10,"id":"request_replace","type":"replace-share-source","shareId":"share_123456","source":{"kind":"display","sourceId":"1","title":"Fixture"},"audio":false,"adapterIndex":0,"encoderIndex":0}`,
 			} {
 				if _, ok := handle(payload).(requestFailedResponse); !ok {
 					t.Fatal("conflicting capture mutation was not rejected")
 				}
 			}
 			for _, payload := range []string{
-				`{"version":9,"id":"request_pause","type":"pause-share","shareId":"share_123456","paused":true}`,
-				`{"version":9,"id":"request_ice","type":"edge-candidate","shareId":"share_123456","connectionId":"retired_edge","candidate":null}`,
+				`{"version":10,"id":"request_pause","type":"pause-share","shareId":"share_123456","paused":true}`,
+				`{"version":10,"id":"request_ice","type":"edge-candidate","shareId":"share_123456","connectionId":"retired_edge","candidate":null}`,
 			} {
 				started := time.Now()
 				handle(payload)
@@ -457,7 +457,7 @@ func TestQuietHostUpdatePreservesControlAndCancelsCleanly(t *testing.T) {
 					t.Fatal(err)
 				}
 			case "stop":
-				handle(`{"version":9,"id":"request_stop","type":"stop-share","shareId":"share_123456"}`)
+				handle(`{"version":10,"id":"request_stop","type":"stop-share","shareId":"share_123456"}`)
 			case "disconnect":
 				if err = session.Close(); err != nil {
 					t.Fatal(err)
@@ -474,7 +474,7 @@ func TestQuietHostUpdatePreservesControlAndCancelsCleanly(t *testing.T) {
 			if outcome == "backpressure-stop" {
 				stopped := make(chan any, 1)
 				go func() {
-					value, err := session.Handle(t.Context(), []byte(`{"version":9,"id":"request_stop","type":"stop-share","shareId":"share_123456"}`))
+					value, err := session.Handle(t.Context(), []byte(`{"version":10,"id":"request_stop","type":"stop-share","shareId":"share_123456"}`))
 					if err != nil {
 						stopped <- err
 					} else {
@@ -577,7 +577,7 @@ func TestControlMessagesRejectUnknownFieldsAndStaleVersions(t *testing.T) {
 	session := New("missing-capture-process", nativecapture.Capabilities{}, false)
 	t.Cleanup(func() { _ = session.Close() })
 	for _, payload := range []string{
-		`{"version":9,"id":"request_sources","type":"list-sources","extra":true}`,
+		`{"version":10,"id":"request_sources","type":"list-sources","extra":true}`,
 		`{"version":4,"id":"request_sources","type":"list-sources"}`,
 		`{"version":5,"id":"short","type":"stop-share","shareId":"share_123456"}`,
 	} {
@@ -609,9 +609,9 @@ func TestResponseKeepsTheRequestIdentity(t *testing.T) {
 func TestPrepareLocalEdgeOwnsOneStrictRequestShape(t *testing.T) {
 	session := New("missing-capture-process", nativecapture.Capabilities{}, false)
 	t.Cleanup(func() { _ = session.Close() })
-	valid := `{"version":9,"id":"request_local_edge","type":"prepare-local-edge","shareId":"share_123456","connectionId":"edge_1234567"}`
+	valid := `{"version":10,"id":"request_local_edge","type":"prepare-local-edge","shareId":"share_123456","connectionId":"edge_1234567"}`
 	assertOperationFailure(t, session, valid)
-	invalid := `{"version":9,"id":"request_local_edge","type":"prepare-local-edge","shareId":"share_123456","connectionId":"edge_1234567","iceServers":[]}`
+	invalid := `{"version":10,"id":"request_local_edge","type":"prepare-local-edge","shareId":"share_123456","connectionId":"edge_1234567","iceServers":[]}`
 	if _, err := session.Handle(t.Context(), []byte(invalid)); err == nil || err.Error() != "native prepare-local-edge request is invalid" {
 		t.Fatalf("extended local-edge request was accepted: %v", err)
 	}
@@ -621,7 +621,7 @@ func TestPreviewFailureReturnsAnAdvisoryResponse(t *testing.T) {
 	session := New("missing-capture-process", nativecapture.Capabilities{}, false)
 	t.Cleanup(func() { _ = session.Close() })
 	value, err := session.Handle(t.Context(), []byte(
-		`{"version":9,"id":"request_preview","type":"source-preview","source":{"kind":"display","sourceId":"65537","title":"Display 1"}}`,
+		`{"version":10,"id":"request_preview","type":"source-preview","source":{"kind":"display","sourceId":"65537","title":"Display 1"}}`,
 	))
 	if err != nil {
 		t.Fatal(err)
@@ -636,7 +636,7 @@ func TestSourceEnumerationFailureDoesNotCloseControl(t *testing.T) {
 	session := New("missing-capture-process", nativecapture.Capabilities{}, false)
 	t.Cleanup(func() { _ = session.Close() })
 	value, err := session.Handle(t.Context(), []byte(
-		`{"version":9,"id":"request_sources","type":"list-sources"}`,
+		`{"version":10,"id":"request_sources","type":"list-sources"}`,
 	))
 	if err != nil || value != operationFailure(requestEnvelope{
 		Version: loopback.ProtocolVersion, ID: "request_sources", Type: "list-sources",
@@ -644,7 +644,7 @@ func TestSourceEnumerationFailureDoesNotCloseControl(t *testing.T) {
 		t.Fatalf("source list failure ended its control session: %#v, %v", value, err)
 	}
 	if _, err := session.Handle(t.Context(), []byte(
-		`{"version":9,"id":"request_options","type":"capture-options"}`,
+		`{"version":10,"id":"request_options","type":"capture-options"}`,
 	)); err != nil {
 		t.Fatalf("control was unusable after source enumeration failed: %v", err)
 	}
@@ -654,10 +654,10 @@ func TestQualitySettingsMapOnceIntoNativeMedia(t *testing.T) {
 	settings := qualitySettings{
 		Resolution: "1440p", MaxFramerate: 60, MaxBitrate: 12_000_000,
 		DegradationPreference: "maintain-framerate",
-		ScreenAudioQuality:    "very-high",
+		MaxAudioBitrate:       192000,
 	}
 	profile := nativeQualityProfile(settings)
-	if !validQualitySettings(settings) || profile.Video.Width != 2560 ||
+	if !profile.Valid() || profile.Video.Width != 2560 ||
 		profile.Video.Height != 1440 || profile.Video.Framerate != 60 ||
 		profile.Video.Bitrate != 12_000_000 ||
 		profile.Video.Preference != "maintain-framerate" ||
@@ -665,7 +665,7 @@ func TestQualitySettingsMapOnceIntoNativeMedia(t *testing.T) {
 		t.Fatalf("native profile = %+v", profile)
 	}
 	settings.Resolution = "2160p"
-	if validQualitySettings(settings) {
+	if nativeQualityProfile(settings).Valid() {
 		t.Fatal("unsupported resolution was accepted")
 	}
 }
@@ -673,9 +673,15 @@ func TestQualitySettingsMapOnceIntoNativeMedia(t *testing.T) {
 func TestUpdateShareRequiresTheCurrentStrictProfile(t *testing.T) {
 	session := New("missing-capture-process", nativecapture.Capabilities{}, false)
 	t.Cleanup(func() { _ = session.Close() })
-	valid := `{"version":9,"id":"request_update","type":"update-share","shareId":"share_123456","profile":{"resolution":"1080p","maxFramerate":30,"maxBitrate":5000000,"degradationPreference":"balanced","screenAudioQuality":"music"}}`
+	valid := `{"version":10,"id":"request_update","type":"update-share","shareId":"share_123456","profile":{"resolution":"1080p","maxFramerate":30,"maxBitrate":5000000,"degradationPreference":"balanced","maxAudioBitrate":128000}}`
 	assertOperationFailure(t, session, valid)
-	invalid := `{"version":9,"id":"request_update","type":"update-share","shareId":"share_123456","profile":{"resolution":"1080p","maxFramerate":30,"maxBitrate":5000000,"degradationPreference":"balanced","screenAudioQuality":"music","extra":true}}`
+	// Opus permits this numeric request, but the current 20 ms sender does not.
+	// Keep the control session usable and let the caller keep its current share.
+	assertOperationFailure(t, session, strings.Replace(valid, `"maxAudioBitrate":128000`, `"maxAudioBitrate":510000`, 1))
+	if _, err := session.Handle(t.Context(), []byte(`{"version":10,"id":"request_options","type":"capture-options"}`)); err != nil {
+		t.Fatalf("unsupported media setting retired control: %v", err)
+	}
+	invalid := `{"version":10,"id":"request_update","type":"update-share","shareId":"share_123456","profile":{"resolution":"1080p","maxFramerate":30,"maxBitrate":5000000,"degradationPreference":"balanced","maxAudioBitrate":128000,"extra":true}}`
 	if _, err := session.Handle(t.Context(), []byte(invalid)); err == nil ||
 		err.Error() != "native update-share request is invalid" {
 		t.Fatalf("extended update was accepted: %v", err)
@@ -685,9 +691,9 @@ func TestUpdateShareRequiresTheCurrentStrictProfile(t *testing.T) {
 func TestReplaceShareSourceKeepsOneStrictTargetShape(t *testing.T) {
 	session := New("missing-capture-process", nativecapture.Capabilities{}, false)
 	t.Cleanup(func() { _ = session.Close() })
-	valid := `{"version":9,"id":"request_source","type":"replace-share-source","shareId":"share_123456","source":{"kind":"picker","sourceId":"1","title":"Portal"},"audio":false,"adapterIndex":0,"encoderIndex":0}`
+	valid := `{"version":10,"id":"request_source","type":"replace-share-source","shareId":"share_123456","source":{"kind":"picker","sourceId":"1","title":"Portal"},"audio":false,"adapterIndex":0,"encoderIndex":0}`
 	assertOperationFailure(t, session, valid)
-	invalid := `{"version":9,"id":"request_source","type":"replace-share-source","shareId":"share_123456","source":{"kind":"picker","sourceId":"1","title":"Portal"},"audio":false,"adapterIndex":0,"encoderIndex":0,"extra":true}`
+	invalid := `{"version":10,"id":"request_source","type":"replace-share-source","shareId":"share_123456","source":{"kind":"picker","sourceId":"1","title":"Portal"},"audio":false,"adapterIndex":0,"encoderIndex":0,"extra":true}`
 	if _, err := session.Handle(t.Context(), []byte(invalid)); err == nil ||
 		err.Error() != "native replace-share-source request is invalid" {
 		t.Fatalf("extended source replacement was accepted: %v", err)
diff --git a/internal/app/nativecontrol/wire.go b/internal/app/nativecontrol/wire.go
index b69ab1ca6..eddcda346 100644
--- a/internal/app/nativecontrol/wire.go
+++ b/internal/app/nativecontrol/wire.go
@@ -3,6 +3,7 @@ package nativecontrol
 import (
 	"github.com/TNTcraftHIM/Piik/internal/app/mediaedge"
 	"github.com/TNTcraftHIM/Piik/internal/app/nativecapture"
+	"github.com/TNTcraftHIM/Piik/internal/server/protocol"
 	"github.com/pion/webrtc/v4"
 )
 
@@ -33,13 +34,7 @@ type sourcePreviewRequest struct {
 	Source  nativecapture.CaptureTarget `json:"source"`
 }
 
-type qualitySettings struct {
-	Resolution            string `json:"resolution"`
-	MaxFramerate          uint32 `json:"maxFramerate"`
-	MaxBitrate            uint32 `json:"maxBitrate"`
-	DegradationPreference string `json:"degradationPreference"`
-	ScreenAudioQuality    string `json:"screenAudioQuality,omitempty"`
-}
+type qualitySettings = protocol.QualitySettings
 
 type startShareRequest struct {
 	Version           int                          `json:"version"`
diff --git a/internal/app/nativehost/profile.go b/internal/app/nativehost/profile.go
index 7e02897da..90dd27011 100644
--- a/internal/app/nativehost/profile.go
+++ b/internal/app/nativehost/profile.go
@@ -1,6 +1,9 @@
 package nativehost
 
-import "github.com/TNTcraftHIM/Piik/internal/app/nativecapture"
+import (
+	"github.com/TNTcraftHIM/Piik/internal/app/nativeaudio"
+	"github.com/TNTcraftHIM/Piik/internal/app/nativecapture"
+)
 
 type QualityProfile struct {
 	Video        nativecapture.VideoProfile
@@ -9,7 +12,5 @@ type QualityProfile struct {
 
 func (profile QualityProfile) Valid() bool {
 	return profile.Video.Valid() &&
-		(profile.AudioBitrate == 64_000 ||
-			profile.AudioBitrate == 128_000 ||
-			profile.AudioBitrate == 192_000)
+		profile.AudioBitrate >= nativeaudio.MinBitrate && profile.AudioBitrate <= nativeaudio.MaxSendBitrate
 }
diff --git a/internal/media/forwarding/audio.go b/internal/media/forwarding/audio.go
new file mode 100644
index 000000000..787b36f6c
--- /dev/null
+++ b/internal/media/forwarding/audio.go
@@ -0,0 +1,52 @@
+package forwarding
+
+import (
+	"errors"
+	"strconv"
+	"strings"
+
+	"github.com/pion/sdp/v3"
+)
+
+// CheckAudioReceiveLimit admits unchanged Opus forwarding. A receiver may not
+// lower the shared source or its siblings. Piik receivers declare the full Opus
+// range; an omitted preference uses codec defaults, not an unrestricted rate.
+func CheckAudioReceiveLimit(description string, sourceCeiling int) error {
+	var session sdp.SessionDescription
+	if err := session.Unmarshal([]byte(description)); err != nil {
+		return err
+	}
+	for _, media := range session.MediaDescriptions {
+		if media.MediaName.Media != "audio" || media.MediaName.Port.Value == 0 {
+			continue
+		}
+		for _, format := range media.MediaName.Formats {
+			payload, err := strconv.ParseUint(format, 10, 8)
+			if err != nil {
+				continue
+			}
+			codec, err := session.GetCodecForPayloadType(uint8(payload))
+			if err != nil || !strings.EqualFold(codec.Name, "opus") {
+				continue
+			}
+			receiveLimit := 0
+			for _, parameter := range strings.Split(codec.Fmtp, ";") {
+				name, value, found := strings.Cut(parameter, "=")
+				if !strings.EqualFold(strings.TrimSpace(name), "maxaveragebitrate") {
+					continue
+				}
+				limit, err := strconv.Atoi(strings.TrimSpace(value))
+				if !found || err != nil || limit < 6_000 || limit > 510_000 {
+					continue // RFC 7587: ignore invalid preferences.
+				}
+				if receiveLimit == 0 || limit < receiveLimit {
+					receiveLimit = limit
+				}
+			}
+			if receiveLimit < sourceCeiling {
+				return errors.New("receiver audio bitrate limit cannot carry the shared Opus source")
+			}
+		}
+	}
+	return nil
+}
diff --git a/internal/media/forwarding/audio_test.go b/internal/media/forwarding/audio_test.go
new file mode 100644
index 000000000..7c249d0d7
--- /dev/null
+++ b/internal/media/forwarding/audio_test.go
@@ -0,0 +1,34 @@
+package forwarding
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestSharedAudioRejectsOnlyAnInsufficientReceiver(t *testing.T) {
+	for _, test := range []struct {
+		parameter string
+		allowed   bool
+	}{
+		{"stereo=1", false},
+		{"stereo=1;maxaveragebitrate=510000", true},
+		{"stereo=1;maxaveragebitrate=192000", false},
+		{"maxaveragebitrate=320000", false},
+		{"maxaveragebitrate=invalid", false},
+		{"maxaveragebitrate=510001", false},
+		{"maxaveragebitrate=510000;maxaveragebitrate=510001", true},
+		{"maxaveragebitrate=510000;maxaveragebitrate=96000", false},
+	} {
+		t.Run(test.parameter, func(t *testing.T) {
+			answer := "v=0\r\no=- 1 1 IN IP4 127.0.0.1\r\ns=-\r\nt=0 0\r\n" +
+				"m=audio 9 UDP/TLS/RTP/SAVPF 111\r\na=rtpmap:111 opus/48000/2\r\na=fmtp:111 " + test.parameter + "\r\n"
+			if err := CheckAudioReceiveLimit(answer, 510_000); (err == nil) != test.allowed {
+				t.Fatalf("receiver admitted=%v, err=%v", test.allowed, err)
+			}
+			// Rejected or unrelated media cannot impose an audio limit.
+			if err := CheckAudioReceiveLimit(strings.Replace(answer, "m=audio 9", "m=audio 0", 1), 510_000); err != nil {
+				t.Fatal(err)
+			}
+		})
+	}
+}
diff --git a/internal/server/protocol/constants.go b/internal/server/protocol/constants.go
index d70fded9f..cb393307b 100644
--- a/internal/server/protocol/constants.go
+++ b/internal/server/protocol/constants.go
@@ -7,12 +7,18 @@ package protocol
 // MaxSafeInteger is JavaScript's Number.MAX_SAFE_INTEGER.
 const MaxSafeInteger = 9007199254740991
 
+// Opus format bounds, independent of UI presets and current sender capabilities.
+const (
+	MinAudioBitrate = 6_000
+	MaxAudioBitrate = 510_000
+)
+
 // Limits and identifiers in the Piik wire contract.
 const (
 	MaxViewersPerRoomLimit      = 20
 	MaxParticipantsPerRoomLimit = MaxViewersPerRoomLimit + 1
 	MaxSignalBytes              = 64 * 1024
-	SignalingProtocol           = "piik-v23"
+	SignalingProtocol           = "piik-v24"
 	RoomCodeLength              = 4
 	MaxMediaRouteRevision       = MaxSafeInteger
 	MaxIceServerURLs            = 8
@@ -62,7 +68,7 @@ var DefaultQualitySettings = QualitySettings{
 	MaxFramerate:          30,
 	MaxBitrate:            5_000_000,
 	DegradationPreference: "balanced",
-	ScreenAudioQuality:    "music",
+	MaxAudioBitrate:       128000,
 }
 
 // DefaultRoutePolicy mirrors DEFAULT_ROUTE_POLICY.
diff --git a/internal/server/protocol/contract_test.go b/internal/server/protocol/contract_test.go
index 9e127ef29..206999b58 100644
--- a/internal/server/protocol/contract_test.go
+++ b/internal/server/protocol/contract_test.go
@@ -126,7 +126,7 @@ const (
 func authenticatedHost() []member {
 	return []member{
 		{"type", `"authenticated"`},
-		{"protocol", `"piik-v23"`},
+		{"protocol", `"piik-v24"`},
 		{"peerId", `"host_12345678"`},
 		{"maxViewers", `8`},
 		{"endpointMediaCopyCapacity", `2`},
@@ -705,7 +705,7 @@ func TestAuthenticateConnectionProgressOptIn(t *testing.T) {
 
 func TestAuthenticateAppliesTheRoutePolicyDefault(t *testing.T) {
 	message, err := DecodeClientMessage([]byte(
-		`{"type":"authenticate","protocol":"piik-v23","roomId":"1234","role":"host",` +
+		`{"type":"authenticate","protocol":"piik-v24","roomId":"1234","role":"host",` +
 			`"token":"` + repeat("a", 43) + `","clientId":"client_12345678"}`))
 	if err != nil {
 		t.Fatal(err)
@@ -721,7 +721,7 @@ func TestAuthenticateAppliesTheRoutePolicyDefault(t *testing.T) {
 
 func TestAuthenticateAcceptsPersistentRoomSessionOptIn(t *testing.T) {
 	message, err := DecodeClientMessage([]byte(
-		`{"type":"authenticate","protocol":"piik-v23","roomId":"1234","role":"host",` +
+		`{"type":"authenticate","protocol":"piik-v24","roomId":"1234","role":"host",` +
 			`"token":"` + repeat("a", 43) + `","clientId":"client_12345678","roomSession":true,"roomOnly":true}`))
 	if err != nil {
 		t.Fatal(err)
@@ -731,7 +731,7 @@ func TestAuthenticateAcceptsPersistentRoomSessionOptIn(t *testing.T) {
 		t.Fatalf("decoded %#v, want room-session opt-in and room-only state", message)
 	}
 	if _, err := DecodeClientMessage([]byte(
-		`{"type":"authenticate","protocol":"piik-v23","roomId":"1234","role":"host",` +
+		`{"type":"authenticate","protocol":"piik-v24","roomId":"1234","role":"host",` +
 			`"token":"` + repeat("a", 43) + `","clientId":"client_12345678","roomOnly":true}`)); err == nil {
 		t.Fatal("accepted roomOnly without roomSession opt-in")
 	}
diff --git a/internal/server/protocol/types.go b/internal/server/protocol/types.go
index 4bfd18683..e026f1424 100644
--- a/internal/server/protocol/types.go
+++ b/internal/server/protocol/types.go
@@ -37,7 +37,6 @@ var (
 var (
 	qualityResolutions           = []string{"480p", "720p", "1080p", "1440p"}
 	degradationPreferences       = []string{"maintain-resolution", "balanced", "maintain-framerate"}
-	screenAudioQualities         = []string{"saver", "music", "very-high"}
 	mediaRoutePhases             = []string{"prepare", "active"}
 	routeDemandReasons           = []string{"join", "edge-unavailable", "parent-departed", "capacity-reduction", "sfu-bootstrap", "direct-convergence", "quality-convergence", "root-convergence"}
 	routeDiagnosticFinalRoutes   = []string{"direct", "sfu", "waiting", "failed"}
@@ -112,7 +111,7 @@ type QualitySettings struct {
 	MaxFramerate          Int    `json:"maxFramerate"`
 	MaxBitrate            Int    `json:"maxBitrate"`
 	DegradationPreference string `json:"degradationPreference"`
-	ScreenAudioQuality    string `json:"screenAudioQuality,omitempty"`
+	MaxAudioBitrate       Int    `json:"maxAudioBitrate,omitempty"`
 }
 
 // UnmarshalJSON implements json.Unmarshaler.
@@ -127,7 +126,7 @@ func (v *QualitySettings) UnmarshalJSON(data []byte) error {
 		"resolution", "maxFramerate", "maxBitrate", "degradationPreference"); err != nil {
 		return err
 	}
-	if err := present.optional("screenAudioQuality"); err != nil {
+	if err := present.optional("maxAudioBitrate"); err != nil {
 		return err
 	}
 	if !enumOf(v.Resolution, qualityResolutions...) {
@@ -142,8 +141,8 @@ func (v *QualitySettings) UnmarshalJSON(data []byte) error {
 	if !enumOf(v.DegradationPreference, degradationPreferences...) {
 		return fmt.Errorf("unknown degradationPreference %q", v.DegradationPreference)
 	}
-	if present.has("screenAudioQuality") && !enumOf(v.ScreenAudioQuality, screenAudioQualities...) {
-		return fmt.Errorf("unknown screenAudioQuality %q", v.ScreenAudioQuality)
+	if present.has("maxAudioBitrate") && !inRangeInt(v.MaxAudioBitrate, MinAudioBitrate, MaxAudioBitrate) {
+		return errors.New("maxAudioBitrate is out of range")
 	}
 	return nil
 }
diff --git a/internal/server/sfu/media.go b/internal/server/sfu/media.go
index 63452c0c0..ad90a3efd 100644
--- a/internal/server/sfu/media.go
+++ b/internal/server/sfu/media.go
@@ -4,10 +4,12 @@ import (
 	"context"
 	"errors"
 	"slices"
+	"strconv"
 	"strings"
 	"sync"
 
 	"github.com/TNTcraftHIM/Piik/internal/media/forwarding"
+	"github.com/TNTcraftHIM/Piik/internal/server/protocol"
 	"github.com/pion/interceptor"
 	"github.com/pion/rtcp"
 	"github.com/pion/webrtc/v4"
@@ -342,7 +344,7 @@ func (media *Media) AcceptPublisherOffer(fence ResourceFence, connectionID strin
 			return webrtc.SessionDescription{}, errors.New("SFU publisher codec does not match its declaration")
 		}
 		if transceiver.Kind() == webrtc.RTPCodecTypeAudio {
-			selected[0].SDPFmtpLine = "minptime=10;useinbandfec=1;stereo=1;usedtx=0"
+			selected[0].SDPFmtpLine = "minptime=10;useinbandfec=1;stereo=1;usedtx=0;maxaveragebitrate=" + strconv.Itoa(protocol.MaxAudioBitrate)
 		}
 		if err = transceiver.SetCodecPreferences(selected[:1]); err != nil {
 			return webrtc.SessionDescription{}, err
@@ -639,6 +641,11 @@ func (media *Media) ApplySubscriberAnswer(fence SubscriptionFence, connectionID
 	if answer.Type != webrtc.SDPTypeAnswer {
 		return errors.New("SFU subscriber requires an answer")
 	}
+	if subscriber.transport.AudioSender != nil {
+		if err := forwarding.CheckAudioReceiveLimit(answer.SDP, protocol.MaxAudioBitrate); err != nil {
+			return err
+		}
+	}
 	return subscriber.transport.PC.SetRemoteDescription(answer)
 }
 
diff --git a/internal/server/sfu/media_test.go b/internal/server/sfu/media_test.go
index 8720cb0d2..3fe701873 100644
--- a/internal/server/sfu/media_test.go
+++ b/internal/server/sfu/media_test.go
@@ -296,6 +296,18 @@ func runMediaFanout(t *testing.T, codec string, layerCount int) {
 			}
 		})
 		check(receiver.SetRemoteDescription(offer))
+		for _, transceiver := range receiver.GetTransceivers() {
+			if transceiver.Kind() != webrtc.RTPCodecTypeAudio {
+				continue
+			}
+			for _, codec := range transceiver.Receiver().GetParameters().Codecs {
+				if codec.MimeType == webrtc.MimeTypeOpus {
+					codec.SDPFmtpLine = "stereo=1;maxaveragebitrate=510000"
+					check(transceiver.SetCodecPreferences([]webrtc.RTPCodecParameters{codec}))
+					break
+				}
+			}
+		}
 		answer, answerErr := receiver.CreateAnswer(nil)
 		check(answerErr)
 		check(service.ApplySubscriberAnswer(subscription, "subscriber_123456", waitGathering(receiver, answer)))
diff --git a/internal/server/signal/server_test.go b/internal/server/signal/server_test.go
index 092fe005d..16ec7c23e 100644
--- a/internal/server/signal/server_test.go
+++ b/internal/server/signal/server_test.go
@@ -2434,9 +2434,9 @@ func TestSignalBindsNewShareQualityAndPreservesActiveShareQualityAcrossReconnect
 		"maxFramerate":          60,
 		"maxBitrate":            8_000_000,
 		"degradationPreference": "maintain-resolution",
-		"screenAudioQuality":    "very-high",
+		"maxAudioBitrate":       192000,
 	}
-	initialJSON := `{"resolution":"1440p","maxFramerate":60,"maxBitrate":8000000,"degradationPreference":"maintain-resolution","screenAudioQuality":"very-high"}`
+	initialJSON := `{"resolution":"1440p","maxFramerate":60,"maxBitrate":8000000,"degradationPreference":"maintain-resolution","maxAudioBitrate":192000}`
 	firstGeneration := "first_share_generation_12345678"
 	viewer := openClient(t, h)
 	authenticate(t, viewer, h.room, protocol.RoleViewer, "quality-viewer-client", 1, "", presenceOptions{})
@@ -2452,9 +2452,9 @@ func TestSignalBindsNewShareQualityAndPreservesActiveShareQualityAcrossReconnect
 		"maxFramerate":          15,
 		"maxBitrate":            2_000_000,
 		"degradationPreference": "maintain-framerate",
-		"screenAudioQuality":    "saver",
+		"maxAudioBitrate":       64000,
 	}
-	reconnectJSON := `{"resolution":"480p","maxFramerate":15,"maxBitrate":2000000,"degradationPreference":"maintain-framerate","screenAudioQuality":"saver"}`
+	reconnectJSON := `{"resolution":"480p","maxFramerate":15,"maxBitrate":2000000,"degradationPreference":"maintain-framerate","maxAudioBitrate":64000}`
 	reconnectedHost := openClient(t, h)
 	reconnectedAuth := authenticate(t, reconnectedHost, h.room, protocol.RoleHost, "quality-host-client", 1, firstGeneration,
 		presenceOptions{qualitySettings: reconnectSettings})
@@ -2469,9 +2469,9 @@ func TestSignalBindsNewShareQualityAndPreservesActiveShareQualityAcrossReconnect
 		"maxFramerate":          30,
 		"maxBitrate":            3_000_000,
 		"degradationPreference": "balanced",
-		"screenAudioQuality":    "music",
+		"maxAudioBitrate":       128000,
 	}
-	updatedJSON := `{"resolution":"720p","maxFramerate":30,"maxBitrate":3000000,"degradationPreference":"balanced","screenAudioQuality":"music"}`
+	updatedJSON := `{"resolution":"720p","maxFramerate":30,"maxBitrate":3000000,"degradationPreference":"balanced","maxAudioBitrate":128000}`
 	reconnectedHost.sendJSON(map[string]any{"type": "set-quality-settings", "qualitySettings": updatedSettings})
 	expectEqual(t, viewer.next("quality-settings").raw, `{"type":"quality-settings","qualitySettings":`+updatedJSON+`}`)
 
diff --git a/scripts/app-media-gate.ts b/scripts/app-media-gate.ts
index 27b1ad6d3..67b803892 100644
--- a/scripts/app-media-gate.ts
+++ b/scripts/app-media-gate.ts
@@ -355,7 +355,7 @@ async function browserMediaGate(input: {
           rejectRequest(new Error("Native request timed out: " + type));
         }, 8_000);
         pending.set(id, { resolve: resolveRequest, reject: rejectRequest, timer });
-        socket!.send(JSON.stringify({ version: 9, id, type, ...fields }));
+        socket!.send(JSON.stringify({ version: 10, id, type, ...fields }));
       });
     };
     socket.onmessage = (event) => {
@@ -440,7 +440,7 @@ async function browserMediaGate(input: {
         maxFramerate: 30,
         maxBitrate: 3_000_000,
         degradationPreference: "balanced",
-        screenAudioQuality: "music",
+        maxAudioBitrate: 128000,
       },
     });
     if (started.shareId !== shareId || started.audio !== result.audioAvailable) {
@@ -592,7 +592,7 @@ async function browserMediaGate(input: {
         maxFramerate: 60,
         maxBitrate: 12_000_000,
         degradationPreference: "maintain-framerate",
-        screenAudioQuality: "very-high",
+        maxAudioBitrate: 192000,
       },
     });
     const liveDeadline = performance.now() + 15_000;
@@ -618,7 +618,7 @@ async function browserMediaGate(input: {
         maxFramerate: 15,
         maxBitrate: 2_000_000,
         degradationPreference: "maintain-resolution",
-        screenAudioQuality: "saver",
+        maxAudioBitrate: 64000,
       },
     });
     const framesBeforeResume = Math.min(
diff --git a/scripts/browser-local-pool-page.js b/scripts/browser-local-pool-page.js
index 31d32218a..a2ead5744 100644
--- a/scripts/browser-local-pool-page.js
+++ b/scripts/browser-local-pool-page.js
@@ -18,7 +18,7 @@ const quietStart = settings.get('quietStart') === '1';
 const selectedProfile = () => ({ resolution: high ? '1080p' : '480p', maxFramerate: 30,
     maxBitrate: high ? 5000000 : 1700000,
     degradationPreference: settings.get('preference') || (high ? 'maintain-resolution' : 'balanced'),
-    screenAudioQuality: 'music' });
+    maxAudioBitrate: Number(settings.get('audioBitrate') || 128000) });
 const productPool = mode === 'carrier' ? new ProbePool() : null;
 const productPeers = [], peers = [], tracks = [], edges = [], monitors = [], audioMonitors = [];
 const errors = [], sourcePulses = [], controls = [], visibility = [], productTrace = [], sourceFrames = [];
@@ -193,7 +193,8 @@ async function statistics() {
     const result = {};
     for (const edge of edges) {
         const metrics = edge.peer.getSnapshot().metrics;
-        result[edge.role] = { send: selectReport(await edge.send.getStats()),
+        result[edge.role] = { audioParameters: edge.peer.getSnapshot().audioSenderParameters,
+            send: selectReport(await edge.send.getStats()),
             receive: selectReport(await edge.receive.getStats()),
             details: Object.fromEntries(['frameWidth', 'frameHeight', 'framesPerSecond', 'bitrateKbps',
                 'qualityLimitationReason', 'nativeEdgeQualityState', 'intervalFramesSent', 'intervalFramesEncoded']
diff --git a/scripts/browser-local-pool-probe.ts b/scripts/browser-local-pool-probe.ts
index 77afc1358..132a6b298 100644
--- a/scripts/browser-local-pool-probe.ts
+++ b/scripts/browser-local-pool-probe.ts
@@ -11,7 +11,7 @@ const mode = process.argv[2] || 'carrier', args = process.argv.slice(3);
 const flags = new Set(['--product', '--1080', '--h264', '--single', '--av', '--late', '--background',
     '--native-source', '--lifecycle', '--network', '--auto', '--relay', '--debug', '--short-pulse', '--display', '--quiet-start']);
 if (!['ordinary', 'carrier'].includes(mode)) throw Error('Expected ordinary|carrier');
-for (const arg of args) if (!flags.has(arg) && !arg.startsWith('--rate=') && !arg.startsWith('--preference='))
+for (const arg of args) if (!flags.has(arg) && !arg.startsWith('--rate=') && !arg.startsWith('--preference=') && !arg.startsWith('--audio-bitrate='))
     throw Error('Unsupported option: ' + arg);
 const codec = args.includes('--h264') ? 'H264' : 'VP8', network = args.includes('--network');
 const automatic = args.includes('--auto'), high = args.includes('--1080'), av = args.includes('--av');
@@ -22,6 +22,8 @@ const nativeSource = background || args.includes('--native-source'), lifecycle =
 const relay = args.includes('--relay');
 const shortPulse = args.includes('--short-pulse');
 const rate = Number(args.find(arg => arg.startsWith('--rate='))?.split('=')[1] || 120000);
+const audioBitrate = Number(args.find(arg => arg.startsWith('--audio-bitrate='))?.split('=')[1] || 128000);
+if (!Number.isInteger(audioBitrate) || audioBitrate < 6000 || audioBitrate > 320000) throw Error('Audio bitrate must be 6000..320000 bps');
 const preference = args.find(arg => arg.startsWith('--preference='))?.split('=')[1] || (high ? 'maintain-resolution' : 'balanced');
 if (!['balanced', 'maintain-resolution', 'maintain-framerate'].includes(preference)) throw Error('Unsupported degradation preference');
 if (!Number.isInteger(rate) || rate <= 0) throw Error('Rate must be a positive integer in bps');
@@ -85,7 +87,7 @@ try {
     const version = await waitForVersion(debugPort, chrome);
     cdp = await CdpConnection.connect(version.webSocketDebuggerUrl, Date.now() + 5000);
     page = await createPage(cdp, 'about:blank');
-    const query = new URLSearchParams({ mode, codec, rate: String(rate), preference });
+    const query = new URLSearchParams({ mode, codec, rate: String(rate), preference, audioBitrate: String(audioBitrate) });
     if (process.argv.includes('--debug')) query.set('debug', '1');
     for (const [key, value] of Object.entries({ network, automatic, high, av, single, late, background, nativeSource, displaySource, quietStart, lifecycle, relay, shortPulse }))
         query.set(key, value ? '1' : '0');
diff --git a/scripts/embedded-sfu-gate.ts b/scripts/embedded-sfu-gate.ts
index 38d1bb78c..a6d0fbc78 100644
--- a/scripts/embedded-sfu-gate.ts
+++ b/scripts/embedded-sfu-gate.ts
@@ -99,6 +99,7 @@ async function main(): Promise<void> {
     high: null as { frames: number; width: number; height: number } | null,
     low: null as { frames: number; width: number; height: number } | null,
     audioEnergy: { high: 0, low: 0, recovered: 0 },
+    audioUpdates: [] as Array<{ bitrate: number; frames: number; connectionRetained: boolean; energy: number }>,
     audioDiagnostics: null as unknown,
     secondRoom: twoRooms ? { connected: false, framesAfterFirstStopped: 0, audioBefore: 0, audioAfter: 0, stopped: false } : null,
     host: null as Snapshot | null, viewer: null as Snapshot | null,
@@ -279,6 +280,19 @@ async function main(): Promise<void> {
       (energy) => { result.audioEnergy.high = energy; return energy > 0; }, 5_000);
     if (!nativeArm) result.stereoSeparationDb = await call(viewer, "gate.audioSeparation()", 5_000);
     result.host = await call(host, "gate.snapshot()");
+    result.stage = "numeric-audio-update";
+    const audioConnection = (await call<Snapshot>(viewer, "gate.snapshot()")).connectionId;
+    let previousEnergy = result.audioEnergy.high;
+    for (const bitrate of [320_000, 96_000]) {
+      if (!await call<boolean>(host, `gate.setAudioBitrate(${bitrate})`)) throw new Error("Numeric audio update failed");
+      const frames = await call<{ frames: number }>(viewer, "gate.waitForFrames(1280, 720)");
+      const after = await call<Snapshot>(viewer, "gate.snapshot()");
+      const energy = await call<number>(viewer, "gate.audioEnergy()", 3_000);
+      const retained = after.connectionId === audioConnection && after.committed;
+      result.audioUpdates.push({ bitrate, frames: frames.frames, connectionRetained: retained, energy });
+      if (!retained || energy <= previousEnergy) throw new Error("Audio update interrupted the current media connection");
+      previousEnergy = energy;
+    }
     if (displayArm) {
       result.stage = "display-background";
       if (result.host!.capture?.displaySurface !== "browser" || result.host!.visibility !== "hidden") {
diff --git a/scripts/embedded-sfu-page.ts b/scripts/embedded-sfu-page.ts
index 43f3a2060..dba5c67c7 100644
--- a/scripts/embedded-sfu-page.ts
+++ b/scripts/embedded-sfu-page.ts
@@ -19,7 +19,7 @@ import { ViewerSfuRoute } from "../src/client/media/viewer-sfu-route";
 
 const high: QualitySettings = {
   resolution: "720p", maxFramerate: 15, maxBitrate: 2_000_000,
-  degradationPreference: "maintain-resolution", screenAudioQuality: "saver",
+  degradationPreference: "maintain-resolution", maxAudioBitrate: 64000,
 };
 const low: QualitySettings = { ...high, resolution: "480p" };
 const shareGeneration = crypto.randomUUID();
@@ -316,6 +316,7 @@ export async function reconnectViewer(room: CreateRoomResponse, discardMedia = f
 
 export function snapshot() {
   return { authenticated, published, simulcast, decoded, committed, peerFailures,
+    maxAudioBitrate: profile.maxAudioBitrate,
     visibility: document.visibilityState, capture: source?.getVideoTracks()[0]?.getSettings(),
     routeEvents, routeStatus,
     connectionId: configuration?.connectionId,
@@ -340,6 +341,15 @@ export async function audioEnergy(): Promise<number> {
   return await probe();
 }
 
+export async function setAudioBitrate(maxAudioBitrate: number): Promise<boolean> {
+  const next = { ...profile, maxAudioBitrate };
+  if (native) await native.updateShare(shareGeneration, next);
+  if (!await hostRoute!.updateProfile(next)) return false;
+  profile = next;
+  send({ type: "set-quality-settings", qualitySettings: next });
+  return true;
+}
+
 export async function waitForFrames(width: number, height: number, minimumFrames = 15) {
   if (!video) throw new Error("Viewer video is unavailable");
   const target = video;
diff --git a/src/client/locales/en.ts b/src/client/locales/en.ts
index 47d334671..301449aba 100644
--- a/src/client/locales/en.ts
+++ b/src/client/locales/en.ts
@@ -278,7 +278,7 @@ export const en: Record<CopyKey, string> = {
   "host.terminated.signal": "Server connection terminated; refresh to continue",
   "host.notice.qualityApplied": "Share settings applied",
   "host.notice.qualitySet": "Quality switched to {label}",
-  "host.notice.audioSet": "Audio quality switched to {label}",
+  "host.notice.audioSet": "Audio bitrate limit set to {kbps} kbps",
   "host.notice.partialApply": "Settings updated, but some viewer connections could not apply them",
   "host.notice.sourceSwitch.ok": "Share source switched",
   "host.notice.sourceSwitch.partial": "Source switched, but {warning}",
@@ -358,6 +358,8 @@ export const en: Record<CopyKey, string> = {
   "host.advanced.preference.balancedHint": "Weigh automatically",
   "host.advanced.preference.framerateHint": "Prefer frame rate",
   "host.advanced.audio": "Audio quality",
+  "host.advanced.audioBitrate": "Audio bitrate limit",
+  "host.audio.bitrateHint": "Audio bitrate limit: {min}–{max} kbps.",
   "host.advanced.audio.saver": "Standard",
   "host.advanced.audio.music": "Music",
   "host.advanced.audio.veryHigh": "Studio",
diff --git a/src/client/locales/zh.ts b/src/client/locales/zh.ts
index 2032e86f6..d3cbcc53c 100644
--- a/src/client/locales/zh.ts
+++ b/src/client/locales/zh.ts
@@ -278,7 +278,7 @@ export const zh = {
   "host.terminated.signal": "服务器连接已终止，请刷新后重试",
   "host.notice.qualityApplied": "分享设置已应用",
   "host.notice.qualitySet": "画质已切换为 {label}",
-  "host.notice.audioSet": "音频质量已切换为 {label}",
+  "host.notice.audioSet": "音频码率上限已设为 {kbps} kbps",
   "host.notice.partialApply": "分享设置已更新，但部分观看连接未能应用新参数",
   "host.notice.sourceSwitch.ok": "分享来源已切换",
   "host.notice.sourceSwitch.partial": "分享来源已切换，但{warning}",
@@ -358,6 +358,8 @@ export const zh = {
   "host.advanced.preference.balancedHint": "自动权衡",
   "host.advanced.preference.framerateHint": "优先帧率",
   "host.advanced.audio": "音频质量",
+  "host.advanced.audioBitrate": "音频码率上限",
+  "host.audio.bitrateHint": "音频码率上限：{min}–{max} kbps。",
   "host.advanced.audio.saver": "普通",
   "host.advanced.audio.music": "音乐",
   "host.advanced.audio.veryHigh": "保真",
diff --git a/src/client/media/quality.ts b/src/client/media/quality.ts
index bf98bf565..584a12f4e 100644
--- a/src/client/media/quality.ts
+++ b/src/client/media/quality.ts
@@ -1,10 +1,11 @@
 import {
   DEFAULT_QUALITY_SETTINGS,
+  MIN_AUDIO_BITRATE,
+  MAX_AUDIO_BITRATE,
   type DegradationPreference,
   type QualityProfileId,
   type QualityResolution,
   type QualitySettings,
-  type ScreenAudioQuality,
 } from "../../shared/protocol";
 import { say, type CopyKey } from "../ui/copy";
 import type { MediaFailure } from "../ui/media-failure";
@@ -18,7 +19,6 @@ export type {
   QualityProfileId,
   QualityResolution,
   QualitySettings,
-  ScreenAudioQuality,
 } from "../../shared/protocol";
 
 export type QualityProfile = QualitySettings;
@@ -30,7 +30,7 @@ export const QUALITY_PROFILES = {
     maxFramerate: 30,
     maxBitrate: 3_000_000,
     degradationPreference: "balanced",
-    screenAudioQuality: "music",
+    maxAudioBitrate: 128000,
   },
   "1080p30": DEFAULT_QUALITY_SETTINGS,
   "1080p60": {
@@ -38,7 +38,7 @@ export const QUALITY_PROFILES = {
     maxFramerate: 60,
     maxBitrate: 8_000_000,
     degradationPreference: "balanced",
-    screenAudioQuality: "music",
+    maxAudioBitrate: 128000,
   },
 } as const satisfies Record<QualityProfileId, QualitySettings>;
 
@@ -64,14 +64,15 @@ export const DEGRADATION_PREFERENCE_KEYS = {
   "maintain-framerate": "host.advanced.preference.framerate",
 } as const satisfies Record<DegradationPreference, CopyKey>;
 
-export const DEFAULT_SCREEN_AUDIO_QUALITY: ScreenAudioQuality = "music";
 export const SCREEN_AUDIO_BITRATES = {
   saver: 64_000,
   music: 128_000,
   "very-high": 192_000,
-} as const satisfies Record<ScreenAudioQuality, number>;
-export const SCREEN_AUDIO_RECEIVE_MAX_BITRATE =
-  SCREEN_AUDIO_BITRATES["very-high"];
+} as const;
+export type ScreenAudioPreset = keyof typeof SCREEN_AUDIO_BITRATES;
+// Current 20 ms output leaves room for RTP/SRTP overhead within a 1200-byte packet.
+export const MAX_SCREEN_AUDIO_BITRATE = 320_000;
+export const SCREEN_AUDIO_RECEIVE_MAX_BITRATE = MAX_AUDIO_BITRATE;
 
 export function startupVideoProfile(
   profile: QualityProfile,
@@ -105,16 +106,10 @@ export interface AudioSenderParameterReadback {
   mismatch: boolean;
 }
 
-export function resolveScreenAudioQuality(
-  quality: ScreenAudioQuality | undefined,
-): ScreenAudioQuality {
-  return quality ?? DEFAULT_SCREEN_AUDIO_QUALITY;
-}
-
 export function screenAudioBitrate(
-  quality: ScreenAudioQuality | undefined,
+  bitrate: number | undefined,
 ): number {
-  return SCREEN_AUDIO_BITRATES[resolveScreenAudioQuality(quality)];
+  return bitrate ?? DEFAULT_QUALITY_SETTINGS.maxAudioBitrate;
 }
 
 export function qualitySettingsEqual(
@@ -123,7 +118,7 @@ export function qualitySettingsEqual(
 ): boolean {
   return (
     videoQualitySettingsEqual(left, right) &&
-    screenAudioQualityEqual(left, right)
+    audioQualitySettingsEqual(left, right)
   );
 }
 
@@ -139,13 +134,13 @@ export function videoQualitySettingsEqual(
   );
 }
 
-export function screenAudioQualityEqual(
+export function audioQualitySettingsEqual(
   left: QualitySettings,
   right: QualitySettings,
 ): boolean {
   return (
-    resolveScreenAudioQuality(left.screenAudioQuality) ===
-      resolveScreenAudioQuality(right.screenAudioQuality)
+    screenAudioBitrate(left.maxAudioBitrate) ===
+      screenAudioBitrate(right.maxAudioBitrate)
   );
 }
 
@@ -398,6 +393,36 @@ export async function configureVideoSender(
   return senderParameterReadback(requested, applied);
 }
 
+export function screenAudioSenderCeiling(current: RTCRtpSendParameters, requestedMaxBitrate: number): number {
+  // Some Browsers accept setParameters above the negotiated Opus receive limit.
+  // Keep that limit on this sender, never on the shared capture or sibling edges.
+  let ceiling = Math.min(requestedMaxBitrate, MAX_SCREEN_AUDIO_BITRATE);
+  for (const codec of current.codecs ?? []) {
+    if (codec.mimeType.toLowerCase() !== "audio/opus") continue;
+    let receiveLimit: number | undefined;
+    let playbackRate = 48_000;
+    let channels = 1;
+    for (const parameter of (codec.sdpFmtpLine ?? "").split(";")) {
+      const [name, value] = parameter.trim().split("=");
+      const key = name?.trim().toLowerCase();
+      const number = Number(value);
+      if (key === "stereo") channels = value?.trim() === "1" ? 2 : 1;
+      if (key === "maxplaybackrate" && Number.isInteger(number) && number >= 8_000 && number <= 48_000) {
+        playbackRate = number;
+      }
+      // RFC 7587 ignores out-of-range receive preferences.
+      if (key === "maxaveragebitrate" && Number.isInteger(number) && number >= MIN_AUDIO_BITRATE && number <= MAX_AUDIO_BITRATE) {
+        receiveLimit = Math.min(receiveLimit ?? MAX_AUDIO_BITRATE, number);
+      }
+    }
+    // Match libwebrtc's default when the peer omits a valid explicit ceiling;
+    // omission must not let setParameters override the default with a higher rate.
+    const defaultBitrate = (playbackRate <= 8_000 ? 12_000 : playbackRate <= 16_000 ? 20_000 : 32_000) * channels;
+    ceiling = Math.min(ceiling, receiveLimit ?? defaultBitrate);
+  }
+  return ceiling;
+}
+
 export async function configureScreenAudioSender(
   sender: RTCRtpSender,
   requestedMaxBitrate: number,
@@ -410,7 +435,7 @@ export async function configureScreenAudioSender(
   if (parameters.encodings.length === 0) {
     parameters.encodings = [{}];
   }
-  parameters.encodings[0]!.maxBitrate = requestedMaxBitrate;
+  parameters.encodings[0]!.maxBitrate = screenAudioSenderCeiling(current, requestedMaxBitrate);
   await sender.setParameters(parameters);
   const appliedMaxBitrate =
     sender.getParameters().encodings[0]?.maxBitrate ?? null;
diff --git a/src/client/native/wire.ts b/src/client/native/wire.ts
index 49db1be37..05b3e39f6 100644
--- a/src/client/native/wire.ts
+++ b/src/client/native/wire.ts
@@ -1,10 +1,10 @@
 import { z } from "zod";
-import { sfuMediaSchema } from "../../shared/protocol";
+import { sfuMediaSchema, maxAudioBitrateSchema } from "../../shared/protocol";
 
-export const NATIVE_CLIENT_PROTOCOL = 9;
+export const NATIVE_CLIENT_PROTOCOL = 10;
 export const NATIVE_CLIENT_PORT_START = 39_721;
 export const NATIVE_CLIENT_PORT_END = 39_730;
-export const NATIVE_CLIENT_SUBPROTOCOL = "piik-client-v9";
+export const NATIVE_CLIENT_SUBPROTOCOL = "piik-client-v10";
 
 const decimalIdentifierSchema = z.string().regex(/^[1-9]\d{0,19}$/);
 const opaqueIdentifierSchema = z
@@ -33,6 +33,7 @@ export const nativeHealthSchema = nativeDiscoveryIdentitySchema.extend({
     .regex(/^[A-Za-z0-9_-]+$/),
   nativeMedia: z
     .object({
+      maxAudioBitrate: maxAudioBitrateSchema.optional(),
       receiverReuse: z.boolean().default(false),
       video: z.boolean().default(false),
       processAudio: z.boolean().default(false),
diff --git a/src/client/pages/HostPage.tsx b/src/client/pages/HostPage.tsx
index 2ba9e932e..5ed8d233e 100644
--- a/src/client/pages/HostPage.tsx
+++ b/src/client/pages/HostPage.tsx
@@ -10,6 +10,7 @@ import {
 import {
   DEFAULT_ROUTE_POLICY,
   MAX_VIEWER_PASSWORD_LENGTH,
+  MIN_AUDIO_BITRATE,
   viewerPasswordSchema,
   type CreateRoomResponse,
   type ClientMessage,
@@ -130,14 +131,15 @@ import {
   QUALITY_RESOLUTIONS,
   qualitySettingsEqual,
   qualitySettingsLabel,
-  resolveScreenAudioQuality,
+  screenAudioBitrate,
+  MAX_SCREEN_AUDIO_BITRATE,
   SCREEN_AUDIO_BITRATES,
   setMediaPaused,
   videoQualitySettingsEqual,
   type DegradationPreference,
   type QualityResolution,
   type QualitySettings,
-  type ScreenAudioQuality,
+  type ScreenAudioPreset,
 } from "../media/quality";
 import { HostSfuRoute } from "../media/host-sfu-route";
 import { BrowserEncodingPool } from "../media/browser-encoding-pool";
@@ -233,7 +235,7 @@ const PREFERENCE_PRESENTATION: Record<
   },
 };
 
-const AUDIO_QUALITY_CAPTIONS: Record<ScreenAudioQuality, CopyKey> = {
+const AUDIO_QUALITY_CAPTIONS: Record<ScreenAudioPreset, CopyKey> = {
   saver: "host.advanced.audio.saver",
   music: "host.advanced.audio.music",
   "very-high": "host.advanced.audio.veryHigh",
@@ -1644,13 +1646,13 @@ export function HostPage({
     }
   }
 
-  function changeScreenAudioQuality(
-    screenAudioQuality: ScreenAudioQuality,
+  function changeMaxAudioBitrate(
+    maxAudioBitrate: number,
   ): void {
     if (phase === "starting") {
       return;
     }
-    const next = { ...advancedQualityRef.current, screenAudioQuality };
+    const next = { ...advancedQualityRef.current, maxAudioBitrate };
     void changeQuality(next);
   }
 
@@ -1730,8 +1732,8 @@ export function HostPage({
       previousProfile.resolution !== nextProfile.resolution ||
       previousProfile.maxFramerate !== nextProfile.maxFramerate;
     const audioChanged =
-      resolveScreenAudioQuality(previousProfile.screenAudioQuality) !==
-      resolveScreenAudioQuality(nextProfile.screenAudioQuality);
+      screenAudioBitrate(previousProfile.maxAudioBitrate) !==
+      screenAudioBitrate(nextProfile.maxAudioBitrate);
     try {
       const nativeClient = nativeClientRef.current;
       const nativeShareGeneration = nativeShareGenerationRef.current;
@@ -1822,7 +1824,7 @@ export function HostPage({
             : null;
         const successNotice =
           audioChanged && !videoChanged
-            ? say("host.notice.audioSet", { label: say(AUDIO_QUALITY_CAPTIONS[resolveScreenAudioQuality(nextProfile.screenAudioQuality)]) })
+            ? say("host.notice.audioSet", { kbps: String(screenAudioBitrate(nextProfile.maxAudioBitrate) / 1_000) })
             : videoChanged && audioChanged
               ? say("host.notice.qualityApplied")
               : say("host.notice.qualitySet", {
@@ -3592,6 +3594,9 @@ export function HostPage({
   const titleContent = titleFrames(hostStatus.titleFrameKey);
   useDocumentTitle([room?.roomId, titleContent.label, hostStatus.titleMarker], titleContent.variations,
     `${lang}:${vis}:${hostStatus.titleFrameKey}:${room?.roomId ?? ""}`);
+  const audioBitrateCeiling = Math.min(MAX_SCREEN_AUDIO_BITRATE, nativeActive
+    ? nativeClientRef.current?.health.nativeMedia.maxAudioBitrate ?? MAX_SCREEN_AUDIO_BITRATE
+    : MAX_SCREEN_AUDIO_BITRATE);
 
   return (
     <div className="lr-app">
@@ -3828,7 +3833,7 @@ export function HostPage({
               <QualityPresets selected={selectedQualityProfileId} busy={changingQuality}
                 disabled={phase === "starting" || switchingSource}
                 onSelect={id => void changeQuality({ ...QUALITY_PROFILES[id],
-                  screenAudioQuality: resolveScreenAudioQuality(advancedQualityRef.current.screenAudioQuality),
+                  maxAudioBitrate: screenAudioBitrate(advancedQualityRef.current.maxAudioBitrate),
                 })} />
             }
             picture={<>
@@ -4016,16 +4021,17 @@ export function HostPage({
                   {(
                     Object.keys(
                       AUDIO_QUALITY_CAPTIONS,
-                    ) as ScreenAudioQuality[]
+                    ) as ScreenAudioPreset[]
                   ).map((audioQuality) => (
                     <Chip
                       key={audioQuality}
                       selected={
-                        resolveScreenAudioQuality(
-                          advancedQuality.screenAudioQuality,
-                        ) === audioQuality
+                        screenAudioBitrate(
+                          advancedQuality.maxAudioBitrate,
+                        ) === SCREEN_AUDIO_BITRATES[audioQuality]
                       }
-                      disabled={phase === "starting" || switchingSource}
+                      disabled={phase === "starting" || switchingSource ||
+                        SCREEN_AUDIO_BITRATES[audioQuality] > audioBitrateCeiling}
                       title={t("host.audio.title", {
                         label: t(AUDIO_QUALITY_CAPTIONS[audioQuality]),
                         kbps: String(
@@ -4033,7 +4039,7 @@ export function HostPage({
                         ),
                       })}
                       hint="hint-audio-quality"
-                      onClick={() => changeScreenAudioQuality(audioQuality)}
+                      onClick={() => changeMaxAudioBitrate(SCREEN_AUDIO_BITRATES[audioQuality])}
                     >
                       <Cap k={AUDIO_QUALITY_CAPTIONS[audioQuality]} />
                       <small className="lr-audio-rate">
@@ -4042,6 +4048,36 @@ export function HostPage({
                     </Chip>
                   ))}
                 </div>
+                <Tooltip kind="hint-audio-quality" text={vis ? undefined : t("host.audio.bitrateHint", {
+                  min: String(MIN_AUDIO_BITRATE / 1_000), max: String(audioBitrateCeiling / 1_000),
+                })}>
+                  <label className="lr-input lr-audio-bitrate">
+                    <input type="number" inputMode="numeric"
+                      key={screenAudioBitrate(advancedQuality.maxAudioBitrate)}
+                      defaultValue={screenAudioBitrate(advancedQuality.maxAudioBitrate) / 1_000}
+                      min={MIN_AUDIO_BITRATE / 1_000}
+                      max={audioBitrateCeiling / 1_000} step={1}
+                      disabled={phase === "starting" || switchingSource}
+                      aria-label={t("host.advanced.audioBitrate")}
+                      onBlur={event => {
+                        const input = event.currentTarget;
+                        if (!input.validity.valid || !Number.isFinite(input.valueAsNumber)) {
+                          input.value = String(screenAudioBitrate(advancedQuality.maxAudioBitrate) / 1_000);
+                          return;
+                        }
+                        changeMaxAudioBitrate(input.valueAsNumber * 1_000);
+                      }}
+                      onKeyDown={event => {
+                        if (event.key === "Enter") event.currentTarget.blur();
+                        if (event.key === "Escape") {
+                          event.currentTarget.value = String(screenAudioBitrate(advancedQuality.maxAudioBitrate) / 1_000);
+                          event.currentTarget.blur();
+                          event.stopPropagation();
+                        }
+                      }} />
+                    <span>kbps</span>
+                  </label>
+                </Tooltip>
               </div>
             </>}
             technical={<>
diff --git a/src/client/sfu/publisher.ts b/src/client/sfu/publisher.ts
index 8f79aa124..46514e5f5 100644
--- a/src/client/sfu/publisher.ts
+++ b/src/client/sfu/publisher.ts
@@ -10,6 +10,7 @@ import {
   needsStartupVideoProfile,
   QUALITY_RESOLUTIONS,
   screenAudioBitrate,
+  screenAudioSenderCeiling,
   senderParameterWarning,
   STARTUP_VIDEO_ENCODED_FRAMES,
   startupVideoProfile,
@@ -108,6 +109,16 @@ export class SfuPublisher {
           if (description.type !== "answer")
             throw new Error("SFU publisher expected an answer");
           await peer.waitForOperation(() => peer.pc.setRemoteDescription(description));
+          const audio = this.audioSender;
+          if (this.profile && audio?.track && screenAudioSenderCeiling(audio.getParameters(),
+            screenAudioBitrate(this.profile.maxAudioBitrate)) !== audio.getParameters().encodings[0]?.maxBitrate) {
+            void this.enqueue(async () => {
+              if (this.peer !== peer || !this.profile) return false;
+              const applied = await this.configure(this.profile, false);
+              if (!applied && this.peer === peer) this.fail("transport");
+              return applied;
+            }).catch(() => this.fail("transport"));
+          }
         },
         async (activeCount) => {
           await this.enqueue(async () => {
@@ -181,7 +192,7 @@ export class SfuPublisher {
           direction: "sendonly",
           streams: [stream],
           sendEncodings: [
-            { maxBitrate: screenAudioBitrate(profile.screenAudioQuality) },
+            { maxBitrate: screenAudioBitrate(profile.maxAudioBitrate) },
           ],
         });
         const opus = RTCRtpSender.getCapabilities("audio")?.codecs.filter(
@@ -475,7 +486,7 @@ export class SfuPublisher {
         bitrate: encoding.maxBitrate!,
       })),
       audio: this.audio !== null,
-      audioBitrate: screenAudioBitrate(profile.screenAudioQuality),
+      audioBitrate: screenAudioBitrate(profile.maxAudioBitrate),
     };
   }
 
@@ -510,7 +521,7 @@ export class SfuPublisher {
     try {
       const audio = await peer.waitForOperation(() => configureScreenAudioSender(
         audioSender,
-        screenAudioBitrate(profile.screenAudioQuality),
+        screenAudioBitrate(profile.maxAudioBitrate),
       ));
       if (this.peer !== peer) return false;
       this.audioWarning = audioSenderParameterWarning(audio);
diff --git a/src/client/styles.css b/src/client/styles.css
index d167f5691..e93f3ae56 100644
--- a/src/client/styles.css
+++ b/src/client/styles.css
@@ -1176,6 +1176,8 @@ html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #334
 .lr-input:focus-within { border-color: var(--action); outline: 3px solid var(--action); outline-offset: 2px; }
 .lr-input input { min-width: 0; flex: 1; height: 100%; border: 0; outline: 0; background: transparent; font: inherit; font-size: 16px; }
 .lr-input input[type="password"]:not(:placeholder-shown) { letter-spacing: .25em; }
+.lr-input.lr-audio-bitrate { width: 160px; max-width: 100%; font-family: var(--mono); }
+.lr-audio-bitrate span { color: var(--muted); font-size: 12px; }
 .lr-welcome { width: 100%; min-width: 0; max-width: 100%; margin: 0; overflow: hidden; color: inherit; font-size: 15px; font-weight: 600; line-height: 1.7; text-align: center; white-space: nowrap; text-overflow: ellipsis; }
 .lr-welcome:not(.is-cipher)::before { content: "✦"; color: #d7982b; margin-right: 8px; }
 .lr-welcome-cipher { display: inline-flex; align-items: center; gap: 8px; vertical-align: middle; opacity: .72; white-space: nowrap; }
diff --git a/src/client/webrtc/host-peer.ts b/src/client/webrtc/host-peer.ts
index ad8fbecbb..b4322ea36 100644
--- a/src/client/webrtc/host-peer.ts
+++ b/src/client/webrtc/host-peer.ts
@@ -11,15 +11,14 @@ import {
   configureScreenAudioSender,
   configureVideoSender,
   needsStartupVideoProfile,
-  resolveScreenAudioQuality,
   screenAudioBitrate,
-  screenAudioQualityEqual,
+  screenAudioSenderCeiling,
+  audioQualitySettingsEqual,
   STARTUP_VIDEO_ENCODED_FRAMES,
   startupVideoProfile,
   videoQualitySettingsEqual,
   type AudioSenderParameterReadback,
   type QualityProfile,
-  type ScreenAudioQuality,
 } from "../media/quality";
 import { cloneSenderVideoTrack, stopSenderVideoTrack } from "../media/sender-video-track";
 import { EMPTY_METRICS, type PeerSnapshot } from "../types";
@@ -93,7 +92,7 @@ export class HostPeer {
   private statsInFlight = false;
   private statsSamplingBlocked = false;
   private appliedVideoProfile: QualityProfile | null = null;
-  private appliedAudioQuality: ScreenAudioQuality | null = null;
+  private appliedAudioBitrate: number | null = null;
   private appliedAudioSenderParameters:
     | AudioSenderParameterReadback
     | null = null;
@@ -369,7 +368,7 @@ export class HostPeer {
       : profile;
     const changed =
       !videoQualitySettingsEqual(this.desiredProfile, profile) ||
-      !screenAudioQualityEqual(this.desiredProfile, profile);
+      !audioQualitySettingsEqual(this.desiredProfile, profile);
     this.desiredProfile = profile;
     // Connection recovery replays the same intent, not a new user mutation.
     const requestedRevision = changed ? ++this.profileRevision : this.profileRevision;
@@ -409,8 +408,8 @@ export class HostPeer {
             effectiveVideoProfile,
           ));
       const updateAudio =
-        this.appliedAudioQuality !==
-          resolveScreenAudioQuality(profile.screenAudioQuality);
+        this.appliedAudioBitrate !==
+          screenAudioBitrate(profile.maxAudioBitrate);
       if (!updateVideo && !updateAudio) {
         return true;
       }
@@ -553,7 +552,7 @@ export class HostPeer {
         this.awaitingReconnect = false;
         if (replayProfile) {
           this.appliedVideoProfile = null;
-          this.appliedAudioQuality = null;
+          this.appliedAudioBitrate = null;
           this.appliedAudioSenderParameters = null;
         }
         if (replayProfile || !this.startupVideoProfilePending) {
@@ -746,6 +745,20 @@ export class HostPeer {
       if (!this.ownsAnswer(epoch)) {
         return;
       }
+      const audio = this.audioSender;
+      if (audio?.track && screenAudioSenderCeiling(audio.getParameters(),
+        screenAudioBitrate(this.desiredProfile.maxAudioBitrate)) !== audio.getParameters().encodings[0]?.maxBitrate) {
+        // Never await sender work inside negotiation: source replacement can
+        // already be waiting for this negotiation queue to finish.
+        void this.enqueueSenderMutation(async () => {
+          if (this.disposed || !this.videoSender || this.audioSender !== audio) return;
+          const revision = this.profileRevision;
+          const applied = await this.configureSender(this.videoSender, audio, {
+            profile: this.desiredProfile, profileRevision: revision, video: false, audio: true,
+          });
+          if (!applied && !this.disposed && revision === this.profileRevision) this.fail();
+        }).catch(error => this.fail(error));
+      }
       await this.flushCandidates();
       if (this.ownsAnswer(epoch)) {
         this.clearAnswerTimer();
@@ -925,7 +938,7 @@ export class HostPeer {
         try {
           audioSenderParameters = await this.waitForOperation(() => configureScreenAudioSender(
             audioSender,
-            screenAudioBitrate(profile.screenAudioQuality),
+            screenAudioBitrate(profile.maxAudioBitrate),
           ));
         } catch (error) {
           if (this.disposed) return false;
@@ -951,8 +964,8 @@ export class HostPeer {
       this.appliedVideoProfile = profile;
     }
     if (mutation.audio && audioSucceeded) {
-      this.appliedAudioQuality = resolveScreenAudioQuality(
-        profile.screenAudioQuality,
+      this.appliedAudioBitrate = screenAudioBitrate(
+        profile.maxAudioBitrate,
       );
       this.appliedAudioSenderParameters = audioSenderParameters;
     }
diff --git a/src/shared/protocol.ts b/src/shared/protocol.ts
index 9a6b2cc7e..87ec7301a 100644
--- a/src/shared/protocol.ts
+++ b/src/shared/protocol.ts
@@ -8,7 +8,7 @@ import { NAT_TRAVERSAL_PATHS } from "./nat-candidate.js";
 export const MAX_VIEWERS_PER_ROOM_LIMIT = 20;
 export const MAX_PARTICIPANTS_PER_ROOM_LIMIT = MAX_VIEWERS_PER_ROOM_LIMIT + 1;
 export const MAX_SIGNAL_BYTES = 64 * 1024;
-export const SIGNALING_PROTOCOL = "piik-v23";
+export const SIGNALING_PROTOCOL = "piik-v24";
 export const SIGNAL_CLOSE_CODES = {
   serviceRestart: 1012,
   sessionReplaced: 4001,
@@ -197,12 +197,9 @@ export type DegradationPreference = z.infer<
   typeof degradationPreferenceSchema
 >;
 
-export const screenAudioQualitySchema = z.enum([
-  "saver",
-  "music",
-  "very-high",
-]);
-export type ScreenAudioQuality = z.infer<typeof screenAudioQualitySchema>;
+export const MIN_AUDIO_BITRATE = 6_000;
+export const MAX_AUDIO_BITRATE = 510_000;
+export const maxAudioBitrateSchema = z.number().int().min(MIN_AUDIO_BITRATE).max(MAX_AUDIO_BITRATE);
 
 export const qualitySettingsSchema = z
   .object({
@@ -210,7 +207,7 @@ export const qualitySettingsSchema = z
     maxFramerate: z.number().int().min(15).max(60),
     maxBitrate: z.number().int().min(2_000_000).max(12_000_000),
     degradationPreference: degradationPreferenceSchema,
-    screenAudioQuality: screenAudioQualitySchema.optional(),
+    maxAudioBitrate: maxAudioBitrateSchema.optional(),
   })
   .strict();
 export type QualitySettings = z.infer<typeof qualitySettingsSchema>;
@@ -219,7 +216,7 @@ export const DEFAULT_QUALITY_SETTINGS = {
   maxFramerate: 30,
   maxBitrate: 5_000_000,
   degradationPreference: "balanced",
-  screenAudioQuality: "music",
+  maxAudioBitrate: 128000,
 } as const satisfies QualitySettings;
 
 export const routePolicySchema = z
diff --git a/tests/browser-debug.test.ts b/tests/browser-debug.test.ts
index 50ab47648..2001fe65e 100644
--- a/tests/browser-debug.test.ts
+++ b/tests/browser-debug.test.ts
@@ -72,7 +72,7 @@ describe("opt-in Browser diagnostics", () => {
       data: "secret-pixels", payload: "secret-audio",
       roomInteraction: { payload: { kind: "chat", text: "private-chat-contents" } },
       viewerGrant: "secret-grant", passwordHash: "secret-hash",
-      transportError: "piik-client-v9.secret-capability Basic secret-basic\nCookie: session=secret-session; refresh=secret-refresh",
+      transportError: "piik-client-v10.secret-capability Basic secret-basic\nCookie: session=secret-session; refresh=secret-refresh",
     });
     const report = await page.__PIIK_DEBUG__!.export();
     for (const secret of ["secret-password", "secret-auth", "secret-query", "secret-fragment", "secret-bearer",
@@ -192,13 +192,13 @@ describe("opt-in Browser diagnostics", () => {
     const token = "x".repeat(43);
     class Socket extends EventTarget {
       static OPEN = 1; static CLOSING = 2;
-      readyState = 1; protocol = `piik-client-v9.${token}`;
+      readyState = 1; protocol = `piik-client-v10.${token}`;
       constructor() { super(); queueMicrotask(() => this.dispatchEvent(new Event("open"))); }
       close() { this.readyState = 3; }
       send(raw: string) {
         const request = JSON.parse(raw);
         queueMicrotask(() => this.dispatchEvent(Object.assign(new Event("message"), {
-          data: JSON.stringify({ version: 9, id: request.id,
+          data: JSON.stringify({ version: 10, id: request.id,
             type: request.type === "hello" ? "ready" : "share-updated",
             ...(request.shareId ? { shareId: request.shareId } : {}) }),
         })));
@@ -206,7 +206,7 @@ describe("opt-in Browser diagnostics", () => {
     }
     vi.stubGlobal("WebSocket", Socket);
     vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify({
-      protocol: 9, service: "piik-client", port: 39721, instanceToken: token,
+      protocol: 10, service: "piik-client", port: 39721, instanceToken: token,
       nativeMedia: { video: true, processAudio: false, systemAudio: true, hardwareH264: true, softwareVP8: true },
     }), { status: 200 })));
     const debug = await import("../src/client/lib/debug");
@@ -236,7 +236,7 @@ describe("opt-in Browser diagnostics", () => {
     const { NativeClient } = await import("../src/client/native/client");
     await expect(NativeClient.connect()).rejects.toMatchObject({ name: "NativeCompatibilityError" });
     expect(page.__PIIK_DEBUG__!.events()).toContainEqual(expect.objectContaining({
-      scope: "native", event: "incompatible", details: { actualProtocol: 8, expectedProtocol: 9 },
+      scope: "native", event: "incompatible", details: { actualProtocol: 8, expectedProtocol: 10 },
     }));
     expect(await debug.exportBrowserDebug()).not.toContain(token);
   });
diff --git a/tests/client-state.test.ts b/tests/client-state.test.ts
index 3cb65de19..368ed2787 100644
--- a/tests/client-state.test.ts
+++ b/tests/client-state.test.ts
@@ -1728,7 +1728,7 @@ describe("client signaling recovery policy", () => {
       maxFramerate: 30,
       maxBitrate: 5_000_000,
       degradationPreference: "balanced",
-      screenAudioQuality: "music",
+      maxAudioBitrate: 128000,
     } as const;
     const firstPending = {
       ...initialQuality,
@@ -2045,7 +2045,7 @@ describe("client signaling recovery policy", () => {
         maxFramerate: 30,
         maxBitrate: 5_000_000,
         degradationPreference: "balanced",
-        screenAudioQuality: "music",
+        maxAudioBitrate: 128000,
       },
       routePolicy: DEFAULT_ROUTE_POLICY,
     });
diff --git a/tests/fixtures/wire-samples.json b/tests/fixtures/wire-samples.json
index 2d929e46d..e08c3df43 100644
--- a/tests/fixtures/wire-samples.json
+++ b/tests/fixtures/wire-samples.json
@@ -1,6 +1,6 @@
 {
   "constants": {
-    "signalingProtocol": "piik-v23",
+    "signalingProtocol": "piik-v24",
     "maxViewersPerRoomLimit": 20,
     "maxParticipantsPerRoomLimit": 21,
     "maxSignalBytes": 65536,
@@ -29,7 +29,7 @@
       "maxFramerate": 30,
       "maxBitrate": 5000000,
       "degradationPreference": "balanced",
-      "screenAudioQuality": "music"
+      "maxAudioBitrate": 128000
     },
     "defaultRoutePolicy": {
       "peerOnly": false,
@@ -49,79 +49,79 @@
     {
       "name": "authenticate-host-minimal",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"host\",\"token\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"clientId\":\"client_12345678\"}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"host\",\"token\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"clientId\":\"client_12345678\"}",
       "valid": true
     },
     {
       "name": "authenticate-host-full",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"host\",\"token\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"clientId\":\"client_12345678\",\"shareGeneration\":\"share_generation_12345678\",\"sharingPaused\":false,\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"screenAudioQuality\":\"music\"},\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false},\"viewerPresence\":true,\"displayName\":\"小明\"}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"host\",\"token\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"clientId\":\"client_12345678\",\"shareGeneration\":\"share_generation_12345678\",\"sharingPaused\":false,\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000},\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false},\"viewerPresence\":true,\"displayName\":\"小明\"}",
       "valid": true
     },
     {
       "name": "authenticate-host-carries-viewer-grant",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"host\",\"token\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"clientId\":\"client_12345678\",\"viewerGrant\":\"bbbbbbbbbbbbbbbbbbbbbg\"}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"host\",\"token\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"clientId\":\"client_12345678\",\"viewerGrant\":\"bbbbbbbbbbbbbbbbbbbbbg\"}",
       "valid": false
     },
     {
       "name": "authenticate-host-carries-viewer-password",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"host\",\"token\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"clientId\":\"client_12345678\",\"viewerPassword\":\"easy-password\"}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"host\",\"token\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"clientId\":\"client_12345678\",\"viewerPassword\":\"easy-password\"}",
       "valid": false
     },
     {
       "name": "authenticate-host-short-token",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"host\",\"token\":\"short\",\"clientId\":\"client_12345678\"}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"host\",\"token\":\"short\",\"clientId\":\"client_12345678\"}",
       "valid": false
     },
     {
       "name": "authenticate-host-unknown-key",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"host\",\"token\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"clientId\":\"client_12345678\",\"admin\":true}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"host\",\"token\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"clientId\":\"client_12345678\",\"admin\":true}",
       "valid": false
     },
     {
       "name": "authenticate-viewer-minimal",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\"}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\"}",
       "valid": true
     },
     {
       "name": "authenticate-viewer-full",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"viewerGrant\":\"bbbbbbbbbbbbbbbbbbbbbg\",\"viewerPassword\":\"easy-password\",\"displayName\":\"Café 朋友\",\"viewerPresence\":true}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"viewerGrant\":\"bbbbbbbbbbbbbbbbbbbbbg\",\"viewerPassword\":\"easy-password\",\"displayName\":\"Café 朋友\",\"viewerPresence\":true}",
       "valid": true
     },
     {
       "name": "authenticate-viewer-carries-host-token",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"token\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"token\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"}",
       "valid": false
     },
     {
       "name": "authenticate-viewer-carries-route-policy",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false}}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false}}",
       "valid": false
     },
     {
       "name": "authenticate-viewer-malformed-grant",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"viewerGrant\":\"bbbbbbbbbbbbbbbbbbbbb\"}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"viewerGrant\":\"bbbbbbbbbbbbbbbbbbbbb\"}",
       "valid": false
     },
     {
       "name": "authenticate-viewer-grant-bad-final-character",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"viewerGrant\":\"bbbbbbbbbbbbbbbbbbbbbb\"}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"viewerGrant\":\"bbbbbbbbbbbbbbbbbbbbbb\"}",
       "valid": false
     },
     {
       "name": "authenticate-viewer-unknown-capabilities",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"capabilities\":{\"peerIceTurn\":true}}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"capabilities\":{\"peerIceTurn\":true}}",
       "valid": false
     },
     {
@@ -139,55 +139,55 @@
     {
       "name": "authenticate-viewer-leading-zero-room",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"0123\",\"role\":\"viewer\",\"clientId\":\"client_12345678\"}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"0123\",\"role\":\"viewer\",\"clientId\":\"client_12345678\"}",
       "valid": false
     },
     {
       "name": "authenticate-viewer-long-room",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"11111\",\"role\":\"viewer\",\"clientId\":\"client_12345678\"}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"11111\",\"role\":\"viewer\",\"clientId\":\"client_12345678\"}",
       "valid": false
     },
     {
       "name": "authenticate-viewer-noncanonical-display-name",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"displayName\":\" Café \"}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"displayName\":\" Café \"}",
       "valid": false
     },
     {
       "name": "authenticate-viewer-display-name-too-long",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"displayName\":\"名名名名名名名名名名名名名名名名名名名名名名名名名\"}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"displayName\":\"名名名名名名名名名名名名名名名名名名名名名名名名名\"}",
       "valid": false
     },
     {
       "name": "authenticate-viewer-display-name-at-limit",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"displayName\":\"名名名名名名名名名名名名名名名名名名名名名名名名\"}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"displayName\":\"名名名名名名名名名名名名名名名名名名名名名名名名\"}",
       "valid": true
     },
     {
       "name": "authenticate-viewer-display-name-bidi-override",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"displayName\":\"a‮b\"}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"displayName\":\"a‮b\"}",
       "valid": false
     },
     {
       "name": "authenticate-viewer-display-name-newline",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"displayName\":\"a\\nb\"}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"displayName\":\"a\\nb\"}",
       "valid": false
     },
     {
       "name": "authenticate-viewer-null-display-name",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"displayName\":null}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"displayName\":null}",
       "valid": false
     },
     {
       "name": "authenticate-unknown-role",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"relay\",\"clientId\":\"client_12345678\"}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"relay\",\"clientId\":\"client_12345678\"}",
       "valid": false
     },
     {
@@ -283,7 +283,7 @@
     {
       "name": "set-quality-settings-with-audio",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"screenAudioQuality\":\"music\"}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000}}",
       "valid": true
     },
     {
@@ -817,19 +817,19 @@
     {
       "name": "set-quality-settings-folded-audio-invalid",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"screenaudioquality\":\"invalid\"}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxaudiobitrate\":\"invalid\"}}",
       "valid": false
     },
     {
       "name": "set-quality-settings-folded-audio-null",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"screenaudioquality\":null}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxaudiobitrate\":null}}",
       "valid": false
     },
     {
       "name": "set-quality-settings-folded-key-collision",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"screenAudioQuality\":\"music\",\"screenaudioquality\":\"invalid\"}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000,\"maxaudiobitrate\":\"invalid\"}}",
       "valid": false
     },
     {
@@ -847,25 +847,25 @@
     {
       "name": "authenticate-host-folded-generation",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"host\",\"token\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"clientId\":\"client_12345678\",\"sharegeneration\":\"bad\"}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"host\",\"token\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"clientId\":\"client_12345678\",\"sharegeneration\":\"bad\"}",
       "valid": false
     },
     {
       "name": "authenticate-host-folded-default-policy",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"host\",\"token\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"clientId\":\"client_12345678\",\"routepolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false}}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"host\",\"token\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"clientId\":\"client_12345678\",\"routepolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false}}",
       "valid": false
     },
     {
       "name": "authenticate-viewer-folded-presence-false",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"viewerpresence\":false}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"viewerpresence\":false}",
       "valid": false
     },
     {
       "name": "authenticate-viewer-folded-password-null",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"viewerpassword\":null}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\",\"viewerpassword\":null}",
       "valid": false
     },
     {
@@ -1053,6 +1053,72 @@
       "schema": "client",
       "json": "{\"type\":\"send-room-interaction\",\"requestId\":\"request_12345678\",\"payload\":{\"kind\":\"reaction\",\"reaction\":\"wave\"}}",
       "valid": true
+    },
+    {
+      "name": "numeric-audio-6000",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":6000}}",
+      "valid": true
+    },
+    {
+      "name": "numeric-audio-96000",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":96000}}",
+      "valid": true
+    },
+    {
+      "name": "numeric-audio-256000",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":256000}}",
+      "valid": true
+    },
+    {
+      "name": "numeric-audio-320000",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":320000}}",
+      "valid": true
+    },
+    {
+      "name": "numeric-audio-510000",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":510000}}",
+      "valid": true
+    },
+    {
+      "name": "numeric-audio-5999",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":5999}}",
+      "valid": false
+    },
+    {
+      "name": "numeric-audio-510001",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":510001}}",
+      "valid": false
+    },
+    {
+      "name": "numeric-audio-128000.5",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":128000.5}}",
+      "valid": false
+    },
+    {
+      "name": "numeric-audio-null",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":null}}",
+      "valid": false
+    },
+    {
+      "name": "numeric-audio-music",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":\"music\"}}",
+      "valid": false
+    },
+    {
+      "name": "published-1.x-authentication",
+      "schema": "client",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\"}",
+      "valid": false
     }
   ],
   "serverMessages": [
@@ -1062,19 +1128,19 @@
     },
     {
       "name": "authenticated-host-minimal",
-      "json": "{\"type\":\"authenticated\",\"protocol\":\"piik-v23\",\"peerId\":\"host_12345678\",\"maxViewers\":8,\"endpointMediaCopyCapacity\":2,\"hostOnline\":true,\"connectionId\":null,\"iceConfig\":{\"iceServers\":[],\"natPredictionStunUrls\":[]},\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false},\"codeEntryPolicy\":\"open\",\"viewerAuthorizationGeneration\":\"viewer_generation_12345678\",\"mediaMode\":\"peer-assisted\",\"shareGeneration\":\"share_generation_12345678\",\"routeRevision\":0,\"routeAssignment\":{\"upstream\":{\"kind\":\"none\"},\"childPeerIds\":[],\"sfuPublicationGeneration\":null},\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"screenAudioQuality\":\"music\"},\"role\":\"host\",\"viewerPasswordEnabled\":false}"
+      "json": "{\"type\":\"authenticated\",\"protocol\":\"piik-v24\",\"peerId\":\"host_12345678\",\"maxViewers\":8,\"endpointMediaCopyCapacity\":2,\"hostOnline\":true,\"connectionId\":null,\"iceConfig\":{\"iceServers\":[],\"natPredictionStunUrls\":[]},\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false},\"codeEntryPolicy\":\"open\",\"viewerAuthorizationGeneration\":\"viewer_generation_12345678\",\"mediaMode\":\"peer-assisted\",\"shareGeneration\":\"share_generation_12345678\",\"routeRevision\":0,\"routeAssignment\":{\"upstream\":{\"kind\":\"none\"},\"childPeerIds\":[],\"sfuPublicationGeneration\":null},\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000},\"role\":\"host\",\"viewerPasswordEnabled\":false}"
     },
     {
       "name": "authenticated-host-full",
-      "json": "{\"type\":\"authenticated\",\"protocol\":\"piik-v23\",\"peerId\":\"host_12345678\",\"maxViewers\":8,\"endpointMediaCopyCapacity\":2,\"hostOnline\":true,\"connectionId\":\"connection_12345678\",\"iceConfig\":{\"iceServers\":[{\"urls\":\"stun:stun.example.test:3478\"},{\"urls\":[\"stun:stun-1.example.test:3478\",\"stun:[2001:db8::1]:3478\"]}],\"natPredictionStunUrls\":[\"stun:nat.example.test:3478\"]},\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false},\"codeEntryPolicy\":\"open\",\"viewerAuthorizationGeneration\":\"viewer_generation_12345678\",\"mediaMode\":\"peer-assisted\",\"shareGeneration\":\"share_generation_12345678\",\"routeRevision\":0,\"routeAssignment\":{\"upstream\":{\"kind\":\"sfu\"},\"childPeerIds\":[],\"sfuPublicationGeneration\":\"generation_12345678\"},\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"screenAudioQuality\":\"music\"},\"role\":\"host\",\"viewerPasswordEnabled\":false}"
+      "json": "{\"type\":\"authenticated\",\"protocol\":\"piik-v24\",\"peerId\":\"host_12345678\",\"maxViewers\":8,\"endpointMediaCopyCapacity\":2,\"hostOnline\":true,\"connectionId\":\"connection_12345678\",\"iceConfig\":{\"iceServers\":[{\"urls\":\"stun:stun.example.test:3478\"},{\"urls\":[\"stun:stun-1.example.test:3478\",\"stun:[2001:db8::1]:3478\"]}],\"natPredictionStunUrls\":[\"stun:nat.example.test:3478\"]},\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false},\"codeEntryPolicy\":\"open\",\"viewerAuthorizationGeneration\":\"viewer_generation_12345678\",\"mediaMode\":\"peer-assisted\",\"shareGeneration\":\"share_generation_12345678\",\"routeRevision\":0,\"routeAssignment\":{\"upstream\":{\"kind\":\"sfu\"},\"childPeerIds\":[],\"sfuPublicationGeneration\":\"generation_12345678\"},\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000},\"role\":\"host\",\"viewerPasswordEnabled\":false}"
     },
     {
       "name": "authenticated-viewer-minimal",
-      "json": "{\"type\":\"authenticated\",\"protocol\":\"piik-v23\",\"peerId\":\"viewer_12345678\",\"maxViewers\":8,\"endpointMediaCopyCapacity\":2,\"hostOnline\":true,\"hostPaused\":false,\"connectionId\":null,\"iceConfig\":{\"iceServers\":[],\"natPredictionStunUrls\":[]},\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false},\"codeEntryPolicy\":\"open\",\"viewerAuthorizationGeneration\":\"viewer_generation_12345678\",\"mediaMode\":\"peer-assisted\",\"shareGeneration\":\"share_generation_12345678\",\"routeRevision\":0,\"routeAssignment\":{\"upstream\":{\"kind\":\"none\"},\"childPeerIds\":[],\"sfuPublicationGeneration\":null},\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"screenAudioQuality\":\"music\"},\"role\":\"viewer\"}"
+      "json": "{\"type\":\"authenticated\",\"protocol\":\"piik-v24\",\"peerId\":\"viewer_12345678\",\"maxViewers\":8,\"endpointMediaCopyCapacity\":2,\"hostOnline\":true,\"hostPaused\":false,\"connectionId\":null,\"iceConfig\":{\"iceServers\":[],\"natPredictionStunUrls\":[]},\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false},\"codeEntryPolicy\":\"open\",\"viewerAuthorizationGeneration\":\"viewer_generation_12345678\",\"mediaMode\":\"peer-assisted\",\"shareGeneration\":\"share_generation_12345678\",\"routeRevision\":0,\"routeAssignment\":{\"upstream\":{\"kind\":\"none\"},\"childPeerIds\":[],\"sfuPublicationGeneration\":null},\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000},\"role\":\"viewer\"}"
     },
     {
       "name": "authenticated-viewer-full",
-      "json": "{\"type\":\"authenticated\",\"protocol\":\"piik-v23\",\"peerId\":\"viewer_12345678\",\"maxViewers\":8,\"endpointMediaCopyCapacity\":2,\"hostOnline\":true,\"hostPaused\":true,\"connectionId\":\"connection_12345678\",\"iceConfig\":{\"iceServers\":[],\"natPredictionStunUrls\":[]},\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false},\"codeEntryPolicy\":\"open\",\"viewerAuthorizationGeneration\":\"viewer_generation_12345678\",\"mediaMode\":\"peer-assisted\",\"shareGeneration\":\"share_generation_12345678\",\"routeRevision\":0,\"routeAssignment\":{\"upstream\":{\"kind\":\"peer\",\"peerId\":\"parent_12345678\"},\"childPeerIds\":[\"child_12345678\",\"child_87654321\"],\"sfuPublicationGeneration\":null},\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"screenAudioQuality\":\"music\"},\"role\":\"viewer\"}"
+      "json": "{\"type\":\"authenticated\",\"protocol\":\"piik-v24\",\"peerId\":\"viewer_12345678\",\"maxViewers\":8,\"endpointMediaCopyCapacity\":2,\"hostOnline\":true,\"hostPaused\":true,\"connectionId\":\"connection_12345678\",\"iceConfig\":{\"iceServers\":[],\"natPredictionStunUrls\":[]},\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false},\"codeEntryPolicy\":\"open\",\"viewerAuthorizationGeneration\":\"viewer_generation_12345678\",\"mediaMode\":\"peer-assisted\",\"shareGeneration\":\"share_generation_12345678\",\"routeRevision\":0,\"routeAssignment\":{\"upstream\":{\"kind\":\"peer\",\"peerId\":\"parent_12345678\"},\"childPeerIds\":[\"child_12345678\",\"child_87654321\"],\"sfuPublicationGeneration\":null},\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000},\"role\":\"viewer\"}"
     },
     {
       "name": "signaling-challenge-response",
@@ -1130,7 +1196,7 @@
     },
     {
       "name": "quality-settings",
-      "json": "{\"type\":\"quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"screenAudioQuality\":\"music\"}}"
+      "json": "{\"type\":\"quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000}}"
     },
     {
       "name": "quality-settings-without-audio",
diff --git a/tests/host-peer-tracks.test.ts b/tests/host-peer-tracks.test.ts
index c3bed817f..59e812a37 100644
--- a/tests/host-peer-tracks.test.ts
+++ b/tests/host-peer-tracks.test.ts
@@ -1017,7 +1017,7 @@ describe("HostPeer source replacement", () => {
       { iceServers: [] },
       {
         ...QUALITY_PROFILES["720p30"],
-        screenAudioQuality: "very-high",
+        maxAudioBitrate: 192000,
       },
     );
 
@@ -1231,6 +1231,26 @@ describe("HostPeer source replacement", () => {
     expect(connection.senders[1]?.appliedMaxBitrates).toEqual([128_000]);
   });
 
+  it("applies an answer's audio limit on the existing sender without touching video", async () => {
+    const peer = createPeer(createStream(createTrack("video", "video"), createTrack("audio", "audio")),
+      undefined, undefined, { ...QUALITY_PROFILES["720p30"], maxAudioBitrate: 320_000 });
+    await peer.start();
+    const connection = FakePeerConnection.latest!;
+    const videoCalls = connection.senders[0]!.setParameters.mock.calls.length;
+    const audio = connection.senders[1]!;
+    audio.getParameters().codecs = [{ mimeType: "audio/opus", clockRate: 48000, payloadType: 111,
+      sdpFmtpLine: "stereo=1;maxaveragebitrate=192000" }];
+    await peer.acceptSignal({ kind: "description", connectionId: peer.connectionId,
+      description: { type: "answer", sdp: "test-answer" } });
+    await vi.waitFor(() => expect(audio.getParameters().encodings[0]?.maxBitrate).toBe(192_000));
+    expect(connection.senders[0]!.setParameters.mock.calls).toHaveLength(videoCalls);
+    expect(connection.createOfferCallCount).toBe(1);
+    expect(peer.getSnapshot().audioSenderParameters).toMatchObject({
+      requestedMaxBitrate: 320_000, appliedMaxBitrate: 192_000, mismatch: true,
+    });
+    peer.dispose();
+  });
+
   it("updates quality parameters without replacing media tracks", async () => {
     const video = createTrack("video", "video");
     const audio = createTrack("audio", "audio");
@@ -1257,7 +1277,7 @@ describe("HostPeer source replacement", () => {
     await expect(
       peer.updateProfile({
         ...QUALITY_PROFILES["1080p60"],
-        screenAudioQuality: "very-high",
+        maxAudioBitrate: 192000,
       }),
     ).resolves.toBe(true);
     expect(connection.senders[0]?.setParameters).toHaveBeenCalledTimes(3);
@@ -1286,7 +1306,7 @@ describe("HostPeer source replacement", () => {
     await expect(
       peer.updateProfile({
         ...QUALITY_PROFILES["720p30"],
-        screenAudioQuality: "very-high",
+        maxAudioBitrate: 192000,
       }),
     ).resolves.toBe(false);
 
@@ -1299,7 +1319,7 @@ describe("HostPeer source replacement", () => {
     await expect(
       peer.updateProfile({
         ...QUALITY_PROFILES["720p30"],
-        screenAudioQuality: "very-high",
+        maxAudioBitrate: 192000,
       }),
     ).resolves.toBe(true);
     expect(audioSender.getParameters().encodings[0]?.maxBitrate).toBe(192_000);
@@ -1315,14 +1335,14 @@ describe("HostPeer source replacement", () => {
 
     const saver = peer.updateProfile({
       ...QUALITY_PROFILES["720p30"],
-      screenAudioQuality: "saver",
+      maxAudioBitrate: 64000,
     });
     await vi.waitFor(() =>
       expect(audioSender.setParameters).toHaveBeenCalledTimes(2),
     );
     const veryHigh = peer.updateProfile({
       ...QUALITY_PROFILES["720p30"],
-      screenAudioQuality: "very-high",
+      maxAudioBitrate: 192000,
     });
     audioSender.releaseDeferredSetParameters();
 
@@ -3436,7 +3456,7 @@ describe("ViewerRelay downstream ownership", () => {
   it("applies the latest audio ceiling to current and future children", async () => {
     const initialProfile = {
       ...QUALITY_PROFILES["1080p60"],
-      screenAudioQuality: "saver",
+      maxAudioBitrate: 64000,
     } as const;
     const relay = new ViewerRelay(
       { iceServers: [] },
@@ -3460,7 +3480,7 @@ describe("ViewerRelay downstream ownership", () => {
     await expect(
       relay.updateProfile({
         ...initialProfile,
-        screenAudioQuality: "very-high",
+        maxAudioBitrate: 192000,
       }),
     ).resolves.toBe(true);
     expect(firstConnection.senders[1]?.appliedMaxBitrates).toEqual([
diff --git a/tests/host-quality-ownership.test.ts b/tests/host-quality-ownership.test.ts
index 359a3d44f..ba333b917 100644
--- a/tests/host-quality-ownership.test.ts
+++ b/tests/host-quality-ownership.test.ts
@@ -4,7 +4,7 @@ import ts from "typescript";
 import { describe, expect, it, vi } from "vitest";
 import {
   QUALITY_PROFILES, qualitySettingsEqual, qualitySettingsLabel,
-  resolveScreenAudioQuality, videoQualitySettingsEqual,
+  screenAudioBitrate, videoQualitySettingsEqual,
   type QualitySettings,
 } from "../src/client/media/quality";
 import { NativeSenderPeer } from "../src/client/native/native-sender-peer";
@@ -108,7 +108,7 @@ function fixture(launchedByClient = true) {
     setDetails: vi.fn(), setNativeActive: vi.fn(),
     applyCaptureProfile: vi.fn(async (_stream: unknown, profile: QualitySettings) => { physical = profile; }),
     captureDetails: () => ({}),
-    qualitySettingsEqual, videoQualitySettingsEqual, resolveScreenAudioQuality, qualitySettingsLabel,
+    qualitySettingsEqual, videoQualitySettingsEqual, screenAudioBitrate, qualitySettingsLabel,
     say: (key: string) => key, syncHostSfuQualityWarning: () => null,
     NativeSenderPeer, discardPreparedHostChild: vi.fn(), removePeer: vi.fn(), startPeer: vi.fn(async () => undefined),
     nativePreviewTailRef: ref(Promise.resolve()), setSwitchingSource: vi.fn(),
diff --git a/tests/native-client.test.ts b/tests/native-client.test.ts
index b76fc626a..65dd2071b 100644
--- a/tests/native-client.test.ts
+++ b/tests/native-client.test.ts
@@ -216,7 +216,7 @@ describe("native App private wire", () => {
     });
     const fetcher = vi.fn(async (url: string) => url.endsWith("/health")
       ? new Response(JSON.stringify({
-          protocol: 9, service: "piik-client", port: 39_721,
+          protocol: 10, service: "piik-client", port: 39_721,
           instanceToken: "a".repeat(43),
           nativeMedia: {video: true, processAudio: false, systemAudio: true, hardwareH264: true, softwareVP8: true},
         }), {status: 200})
@@ -243,7 +243,7 @@ describe("native App private wire", () => {
       static readonly CLOSING = 2;
       static readonly CLOSED = 3;
       readyState = FakeWebSocket.OPEN;
-      protocol = `piik-client-v9.${token}`;
+      protocol = `piik-client-v10.${token}`;
       readonly close = vi.fn(() => {
         this.readyState = FakeWebSocket.CLOSING;
       });
@@ -261,7 +261,7 @@ describe("native App private wire", () => {
           const event = new Event("message");
           Object.defineProperty(event, "data", {
             value: JSON.stringify({
-              version: 9,
+              version: 10,
               id: request.id,
               type: request.type === "hello" ? "ready" : request.type === "ping" ? "pong" : "request-failed",
               ...(request.type === "update-share" ? { code: "operation-failed" } : {}),
@@ -283,7 +283,7 @@ describe("native App private wire", () => {
     });
     vi.stubGlobal("fetch", vi.fn(async () =>
       new Response(JSON.stringify({
-        protocol: 9,
+        protocol: 10,
         service: "piik-client",
         port: 39_721,
         instanceToken: token,
@@ -336,7 +336,7 @@ describe("native App private wire", () => {
   it("accepts descriptive health extensions and treats absent media features as unavailable", () => {
     expect(
       nativeHealthSchema.parse({
-        protocol: 9,
+        protocol: 10,
         service: "piik-client",
         port: 39_721,
         instanceToken: "a".repeat(43),
@@ -388,7 +388,7 @@ describe("native App private wire", () => {
       static readonly OPEN = 1;
       static readonly CLOSING = 2;
       readyState = CaptureSocket.OPEN;
-      protocol = `piik-client-v9.${health.instanceToken}`;
+      protocol = `piik-client-v10.${health.instanceToken}`;
       constructor() {
         super();
         queueMicrotask(() => this.dispatchEvent(new Event("open")));
@@ -444,7 +444,7 @@ describe("native App private wire", () => {
       static readonly OPEN = 1;
       static readonly CLOSING = 2;
       readyState = Socket.OPEN;
-      protocol = `piik-client-v9.${health.instanceToken}`;
+      protocol = `piik-client-v10.${health.instanceToken}`;
       constructor() { super(); queueMicrotask(() => this.dispatchEvent(new Event("open"))); }
       close() { this.readyState = Socket.CLOSING; }
       send(payload: string) {
@@ -493,11 +493,11 @@ describe("native App private wire", () => {
       static readonly OPEN = 1;
       static readonly CLOSING = 2;
       readyState = Socket.OPEN;
-      protocol = `piik-client-v9.${health.instanceToken}`;
+      protocol = `piik-client-v10.${health.instanceToken}`;
       constructor() { super(); socket = this; queueMicrotask(() => this.dispatchEvent(new Event("open"))); }
       close() { this.readyState = Socket.CLOSING; }
       ack(request: Record<string, unknown>, type: string, fields = {}) {
-        this.dispatchEvent(new MessageEvent("message", { data: JSON.stringify({ version: 9, id: request.id, type, ...fields }) }));
+        this.dispatchEvent(new MessageEvent("message", { data: JSON.stringify({ version: 10, id: request.id, type, ...fields }) }));
       }
       send(payload: string) {
         const request = JSON.parse(payload) as Record<string, unknown>;
@@ -556,14 +556,14 @@ describe("native App private wire", () => {
       static readonly OPEN = 1;
       static readonly CLOSING = 2;
       readyState = Socket.OPEN;
-      protocol = `piik-client-v9.${health.instanceToken}`;
+      protocol = `piik-client-v10.${health.instanceToken}`;
       constructor() { super(); queueMicrotask(() => this.dispatchEvent(new Event("open"))); }
       close() { this.readyState = Socket.CLOSING; }
       send(payload: string) {
         const request = JSON.parse(payload) as Record<string, unknown>;
         requests.push(request);
         queueMicrotask(() => this.dispatchEvent(new MessageEvent("message", { data: JSON.stringify({
-          version: 9, id: request.id, ...(request.type === "hello" ? { type: "ready" } : {
+          version: 10, id: request.id, ...(request.type === "hello" ? { type: "ready" } : {
             type: "receive-answer", shareId: request.shareId, connectionId: request.connectionId,
             sdp: "answer", audio: false, codec: "vp8", ...(supported ? { reused: true } : {}),
           }),
@@ -578,7 +578,7 @@ describe("native App private wire", () => {
     const client = (await NativeClient.connect())!;
     try {
       const result = await client.receiveOffer("share_123456", "connection_1234", { type: "offer", sdp: "offer" }, { iceServers: [] }, 2);
-      expect(requests.at(-1)).toEqual({ version: 9, id: expect.any(String), type: "receive-offer",
+      expect(requests.at(-1)).toEqual({ version: 10, id: expect.any(String), type: "receive-offer",
         shareId: "share_123456", connectionId: "connection_1234", sdp: "offer", iceServers: [], edgeCapacity: 2,
         ...(supported ? { reuseReceiver: true } : {}),
       });
@@ -623,7 +623,7 @@ describe("native App private wire", () => {
 
   it("fences native events by share and connection identity", () => {
     const event = {
-      version: 9,
+      version: 10,
       type: "edge-state",
       shareId: "share_123456",
       connectionId: "edge_1234567",
@@ -637,7 +637,7 @@ describe("native App private wire", () => {
       nativeEventSchema.safeParse({ ...event, routeRevision: 1 }).success,
     ).toBe(false);
     const path = {
-      version: 9,
+      version: 10,
       type: "edge-path",
       shareId: "share_123456",
       connectionId: "edge_1234567",
@@ -652,7 +652,7 @@ describe("native App private wire", () => {
 
   it("keeps an unavailable preview advisory instead of treating it as media failure", () => {
     const preview = {
-      version: 9,
+      version: 10,
       id: "request_preview",
       type: "source-preview",
       sourceKey: "display:65537",
@@ -676,10 +676,10 @@ describe("native App private wire", () => {
       maxFramerate: 60,
       maxBitrate: 12_000_000,
       degradationPreference: "maintain-framerate",
-      screenAudioQuality: "very-high",
+      maxAudioBitrate: 192000,
     };
     expect(shareStartedResponseSchema.safeParse({
-      version: 9,
+      version: 10,
       id: "request_start",
       type: "share-started",
       shareId: "share_123456",
@@ -687,19 +687,19 @@ describe("native App private wire", () => {
       codec: "h264",
     }).success).toBe(true);
     expect(shareUpdatedResponseSchema.safeParse({
-      version: 9,
+      version: 10,
       id: "request_update",
       type: "share-updated",
       shareId: "share_123456",
     }).success).toBe(true);
     expect(shareSourceReplacedResponseSchema.safeParse({
-      version: 9,
+      version: 10,
       id: "request_source",
       type: "share-source-replaced",
       shareId: "share_123456",
     }).success).toBe(true);
     expect(shareUpdatedResponseSchema.safeParse({
-      version: 9,
+      version: 10,
       id: "request_update",
       type: "share-updated",
       shareId: "share_123456",
@@ -709,7 +709,7 @@ describe("native App private wire", () => {
 
   it("requires the actual Native codec instead of reporting Auto as media", () => {
     const response = {
-      version: 9,
+      version: 10,
       id: "request_receive",
       type: "receive-answer",
       shareId: "share_123456",
@@ -720,7 +720,7 @@ describe("native App private wire", () => {
     for (const codec of ["h264", "vp8"]) {
       expect(receiveAnswerResponseSchema.safeParse({ ...response, codec }).success).toBe(true);
       expect(shareStartedResponseSchema.safeParse({
-        version: 9, id: "request_start", type: "share-started",
+        version: 10, id: "request_start", type: "share-started",
         shareId: response.shareId, audio: false, codec,
       }).success).toBe(true);
     }
@@ -730,7 +730,7 @@ describe("native App private wire", () => {
 
   it("accepts only internally consistent native quality evidence", () => {
     const event = {
-      version: 9,
+      version: 10,
       type: "edge-quality",
       shareId: "share_123456",
       connectionId: "edge_1234567",
diff --git a/tests/native-media-bridge.test.ts b/tests/native-media-bridge.test.ts
index dabb9c1a9..9bf8eb9b7 100644
--- a/tests/native-media-bridge.test.ts
+++ b/tests/native-media-bridge.test.ts
@@ -80,7 +80,7 @@ function fixture(options: {
     NativeMediaBridgeControl["prepareLocalEdge"]
   >(async (_shareId, connectionId) => {
       listener?.({
-        version: 9,
+        version: 10,
         type: "edge-candidate",
         shareId: "share_123456",
         connectionId,
@@ -185,7 +185,7 @@ describe("native media bridge", () => {
       current.peer().dispatchEvent(Object.assign(new Event("icecandidate"), { candidate: null }));
     } else {
       current.peer().addIceCandidate.mockRejectedValueOnce(cause);
-      current.emit({ version: 9, type: "edge-candidate", shareId: "share_123456",
+      current.emit({ version: 10, type: "edge-candidate", shareId: "share_123456",
         connectionId: current.bridge.connectionId, candidate: null });
     }
     await vi.waitFor(() => expect(current.onFailed).toHaveBeenCalledOnce());
@@ -205,7 +205,7 @@ describe("native media bridge", () => {
     const result = starting.catch((error: unknown) => error);
     if (phase === "queued") {
       current.emit({
-        version: 9, type: "edge-candidate", shareId: "share_123456",
+        version: 10, type: "edge-candidate", shareId: "share_123456",
         connectionId: current.bridge.connectionId,
         candidate: { candidate: "candidate:2 1 udp 1 127.0.0.1 10 typ host" },
       });
@@ -218,13 +218,13 @@ describe("native media bridge", () => {
     if (phase === "active") {
       peer.addIceCandidate.mockRejectedValueOnce(new DOMException("Rejected candidate", "OperationError"));
       current.emit({
-        version: 9, type: "edge-candidate", shareId: "share_123456",
+        version: 10, type: "edge-candidate", shareId: "share_123456",
         connectionId: current.bridge.connectionId,
         candidate: { candidate: "candidate:2 1 udp 1 127.0.0.1 10 typ host" },
       });
     }
     current.emit({
-      version: 9, type: "edge-candidate", shareId: "share_123456",
+      version: 10, type: "edge-candidate", shareId: "share_123456",
       connectionId: current.bridge.connectionId, candidate: null,
     });
     await vi.waitFor(() => expect(debugError).toHaveBeenCalledWith(
@@ -378,14 +378,14 @@ describe("native media bridge", () => {
     await starting;
 
     current.emit({
-      version: 9,
+      version: 10,
       type: "edge-state",
       shareId: "share_123456",
       connectionId: current.bridge.connectionId,
       state: "failed",
     });
     current.emit({
-      version: 9,
+      version: 10,
       type: "edge-state",
       shareId: "share_123456",
       connectionId: current.bridge.connectionId,
diff --git a/tests/native-sender-edge.test.ts b/tests/native-sender-edge.test.ts
index f095c7585..4abe7b015 100644
--- a/tests/native-sender-edge.test.ts
+++ b/tests/native-sender-edge.test.ts
@@ -66,17 +66,17 @@ describe("native sender edge adapter", () => {
     "keeps connected media when trickle signaling is unavailable: %j", async (candidate) => {
       const current = fixture();
       expect(await current.edge.start()).toBe(true);
-      current.emit({ version: 9, type: "edge-state", shareId: "share_1234567", connectionId: "edge_12345678", state: "connected" });
+      current.emit({ version: 10, type: "edge-state", shareId: "share_1234567", connectionId: "edge_12345678", state: "connected" });
       current.sendSignal.mockReturnValue(false);
-      current.emit({ version: 9, type: "edge-candidate", shareId: "share_1234567", connectionId: "edge_12345678", candidate });
+      current.emit({ version: 10, type: "edge-candidate", shareId: "share_1234567", connectionId: "edge_12345678", candidate });
       expect(current.edge.isConnected()).toBe(true);
       expect(current.control.closeEdge).not.toHaveBeenCalled();
       expect(current.states).toEqual(["connected"]);
-      current.emit({ version: 9, type: "edge-state", shareId: "share_1234567", connectionId: "edge_12345678", state: "failed" });
+      current.emit({ version: 10, type: "edge-state", shareId: "share_1234567", connectionId: "edge_12345678", state: "failed" });
       expect(current.edge.isConnected()).toBe(false);
       expect(current.states).toEqual(["connected", "failed"]);
       current.edge.dispose();
-      current.emit({ version: 9, type: "edge-state", shareId: "share_1234567", connectionId: "edge_12345678", state: "connected" });
+      current.emit({ version: 10, type: "edge-state", shareId: "share_1234567", connectionId: "edge_12345678", state: "connected" });
       expect(current.edge.isConnected()).toBe(false);
       expect(current.control.closeEdge).toHaveBeenCalledOnce();
     },
@@ -90,7 +90,7 @@ describe("native sender edge adapter", () => {
 
     const current = fixture();
     vi.mocked(current.control.prepareEdge).mockImplementationOnce(async () => {
-      current.emit({ version: 9, type: "edge-candidate", shareId: "share_1234567", connectionId: "edge_12345678", candidate: null });
+      current.emit({ version: 10, type: "edge-candidate", shareId: "share_1234567", connectionId: "edge_12345678", candidate: null });
       return { type: "offer", sdp: "v=0\r\n" };
     });
     current.sendSignal.mockImplementation((_peer, payload) => payload.kind === "description");
@@ -104,7 +104,7 @@ describe("native sender edge adapter", () => {
     const prepare = vi.mocked(current.control.prepareEdge);
     prepare.mockImplementationOnce(async () => {
       current.emit({
-        version: 9,
+        version: 10,
         type: "edge-candidate",
         shareId: "share_1234567",
         connectionId: "edge_12345678",
@@ -125,7 +125,7 @@ describe("native sender edge adapter", () => {
     const current = fixture();
     expect(await current.edge.start()).toBe(true);
     current.emit({
-      version: 9,
+      version: 10,
       type: "edge-state",
       shareId: "share_1234567",
       connectionId: "edge_12345678",
@@ -153,7 +153,7 @@ describe("native sender edge adapter", () => {
       .toHaveLength(3);
     for (const [index, port] of [40_000, 40_003, 40_006].entries()) {
       current.emit({
-        version: 9,
+        version: 10,
         type: "edge-candidate",
         shareId: "share_1234567",
         connectionId: "edge_12345678",
diff --git a/tests/native-sender-peer.test.ts b/tests/native-sender-peer.test.ts
index 439a122a3..91b8123b4 100644
--- a/tests/native-sender-peer.test.ts
+++ b/tests/native-sender-peer.test.ts
@@ -67,7 +67,7 @@ describe("native Host peer quality", () => {
       qualityProbe: true,
     })).toBe(false);
     listener({
-      version: 9,
+      version: 10,
       type: "edge-state",
       shareId: "share_1234567",
       connectionId: "edge_12345678",
@@ -75,7 +75,7 @@ describe("native Host peer quality", () => {
     });
 
     const quality = {
-      version: 9 as const,
+      version: 10 as const,
       type: "edge-quality" as const,
       shareId: "share_1234567",
       connectionId: "edge_12345678",
diff --git a/tests/native-sfu-publisher.test.ts b/tests/native-sfu-publisher.test.ts
index 31f57297f..5412b8768 100644
--- a/tests/native-sfu-publisher.test.ts
+++ b/tests/native-sfu-publisher.test.ts
@@ -30,7 +30,7 @@ describe("Native SFU publication", () => {
     const activation = publisher.activate();
     if (mode === "transport") {
       await activation;
-      listener!({ version: 9, type: "publication-state", shareId: "native_share", ...config, state: "failed" });
+      listener!({ version: 10, type: "publication-state", shareId: "native_share", ...config, state: "failed" });
     }
     const firstClose = publisher.disconnect();
     expect(publisher.disconnect()).toBe(firstClose);
@@ -65,7 +65,7 @@ describe("Native SFU publication", () => {
     const control = {
       preparePublication: vi.fn(async () => {
         emit({
-          version: 9,
+          version: 10,
           type: "publication-candidate",
           shareId: "native_share",
           ...config,
@@ -135,7 +135,7 @@ describe("Native SFU publication", () => {
     expect(await publisher.updateProfile()).toBe(true);
     expect(sent.at(-1)).toMatchObject({ kind: "media", media });
     emit({
-      version: 9,
+      version: 10,
       type: "publication-quality",
       shareId: "native_share",
       ...config,
@@ -170,12 +170,12 @@ describe("Native SFU publication", () => {
         frameHeight: 360,
       }),
     );
-    emit({ version: 9, type: "publication-state", shareId: "native_share", ...config, state: "disconnected" });
+    emit({ version: 10, type: "publication-state", shareId: "native_share", ...config, state: "disconnected" });
     expect(control.closePublication).not.toHaveBeenCalled();
     expect(onDisconnected).not.toHaveBeenCalled();
-    emit({ version: 9, type: "publication-state", shareId: "native_share", ...config, state: "connected" });
+    emit({ version: 10, type: "publication-state", shareId: "native_share", ...config, state: "connected" });
     emit({
-      version: 9,
+      version: 10,
       type: "publication-state",
       shareId: "native_share",
       ...config,
diff --git a/tests/native-viewer-peer.test.ts b/tests/native-viewer-peer.test.ts
index 89f26a8fc..d0d42eac7 100644
--- a/tests/native-viewer-peer.test.ts
+++ b/tests/native-viewer-peer.test.ts
@@ -94,7 +94,7 @@ it.each(["viewer", "route"] as const)("retires a connected Native receiver on co
       description: { type: "offer", sdp: "v=0\r\nm=video 9 UDP/TLS/RTP/SAVPF 96\r\na=sendonly\r\na=rtpmap:96 VP8/90000\r\n" },
     });
     const connected = {
-      version: 9, shareId: "session", connectionId: "current", type: "edge-state", state: "connected",
+      version: 10, shareId: "session", connectionId: "current", type: "edge-state", state: "connected",
     } as const;
     onEvent(connected);
     expect(peer.isConnected()).toBe(true);
@@ -215,7 +215,7 @@ it.each(["reused", "replaced", "answer-lost", "control-lost"])("keeps Native rec
   });
   try {
     await peer.acceptSignal("parent", offer("first"));
-    event({ version: 9, type: "edge-state", shareId: "session", connectionId: "current", state: "connected" });
+    event({ version: 10, type: "edge-state", shareId: "session", connectionId: "current", state: "connected" });
     const source = peer.nativeSource;
     receiveOffer.mockImplementationOnce(async () => {
       if (outcome === "replaced") {
@@ -567,7 +567,7 @@ it.each(["first", "replacement", "failed-offer"])("keeps committed route recover
   const offer = (connectionId: string) => ({ kind: "description" as const, connectionId,
     description: { type: "offer" as const, sdp: "v=0\r\nm=video 9 UDP/TLS/RTP/SAVPF 96\r\na=sendonly\r\na=rtpmap:96 VP8/90000\r\n" }});
   const state = (connectionId: string, value: "connected" | "failed") => onEvent({
-    version: 9, shareId: "session", connectionId, type: "edge-state", state: value,
+    version: 10, shareId: "session", connectionId, type: "edge-state", state: value,
   });
   try {
     await peer.acceptSignal("parent", offer("first"));
@@ -589,7 +589,7 @@ it.each(["first", "replacement", "failed-offer"])("keeps committed route recover
     const retiredEvent = onEvent;
     if (scenario === "failed-offer") receiveOffer.mockRejectedValueOnce(new Error("receiver unavailable"));
     await peer.acceptSignal("parent", offer("rebuilt"));
-    retiredEvent({ version: 9, shareId: "session", connectionId, type: "edge-state", state: "connected" });
+    retiredEvent({ version: 10, shareId: "session", connectionId, type: "edge-state", state: "connected" });
     state("rebuilt", "failed");
     expect(restart).toHaveBeenCalledTimes(2);
     expect(exhausted).toHaveBeenCalledExactlyOnceWith("parent", "rebuilt");
diff --git a/tests/protocol.test.ts b/tests/protocol.test.ts
index 28ce6b697..c5c7228b9 100644
--- a/tests/protocol.test.ts
+++ b/tests/protocol.test.ts
@@ -87,7 +87,7 @@ describe("runtime capabilities", () => {
 
 const qualitySettingsWithAudio = {
   ...qualitySettings,
-  screenAudioQuality: "music",
+  maxAudioBitrate: 128000,
 } as const;
 
 const legacyCodecQualitySettings = {
@@ -139,7 +139,7 @@ const qualityEvidence = {
 
 describe("client signaling protocol", () => {
   it("uses the current strict signaling generation", () => {
-    expect(SIGNALING_PROTOCOL).toBe("piik-v23");
+    expect(SIGNALING_PROTOCOL).toBe("piik-v24");
   });
 
   it("keeps signaling challenges strict and sequence-only", () => {
@@ -772,15 +772,13 @@ describe("client signaling protocol", () => {
         qualitySettings: { ...qualitySettings, resolution: "480p" },
       }).success,
     ).toBe(true);
-    for (const screenAudioQuality of [
-      "saver",
-      "music",
-      "very-high",
+    for (const maxAudioBitrate of [
+      6_000, 96_000, 256_000, 320_000, 510_000,
     ] as const) {
       expect(
         clientMessageSchema.safeParse({
           type: "set-quality-settings",
-          qualitySettings: { ...qualitySettings, screenAudioQuality },
+          qualitySettings: { ...qualitySettings, maxAudioBitrate },
         }).success,
       ).toBe(true);
     }
@@ -794,8 +792,14 @@ describe("client signaling protocol", () => {
       { ...qualitySettings, maxBitrate: 5_000_000.5 },
       { ...qualitySettings, degradationPreference: "automatic" },
       legacyCodecQualitySettings,
-      { ...qualitySettings, screenAudioQuality: "lossless" },
-      { ...qualitySettings, screenAudioQuality: 960_000 },
+      { ...qualitySettings, maxAudioBitrate: "lossless" },
+      { ...qualitySettings, maxAudioBitrate: "music" },
+      { ...qualitySettings, maxAudioBitrate: 0 },
+      { ...qualitySettings, maxAudioBitrate: 5_999 },
+      { ...qualitySettings, maxAudioBitrate: 510_001 },
+      { ...qualitySettings, maxAudioBitrate: 128_000.5 },
+      { ...qualitySettings, maxAudioBitrate: null },
+      { ...qualitySettings, maxAudioBitrate: 960_000 },
       { ...qualitySettings, codec: "video/VP9" },
     ]) {
       expect(
diff --git a/tests/quality-preference.test.ts b/tests/quality-preference.test.ts
index 282968565..a279e3f09 100644
--- a/tests/quality-preference.test.ts
+++ b/tests/quality-preference.test.ts
@@ -14,7 +14,7 @@ describe("sharing quality preference", () => {
     expect(readPreferredQuality()).toEqual(DEFAULT_QUALITY_SETTINGS);
     const chosen = { ...DEFAULT_QUALITY_SETTINGS, resolution: "1440p" as const,
       maxFramerate: 60, maxBitrate: 10_000_000, degradationPreference: "maintain-resolution" as const,
-      screenAudioQuality: "very-high" as const };
+      maxAudioBitrate: 256_000 };
     savePreferredQuality(chosen);
     expect(readPreferredQuality()).toEqual(chosen);
     savePreferredQuality({ ...chosen, maxBitrate: -1 });
diff --git a/tests/quality.test.ts b/tests/quality.test.ts
index 12000d778..d0b435f65 100644
--- a/tests/quality.test.ts
+++ b/tests/quality.test.ts
@@ -13,6 +13,7 @@ import {
   QUALITY_RESOLUTIONS,
   qualitySettingsEqual,
   screenAudioBitrate,
+  screenAudioSenderCeiling,
   senderParameterWarning,
   setMediaPaused,
   startupVideoProfile,
@@ -150,10 +151,10 @@ describe("realtime quality controls", () => {
   it("keeps audio selection orthogonal while defaulting missing settings to music", () => {
     const saver = {
       ...QUALITY_PROFILES["1080p60"],
-      screenAudioQuality: "saver",
+      maxAudioBitrate: 64000,
     } as const;
     const {
-      screenAudioQuality: _screenAudioQuality,
+      maxAudioBitrate: _maxAudioBitrate,
       ...legacySettings
     } = QUALITY_PROFILES["1080p60"];
 
@@ -295,9 +296,9 @@ describe("realtime quality controls", () => {
 
   it.each([
     [undefined, 128_000],
-    ["saver", 64_000],
-    ["music", 128_000],
-    ["very-high", 192_000],
+    [64_000, 64_000],
+    [128_000, 128_000],
+    [192_000, 192_000],
   ] as const)("applies and reads back the %s audio ceiling", async (quality, bitrate) => {
     let applied = { encodings: [] } as unknown as RTCRtpSendParameters;
     const sender = {
@@ -331,6 +332,38 @@ describe("realtime quality controls", () => {
     });
   });
 
+  it.each([192_000, 510_000])("honors the receiver's %i Opus limit on every live update", async (limit) => {
+    let applied = {
+      codecs: [{ mimeType: "audio/opus", sdpFmtpLine: `stereo=1;maxaveragebitrate=${limit}` }],
+      encodings: [{}],
+    } as RTCRtpSendParameters;
+    const sender = {
+      getParameters: () => applied,
+      setParameters: async (value: RTCRtpSendParameters) => { applied = value; },
+    } as RTCRtpSender;
+    for (const bitrate of [128_000, 320_000, 96_000, 510_000]) {
+      const ceiling = Math.min(bitrate, limit, 320_000);
+      await expect(configureScreenAudioSender(sender, bitrate)).resolves.toEqual({
+        requestedMaxBitrate: bitrate, appliedMaxBitrate: ceiling, mismatch: ceiling !== bitrate,
+      });
+      expect(applied.encodings[0]?.maxBitrate).toBe(ceiling);
+    }
+  });
+
+  it.each([
+    ["", 32_000],
+    ["stereo=1", 64_000],
+    ["stereo=1;maxaveragebitrate=invalid", 64_000],
+    ["stereo=1;maxaveragebitrate=510001", 64_000],
+    ["maxplaybackrate=8000", 12_000],
+    ["stereo=1;maxplaybackrate=16000", 40_000],
+    ["maxaveragebitrate=510000;maxaveragebitrate=96000", 96_000],
+  ] as const)("keeps omitted/invalid Opus limits bounded: %s", (sdpFmtpLine, expected) => {
+    const parameters = { codecs: [{ mimeType: "audio/opus", sdpFmtpLine }] } as RTCRtpSendParameters;
+    expect(screenAudioSenderCeiling(parameters, 320_000)).toBe(expected);
+    expect(screenAudioSenderCeiling(parameters, 6_000)).toBe(6_000);
+  });
+
   it("reports an audio ceiling the browser rewrites", async () => {
     const sender = {
       getParameters: vi
diff --git a/tests/screen-audio-sdp.test.ts b/tests/screen-audio-sdp.test.ts
index fb4850157..c9893c9f8 100644
--- a/tests/screen-audio-sdp.test.ts
+++ b/tests/screen-audio-sdp.test.ts
@@ -35,7 +35,7 @@ describe("preferScreenAudioStereo", () => {
     expect(session.media[0]?.fmtp).toContainEqual({
       payload: 111,
       config:
-        "minptime=10;useinbandfec=1;x-stereo=keep;stereo=1;maxaveragebitrate=192000",
+        "minptime=10;useinbandfec=1;x-stereo=keep;stereo=1;maxaveragebitrate=510000",
     });
     expect(session.media[1]?.fmtp).toEqual([
       { payload: 96, config: "packetization-mode=1;profile-level-id=42e01f" },
@@ -52,7 +52,7 @@ describe("preferScreenAudioStereo", () => {
     });
 
     expect(parse(result.sdp!).media[0]?.fmtp[0]?.config).toBe(
-      "stereo=1;x-stereo=0;maxaveragebitrate=192000;x-maxaveragebitrate=keep",
+      "stereo=1;x-stereo=0;maxaveragebitrate=510000;x-maxaveragebitrate=keep",
     );
   });
 
@@ -64,7 +64,7 @@ describe("preferScreenAudioStereo", () => {
 
     expect(parse(result.sdp!).media[0]?.fmtp).toContainEqual({
       payload: 111,
-      config: "stereo=1;maxaveragebitrate=192000",
+      config: "stereo=1;maxaveragebitrate=510000",
     });
   });
 
@@ -82,7 +82,7 @@ describe("preferScreenAudioStereo", () => {
 
     expect(audio[0]?.fmtp[0]?.config).toBe("stereo=0");
     expect(audio[1]?.fmtp[0]?.config).toContain("stereo=1");
-    expect(audio[1]?.fmtp[0]?.config).toContain("maxaveragebitrate=192000");
+    expect(audio[1]?.fmtp[0]?.config).toContain("maxaveragebitrate=510000");
   });
 
   it.each([
diff --git a/tests/sfu-client.test.ts b/tests/sfu-client.test.ts
index 3beaaa58b..fdce7d900 100644
--- a/tests/sfu-client.test.ts
+++ b/tests/sfu-client.test.ts
@@ -373,7 +373,7 @@ describe("embedded SFU browser transport", () => {
     const { publisher: host, pc, send } = await publisher();
     const profile = {
       ...QUALITY_PROFILES["720p30"],
-      screenAudioQuality: "very-high" as const,
+      maxAudioBitrate: 192000 as const,
     };
     expect(await host.updateProfile(profile)).toBe(true);
     expect(pc.transceivers[0]!.sender.parameters.encodings).toEqual([
@@ -680,7 +680,7 @@ describe("embedded SFU browser transport", () => {
     expect(
       await host.updateProfile({
         ...QUALITY_PROFILES["1080p30"],
-        screenAudioQuality: "saver",
+        maxAudioBitrate: 64000,
       }),
     ).toBe(true);
     expect(video.clones[0]!.applyConstraints).toHaveBeenCalledTimes(
diff --git a/tests/viewer-peer-generation.test.ts b/tests/viewer-peer-generation.test.ts
index 9f40f2f6e..fcef6b920 100644
--- a/tests/viewer-peer-generation.test.ts
+++ b/tests/viewer-peer-generation.test.ts
@@ -455,7 +455,7 @@ describe("ViewerPeer connection generations", () => {
       expect(description).toEqual(expect.objectContaining({
         type: "answer",
         sdp: expect.stringContaining(
-          "a=fmtp:111 minptime=10;useinbandfec=1;stereo=1;maxaveragebitrate=192000",
+          "a=fmtp:111 minptime=10;useinbandfec=1;stereo=1;maxaveragebitrate=510000",
         ),
       }));
       expect(answers[index]?.description.sdp).toBe(description.sdp);

From 87b608c50f450bc1c6ad7deae90019326b9bd748 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 15:53:31 +0800
Subject: [PATCH 067/262] fix(media): declare Opus receive capacity on native
 preview

---
 docs/research/browser-screen-audio-quality.md |  3 ++-
 src/client/native/media-bridge.ts             |  3 ++-
 tests/native-media-bridge.test.ts             | 25 +++++++++++++++++++
 3 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/docs/research/browser-screen-audio-quality.md b/docs/research/browser-screen-audio-quality.md
index 02341fbcc..153c7a605 100644
--- a/docs/research/browser-screen-audio-quality.md
+++ b/docs/research/browser-screen-audio-quality.md
@@ -110,7 +110,8 @@ networks, mobile playback and physical listening remain open.
 
 RFC 7587 gives an omitted receive bitrate a mode-dependent default, not an
 unrestricted value, and asks receivers to ignore out-of-range preferences.
-All candidate Piik receivers therefore declare the full Opus range explicitly.
+All candidate Piik receivers therefore declare the full Opus range explicitly,
+including the App's local preview bridge through the same Browser answer helper.
 Browser sender enforcement uses [libwebrtc's existing default calculation](https://webrtc.googlesource.com/src/+/refs/heads/main/modules/audio_coding/codecs/opus/audio_encoder_opus.cc)
 when a peer omits a valid limit. Unchanged forwarding requires an explicit
 sufficient limit; it cannot turn down the shared source for one receiver.
diff --git a/src/client/native/media-bridge.ts b/src/client/native/media-bridge.ts
index 6d181326c..dcaf209f5 100644
--- a/src/client/native/media-bridge.ts
+++ b/src/client/native/media-bridge.ts
@@ -4,6 +4,7 @@ import { browserDebugEnabled, debugError, debugEvent } from "../lib/debug";
 import { observeDebugConnection } from "../lib/debug-webrtc";
 import type { ConnectionMetrics } from "../types";
 import { addRemoteIceCandidate, type SignalCandidate } from "../webrtc/nat-prediction";
+import { preferScreenAudioStereo } from "../webrtc/screen-audio-sdp";
 import {
   collectConnectionMetrics,
   decodedVideoFrames,
@@ -183,7 +184,7 @@ export class NativeMediaBridge {
       for (const candidate of this.pendingCandidates.splice(0)) {
         await addRemoteIceCandidate(this.peer, candidate);
       }
-      const answer = await this.peer.createAnswer();
+      const answer = preferScreenAudioStereo(await this.peer.createAnswer());
       if (!answer.sdp) {
         throw new Error("Native media bridge produced no SDP answer");
       }
diff --git a/tests/native-media-bridge.test.ts b/tests/native-media-bridge.test.ts
index 9bf8eb9b7..da1273ee7 100644
--- a/tests/native-media-bridge.test.ts
+++ b/tests/native-media-bridge.test.ts
@@ -130,6 +130,31 @@ afterEach(() => {
 });
 
 describe("native media bridge", () => {
+  it("advertises the same Opus receive range on local preview as remote viewers", async () => {
+    const current = fixture();
+    current.peer().createAnswer.mockResolvedValueOnce({ type: "answer", sdp:
+      "v=0\r\no=- 1 1 IN IP4 127.0.0.1\r\ns=-\r\nt=0 0\r\n" +
+      "m=audio 9 UDP/TLS/RTP/SAVPF 111\r\na=rtpmap:111 opus/48000/2\r\n" +
+      "a=fmtp:111 minptime=10;useinbandfec=1\r\n",
+    });
+    const starting = current.bridge.start(true);
+    await vi.waitFor(() => expect(current.control.acceptSignal).toHaveBeenCalledWith(
+      "share_123456", current.bridge.connectionId, expect.objectContaining({
+        kind: "description", description: expect.objectContaining({
+          sdp: expect.stringContaining("stereo=1;maxaveragebitrate=510000"),
+        }),
+      }),
+    ));
+    expect(current.peer().setLocalDescription).toHaveBeenCalledWith(expect.objectContaining({
+      sdp: expect.stringContaining("stereo=1;maxaveragebitrate=510000"),
+    }));
+    current.peer().emitTrack({ kind: "video", stop: vi.fn() } as unknown as MediaStreamTrack);
+    current.peer().emitTrack({ kind: "audio", stop: vi.fn() } as unknown as MediaStreamTrack);
+    current.peer().setState("connected");
+    await expect(starting).resolves.toBe(current.bridge.stream);
+    current.bridge.dispose();
+  });
+
   it("releases an unstarted Browser reservation without sending an edge command", async () => {
     const current = fixture();
     current.bridge.dispose();

From 1a7c7d70fc5d9a0f4e82bf8d0e72254501336b7c Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 15:59:55 +0800
Subject: [PATCH 068/262] fix(capture): preserve source geometry within Windows
 output ceilings

---
 docs/research/native-client-media.md          | 34 +++++++++++++--
 docs/standards/media-quality.md               |  4 ++
 docs/status.md                                |  4 +-
 docs/todo.md                                  |  5 ++-
 docs/verification-status.md                   |  3 +-
 native/capture/windows/capture_geometry.h     | 15 +++++++
 .../capture/windows/capture_geometry.test.cpp | 14 +++++++
 native/capture/windows/main.cpp               |  5 ++-
 native/capture/windows/output_worker.test.cpp | 34 +++++++++++++++
 scripts/app-media-gate.ts                     | 41 +++++++++++--------
 scripts/app-native-host-gate.ts               | 40 +++++++++++-------
 scripts/embedded-sfu-gate.ts                  | 16 ++++----
 scripts/embedded-sfu-page.ts                  |  7 +++-
 scripts/media-gate-geometry.ts                | 11 +++++
 14 files changed, 186 insertions(+), 47 deletions(-)
 create mode 100644 scripts/media-gate-geometry.ts

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index adffac81f..82508f7c0 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -519,17 +519,43 @@ bounds dimensions. Native capture, forwarding and SFU declarations also admit
 specific encoded formats. Removing one validator would leave these consumers
 inconsistent.
 
-Source review also distinguishes output geometry from a quality limit. Windows
-`FrameConverter` fits content into the selected landscape raster with a black
-background, so its padding is encoded. Browser display capture instead requests
+Source review also distinguishes output geometry from a quality limit. The
+published Windows path fits content into the selected landscape raster with a
+black background, so its padding is encoded. Browser display capture instead requests
 landscape width/height ceilings; a portrait source can be reduced unnecessarily
 by the height ceiling. The shared TV uses `object-fit: contain` in a 16:9 stage,
 adding presentation space independently of encoded padding. For example, the
-Windows fit rule places 1080x1920 content at 608x1080 inside a 1920x1080 output.
+published Windows fit rule places 1080x1920 content at 608x1080 inside a 1920x1080 output.
 This is a code-derived result, not a new physical capture measurement. Evaluate
 orientation-independent limits and preservation of source aspect ratio together;
 adding numeric fields alone would retain the current geometry limitation.
 
+The candidate first changes the existing Windows output worker: it passes the
+source's fitted even dimensions to WebRTC, retaining the selected profile as a
+ceiling. A 640x480 source stays 640x480; portrait and ultrawide sources no longer
+require an encoded landscape canvas. The converter, adaptation owner, output
+generation and frame envelope are reused. Axis-specific limits still apply;
+this does not yet give portrait capture a transposed ceiling or add a 4K setting.
+Browser and other platform geometry remain separate pending work.
+
+Local synthetic-input controls exercised that production worker through four
+successive source sizes: 1080x1920, 3440x1440, 640x480 and 1920x1080. Under the
+1080p ceiling, H.264 and VP8 each produced 40 frames at 606x1080, 1920x802,
+640x480 and 1920x1080; Chrome decoded every frame at the declared dimensions.
+Separately, a codec-only control bypassed product profile admission and encoded
+1080x1920, 3440x1440 and 3840x2160 at 30 fps with the current Windows H.264
+encoder. Chrome decoded all 30 frames per size; observed levels were 4.0, 5.0
+and 5.1. This establishes local codec feasibility, not product 4K support,
+4K60, sustained performance or cross-device acceptance.
+
+The real Windows H.264 source also passed the existing App UI and two-Viewer
+gates: live/paused settings, background/window recovery, source replacement and
+retirement retained their expected owners. Native SFU passed 300 decoded frames
+at its original source aspect, reduction from 658x720 to 438x480, numeric audio
+changes, Viewer reload/recovery and cleanup. Gate expectations now derive from
+the observed source and selected ceilings, instead of requiring encoded 16:9
+padding. Physical game, macOS/Linux and orientation-change acceptance remain open.
+
 The restriction extends beyond resolution labels: shared readers also bound
 frame rate and bitrate, and Native's selectable profile admits four exact raster
 pairs while derived outputs admit other dimensions within axis-specific limits.
diff --git a/docs/standards/media-quality.md b/docs/standards/media-quality.md
index 980d0b8ec..2ab476242 100644
--- a/docs/standards/media-quality.md
+++ b/docs/standards/media-quality.md
@@ -42,6 +42,10 @@ contract. [Status](../status.md) indexes delivery and remaining acceptance.
   frame matches its desktop source dimensions. Other frames retain their own
   aspect ratio. This changes only the encoded presentation, never the game or
   display settings; vendor-private scaling is not inferred.
+  Each Windows output fits that presentation within its selected ceiling using
+  even dimensions, without enlarging the source or encoding a fixed landscape
+  canvas. The existing WebRTC encoder may adapt further; source resizing does
+  not create a new room or route. Frame envelopes carry actual output dimensions.
 - Windows SDR conversion owns one output color contract: limited-range BT.601
   NV12 with matching H.264 metadata. RGB capture and decoded video retain their
   input range/matrix through conversion and relay scaling; dimensions do not
diff --git a/docs/status.md b/docs/status.md
index c99d58de8..b0158532a 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -65,7 +65,9 @@ Numeric audio is implemented in the unpublished candidate: Browser/server v24
 and Native control v10 replace the preset field; capture v7 and SQLite schema 2
 remain unchanged. Matched candidate App/Web/Server builds are required;
 1.x participants are rejected by the existing compatibility checks.
-Geometry, 4K and additional codecs are still assessed through the media boundary.
+Windows output now preserves the source shape within the existing ceiling;
+axis-independent limits, other-platform geometry, 4K and additional codecs are
+still assessed through the media boundary.
 Native Magicsock remains an isolated experiment with incomplete product
 integration and unresolved recovery cases. These proposals do not yet change
 the accepted contract or transport. A small external test is proposed before
diff --git a/docs/todo.md b/docs/todo.md
index 68e04f187..b0a79896c 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -50,7 +50,10 @@ Implementation needs a concrete useful result within the product model.
   actual output. Numeric audio admission, storage and the compact custom input
   implement [#462](https://github.com/TNTcraftHIM/Piik/pull/462)'s use case, with
   local Browser/direct/relay and Browser/native SFU evidence. Next assess
-  source-aspect-preserving geometry and 4K through the same owners. Preserve
+  source-aspect-preserving geometry and 4K through the same owners. Windows
+  output now fits the source without a padded landscape canvas or upscaling;
+  axis-independent limits, Browser/other-platform geometry and product 4K
+  admission remain open. Preserve
   safety limits and framework-owned adaptation. The
   [audio controls](./research/browser-screen-audio-quality.md#numeric-bitrate-assessment)
   retain explicit receive-limit enforcement and the current 320 kbps sender
diff --git a/docs/verification-status.md b/docs/verification-status.md
index 379155b84..09bb444e3 100644
--- a/docs/verification-status.md
+++ b/docs/verification-status.md
@@ -11,7 +11,8 @@ implementation and obsolete package history.
 
 Windows App and Browser are the owner's primary acceptance targets. Current
 Go packages embed their Web assets and do not run a Node backend. The current
-contract is Browser/server v23, Native control v9 and capture v7.
+published contract is Browser/server v23, Native control v9 and capture v7;
+[status](./status.md#current-work) owns unpublished candidate changes.
 
 Bounded current checks cover:
 
diff --git a/native/capture/windows/capture_geometry.h b/native/capture/windows/capture_geometry.h
index 3c1bff3db..90c6ed704 100644
--- a/native/capture/windows/capture_geometry.h
+++ b/native/capture/windows/capture_geometry.h
@@ -4,6 +4,7 @@
 
 #include <algorithm>
 #include <cmath>
+#include <stdexcept>
 
 namespace piik::capture {
 
@@ -40,4 +41,18 @@ inline RECT FitFrameRect(SIZE content, SIZE output) {
   return {left, top, left + width, top + height};
 }
 
+// A quality profile is an output ceiling, not a canvas to pad or upscale into.
+// Keep even dimensions for NV12; WebRTC can further adapt this bounded source.
+inline SIZE BoundedFrameSize(SIZE content, SIZE ceiling) {
+  if (content.cx <= 0 || content.cy <= 0 || ceiling.cx < 2 || ceiling.cy < 2)
+    throw std::invalid_argument("Invalid capture presentation dimensions");
+  const double scale = std::min({1.0,
+      static_cast<double>(ceiling.cx) / content.cx,
+      static_cast<double>(ceiling.cy) / content.cy});
+  return {
+      std::max<LONG>(2, static_cast<LONG>(content.cx * scale) & ~1L),
+      std::max<LONG>(2, static_cast<LONG>(content.cy * scale) & ~1L),
+  };
+}
+
 }  // namespace piik::capture
diff --git a/native/capture/windows/capture_geometry.test.cpp b/native/capture/windows/capture_geometry.test.cpp
index 766d11ab8..c9b75a7ec 100644
--- a/native/capture/windows/capture_geometry.test.cpp
+++ b/native/capture/windows/capture_geometry.test.cpp
@@ -49,5 +49,19 @@ int main() {
               {240, 0, 1680, 1080});
   const RECT wide = FitFrameRect({2560, 1080}, monitor);
   assert(wide.left == 0 && wide.right == 1920 && wide.top > 0 && wide.bottom < 1080);
+  const auto expect_size = [&](SIZE content, SIZE expected) {
+    const SIZE actual = BoundedFrameSize(content, monitor);
+    assert(actual.cx == expected.cx && actual.cy == expected.cy);
+  };
+  expect_size({1080, 1920}, {606, 1080});
+  expect_size({3440, 1440}, {1920, 802});
+  expect_size({640, 480}, {640, 480});
+  expect_size({641, 481}, {640, 480});
+  expect_size({3840, 2160}, monitor);
+  expect_size(presentation(DISPLAYCONFIG_SCALING_STRETCHED), monitor);
+  try {
+    (void)BoundedFrameSize({}, monitor);
+    assert(false);
+  } catch (const std::invalid_argument&) {}
   std::cout << "Windows capture presentation geometry passed.\n";
 }
diff --git a/native/capture/windows/main.cpp b/native/capture/windows/main.cpp
index 640a40c6c..804615e27 100644
--- a/native/capture/windows/main.cpp
+++ b/native/capture/windows/main.cpp
@@ -1471,6 +1471,8 @@ class OutputWorker final {
         }
         std::optional<AdaptiveAccessUnit> output;
         try {
+          const auto size = piik::capture::BoundedFrameSize(input->presentation,
+              {static_cast<LONG>(profile_.width), static_cast<LONG>(profile_.height)});
           if (!encoder) {
             encoder = std::make_unique<AdaptiveEncoder>(
                 kind_, profile_, device_.Get(), create_, std::move(initial), layer_);
@@ -1486,7 +1488,8 @@ class OutputWorker final {
             }
             return converter->Convert(input->texture.Get(), input->width,
                                       input->height, input->presentation, input->color_space);
-          }, profile_.width, profile_.height, input->timestamp, work.recovery, work.bitrate);
+          }, static_cast<UINT32>(size.cx), static_cast<UINT32>(size.cy),
+             input->timestamp, work.recovery, work.bitrate);
         } catch (...) {
           // Device loss is current shared evidence; an old codec failure only
           // retires its activation. No retry occurs without a new activation.
diff --git a/native/capture/windows/output_worker.test.cpp b/native/capture/windows/output_worker.test.cpp
index 2c85e316d..1939f4d37 100644
--- a/native/capture/windows/output_worker.test.cpp
+++ b/native/capture/windows/output_worker.test.cpp
@@ -72,6 +72,7 @@ void CheckWorkerFailureGeneration(ID3D11Device* device, bool replace) {
   auto input = std::make_shared<CaptureInput>();
   input->width = 1280;
   input->height = 720;
+  input->presentation = {1280, 720};
   input->timestamp = 333'333;
   worker.Submit(input);
   assert(began.wait_for(std::chrono::seconds(2)) == std::future_status::ready);
@@ -115,6 +116,36 @@ void CheckPrimaryFailureDetails() {
   assert(rejected);
 }
 
+void CheckWorkerDimensions(ID3D11Device* device, SIZE content, SIZE expected) {
+  HANDLE read = nullptr, write = nullptr;
+  assert(CreatePipe(&read, &write, nullptr, 4096));
+  UniqueHandle input_pipe(read), output_pipe(write);
+  ProtocolWriter writer(write);
+  std::promise<void> output;
+  auto delivered = output.get_future();
+  OutputWorker worker(0, VideoProfile{}, OutputKind::h264, device, writer,
+      [](const VideoProfile&) -> std::unique_ptr<VideoEncoder> {
+        return std::make_unique<FixtureEncoder>(nullptr, std::shared_future<void>{});
+      }, nullptr, true, [&](const EncodedAccessUnit&) { output.set_value(); },
+      [&](std::exception_ptr error) { output.set_exception(error); });
+  auto frame = std::make_shared<CaptureInput>();
+  frame->width = static_cast<UINT32>(content.cx);
+  frame->height = static_cast<UINT32>(content.cy);
+  frame->presentation = content;
+  frame->timestamp = 333'333;
+  worker.Submit(frame);
+  assert(delivered.wait_for(std::chrono::seconds(2)) == std::future_status::ready);
+  delivered.get();
+  worker.Stop();
+  worker.Join();
+  std::array<BYTE, 35> packet{};
+  DWORD received = 0;
+  assert(ReadFile(read, packet.data(), static_cast<DWORD>(packet.size()), &received, nullptr));
+  assert(received == packet.size());
+  assert((packet[24] << 8 | packet[25]) == expected.cx);
+  assert((packet[26] << 8 | packet[27]) == expected.cy);
+}
+
 void CheckH264ProfileCompatibility() {
   const VideoProfile profile;
   for (const auto* value : {"42c01f", "42e01f", "42E01F", "4d801f", "58c01f"})
@@ -302,4 +333,7 @@ int main() {
   CheckAutoCadenceProbe(device.Get());
   CheckWorkerFailureGeneration(device.Get(), false);
   CheckWorkerFailureGeneration(device.Get(), true);
+  CheckWorkerDimensions(device.Get(), {1080, 1920}, {404, 720});
+  CheckWorkerDimensions(device.Get(), {3440, 1440}, {1280, 534});
+  CheckWorkerDimensions(device.Get(), {640, 480}, {640, 480});
 }
diff --git a/scripts/app-media-gate.ts b/scripts/app-media-gate.ts
index 67b803892..9bd1ca647 100644
--- a/scripts/app-media-gate.ts
+++ b/scripts/app-media-gate.ts
@@ -3,6 +3,7 @@ import { copyFile, mkdir, mkdtemp } from "node:fs/promises";
 import { createServer } from "node:http";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
+import { fittedCaptureSize, matchesCaptureSize } from "./media-gate-geometry";
 
 import {
   CdpConnection,
@@ -266,7 +267,7 @@ async function browserMediaGate(input: {
   sourceTitle: string;
   sourceKind: "window" | "display";
   stunUrls: string;
-}): Promise<MediaEvidence> {
+}, geometry: { fit: typeof fittedCaptureSize; matches: typeof matchesCaptureSize }): Promise<MediaEvidence> {
   let socket: WebSocket | null = null;
   const peers: RTCPeerConnection[] = [];
   const result: MediaEvidence = {
@@ -436,10 +437,10 @@ async function browserMediaGate(input: {
       encoderIndex: encoder.index,
       edgeCapacity: 2,
       profile: {
-        resolution: "720p",
+        resolution: "1440p",
         maxFramerate: 30,
         maxBitrate: 3_000_000,
-        degradationPreference: "balanced",
+        degradationPreference: "maintain-resolution",
         maxAudioBitrate: 128000,
       },
     });
@@ -495,6 +496,11 @@ async function browserMediaGate(input: {
         await peer.addIceCandidate(candidate);
       }
       const answer = await peer.createAnswer();
+      // This fixture is an unchanged-Opus receiver, like the product Viewer.
+      // Declare its receive capacity; the offer's fmtp is the opposite direction.
+      const opus = answer.sdp?.match(/^a=rtpmap:(\d+) opus\/48000\/2\r?$/m)?.[1];
+      if (opus) answer.sdp = answer.sdp!.replace(new RegExp(`^(a=fmtp:${opus} [^\\r\\n]*)`, "m"),
+        "$1;stereo=1;maxaveragebitrate=510000");
       await peer.setLocalDescription(answer);
       await request("edge-answer", {
         shareId,
@@ -552,16 +558,16 @@ async function browserMediaGate(input: {
         ? Math.min(...result.edgeAudioBytes)
         : 0;
       const videos = [...edges.values()].map((edge) => edge.video);
-      result.width = videos.every((video) => video.videoWidth === 1280) ? 1280 : 0;
-      result.height = videos.every((video) => video.videoHeight === 720) ? 720 : 0;
+      result.width = videos.every((video) => video.videoWidth === videos[0]!.videoWidth && video.videoWidth <= 2560) ? videos[0]!.videoWidth : 0;
+      result.height = videos.every((video) => video.videoHeight === videos[0]!.videoHeight && video.videoHeight <= 1440) ? videos[0]!.videoHeight : 0;
       if (
         result.captureActive &&
         result.connected &&
         result.frames >= 30 &&
         (!result.audioAvailable ||
           (result.audioPackets > 10 && result.audioEnergy > 0)) &&
-        result.width === 1280 &&
-        result.height === 720 &&
+        result.width >= 320 &&
+        result.height >= 240 &&
         result.nativeCandidateTypes.includes("srflx")
       ) {
         break;
@@ -574,21 +580,24 @@ async function browserMediaGate(input: {
       result.frames < 30 ||
       (result.audioAvailable &&
         (result.audioPackets <= 10 || result.audioEnergy <= 0)) ||
-      result.width !== 1280 ||
-      result.height !== 720 ||
+      result.width < 320 ||
+      result.height < 240 ||
       !result.nativeCandidateTypes.includes("srflx")
     ) {
       throw new Error("Native H264 did not reach decoded Browser video");
     }
 
     const videos = [...edges.values()].map((edge) => edge.video);
+    const sourceSize = { width: result.width, height: result.height };
+    const liveSize = geometry.fit(sourceSize, 1280, 720);
+    const pausedSize = geometry.fit(sourceSize, 854, 480);
     const framesBeforeLiveUpdate = Math.min(
       ...videos.map((video) => video.getVideoPlaybackQuality().totalVideoFrames),
     );
     const liveUpdate = await request("update-share", {
       shareId,
       profile: {
-        resolution: "1440p",
+        resolution: "720p",
         maxFramerate: 60,
         maxBitrate: 12_000_000,
         degradationPreference: "maintain-framerate",
@@ -601,7 +610,7 @@ async function browserMediaGate(input: {
         ...videos.map((video) => video.getVideoPlaybackQuality().totalVideoFrames),
       );
       result.liveProfileUpdated = liveUpdate.type === "share-updated" &&
-        videos.every((video) => video.videoWidth === 2560 && video.videoHeight === 1440) &&
+        videos.every((video) => geometry.matches(video.videoWidth, video.videoHeight, liveSize)) &&
         frames >= framesBeforeLiveUpdate + 10;
       if (result.liveProfileUpdated) break;
       await new Promise((resolveWait) => window.setTimeout(resolveWait, 100));
@@ -631,12 +640,12 @@ async function browserMediaGate(input: {
         ...videos.map((video) => video.getVideoPlaybackQuality().totalVideoFrames),
       );
       result.pausedProfileUpdated = pausedUpdate.type === "share-updated" &&
-        videos.every((video) => video.videoWidth === 854 && video.videoHeight === 480) &&
+        videos.every((video) => geometry.matches(video.videoWidth, video.videoHeight, pausedSize)) &&
         frames >= framesBeforeResume + 10;
       if (result.pausedProfileUpdated) {
         result.frames = frames;
-        result.width = 854;
-        result.height = 480;
+        result.width = videos[0]!.videoWidth;
+        result.height = videos[0]!.videoHeight;
         break;
       }
       await new Promise((resolveWait) => window.setTimeout(resolveWait, 100));
@@ -901,7 +910,7 @@ async function main(): Promise<void> {
         sourceTitle: SOURCE_TITLE,
         sourceKind,
         stunUrls: GATE_STUN_URLS,
-      }) + "))((target) => target)",
+      }) + `, { fit: ${fittedCaptureSize.toString()}, matches: ${matchesCaptureSize.toString()} }))((target) => target)`,
       Date.now() + 70_000,
     );
     if (media.error) throw new Error(media.error);
@@ -925,7 +934,7 @@ async function main(): Promise<void> {
     (!media.audioAvailable ||
       (media.audioPackets > 10 && media.audioEnergy > 0)) &&
     media.liveProfileUpdated && media.pausedProfileUpdated &&
-    media.width === 854 && media.height === 480 &&
+    media.width > 0 && media.width <= 854 && media.height > 0 && media.height <= 480 &&
     media.nativeCandidateTypes.includes("srflx") &&
     cleanup.browserExited && cleanup.nativeExited && cleanup.serverClosed &&
     cleanup.portsClosed && cleanup.profileRemoved;
diff --git a/scripts/app-native-host-gate.ts b/scripts/app-native-host-gate.ts
index 9683c6975..494a7ab15 100644
--- a/scripts/app-native-host-gate.ts
+++ b/scripts/app-native-host-gate.ts
@@ -10,6 +10,7 @@ import { mkdir, mkdtemp, readFile, stat } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
+import { fittedCaptureSize, matchesCaptureSize } from "./media-gate-geometry";
 
 import {
   CdpConnection,
@@ -35,6 +36,11 @@ type GateMode = "local" | "one-link";
 type VideoCodec = "h264" | "vp8";
 
 const CODEC_PROBE = `(() => {
+  const fitSize = ${fittedCaptureSize.toString()}, matchesSize = ${matchesCaptureSize.toString()};
+  window.__piikGateFitsProfile = (width, height) => {
+    const video = document.querySelector('video'), source = window.__piikGateSourceSize;
+    return Boolean(video && source && matchesSize(video.videoWidth, video.videoHeight, fitSize(source, width, height)));
+  };
   const peers = [], BrowserPeer = RTCPeerConnection;
   const sockets = [], BrowserSocket = WebSocket;
   window.WebSocket = class extends BrowserSocket {
@@ -783,6 +789,10 @@ async function main(): Promise<void> {
       5_000,
     );
     stage = "pre-share-codec";
+    // Observe the source at the largest current ceiling before testing smaller
+    // ceilings. Native capture no longer pads/upscales every source to 16:9.
+    await clickHostControl(cdp, host, `document.querySelector('button.lr-chip[aria-label="1440p"]')`);
+    await clickHostControl(cdp, host, `document.querySelector('button[name="degradationPreference"][value="maintain-resolution"]')`);
     await clickHostControl(cdp, host, `document.querySelector('.lr-sharing-technical > summary')`);
     await clickHostControl(cdp, host,
       `([...document.querySelectorAll('button.lr-chip')].find((button) =>
@@ -906,13 +916,16 @@ async function main(): Promise<void> {
           deadline,
         ),
         (state) => state.connected && state.frames >= 30 &&
-          state.width === 1920 && state.height === 1080,
+          state.width >= 320 && state.width <= 2560 && state.height >= 240 && state.height <= 1440,
         40_000,
       );
       result.viewerConnected = viewerState.connected;
       result.viewerFrames = viewerState.frames;
       result.viewerWidth = viewerState.width;
       result.viewerHeight = viewerState.height;
+      await evaluate<void>(cdp, viewer,
+        `window.__piikGateSourceSize = ${JSON.stringify({ width: viewerState.width, height: viewerState.height })}`,
+        Date.now() + 5_000);
       await assertVideoCodec(cdp, viewer, actualCodec);
       if (mode === "one-link") {
         result.codecPreserved = true;
@@ -943,9 +956,7 @@ async function main(): Promise<void> {
           (deadline) => evaluate<boolean>(
             cdp!,
             viewer,
-            `(() => { const video = document.querySelector('video'); return Boolean(
-              video && video.videoWidth === ${width} && video.videoHeight === ${height}
-            ); })()`,
+            `window.__piikGateFitsProfile(${width}, ${height})`,
             deadline,
           ),
           Boolean,
@@ -993,7 +1004,7 @@ async function main(): Promise<void> {
           cdp!,
           viewer,
           `(() => { const video = document.querySelector('video'); return Boolean(
-            video && video.videoWidth === 2560 && video.videoHeight === 1440 &&
+            video && window.__piikGateFitsProfile(2560, 1440) &&
             video.getVideoPlaybackQuality().totalVideoFrames >= ${viewerState.frames + 10}
           ); })()`,
           deadline,
@@ -1004,8 +1015,8 @@ async function main(): Promise<void> {
       if (!result.liveQualityChanged) {
         throw new Error("Native quality change did not reach the Viewer");
       }
-      result.viewerWidth = 2560;
-      result.viewerHeight = 1440;
+      result.viewerWidth = viewerState.width;
+      result.viewerHeight = viewerState.height;
       await assertVideoCodec(cdp, viewer, actualCodec);
       const framesBeforePreference = await evaluate<number>(
         cdp,
@@ -1132,10 +1143,10 @@ async function main(): Promise<void> {
           deadline,
         ),
         (value) => value.frames >= framesBeforeResume + 10 &&
-          value.width === 854 && value.height === 480,
+          matchesCaptureSize(value.width, value.height, fittedCaptureSize(viewerState, 854, 480)),
         20_000,
       );
-      result.pausedQualityChanged = resumed.width === 854 && resumed.height === 480;
+      result.pausedQualityChanged = matchesCaptureSize(resumed.width, resumed.height, fittedCaptureSize(viewerState, 854, 480));
       result.mediaObjectPreserved = resumed.sameMedia;
       result.viewerWidth = resumed.width;
       result.viewerHeight = resumed.height;
@@ -1189,7 +1200,7 @@ async function main(): Promise<void> {
             `(() => {
               const video = document.querySelector('video');
               return Boolean(video && video.srcObject === window.__piikGateMedia &&
-                video.videoWidth === ${width} && video.videoHeight === ${height} &&
+                window.__piikGateFitsProfile(${width}, ${height}) &&
                 video.getVideoPlaybackQuality().totalVideoFrames >= ${before + 10});
             })()`, deadline,
           ), Boolean, 20_000);
@@ -1278,7 +1289,7 @@ async function main(): Promise<void> {
             const video = document.querySelector('video');
             return Boolean(
               video && video.srcObject === window.__piikGateMedia &&
-              video.videoWidth === 854 && video.videoHeight === 480 &&
+              video.videoWidth > 0 && video.videoWidth <= 854 && video.videoHeight > 0 && video.videoHeight <= 480 &&
               video.getVideoPlaybackQuality().totalVideoFrames >= ${framesBeforeSourceChange + 10}
             );
           })()`,
@@ -1386,7 +1397,7 @@ async function main(): Promise<void> {
             const video = document.querySelector('video');
             return Boolean(video && video.srcObject &&
               video.srcObject !== window.__piikGateMedia &&
-              video.videoWidth === 854 && video.videoHeight === 480);
+              video.videoWidth > 0 && video.videoWidth <= 854 && video.videoHeight > 0 && video.videoHeight <= 480);
           })()`,
           deadline,
         ),
@@ -1460,7 +1471,8 @@ async function main(): Promise<void> {
         result.remoteNatPath && result.remotePeerExited === true
       : mode === "one-link"
         ? result.publicViewerPage && result.publicViewerSignal && result.viewerConnected &&
-          result.viewerFrames >= 30 && result.viewerWidth === 1920 && result.viewerHeight === 1080 && result.codecPreserved
+          result.viewerFrames >= 30 && result.viewerWidth > 0 && result.viewerWidth <= 2560 &&
+          result.viewerHeight > 0 && result.viewerHeight <= 1440 && result.codecPreserved
         : result.viewerConnected && result.viewerFrames >= 30 &&
         result.qualityControlsEnabled && result.liveQualityChanged &&
         result.backgroundProfileRecovery !== false &&
@@ -1469,7 +1481,7 @@ async function main(): Promise<void> {
         result.codecPreserved &&
         result.pausedQualityChanged && result.mediaObjectPreserved &&
         result.nativeSourceChanged &&
-        result.viewerWidth === 854 && result.viewerHeight === 480 &&
+        result.viewerWidth > 0 && result.viewerWidth <= 854 && result.viewerHeight > 0 && result.viewerHeight <= 480 &&
         result.nativeQualityEvidence &&
         (crashGate
           ? result.appCrashEndedShare === true
diff --git a/scripts/embedded-sfu-gate.ts b/scripts/embedded-sfu-gate.ts
index a6d0fbc78..2da845877 100644
--- a/scripts/embedded-sfu-gate.ts
+++ b/scripts/embedded-sfu-gate.ts
@@ -12,6 +12,7 @@ import {
 import type { snapshot } from "./embedded-sfu-page";
 import { readAppEndpoint } from "./app-gate-endpoint";
 import { SOURCE_TITLE, sourceServer, startSourceBrowser, waitForCaptureWindow } from "./app-native-host-gate";
+import { fittedCaptureSize } from "./media-gate-geometry";
 
 const ROOT = resolve(import.meta.dirname, "..");
 const BUILD_ROOT = join(ROOT, "build", "embedded-media");
@@ -251,7 +252,7 @@ async function main(): Promise<void> {
       await until(secondHost, (value) => value.authenticated);
       await call(secondViewer, `gate.startViewer(${JSON.stringify(secondRoom)})`);
       await until(secondViewer, (value) => value.committed && value.audioKbps > 0);
-      await call(secondViewer, "gate.waitForFrames(1280, 720)");
+      await call(secondViewer, "gate.waitForFrames(1280, 720, 15, true)");
       await waitForSample(() => call<number>(secondViewer!, "gate.audioEnergy()", 3_000),
         (energy) => { result.secondRoom!.audioBefore = energy; return energy > 0; }, 5_000);
       const second = await call<Snapshot>(secondHost, "gate.snapshot()");
@@ -266,7 +267,7 @@ async function main(): Promise<void> {
       : null;
     const sourceBefore = await sourceSample();
     try {
-      result.high = await call(viewer, nativeArm ? "gate.waitForFrames(1280, 720, 300)" : "gate.waitForFrames(1280, 720)", nativeArm ? 32_000 : 25_000);
+      result.high = await call(viewer, nativeArm ? "gate.waitForFrames(1280, 720, 300, true)" : "gate.waitForFrames(1280, 720)", nativeArm ? 32_000 : 25_000);
     } finally {
       const sourceAfter = await sourceSample().catch(() => null);
       if (sourceBefore && sourceAfter) result.sourceDrawing = {
@@ -285,7 +286,7 @@ async function main(): Promise<void> {
     let previousEnergy = result.audioEnergy.high;
     for (const bitrate of [320_000, 96_000]) {
       if (!await call<boolean>(host, `gate.setAudioBitrate(${bitrate})`)) throw new Error("Numeric audio update failed");
-      const frames = await call<{ frames: number }>(viewer, "gate.waitForFrames(1280, 720)");
+      const frames = await call<{ frames: number }>(viewer, `gate.waitForFrames(${result.high!.width}, ${result.high!.height})`);
       const after = await call<Snapshot>(viewer, "gate.snapshot()");
       const energy = await call<number>(viewer, "gate.audioEnergy()", 3_000);
       const retained = after.connectionId === audioConnection && after.committed;
@@ -326,7 +327,8 @@ async function main(): Promise<void> {
       result.host = await call(host, "gate.snapshot()");
       throw new Error("Live profile update failed");
     }
-    result.low = await call(viewer, "gate.waitForFrames(854, 480)");
+    const lowSize = nativeArm ? fittedCaptureSize(result.high!, 854, 480) : { width: 854, height: 480 };
+    result.low = await call(viewer, `gate.waitForFrames(${lowSize.width}, ${lowSize.height}, 15, false, ${nativeArm ? 2 : 0})`);
     await waitForSample(() => call<number>(viewer!, "gate.audioEnergy()", 3_000),
       (energy) => { result.audioEnergy.low = energy; return energy > result.audioEnergy.high; }, 5_000);
     result.stage = "viewer-media-reload";
@@ -335,7 +337,7 @@ async function main(): Promise<void> {
     // still retains the old committed edge inside the reconnect grace period.
     await call(viewer, `gate.reconnectViewer(${JSON.stringify(room)}, true)`);
     await until(viewer, value => value.committed && value.connectionId !== retainedSubscription && value.audioKbps > 0);
-    await call(viewer, "gate.waitForFrames(854, 480)");
+    await call(viewer, `gate.waitForFrames(${result.low!.width}, ${result.low!.height})`);
     result.pageReloadRecovered = true;
     result.stage = "committed-subscription-recovery";
     const previousSubscription = await call<string>(viewer, "gate.failSubscription()");
@@ -344,7 +346,7 @@ async function main(): Promise<void> {
     await until(viewer, value => value.routeStatus === "failed");
     await call(viewer, `gate.reconnectViewer(${JSON.stringify(room)})`);
     await until(viewer, value => value.committed && value.connectionId !== previousSubscription && value.audioKbps > 0);
-    await call(viewer, "gate.waitForFrames(854, 480)");
+    await call(viewer, `gate.waitForFrames(${result.low!.width}, ${result.low!.height})`);
     await waitForSample(() => call<number>(viewer!, "gate.audioEnergy()", 3_000),
       energy => { result.audioEnergy.recovered = energy; return energy > 0; }, 5_000);
     result.viewer = await call(viewer, "gate.snapshot()");
@@ -360,7 +362,7 @@ async function main(): Promise<void> {
       if (!(await call<Snapshot>(host, "gate.snapshot()")).nativeShareStopped) throw new Error("First Native capture did not stop");
       result.secondRoom!.audioBefore = await call<number>(secondViewer, "gate.audioEnergy()");
       await cdp.call("Page.bringToFront", {}, secondViewer.sessionId, Date.now() + 3_000);
-      const continued = await call<{ frames: number }>(secondViewer, "gate.waitForFrames(1280, 720, 30)");
+      const continued = await call<{ frames: number }>(secondViewer, `gate.waitForFrames(${result.high!.width}, ${result.high!.height}, 30)`);
       result.secondRoom!.framesAfterFirstStopped = continued.frames;
       await waitForSample(() => call<number>(secondViewer!, "gate.audioEnergy()", 3_000),
         (energy) => { result.secondRoom!.audioAfter = energy; return energy > result.secondRoom!.audioBefore; }, 5_000);
diff --git a/scripts/embedded-sfu-page.ts b/scripts/embedded-sfu-page.ts
index dba5c67c7..1efa47f29 100644
--- a/scripts/embedded-sfu-page.ts
+++ b/scripts/embedded-sfu-page.ts
@@ -350,7 +350,7 @@ export async function setAudioBitrate(maxAudioBitrate: number): Promise<boolean>
   return true;
 }
 
-export async function waitForFrames(width: number, height: number, minimumFrames = 15) {
+export async function waitForFrames(width: number, height: number, minimumFrames = 15, withinCeiling = false, tolerance = 0) {
   if (!video) throw new Error("Viewer video is unavailable");
   const target = video;
   return await new Promise<{ frames: number; width: number; height: number }>((resolve, reject) => {
@@ -362,7 +362,10 @@ export async function waitForFrames(width: number, height: number, minimumFrames
     }, minimumFrames > 15 ? 30_000 : 20_000);
     const next = () => {
       callback = target.requestVideoFrameCallback(() => {
-        frames = target.videoWidth === width && target.videoHeight === height ? frames + 1 : 0;
+        const matches = withinCeiling
+          ? target.videoWidth >= 320 && target.videoHeight >= 240 && target.videoWidth <= width && target.videoHeight <= height
+          : Math.abs(target.videoWidth - width) <= tolerance && Math.abs(target.videoHeight - height) <= tolerance;
+        frames = matches ? frames + 1 : 0;
         if (frames < minimumFrames) return next();
         clearTimeout(timer);
         resolve({ frames, width: target.videoWidth, height: target.videoHeight });
diff --git a/scripts/media-gate-geometry.ts b/scripts/media-gate-geometry.ts
new file mode 100644
index 000000000..1d388ee5e
--- /dev/null
+++ b/scripts/media-gate-geometry.ts
@@ -0,0 +1,11 @@
+// Gate expectations derive from the decoded source instead of assuming a 16:9
+// canvas. Two pixels allow independent NV12 rounding at successive ceilings.
+export function fittedCaptureSize(source: { width: number; height: number }, width: number, height: number) {
+  const scale = Math.min(1, width / source.width, height / source.height);
+  return { width: Math.max(2, Math.floor(source.width * scale / 2) * 2),
+    height: Math.max(2, Math.floor(source.height * scale / 2) * 2) };
+}
+
+export function matchesCaptureSize(width: number, height: number, expected: { width: number; height: number }) {
+  return width > 0 && height > 0 && Math.abs(width - expected.width) <= 2 && Math.abs(height - expected.height) <= 2;
+}

From 8b46d7c59930bba7709f84997d5dcb67c3893f2f Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 16:12:06 +0800
Subject: [PATCH 069/262] test(media): declare Opus limits in native and SFU
 receive fixtures

---
 internal/app/nativehost/audio_test.go            | 13 +++++++++++++
 internal/server/signal/router_sfu_signal_test.go | 14 ++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/internal/app/nativehost/audio_test.go b/internal/app/nativehost/audio_test.go
index f2fc435ee..51bd8725a 100644
--- a/internal/app/nativehost/audio_test.go
+++ b/internal/app/nativehost/audio_test.go
@@ -150,6 +150,19 @@ func TestAudioEOFWaitsForExplicitSourceReplacement(t *testing.T) {
 	offer, err := session.PrepareLocalEdge("audio-edge")
 	check(err)
 	check(receiver.SetRemoteDescription(offer))
+	// A receive preference belongs to this answer, not the upstream offer.
+	for _, transceiver := range receiver.GetTransceivers() {
+		if transceiver.Kind() != webrtc.RTPCodecTypeAudio {
+			continue
+		}
+		for _, codec := range transceiver.Receiver().GetParameters().Codecs {
+			if codec.MimeType == webrtc.MimeTypeOpus {
+				codec.SDPFmtpLine = "stereo=1;maxaveragebitrate=510000"
+				check(transceiver.SetCodecPreferences([]webrtc.RTPCodecParameters{codec}))
+				break
+			}
+		}
+	}
 	go func() {
 		for {
 			select {
diff --git a/internal/server/signal/router_sfu_signal_test.go b/internal/server/signal/router_sfu_signal_test.go
index f8068c576..e5e92f4bc 100644
--- a/internal/server/signal/router_sfu_signal_test.go
+++ b/internal/server/signal/router_sfu_signal_test.go
@@ -210,6 +210,20 @@ func TestEmbeddedSfuAuthenticatedWebSocketCarriesActualRTP(t *testing.T) {
 		}
 	})
 	applyRemote(viewer, subscriber, viewerConfig, false)
+	// SFU reserves its audio track for later source/microphone changes. Match
+	// the product Viewer's receive preference even while this fixture is silent.
+	for _, transceiver := range subscriber.GetTransceivers() {
+		if transceiver.Kind() != webrtc.RTPCodecTypeAudio {
+			continue
+		}
+		for _, codec := range transceiver.Receiver().GetParameters().Codecs {
+			if codec.MimeType == webrtc.MimeTypeOpus {
+				codec.SDPFmtpLine = "stereo=1;maxaveragebitrate=510000"
+				check(transceiver.SetCodecPreferences([]webrtc.RTPCodecParameters{codec}))
+				break
+			}
+		}
+	}
 	answer, err := subscriber.CreateAnswer(nil)
 	check(err)
 	sendDescription(viewer, viewerConfig, gather(subscriber, answer), nil)

From 97f4066c9fe2c5597ea8f91fd379121606f24508 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 16:23:25 +0800
Subject: [PATCH 070/262] refactor(capture): validate numeric profiles
 independently of UI presets

---
 docs/research/native-client-media.md          | 14 +++++++------
 internal/app/nativecapture/protocol_test.go   | 16 ++++++++++++++-
 internal/app/nativecapture/stream.go          | 10 ++++------
 native/capture/darwin/main.swift              | 20 +++++++++----------
 native/capture/linux/main.c                   | 18 ++++++++---------
 native/capture/linux/main.test.c              | 18 +++++++++++++++++
 native/capture/windows/capture_geometry.h     |  5 +++++
 native/capture/windows/main.cpp               | 11 +++-------
 native/capture/windows/output_worker.test.cpp | 17 ++++++++++------
 9 files changed, 83 insertions(+), 46 deletions(-)

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 82508f7c0..441259ecb 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -556,12 +556,14 @@ changes, Viewer reload/recovery and cleanup. Gate expectations now derive from
 the observed source and selected ceilings, instead of requiring encoded 16:9
 padding. Physical game, macOS/Linux and orientation-change acceptance remain open.
 
-The restriction extends beyond resolution labels: shared readers also bound
-frame rate and bitrate, and Native's selectable profile admits four exact raster
-pairs while derived outputs admit other dimensions within axis-specific limits.
-These are different meanings. Keep explicit resource ceilings, but assess them
-separately from presets and device capability; arbitrary numbers are not the
-replacement contract.
+The candidate's Native capture admission now shares the numeric dimension
+bounds already used by encoded outputs instead of duplicating the four UI
+presets. Even dimensions must fit within 2560x1440; a source ceiling must also
+yield a valid half-size output. Frame-rate, bitrate and output-count bounds
+remain unchanged. Signaling still uses the existing resolution enum: custom
+dimensions are an internal foundation, not yet a product control or a 4K option.
+Device capability and the public request contract still need separate admission;
+removing an enum is not permission to allocate arbitrary media resources.
 
 The proposed boundary follows the
 [Media Capture specification](https://www.w3.org/TR/mediacapture-streams/#constrainable-interface):
diff --git a/internal/app/nativecapture/protocol_test.go b/internal/app/nativecapture/protocol_test.go
index d38628432..b356ada63 100644
--- a/internal/app/nativecapture/protocol_test.go
+++ b/internal/app/nativecapture/protocol_test.go
@@ -290,13 +290,27 @@ func TestVideoProfileUsesTheProductBounds(t *testing.T) {
 		{Width: 1280, Height: 720, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
 		{Width: 1920, Height: 1080, Framerate: 60, Bitrate: 8_000_000, Preference: "maintain-framerate"},
 		{Width: 2560, Height: 1440, Framerate: 60, Bitrate: 12_000_000, Preference: "balanced"},
+		{Width: 1920, Height: 1200, Framerate: 30, Bitrate: 5_000_000, Preference: "balanced"},
+		{Width: 720, Height: 1280, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: 4, Height: 4, Framerate: 15, Bitrate: 2_000_000, Preference: "balanced"},
 	} {
 		if !profile.Valid() {
 			t.Fatalf("valid profile rejected: %+v", profile)
 		}
+		for _, output := range ScreenShareOutputs(profile) {
+			if !output.Valid() {
+				t.Fatalf("valid source profile produced an invalid output: %+v", output)
+			}
+		}
 	}
 	for _, profile := range []VideoProfile{
-		{Width: 1920, Height: 1200, Framerate: 30, Bitrate: 5_000_000, Preference: "balanced"},
+		{Width: 0, Height: 720, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: 2, Height: 720, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: 1280, Height: 2, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: 1279, Height: 720, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: 1280, Height: 719, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: 2562, Height: 1440, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: 2560, Height: 1442, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
 		{Width: 1920, Height: 1080, Framerate: 14, Bitrate: 5_000_000, Preference: "balanced"},
 		{Width: 1920, Height: 1080, Framerate: 30, Bitrate: 12_000_001, Preference: "balanced"},
 		{Width: 1920, Height: 1080, Framerate: 30, Bitrate: 5_000_000, Preference: "unknown"},
diff --git a/internal/app/nativecapture/stream.go b/internal/app/nativecapture/stream.go
index 0df559bb3..205eb63d9 100644
--- a/internal/app/nativecapture/stream.go
+++ b/internal/app/nativecapture/stream.go
@@ -109,12 +109,10 @@ func ScreenShareOutputs(profile VideoProfile) []OutputProfile {
 }
 
 func (profile VideoProfile) Valid() bool {
-	validResolution :=
-		(profile.Width == 854 && profile.Height == 480) ||
-			(profile.Width == 1280 && profile.Height == 720) ||
-			(profile.Width == 1920 && profile.Height == 1080) ||
-			(profile.Width == 2560 && profile.Height == 1440)
-	return validResolution && profile.Framerate >= 15 && profile.Framerate <= 60 &&
+	// The source ceiling must also yield a valid half-size output. Preset labels
+	// belong to the UI, not the capture process's numeric resource boundary.
+	return ValidVideoSize(profile.Width, profile.Height) && profile.Width >= 4 && profile.Height >= 4 &&
+		profile.Framerate >= 15 && profile.Framerate <= 60 &&
 		profile.Bitrate >= 2_000_000 && profile.Bitrate <= 12_000_000 &&
 		validVideoPreference(profile.Preference)
 }
diff --git a/native/capture/darwin/main.swift b/native/capture/darwin/main.swift
index fc4986a7c..05a72adbb 100644
--- a/native/capture/darwin/main.swift
+++ b/native/capture/darwin/main.swift
@@ -1340,6 +1340,11 @@ private func captureFilter(
     throw CaptureFailure(description: "capture target kind is unsupported")
 }
 
+private func validVideoSize(_ width: Int, _ height: Int) -> Bool {
+    width >= 2 && width <= 2560 && width % 2 == 0 &&
+        height >= 2 && height <= 1440 && height % 2 == 0
+}
+
 private func videoProfile(_ arguments: [String]) throws -> VideoProfile {
     guard arguments.count >= 28,
           arguments[10] == "--width", let width = Int(arguments[11]),
@@ -1353,12 +1358,8 @@ private func videoProfile(_ arguments: [String]) throws -> VideoProfile {
           arguments[22] == "--protocol-v7" else {
         throw CaptureFailure(description: "invalid video profile arguments")
     }
-    let validResolution =
-        (width == 854 && height == 480) ||
-        (width == 1280 && height == 720) ||
-        (width == 1920 && height == 1080) ||
-        (width == 2560 && height == 1440)
-    guard validResolution, frameRate >= 15, frameRate <= 60,
+    guard validVideoSize(width, height), width >= 4, height >= 4,
+          frameRate >= 15, frameRate <= 60,
           bitrate >= 2_000_000, bitrate <= 12_000_000 else {
         throw CaptureFailure(description: "video profile is outside the product bounds")
     }
@@ -1384,8 +1385,8 @@ private func outputProfiles(_ arguments: [String], start: Int = 23,
               let height = Int(arguments[index + 2]),
               let fps = Int32(arguments[index + 3]),
               let bitrate = Int(arguments[index + 4]),
-              width >= 2, width <= (source?.width ?? 2560), width % 2 == 0,
-              height >= 2, height <= (source?.height ?? 1440), height % 2 == 0,
+              validVideoSize(width, height),
+              width <= (source?.width ?? 2560), height <= (source?.height ?? 1440),
               fps >= 1, fps <= (source?.frameRate ?? 60),
               bitrate >= 1000, bitrate <= (source?.bitrate ?? 12_000_000) else {
             throw CaptureFailure(description: "output profile is outside source bounds")
@@ -1438,8 +1439,7 @@ private func readInput(done: StopSignal, outputs: [OutputProfile] = [],
                     let timestamp = number(8..<16), duration = number(16..<24)
                     let width = number(24..<26), height = number(26..<28)
                     guard size <= maxPayloadBytes, header[6] <= 1, header[7] == 0,
-                          width >= 2, width <= 2560, width % 2 == 0,
-                          height >= 2, height <= 1440, height % 2 == 0,
+                          validVideoSize(Int(width), Int(height)),
                           timestamp <= UInt64(Int64.max) / 100,
                           duration > 0, duration <= UInt64(Int64.max) / 100,
                           let payload = try readExactly(size) else {
diff --git a/native/capture/linux/main.c b/native/capture/linux/main.c
index dd6c75427..5315881e5 100644
--- a/native/capture/linux/main.c
+++ b/native/capture/linux/main.c
@@ -370,6 +370,11 @@ static gboolean parse_uint(const char *value, guint minimum, guint maximum,
   return TRUE;
 }
 
+static gboolean valid_video_size(guint width, guint height) {
+  return width >= 2 && width <= 2560 && width % 2 == 0 &&
+         height >= 2 && height <= 1440 && height % 2 == 0;
+}
+
 static gboolean parse_outputs(int count, char **values, guint start, CaptureRun *run) {
   if (count <= (int)start || (count - (int)start) % 5 != 0 ||
       (count - (int)start) / 5 > kMaxOutputs) return FALSE;
@@ -389,7 +394,7 @@ static gboolean parse_outputs(int count, char **values, guint start, CaptureRun
         !parse_uint(values[offset + 2], 2, 1440, &output->profile.height) ||
         !parse_uint(values[offset + 3], 1, 60, &output->profile.frame_rate) ||
         !parse_uint(values[offset + 4], 1000, 12000000, &output->profile.bit_rate) ||
-        output->profile.width % 2 != 0 || output->profile.height % 2 != 0) return FALSE;
+        !valid_video_size(output->profile.width, output->profile.height)) return FALSE;
   }
   return TRUE;
 }
@@ -443,12 +448,8 @@ static gboolean parse_profile(int count, char **values, CaptureRun *run,
       !parse_uint(values[17], 2000000, 12000000, &profile->bit_rate)) {
     return FALSE;
   }
-  gboolean resolution =
-      (profile->width == 854 && profile->height == 480) ||
-      (profile->width == 1280 && profile->height == 720) ||
-      (profile->width == 1920 && profile->height == 1080) ||
-      (profile->width == 2560 && profile->height == 1440);
-  if (!resolution) return FALSE;
+  if (!valid_video_size(profile->width, profile->height) ||
+      profile->width < 4 || profile->height < 4) return FALSE;
   if (!parse_preference(values[19], profile) || !parse_outputs(count, values, 23, run)) return FALSE;
   run->original_output = MIN(1, run->output_count - 1);
   const VideoProfile *original = &run->outputs[run->original_output].profile;
@@ -747,8 +748,7 @@ static gboolean valid_input_header(CaptureRun *run) {
       run->input_size == 0 || run->input_size > kMaxPayloadBytes) return FALSE;
   guint width = (guint)read_be(header + 24, 2), height = (guint)read_be(header + 26, 2);
   guint64 timestamp = read_be(header + 8, 8), duration = read_be(header + 16, 8);
-  return width >= 2 && width <= 2560 && height >= 2 && height <= 1440 &&
-         width % 2 == 0 && height % 2 == 0 && duration > 0 &&
+  return valid_video_size(width, height) && duration > 0 &&
          timestamp <= INT64_MAX / 100 && duration <= INT64_MAX / 100;
 }
 
diff --git a/native/capture/linux/main.test.c b/native/capture/linux/main.test.c
index 142a04748..1052c9b82 100644
--- a/native/capture/linux/main.test.c
+++ b/native/capture/linux/main.test.c
@@ -152,6 +152,24 @@ static void check_slot_profiles(void) {
   for (guint index = 0; index < run.output_count; ++index) {
     g_assert_false(run.outputs[index].enabled);
   }
+
+  char *numeric[] = {
+      "capture", "--capture-video", "picker", "1", "0", "0",
+      "--adapter-index", "0", "--mft-index", "0", "--width", "1920",
+      "--height", "1200", "--fps", "30", "--bitrate", "3000000",
+      "--preference", "balanced", "--codec", "h264", "--protocol-v7",
+      "--output", "1920", "1200", "30", "3000000"};
+  const struct { char *width; char *height; gboolean valid; } sizes[] = {
+      {"1920", "1200", TRUE}, {"720", "1280", TRUE}, {"4", "4", TRUE},
+      {"0", "720", FALSE}, {"2", "720", FALSE}, {"1280", "2", FALSE},
+      {"1279", "720", FALSE}, {"1280", "719", FALSE},
+      {"2562", "1440", FALSE}, {"2560", "1442", FALSE}, {"3840", "2160", FALSE}};
+  for (guint index = 0; index < G_N_ELEMENTS(sizes); ++index) {
+    numeric[11] = numeric[24] = sizes[index].width;
+    numeric[13] = numeric[25] = sizes[index].height;
+    run = (CaptureRun){0};
+    g_assert_cmpint(parse_profile(G_N_ELEMENTS(numeric), numeric, &run, &encoder), ==, sizes[index].valid);
+  }
 }
 
 static GstPadProbeReturn record_key_request(GstPad *pad, GstPadProbeInfo *info,
diff --git a/native/capture/windows/capture_geometry.h b/native/capture/windows/capture_geometry.h
index 90c6ed704..d73729873 100644
--- a/native/capture/windows/capture_geometry.h
+++ b/native/capture/windows/capture_geometry.h
@@ -8,6 +8,11 @@
 
 namespace piik::capture {
 
+inline bool ValidVideoSize(UINT32 width, UINT32 height) {
+  return width >= 2 && width <= 2560 && !(width & 1) &&
+         height >= 2 && height <= 1440 && !(height & 1);
+}
+
 inline SIZE DisplayedFrameSize(SIZE captured, SIZE desktop, SIZE target,
                                DISPLAYCONFIG_SCALING scaling,
                                DISPLAYCONFIG_ROTATION rotation) {
diff --git a/native/capture/windows/main.cpp b/native/capture/windows/main.cpp
index 804615e27..b80b1261e 100644
--- a/native/capture/windows/main.cpp
+++ b/native/capture/windows/main.cpp
@@ -966,12 +966,8 @@ DegradationPreference ParseDegradationPreference(const wchar_t* value) {
 }
 
 void ValidateVideoProfile(const VideoProfile& profile) {
-  const bool valid_resolution =
-      (profile.width == 854 && profile.height == 480) ||
-      (profile.width == 1280 && profile.height == 720) ||
-      (profile.width == 1920 && profile.height == 1080) ||
-      (profile.width == 2560 && profile.height == 1440);
-  if (!valid_resolution || profile.frame_rate < 15 || profile.frame_rate > 60 ||
+  if (!piik::capture::ValidVideoSize(profile.width, profile.height) ||
+      profile.width < 4 || profile.height < 4 || profile.frame_rate < 15 || profile.frame_rate > 60 ||
       profile.bit_rate < 2'000'000 || profile.bit_rate > 12'000'000) {
     Fail("argument-profile", "video profile is outside the product bounds");
   }
@@ -985,8 +981,7 @@ void ParseOutputProfiles(ProductArguments& arguments, int first, int count, wcha
     output.height = ParseIndex(values[index + 2], "argument-output-height");
     output.frame_rate = ParseIndex(values[index + 3], "argument-output-fps");
     output.bit_rate = ParseIndex(values[index + 4], "argument-output-bitrate");
-    if (output.width < 2 || output.height < 2 || (output.width & 1) || (output.height & 1) ||
-        output.width > 2560 || output.height > 1440 || output.frame_rate == 0 ||
+    if (!piik::capture::ValidVideoSize(output.width, output.height) || output.frame_rate == 0 ||
         output.frame_rate > 60 || output.bit_rate < 1'000 || output.bit_rate > 12'000'000) {
       Fail("argument-output", "output profile exceeds codec bounds");
     }
diff --git a/native/capture/windows/output_worker.test.cpp b/native/capture/windows/output_worker.test.cpp
index 1939f4d37..f74a6cc4d 100644
--- a/native/capture/windows/output_worker.test.cpp
+++ b/native/capture/windows/output_worker.test.cpp
@@ -315,12 +315,17 @@ int main() {
   assert(profile.h264_level() == 51 && profile.profile_level_id() == "42c033");
   profile = VideoProfile{1920, 1080, 60, 8'000'000};
   assert(profile.h264_level() == 42);
-  profile = VideoProfile{3840, 2160, 30, 12'000'000};
-  try {
-    ValidateVideoProfile(profile);
-    assert(false);
-  } catch (const GateFailure& error) {
-    assert(error.stage() == "argument-profile");
+  for (const SIZE size : {SIZE{1920, 1200}, SIZE{720, 1280}, SIZE{4, 4}}) {
+    ValidateVideoProfile(VideoProfile{static_cast<UINT32>(size.cx), static_cast<UINT32>(size.cy), 30, 3'000'000});
+  }
+  for (const SIZE size : {SIZE{0, 720}, SIZE{2, 720}, SIZE{1280, 2}, SIZE{1279, 720},
+                          SIZE{1280, 719}, SIZE{2562, 1440}, SIZE{2560, 1442}, SIZE{3840, 2160}}) {
+    try {
+      ValidateVideoProfile(VideoProfile{static_cast<UINT32>(size.cx), static_cast<UINT32>(size.cy), 30, 3'000'000});
+      assert(false);
+    } catch (const GateFailure& error) {
+      assert(error.stage() == "argument-profile");
+    }
   }
   CheckEncoderCandidates();
   CheckH264ProfileCompatibility();

From eca6ea88b9c3d615d974f9a2b0d44e356ef3990f Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 16:35:53 +0800
Subject: [PATCH 071/262] fix(capture): preserve source geometry through Linux
 scaling

---
 docs/research/native-client-media.md | 11 ++++-
 docs/standards/media-quality.md      | 10 ++--
 docs/status.md                       |  4 +-
 docs/todo.md                         |  6 +--
 native/capture/linux/README.md       | 10 +++-
 native/capture/linux/main.c          | 40 +++++++++++++---
 native/capture/linux/main.test.c     | 70 +++++++++++++++++++++++++++-
 7 files changed, 131 insertions(+), 20 deletions(-)

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 441259ecb..9b24329e0 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -536,7 +536,16 @@ ceiling. A 640x480 source stays 640x480; portrait and ultrawide sources no longe
 require an encoded landscape canvas. The converter, adaptation owner, output
 generation and frame envelope are reused. Axis-specific limits still apply;
 this does not yet give portrait capture a transposed ceiling or add a 4K setting.
-Browser and other platform geometry remain separate pending work.
+Browser and macOS geometry remain separate pending work.
+
+Linux uses the existing [GStreamer scaler](https://gstreamer.freedesktop.org/documentation/videoconvertscale/videoscale.html)
+with bounded even-dimension ranges instead of fixed output dimensions. Square
+pixel negotiation retains presentation aspect without a padded canvas; encoded
+samples provide the actual dimensions for the frame envelope. The headless
+control changes portrait, ultrawide, small, odd-sized and square inputs within
+one pipeline, checks the output ceiling and image corners, and exercises the
+smallest derived output. Compilation and those regressions passed on Linux;
+Portal capture and hardware encoder resizing still need a physical device.
 
 Local synthetic-input controls exercised that production worker through four
 successive source sizes: 1080x1920, 3440x1440, 640x480 and 1920x1080. Under the
diff --git a/docs/standards/media-quality.md b/docs/standards/media-quality.md
index 2ab476242..747d746a3 100644
--- a/docs/standards/media-quality.md
+++ b/docs/standards/media-quality.md
@@ -42,10 +42,12 @@ contract. [Status](../status.md) indexes delivery and remaining acceptance.
   frame matches its desktop source dimensions. Other frames retain their own
   aspect ratio. This changes only the encoded presentation, never the game or
   display settings; vendor-private scaling is not inferred.
-  Each Windows output fits that presentation within its selected ceiling using
-  even dimensions, without enlarging the source or encoding a fixed landscape
-  canvas. The existing WebRTC encoder may adapt further; source resizing does
-  not create a new room or route. Frame envelopes carry actual output dimensions.
+- Windows and Linux outputs preserve source presentation aspect within the
+  selected ceiling, rounded to even dimensions. Small sources are not enlarged
+  to a fixed landscape canvas. Windows uses its existing converter; Linux uses
+  GStreamer's size negotiation. Source resizing does not create a new room or
+  route, and frame envelopes carry actual output dimensions. Network adaptation
+  remains owned by the existing media framework.
 - Windows SDR conversion owns one output color contract: limited-range BT.601
   NV12 with matching H.264 metadata. RGB capture and decoded video retain their
   input range/matrix through conversion and relay scaling; dimensions do not
diff --git a/docs/status.md b/docs/status.md
index b0158532a..dd2090f09 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -65,8 +65,8 @@ Numeric audio is implemented in the unpublished candidate: Browser/server v24
 and Native control v10 replace the preset field; capture v7 and SQLite schema 2
 remain unchanged. Matched candidate App/Web/Server builds are required;
 1.x participants are rejected by the existing compatibility checks.
-Windows output now preserves the source shape within the existing ceiling;
-axis-independent limits, other-platform geometry, 4K and additional codecs are
+Windows and Linux output now preserve source shape within the existing ceiling;
+axis-independent limits, Browser/macOS geometry, 4K and additional codecs are
 still assessed through the media boundary.
 Native Magicsock remains an isolated experiment with incomplete product
 integration and unresolved recovery cases. These proposals do not yet change
diff --git a/docs/todo.md b/docs/todo.md
index b0a79896c..4f25a088a 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -50,9 +50,9 @@ Implementation needs a concrete useful result within the product model.
   actual output. Numeric audio admission, storage and the compact custom input
   implement [#462](https://github.com/TNTcraftHIM/Piik/pull/462)'s use case, with
   local Browser/direct/relay and Browser/native SFU evidence. Next assess
-  source-aspect-preserving geometry and 4K through the same owners. Windows
-  output now fits the source without a padded landscape canvas or upscaling;
-  axis-independent limits, Browser/other-platform geometry and product 4K
+  source-aspect-preserving geometry and 4K through the same owners. Windows and
+  Linux outputs now fit the source without a fixed padded landscape canvas;
+  axis-independent limits, Browser/macOS geometry and product 4K
   admission remain open. Preserve
   safety limits and framework-owned adaptation. The
   [audio controls](./research/browser-screen-audio-quality.md#numeric-bitrate-assessment)
diff --git a/native/capture/linux/README.md b/native/capture/linux/README.md
index 6428e97c5..814348841 100644
--- a/native/capture/linux/README.md
+++ b/native/capture/linux/README.md
@@ -20,10 +20,11 @@ sh native/capture/linux/build.sh /outside/repository/build
 ```
 
 Run `npm run check:native` on Linux to compile the sidecar, run the headless
-output-profile, segment-timestamp and retirement regressions, and validate its probe/source list.
+output-profile, source-geometry, segment-timestamp and retirement regressions,
+and validate its probe/source list.
 The same check runs when the Linux CI job packages an App candidate. For the
 native build and regression alone, add `--check` to the command above. The test
-uses GStreamer's core synthetic elements and needs no display, Portal session,
+uses synthetic input and GStreamer's core/base elements and needs no display, Portal session,
 capture device or hardware encoder; physical capture remains a separate check.
 
 Input ticks, output activation and encoded frames use GStreamer running time,
@@ -32,6 +33,11 @@ Keyframe events retain raw PTS for their timestamp field and normalized running
 time for their running-time field. The Portal stream uses the pipeline clock so
 unchanged content does not stop output keepalives.
 
+GStreamer fits each source within the output's even-dimension ceilings while
+preserving presentation aspect. It renegotiates those dimensions on source
+resize; the encoded sample's caps supply the actual frame size. Requested
+profile dimensions remain configuration facts, not measured output.
+
 Each output bin contains its downstream flow failures before they reach the
 shared tee. The main-context bus handler reports that output as unavailable and
 closes its valve before stopping the branch. Failed outputs remain retired for
diff --git a/native/capture/linux/main.c b/native/capture/linux/main.c
index 5315881e5..a0baf05fa 100644
--- a/native/capture/linux/main.c
+++ b/native/capture/linux/main.c
@@ -941,6 +941,17 @@ static GstFlowReturn video_sample(GstAppSink *sink, gpointer data) {
   CaptureRun *run = output->run;
   GstSample *sample = gst_app_sink_pull_sample(sink);
   if (sample == NULL) return GST_FLOW_EOS;
+  GstCaps *caps = gst_sample_get_caps(sample);
+  const GstStructure *format = caps == NULL ? NULL : gst_caps_get_structure(caps, 0);
+  gint width = 0, height = 0;
+  if (format == NULL || !gst_structure_get_int(format, "width", &width) ||
+      !gst_structure_get_int(format, "height", &height) ||
+      !valid_video_size(width, height) ||
+      (guint)width > output->profile.width || (guint)height > output->profile.height) {
+    gst_sample_unref(sample);
+    fail_output(output, "GStreamer returned H.264 dimensions outside the output ceiling");
+    return GST_FLOW_ERROR;
+  }
   GstBuffer *buffer = gst_sample_get_buffer(sample);
   GstMapInfo mapped = GST_MAP_INFO_INIT;
   if (buffer == NULL || !gst_buffer_map(buffer, &mapped, GST_MAP_READ) ||
@@ -982,7 +993,7 @@ static GstFlowReturn video_sample(GstAppSink *sink, gpointer data) {
     return GST_FLOW_OK;
   }
   gboolean written = write_frame(2, recovery ? 1 : 0, (guint8)output->layer,
-                                  output->profile.width, output->profile.height,
+                                  width, height,
                                   timestamp / 100,
                                   10000000ULL / output->profile.frame_rate,
                                   mapped.data, mapped.size);
@@ -1099,6 +1110,22 @@ static int run_pipeline(CaptureRun *run, const char *starting_status) {
   return 0;
 }
 
+static void append_video_scale(GString *pipeline, const VideoProfile *profile) {
+  // Let GStreamer preserve source aspect and renegotiate after a resize. The
+  // step keeps NV12 dimensions even; the profile is a ceiling, not a canvas.
+  g_string_append(pipeline, "videoconvert ! videoscale add-borders=false ! "
+                           "video/x-raw,format=NV12,");
+  const struct { const char *name; guint limit; } dimensions[] = {
+      {"width", profile->width}, {"height", profile->height}};
+  for (guint index = 0; index < G_N_ELEMENTS(dimensions); ++index) {
+    // GStreamer represents a one-value range as a scalar.
+    g_string_append_printf(pipeline, dimensions[index].limit == 2
+        ? "%s=(int)%u," : "%s=(int)[2,%u,2],",
+        dimensions[index].name, dimensions[index].limit);
+  }
+  g_string_append(pipeline, "pixel-aspect-ratio=1/1 ! ");
+}
+
 static int capture_video(int count, char **values) {
   CaptureRun run = {.last_input_timestamp = GST_CLOCK_TIME_NONE};
   gboolean encoded = count > 1 && strcmp(values[1], "--encoded-video") == 0;
@@ -1141,16 +1168,17 @@ static int capture_video(int count, char **values) {
         "frames. ! valve name=gate%u drop=%s ! ( "
         "queue name=raw%u max-size-buffers=1 max-size-bytes=0 "
         "max-size-time=0 leaky=downstream ! videorate drop-only=true ! "
-        "video/x-raw,framerate=%u/1 ! videoconvert ! videoscale ! "
-        "video/x-raw,format=NV12,width=%u,height=%u ! "
+        "video/x-raw,framerate=%u/1 ! ",
+        index, run.outputs[index].enabled ? "false" : "true",
+        index, profile->frame_rate);
+    append_video_scale(pipeline_text, profile);
+    g_string_append_printf(pipeline_text,
         "%s name=encoder%u ! video/x-h264,profile=constrained-baseline ! "
         "h264parse config-interval=-1 ! "
         "video/x-h264,stream-format=byte-stream,alignment=au ! "
         "appsink name=output%u emit-signals=true sync=false async=false "
         "max-buffers=1 drop=false ) ",
-        index, run.outputs[index].enabled ? "false" : "true",
-        index, profile->frame_rate, profile->width, profile->height, encoder_info->factory,
-        index, index);
+        encoder_info->factory, index, index);
   }
   GstElement *pipeline = gst_parse_launch(pipeline_text->str, &error);
   g_string_free(pipeline_text, TRUE);
diff --git a/native/capture/linux/main.test.c b/native/capture/linux/main.test.c
index 1052c9b82..33a60e967 100644
--- a/native/capture/linux/main.test.c
+++ b/native/capture/linux/main.test.c
@@ -1,7 +1,8 @@
-// build.sh --check uses synthetic GStreamer elements; no capture or codec is used.
+// build.sh --check uses synthetic video/GStreamer elements; no capture or codec is used.
 #define main capture_main
 #include "main.c"
 #undef main
+#include <gst/video/video.h>
 
 typedef struct { GstElement parent; guint bitrate; } FixtureEncoder;
 typedef struct { GstElementClass parent; } FixtureEncoderClass;
@@ -209,7 +210,8 @@ static void check_encoder_timestamp_segment(GstClockTime offset) {
   gst_pad_add_probe(source_pad, GST_PAD_PROBE_TYPE_BUFFER, begin_input_frame, &run, NULL);
   gst_pad_add_probe(source_pad, GST_PAD_PROBE_TYPE_BUFFER, output_input_frame, &output, NULL);
   gst_pad_add_probe(sink_pad, GST_PAD_PROBE_TYPE_EVENT_DOWNSTREAM, record_key_request, &request, NULL);
-  GstCaps *caps = gst_caps_from_string("video/x-h264,stream-format=byte-stream,alignment=au");
+  GstCaps *caps = gst_caps_from_string(
+      "video/x-h264,stream-format=byte-stream,alignment=au,width=640,height=480");
   GstBuffer *buffer = gst_buffer_new_allocate(NULL, sizeof(h264), NULL);
   gst_buffer_fill(buffer, 0, h264, sizeof(h264));
   GST_BUFFER_PTS(buffer) = offset + GST_SECOND;
@@ -244,6 +246,8 @@ static void check_encoder_timestamp_segment(GstClockTime offset) {
   g_assert_cmpint(bytes[37], ==, 2);
   g_assert_cmpint(bytes[38], ==, 1);
   g_assert_cmpuint(read_be((guint8 *)bytes + 40, 8), ==, 3 * GST_SECOND / 100);
+  g_assert_cmpuint(read_be((guint8 *)bytes + 56, 2), ==, 640);
+  g_assert_cmpuint(read_be((guint8 *)bytes + 58, 2), ==, 480);
   g_assert_cmpmem(bytes + 64, sizeof(h264), h264, sizeof(h264));
   g_assert_cmpuint(output.activation_timestamp, ==, 3 * GST_SECOND);
   g_assert_nonnull(request);
@@ -274,6 +278,66 @@ static GstState branch_state(VideoOutput *output) {
   return state;
 }
 
+static void check_source_geometry(guint max_width, guint max_height) {
+  const VideoProfile profile = {.width = max_width, .height = max_height};
+  GString *description = g_string_new("appsrc name=source format=time ! ");
+  append_video_scale(description, &profile);
+  g_string_append(description, "appsink name=output sync=false async=false");
+  GError *error = NULL;
+  GstElement *pipeline = gst_parse_launch(description->str, &error);
+  g_string_free(description, TRUE);
+  g_assert_no_error(error);
+  GstElement *source = gst_bin_get_by_name(GST_BIN(pipeline), "source");
+  GstElement *sink = gst_bin_get_by_name(GST_BIN(pipeline), "output");
+  g_assert_cmpint(gst_element_set_state(pipeline, GST_STATE_PLAYING), !=,
+                 GST_STATE_CHANGE_FAILURE);
+  // Keep one pipeline while input caps change, as a resized captured window or
+  // decoded relay source does. Small sources must not be enlarged to the ceiling.
+  const guint sizes[][2] = {{1080, 1920}, {3440, 1440}, {640, 480},
+                           {1920, 1080}, {641, 479}, {600, 600}};
+  for (guint index = 0; index < G_N_ELEMENTS(sizes); ++index) {
+    GstVideoInfo input;
+    g_assert_true(gst_video_info_set_format(&input, GST_VIDEO_FORMAT_NV12,
+                                           sizes[index][0], sizes[index][1]));
+    GstCaps *caps = gst_video_info_to_caps(&input);
+    gst_app_src_set_caps(GST_APP_SRC(source), caps);
+    gst_caps_unref(caps);
+    GstBuffer *buffer = gst_buffer_new_allocate(NULL, input.size, NULL);
+    gst_buffer_memset(buffer, 0, 128, input.size);
+    gst_buffer_memset(buffer, 0, 235, input.offset[1]);
+    GST_BUFFER_PTS(buffer) = index * GST_SECOND / 30;
+    GST_BUFFER_DURATION(buffer) = GST_SECOND / 30;
+    g_assert_cmpint(gst_app_src_push_buffer(GST_APP_SRC(source), buffer), ==, GST_FLOW_OK);
+    GstSample *sample = gst_app_sink_try_pull_sample(GST_APP_SINK(sink), GST_SECOND);
+    g_assert_nonnull(sample);
+    GstVideoInfo actual;
+    g_assert_true(gst_video_info_from_caps(&actual, gst_sample_get_caps(sample)));
+    g_assert_true(valid_video_size(actual.width, actual.height));
+    g_assert_cmpuint(actual.width, <=, max_width);
+    g_assert_cmpuint(actual.height, <=, max_height);
+    g_assert_cmpint(actual.par_n, ==, actual.par_d);
+    double scale = MIN(1.0, MIN((double)max_width / input.width,
+                               (double)max_height / input.height));
+    g_assert_cmpfloat(ABS(actual.width - input.width * scale), <=, 2);
+    g_assert_cmpfloat(ABS(actual.height - input.height * scale), <=, 2);
+    GstVideoFrame frame;
+    g_assert_true(gst_video_frame_map(&frame, &actual, gst_sample_get_buffer(sample), GST_MAP_READ));
+    const guint8 *luma = GST_VIDEO_FRAME_PLANE_DATA(&frame, 0);
+    const gint stride = GST_VIDEO_FRAME_PLANE_STRIDE(&frame, 0);
+    // No encoded letterbox: even the four corners still contain the source.
+    for (gint y = 0; y < actual.height; y += actual.height - 1) {
+      g_assert_cmpint(luma[y * stride], >=, 230);
+      g_assert_cmpint(luma[y * stride + actual.width - 1], >=, 230);
+    }
+    gst_video_frame_unmap(&frame);
+    gst_sample_unref(sample);
+  }
+  gst_element_set_state(pipeline, GST_STATE_NULL);
+  gst_object_unref(source);
+  gst_object_unref(sink);
+  gst_object_unref(pipeline);
+}
+
 static void check_slot_retirement(void) {
   CaptureRun run = {.output_count = 6};
   g_mutex_init(&run.lock);
@@ -470,6 +534,8 @@ int main(int argc, char **argv) {
   check_encoder_admission_and_control();
   check_bus_error_retains_primary_cause();
   check_slot_profiles();
+  check_source_geometry(1920, 1080);
+  check_source_geometry(2, 2);
   check_encoder_timestamp_segment(1000ULL * 60 * 60 * GST_SECOND);
   check_encoder_timestamp_segment(0);
   check_slot_retirement();

From 9dec156cdb22258c22f1643690a7d88ceafe23c2 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 17:04:55 +0800
Subject: [PATCH 072/262] feat(media)!: accept numeric video size ceilings

Replace resolution preset strings with bounded dimensions in the unpublished 2.0 contract. Keep UI shortcuts and implementation limits separate, reuse existing media owners, and verify a live custom size through Windows native capture.
---
 docs/research/native-client-media.md          |  20 ++-
 docs/standards/media-quality.md               |   8 +-
 docs/status.md                                |   8 +-
 docs/todo.md                                  |   4 +-
 internal/app/app.go                           |   4 +
 .../app/config/quality_preference_test.go     |  10 +-
 internal/app/loopback/server.go               |  22 +--
 .../nativecontrol/operation_failure_test.go   |   8 +-
 internal/app/nativecontrol/session.go         |  15 +-
 internal/app/nativecontrol/session_test.go    |  26 ++--
 internal/server/protocol/constants.go         |   2 +-
 internal/server/protocol/contract_test.go     |   6 +-
 internal/server/protocol/types.go             |  37 +++--
 internal/server/signal/server_test.go         |  12 +-
 scripts/app-media-gate.ts                     |   6 +-
 scripts/app-native-host-gate.ts               |  21 ++-
 scripts/embedded-sfu-page.ts                  |   4 +-
 scripts/peer-assisted-benchmark.ts            |   5 +-
 .../components/living/QualityPresets.tsx      |  66 ++++++++-
 src/client/locales/en.ts                      |   3 +
 src/client/locales/zh.ts                      |   3 +
 src/client/media/browser-encoding-pool.ts     |   4 +-
 src/client/media/quality.ts                   |  45 +++---
 src/client/native/wire.ts                     |   3 +-
 src/client/pages/ControlsPreview.tsx          |  11 +-
 src/client/pages/HostPage.tsx                 |  38 ++---
 src/client/sfu/publisher.ts                   |   5 +-
 src/client/styles.css                         |   5 +
 src/client/webrtc/video-codec-preflight.ts    |   3 +-
 src/shared/protocol.ts                        |  21 +--
 tests/browser-encoding-pool.test.ts           |   2 +-
 tests/client-state.test.ts                    |   6 +-
 tests/fixtures/wire-samples.json              | 139 ++++++++++++++----
 tests/host-peer-tracks.test.ts                |   2 +-
 tests/host-quality-ownership.test.ts          |   4 +-
 tests/native-client.test.ts                   |   2 +-
 tests/protocol.test.ts                        |   6 +-
 tests/quality-preference.test.ts              |   2 +-
 tests/quality.test.ts                         |  23 ++-
 39 files changed, 410 insertions(+), 201 deletions(-)

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 9b24329e0..1e8c965b6 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -513,7 +513,7 @@ a corrected SDP interpretation, not evidence that all Firefox sharing lost audio
 Planning direction reviewed 2026-10-09 for 2.0; the design below is a proposal,
 not a replacement for the current contract or profile decision above. The owner
 reopened numeric media requests and capability negotiation as one coherent
-extension. Resolution enums are enforced
+extension. The published resolution enums are enforced
 by both signaling readers and Native control, while capture admission separately
 bounds dimensions. Native capture, forwarding and SFU declarations also admit
 specific encoded formats. Removing one validator would leave these consumers
@@ -569,10 +569,20 @@ The candidate's Native capture admission now shares the numeric dimension
 bounds already used by encoded outputs instead of duplicating the four UI
 presets. Even dimensions must fit within 2560x1440; a source ceiling must also
 yield a valid half-size output. Frame-rate, bitrate and output-count bounds
-remain unchanged. Signaling still uses the existing resolution enum: custom
-dimensions are an internal foundation, not yet a product control or a 4K option.
-Device capability and the public request contract still need separate admission;
-removing an enum is not permission to allocate arbitrary media resources.
+remain unchanged. Candidate signaling and Native control now carry numeric
+width/height ceilings, with custom input beside the existing UI shortcuts.
+Descriptive wire bounds are independent of the current implementation maximum;
+App discovery advertises that maximum, and Native rejects unsupported profiles
+as operation failures without retiring the control session. This does not yet
+admit product 4K. Removing an enum is not permission to allocate arbitrary media
+resources.
+
+The Windows H.264 UI gate applies a non-preset 960x600 ceiling during a live
+share and observes fitted output without replacing the Viewer media object.
+Preset changes, paused updates, source recovery/replacement and subsequent
+sharing still pass. Value-based comparison prevents an identical deserialized
+size from turning an audio-only edit into a video update. Numeric preference
+round-trips and malformed/unsupported requests have separate boundary checks.
 
 The proposed boundary follows the
 [Media Capture specification](https://www.w3.org/TR/mediacapture-streams/#constrainable-interface):
diff --git a/docs/standards/media-quality.md b/docs/standards/media-quality.md
index 747d746a3..8e713f29d 100644
--- a/docs/standards/media-quality.md
+++ b/docs/standards/media-quality.md
@@ -126,8 +126,12 @@ The three recommended profiles are ceilings, not delivery guarantees:
 | `1080p30` | 1920x1080 at 30 fps | 5 Mbps |
 | `1080p60` | 1920x1080 at 60 fps | 8 Mbps |
 
-`1080p30` is the default. Advanced resolution includes 480p, 720p, 1080p, and
-1440p; frame rate, bitrate, and `maintain-resolution | balanced |
+`1080p30` is the default. The 2.0 candidate carries numeric width/height ceilings;
+480p, 720p, 1080p and 1440p remain UI shortcuts. Advanced picture settings also
+accept custom even dimensions within the current 2560x1440 implementation bound.
+Width and height form one applied edit. Larger wire-valid requests do not
+authorize an adapter to exceed its local capture, codec or allocation limits.
+Frame rate, bitrate, and `maintain-resolution | balanced |
 maintain-framerate` remain independent controls. Display video uses the standard
 `contentHint = "motion"` for game motion.
 Native H264 retains Constrained Baseline. Capture validates the coding-tool subset under
diff --git a/docs/status.md b/docs/status.md
index dd2090f09..6039e2cf8 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -61,11 +61,13 @@ one hour without authenticated participants; the private deployment retains the
 default. Operator records own activation, database and postflight evidence.
 The owner is holding the unpublished maintenance changes for 2.0. Preparation
 includes separating media presets from numeric requests and bounded capabilities.
-Numeric audio is implemented in the unpublished candidate: Browser/server v24
-and Native control v10 replace the preset field; capture v7 and SQLite schema 2
+Numeric audio and video ceilings are implemented in the unpublished candidate:
+Browser/server v24 and Native control v10 replace the preset fields;
+capture v7 and SQLite schema 2
 remain unchanged. Matched candidate App/Web/Server builds are required;
 1.x participants are rejected by the existing compatibility checks.
-Windows and Linux output now preserve source shape within the existing ceiling;
+Custom width/height controls retain the current implementation ceiling.
+Windows and Linux output now preserve source shape within that ceiling;
 axis-independent limits, Browser/macOS geometry, 4K and additional codecs are
 still assessed through the media boundary.
 Native Magicsock remains an isolated experiment with incomplete product
diff --git a/docs/todo.md b/docs/todo.md
index 4f25a088a..b5f27e894 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -49,7 +49,9 @@ Implementation needs a concrete useful result within the product model.
   separate UI presets, numeric requests, bounded implementation capabilities and
   actual output. Numeric audio admission, storage and the compact custom input
   implement [#462](https://github.com/TNTcraftHIM/Piik/pull/462)'s use case, with
-  local Browser/direct/relay and Browser/native SFU evidence. Next assess
+  local Browser/direct/relay and Browser/native SFU evidence. Numeric video
+  requests and custom width/height controls now pass the existing Windows live
+  capture gate within current implementation limits. Next assess
   source-aspect-preserving geometry and 4K through the same owners. Windows and
   Linux outputs now fit the source without a fixed padded landscape canvas;
   axis-independent limits, Browser/macOS geometry and product 4K
diff --git a/internal/app/app.go b/internal/app/app.go
index 63b748e07..2e38d3430 100644
--- a/internal/app/app.go
+++ b/internal/app/app.go
@@ -27,6 +27,7 @@ import (
 	"github.com/TNTcraftHIM/Piik/internal/diagnostics"
 	serverapp "github.com/TNTcraftHIM/Piik/internal/server/app"
 	serverconfig "github.com/TNTcraftHIM/Piik/internal/server/config"
+	"github.com/TNTcraftHIM/Piik/internal/server/protocol"
 	"github.com/TNTcraftHIM/Piik/internal/server/webassets"
 	"golang.org/x/mod/semver"
 )
@@ -627,6 +628,9 @@ func discoverNativeMedia(ctx context.Context, configuredPath string) nativeRunti
 		captureProcess: path,
 		capture:        capabilities,
 		capabilities: loopback.NativeMediaCapabilities{
+			MaxVideoResolution: protocol.QualityResolution{
+				Width: nativecapture.MaxVideoWidth, Height: nativecapture.MaxVideoHeight,
+			},
 			MaxAudioBitrate:       nativeaudio.MaxSendBitrate,
 			ReceiverReuse:         true,
 			Video:                 summary.Video,
diff --git a/internal/app/config/quality_preference_test.go b/internal/app/config/quality_preference_test.go
index a9c6dcb8f..71b00c366 100644
--- a/internal/app/config/quality_preference_test.go
+++ b/internal/app/config/quality_preference_test.go
@@ -20,7 +20,7 @@ func TestQualityPreferencePersistsWithoutChangingAppConfiguration(t *testing.T)
 		t.Fatalf("initial preference: %v, %v", p.Read(), err)
 	}
 	quality := protocol.DefaultQualitySettings
-	quality.Resolution, quality.MaxAudioBitrate = "1440p", 320_000
+	quality.Resolution, quality.MaxAudioBitrate = protocol.QualityResolution{Width: 1920, Height: 1200}, 320_000
 	if err := p.Save(quality); err != nil {
 		t.Fatal(err)
 	}
@@ -29,7 +29,7 @@ func TestQualityPreferencePersistsWithoutChangingAppConfiguration(t *testing.T)
 		t.Fatalf("restored: %v, %v", loaded.Read(), err)
 	}
 	copy := loaded.Read()
-	copy.Resolution = "480p"
+	copy.Resolution.Width = 854
 	if *loaded.Read() != quality {
 		t.Fatal("caller modified stored settings")
 	}
@@ -38,7 +38,7 @@ func TestQualityPreferencePersistsWithoutChangingAppConfiguration(t *testing.T)
 		t.Fatal("preference changed strict App configuration")
 	}
 	invalid := quality
-	invalid.Resolution = "2160p"
+	invalid.Resolution.Width = 8194
 	if p.Save(invalid) == nil || *p.Read() != quality {
 		t.Fatal("invalid choice changed preference")
 	}
@@ -48,8 +48,8 @@ func TestQualityPreferencePersistsWithoutChangingAppConfiguration(t *testing.T)
 	if err := os.Mkdir(path+".quality", 0700); err != nil {
 		t.Fatal(err)
 	}
-	quality.Resolution = "720p"
-	if p.Save(quality) == nil || p.Read().Resolution != "1440p" {
+	quality.Resolution = protocol.QualityResolution{Width: 1280, Height: 720}
+	if p.Save(quality) == nil || p.Read().Resolution != (protocol.QualityResolution{Width: 1920, Height: 1200}) {
 		t.Fatal("failed write replaced saved preference")
 	}
 }
diff --git a/internal/app/loopback/server.go b/internal/app/loopback/server.go
index 5a888f30e..e7617ac41 100644
--- a/internal/app/loopback/server.go
+++ b/internal/app/loopback/server.go
@@ -17,6 +17,7 @@ import (
 	"time"
 
 	appconfig "github.com/TNTcraftHIM/Piik/internal/app/config"
+	"github.com/TNTcraftHIM/Piik/internal/server/protocol"
 	"github.com/coder/websocket"
 )
 
@@ -72,16 +73,17 @@ type Health struct {
 }
 
 type NativeMediaCapabilities struct {
-	MaxAudioBitrate       int  `json:"maxAudioBitrate,omitempty"`
-	ReceiverReuse         bool `json:"receiverReuse,omitempty"`
-	Video                 bool `json:"video"`
-	CaptureBorderControl  bool `json:"captureBorderControl,omitempty"`
-	Microphone            bool `json:"microphone,omitempty"`
-	ProcessAudio          bool `json:"processAudio"`
-	ProcessAudioExclusion bool `json:"processAudioExclusion,omitempty"`
-	SystemAudio           bool `json:"systemAudio"`
-	HardwareH264          bool `json:"hardwareH264"`
-	SoftwareVP8           bool `json:"softwareVP8"`
+	MaxVideoResolution    protocol.QualityResolution `json:"maxVideoResolution,omitzero"`
+	MaxAudioBitrate       int                        `json:"maxAudioBitrate,omitempty"`
+	ReceiverReuse         bool                       `json:"receiverReuse,omitempty"`
+	Video                 bool                       `json:"video"`
+	CaptureBorderControl  bool                       `json:"captureBorderControl,omitempty"`
+	Microphone            bool                       `json:"microphone,omitempty"`
+	ProcessAudio          bool                       `json:"processAudio"`
+	ProcessAudioExclusion bool                       `json:"processAudioExclusion,omitempty"`
+	SystemAudio           bool                       `json:"systemAudio"`
+	HardwareH264          bool                       `json:"hardwareH264"`
+	SoftwareVP8           bool                       `json:"softwareVP8"`
 }
 
 type Server struct {
diff --git a/internal/app/nativecontrol/operation_failure_test.go b/internal/app/nativecontrol/operation_failure_test.go
index 4a69ba5bd..e4f2b3b19 100644
--- a/internal/app/nativecontrol/operation_failure_test.go
+++ b/internal/app/nativecontrol/operation_failure_test.go
@@ -138,7 +138,7 @@ func TestOperationalFailureAndIdempotentStopKeepTheRealControlConnection(t *test
 	defer connection.CloseNow()
 	for index, command := range []struct{ kind, fields, expected string }{
 		{"hello", "", "ready"},
-		{"start-share", `,"shareId":"missing_share","source":{"kind":"display","sourceId":"1","title":"Fixture"},"edgeCapacity":1,"codec":"vp8","profile":{"resolution":"1080p","maxFramerate":30,"maxBitrate":5000000,"degradationPreference":"balanced"}`, "request-failed"},
+		{"start-share", `,"shareId":"missing_share","source":{"kind":"display","sourceId":"1","title":"Fixture"},"edgeCapacity":1,"codec":"vp8","profile":{"resolution":{"width":1920,"height":1080},"maxFramerate":30,"maxBitrate":5000000,"degradationPreference":"balanced"}`, "request-failed"},
 		{"prepare-edge", `,"shareId":"missing_share","connectionId":"edge_123456","iceServers":[]`, "request-failed"},
 		{"edge-answer", `,"shareId":"missing_share","connectionId":"edge_123456","sdp":"v=0"`, "request-failed"},
 		{"receive-candidate", `,"shareId":"missing_share","connectionId":"edge_123456","candidate":null`, "request-failed"},
@@ -180,7 +180,7 @@ func TestFailedEdgeAndLateStopDoNotRetireAnotherShare(t *testing.T) {
 	t.Setenv("PIIK_QUIET_CAPTURE_FIXTURE", t.TempDir())
 	session := New(executable, nativecapture.Capabilities{SoftwareVP8: true}, false)
 	defer session.Close()
-	const start = `{"version":10,"id":"request_start","type":"start-share","shareId":"share_123456","source":{"kind":"display","sourceId":"1","title":"Fixture"},"audio":false,"edgeCapacity":1,"codec":"vp8","profile":{"resolution":"1080p","maxFramerate":30,"maxBitrate":5000000,"degradationPreference":"balanced"}}`
+	const start = `{"version":10,"id":"request_start","type":"start-share","shareId":"share_123456","source":{"kind":"display","sourceId":"1","title":"Fixture"},"audio":false,"edgeCapacity":1,"codec":"vp8","profile":{"resolution":{"width":1920,"height":1080},"maxFramerate":30,"maxBitrate":5000000,"degradationPreference":"balanced"}}`
 	if value, err := awaitControlResponse(t, session, []byte(start)); err != nil {
 		t.Fatal(err)
 	} else if _, ok := value.(shareStartedResponse); !ok {
@@ -274,8 +274,8 @@ func TestCaptureStartupAndReplacementRemainCancellable(t *testing.T) {
 			}
 			session := New(executable, nativecapture.Capabilities{SoftwareVP8: true}, false)
 			defer session.Close()
-			start := `{"version":10,"id":"request_start","type":"start-share","shareId":"share_123456","source":{"kind":"display","sourceId":"1","title":"Fixture"},"edgeCapacity":1,"codec":"vp8","profile":{"resolution":"1080p","maxFramerate":30,"maxBitrate":5000000,"degradationPreference":"balanced"}}`
-			payload := strings.Replace(start, "1080p", "720p", 1)
+			start := `{"version":10,"id":"request_start","type":"start-share","shareId":"share_123456","source":{"kind":"display","sourceId":"1","title":"Fixture"},"edgeCapacity":1,"codec":"vp8","profile":{"resolution":{"width":1920,"height":1080},"maxFramerate":30,"maxBitrate":5000000,"degradationPreference":"balanced"}}`
+			payload := strings.Replace(start, `"width":1920,"height":1080`, `"width":1280,"height":720`, 1)
 			if kind == "replace-share-source" {
 				if value, err := awaitControlResponse(t, session, []byte(start)); err != nil {
 					t.Fatal(err)
diff --git a/internal/app/nativecontrol/session.go b/internal/app/nativecontrol/session.go
index f3e8e3ab6..74c488593 100644
--- a/internal/app/nativecontrol/session.go
+++ b/internal/app/nativecontrol/session.go
@@ -641,25 +641,14 @@ func (session *Session) startShare(
 }
 
 func nativeQualityProfile(settings qualitySettings) nativehost.QualityProfile {
-	width, height := uint32(0), uint32(0)
-	switch settings.Resolution {
-	case "480p":
-		width, height = 854, 480
-	case "720p":
-		width, height = 1280, 720
-	case "1080p":
-		width, height = 1920, 1080
-	case "1440p":
-		width, height = 2560, 1440
-	}
 	audioBitrate := int(settings.MaxAudioBitrate)
 	if audioBitrate == 0 {
 		audioBitrate = int(protocol.DefaultQualitySettings.MaxAudioBitrate)
 	}
 	return nativehost.QualityProfile{
 		Video: nativecapture.VideoProfile{
-			Width:      width,
-			Height:     height,
+			Width:      uint32(settings.Resolution.Width),
+			Height:     uint32(settings.Resolution.Height),
 			Framerate:  uint32(settings.MaxFramerate),
 			Bitrate:    uint32(settings.MaxBitrate),
 			Preference: settings.DegradationPreference,
diff --git a/internal/app/nativecontrol/session_test.go b/internal/app/nativecontrol/session_test.go
index de572e1e8..09e240589 100644
--- a/internal/app/nativecontrol/session_test.go
+++ b/internal/app/nativecontrol/session_test.go
@@ -18,6 +18,7 @@ import (
 	"github.com/TNTcraftHIM/Piik/internal/app/loopback"
 	"github.com/TNTcraftHIM/Piik/internal/app/nativecapture"
 	"github.com/TNTcraftHIM/Piik/internal/app/nativehost"
+	"github.com/TNTcraftHIM/Piik/internal/server/protocol"
 	"github.com/pion/webrtc/v4"
 )
 
@@ -253,7 +254,7 @@ func TestMicrophoneOptInPreservesLegacyAndOrdersStateBeforeCompletion(t *testing
 			request := startShareRequest{Version: 10, ID: "request_start", Type: "start-share", ShareID: "share_123456",
 				Source:           nativecapture.CaptureTarget{Kind: "display", SourceID: "1", Title: "Fixture"},
 				MicrophoneMixing: optIn, EdgeCapacity: 1, Codec: "vp8",
-				Profile: qualitySettings{Resolution: "1080p", MaxFramerate: 30, MaxBitrate: 5_000_000, DegradationPreference: "balanced"}}
+				Profile: qualitySettings{Resolution: protocol.QualityResolution{Width: 1920, Height: 1080}, MaxFramerate: 30, MaxBitrate: 5_000_000, DegradationPreference: "balanced"}}
 			payload, _ := json.Marshal(request)
 			result, err := awaitControlResponse(t, session, payload)
 			started, ok := result.(shareStartedResponse)
@@ -335,11 +336,11 @@ func TestCaptureBorderPreferenceFollowsSourceAndProfile(t *testing.T) {
 			start := startShareRequest{Version: 10, ID: "request_start", Type: "start-share", ShareID: "share_123456",
 				Source:            nativecapture.CaptureTarget{Kind: "display", SourceID: "1", Title: "Fixture"},
 				ShowCaptureBorder: true, EdgeCapacity: 1, Codec: "vp8",
-				Profile: qualitySettings{Resolution: "1080p", MaxFramerate: 30, MaxBitrate: 5_000_000, DegradationPreference: "balanced"}}
+				Profile: qualitySettings{Resolution: protocol.QualityResolution{Width: 1920, Height: 1080}, MaxFramerate: 30, MaxBitrate: 5_000_000, DegradationPreference: "balanced"}}
 			handle(start)
 			assertBorder(supported)
 			profile := start.Profile
-			profile.Resolution = "480p"
+			profile.Resolution = protocol.QualityResolution{Width: 854, Height: 480}
 			handle(updateShareRequest{Version: 10, ID: "request_update", Type: "update-share", ShareID: start.ShareID, Profile: profile})
 			session.mu.Lock()
 			done := session.updateDone
@@ -393,9 +394,9 @@ func TestQuietHostUpdatePreservesControlAndCancelsCleanly(t *testing.T) {
 				}
 				return value
 			}
-			const start = `{"version":10,"id":"request_start","type":"start-share","shareId":"share_123456","source":{"kind":"display","sourceId":"1","title":"Fixture"},"audio":false,"adapterIndex":0,"encoderIndex":0,"edgeCapacity":1,"codec":"vp8","profile":{"resolution":"1080p","maxFramerate":30,"maxBitrate":5000000,"degradationPreference":"balanced"}}`
+			const start = `{"version":10,"id":"request_start","type":"start-share","shareId":"share_123456","source":{"kind":"display","sourceId":"1","title":"Fixture"},"audio":false,"adapterIndex":0,"encoderIndex":0,"edgeCapacity":1,"codec":"vp8","profile":{"resolution":{"width":1920,"height":1080},"maxFramerate":30,"maxBitrate":5000000,"degradationPreference":"balanced"}}`
 			handle(start)
-			const update = `{"version":10,"id":"request_update","type":"update-share","shareId":"share_123456","profile":{"resolution":"720p","maxFramerate":30,"maxBitrate":3000000,"degradationPreference":"balanced"}}`
+			const update = `{"version":10,"id":"request_update","type":"update-share","shareId":"share_123456","profile":{"resolution":{"width":1280,"height":720},"maxFramerate":30,"maxBitrate":3000000,"degradationPreference":"balanced"}}`
 			if value := handle(update); value != nil {
 				t.Fatalf("Host update did not defer: %#v", value)
 			}
@@ -652,7 +653,7 @@ func TestSourceEnumerationFailureDoesNotCloseControl(t *testing.T) {
 
 func TestQualitySettingsMapOnceIntoNativeMedia(t *testing.T) {
 	settings := qualitySettings{
-		Resolution: "1440p", MaxFramerate: 60, MaxBitrate: 12_000_000,
+		Resolution: protocol.QualityResolution{Width: 2560, Height: 1440}, MaxFramerate: 60, MaxBitrate: 12_000_000,
 		DegradationPreference: "maintain-framerate",
 		MaxAudioBitrate:       192000,
 	}
@@ -664,7 +665,11 @@ func TestQualitySettingsMapOnceIntoNativeMedia(t *testing.T) {
 		profile.AudioBitrate != 192_000 {
 		t.Fatalf("native profile = %+v", profile)
 	}
-	settings.Resolution = "2160p"
+	settings.Resolution = protocol.QualityResolution{Width: 1920, Height: 1200}
+	if profile := nativeQualityProfile(settings); !profile.Valid() || profile.Video.Height != 1200 {
+		t.Fatalf("numeric size outside UI presets was not preserved: %+v", profile)
+	}
+	settings.Resolution = protocol.QualityResolution{Width: 3840, Height: 2160}
 	if nativeQualityProfile(settings).Valid() {
 		t.Fatal("unsupported resolution was accepted")
 	}
@@ -673,15 +678,18 @@ func TestQualitySettingsMapOnceIntoNativeMedia(t *testing.T) {
 func TestUpdateShareRequiresTheCurrentStrictProfile(t *testing.T) {
 	session := New("missing-capture-process", nativecapture.Capabilities{}, false)
 	t.Cleanup(func() { _ = session.Close() })
-	valid := `{"version":10,"id":"request_update","type":"update-share","shareId":"share_123456","profile":{"resolution":"1080p","maxFramerate":30,"maxBitrate":5000000,"degradationPreference":"balanced","maxAudioBitrate":128000}}`
+	valid := `{"version":10,"id":"request_update","type":"update-share","shareId":"share_123456","profile":{"resolution":{"width":1920,"height":1080},"maxFramerate":30,"maxBitrate":5000000,"degradationPreference":"balanced","maxAudioBitrate":128000}}`
 	assertOperationFailure(t, session, valid)
 	// Opus permits this numeric request, but the current 20 ms sender does not.
 	// Keep the control session usable and let the caller keep its current share.
 	assertOperationFailure(t, session, strings.Replace(valid, `"maxAudioBitrate":128000`, `"maxAudioBitrate":510000`, 1))
+	assertOperationFailure(t, session, strings.Replace(valid,
+		`"resolution":{"width":1920,"height":1080}`,
+		`"resolution":{"width":3840,"height":2160}`, 1))
 	if _, err := session.Handle(t.Context(), []byte(`{"version":10,"id":"request_options","type":"capture-options"}`)); err != nil {
 		t.Fatalf("unsupported media setting retired control: %v", err)
 	}
-	invalid := `{"version":10,"id":"request_update","type":"update-share","shareId":"share_123456","profile":{"resolution":"1080p","maxFramerate":30,"maxBitrate":5000000,"degradationPreference":"balanced","maxAudioBitrate":128000,"extra":true}}`
+	invalid := `{"version":10,"id":"request_update","type":"update-share","shareId":"share_123456","profile":{"resolution":{"width":1920,"height":1080},"maxFramerate":30,"maxBitrate":5000000,"degradationPreference":"balanced","maxAudioBitrate":128000,"extra":true}}`
 	if _, err := session.Handle(t.Context(), []byte(invalid)); err == nil ||
 		err.Error() != "native update-share request is invalid" {
 		t.Fatalf("extended update was accepted: %v", err)
diff --git a/internal/server/protocol/constants.go b/internal/server/protocol/constants.go
index cb393307b..2414043f6 100644
--- a/internal/server/protocol/constants.go
+++ b/internal/server/protocol/constants.go
@@ -64,7 +64,7 @@ var NatTraversalPaths = [...]string{"unknown", "ordinary", "predicted"}
 
 // DefaultQualitySettings mirrors DEFAULT_QUALITY_SETTINGS.
 var DefaultQualitySettings = QualitySettings{
-	Resolution:            "1080p",
+	Resolution:            QualityResolution{Width: 1920, Height: 1080},
 	MaxFramerate:          30,
 	MaxBitrate:            5_000_000,
 	DegradationPreference: "balanced",
diff --git a/internal/server/protocol/contract_test.go b/internal/server/protocol/contract_test.go
index 206999b58..3ebd15393 100644
--- a/internal/server/protocol/contract_test.go
+++ b/internal/server/protocol/contract_test.go
@@ -117,7 +117,7 @@ func drop(base []member, keys ...string) []member {
 const (
 	testAssignmentNone = `{"upstream":{"kind":"none"},"childPeerIds":[],` +
 		`"sfuPublicationGeneration":null}`
-	testQualitySettings = `{"resolution":"1080p","maxFramerate":60,"maxBitrate":8000000,` +
+	testQualitySettings = `{"resolution":{"width":1920,"height":1080},"maxFramerate":60,"maxBitrate":8000000,` +
 		`"degradationPreference":"maintain-resolution"}`
 	testRoutePolicy = `{"peerOnly":false,"topologyOptimization":true,"natPrediction":false}`
 	testIceConfig   = `{"iceServers":[],"natPredictionStunUrls":[]}`
@@ -245,7 +245,7 @@ func TestAuthenticatedRoomRevision(t *testing.T) {
 		object(drop(authenticatedHost(), "mediaMode")), false)
 	assertServerMessage(t, "quality settings past the bitrate ceiling",
 		object(with(authenticatedHost(), member{"qualitySettings",
-			`{"resolution":"1080p","maxFramerate":60,"maxBitrate":20000000,` +
+			`{"resolution":{"width":1920,"height":1080},"maxFramerate":60,"maxBitrate":20000000,` +
 				`"degradationPreference":"maintain-resolution"}`})), false)
 }
 
@@ -578,7 +578,7 @@ func TestDuplicateKeysKeepTheLastOccurrence(t *testing.T) {
 	}
 	// A duplicated object is replaced, not merged.
 	if _, err := DecodeClientMessage(
-		[]byte(`{"type":"set-quality-settings","qualitySettings":{"resolution":"480p"},` +
+		[]byte(`{"type":"set-quality-settings","qualitySettings":{"resolution":{"width":854,"height":480}},` +
 			`"qualitySettings":` + testQualitySettings + `}`)); err != nil {
 		t.Fatalf("a duplicated object must be replaced wholesale: %v", err)
 	}
diff --git a/internal/server/protocol/types.go b/internal/server/protocol/types.go
index e026f1424..f201cc158 100644
--- a/internal/server/protocol/types.go
+++ b/internal/server/protocol/types.go
@@ -35,7 +35,6 @@ var (
 
 // Enumerations mirrored from src/shared/protocol.ts.
 var (
-	qualityResolutions           = []string{"480p", "720p", "1080p", "1440p"}
 	degradationPreferences       = []string{"maintain-resolution", "balanced", "maintain-framerate"}
 	mediaRoutePhases             = []string{"prepare", "active"}
 	routeDemandReasons           = []string{"join", "edge-unavailable", "parent-departed", "capacity-reduction", "sfu-bootstrap", "direct-convergence", "quality-convergence", "root-convergence"}
@@ -105,13 +104,36 @@ func (v *MediaRouteUpstream) UnmarshalJSON(data []byte) error {
 // qualitySettingsSchema / routePolicySchema / runtimeCapabilitiesSchema
 // ---------------------------------------------------------------------------
 
+// QualityResolution is a requested ceiling, not encoder availability or an allocation.
+type QualityResolution struct {
+	Width  Int `json:"width"`
+	Height Int `json:"height"`
+}
+
+func (v *QualityResolution) UnmarshalJSON(data []byte) error {
+	*v = QualityResolution{}
+	type raw QualityResolution
+	present, err := decodeObject(data, (*raw)(v))
+	if err != nil {
+		return err
+	}
+	if err := present.require("width", "height"); err != nil {
+		return err
+	}
+	if !inRangeInt(v.Width, 4, 8192) || v.Width%2 != 0 ||
+		!inRangeInt(v.Height, 4, 8192) || v.Height%2 != 0 {
+		return errors.New("resolution is out of range")
+	}
+	return nil
+}
+
 // QualitySettings mirrors qualitySettingsSchema.
 type QualitySettings struct {
-	Resolution            string `json:"resolution"`
-	MaxFramerate          Int    `json:"maxFramerate"`
-	MaxBitrate            Int    `json:"maxBitrate"`
-	DegradationPreference string `json:"degradationPreference"`
-	MaxAudioBitrate       Int    `json:"maxAudioBitrate,omitempty"`
+	Resolution            QualityResolution `json:"resolution"`
+	MaxFramerate          Int               `json:"maxFramerate"`
+	MaxBitrate            Int               `json:"maxBitrate"`
+	DegradationPreference string            `json:"degradationPreference"`
+	MaxAudioBitrate       Int               `json:"maxAudioBitrate,omitempty"`
 }
 
 // UnmarshalJSON implements json.Unmarshaler.
@@ -129,9 +151,6 @@ func (v *QualitySettings) UnmarshalJSON(data []byte) error {
 	if err := present.optional("maxAudioBitrate"); err != nil {
 		return err
 	}
-	if !enumOf(v.Resolution, qualityResolutions...) {
-		return fmt.Errorf("unknown resolution %q", v.Resolution)
-	}
 	if !inRangeInt(v.MaxFramerate, 15, 60) {
 		return errors.New("maxFramerate is out of range")
 	}
diff --git a/internal/server/signal/server_test.go b/internal/server/signal/server_test.go
index 16ec7c23e..972767b2d 100644
--- a/internal/server/signal/server_test.go
+++ b/internal/server/signal/server_test.go
@@ -2430,13 +2430,13 @@ func TestSignalRetainsAuthoritativePauseWhenReconnectingHostAdvertisesUnpaused(t
 func TestSignalBindsNewShareQualityAndPreservesActiveShareQualityAcrossReconnect(t *testing.T) {
 	h := startHarness(t, harnessOptions{})
 	initialSettings := map[string]any{
-		"resolution":            "1440p",
+		"resolution":            protocol.QualityResolution{Width: 2560, Height: 1440},
 		"maxFramerate":          60,
 		"maxBitrate":            8_000_000,
 		"degradationPreference": "maintain-resolution",
 		"maxAudioBitrate":       192000,
 	}
-	initialJSON := `{"resolution":"1440p","maxFramerate":60,"maxBitrate":8000000,"degradationPreference":"maintain-resolution","maxAudioBitrate":192000}`
+	initialJSON := `{"resolution":{"width":2560,"height":1440},"maxFramerate":60,"maxBitrate":8000000,"degradationPreference":"maintain-resolution","maxAudioBitrate":192000}`
 	firstGeneration := "first_share_generation_12345678"
 	viewer := openClient(t, h)
 	authenticate(t, viewer, h.room, protocol.RoleViewer, "quality-viewer-client", 1, "", presenceOptions{})
@@ -2448,13 +2448,13 @@ func TestSignalBindsNewShareQualityAndPreservesActiveShareQualityAcrossReconnect
 	expectEqual(t, viewer.next("quality-settings").raw, `{"type":"quality-settings","qualitySettings":`+initialJSON+`}`)
 
 	reconnectSettings := map[string]any{
-		"resolution":            "480p",
+		"resolution":            protocol.QualityResolution{Width: 854, Height: 480},
 		"maxFramerate":          15,
 		"maxBitrate":            2_000_000,
 		"degradationPreference": "maintain-framerate",
 		"maxAudioBitrate":       64000,
 	}
-	reconnectJSON := `{"resolution":"480p","maxFramerate":15,"maxBitrate":2000000,"degradationPreference":"maintain-framerate","maxAudioBitrate":64000}`
+	reconnectJSON := `{"resolution":{"width":854,"height":480},"maxFramerate":15,"maxBitrate":2000000,"degradationPreference":"maintain-framerate","maxAudioBitrate":64000}`
 	reconnectedHost := openClient(t, h)
 	reconnectedAuth := authenticate(t, reconnectedHost, h.room, protocol.RoleHost, "quality-host-client", 1, firstGeneration,
 		presenceOptions{qualitySettings: reconnectSettings})
@@ -2465,13 +2465,13 @@ func TestSignalBindsNewShareQualityAndPreservesActiveShareQualityAcrossReconnect
 	}
 
 	updatedSettings := map[string]any{
-		"resolution":            "720p",
+		"resolution":            protocol.QualityResolution{Width: 1280, Height: 720},
 		"maxFramerate":          30,
 		"maxBitrate":            3_000_000,
 		"degradationPreference": "balanced",
 		"maxAudioBitrate":       128000,
 	}
-	updatedJSON := `{"resolution":"720p","maxFramerate":30,"maxBitrate":3000000,"degradationPreference":"balanced","maxAudioBitrate":128000}`
+	updatedJSON := `{"resolution":{"width":1280,"height":720},"maxFramerate":30,"maxBitrate":3000000,"degradationPreference":"balanced","maxAudioBitrate":128000}`
 	reconnectedHost.sendJSON(map[string]any{"type": "set-quality-settings", "qualitySettings": updatedSettings})
 	expectEqual(t, viewer.next("quality-settings").raw, `{"type":"quality-settings","qualitySettings":`+updatedJSON+`}`)
 
diff --git a/scripts/app-media-gate.ts b/scripts/app-media-gate.ts
index 9bd1ca647..a4b296325 100644
--- a/scripts/app-media-gate.ts
+++ b/scripts/app-media-gate.ts
@@ -437,7 +437,7 @@ async function browserMediaGate(input: {
       encoderIndex: encoder.index,
       edgeCapacity: 2,
       profile: {
-        resolution: "1440p",
+        resolution: { width: 2560, height: 1440 },
         maxFramerate: 30,
         maxBitrate: 3_000_000,
         degradationPreference: "maintain-resolution",
@@ -597,7 +597,7 @@ async function browserMediaGate(input: {
     const liveUpdate = await request("update-share", {
       shareId,
       profile: {
-        resolution: "720p",
+        resolution: { width: 1280, height: 720 },
         maxFramerate: 60,
         maxBitrate: 12_000_000,
         degradationPreference: "maintain-framerate",
@@ -623,7 +623,7 @@ async function browserMediaGate(input: {
     const pausedUpdate = await request("update-share", {
       shareId,
       profile: {
-        resolution: "480p",
+        resolution: { width: 854, height: 480 },
         maxFramerate: 15,
         maxBitrate: 2_000_000,
         degradationPreference: "maintain-resolution",
diff --git a/scripts/app-native-host-gate.ts b/scripts/app-native-host-gate.ts
index 494a7ab15..5c80f04a5 100644
--- a/scripts/app-native-host-gate.ts
+++ b/scripts/app-native-host-gate.ts
@@ -82,6 +82,7 @@ interface GateResult {
   qualityControlsEnabled: boolean;
   livePresetChanges: number;
   liveQualityChanged: boolean;
+  customQualityChanged: boolean;
   pausedQualityChanged: boolean;
   backgroundProfileRecovery: boolean | null;
   sourceWindowRecovery: boolean | null;
@@ -632,6 +633,7 @@ async function main(): Promise<void> {
     qualityControlsEnabled: false,
     livePresetChanges: 0,
     liveQualityChanged: false,
+    customQualityChanged: false,
     pausedQualityChanged: false,
     backgroundProfileRecovery: mode === "local" && sourceKind === "window" ? false : null,
     sourceWindowRecovery: mode === "local" && sourceKind === "window" ? false : null,
@@ -1018,6 +1020,23 @@ async function main(): Promise<void> {
       result.viewerWidth = viewerState.width;
       result.viewerHeight = viewerState.height;
       await assertVideoCodec(cdp, viewer, actualCodec);
+      stage = "native-custom-quality";
+      const framesBeforeCustom = await evaluate<number>(cdp, viewer,
+        `document.querySelector('video')?.getVideoPlaybackQuality().totalVideoFrames ?? 0`, Date.now() + 5_000);
+      await evaluate<void>(cdp, host, `(() => {
+        const width = document.querySelector('.lr-video-size input[name="width"]');
+        const height = document.querySelector('.lr-video-size input[name="height"]');
+        width.focus(); width.value = '960';
+        height.focus(); height.value = '600'; height.blur();
+      })()`, Date.now() + 5_000);
+      result.customQualityChanged = await waitForValue(
+        deadline => evaluate<boolean>(cdp!, viewer, `(() => {
+          const video = document.querySelector('video');
+          return Boolean(video && window.__piikGateFitsProfile(960, 600) &&
+            video.srcObject === window.__piikGateMedia &&
+            video.getVideoPlaybackQuality().totalVideoFrames >= ${framesBeforeCustom + 10});
+        })()`, deadline), Boolean, 20_000);
+      await assertVideoCodec(cdp, viewer, actualCodec);
       const framesBeforePreference = await evaluate<number>(
         cdp,
         viewer,
@@ -1474,7 +1493,7 @@ async function main(): Promise<void> {
           result.viewerFrames >= 30 && result.viewerWidth > 0 && result.viewerWidth <= 2560 &&
           result.viewerHeight > 0 && result.viewerHeight <= 1440 && result.codecPreserved
         : result.viewerConnected && result.viewerFrames >= 30 &&
-        result.qualityControlsEnabled && result.liveQualityChanged &&
+        result.qualityControlsEnabled && result.liveQualityChanged && result.customQualityChanged &&
         result.backgroundProfileRecovery !== false &&
         result.sourceWindowRecovery !== false &&
         result.livePresetChanges === 2 &&
diff --git a/scripts/embedded-sfu-page.ts b/scripts/embedded-sfu-page.ts
index 1efa47f29..13659cded 100644
--- a/scripts/embedded-sfu-page.ts
+++ b/scripts/embedded-sfu-page.ts
@@ -18,10 +18,10 @@ import { HostSfuRoute, type HostPublisherTransport } from "../src/client/media/h
 import { ViewerSfuRoute } from "../src/client/media/viewer-sfu-route";
 
 const high: QualitySettings = {
-  resolution: "720p", maxFramerate: 15, maxBitrate: 2_000_000,
+  resolution: { width: 1280, height: 720 }, maxFramerate: 15, maxBitrate: 2_000_000,
   degradationPreference: "maintain-resolution", maxAudioBitrate: 64000,
 };
-const low: QualitySettings = { ...high, resolution: "480p" };
+const low: QualitySettings = { ...high, resolution: { width: 854, height: 480 } };
 const shareGeneration = crypto.randomUUID();
 const clientId = crypto.randomUUID();
 let socket: WebSocket | null = null;
diff --git a/scripts/peer-assisted-benchmark.ts b/scripts/peer-assisted-benchmark.ts
index 2d951d313..444dda8b2 100644
--- a/scripts/peer-assisted-benchmark.ts
+++ b/scripts/peer-assisted-benchmark.ts
@@ -18,7 +18,6 @@ import {
 } from "../src/shared/media-copy-accounting";
 import {
   QUALITY_PROFILES,
-  QUALITY_RESOLUTIONS,
   qualitySettingsEqual,
   type QualityProfileId,
   type QualitySettings,
@@ -3203,7 +3202,7 @@ async function runCase(
   let routeTimingStatus: BenchmarkRun["routeTimingStatus"] = "not-requested";
   try {
     const capture = PROFILE_SETTINGS[config.profileId];
-    const captureResolution = QUALITY_RESOLUTIONS[capture.resolution];
+    const captureResolution = capture.resolution;
     const commonInit = {
       width: captureResolution.width,
       height: captureResolution.height,
@@ -3491,7 +3490,7 @@ async function main(): Promise<number> {
   }
 
   const profile = PROFILE_SETTINGS[config.profileId];
-  const profileResolution = QUALITY_RESOLUTIONS[profile.resolution];
+  const profileResolution = profile.resolution;
   const report: BenchmarkReport = {
     schemaVersion: 5,
     startedAt: new Date().toISOString(),
diff --git a/src/client/components/living/QualityPresets.tsx b/src/client/components/living/QualityPresets.tsx
index 187a1d0b8..fe56be928 100644
--- a/src/client/components/living/QualityPresets.tsx
+++ b/src/client/components/living/QualityPresets.tsx
@@ -1,5 +1,10 @@
-import { QUALITY_PROFILES, QUALITY_PROFILE_KEYS, type QualityProfileId } from "../../media/quality";
+import { Fragment } from "react";
+import {
+  QUALITY_PROFILES, QUALITY_PROFILE_KEYS, QUALITY_RESOLUTIONS, qualityResolutionEqual,
+  type QualityProfileId, type QualityResolution,
+} from "../../media/quality";
 import { useCopy } from "../../ui/copy";
+import { Chip } from "./primitives";
 import { QualityTileGlyph } from "./QualityTileGlyph";
 import { Tooltip } from "./Tooltip";
 
@@ -18,10 +23,65 @@ export function QualityPresets({ selected, disabled = false, busy = false, onSel
         text={vis ? undefined : t("host.quality.title", { label: caption, mbps: (profile.maxBitrate / 1_000_000).toFixed(0) })}>
         <button type="button" className={`lr-tile${selected === id ? " is-selected" : ""}`}
           aria-pressed={selected === id} aria-label={caption} disabled={disabled} onClick={() => onSelect(id)}>
-          <QualityTileGlyph resolution={profile.resolution} framerate={profile.maxFramerate} />
-          <small>{vis ? `${profile.resolution.replace("p", "")}·${profile.maxFramerate}` : caption}</small>
+          <QualityTileGlyph resolution={`${profile.resolution.height}p`} framerate={profile.maxFramerate} />
+          <small>{vis ? `${profile.resolution.height}·${profile.maxFramerate}` : caption}</small>
         </button>
       </Tooltip>;
     })}
   </div>;
 }
+
+export function ResolutionControl({ value, maximum, disabled, onChange }: {
+  value: QualityResolution;
+  maximum: QualityResolution;
+  disabled: boolean;
+  onChange: (resolution: QualityResolution) => void;
+}) {
+  const { t, vis } = useCopy();
+  const axes = ["width", "height"] as const;
+  const reset = (container: HTMLElement) => {
+    for (const axis of axes) container.querySelector<HTMLInputElement>(`input[name="${axis}"]`)!.value = String(value[axis]);
+  };
+  const apply = (container: HTMLElement) => {
+    const width = container.querySelector<HTMLInputElement>('input[name="width"]')!;
+    const height = container.querySelector<HTMLInputElement>('input[name="height"]')!;
+    if (![width, height].every(input => input.validity.valid && Number.isFinite(input.valueAsNumber))) {
+      reset(container);
+      return;
+    }
+    const next = { width: width.valueAsNumber, height: height.valueAsNumber };
+    if (!qualityResolutionEqual(value, next)) onChange(next);
+  };
+  return <div className="lr-resolution-controls"
+    onBlur={event => {
+      if (!event.currentTarget.contains(event.relatedTarget)) apply(event.currentTarget);
+    }}
+    onKeyDown={event => {
+      if (!(event.target instanceof HTMLInputElement) || (event.key !== "Enter" && event.key !== "Escape")) return;
+      event.preventDefault();
+      event.stopPropagation();
+      if (event.key === "Escape") reset(event.currentTarget);
+      event.target.blur();
+    }}>
+    <div className="lr-row-group" role="group" aria-label={t("host.advanced.resolution")}>
+      {Object.entries(QUALITY_RESOLUTIONS).map(([label, resolution]) => <Chip key={label}
+        selected={qualityResolutionEqual(value, resolution)}
+        disabled={disabled || resolution.width > maximum.width || resolution.height > maximum.height}
+        title={label} hint="hint-quality" onClick={() => onChange(resolution)}>{label}</Chip>)}
+    </div>
+    <Tooltip kind="hint-quality" text={vis ? undefined : t("host.video.resolutionHint", {
+      width: String(maximum.width), height: String(maximum.height),
+    })}>
+      <span className="lr-input lr-video-size" key={`${value.width}x${value.height}`}
+        role="group" aria-label={t("host.advanced.resolution")}>
+        {axes.map((axis, index) => <Fragment key={axis}>
+          {index === 1 ? <span aria-hidden="true">×</span> : null}
+          <input type="number" inputMode="numeric" name={axis} defaultValue={value[axis]}
+            min={4} max={maximum[axis]} step={2} disabled={disabled}
+            aria-label={t(axis === "width" ? "host.video.width" : "host.video.height")} />
+        </Fragment>)}
+        <span aria-hidden="true">px</span>
+      </span>
+    </Tooltip>
+  </div>;
+}
diff --git a/src/client/locales/en.ts b/src/client/locales/en.ts
index 301449aba..79a16c143 100644
--- a/src/client/locales/en.ts
+++ b/src/client/locales/en.ts
@@ -359,6 +359,9 @@ export const en: Record<CopyKey, string> = {
   "host.advanced.preference.framerateHint": "Prefer frame rate",
   "host.advanced.audio": "Audio quality",
   "host.advanced.audioBitrate": "Audio bitrate limit",
+  "host.video.width": "Width limit in pixels",
+  "host.video.height": "Height limit in pixels",
+  "host.video.resolutionHint": "Width × height limits: {width} × {height} pixels. Source proportions are preserved.",
   "host.audio.bitrateHint": "Audio bitrate limit: {min}–{max} kbps.",
   "host.advanced.audio.saver": "Standard",
   "host.advanced.audio.music": "Music",
diff --git a/src/client/locales/zh.ts b/src/client/locales/zh.ts
index d3cbcc53c..62480a4fa 100644
--- a/src/client/locales/zh.ts
+++ b/src/client/locales/zh.ts
@@ -359,6 +359,9 @@ export const zh = {
   "host.advanced.preference.framerateHint": "优先帧率",
   "host.advanced.audio": "音频质量",
   "host.advanced.audioBitrate": "音频码率上限",
+  "host.video.width": "宽度上限（像素）",
+  "host.video.height": "高度上限（像素）",
+  "host.video.resolutionHint": "宽 × 高上限：{width} × {height} 像素。保留来源比例。",
   "host.audio.bitrateHint": "音频码率上限：{min}–{max} kbps。",
   "host.advanced.audio.saver": "普通",
   "host.advanced.audio.music": "音乐",
diff --git a/src/client/media/browser-encoding-pool.ts b/src/client/media/browser-encoding-pool.ts
index 97a92c161..de152ad5e 100644
--- a/src/client/media/browser-encoding-pool.ts
+++ b/src/client/media/browser-encoding-pool.ts
@@ -6,7 +6,7 @@ import { BrowserEncodingProducer } from "./browser-encoding-producer";
 import { BROWSER_CARRIER_SIZE, type BrowserEncodingOutput } from "./browser-encoding-output";
 import { codecIdentity, fits, nativeVideoBudget, negotiatedCodec, noRegression, observeVideo,
   projectEncodingMetrics, videoOutbound, type Observation } from "./browser-encoding-stats";
-import { QUALITY_RESOLUTIONS, videoQualitySettingsEqual, type QualityProfile } from "./quality";
+import { videoQualitySettingsEqual, type QualityProfile } from "./quality";
 
 export interface BrowserPooledSender {
   updateProfile(profile: QualityProfile): Promise<void>;
@@ -63,7 +63,7 @@ export class BrowserEncodingPool {
     return {
       carrierScale: () => {
         if (!member.carrier) return;
-        const width = member.sender.track?.getSettings().width ?? QUALITY_RESOLUTIONS[member.profile.resolution].width;
+        const width = member.sender.track?.getSettings().width ?? member.profile.resolution.width;
         return Math.max(1, width / BROWSER_CARRIER_SIZE);
       },
       updateProfile: async (next) => {
diff --git a/src/client/media/quality.ts b/src/client/media/quality.ts
index 584a12f4e..4a93b4c58 100644
--- a/src/client/media/quality.ts
+++ b/src/client/media/quality.ts
@@ -3,7 +3,6 @@ import {
   MIN_AUDIO_BITRATE,
   MAX_AUDIO_BITRATE,
   type DegradationPreference,
-  type QualityProfileId,
   type QualityResolution,
   type QualitySettings,
 } from "../../shared/protocol";
@@ -16,17 +15,18 @@ import { applySenderCaptureConstraints, senderCaptureTrack } from "./sender-vide
 
 export type {
   DegradationPreference,
-  QualityProfileId,
   QualityResolution,
   QualitySettings,
 } from "../../shared/protocol";
 
 export type QualityProfile = QualitySettings;
 export const STARTUP_VIDEO_ENCODED_FRAMES = 5;
+// Current product output boundary, independent of wire admission and UI shortcuts.
+export const MAX_CAPTURE_RESOLUTION = { width: 2560, height: 1440 } as const;
 
 export const QUALITY_PROFILES = {
   "720p30": {
-    resolution: "720p",
+    resolution: { width: 1280, height: 720 },
     maxFramerate: 30,
     maxBitrate: 3_000_000,
     degradationPreference: "balanced",
@@ -34,13 +34,14 @@ export const QUALITY_PROFILES = {
   },
   "1080p30": DEFAULT_QUALITY_SETTINGS,
   "1080p60": {
-    resolution: "1080p",
+    resolution: { width: 1920, height: 1080 },
     maxFramerate: 60,
     maxBitrate: 8_000_000,
     degradationPreference: "balanced",
     maxAudioBitrate: 128000,
   },
-} as const satisfies Record<QualityProfileId, QualitySettings>;
+} as const satisfies Record<string, QualitySettings>;
+export type QualityProfileId = keyof typeof QUALITY_PROFILES;
 
 export const QUALITY_PROFILE_KEYS = {
   "720p30": "host.quality.720p30",
@@ -49,14 +50,20 @@ export const QUALITY_PROFILE_KEYS = {
 } as const satisfies Record<QualityProfileId, CopyKey>;
 
 export const QUALITY_RESOLUTIONS = {
-  "480p": { width: 854, height: 480, label: "480p" },
-  "720p": { width: 1280, height: 720, label: "720p" },
-  "1080p": { width: 1920, height: 1080, label: "1080p" },
-  "1440p": { width: 2560, height: 1440, label: "1440p" },
-} as const satisfies Record<
-  QualityResolution,
-  { width: number; height: number; label: string }
->;
+  "480p": { width: 854, height: 480 },
+  "720p": { width: 1280, height: 720 },
+  "1080p": { width: 1920, height: 1080 },
+  "1440p": { width: 2560, height: 1440 },
+} as const satisfies Record<string, QualityResolution>;
+
+export function qualityResolutionEqual(left: QualityResolution, right: QualityResolution): boolean {
+  return left.width === right.width && left.height === right.height;
+}
+
+export function qualityResolutionLabel(resolution: QualityResolution): string {
+  return Object.entries(QUALITY_RESOLUTIONS).find(([, size]) => qualityResolutionEqual(size, resolution))?.[0]
+    ?? `${resolution.width}×${resolution.height}`;
+}
 
 export const DEGRADATION_PREFERENCE_KEYS = {
   "maintain-resolution": "host.advanced.preference.resolution",
@@ -127,7 +134,7 @@ export function videoQualitySettingsEqual(
   right: QualitySettings,
 ): boolean {
   return (
-    left.resolution === right.resolution &&
+    qualityResolutionEqual(left.resolution, right.resolution) &&
     left.maxFramerate === right.maxFramerate &&
     left.maxBitrate === right.maxBitrate &&
     left.degradationPreference === right.degradationPreference
@@ -150,7 +157,7 @@ export function matchingQualityProfileId(
   for (const id of Object.keys(QUALITY_PROFILES) as QualityProfileId[]) {
     const profile = QUALITY_PROFILES[id];
     if (
-      settings.resolution === profile.resolution &&
+      qualityResolutionEqual(settings.resolution, profile.resolution) &&
       settings.maxFramerate === profile.maxFramerate &&
       settings.maxBitrate === profile.maxBitrate &&
       settings.degradationPreference === profile.degradationPreference
@@ -166,11 +173,11 @@ export function qualitySettingsLabel(settings: QualitySettings): string {
   if (profileId) {
     return say(QUALITY_PROFILE_KEYS[profileId]);
   }
-  return `${QUALITY_RESOLUTIONS[settings.resolution].label} ${settings.maxFramerate} fps · ${(settings.maxBitrate / 1_000_000).toFixed(1)} Mbps · ${say(DEGRADATION_PREFERENCE_KEYS[settings.degradationPreference])}`;
+  return `${qualityResolutionLabel(settings.resolution)} ${settings.maxFramerate} fps · ${(settings.maxBitrate / 1_000_000).toFixed(1)} Mbps · ${say(DEGRADATION_PREFERENCE_KEYS[settings.degradationPreference])}`;
 }
 
 function captureConstraints(profile: QualityProfile): MediaTrackConstraints {
-  const resolution = QUALITY_RESOLUTIONS[profile.resolution];
+  const resolution = profile.resolution;
   return {
     width: { ideal: resolution.width, max: resolution.width },
     height: { ideal: resolution.height, max: resolution.height },
@@ -219,7 +226,7 @@ export type BrowserCaptureSource = "browser" | "camera";
 
 export async function captureBrowserSource(profile: QualityProfile, source: BrowserCaptureSource, deviceId = ""): Promise<MediaStream> {
   if (source !== "camera") return captureDisplay(profile);
-  const resolution = QUALITY_RESOLUTIONS[profile.resolution];
+  const resolution = profile.resolution;
   const stream = await navigator.mediaDevices.getUserMedia({ audio: false, video: {
     ...(deviceId ? { deviceId: { exact: deviceId } } : { facingMode: { ideal: "environment" } }),
     width: { ideal: resolution.width }, height: { ideal: resolution.height },
@@ -295,7 +302,7 @@ function requestedScaleResolutionDownBy(
     sender.track && typeof sender.track.getSettings === "function"
       ? senderCaptureTrack(sender.track).getSettings()
       : undefined;
-  const ceiling = QUALITY_RESOLUTIONS[profile.resolution];
+  const ceiling = profile.resolution;
   if (!source?.width || !source.height) {
     return 1;
   }
diff --git a/src/client/native/wire.ts b/src/client/native/wire.ts
index 05b3e39f6..a83e95652 100644
--- a/src/client/native/wire.ts
+++ b/src/client/native/wire.ts
@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { sfuMediaSchema, maxAudioBitrateSchema } from "../../shared/protocol";
+import { sfuMediaSchema, maxAudioBitrateSchema, qualityResolutionSchema } from "../../shared/protocol";
 
 export const NATIVE_CLIENT_PROTOCOL = 10;
 export const NATIVE_CLIENT_PORT_START = 39_721;
@@ -34,6 +34,7 @@ export const nativeHealthSchema = nativeDiscoveryIdentitySchema.extend({
   nativeMedia: z
     .object({
       maxAudioBitrate: maxAudioBitrateSchema.optional(),
+      maxVideoResolution: qualityResolutionSchema.optional(),
       receiverReuse: z.boolean().default(false),
       video: z.boolean().default(false),
       processAudio: z.boolean().default(false),
diff --git a/src/client/pages/ControlsPreview.tsx b/src/client/pages/ControlsPreview.tsx
index a2c66c5bc..8f2aca9e4 100644
--- a/src/client/pages/ControlsPreview.tsx
+++ b/src/client/pages/ControlsPreview.tsx
@@ -19,9 +19,9 @@ import { LauncherForm, type AppMode } from "../components/living/LauncherForm";
 import { AppReleaseNotice } from "../components/living/AppReleaseNotice";
 import { useTheaterMode } from "../components/living/use-theater-mode";
 
-import { QualityPresets } from "../components/living/QualityPresets";
+import { QualityPresets, ResolutionControl } from "../components/living/QualityPresets";
 import { RoomCodeInput } from "../components/living/RoomCodeInput";
-import type { QualityProfileId } from "../media/quality";
+import { MAX_CAPTURE_RESOLUTION, QUALITY_PROFILES, type QualityProfileId, type QualityResolution } from "../media/quality";
 import type { loadCameraPreviews } from "../media/camera-previews";
 import { Tooltip } from "../components/living/Tooltip";
 import { StatusIndicator } from "../components/living/StatusIndicator";
@@ -57,6 +57,7 @@ export function ControlsPreview() {
   const [voiceProcessing, setVoiceProcessing] = useState(true);
   const [microphoneDevice, setMicrophoneDevice] = useState("");
   const [sharingSettings, setSharingSettings] = useState(false);
+  const [resolution, setResolution] = useState<QualityResolution>(QUALITY_PROFILES["1080p30"].resolution);
   const [launchMode, setLaunchMode] = useState<AppMode>("link");
   const [majorUpdate, setMajorUpdate] = useState(true);
   const releaseVersion = majorUpdate ? "v2.0.0" : "v1.1.0";
@@ -64,7 +65,7 @@ export function ControlsPreview() {
   const [launchSite, setLaunchSite] = useState("");
   const [launchPassword, setLaunchPassword] = useState("");
   const [launchLan, setLaunchLan] = useState("192.0.2.10");
-  const [preset, setPreset] = useState<QualityProfileId>("1080p30");
+  const [preset, setPreset] = useState<QualityProfileId | null>("1080p30");
   const [policy, setPolicy] = useState<"open" | "private">("open");
   const [roomPassword, setRoomPassword] = useState(false);
   const [includeCredential, setIncludeCredential] = useState(true);
@@ -117,7 +118,9 @@ export function ControlsPreview() {
           <Btn id="host-stop-share" icon="stop" tone="danger" title="host.stop" cap="host.stop" hint="hint-share-stop" onClick={notify} />
         </div>
         <SharingSettings id="preview-sharing-settings" open={sharingSettings}
-          presets={<QualityPresets selected={preset} onSelect={setPreset} />}
+          presets={<QualityPresets selected={preset} onSelect={id => { setPreset(id); setResolution(QUALITY_PROFILES[id].resolution); }} />}
+          picture={<ResolutionControl value={resolution} maximum={MAX_CAPTURE_RESOLUTION} disabled={false}
+            onChange={value => { setResolution(value); setPreset(null); }} />}
           audio={<><div className="lr-door-group lr-source-audio-settings">
             <SwitchItem checked={sound} onChange={setSound} label={t("host.sourcePicker.systemAudio")}
               hint={sound ? "hint-stop-audio" : "hint-share-audio"} />
diff --git a/src/client/pages/HostPage.tsx b/src/client/pages/HostPage.tsx
index 5ed8d233e..61886604c 100644
--- a/src/client/pages/HostPage.tsx
+++ b/src/client/pages/HostPage.tsx
@@ -53,7 +53,7 @@ import type { ComicKind } from "../components/living/Comic";
 import type { HintKind } from "../ui/visual-kinds";
 import type { ComicTone } from "../components/living/comic-presentation";
 import { Tooltip } from "../components/living/Tooltip";
-import { QualityPresets } from "../components/living/QualityPresets";
+import { QualityPresets, ResolutionControl } from "../components/living/QualityPresets";
 import { RoomCodeInput, RoomCodeError } from "../components/living/RoomCodeInput";
 import { MetricCell } from "../components/living/Metrics";
 import {
@@ -128,7 +128,8 @@ import {
   matchingQualityProfileId,
   QUALITY_PROFILES,
   DEGRADATION_PREFERENCE_KEYS,
-  QUALITY_RESOLUTIONS,
+  MAX_CAPTURE_RESOLUTION,
+  qualityResolutionEqual,
   qualitySettingsEqual,
   qualitySettingsLabel,
   screenAudioBitrate,
@@ -137,7 +138,6 @@ import {
   setMediaPaused,
   videoQualitySettingsEqual,
   type DegradationPreference,
-  type QualityResolution,
   type QualitySettings,
   type ScreenAudioPreset,
 } from "../media/quality";
@@ -1729,7 +1729,7 @@ export function HostPage({
       nextProfile,
     );
     const captureChanged =
-      previousProfile.resolution !== nextProfile.resolution ||
+      !qualityResolutionEqual(previousProfile.resolution, nextProfile.resolution) ||
       previousProfile.maxFramerate !== nextProfile.maxFramerate;
     const audioChanged =
       screenAudioBitrate(previousProfile.maxAudioBitrate) !==
@@ -3597,6 +3597,11 @@ export function HostPage({
   const audioBitrateCeiling = Math.min(MAX_SCREEN_AUDIO_BITRATE, nativeActive
     ? nativeClientRef.current?.health.nativeMedia.maxAudioBitrate ?? MAX_SCREEN_AUDIO_BITRATE
     : MAX_SCREEN_AUDIO_BITRATE);
+  const nativeResolutionCeiling = nativeActive ? nativeClientRef.current?.health.nativeMedia.maxVideoResolution : undefined;
+  const resolutionCeiling = {
+    width: Math.min(MAX_CAPTURE_RESOLUTION.width, nativeResolutionCeiling?.width ?? MAX_CAPTURE_RESOLUTION.width),
+    height: Math.min(MAX_CAPTURE_RESOLUTION.height, nativeResolutionCeiling?.height ?? MAX_CAPTURE_RESOLUTION.height),
+  };
 
   return (
     <div className="lr-app">
@@ -3844,28 +3849,9 @@ export function HostPage({
                   <Glyph name="expand" size={19} />
                   <Cap k="host.advanced.resolution" />
                 </span>
-                <div
-                  className="lr-row-group"
-                  role="group"
-                  aria-label={t("host.advanced.resolution")}
-                >
-                  {(
-                    Object.keys(QUALITY_RESOLUTIONS) as QualityResolution[]
-                  ).map((resolution) => (
-                    <Chip
-                      key={resolution}
-                      selected={advancedQuality.resolution === resolution}
-                      disabled={phase === "starting" || switchingSource}
-                      title={QUALITY_RESOLUTIONS[resolution].label}
-                      hint="hint-quality"
-                      onClick={() =>
-                        changeAdvancedQuality({ resolution })
-                      }
-                    >
-                      {QUALITY_RESOLUTIONS[resolution].label}
-                    </Chip>
-                  ))}
-                </div>
+                <ResolutionControl value={advancedQuality.resolution} maximum={resolutionCeiling}
+                  disabled={phase === "starting" || switchingSource}
+                  onChange={resolution => changeAdvancedQuality({ resolution })} />
               </div>
               <div className="lr-sharing-limits">
                 <div className="lr-door-group">
diff --git a/src/client/sfu/publisher.ts b/src/client/sfu/publisher.ts
index 46514e5f5..04b3893b2 100644
--- a/src/client/sfu/publisher.ts
+++ b/src/client/sfu/publisher.ts
@@ -8,7 +8,6 @@ import {
   configureScreenAudioSender,
   configureVideoSender,
   needsStartupVideoProfile,
-  QUALITY_RESOLUTIONS,
   screenAudioBitrate,
   screenAudioSenderCeiling,
   senderParameterWarning,
@@ -436,7 +435,7 @@ export class SfuPublisher {
 
   private encodings(profile: QualityProfile): RTCRtpEncodingParameters[] {
     const settings = this.video ? senderCaptureTrack(this.video).getSettings() : undefined;
-    const ceiling = QUALITY_RESOLUTIONS[profile.resolution];
+    const ceiling = profile.resolution;
     const width = settings?.width ?? ceiling.width;
     const height = settings?.height ?? ceiling.height;
     const scale = Math.max(1, width / ceiling.width, height / ceiling.height);
@@ -465,7 +464,7 @@ export class SfuPublisher {
 
   private media(profile: QualityProfile): SfuMedia {
     const settings = senderCaptureTrack(this.video!).getSettings();
-    const ceiling = QUALITY_RESOLUTIONS[profile.resolution];
+    const ceiling = profile.resolution;
     return {
       codec: this.codec,
       layers: this.encodings(profile).map((encoding) => ({
diff --git a/src/client/styles.css b/src/client/styles.css
index e93f3ae56..fa225d2ac 100644
--- a/src/client/styles.css
+++ b/src/client/styles.css
@@ -1178,6 +1178,11 @@ html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #334
 .lr-input input[type="password"]:not(:placeholder-shown) { letter-spacing: .25em; }
 .lr-input.lr-audio-bitrate { width: 160px; max-width: 100%; font-family: var(--mono); }
 .lr-audio-bitrate span { color: var(--muted); font-size: 12px; }
+.lr-input.lr-video-size { display: grid; grid-template-columns: minmax(0, 1fr) auto minmax(0, 1fr) auto; gap: 4px; padding-inline: 8px; width: 252px; max-width: 100%; font-family: var(--mono); }
+.lr-resolution-controls { display: flex; flex-direction: column; gap: 8px; min-width: 0; }
+.lr-video-size input { width: 100%; padding: 0; text-align: center; appearance: textfield; }
+.lr-video-size input::-webkit-inner-spin-button, .lr-video-size input::-webkit-outer-spin-button { appearance: none; margin: 0; }
+.lr-video-size span { color: var(--muted); font-size: 12px; }
 .lr-welcome { width: 100%; min-width: 0; max-width: 100%; margin: 0; overflow: hidden; color: inherit; font-size: 15px; font-weight: 600; line-height: 1.7; text-align: center; white-space: nowrap; text-overflow: ellipsis; }
 .lr-welcome:not(.is-cipher)::before { content: "✦"; color: #d7982b; margin-right: 8px; }
 .lr-welcome-cipher { display: inline-flex; align-items: center; gap: 8px; vertical-align: middle; opacity: .72; white-space: nowrap; }
diff --git a/src/client/webrtc/video-codec-preflight.ts b/src/client/webrtc/video-codec-preflight.ts
index 1084082b7..e7c892027 100644
--- a/src/client/webrtc/video-codec-preflight.ts
+++ b/src/client/webrtc/video-codec-preflight.ts
@@ -1,6 +1,5 @@
 import {
   configureVideoSender,
-  QUALITY_RESOLUTIONS,
   startupVideoProfile,
   type QualityProfile,
 } from "../media/quality";
@@ -56,7 +55,7 @@ export function h264ProbeTarget(
   settings: MediaTrackSettings,
   profile: QualityProfile,
 ): H264ProbeTarget {
-  const ceiling = QUALITY_RESOLUTIONS[profile.resolution];
+  const ceiling = profile.resolution;
   const sourceWidth = positiveNumber(settings.width, ceiling.width);
   const sourceHeight = positiveNumber(settings.height, ceiling.height);
   const scale = Math.max(
diff --git a/src/shared/protocol.ts b/src/shared/protocol.ts
index 87ec7301a..0d5b374bd 100644
--- a/src/shared/protocol.ts
+++ b/src/shared/protocol.ts
@@ -173,19 +173,12 @@ export const roomCodeSchema = z
 export const roleSchema = z.enum(["host", "viewer"]);
 export type Role = z.infer<typeof roleSchema>;
 
-export const qualityProfileIdSchema = z.enum([
-  "720p30",
-  "1080p30",
-  "1080p60",
-]);
-export type QualityProfileId = z.infer<typeof qualityProfileIdSchema>;
-
-export const qualityResolutionSchema = z.enum([
-  "480p",
-  "720p",
-  "1080p",
-  "1440p",
-]);
+// Describes a requested ceiling, not encoder availability or an allocation.
+// Match the existing media-description bound; adapters retain their own limits.
+export const qualityResolutionSchema = z.object({
+  width: z.number().int().min(4).max(8192).multipleOf(2),
+  height: z.number().int().min(4).max(8192).multipleOf(2),
+}).strict();
 export type QualityResolution = z.infer<typeof qualityResolutionSchema>;
 
 export const degradationPreferenceSchema = z.enum([
@@ -212,7 +205,7 @@ export const qualitySettingsSchema = z
   .strict();
 export type QualitySettings = z.infer<typeof qualitySettingsSchema>;
 export const DEFAULT_QUALITY_SETTINGS = {
-  resolution: "1080p",
+  resolution: { width: 1920, height: 1080 },
   maxFramerate: 30,
   maxBitrate: 5_000_000,
   degradationPreference: "balanced",
diff --git a/tests/browser-encoding-pool.test.ts b/tests/browser-encoding-pool.test.ts
index 16b654428..13209f3c3 100644
--- a/tests/browser-encoding-pool.test.ts
+++ b/tests/browser-encoding-pool.test.ts
@@ -424,7 +424,7 @@ describe("Browser encoding pool ownership", () => {
       }
       if (change === "budget") { strong.demand.budget = 500_000; await sample(); }
       if (change === "target demand") { weak.demand.budget = 500_000; await sample(); }
-      if (change === "profile") await strong.handle.updateProfile({ ...profile, resolution: "720p" });
+      if (change === "profile") await strong.handle.updateProfile({ ...profile, resolution: { width: 1280, height: 720 } });
       const key = ["key dimensions", "quiet current", "unknown current"].includes(change)
         ? { width: 960, height: 540 } : { width: 1920, height: 1080 };
       expect(accept(key)).toBe(false);
diff --git a/tests/client-state.test.ts b/tests/client-state.test.ts
index 368ed2787..7c9e2b1fa 100644
--- a/tests/client-state.test.ts
+++ b/tests/client-state.test.ts
@@ -1724,7 +1724,7 @@ describe("client signaling recovery policy", () => {
     });
     const shareGeneration = "share_generation_12345678";
     const initialQuality = {
-      resolution: "1080p",
+      resolution: { width: 1920, height: 1080 },
       maxFramerate: 30,
       maxBitrate: 5_000_000,
       degradationPreference: "balanced",
@@ -1732,7 +1732,7 @@ describe("client signaling recovery policy", () => {
     } as const;
     const firstPending = {
       ...initialQuality,
-      resolution: "720p",
+      resolution: { width: 1280, height: 720 },
       maxBitrate: 3_000_000,
     } as const;
     const latestPending = {
@@ -2041,7 +2041,7 @@ describe("client signaling recovery policy", () => {
         sfuPublicationGeneration: null,
       },
       qualitySettings: {
-        resolution: "1080p",
+        resolution: { width: 1920, height: 1080 },
         maxFramerate: 30,
         maxBitrate: 5_000_000,
         degradationPreference: "balanced",
diff --git a/tests/fixtures/wire-samples.json b/tests/fixtures/wire-samples.json
index e08c3df43..62ca26220 100644
--- a/tests/fixtures/wire-samples.json
+++ b/tests/fixtures/wire-samples.json
@@ -25,7 +25,10 @@
     "signalCloseCodeAuthenticationFailed": 4003,
     "signalCloseCodeViewerAccessRevoked": 4004,
     "defaultQualitySettings": {
-      "resolution": "1080p",
+      "resolution": {
+        "width": 1920,
+        "height": 1080
+      },
       "maxFramerate": 30,
       "maxBitrate": 5000000,
       "degradationPreference": "balanced",
@@ -55,7 +58,7 @@
     {
       "name": "authenticate-host-full",
       "schema": "client",
-      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"host\",\"token\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"clientId\":\"client_12345678\",\"shareGeneration\":\"share_generation_12345678\",\"sharingPaused\":false,\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000},\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false},\"viewerPresence\":true,\"displayName\":\"小明\"}",
+      "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v24\",\"roomId\":\"1234\",\"role\":\"host\",\"token\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"clientId\":\"client_12345678\",\"shareGeneration\":\"share_generation_12345678\",\"sharingPaused\":false,\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000},\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false},\"viewerPresence\":true,\"displayName\":\"小明\"}",
       "valid": true
     },
     {
@@ -277,37 +280,37 @@
     {
       "name": "set-quality-settings",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\"}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\"}}",
       "valid": true
     },
     {
       "name": "set-quality-settings-with-audio",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000}}",
       "valid": true
     },
     {
       "name": "set-quality-settings-legacy-codec",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"videoCodec\":\"vp8\"}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"videoCodec\":\"vp8\"}}",
       "valid": false
     },
     {
       "name": "set-quality-settings-framerate-below-floor",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":14,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\"}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":14,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\"}}",
       "valid": false
     },
     {
       "name": "set-quality-settings-fractional-bitrate",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":5000000.5,\"degradationPreference\":\"maintain-resolution\"}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":60,\"maxBitrate\":5000000.5,\"degradationPreference\":\"maintain-resolution\"}}",
       "valid": false
     },
     {
       "name": "set-quality-settings-missing-framerate",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\"}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\"}}",
       "valid": false
     },
     {
@@ -817,31 +820,31 @@
     {
       "name": "set-quality-settings-folded-audio-invalid",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxaudiobitrate\":\"invalid\"}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxaudiobitrate\":\"invalid\"}}",
       "valid": false
     },
     {
       "name": "set-quality-settings-folded-audio-null",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxaudiobitrate\":null}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxaudiobitrate\":null}}",
       "valid": false
     },
     {
       "name": "set-quality-settings-folded-key-collision",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000,\"maxaudiobitrate\":\"invalid\"}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000,\"maxaudiobitrate\":\"invalid\"}}",
       "valid": false
     },
     {
       "name": "set-quality-settings-exact-duplicate-last-valid",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":null,\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\"}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":null,\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\"}}",
       "valid": true
     },
     {
       "name": "set-quality-settings-exact-duplicate-last-null",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxFramerate\":null,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\"}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":60,\"maxFramerate\":null,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\"}}",
       "valid": false
     },
     {
@@ -1057,61 +1060,61 @@
     {
       "name": "numeric-audio-6000",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":6000}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":6000}}",
       "valid": true
     },
     {
       "name": "numeric-audio-96000",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":96000}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":96000}}",
       "valid": true
     },
     {
       "name": "numeric-audio-256000",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":256000}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":256000}}",
       "valid": true
     },
     {
       "name": "numeric-audio-320000",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":320000}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":320000}}",
       "valid": true
     },
     {
       "name": "numeric-audio-510000",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":510000}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":510000}}",
       "valid": true
     },
     {
       "name": "numeric-audio-5999",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":5999}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":5999}}",
       "valid": false
     },
     {
       "name": "numeric-audio-510001",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":510001}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":510001}}",
       "valid": false
     },
     {
       "name": "numeric-audio-128000.5",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":128000.5}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":128000.5}}",
       "valid": false
     },
     {
       "name": "numeric-audio-null",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":null}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":null}}",
       "valid": false
     },
     {
       "name": "numeric-audio-music",
       "schema": "client",
-      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":\"music\"}}",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":\"music\"}}",
       "valid": false
     },
     {
@@ -1119,6 +1122,84 @@
       "schema": "client",
       "json": "{\"type\":\"authenticate\",\"protocol\":\"piik-v23\",\"roomId\":\"1234\",\"role\":\"viewer\",\"clientId\":\"client_12345678\"}",
       "valid": false
+    },
+    {
+      "name": "set-quality-settings-numeric-16-10",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1200},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":128000}}",
+      "valid": true
+    },
+    {
+      "name": "set-quality-settings-portrait",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":720,\"height\":1280},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":128000}}",
+      "valid": true
+    },
+    {
+      "name": "set-quality-settings-square",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1080,\"height\":1080},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":128000}}",
+      "valid": true
+    },
+    {
+      "name": "set-quality-settings-future-4k-description",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":3840,\"height\":2160},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":128000}}",
+      "valid": true
+    },
+    {
+      "name": "set-quality-settings-maximum-description",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":8192,\"height\":8192},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":128000}}",
+      "valid": true
+    },
+    {
+      "name": "set-quality-settings-too-wide",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":8194,\"height\":1080},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":128000}}",
+      "valid": false
+    },
+    {
+      "name": "set-quality-settings-too-tall",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":8194},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":128000}}",
+      "valid": false
+    },
+    {
+      "name": "set-quality-settings-too-small",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":2,\"height\":1080},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":128000}}",
+      "valid": false
+    },
+    {
+      "name": "set-quality-settings-odd-size",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1919,\"height\":1080},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":128000}}",
+      "valid": false
+    },
+    {
+      "name": "set-quality-settings-fractional-size",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080.5},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":128000}}",
+      "valid": false
+    },
+    {
+      "name": "set-quality-settings-missing-height",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":128000}}",
+      "valid": false
+    },
+    {
+      "name": "set-quality-settings-null-size",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":null},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":128000}}",
+      "valid": false
+    },
+    {
+      "name": "set-quality-settings-ui-label-on-wire",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080,\"label\":\"1080p\"},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":128000}}",
+      "valid": false
     }
   ],
   "serverMessages": [
@@ -1128,19 +1209,19 @@
     },
     {
       "name": "authenticated-host-minimal",
-      "json": "{\"type\":\"authenticated\",\"protocol\":\"piik-v24\",\"peerId\":\"host_12345678\",\"maxViewers\":8,\"endpointMediaCopyCapacity\":2,\"hostOnline\":true,\"connectionId\":null,\"iceConfig\":{\"iceServers\":[],\"natPredictionStunUrls\":[]},\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false},\"codeEntryPolicy\":\"open\",\"viewerAuthorizationGeneration\":\"viewer_generation_12345678\",\"mediaMode\":\"peer-assisted\",\"shareGeneration\":\"share_generation_12345678\",\"routeRevision\":0,\"routeAssignment\":{\"upstream\":{\"kind\":\"none\"},\"childPeerIds\":[],\"sfuPublicationGeneration\":null},\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000},\"role\":\"host\",\"viewerPasswordEnabled\":false}"
+      "json": "{\"type\":\"authenticated\",\"protocol\":\"piik-v24\",\"peerId\":\"host_12345678\",\"maxViewers\":8,\"endpointMediaCopyCapacity\":2,\"hostOnline\":true,\"connectionId\":null,\"iceConfig\":{\"iceServers\":[],\"natPredictionStunUrls\":[]},\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false},\"codeEntryPolicy\":\"open\",\"viewerAuthorizationGeneration\":\"viewer_generation_12345678\",\"mediaMode\":\"peer-assisted\",\"shareGeneration\":\"share_generation_12345678\",\"routeRevision\":0,\"routeAssignment\":{\"upstream\":{\"kind\":\"none\"},\"childPeerIds\":[],\"sfuPublicationGeneration\":null},\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000},\"role\":\"host\",\"viewerPasswordEnabled\":false}"
     },
     {
       "name": "authenticated-host-full",
-      "json": "{\"type\":\"authenticated\",\"protocol\":\"piik-v24\",\"peerId\":\"host_12345678\",\"maxViewers\":8,\"endpointMediaCopyCapacity\":2,\"hostOnline\":true,\"connectionId\":\"connection_12345678\",\"iceConfig\":{\"iceServers\":[{\"urls\":\"stun:stun.example.test:3478\"},{\"urls\":[\"stun:stun-1.example.test:3478\",\"stun:[2001:db8::1]:3478\"]}],\"natPredictionStunUrls\":[\"stun:nat.example.test:3478\"]},\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false},\"codeEntryPolicy\":\"open\",\"viewerAuthorizationGeneration\":\"viewer_generation_12345678\",\"mediaMode\":\"peer-assisted\",\"shareGeneration\":\"share_generation_12345678\",\"routeRevision\":0,\"routeAssignment\":{\"upstream\":{\"kind\":\"sfu\"},\"childPeerIds\":[],\"sfuPublicationGeneration\":\"generation_12345678\"},\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000},\"role\":\"host\",\"viewerPasswordEnabled\":false}"
+      "json": "{\"type\":\"authenticated\",\"protocol\":\"piik-v24\",\"peerId\":\"host_12345678\",\"maxViewers\":8,\"endpointMediaCopyCapacity\":2,\"hostOnline\":true,\"connectionId\":\"connection_12345678\",\"iceConfig\":{\"iceServers\":[{\"urls\":\"stun:stun.example.test:3478\"},{\"urls\":[\"stun:stun-1.example.test:3478\",\"stun:[2001:db8::1]:3478\"]}],\"natPredictionStunUrls\":[\"stun:nat.example.test:3478\"]},\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false},\"codeEntryPolicy\":\"open\",\"viewerAuthorizationGeneration\":\"viewer_generation_12345678\",\"mediaMode\":\"peer-assisted\",\"shareGeneration\":\"share_generation_12345678\",\"routeRevision\":0,\"routeAssignment\":{\"upstream\":{\"kind\":\"sfu\"},\"childPeerIds\":[],\"sfuPublicationGeneration\":\"generation_12345678\"},\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000},\"role\":\"host\",\"viewerPasswordEnabled\":false}"
     },
     {
       "name": "authenticated-viewer-minimal",
-      "json": "{\"type\":\"authenticated\",\"protocol\":\"piik-v24\",\"peerId\":\"viewer_12345678\",\"maxViewers\":8,\"endpointMediaCopyCapacity\":2,\"hostOnline\":true,\"hostPaused\":false,\"connectionId\":null,\"iceConfig\":{\"iceServers\":[],\"natPredictionStunUrls\":[]},\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false},\"codeEntryPolicy\":\"open\",\"viewerAuthorizationGeneration\":\"viewer_generation_12345678\",\"mediaMode\":\"peer-assisted\",\"shareGeneration\":\"share_generation_12345678\",\"routeRevision\":0,\"routeAssignment\":{\"upstream\":{\"kind\":\"none\"},\"childPeerIds\":[],\"sfuPublicationGeneration\":null},\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000},\"role\":\"viewer\"}"
+      "json": "{\"type\":\"authenticated\",\"protocol\":\"piik-v24\",\"peerId\":\"viewer_12345678\",\"maxViewers\":8,\"endpointMediaCopyCapacity\":2,\"hostOnline\":true,\"hostPaused\":false,\"connectionId\":null,\"iceConfig\":{\"iceServers\":[],\"natPredictionStunUrls\":[]},\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false},\"codeEntryPolicy\":\"open\",\"viewerAuthorizationGeneration\":\"viewer_generation_12345678\",\"mediaMode\":\"peer-assisted\",\"shareGeneration\":\"share_generation_12345678\",\"routeRevision\":0,\"routeAssignment\":{\"upstream\":{\"kind\":\"none\"},\"childPeerIds\":[],\"sfuPublicationGeneration\":null},\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000},\"role\":\"viewer\"}"
     },
     {
       "name": "authenticated-viewer-full",
-      "json": "{\"type\":\"authenticated\",\"protocol\":\"piik-v24\",\"peerId\":\"viewer_12345678\",\"maxViewers\":8,\"endpointMediaCopyCapacity\":2,\"hostOnline\":true,\"hostPaused\":true,\"connectionId\":\"connection_12345678\",\"iceConfig\":{\"iceServers\":[],\"natPredictionStunUrls\":[]},\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false},\"codeEntryPolicy\":\"open\",\"viewerAuthorizationGeneration\":\"viewer_generation_12345678\",\"mediaMode\":\"peer-assisted\",\"shareGeneration\":\"share_generation_12345678\",\"routeRevision\":0,\"routeAssignment\":{\"upstream\":{\"kind\":\"peer\",\"peerId\":\"parent_12345678\"},\"childPeerIds\":[\"child_12345678\",\"child_87654321\"],\"sfuPublicationGeneration\":null},\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000},\"role\":\"viewer\"}"
+      "json": "{\"type\":\"authenticated\",\"protocol\":\"piik-v24\",\"peerId\":\"viewer_12345678\",\"maxViewers\":8,\"endpointMediaCopyCapacity\":2,\"hostOnline\":true,\"hostPaused\":true,\"connectionId\":\"connection_12345678\",\"iceConfig\":{\"iceServers\":[],\"natPredictionStunUrls\":[]},\"routePolicy\":{\"peerOnly\":false,\"topologyOptimization\":true,\"natPrediction\":false},\"codeEntryPolicy\":\"open\",\"viewerAuthorizationGeneration\":\"viewer_generation_12345678\",\"mediaMode\":\"peer-assisted\",\"shareGeneration\":\"share_generation_12345678\",\"routeRevision\":0,\"routeAssignment\":{\"upstream\":{\"kind\":\"peer\",\"peerId\":\"parent_12345678\"},\"childPeerIds\":[\"child_12345678\",\"child_87654321\"],\"sfuPublicationGeneration\":null},\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000},\"role\":\"viewer\"}"
     },
     {
       "name": "signaling-challenge-response",
@@ -1196,11 +1277,11 @@
     },
     {
       "name": "quality-settings",
-      "json": "{\"type\":\"quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000}}"
+      "json": "{\"type\":\"quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\",\"maxAudioBitrate\":128000}}"
     },
     {
       "name": "quality-settings-without-audio",
-      "json": "{\"type\":\"quality-settings\",\"qualitySettings\":{\"resolution\":\"1080p\",\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\"}}"
+      "json": "{\"type\":\"quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\"}}"
     },
     {
       "name": "route-policy",
diff --git a/tests/host-peer-tracks.test.ts b/tests/host-peer-tracks.test.ts
index 59e812a37..0d367ace6 100644
--- a/tests/host-peer-tracks.test.ts
+++ b/tests/host-peer-tracks.test.ts
@@ -3377,7 +3377,7 @@ describe("ViewerRelay downstream ownership", () => {
 
   it("applies the latest profile to the current and future child", async () => {
     const customSettings = {
-      resolution: "1440p",
+      resolution: { width: 2560, height: 1440 },
       maxFramerate: 45,
       maxBitrate: 10_500_000,
       degradationPreference: "balanced",
diff --git a/tests/host-quality-ownership.test.ts b/tests/host-quality-ownership.test.ts
index ba333b917..b800a096a 100644
--- a/tests/host-quality-ownership.test.ts
+++ b/tests/host-quality-ownership.test.ts
@@ -3,7 +3,7 @@ import { createContext, runInContext } from "node:vm";
 import ts from "typescript";
 import { describe, expect, it, vi } from "vitest";
 import {
-  QUALITY_PROFILES, qualitySettingsEqual, qualitySettingsLabel,
+  QUALITY_PROFILES, qualitySettingsEqual, qualitySettingsLabel, qualityResolutionEqual,
   screenAudioBitrate, videoQualitySettingsEqual,
   type QualitySettings,
 } from "../src/client/media/quality";
@@ -108,7 +108,7 @@ function fixture(launchedByClient = true) {
     setDetails: vi.fn(), setNativeActive: vi.fn(),
     applyCaptureProfile: vi.fn(async (_stream: unknown, profile: QualitySettings) => { physical = profile; }),
     captureDetails: () => ({}),
-    qualitySettingsEqual, videoQualitySettingsEqual, screenAudioBitrate, qualitySettingsLabel,
+    qualitySettingsEqual, qualityResolutionEqual, videoQualitySettingsEqual, screenAudioBitrate, qualitySettingsLabel,
     say: (key: string) => key, syncHostSfuQualityWarning: () => null,
     NativeSenderPeer, discardPreparedHostChild: vi.fn(), removePeer: vi.fn(), startPeer: vi.fn(async () => undefined),
     nativePreviewTailRef: ref(Promise.resolve()), setSwitchingSource: vi.fn(),
diff --git a/tests/native-client.test.ts b/tests/native-client.test.ts
index 65dd2071b..ea7038842 100644
--- a/tests/native-client.test.ts
+++ b/tests/native-client.test.ts
@@ -672,7 +672,7 @@ describe("native App private wire", () => {
 
   it("keeps native share lifecycle responses as strict acknowledgements", () => {
     const profile = {
-      resolution: "1440p",
+      resolution: { width: 2560, height: 1440 },
       maxFramerate: 60,
       maxBitrate: 12_000_000,
       degradationPreference: "maintain-framerate",
diff --git a/tests/protocol.test.ts b/tests/protocol.test.ts
index c5c7228b9..3cbf4f307 100644
--- a/tests/protocol.test.ts
+++ b/tests/protocol.test.ts
@@ -44,7 +44,7 @@ it("accepts bounded future reaction events while keeping commands and known prop
   expect(serverMessageSchema.safeParse({ ...event, sender: { ...event.sender, peerId: "bad" } }).success).toBe(false);
 });
 const qualitySettings = {
-  resolution: "1080p",
+  resolution: { width: 1920, height: 1080 },
   maxFramerate: 60,
   maxBitrate: 8_000_000,
   degradationPreference: "maintain-resolution",
@@ -769,7 +769,7 @@ describe("client signaling protocol", () => {
     expect(
       clientMessageSchema.safeParse({
         type: "set-quality-settings",
-        qualitySettings: { ...qualitySettings, resolution: "480p" },
+        qualitySettings: { ...qualitySettings, resolution: { width: 854, height: 480 } },
       }).success,
     ).toBe(true);
     for (const maxAudioBitrate of [
@@ -1555,7 +1555,7 @@ describe("server signaling protocol", () => {
       serverMessageSchema.safeParse({
         type: "quality-settings",
         qualitySettings: {
-          resolution: "720p",
+          resolution: { width: 1280, height: 720 },
           maxFramerate: 30,
           maxBitrate: 3_000_000,
           degradationPreference: "balanced",
diff --git a/tests/quality-preference.test.ts b/tests/quality-preference.test.ts
index a279e3f09..bc3c51e3e 100644
--- a/tests/quality-preference.test.ts
+++ b/tests/quality-preference.test.ts
@@ -12,7 +12,7 @@ describe("sharing quality preference", () => {
       setItem: (key: string, value: string) => storage.set(key, value),
     } });
     expect(readPreferredQuality()).toEqual(DEFAULT_QUALITY_SETTINGS);
-    const chosen = { ...DEFAULT_QUALITY_SETTINGS, resolution: "1440p" as const,
+    const chosen = { ...DEFAULT_QUALITY_SETTINGS, resolution: { width: 2560, height: 1440 } as const,
       maxFramerate: 60, maxBitrate: 10_000_000, degradationPreference: "maintain-resolution" as const,
       maxAudioBitrate: 256_000 };
     savePreferredQuality(chosen);
diff --git a/tests/quality.test.ts b/tests/quality.test.ts
index d0b435f65..7de190a85 100644
--- a/tests/quality.test.ts
+++ b/tests/quality.test.ts
@@ -12,6 +12,8 @@ import {
   QUALITY_PROFILES,
   QUALITY_RESOLUTIONS,
   qualitySettingsEqual,
+  qualityResolutionLabel,
+  videoQualitySettingsEqual,
   screenAudioBitrate,
   screenAudioSenderCeiling,
   senderParameterWarning,
@@ -55,7 +57,7 @@ describe("realtime quality controls", () => {
       "1080p60",
     ]);
     expect(QUALITY_PROFILES["1080p30"]).toMatchObject({
-      resolution: "1080p",
+      resolution: { width: 1920, height: 1080 },
       maxFramerate: 30,
       maxBitrate: 5_000_000,
     });
@@ -65,11 +67,10 @@ describe("realtime quality controls", () => {
     expect(QUALITY_RESOLUTIONS["480p"]).toEqual({
       width: 854,
       height: 480,
-      label: "480p",
     });
     expect(
       Object.values(QUALITY_PROFILES).map((profile) => profile.resolution),
-    ).not.toContain("480p");
+    ).not.toContainEqual(QUALITY_RESOLUTIONS["480p"]);
   });
 
   it("bounds initial capture to the selected profile", async () => {
@@ -105,19 +106,29 @@ describe("realtime quality controls", () => {
     const { stream, videoTrack } = createVideoStream();
 
     await applyCaptureProfile(stream, {
-      resolution: "1440p",
+      resolution: { width: 1920, height: 1200 },
       maxFramerate: 45,
       maxBitrate: 9_500_000,
       degradationPreference: "balanced",
     });
 
     expect(videoTrack.applyConstraints).toHaveBeenCalledWith({
-      width: { ideal: 2560, max: 2560 },
-      height: { ideal: 1440, max: 1440 },
+      width: { ideal: 1920, max: 1920 },
+      height: { ideal: 1200, max: 1200 },
       frameRate: { ideal: 45, max: 45 },
     });
   });
 
+  it("compares deserialized size values without treating audio edits as new video", () => {
+    const profile = QUALITY_PROFILES["1080p30"];
+    const restored = JSON.parse(JSON.stringify(profile));
+    expect(qualitySettingsEqual(profile, restored)).toBe(true);
+    expect(videoQualitySettingsEqual(profile, { ...restored, maxAudioBitrate: 256_000 })).toBe(true);
+    expect(videoQualitySettingsEqual(profile, { ...restored, resolution: { width: 1920, height: 1200 } })).toBe(false);
+    expect(qualityResolutionLabel(restored.resolution)).toBe("1080p");
+    expect(qualityResolutionLabel({ width: 1920, height: 1200 })).toBe("1920×1200");
+  });
+
   it("leaves capture constraints with the owner of a remote track", async () => {
     const { videoTrack } = createVideoStream();
     videoTrack.getCapabilities = vi.fn(() => ({}));

From 34d2a3b6aab618d6a0e9536768bb6d0ff64f069d Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 17:35:36 +0800
Subject: [PATCH 073/262] feat(capture): admit bounded 4K30 video formats

---
 docs/research/native-client-media.md          | 38 +++++++++++++++----
 docs/standards/media-quality.md               | 10 ++++-
 docs/status.md                                |  9 +++--
 docs/todo.md                                  |  7 +++-
 internal/app/app.go                           |  2 +-
 .../app/mediaedge/relay_chain_fixture_test.go | 11 +++---
 internal/app/mediaedge/relay_derivation.go    |  2 +-
 internal/app/mediaedge/relay_input.go         | 13 ++++++-
 internal/app/mediaedge/relay_input_test.go    |  8 ++--
 internal/app/nativecapture/protocol.go        | 26 +++++++++++--
 internal/app/nativecapture/protocol_test.go   | 12 +++++-
 internal/app/nativecapture/stream.go          |  7 ++--
 internal/app/nativecontrol/session_test.go    |  8 +++-
 native/capture/darwin/main.swift              | 26 ++++++++-----
 native/capture/linux/main.c                   | 22 ++++++++---
 native/capture/linux/main.test.c              | 12 +++++-
 native/capture/windows/capture_geometry.h     |  7 +---
 native/capture/windows/capture_input.h        |  4 +-
 native/capture/windows/h264_decoder.h         | 14 +++----
 native/capture/windows/main.cpp               | 11 +++---
 native/capture/windows/output_worker.test.cpp | 14 ++++++-
 native/capture/windows/video_bounds.h         | 30 +++++++++++++++
 native/capture/windows/vp8_decoder.h          |  6 ++-
 23 files changed, 223 insertions(+), 76 deletions(-)
 create mode 100644 native/capture/windows/video_bounds.h

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 1e8c965b6..e2d428e9e 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -567,15 +567,13 @@ padding. Physical game, macOS/Linux and orientation-change acceptance remain ope
 
 The candidate's Native capture admission now shares the numeric dimension
 bounds already used by encoded outputs instead of duplicating the four UI
-presets. Even dimensions must fit within 2560x1440; a source ceiling must also
-yield a valid half-size output. Frame-rate, bitrate and output-count bounds
-remain unchanged. Candidate signaling and Native control now carry numeric
+presets. A source ceiling must also yield a valid half-size output. Bitrate and
+output-count bounds remain unchanged. Candidate signaling and Native control now carry numeric
 width/height ceilings, with custom input beside the existing UI shortcuts.
 Descriptive wire bounds are independent of the current implementation maximum;
-App discovery advertises that maximum, and Native rejects unsupported profiles
-as operation failures without retiring the control session. This does not yet
-admit product 4K. Removing an enum is not permission to allocate arbitrary media
-resources.
+App discovery advertises per-axis maxima, and Native rejects unsupported
+size/rate combinations as operation failures without retiring the control
+session. Removing an enum is not permission to allocate arbitrary media resources.
 
 The Windows H.264 UI gate applies a non-preset 960x600 ceiling during a live
 share and observes fitted output without replacing the Viewer media object.
@@ -584,6 +582,32 @@ sharing still pass. Value-based comparison prevents an identical deserialized
 size from turning an audio-only edit into a video update. Numeric preference
 round-trips and malformed/unsupported requests have separate boundary checks.
 
+Native bounds now admit 3840x2160 and 2160x3840 at 30 fps. The per-axis limit and
+pixel total remain independent; an arbitrary 3840-square picture is rejected.
+The output throughput ceiling uses H.264 Level 5.1's macroblock rate, including
+alignment for non-preset sizes. Coded padding and decoded reference buffers have
+their own pre-allocation bounds, following [H.264 Table A-1](https://www.itu.int/rec/T-REC-H.264)
+(also implemented in [FFmpeg's level table](https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/h264_levels.c)).
+The Windows decoder's advertised support remains
+[Level 5.1](https://learn.microsoft.com/en-us/windows/win32/medfound/h-264-video-decoder).
+An isolated Level 5.2 trial was rejected by this machine's hardware encoder at
+output-type setup; it did not reach the decoder. The candidate therefore keeps
+Level 5.1 and rejects 4K60 before allocating an encoder.
+
+Current production Windows code encoded and decoded 30 synthetic frames in each
+4K orientation, both with and without a D3D decoder manager. Retaining/uploading
+the decoded surface also passed. The normal Go/native encoded-input path then
+produced 1920x1080 and 1080x1920 derived outputs. Production H.264 and VP8 output
+workers also handled a 4K-to-1080p-to-4K synthetic source sequence, and Native
+VP8 derivation produced the lower output from the 4K input. The Browser H.264 SFU gate with
+a synthetic 3840x2160/30 source passed first-picture delivery, an explicit lower
+profile, audio-only edits with retained connections, subscription/page recovery
+and retirement. Windows native checks and Linux headless build/checks pass;
+macOS SDK and physical 4K capture are not verified here. The UI ceiling remains
+2560x1440 until combined capability controls and whole-route acceptance are
+complete. These checks do not establish 4K60, sustained device performance or
+universal portrait decoding support.
+
 The proposed boundary follows the
 [Media Capture specification](https://www.w3.org/TR/mediacapture-streams/#constrainable-interface):
 requested constraints, supported capabilities and actual settings have different
diff --git a/docs/standards/media-quality.md b/docs/standards/media-quality.md
index 8e713f29d..d5857cdeb 100644
--- a/docs/standards/media-quality.md
+++ b/docs/standards/media-quality.md
@@ -128,7 +128,7 @@ The three recommended profiles are ceilings, not delivery guarantees:
 
 `1080p30` is the default. The 2.0 candidate carries numeric width/height ceilings;
 480p, 720p, 1080p and 1440p remain UI shortcuts. Advanced picture settings also
-accept custom even dimensions within the current 2560x1440 implementation bound.
+accept custom even dimensions within the current 2560x1440 UI bound.
 Width and height form one applied edit. Larger wire-valid requests do not
 authorize an adapter to exceed its local capture, codec or allocation limits.
 Frame rate, bitrate, and `maintain-resolution | balanced |
@@ -145,6 +145,14 @@ derivation, validate every H.264 sequence parameter set's supported format,
 coded storage and visible crop; a later small descriptor cannot authorize earlier
 large input.
 
+The candidate Native adapters admit even visible dimensions up to 3840 per
+axis and 3840x2160 total pixels. Their shared output-rate bound follows H.264
+Level 5.1: 983,040 16x16 macroblocks per second, with at most 60 fps. This admits
+landscape/portrait 4K30 and existing 1440p60, not 4K60. Decoder alignment has a
+separate coded-storage bound; reference-picture storage is bounded before
+Native derivation. These are admission limits, not a device performance promise.
+The UI remains within its previous ceiling pending whole-route acceptance.
+
 Framework-driven downscaling under bandwidth or device pressure is valid within
 the selected degradation preference. A low decoded resolution alone is not a
 defect and does not justify a new quality floor. Review avoidable disruption,
diff --git a/docs/status.md b/docs/status.md
index 6039e2cf8..8fcc633a7 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -67,9 +67,12 @@ capture v7 and SQLite schema 2
 remain unchanged. Matched candidate App/Web/Server builds are required;
 1.x participants are rejected by the existing compatibility checks.
 Custom width/height controls retain the current implementation ceiling.
-Windows and Linux output now preserve source shape within that ceiling;
-axis-independent limits, Browser/macOS geometry, 4K and additional codecs are
-still assessed through the media boundary.
+Windows and Linux output now preserve source shape within that ceiling.
+Native admission now has axis-independent size, pixel-count and output-rate
+bounds for 4K30; local Windows encoding, decoding and derived-output checks pass.
+Browser H.264 4K30 also passes the existing SFU flow with a synthetic source.
+Browser/macOS geometry, 4K controls and whole-route/device acceptance, and
+additional codecs remain in the media assessment.
 Native Magicsock remains an isolated experiment with incomplete product
 integration and unresolved recovery cases. These proposals do not yet change
 the accepted contract or transport. A small external test is proposed before
diff --git a/docs/todo.md b/docs/todo.md
index b5f27e894..ba3d02fc0 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -54,8 +54,11 @@ Implementation needs a concrete useful result within the product model.
   capture gate within current implementation limits. Next assess
   source-aspect-preserving geometry and 4K through the same owners. Windows and
   Linux outputs now fit the source without a fixed padded landscape canvas;
-  axis-independent limits, Browser/macOS geometry and product 4K
-  admission remain open. Preserve
+  Native axis-independent 4K30 admission and bounded Windows codec/derived-output
+  checks now pass, as does Browser H.264 4K30 over the existing SFU gate with a
+  synthetic source. Next align controls with combined size/rate limits and verify
+  Native/Browser mixed routes, source/live changes and limited receivers.
+  Browser/macOS geometry and physical 4K capture remain open. Preserve
   safety limits and framework-owned adaptation. The
   [audio controls](./research/browser-screen-audio-quality.md#numeric-bitrate-assessment)
   retain explicit receive-limit enforcement and the current 320 kbps sender
diff --git a/internal/app/app.go b/internal/app/app.go
index 2e38d3430..b19955222 100644
--- a/internal/app/app.go
+++ b/internal/app/app.go
@@ -629,7 +629,7 @@ func discoverNativeMedia(ctx context.Context, configuredPath string) nativeRunti
 		capture:        capabilities,
 		capabilities: loopback.NativeMediaCapabilities{
 			MaxVideoResolution: protocol.QualityResolution{
-				Width: nativecapture.MaxVideoWidth, Height: nativecapture.MaxVideoHeight,
+				Width: nativecapture.MaxVideoDimension, Height: nativecapture.MaxVideoDimension,
 			},
 			MaxAudioBitrate:       nativeaudio.MaxSendBitrate,
 			ReceiverReuse:         true,
diff --git a/internal/app/mediaedge/relay_chain_fixture_test.go b/internal/app/mediaedge/relay_chain_fixture_test.go
index 7ad132931..5d1170a8e 100644
--- a/internal/app/mediaedge/relay_chain_fixture_test.go
+++ b/internal/app/mediaedge/relay_chain_fixture_test.go
@@ -44,10 +44,11 @@ func TestRelayChainEncodedFixture(t *testing.T) {
 		t.Fatal("encoded chain fixture exceeds 64 MiB")
 	}
 	type fixtureFrame struct {
-		Index, Width, Height int
-		Recovery             bool
-		DataHex              string
-		Data                 []byte `json:"-"`
+		Index         int
+		Width, Height uint32
+		Recovery      bool
+		DataHex       string
+		Data          []byte `json:"-"`
 	}
 	var frames []fixtureFrame
 	identities := make(map[[sha256.Size]byte][]int)
@@ -59,7 +60,7 @@ func TestRelayChainEncodedFixture(t *testing.T) {
 		}
 		check(err)
 		if len(frames) >= 400 || frame.Index != len(frames) || frame.Width <= 0 || frame.Height <= 0 ||
-			frame.Width > 2560 || frame.Height > 1440 || len(frame.DataHex) == 0 || len(frame.DataHex) > 8<<20 ||
+			!nativecapture.ValidVideoSize(frame.Width, frame.Height) || len(frame.DataHex) == 0 || len(frame.DataHex) > 8<<20 ||
 			len(frame.DataHex)%2 != 0 {
 			t.Fatal("encoded chain fixture has invalid or excessive frames")
 		}
diff --git a/internal/app/mediaedge/relay_derivation.go b/internal/app/mediaedge/relay_derivation.go
index 821b68dcc..1969caf65 100644
--- a/internal/app/mediaedge/relay_derivation.go
+++ b/internal/app/mediaedge/relay_derivation.go
@@ -132,7 +132,7 @@ func (source *Source) relayPlan() relayPlan {
 	plan.output = nativecapture.ScreenShareOutputs(*plan.profile)[0]
 	plan.output.Width = min(width/4*2, plan.output.Width)
 	plan.output.Height = min(height/4*2, plan.output.Height)
-	if !plan.output.Valid() || width > 2560 || height > 1440 {
+	if !plan.output.Valid() || !nativecapture.ValidVideoSize(width, height) {
 		return plan
 	}
 	demands := source.collectDemands(edges, nil)
diff --git a/internal/app/mediaedge/relay_input.go b/internal/app/mediaedge/relay_input.go
index c0e78b4fe..a1c98dfe5 100644
--- a/internal/app/mediaedge/relay_input.go
+++ b/internal/app/mediaedge/relay_input.go
@@ -151,10 +151,19 @@ func relayH264Size(nal []byte) (uint32, uint32, error) {
 	}
 	// Constrained Baseline uses 8-bit 4:2:0. Bound uncropped storage before
 	// allowing padding to be removed from the visible picture.
-	if sps.ChromaFormatIdc != 1 || sps.MaxNumRefFrames > 16 ||
-		width > nativecapture.MaxVideoWidth || height > nativecapture.MaxVideoHeight {
+	if sps.ChromaFormatIdc != 1 || !nativecapture.ValidCodedVideoSize(width, height) {
 		return 0, 0, errors.New("native H264 input storage exceeds its bound")
 	}
+	bufferedFrames := max(1, sps.MaxNumRefFrames)
+	if sps.VUI != nil && sps.VUI.BitstreamRestriction != nil {
+		bufferedFrames = max(bufferedFrames, sps.VUI.BitstreamRestriction.MaxDecFrameBuffering,
+			sps.VUI.BitstreamRestriction.MaxNumReorderFrames)
+	}
+	// Level 5.1 also bounds the decoded-picture buffer. A per-frame size check
+	// alone would let a larger picture multiply the old 16-reference allocation.
+	if bufferedFrames > 16 || width*height/256*uint64(bufferedFrames) > 184_320 {
+		return 0, 0, errors.New("native H264 input reference storage exceeds its bound")
+	}
 	if crop := sps.FrameCropping; crop != nil {
 		x := (uint64(crop.LeftOffset) + uint64(crop.RightOffset)) * 2
 		y := (uint64(crop.TopOffset) + uint64(crop.BottomOffset)) * cropUnitY
diff --git a/internal/app/mediaedge/relay_input_test.go b/internal/app/mediaedge/relay_input_test.go
index 3ba2e0dea..f44f397ea 100644
--- a/internal/app/mediaedge/relay_input_test.go
+++ b/internal/app/mediaedge/relay_input_test.go
@@ -106,9 +106,11 @@ func TestRelayH264AllocationBounds(t *testing.T) {
 		{"1440p", "6742c033da00a002d640", 2560, 1440},
 		{"padded-1080p", "6742c033da01e0089f95", 1920, 1080},
 		{"portrait-within-bound", "6742c033da01100b5e5d", 1080, 1440},
-		{"4k", "6742c033da00f0010f90", 0, 0},
-		{"portrait-overflow", "6742c033da008701e190", 0, 0},
-		{"padded-4k", "6742c033da00f00111f894", 0, 0},
+		{"4k", "6742c033da00f0010f90", 3840, 2160},
+		{"portrait-4k", "6742c033da008701e190", 2160, 3840},
+		{"padded-4k", "6742c033da00f00111f894", 3840, 2160},
+		{"4k-reference-buffer-limit", "6742c033f300780087c8", 3840, 2160},
+		{"4k-reference-buffer-overflow", "6742c033f380780087c8", 0, 0},
 		{"large-cropped-storage", "6742c033da00f001e1f8034940", 0, 0},
 		{"crop-overflow", "6742c033da0a37e000000300100000030004", 0, 0},
 		{"coded-size-overflow", "6742c033da000003000040000003000d90", 0, 0},
diff --git a/internal/app/nativecapture/protocol.go b/internal/app/nativecapture/protocol.go
index 5ba4f96a4..236e38eff 100644
--- a/internal/app/nativecapture/protocol.go
+++ b/internal/app/nativecapture/protocol.go
@@ -15,14 +15,32 @@ const (
 	maxMediaBytes       = encoded.MaxAccessUnitBytes
 	maxStatusBytes      = 4 * 1024
 	maxControlBytes     = 64
-	MaxVideoWidth       = 2560
-	MaxVideoHeight      = 1440
+	MaxVideoDimension   = 3840
+	MaxVideoPixels      = 3840 * 2160
+	// Coded pictures may include alignment outside the visible crop. Keep this
+	// separate from visible dimensions and within H.264 Level 5.1 storage.
+	MaxCodedVideoDimension = 4096
+	MaxCodedVideoPixels    = 36_864 * 16 * 16
 )
 
 // ValidVideoSize bounds the decoded picture in the current capture contract.
 func ValidVideoSize(width, height uint32) bool {
-	return width >= 2 && width <= MaxVideoWidth && width%2 == 0 &&
-		height >= 2 && height <= MaxVideoHeight && height%2 == 0
+	return width >= 2 && width <= MaxVideoDimension && width%2 == 0 &&
+		height >= 2 && height <= MaxVideoDimension && height%2 == 0 &&
+		uint64(width)*uint64(height) <= MaxVideoPixels
+}
+
+// ValidVideoFormat keeps both current encoders within the shared receive
+// ceiling (H.264 Level 5.1), including non-preset shapes and frame rates.
+func ValidVideoFormat(width, height, framerate uint32) bool {
+	return ValidVideoSize(width, height) && framerate >= 1 && framerate <= 60 &&
+		uint64((width+15)/16)*uint64((height+15)/16)*uint64(framerate) <= 983_040
+}
+
+func ValidCodedVideoSize(width, height uint64) bool {
+	return width >= 2 && width <= MaxCodedVideoDimension && width%2 == 0 &&
+		height >= 2 && height <= MaxCodedVideoDimension && height%2 == 0 &&
+		width*height <= MaxCodedVideoPixels
 }
 
 type FrameKind uint8
diff --git a/internal/app/nativecapture/protocol_test.go b/internal/app/nativecapture/protocol_test.go
index b356ada63..8ef21f0be 100644
--- a/internal/app/nativecapture/protocol_test.go
+++ b/internal/app/nativecapture/protocol_test.go
@@ -292,6 +292,9 @@ func TestVideoProfileUsesTheProductBounds(t *testing.T) {
 		{Width: 2560, Height: 1440, Framerate: 60, Bitrate: 12_000_000, Preference: "balanced"},
 		{Width: 1920, Height: 1200, Framerate: 30, Bitrate: 5_000_000, Preference: "balanced"},
 		{Width: 720, Height: 1280, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: 3840, Height: 2160, Framerate: 30, Bitrate: 12_000_000, Preference: "balanced"},
+		{Width: 2160, Height: 3840, Framerate: 30, Bitrate: 12_000_000, Preference: "balanced"},
+		{Width: 3000, Height: 2764, Framerate: 30, Bitrate: 12_000_000, Preference: "balanced"},
 		{Width: 4, Height: 4, Framerate: 15, Bitrate: 2_000_000, Preference: "balanced"},
 	} {
 		if !profile.Valid() {
@@ -309,8 +312,13 @@ func TestVideoProfileUsesTheProductBounds(t *testing.T) {
 		{Width: 1280, Height: 2, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
 		{Width: 1279, Height: 720, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
 		{Width: 1280, Height: 719, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
-		{Width: 2562, Height: 1440, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
-		{Width: 2560, Height: 1442, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: 3842, Height: 2160, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: 2160, Height: 3842, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: 3840, Height: 2162, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: 3000, Height: 2766, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: 3840, Height: 2160, Framerate: 31, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: 2160, Height: 3840, Framerate: 60, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: ^uint32(0), Height: ^uint32(0), Framerate: ^uint32(0), Bitrate: 3_000_000, Preference: "balanced"},
 		{Width: 1920, Height: 1080, Framerate: 14, Bitrate: 5_000_000, Preference: "balanced"},
 		{Width: 1920, Height: 1080, Framerate: 30, Bitrate: 12_000_001, Preference: "balanced"},
 		{Width: 1920, Height: 1080, Framerate: 30, Bitrate: 5_000_000, Preference: "unknown"},
diff --git a/internal/app/nativecapture/stream.go b/internal/app/nativecapture/stream.go
index 205eb63d9..f8626c602 100644
--- a/internal/app/nativecapture/stream.go
+++ b/internal/app/nativecapture/stream.go
@@ -88,8 +88,7 @@ type OutputProfile struct {
 }
 
 func (profile OutputProfile) Valid() bool {
-	return ValidVideoSize(profile.Width, profile.Height) &&
-		profile.Framerate >= 1 && profile.Framerate <= 60 &&
+	return ValidVideoFormat(profile.Width, profile.Height, profile.Framerate) &&
 		profile.Bitrate >= minOutputBitrate && profile.Bitrate <= maxOutputBitrate
 }
 
@@ -111,8 +110,8 @@ func ScreenShareOutputs(profile VideoProfile) []OutputProfile {
 func (profile VideoProfile) Valid() bool {
 	// The source ceiling must also yield a valid half-size output. Preset labels
 	// belong to the UI, not the capture process's numeric resource boundary.
-	return ValidVideoSize(profile.Width, profile.Height) && profile.Width >= 4 && profile.Height >= 4 &&
-		profile.Framerate >= 15 && profile.Framerate <= 60 &&
+	return ValidVideoFormat(profile.Width, profile.Height, profile.Framerate) && profile.Width >= 4 && profile.Height >= 4 &&
+		profile.Framerate >= 15 &&
 		profile.Bitrate >= 2_000_000 && profile.Bitrate <= 12_000_000 &&
 		validVideoPreference(profile.Preference)
 }
diff --git a/internal/app/nativecontrol/session_test.go b/internal/app/nativecontrol/session_test.go
index 09e240589..4e3f633a7 100644
--- a/internal/app/nativecontrol/session_test.go
+++ b/internal/app/nativecontrol/session_test.go
@@ -671,7 +671,11 @@ func TestQualitySettingsMapOnceIntoNativeMedia(t *testing.T) {
 	}
 	settings.Resolution = protocol.QualityResolution{Width: 3840, Height: 2160}
 	if nativeQualityProfile(settings).Valid() {
-		t.Fatal("unsupported resolution was accepted")
+		t.Fatal("unsupported 4K60 combination was accepted")
+	}
+	settings.MaxFramerate = 30
+	if !nativeQualityProfile(settings).Valid() {
+		t.Fatal("4K30 was rejected")
 	}
 }
 
@@ -685,7 +689,7 @@ func TestUpdateShareRequiresTheCurrentStrictProfile(t *testing.T) {
 	assertOperationFailure(t, session, strings.Replace(valid, `"maxAudioBitrate":128000`, `"maxAudioBitrate":510000`, 1))
 	assertOperationFailure(t, session, strings.Replace(valid,
 		`"resolution":{"width":1920,"height":1080}`,
-		`"resolution":{"width":3840,"height":2160}`, 1))
+		`"resolution":{"width":7680,"height":4320}`, 1))
 	if _, err := session.Handle(t.Context(), []byte(`{"version":10,"id":"request_options","type":"capture-options"}`)); err != nil {
 		t.Fatalf("unsupported media setting retired control: %v", err)
 	}
diff --git a/native/capture/darwin/main.swift b/native/capture/darwin/main.swift
index 05a72adbb..6e05e6a3a 100644
--- a/native/capture/darwin/main.swift
+++ b/native/capture/darwin/main.swift
@@ -15,6 +15,8 @@ private let height = 720
 private let frameRate: Int32 = 30
 private let bitrate = 3_000_000
 private let maxPayloadBytes = 4_194_304
+private let maxVideoDimension = 3840
+private let maxVideoPixels = 3840 * 2160
 private let supportedH264Levels: Set<UInt8> = [
     0x1e, 0x1f, 0x20, 0x28, 0x29, 0x2a, 0x32, 0x33,
 ]
@@ -1341,8 +1343,15 @@ private func captureFilter(
 }
 
 private func validVideoSize(_ width: Int, _ height: Int) -> Bool {
-    width >= 2 && width <= 2560 && width % 2 == 0 &&
-        height >= 2 && height <= 1440 && height % 2 == 0
+    width >= 2 && width <= maxVideoDimension && width % 2 == 0 &&
+        height >= 2 && height <= maxVideoDimension && height % 2 == 0 &&
+        width * height <= maxVideoPixels
+}
+
+private func validVideoFormat(_ width: Int, _ height: Int, _ fps: Int32) -> Bool {
+    // Match the shared H.264 Level 5.1 receive ceiling, including numeric sizes.
+    validVideoSize(width, height) && fps >= 1 && fps <= 60 &&
+        ((width + 15) / 16) * ((height + 15) / 16) * Int(fps) <= 983_040
 }
 
 private func videoProfile(_ arguments: [String]) throws -> VideoProfile {
@@ -1358,8 +1367,8 @@ private func videoProfile(_ arguments: [String]) throws -> VideoProfile {
           arguments[22] == "--protocol-v7" else {
         throw CaptureFailure(description: "invalid video profile arguments")
     }
-    guard validVideoSize(width, height), width >= 4, height >= 4,
-          frameRate >= 15, frameRate <= 60,
+    guard validVideoFormat(width, height, frameRate), width >= 4, height >= 4,
+          frameRate >= 15,
           bitrate >= 2_000_000, bitrate <= 12_000_000 else {
         throw CaptureFailure(description: "video profile is outside the product bounds")
     }
@@ -1385,9 +1394,9 @@ private func outputProfiles(_ arguments: [String], start: Int = 23,
               let height = Int(arguments[index + 2]),
               let fps = Int32(arguments[index + 3]),
               let bitrate = Int(arguments[index + 4]),
-              validVideoSize(width, height),
-              width <= (source?.width ?? 2560), height <= (source?.height ?? 1440),
-              fps >= 1, fps <= (source?.frameRate ?? 60),
+              validVideoFormat(width, height, fps),
+              width <= (source?.width ?? maxVideoDimension), height <= (source?.height ?? maxVideoDimension),
+              fps <= (source?.frameRate ?? 60),
               bitrate >= 1000, bitrate <= (source?.bitrate ?? 12_000_000) else {
             throw CaptureFailure(description: "output profile is outside source bounds")
         }
@@ -1569,8 +1578,7 @@ private final class H264InputDecoder {
             try require(status, "decode-h264-format")
             guard let nextFormat else { throw CaptureFailure(description: "missing input format") }
             let dimensions = CMVideoFormatDescriptionGetDimensions(nextFormat)
-            guard dimensions.width >= 2, dimensions.width <= 2560,
-                  dimensions.height >= 2, dimensions.height <= 1440 else {
+            guard validVideoSize(Int(dimensions.width), Int(dimensions.height)) else {
                 throw CaptureFailure(description: "decoded input exceeds its dimension bound")
             }
             if let session, !VTDecompressionSessionCanAcceptFormatDescription(session, formatDescription: nextFormat) {
diff --git a/native/capture/linux/main.c b/native/capture/linux/main.c
index a0baf05fa..575cc5443 100644
--- a/native/capture/linux/main.c
+++ b/native/capture/linux/main.c
@@ -19,6 +19,8 @@ enum {
   kMaxOutputs = 6,
   kMaxPayloadBytes = 4 * 1024 * 1024,
   kAudioFrameBytes = 960 * 2 * 2,
+  kMaxVideoDimension = 3840,
+  kMaxVideoPixels = 3840 * 2160,
 };
 
 typedef enum {
@@ -371,8 +373,15 @@ static gboolean parse_uint(const char *value, guint minimum, guint maximum,
 }
 
 static gboolean valid_video_size(guint width, guint height) {
-  return width >= 2 && width <= 2560 && width % 2 == 0 &&
-         height >= 2 && height <= 1440 && height % 2 == 0;
+  return width >= 2 && width <= kMaxVideoDimension && width % 2 == 0 &&
+         height >= 2 && height <= kMaxVideoDimension && height % 2 == 0 &&
+         (guint64)width * height <= kMaxVideoPixels;
+}
+
+static gboolean valid_video_format(guint width, guint height, guint fps) {
+  // Match the shared H.264 Level 5.1 receive ceiling, including numeric sizes.
+  return valid_video_size(width, height) && fps >= 1 && fps <= 60 &&
+         (guint64)((width + 15) / 16) * ((height + 15) / 16) * fps <= 983040;
 }
 
 static gboolean parse_outputs(int count, char **values, guint start, CaptureRun *run) {
@@ -390,11 +399,12 @@ static gboolean parse_outputs(int count, char **values, guint start, CaptureRun
     output->activation_timestamp = GST_CLOCK_TIME_NONE;
     output->profile.preference = run->profile.preference;
     if (strcmp(values[offset], "--output") != 0 ||
-        !parse_uint(values[offset + 1], 2, 2560, &output->profile.width) ||
-        !parse_uint(values[offset + 2], 2, 1440, &output->profile.height) ||
+        !parse_uint(values[offset + 1], 2, kMaxVideoDimension, &output->profile.width) ||
+        !parse_uint(values[offset + 2], 2, kMaxVideoDimension, &output->profile.height) ||
         !parse_uint(values[offset + 3], 1, 60, &output->profile.frame_rate) ||
         !parse_uint(values[offset + 4], 1000, 12000000, &output->profile.bit_rate) ||
-        !valid_video_size(output->profile.width, output->profile.height)) return FALSE;
+        !valid_video_format(output->profile.width, output->profile.height,
+                            output->profile.frame_rate)) return FALSE;
   }
   return TRUE;
 }
@@ -448,7 +458,7 @@ static gboolean parse_profile(int count, char **values, CaptureRun *run,
       !parse_uint(values[17], 2000000, 12000000, &profile->bit_rate)) {
     return FALSE;
   }
-  if (!valid_video_size(profile->width, profile->height) ||
+  if (!valid_video_format(profile->width, profile->height, profile->frame_rate) ||
       profile->width < 4 || profile->height < 4) return FALSE;
   if (!parse_preference(values[19], profile) || !parse_outputs(count, values, 23, run)) return FALSE;
   run->original_output = MIN(1, run->output_count - 1);
diff --git a/native/capture/linux/main.test.c b/native/capture/linux/main.test.c
index 33a60e967..e2f3548ac 100644
--- a/native/capture/linux/main.test.c
+++ b/native/capture/linux/main.test.c
@@ -162,15 +162,25 @@ static void check_slot_profiles(void) {
       "--output", "1920", "1200", "30", "3000000"};
   const struct { char *width; char *height; gboolean valid; } sizes[] = {
       {"1920", "1200", TRUE}, {"720", "1280", TRUE}, {"4", "4", TRUE},
+      {"3840", "2160", TRUE}, {"2160", "3840", TRUE}, {"3000", "2764", TRUE},
       {"0", "720", FALSE}, {"2", "720", FALSE}, {"1280", "2", FALSE},
       {"1279", "720", FALSE}, {"1280", "719", FALSE},
-      {"2562", "1440", FALSE}, {"2560", "1442", FALSE}, {"3840", "2160", FALSE}};
+      {"3842", "2160", FALSE}, {"2160", "3842", FALSE},
+      {"3840", "2162", FALSE}, {"3000", "2766", FALSE}};
   for (guint index = 0; index < G_N_ELEMENTS(sizes); ++index) {
     numeric[11] = numeric[24] = sizes[index].width;
     numeric[13] = numeric[25] = sizes[index].height;
     run = (CaptureRun){0};
     g_assert_cmpint(parse_profile(G_N_ELEMENTS(numeric), numeric, &run, &encoder), ==, sizes[index].valid);
   }
+  numeric[11] = numeric[24] = "3840";
+  numeric[13] = numeric[25] = "2160";
+  numeric[15] = numeric[26] = "60";
+  run = (CaptureRun){0};
+  g_assert_false(parse_profile(G_N_ELEMENTS(numeric), numeric, &run, &encoder));
+  numeric[15] = "30"; // Reject an excessive derived output independently.
+  g_assert_false(parse_profile(G_N_ELEMENTS(numeric), numeric, &run, &encoder));
+  g_assert_false(valid_video_format(G_MAXUINT, G_MAXUINT, G_MAXUINT));
 }
 
 static GstPadProbeReturn record_key_request(GstPad *pad, GstPadProbeInfo *info,
diff --git a/native/capture/windows/capture_geometry.h b/native/capture/windows/capture_geometry.h
index d73729873..5e199890c 100644
--- a/native/capture/windows/capture_geometry.h
+++ b/native/capture/windows/capture_geometry.h
@@ -1,5 +1,7 @@
 #pragma once
 
+#include "video_bounds.h"
+
 #include <windows.h>
 
 #include <algorithm>
@@ -8,11 +10,6 @@
 
 namespace piik::capture {
 
-inline bool ValidVideoSize(UINT32 width, UINT32 height) {
-  return width >= 2 && width <= 2560 && !(width & 1) &&
-         height >= 2 && height <= 1440 && !(height & 1);
-}
-
 inline SIZE DisplayedFrameSize(SIZE captured, SIZE desktop, SIZE target,
                                DISPLAYCONFIG_SCALING scaling,
                                DISPLAYCONFIG_ROTATION rotation) {
diff --git a/native/capture/windows/capture_input.h b/native/capture/windows/capture_input.h
index 8d56f29dc..1dee4fbe0 100644
--- a/native/capture/windows/capture_input.h
+++ b/native/capture/windows/capture_input.h
@@ -1,6 +1,7 @@
 #pragma once
 
 #include "capture_control.h"
+#include "video_bounds.h"
 
 #include <algorithm>
 #include <array>
@@ -85,8 +86,7 @@ class InputEnvelopes final {
     } else if ((frame_.kind != 2 && frame_.kind != 4) || header_[6] > 1 ||
                frame_.duration == 0 || frame_.timestamp > static_cast<uint64_t>(INT64_MAX) / 100 ||
                frame_.duration > static_cast<uint64_t>(INT64_MAX) / 100 ||
-               frame_.width < 2 || frame_.height < 2 || frame_.width > 2560 || frame_.height > 1440 ||
-               (frame_.width & 1) || (frame_.height & 1) || payload_size_ > 4 * 1024 * 1024) {
+               !ValidVideoSize(frame_.width, frame_.height) || payload_size_ > 4 * 1024 * 1024) {
       throw std::runtime_error("Invalid native encoded input");
     }
     frame_.data.reserve(payload_size_);
diff --git a/native/capture/windows/h264_decoder.h b/native/capture/windows/h264_decoder.h
index f7e0bd55f..af776bc95 100644
--- a/native/capture/windows/h264_decoder.h
+++ b/native/capture/windows/h264_decoder.h
@@ -41,8 +41,8 @@ class H264Decoder final {
     Check(decoder_.As(&codec), "codec-api");
     for (const auto& setting : {
              std::pair<GUID, ULONG>{CODECAPI_AVLowLatencyMode, TRUE},
-             std::pair<GUID, ULONG>{CODECAPI_AVDecVideoMaxCodedWidth, 2560},
-             std::pair<GUID, ULONG>{CODECAPI_AVDecVideoMaxCodedHeight, 1440}}) {
+             std::pair<GUID, ULONG>{CODECAPI_AVDecVideoMaxCodedWidth, kMaxCodedVideoDimension},
+             std::pair<GUID, ULONG>{CODECAPI_AVDecVideoMaxCodedHeight, kMaxCodedVideoDimension}}) {
       VARIANT value;
       VariantInit(&value);
       value.vt = VT_UI4;
@@ -117,7 +117,7 @@ class H264Decoder final {
       if (subtype != MFVideoFormat_NV12) continue;
       UINT32 width = 0, height = 0;
       Check(MFGetAttributeSize(type.Get(), MF_MT_FRAME_SIZE, &width, &height), "output-size");
-      if (width < 2 || height < 2 || width > 2560 || height > 1440 || (width & 1) || (height & 1)) {
+      if (!ValidVideoSize(width, height)) {
         throw std::runtime_error("H264 decoder output dimensions exceed the source bound");
       }
       Check(decoder_->SetOutputType(0, type.Get(), 0), "set-output");
@@ -142,11 +142,11 @@ class H264Decoder final {
       Check(decoder_->GetOutputStreamInfo(0, &info), "output-info");
       Microsoft::WRL::ComPtr<IMFSample> owned;
       if (!(info.dwFlags & (MFT_OUTPUT_STREAM_PROVIDES_SAMPLES | MFT_OUTPUT_STREAM_CAN_PROVIDE_SAMPLES))) {
-        const DWORD expected = static_cast<DWORD>(stride_) * height_ * 3 / 2;
-        const DWORD size = std::max(info.cbSize, expected);
-        if (size > 2560 * 1440 * 2) throw std::runtime_error("H264 decoder output allocation exceeds its bound");
+        const UINT64 expected = static_cast<UINT64>(stride_) * height_ * 3 / 2;
+        const UINT64 size = std::max<UINT64>(info.cbSize, expected);
+        if (size > kMaxCodedVideoPixels * 2) throw std::runtime_error("H264 decoder output allocation exceeds its bound");
         Microsoft::WRL::ComPtr<IMFMediaBuffer> buffer;
-        Check(MFCreateAlignedMemoryBuffer(size, info.cbAlignment ? info.cbAlignment - 1 : 0, &buffer), "output-buffer");
+        Check(MFCreateAlignedMemoryBuffer(static_cast<DWORD>(size), info.cbAlignment ? info.cbAlignment - 1 : 0, &buffer), "output-buffer");
         Check(MFCreateSample(&owned), "output-sample");
         Check(owned->AddBuffer(buffer.Get()), "output-sample-buffer");
       }
diff --git a/native/capture/windows/main.cpp b/native/capture/windows/main.cpp
index b80b1261e..5ff8a09d1 100644
--- a/native/capture/windows/main.cpp
+++ b/native/capture/windows/main.cpp
@@ -966,8 +966,8 @@ DegradationPreference ParseDegradationPreference(const wchar_t* value) {
 }
 
 void ValidateVideoProfile(const VideoProfile& profile) {
-  if (!piik::capture::ValidVideoSize(profile.width, profile.height) ||
-      profile.width < 4 || profile.height < 4 || profile.frame_rate < 15 || profile.frame_rate > 60 ||
+  if (!piik::capture::ValidVideoFormat(profile.width, profile.height, profile.frame_rate) ||
+      profile.width < 4 || profile.height < 4 || profile.frame_rate < 15 ||
       profile.bit_rate < 2'000'000 || profile.bit_rate > 12'000'000) {
     Fail("argument-profile", "video profile is outside the product bounds");
   }
@@ -981,8 +981,8 @@ void ParseOutputProfiles(ProductArguments& arguments, int first, int count, wcha
     output.height = ParseIndex(values[index + 2], "argument-output-height");
     output.frame_rate = ParseIndex(values[index + 3], "argument-output-fps");
     output.bit_rate = ParseIndex(values[index + 4], "argument-output-bitrate");
-    if (!piik::capture::ValidVideoSize(output.width, output.height) || output.frame_rate == 0 ||
-        output.frame_rate > 60 || output.bit_rate < 1'000 || output.bit_rate > 12'000'000) {
+    if (!piik::capture::ValidVideoFormat(output.width, output.height, output.frame_rate) ||
+        output.bit_rate < 1'000 || output.bit_rate > 12'000'000) {
       Fail("argument-output", "output profile exceeds codec bounds");
     }
     if (arguments.mode == ProductArguments::Mode::video &&
@@ -1674,7 +1674,8 @@ ComPtr<ID3D11Texture2D> OwnDecodedTexture(const DeviceContext& device, IMFSample
     D3D11_TEXTURE2D_DESC description{};
     original->GetDesc(&description);
     if (description.Format != DXGI_FORMAT_NV12 || description.Width < width || description.Height < height ||
-        description.Width > 2560 || description.Height > 1440) Fail("decoded-texture-size", "decoder texture exceeds source bounds");
+        !piik::capture::ValidCodedVideoSize(description.Width, description.Height))
+      Fail("decoded-texture-size", "decoder texture exceeds source bounds");
     description.ArraySize = description.MipLevels = 1;
     description.Usage = D3D11_USAGE_DEFAULT;
     description.CPUAccessFlags = description.MiscFlags = 0;
diff --git a/native/capture/windows/output_worker.test.cpp b/native/capture/windows/output_worker.test.cpp
index f74a6cc4d..bd5aeb170 100644
--- a/native/capture/windows/output_worker.test.cpp
+++ b/native/capture/windows/output_worker.test.cpp
@@ -315,11 +315,13 @@ int main() {
   assert(profile.h264_level() == 51 && profile.profile_level_id() == "42c033");
   profile = VideoProfile{1920, 1080, 60, 8'000'000};
   assert(profile.h264_level() == 42);
-  for (const SIZE size : {SIZE{1920, 1200}, SIZE{720, 1280}, SIZE{4, 4}}) {
+  for (const SIZE size : {SIZE{1920, 1200}, SIZE{720, 1280}, SIZE{4, 4},
+                          SIZE{3840, 2160}, SIZE{2160, 3840}, SIZE{3000, 2764}}) {
     ValidateVideoProfile(VideoProfile{static_cast<UINT32>(size.cx), static_cast<UINT32>(size.cy), 30, 3'000'000});
   }
   for (const SIZE size : {SIZE{0, 720}, SIZE{2, 720}, SIZE{1280, 2}, SIZE{1279, 720},
-                          SIZE{1280, 719}, SIZE{2562, 1440}, SIZE{2560, 1442}, SIZE{3840, 2160}}) {
+                          SIZE{1280, 719}, SIZE{3842, 2160}, SIZE{2160, 3842},
+                          SIZE{3840, 2162}, SIZE{3000, 2766}}) {
     try {
       ValidateVideoProfile(VideoProfile{static_cast<UINT32>(size.cx), static_cast<UINT32>(size.cy), 30, 3'000'000});
       assert(false);
@@ -327,6 +329,14 @@ int main() {
       assert(error.stage() == "argument-profile");
     }
   }
+  assert(piik::capture::ValidVideoFormat(3840, 2160, 30));
+  assert(!piik::capture::ValidVideoFormat(3840, 2160, 31));
+  assert(!piik::capture::ValidVideoFormat(2160, 3840, 60));
+  assert(!piik::capture::ValidVideoFormat(UINT32_MAX, UINT32_MAX, UINT32_MAX));
+  assert(piik::capture::ValidCodedVideoSize(3840, 2176));
+  assert(piik::capture::ValidCodedVideoSize(2176, 3840));
+  assert(!piik::capture::ValidCodedVideoSize(3840, 3840));
+  assert(!piik::capture::ValidCodedVideoSize(UINT32_MAX, UINT32_MAX));
   CheckEncoderCandidates();
   CheckH264ProfileCompatibility();
   CheckPrimaryFailureDetails();
diff --git a/native/capture/windows/video_bounds.h b/native/capture/windows/video_bounds.h
new file mode 100644
index 000000000..79fac850a
--- /dev/null
+++ b/native/capture/windows/video_bounds.h
@@ -0,0 +1,30 @@
+#pragma once
+
+#include <cstdint>
+
+namespace piik::capture {
+
+inline constexpr uint32_t kMaxVideoDimension = 3840;
+inline constexpr uint64_t kMaxVideoPixels = 3840 * 2160;
+// H.264 Level 5.1 coded storage, including padding outside the visible crop.
+inline constexpr uint32_t kMaxCodedVideoDimension = 4096;
+inline constexpr uint64_t kMaxCodedVideoPixels = 36'864 * 16 * 16;
+
+inline bool ValidVideoSize(uint32_t width, uint32_t height) {
+  return width >= 2 && width <= kMaxVideoDimension && !(width & 1) &&
+         height >= 2 && height <= kMaxVideoDimension && !(height & 1) &&
+         static_cast<uint64_t>(width) * height <= kMaxVideoPixels;
+}
+
+inline bool ValidVideoFormat(uint32_t width, uint32_t height, uint32_t fps) {
+  return ValidVideoSize(width, height) && fps >= 1 && fps <= 60 &&
+         static_cast<uint64_t>((width + 15) / 16) * ((height + 15) / 16) * fps <= 983'040;
+}
+
+inline bool ValidCodedVideoSize(uint32_t width, uint32_t height) {
+  return width >= 2 && width <= kMaxCodedVideoDimension && !(width & 1) &&
+         height >= 2 && height <= kMaxCodedVideoDimension && !(height & 1) &&
+         static_cast<uint64_t>(width) * height <= kMaxCodedVideoPixels;
+}
+
+}  // namespace piik::capture
diff --git a/native/capture/windows/vp8_decoder.h b/native/capture/windows/vp8_decoder.h
index cb57c4eb4..d7246aac8 100644
--- a/native/capture/windows/vp8_decoder.h
+++ b/native/capture/windows/vp8_decoder.h
@@ -1,5 +1,7 @@
 #pragma once
 
+#include "video_bounds.h"
+
 #include <vpx/vp8dx.h>
 #include <vpx/vpx_decoder.h>
 
@@ -37,7 +39,7 @@ class Vp8Decoder final {
       vpx_codec_stream_info_t info{};
       info.sz = sizeof(info);
       if (vpx_codec_peek_stream_info(vpx_codec_vp8_dx(), data.data(), static_cast<unsigned int>(data.size()), &info) != VPX_CODEC_OK ||
-          info.w < 2 || info.h < 2 || info.w > 2560 || info.h > 1440 || (info.w & 1) || (info.h & 1)) {
+          !ValidVideoSize(info.w, info.h)) {
         throw std::runtime_error("VP8 decoder input dimensions exceed the source bound");
       }
     }
@@ -48,7 +50,7 @@ class Vp8Decoder final {
     const auto* image = vpx_codec_get_frame(&codec_, &iterator);
     if (!image) return {};
     const uint32_t width = image->d_w, height = image->d_h;
-    if (width < 2 || height < 2 || width > 2560 || height > 1440 || (width & 1) || (height & 1) ||
+    if (!ValidVideoSize(width, height) ||
         image->fmt != VPX_IMG_FMT_I420 || image->stride[0] < static_cast<int>(width) ||
         image->stride[1] < static_cast<int>(width / 2) || image->stride[2] < static_cast<int>(width / 2)) {
       throw std::runtime_error("VP8 decoder output format is unsupported");

From 736f9324d9ee9fab20672efa800c7665cf5b34e8 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 17:56:08 +0800
Subject: [PATCH 074/262] feat(media): bound 4K controls by capture
 capabilities

---
 docs/research/native-client-media.md          | 16 +++++---
 docs/standards/media-quality.md               | 15 +++++---
 docs/status.md                                | 12 +++---
 docs/todo.md                                  | 18 +++------
 internal/app/app.go                           | 22 ++++++-----
 internal/app/loopback/server.go               | 24 ++++++------
 internal/app/nativecapture/protocol.go        | 15 ++++----
 scripts/app-native-host-gate.ts               | 27 +++++++++++++-
 .../components/living/QualityPresets.tsx      | 23 ++++++++----
 src/client/locales/en.ts                      |  2 +-
 src/client/locales/zh.ts                      |  2 +-
 src/client/media/quality.ts                   | 37 ++++++++++++++++++-
 src/client/native/wire.ts                     |  2 +
 src/client/pages/ControlsPreview.tsx          |  4 +-
 src/client/pages/HostPage.tsx                 | 22 +++++------
 tests/native-client.test.ts                   |  8 ++++
 tests/quality.test.ts                         | 21 +++++++++++
 17 files changed, 185 insertions(+), 85 deletions(-)

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index e2d428e9e..47d27e702 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -571,12 +571,15 @@ presets. A source ceiling must also yield a valid half-size output. Bitrate and
 output-count bounds remain unchanged. Candidate signaling and Native control now carry numeric
 width/height ceilings, with custom input beside the existing UI shortcuts.
 Descriptive wire bounds are independent of the current implementation maximum;
-App discovery advertises per-axis maxima, and Native rejects unsupported
+App discovery advertises axis, pixel-count and macroblock-rate limits, and Native rejects unsupported
 size/rate combinations as operation failures without retiring the control
 session. Removing an enum is not permission to allocate arbitrary media resources.
 
-The Windows H.264 UI gate applies a non-preset 960x600 ceiling during a live
-share and observes fitted output without replacing the Viewer media object.
+The Windows H.264 UI gate switches from 1080p60 to the 4K ceiling with the
+30 fps limit, then applies a non-preset 960x600 ceiling during the live share.
+It observes fitted output without replacing the Viewer media object. The
+captured window is smaller than 4K, so this verifies settings/lifecycle, not
+physical 4K capture.
 Preset changes, paused updates, source recovery/replacement and subsequent
 sharing still pass. Value-based comparison prevents an identical deserialized
 size from turning an audio-only edit into a video update. Numeric preference
@@ -603,9 +606,10 @@ VP8 derivation produced the lower output from the 4K input. The Browser H.264 SF
 a synthetic 3840x2160/30 source passed first-picture delivery, an explicit lower
 profile, audio-only edits with retained connections, subscription/page recovery
 and retirement. Windows native checks and Linux headless build/checks pass;
-macOS SDK and physical 4K capture are not verified here. The UI ceiling remains
-2560x1440 until combined capability controls and whole-route acceptance are
-complete. These checks do not establish 4K60, sustained device performance or
+macOS SDK and physical 4K capture are not verified here. Controls now use the
+combined limits, reject oversized pixel totals and cap frame rate on size changes.
+Whole-route and cross-device acceptance remain open. These checks do not
+establish 4K60, sustained device performance or
 universal portrait decoding support.
 
 The proposed boundary follows the
diff --git a/docs/standards/media-quality.md b/docs/standards/media-quality.md
index d5857cdeb..2c2ba8349 100644
--- a/docs/standards/media-quality.md
+++ b/docs/standards/media-quality.md
@@ -127,12 +127,14 @@ The three recommended profiles are ceilings, not delivery guarantees:
 | `1080p60` | 1920x1080 at 60 fps | 8 Mbps |
 
 `1080p30` is the default. The 2.0 candidate carries numeric width/height ceilings;
-480p, 720p, 1080p and 1440p remain UI shortcuts. Advanced picture settings also
-accept custom even dimensions within the current 2560x1440 UI bound.
-Width and height form one applied edit. Larger wire-valid requests do not
+480p, 720p, 1080p, 1440p and 4K are UI shortcuts. Advanced picture settings also
+accept custom even dimensions within the combined implementation bounds below.
+Width and height form one applied edit. A size change caps the requested frame
+rate in the same quality operation when the larger size requires a lower limit.
+Larger wire-valid requests do not
 authorize an adapter to exceed its local capture, codec or allocation limits.
 Frame rate, bitrate, and `maintain-resolution | balanced |
-maintain-framerate` remain independent controls. Display video uses the standard
+maintain-framerate` retain their controls. Display video uses the standard
 `contentHint = "motion"` for game motion.
 Native H264 retains Constrained Baseline. Capture validates the coding-tool subset under
 RFC 6184, including equivalent Constrained Baseline constraint bytes, and reports
@@ -151,7 +153,10 @@ Level 5.1: 983,040 16x16 macroblocks per second, with at most 60 fps. This admit
 landscape/portrait 4K30 and existing 1440p60, not 4K60. Decoder alignment has a
 separate coded-storage bound; reference-picture storage is bounded before
 Native derivation. These are admission limits, not a device performance promise.
-The UI remains within its previous ceiling pending whole-route acceptance.
+App discovery reports axis, pixel-count and output-rate limits through the
+existing native health description. Controls use the intersection with local
+implementation limits; a remote claim cannot raise those limits. Whole-route
+and physical-device acceptance remain separate from available controls.
 
 Framework-driven downscaling under bandwidth or device pressure is valid within
 the selected degradation preference. A low decoded resolution alone is not a
diff --git a/docs/status.md b/docs/status.md
index 8fcc633a7..015bb9549 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -66,13 +66,11 @@ Browser/server v24 and Native control v10 replace the preset fields;
 capture v7 and SQLite schema 2
 remain unchanged. Matched candidate App/Web/Server builds are required;
 1.x participants are rejected by the existing compatibility checks.
-Custom width/height controls retain the current implementation ceiling.
-Windows and Linux output now preserve source shape within that ceiling.
-Native admission now has axis-independent size, pixel-count and output-rate
-bounds for 4K30; local Windows encoding, decoding and derived-output checks pass.
-Browser H.264 4K30 also passes the existing SFU flow with a synthetic source.
-Browser/macOS geometry, 4K controls and whole-route/device acceptance, and
-additional codecs remain in the media assessment.
+Custom width/height controls apply combined size and frame-rate limits, admitting
+4K30. Windows and Linux output preserve source shape within the selected ceiling.
+The [media assessment](./research/native-client-media.md#media-capability-extension-assessment)
+owns local codec, derived-output, SFU and live-control evidence. Browser/macOS
+geometry, whole-route/device acceptance and additional codecs remain open.
 Native Magicsock remains an isolated experiment with incomplete product
 integration and unresolved recovery cases. These proposals do not yet change
 the accepted contract or transport. A small external test is proposed before
diff --git a/docs/todo.md b/docs/todo.md
index ba3d02fc0..489d0af47 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -47,19 +47,11 @@ Implementation needs a concrete useful result within the product model.
 - [ ] **Media parameters and capabilities for 2.0.** Follow the
   [media assessment](./research/native-client-media.md#media-capability-extension-assessment):
   separate UI presets, numeric requests, bounded implementation capabilities and
-  actual output. Numeric audio admission, storage and the compact custom input
-  implement [#462](https://github.com/TNTcraftHIM/Piik/pull/462)'s use case, with
-  local Browser/direct/relay and Browser/native SFU evidence. Numeric video
-  requests and custom width/height controls now pass the existing Windows live
-  capture gate within current implementation limits. Next assess
-  source-aspect-preserving geometry and 4K through the same owners. Windows and
-  Linux outputs now fit the source without a fixed padded landscape canvas;
-  Native axis-independent 4K30 admission and bounded Windows codec/derived-output
-  checks now pass, as does Browser H.264 4K30 over the existing SFU gate with a
-  synthetic source. Next align controls with combined size/rate limits and verify
-  Native/Browser mixed routes, source/live changes and limited receivers.
-  Browser/macOS geometry and physical 4K capture remain open. Preserve
-  safety limits and framework-owned adaptation. The
+  actual output. Numeric audio and video controls are implemented; the assessment
+  owns local capture, codec, derived-output and SFU evidence. Next verify
+  Native/Browser mixed routes, 4K source/live changes and limited receivers.
+  Browser/macOS geometry and physical 4K capture remain open. Preserve safety
+  limits and framework-owned adaptation. The
   [audio controls](./research/browser-screen-audio-quality.md#numeric-bitrate-assessment)
   retain explicit receive-limit enforcement and the current 320 kbps sender
   ceiling; physical listening and impaired-network evidence remain open.
diff --git a/internal/app/app.go b/internal/app/app.go
index b19955222..6966ecca4 100644
--- a/internal/app/app.go
+++ b/internal/app/app.go
@@ -631,16 +631,18 @@ func discoverNativeMedia(ctx context.Context, configuredPath string) nativeRunti
 			MaxVideoResolution: protocol.QualityResolution{
 				Width: nativecapture.MaxVideoDimension, Height: nativecapture.MaxVideoDimension,
 			},
-			MaxAudioBitrate:       nativeaudio.MaxSendBitrate,
-			ReceiverReuse:         true,
-			Video:                 summary.Video,
-			CaptureBorderControl:  summary.CaptureBorderControl,
-			Microphone:            summary.Microphone,
-			ProcessAudio:          summary.ProcessAudio,
-			ProcessAudioExclusion: summary.ProcessAudioExclusion,
-			SystemAudio:           summary.SystemAudio,
-			HardwareH264:          summary.HardwareH264,
-			SoftwareVP8:           summary.SoftwareVP8,
+			MaxVideoPixels:               nativecapture.MaxVideoPixels,
+			MaxVideoMacroblocksPerSecond: nativecapture.MaxVideoMacroblocksPerSecond,
+			MaxAudioBitrate:              nativeaudio.MaxSendBitrate,
+			ReceiverReuse:                true,
+			Video:                        summary.Video,
+			CaptureBorderControl:         summary.CaptureBorderControl,
+			Microphone:                   summary.Microphone,
+			ProcessAudio:                 summary.ProcessAudio,
+			ProcessAudioExclusion:        summary.ProcessAudioExclusion,
+			SystemAudio:                  summary.SystemAudio,
+			HardwareH264:                 summary.HardwareH264,
+			SoftwareVP8:                  summary.SoftwareVP8,
 		},
 	}
 }
diff --git a/internal/app/loopback/server.go b/internal/app/loopback/server.go
index e7617ac41..7fa232116 100644
--- a/internal/app/loopback/server.go
+++ b/internal/app/loopback/server.go
@@ -73,17 +73,19 @@ type Health struct {
 }
 
 type NativeMediaCapabilities struct {
-	MaxVideoResolution    protocol.QualityResolution `json:"maxVideoResolution,omitzero"`
-	MaxAudioBitrate       int                        `json:"maxAudioBitrate,omitempty"`
-	ReceiverReuse         bool                       `json:"receiverReuse,omitempty"`
-	Video                 bool                       `json:"video"`
-	CaptureBorderControl  bool                       `json:"captureBorderControl,omitempty"`
-	Microphone            bool                       `json:"microphone,omitempty"`
-	ProcessAudio          bool                       `json:"processAudio"`
-	ProcessAudioExclusion bool                       `json:"processAudioExclusion,omitempty"`
-	SystemAudio           bool                       `json:"systemAudio"`
-	HardwareH264          bool                       `json:"hardwareH264"`
-	SoftwareVP8           bool                       `json:"softwareVP8"`
+	MaxVideoResolution           protocol.QualityResolution `json:"maxVideoResolution,omitzero"`
+	MaxVideoPixels               int                        `json:"maxVideoPixels,omitempty"`
+	MaxVideoMacroblocksPerSecond int                        `json:"maxVideoMacroblocksPerSecond,omitempty"`
+	MaxAudioBitrate              int                        `json:"maxAudioBitrate,omitempty"`
+	ReceiverReuse                bool                       `json:"receiverReuse,omitempty"`
+	Video                        bool                       `json:"video"`
+	CaptureBorderControl         bool                       `json:"captureBorderControl,omitempty"`
+	Microphone                   bool                       `json:"microphone,omitempty"`
+	ProcessAudio                 bool                       `json:"processAudio"`
+	ProcessAudioExclusion        bool                       `json:"processAudioExclusion,omitempty"`
+	SystemAudio                  bool                       `json:"systemAudio"`
+	HardwareH264                 bool                       `json:"hardwareH264"`
+	SoftwareVP8                  bool                       `json:"softwareVP8"`
 }
 
 type Server struct {
diff --git a/internal/app/nativecapture/protocol.go b/internal/app/nativecapture/protocol.go
index 236e38eff..e38dc0c53 100644
--- a/internal/app/nativecapture/protocol.go
+++ b/internal/app/nativecapture/protocol.go
@@ -11,12 +11,13 @@ import (
 )
 
 const (
-	envelopeHeaderBytes = 32
-	maxMediaBytes       = encoded.MaxAccessUnitBytes
-	maxStatusBytes      = 4 * 1024
-	maxControlBytes     = 64
-	MaxVideoDimension   = 3840
-	MaxVideoPixels      = 3840 * 2160
+	envelopeHeaderBytes          = 32
+	maxMediaBytes                = encoded.MaxAccessUnitBytes
+	maxStatusBytes               = 4 * 1024
+	maxControlBytes              = 64
+	MaxVideoDimension            = 3840
+	MaxVideoPixels               = 3840 * 2160
+	MaxVideoMacroblocksPerSecond = 983_040
 	// Coded pictures may include alignment outside the visible crop. Keep this
 	// separate from visible dimensions and within H.264 Level 5.1 storage.
 	MaxCodedVideoDimension = 4096
@@ -34,7 +35,7 @@ func ValidVideoSize(width, height uint32) bool {
 // ceiling (H.264 Level 5.1), including non-preset shapes and frame rates.
 func ValidVideoFormat(width, height, framerate uint32) bool {
 	return ValidVideoSize(width, height) && framerate >= 1 && framerate <= 60 &&
-		uint64((width+15)/16)*uint64((height+15)/16)*uint64(framerate) <= 983_040
+		uint64((width+15)/16)*uint64((height+15)/16)*uint64(framerate) <= MaxVideoMacroblocksPerSecond
 }
 
 func ValidCodedVideoSize(width, height uint64) bool {
diff --git a/scripts/app-native-host-gate.ts b/scripts/app-native-host-gate.ts
index 5c80f04a5..0bf8c6053 100644
--- a/scripts/app-native-host-gate.ts
+++ b/scripts/app-native-host-gate.ts
@@ -82,6 +82,7 @@ interface GateResult {
   qualityControlsEnabled: boolean;
   livePresetChanges: number;
   liveQualityChanged: boolean;
+  fourKQualityChanged: boolean;
   customQualityChanged: boolean;
   pausedQualityChanged: boolean;
   backgroundProfileRecovery: boolean | null;
@@ -633,6 +634,7 @@ async function main(): Promise<void> {
     qualityControlsEnabled: false,
     livePresetChanges: 0,
     liveQualityChanged: false,
+    fourKQualityChanged: false,
     customQualityChanged: false,
     pausedQualityChanged: false,
     backgroundProfileRecovery: mode === "local" && sourceKind === "window" ? false : null,
@@ -1020,6 +1022,29 @@ async function main(): Promise<void> {
       result.viewerWidth = viewerState.width;
       result.viewerHeight = viewerState.height;
       await assertVideoCodec(cdp, viewer, actualCodec);
+      stage = "native-4k-quality";
+      await clickHostControl(cdp, host, `document.querySelectorAll('button.lr-tile')[2]`);
+      await waitForValue(deadline => evaluate<boolean>(cdp!, host,
+        `document.querySelector('.lr-slider input[type="range"]')?.value === '60' &&
+          document.querySelector('.lr-sharing-panel')?.getAttribute('aria-busy') === 'false'`,
+        deadline), Boolean, 20_000);
+      const framesBefore4K = await evaluate<number>(cdp, viewer,
+        `document.querySelector('video')?.getVideoPlaybackQuality().totalVideoFrames ?? 0`, Date.now() + 5_000);
+      await evaluate<void>(cdp, host,
+        `document.querySelector('button.lr-chip[aria-label="4K"]')?.click()`, Date.now() + 5_000);
+      await waitForValue(deadline => evaluate<boolean>(cdp!, host, `(() => {
+        const fps = document.querySelector('.lr-slider input[type="range"]');
+        const width = document.querySelector('.lr-video-size input[name="width"]');
+        const height = document.querySelector('.lr-video-size input[name="height"]');
+        return fps?.max === '30' && fps.value === '30' && width?.value === '3840' && height?.value === '2160';
+      })()`, deadline), Boolean, 10_000);
+      result.fourKQualityChanged = await waitForValue(deadline => evaluate<boolean>(cdp!, viewer, `(() => {
+        const video = document.querySelector('video');
+        return Boolean(video && window.__piikGateFitsProfile(3840, 2160) &&
+          video.srcObject === window.__piikGateMedia &&
+          video.getVideoPlaybackQuality().totalVideoFrames >= ${framesBefore4K + 10});
+      })()`, deadline), Boolean, 20_000);
+      await assertVideoCodec(cdp, viewer, actualCodec);
       stage = "native-custom-quality";
       const framesBeforeCustom = await evaluate<number>(cdp, viewer,
         `document.querySelector('video')?.getVideoPlaybackQuality().totalVideoFrames ?? 0`, Date.now() + 5_000);
@@ -1493,7 +1518,7 @@ async function main(): Promise<void> {
           result.viewerFrames >= 30 && result.viewerWidth > 0 && result.viewerWidth <= 2560 &&
           result.viewerHeight > 0 && result.viewerHeight <= 1440 && result.codecPreserved
         : result.viewerConnected && result.viewerFrames >= 30 &&
-        result.qualityControlsEnabled && result.liveQualityChanged && result.customQualityChanged &&
+        result.qualityControlsEnabled && result.liveQualityChanged && result.fourKQualityChanged && result.customQualityChanged &&
         result.backgroundProfileRecovery !== false &&
         result.sourceWindowRecovery !== false &&
         result.livePresetChanges === 2 &&
diff --git a/src/client/components/living/QualityPresets.tsx b/src/client/components/living/QualityPresets.tsx
index fe56be928..7765e3e59 100644
--- a/src/client/components/living/QualityPresets.tsx
+++ b/src/client/components/living/QualityPresets.tsx
@@ -1,15 +1,16 @@
 import { Fragment } from "react";
 import {
   QUALITY_PROFILES, QUALITY_PROFILE_KEYS, QUALITY_RESOLUTIONS, qualityResolutionEqual,
-  type QualityProfileId, type QualityResolution,
+  captureFramerateCeiling, VIDEO_CAPTURE_LIMITS, type VideoCaptureLimits, type QualityProfileId, type QualityResolution,
 } from "../../media/quality";
 import { useCopy } from "../../ui/copy";
 import { Chip } from "./primitives";
 import { QualityTileGlyph } from "./QualityTileGlyph";
 import { Tooltip } from "./Tooltip";
 
-export function QualityPresets({ selected, disabled = false, busy = false, onSelect }: {
+export function QualityPresets({ selected, limits = VIDEO_CAPTURE_LIMITS, disabled = false, busy = false, onSelect }: {
   selected: QualityProfileId | null;
+  limits?: VideoCaptureLimits;
   disabled?: boolean;
   busy?: boolean;
   onSelect: (id: QualityProfileId) => void;
@@ -22,7 +23,8 @@ export function QualityPresets({ selected, disabled = false, busy = false, onSel
       return <Tooltip key={id} kind="hint-quality" align={index === 0 ? "start" : "center"}
         text={vis ? undefined : t("host.quality.title", { label: caption, mbps: (profile.maxBitrate / 1_000_000).toFixed(0) })}>
         <button type="button" className={`lr-tile${selected === id ? " is-selected" : ""}`}
-          aria-pressed={selected === id} aria-label={caption} disabled={disabled} onClick={() => onSelect(id)}>
+          aria-pressed={selected === id} aria-label={caption}
+          disabled={disabled || profile.maxFramerate > captureFramerateCeiling(profile.resolution, limits)} onClick={() => onSelect(id)}>
           <QualityTileGlyph resolution={`${profile.resolution.height}p`} framerate={profile.maxFramerate} />
           <small>{vis ? `${profile.resolution.height}·${profile.maxFramerate}` : caption}</small>
         </button>
@@ -31,9 +33,9 @@ export function QualityPresets({ selected, disabled = false, busy = false, onSel
   </div>;
 }
 
-export function ResolutionControl({ value, maximum, disabled, onChange }: {
+export function ResolutionControl({ value, limits, disabled, onChange }: {
   value: QualityResolution;
-  maximum: QualityResolution;
+  limits: VideoCaptureLimits;
   disabled: boolean;
   onChange: (resolution: QualityResolution) => void;
 }) {
@@ -50,6 +52,10 @@ export function ResolutionControl({ value, maximum, disabled, onChange }: {
       return;
     }
     const next = { width: width.valueAsNumber, height: height.valueAsNumber };
+    if (captureFramerateCeiling(next, limits) < 15) {
+      reset(container);
+      return;
+    }
     if (!qualityResolutionEqual(value, next)) onChange(next);
   };
   return <div className="lr-resolution-controls"
@@ -66,18 +72,19 @@ export function ResolutionControl({ value, maximum, disabled, onChange }: {
     <div className="lr-row-group" role="group" aria-label={t("host.advanced.resolution")}>
       {Object.entries(QUALITY_RESOLUTIONS).map(([label, resolution]) => <Chip key={label}
         selected={qualityResolutionEqual(value, resolution)}
-        disabled={disabled || resolution.width > maximum.width || resolution.height > maximum.height}
+        disabled={disabled || captureFramerateCeiling(resolution, limits) < 15}
         title={label} hint="hint-quality" onClick={() => onChange(resolution)}>{label}</Chip>)}
     </div>
     <Tooltip kind="hint-quality" text={vis ? undefined : t("host.video.resolutionHint", {
-      width: String(maximum.width), height: String(maximum.height),
+      width: String(limits.maxVideoResolution.width), height: String(limits.maxVideoResolution.height),
+      pixels: limits.maxVideoPixels.toLocaleString("en-US"),
     })}>
       <span className="lr-input lr-video-size" key={`${value.width}x${value.height}`}
         role="group" aria-label={t("host.advanced.resolution")}>
         {axes.map((axis, index) => <Fragment key={axis}>
           {index === 1 ? <span aria-hidden="true">×</span> : null}
           <input type="number" inputMode="numeric" name={axis} defaultValue={value[axis]}
-            min={4} max={maximum[axis]} step={2} disabled={disabled}
+            min={4} max={limits.maxVideoResolution[axis]} step={2} disabled={disabled}
             aria-label={t(axis === "width" ? "host.video.width" : "host.video.height")} />
         </Fragment>)}
         <span aria-hidden="true">px</span>
diff --git a/src/client/locales/en.ts b/src/client/locales/en.ts
index 79a16c143..95f3a59fd 100644
--- a/src/client/locales/en.ts
+++ b/src/client/locales/en.ts
@@ -361,7 +361,7 @@ export const en: Record<CopyKey, string> = {
   "host.advanced.audioBitrate": "Audio bitrate limit",
   "host.video.width": "Width limit in pixels",
   "host.video.height": "Height limit in pixels",
-  "host.video.resolutionHint": "Width × height limits: {width} × {height} pixels. Source proportions are preserved.",
+  "host.video.resolutionHint": "Width ≤ {width} px; height ≤ {height} px; total ≤ {pixels} pixels. Source proportions are preserved; the FPS limit follows the size.",
   "host.audio.bitrateHint": "Audio bitrate limit: {min}–{max} kbps.",
   "host.advanced.audio.saver": "Standard",
   "host.advanced.audio.music": "Music",
diff --git a/src/client/locales/zh.ts b/src/client/locales/zh.ts
index 62480a4fa..f17f1bbc4 100644
--- a/src/client/locales/zh.ts
+++ b/src/client/locales/zh.ts
@@ -361,7 +361,7 @@ export const zh = {
   "host.advanced.audioBitrate": "音频码率上限",
   "host.video.width": "宽度上限（像素）",
   "host.video.height": "高度上限（像素）",
-  "host.video.resolutionHint": "宽 × 高上限：{width} × {height} 像素。保留来源比例。",
+  "host.video.resolutionHint": "宽 ≤ {width}，高 ≤ {height} 像素；总像素 ≤ {pixels}。保留来源比例，帧率上限随尺寸调整。",
   "host.audio.bitrateHint": "音频码率上限：{min}–{max} kbps。",
   "host.advanced.audio.saver": "普通",
   "host.advanced.audio.music": "音乐",
diff --git a/src/client/media/quality.ts b/src/client/media/quality.ts
index 4a93b4c58..6f521c751 100644
--- a/src/client/media/quality.ts
+++ b/src/client/media/quality.ts
@@ -21,8 +21,40 @@ export type {
 
 export type QualityProfile = QualitySettings;
 export const STARTUP_VIDEO_ENCODED_FRAMES = 5;
-// Current product output boundary, independent of wire admission and UI shortcuts.
-export const MAX_CAPTURE_RESOLUTION = { width: 2560, height: 1440 } as const;
+export interface VideoCaptureLimits {
+  maxVideoResolution: QualityResolution;
+  maxVideoPixels: number;
+  maxVideoMacroblocksPerSecond: number;
+}
+
+// Current output boundary, independent of descriptive wire bounds and UI presets.
+// The common H.264 Level 5.1 path admits 4K30 and 1440p60 in either orientation.
+export const VIDEO_CAPTURE_LIMITS: VideoCaptureLimits = {
+  maxVideoResolution: { width: 3840, height: 3840 },
+  maxVideoPixels: 3840 * 2160,
+  maxVideoMacroblocksPerSecond: 983_040,
+};
+
+export function videoCaptureLimits(advertised?: Partial<VideoCaptureLimits>): VideoCaptureLimits {
+  const local = VIDEO_CAPTURE_LIMITS;
+  return {
+    maxVideoResolution: {
+      width: Math.min(local.maxVideoResolution.width, advertised?.maxVideoResolution?.width ?? local.maxVideoResolution.width),
+      height: Math.min(local.maxVideoResolution.height, advertised?.maxVideoResolution?.height ?? local.maxVideoResolution.height),
+    },
+    maxVideoPixels: Math.min(local.maxVideoPixels, advertised?.maxVideoPixels ?? local.maxVideoPixels),
+    maxVideoMacroblocksPerSecond: Math.min(local.maxVideoMacroblocksPerSecond,
+      advertised?.maxVideoMacroblocksPerSecond ?? local.maxVideoMacroblocksPerSecond),
+  };
+}
+
+export function captureFramerateCeiling(size: QualityResolution, limits = VIDEO_CAPTURE_LIMITS): number {
+  if (![size.width, size.height].every(value => Number.isInteger(value) && value >= 4 && value % 2 === 0)
+    || size.width > limits.maxVideoResolution.width || size.height > limits.maxVideoResolution.height
+    || size.width * size.height > limits.maxVideoPixels) return 0;
+  return Math.min(60, Math.floor(limits.maxVideoMacroblocksPerSecond /
+    (Math.ceil(size.width / 16) * Math.ceil(size.height / 16))));
+}
 
 export const QUALITY_PROFILES = {
   "720p30": {
@@ -54,6 +86,7 @@ export const QUALITY_RESOLUTIONS = {
   "720p": { width: 1280, height: 720 },
   "1080p": { width: 1920, height: 1080 },
   "1440p": { width: 2560, height: 1440 },
+  "4K": { width: 3840, height: 2160 },
 } as const satisfies Record<string, QualityResolution>;
 
 export function qualityResolutionEqual(left: QualityResolution, right: QualityResolution): boolean {
diff --git a/src/client/native/wire.ts b/src/client/native/wire.ts
index a83e95652..b91cb0c5d 100644
--- a/src/client/native/wire.ts
+++ b/src/client/native/wire.ts
@@ -35,6 +35,8 @@ export const nativeHealthSchema = nativeDiscoveryIdentitySchema.extend({
     .object({
       maxAudioBitrate: maxAudioBitrateSchema.optional(),
       maxVideoResolution: qualityResolutionSchema.optional(),
+      maxVideoPixels: z.number().int().min(16).max(8192 * 8192).optional(),
+      maxVideoMacroblocksPerSecond: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional(),
       receiverReuse: z.boolean().default(false),
       video: z.boolean().default(false),
       processAudio: z.boolean().default(false),
diff --git a/src/client/pages/ControlsPreview.tsx b/src/client/pages/ControlsPreview.tsx
index 8f2aca9e4..c639369b2 100644
--- a/src/client/pages/ControlsPreview.tsx
+++ b/src/client/pages/ControlsPreview.tsx
@@ -21,7 +21,7 @@ import { useTheaterMode } from "../components/living/use-theater-mode";
 
 import { QualityPresets, ResolutionControl } from "../components/living/QualityPresets";
 import { RoomCodeInput } from "../components/living/RoomCodeInput";
-import { MAX_CAPTURE_RESOLUTION, QUALITY_PROFILES, type QualityProfileId, type QualityResolution } from "../media/quality";
+import { VIDEO_CAPTURE_LIMITS, QUALITY_PROFILES, type QualityProfileId, type QualityResolution } from "../media/quality";
 import type { loadCameraPreviews } from "../media/camera-previews";
 import { Tooltip } from "../components/living/Tooltip";
 import { StatusIndicator } from "../components/living/StatusIndicator";
@@ -119,7 +119,7 @@ export function ControlsPreview() {
         </div>
         <SharingSettings id="preview-sharing-settings" open={sharingSettings}
           presets={<QualityPresets selected={preset} onSelect={id => { setPreset(id); setResolution(QUALITY_PROFILES[id].resolution); }} />}
-          picture={<ResolutionControl value={resolution} maximum={MAX_CAPTURE_RESOLUTION} disabled={false}
+          picture={<ResolutionControl value={resolution} limits={VIDEO_CAPTURE_LIMITS} disabled={false}
             onChange={value => { setResolution(value); setPreset(null); }} />}
           audio={<><div className="lr-door-group lr-source-audio-settings">
             <SwitchItem checked={sound} onChange={setSound} label={t("host.sourcePicker.systemAudio")}
diff --git a/src/client/pages/HostPage.tsx b/src/client/pages/HostPage.tsx
index 61886604c..8991adcc4 100644
--- a/src/client/pages/HostPage.tsx
+++ b/src/client/pages/HostPage.tsx
@@ -128,7 +128,8 @@ import {
   matchingQualityProfileId,
   QUALITY_PROFILES,
   DEGRADATION_PREFERENCE_KEYS,
-  MAX_CAPTURE_RESOLUTION,
+  videoCaptureLimits,
+  captureFramerateCeiling,
   qualityResolutionEqual,
   qualitySettingsEqual,
   qualitySettingsLabel,
@@ -3597,11 +3598,8 @@ export function HostPage({
   const audioBitrateCeiling = Math.min(MAX_SCREEN_AUDIO_BITRATE, nativeActive
     ? nativeClientRef.current?.health.nativeMedia.maxAudioBitrate ?? MAX_SCREEN_AUDIO_BITRATE
     : MAX_SCREEN_AUDIO_BITRATE);
-  const nativeResolutionCeiling = nativeActive ? nativeClientRef.current?.health.nativeMedia.maxVideoResolution : undefined;
-  const resolutionCeiling = {
-    width: Math.min(MAX_CAPTURE_RESOLUTION.width, nativeResolutionCeiling?.width ?? MAX_CAPTURE_RESOLUTION.width),
-    height: Math.min(MAX_CAPTURE_RESOLUTION.height, nativeResolutionCeiling?.height ?? MAX_CAPTURE_RESOLUTION.height),
-  };
+  const videoLimits = videoCaptureLimits(nativeActive ? nativeClientRef.current?.health.nativeMedia : undefined);
+  const framerateCeiling = Math.max(15, captureFramerateCeiling(advancedQuality.resolution, videoLimits));
 
   return (
     <div className="lr-app">
@@ -3835,7 +3833,7 @@ export function HostPage({
           </div>
           <SharingSettings id="host-advanced-door" open={showAdvanced} busy={changingQuality}
             presets={
-              <QualityPresets selected={selectedQualityProfileId} busy={changingQuality}
+              <QualityPresets selected={selectedQualityProfileId} limits={videoLimits} busy={changingQuality}
                 disabled={phase === "starting" || switchingSource}
                 onSelect={id => void changeQuality({ ...QUALITY_PROFILES[id],
                   maxAudioBitrate: screenAudioBitrate(advancedQualityRef.current.maxAudioBitrate),
@@ -3849,9 +3847,11 @@ export function HostPage({
                   <Glyph name="expand" size={19} />
                   <Cap k="host.advanced.resolution" />
                 </span>
-                <ResolutionControl value={advancedQuality.resolution} maximum={resolutionCeiling}
+                <ResolutionControl value={advancedQuality.resolution} limits={videoLimits}
                   disabled={phase === "starting" || switchingSource}
-                  onChange={resolution => changeAdvancedQuality({ resolution })} />
+                  onChange={resolution => changeAdvancedQuality({ resolution,
+                    maxFramerate: Math.min(advancedQualityRef.current.maxFramerate, captureFramerateCeiling(resolution, videoLimits)),
+                  })} />
               </div>
               <div className="lr-sharing-limits">
                 <div className="lr-door-group">
@@ -3866,8 +3866,8 @@ export function HostPage({
                       <input
                         type="range"
                         min={15}
-                        max={60}
-                        step={5}
+                        max={framerateCeiling}
+                        step={1}
                         value={advancedQuality.maxFramerate}
                         disabled={phase === "starting" || switchingSource}
                         aria-label={t("host.advanced.framerate")}
diff --git a/tests/native-client.test.ts b/tests/native-client.test.ts
index ea7038842..1879b9674 100644
--- a/tests/native-client.test.ts
+++ b/tests/native-client.test.ts
@@ -31,6 +31,14 @@ describe("native App private wire", () => {
     nativeMedia: { video: true, hardwareH264: true },
   };
 
+  it("reads numeric video capability descriptions and rejects malformed limits", () => {
+    const nativeMedia = { ...health.nativeMedia, maxVideoResolution: { width: 3840, height: 3840 },
+      maxVideoPixels: 3840 * 2160, maxVideoMacroblocksPerSecond: 983_040 };
+    expect(nativeHealthSchema.parse({ ...health, nativeMedia }).nativeMedia).toMatchObject(nativeMedia);
+    expect(nativeHealthSchema.safeParse({ ...health, nativeMedia: { ...nativeMedia, maxVideoPixels: 0 } }).success).toBe(false);
+    expect(nativeHealthSchema.safeParse({ ...health, nativeMedia: { ...nativeMedia, maxVideoMacroblocksPerSecond: -1 } }).success).toBe(false);
+  });
+
   it.each(["prompt", "denied"] as const)("does not hold Viewer reception for %s permission and observes a later grant", async (state) => {
     vi.stubGlobal("window", { setTimeout, clearTimeout, location: { hostname: "piik.example" } });
     const query = vi.fn().mockResolvedValue({ state });
diff --git a/tests/quality.test.ts b/tests/quality.test.ts
index 7de190a85..a65ab7b37 100644
--- a/tests/quality.test.ts
+++ b/tests/quality.test.ts
@@ -5,6 +5,8 @@ import {
   applyCaptureProfile,
   applyVideoCaptureProfile,
   captureDisplay,
+  captureFramerateCeiling,
+  videoCaptureLimits,
   configureScreenAudioSender,
   configureVideoSender,
   matchingQualityProfileId,
@@ -50,6 +52,25 @@ afterEach(() => {
 });
 
 describe("realtime quality controls", () => {
+  it("bounds custom size, orientation and frame rate together before capture", () => {
+    expect(captureFramerateCeiling(QUALITY_RESOLUTIONS["4K"])).toBe(30);
+    expect(captureFramerateCeiling({ width: 2160, height: 3840 })).toBe(30);
+    expect(captureFramerateCeiling(QUALITY_RESOLUTIONS["1440p"])).toBe(60);
+    expect(captureFramerateCeiling({ width: 1440, height: 2560 })).toBe(60);
+    expect(captureFramerateCeiling({ width: 3840, height: 2100 })).toBe(31);
+    for (const size of [{ width: 3840, height: 3840 }, { width: 1921, height: 1080 },
+      { width: 4.5, height: 4 }, { width: Infinity, height: 4 }, { width: 2, height: 4 }]) {
+      expect(captureFramerateCeiling(size)).toBe(0);
+    }
+    const limited = videoCaptureLimits({ maxVideoResolution: { width: 1920, height: 1080 },
+      maxVideoPixels: 1920 * 1080, maxVideoMacroblocksPerSecond: 245_760 });
+    expect(captureFramerateCeiling(QUALITY_RESOLUTIONS["4K"], limited)).toBe(0);
+    expect(captureFramerateCeiling(QUALITY_RESOLUTIONS["1080p"], limited)).toBe(30);
+    expect(captureFramerateCeiling(QUALITY_RESOLUTIONS["720p"], limited)).toBe(60);
+    expect(videoCaptureLimits({ maxVideoResolution: { width: 8192, height: 8192 },
+      maxVideoPixels: 8192 * 8192, maxVideoMacroblocksPerSecond: 9_000_000 })).toEqual(videoCaptureLimits());
+  });
+
   it("keeps exactly three recommended profiles with 1080p30 as the default", () => {
     expect(Object.keys(QUALITY_PROFILES)).toEqual([
       "720p30",

From fa61093ab41712fbf75fc48c62c0d35ca3bca637 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 18:24:11 +0800
Subject: [PATCH 075/262] test(media): cover numeric source geometry and mixed
 fanout

---
 docs/research/browser-local-encoding-pool.md |  7 ++++++
 docs/research/native-client-media.md         | 15 +++++++++---
 docs/status.md                               |  5 ++--
 docs/todo.md                                 |  6 +++--
 scripts/app-browser-fanout-gate.ts           | 25 +++++++++++++++-----
 scripts/browser-local-pool-page.js           | 25 ++++++++++++--------
 scripts/browser-local-pool-probe.ts          | 12 +++++++---
 scripts/media-gate-geometry.ts               | 11 +++++++++
 tests/browser-gate-harness.test.ts           | 10 ++++++++
 9 files changed, 90 insertions(+), 26 deletions(-)

diff --git a/docs/research/browser-local-encoding-pool.md b/docs/research/browser-local-encoding-pool.md
index a462562cd..50e3d1eff 100644
--- a/docs/research/browser-local-encoding-pool.md
+++ b/docs/research/browser-local-encoding-pool.md
@@ -677,9 +677,16 @@ npx tsx scripts/browser-local-pool-probe.ts carrier --1080 --background
 npx tsx scripts/browser-local-pool-probe.ts carrier --display --quiet-start --1080 --h264 --av --lifecycle
 npx tsx scripts/browser-local-pool-probe.ts ordinary --display --quiet-start --1080 --av --lifecycle
 npx tsx scripts/browser-local-pool-probe.ts carrier --display --1080 --h264 --av --network --auto --rate=400000 --preference=balanced
+npx tsx scripts/browser-local-pool-probe.ts carrier --display --size=3840x2160 --h264 --single --lifecycle
+npx tsx scripts/browser-local-pool-probe.ts carrier --size=2160x3840 --h264 --relay --late
 ```
 
 Add `--h264`, `--single` or `--late` for the corresponding case. Set
+`--size=WIDTHxHEIGHT` for a numeric source/quality ceiling within current 30 fps
+capture bounds; this also requests that window size for real tab capture.
+Chrome's content area and capture toolbar can make the actual surface smaller.
+The pool check expects one output owner per compatible allocation, not one
+owner for children with different bandwidth budgets. Set
 `--network --auto --short-pulse` for a 45-second warmup, one-second constraint
 and 40-second recovery instead of the ordinary 14-second constraint. Set
 `CHROME_PATH` for another installed Chromium binary. `--auto` extends the
diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 47d27e702..e2b15c7ef 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -608,9 +608,18 @@ profile, audio-only edits with retained connections, subscription/page recovery
 and retirement. Windows native checks and Linux headless build/checks pass;
 macOS SDK and physical 4K capture are not verified here. Controls now use the
 combined limits, reject oversized pixel totals and cap frame rate on size changes.
-Whole-route and cross-device acceptance remain open. These checks do not
-establish 4K60, sustained device performance or
-universal portrait decoding support.
+
+Chrome 154 real portrait/landscape tab capture retained the source aspect through
+the pooled output. The landscape check also passed live/quiet/paused profile
+changes, source replacement and ordinary recovery after producer failure.
+A synthetic 2160x3840 Browser relay delivered fresh pictures to two children,
+including a late connection. Separate 3840x2160 and 2160x3840 Browser-to-Native
+fanout checks delivered about 30 fps to both Viewers and passed live reduction,
+pause/resume, source-audio changes and App-exit recovery. Reproduce with
+`PIIK_CLIENT_BROWSER_FANOUT_GATE=true`, `PIIK_CLIENT_GATE_VIDEO_SIZE=WIDTHxHEIGHT`
+and `CHROME_PATH` set, then run `npm run gate:app-browser-fanout`.
+These local checks do not establish 4K60, physical 4K/game
+capture, sustained device performance, all Browser decoders or all route changes.
 
 The proposed boundary follows the
 [Media Capture specification](https://www.w3.org/TR/mediacapture-streams/#constrainable-interface):
diff --git a/docs/status.md b/docs/status.md
index 015bb9549..ff0bf8a74 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -69,8 +69,9 @@ remain unchanged. Matched candidate App/Web/Server builds are required;
 Custom width/height controls apply combined size and frame-rate limits, admitting
 4K30. Windows and Linux output preserve source shape within the selected ceiling.
 The [media assessment](./research/native-client-media.md#media-capability-extension-assessment)
-owns local codec, derived-output, SFU and live-control evidence. Browser/macOS
-geometry, whole-route/device acceptance and additional codecs remain open.
+owns local codec, derived-output, SFU, Browser/Native fanout and live-control
+evidence. macOS geometry, cross-browser/device and route-change acceptance, and
+additional codecs remain open.
 Native Magicsock remains an isolated experiment with incomplete product
 integration and unresolved recovery cases. These proposals do not yet change
 the accepted contract or transport. A small external test is proposed before
diff --git a/docs/todo.md b/docs/todo.md
index 489d0af47..26e0d1449 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -49,8 +49,10 @@ Implementation needs a concrete useful result within the product model.
   separate UI presets, numeric requests, bounded implementation capabilities and
   actual output. Numeric audio and video controls are implemented; the assessment
   owns local capture, codec, derived-output and SFU evidence. Next verify
-  Native/Browser mixed routes, 4K source/live changes and limited receivers.
-  Browser/macOS geometry and physical 4K capture remain open. Preserve safety
+  route changes, limited receivers and cross-browser/camera orientation behavior.
+  Browser display capture, Browser relay and Browser-to-Native fanout now have
+  bounded high-resolution evidence. macOS geometry and physical 4K/game capture
+  remain open. Preserve safety
   limits and framework-owned adaptation. The
   [audio controls](./research/browser-screen-audio-quality.md#numeric-bitrate-assessment)
   retain explicit receive-limit enforcement and the current 320 kbps sender
diff --git a/scripts/app-browser-fanout-gate.ts b/scripts/app-browser-fanout-gate.ts
index e534a31e6..531e881e3 100644
--- a/scripts/app-browser-fanout-gate.ts
+++ b/scripts/app-browser-fanout-gate.ts
@@ -8,6 +8,7 @@ import {
   waitForSample, waitForVersion, type PageHandle,
 } from "./browser-gate-harness";
 import { readAppEndpoint } from "./app-gate-endpoint";
+import { fittedCaptureSize, matchesCaptureSize, parseVideoGateSize } from "./media-gate-geometry";
 
 const ROOT = resolve(import.meta.dirname, "..");
 const BUILD_ROOT = join(ROOT, "build/go-check");
@@ -17,6 +18,7 @@ const BUILD_ROOT = join(ROOT, "build/go-check");
 const LAN_ADDRESS = "192.0.2.1";
 
 const initialAudio = process.env.PIIK_CLIENT_GATE_AUDIO !== "false";
+const captureSize = parseVideoGateSize(process.env.PIIK_CLIENT_GATE_VIDEO_SIZE || "1920x1080");
 const probe = String.raw`(() => {
   localStorage.setItem('piik:ui-lang', 'en');
   localStorage.setItem('piik:ui-mode', 'text');
@@ -38,8 +40,8 @@ const probe = String.raw`(() => {
   let audio = ${initialAudio}, captures = 0;
   navigator.mediaDevices.getDisplayMedia = async () => {
     captures++;
-    const canvas = document.createElement('canvas'); canvas.width = 1920; canvas.height = 1080;
-    const context = canvas.getContext('2d'); let frame = 0;
+    const canvas = document.createElement('canvas'); canvas.width = ${captureSize.width}; canvas.height = ${captureSize.height};
+    const context = canvas.getContext('2d'); context.scale(canvas.width/1920,canvas.height/1080); let frame = 0;
     const draw = () => { context.fillStyle = '#14242a'; context.fillRect(0,0,1920,1080);
       context.fillStyle = '#68dab3'; context.fillRect((frame++ * 17)%1800,100,120,400);
       context.fillStyle = '#ffffff'; context.font = '80px sans-serif'; context.fillText(String(frame),100,700); };
@@ -80,7 +82,7 @@ const probe = String.raw`(() => {
           }
         }); }
       const video = document.querySelector('video');
-      return { outbound, encoded, received, captures, videoStats, feedback, width: video?.videoWidth || 0,
+      return { outbound, encoded, received, captures, videoStats, feedback, width: video?.videoWidth || 0, height: video?.videoHeight || 0,
         requests, errors, peers: pcs.map((p) => ({state:p.connectionState, tracks:p.getSenders().map((s)=>s.track?.kind)})),
         frames: video?.getVideoPlaybackQuality().totalVideoFrames || 0,
         sharing: Boolean(document.querySelector('button[aria-label="Stop sharing"]')),
@@ -206,6 +208,12 @@ async function main(): Promise<void> {
     await click(host, 'button[aria-controls="host-advanced-door"]');
     stage = "share-codec";
     await click(host, 'button[aria-label^="H264"]');
+    await evaluate(cdp, host, `(() => {
+      const width = document.querySelector('.lr-video-size input[name="width"]');
+      const height = document.querySelector('.lr-video-size input[name="height"]');
+      width.focus(); width.value = '${captureSize.width}';
+      height.focus(); height.value = '${captureSize.height}'; height.blur();
+    })()`, Date.now()+5000);
     stage = "share-picker";
     await click(host, 'button.lr-tv-big.is-action');
     // This arm measures Native ingress. Browser capture can start without App
@@ -240,8 +248,8 @@ async function main(): Promise<void> {
       await waitForSample(() => read(viewer), (s) => s.width > 0 && s.frames >= 30, 30000);
     }
     stage = "shared-encode";
-    await waitForSample(() => read(viewers[0]!), (s) => s.width===1920 && s.outbound===0, 30000);
-    await waitForSample(() => read(viewers[1]!), (s) => s.width===1920 && s.outbound===0, 30000);
+    for (const viewer of viewers) await waitForSample(() => read(viewer),
+      (s) => matchesCaptureSize(s.width, s.height, captureSize) && s.outbound===0, 30000);
     checks.host = await read(host);
     checks.viewers = await Promise.all(viewers.map(read));
     if ((checks.host as any).outbound !== 1 || !(checks.viewers as any[]).every((v) => v.outbound === 0)) {
@@ -255,7 +263,12 @@ async function main(): Promise<void> {
     if (!(checks.viewerFps as number[]).every((fps) => fps>=27)) throw new Error("Viewer delivery did not sustain the 30 fps source");
     stage = "quality";
     await click(host, 'button[aria-label="720p"]');
-    await waitForSample(() => read(viewers[0]!), (s) => s.width === 1280, 20000);
+    // Canvas capture can crop when applyConstraints changes its aspect. This
+    // gate checks fanout of the actual input; --display in the pool probe owns
+    // real display-capture geometry.
+    await waitForSample(async () => ({ source: await read(host), viewer: await read(viewers[0]!) }),
+      ({ source, viewer }) => source.width > 0 && source.height > 0 &&
+        matchesCaptureSize(viewer.width, viewer.height, fittedCaptureSize(source, 1280, 720)), 20000);
     checks.liveQuality = true;
     stage = "pause-resume";
     await click(host, 'button[aria-label="Pause sharing"]');
diff --git a/scripts/browser-local-pool-page.js b/scripts/browser-local-pool-page.js
index a2ead5744..c5f66e524 100644
--- a/scripts/browser-local-pool-page.js
+++ b/scripts/browser-local-pool-page.js
@@ -1,7 +1,7 @@
 // Actual HostPeer/BrowserEncodingPool comparison; synthetic source and local receivers only.
 import { BrowserEncodingPool as ProbePool } from '../src/client/media/browser-encoding-pool';
 import { HostPeer as ProbeHostPeer } from '../src/client/webrtc/host-peer';
-import { applyVideoCaptureProfile as probeApplyProfile } from '../src/client/media/quality';
+import { applyVideoCaptureProfile as probeApplyProfile, QUALITY_RESOLUTIONS } from '../src/client/media/quality';
 import { browserDebugEnabled, exportBrowserDebug } from '../src/client/lib/debug';
 
 const settings = new URLSearchParams(location.search);
@@ -15,8 +15,9 @@ const relay = settings.get('relay') === '1';
 const shortPulse = settings.get('shortPulse') === '1';
 const displaySource = settings.get('displaySource') === '1';
 const quietStart = settings.get('quietStart') === '1';
-const selectedProfile = () => ({ resolution: high ? '1080p' : '480p', maxFramerate: 30,
-    maxBitrate: high ? 5000000 : 1700000,
+const customSize = settings.has('width') ? { width: Number(settings.get('width')), height: Number(settings.get('height')) } : null;
+const selectedProfile = () => ({ resolution: customSize ?? QUALITY_RESOLUTIONS[high ? '1080p' : '480p'], maxFramerate: 30,
+    maxBitrate: customSize ? 12000000 : high ? 5000000 : 1700000,
     degradationPreference: settings.get('preference') || (high ? 'maintain-resolution' : 'balanced'),
     maxAudioBitrate: Number(settings.get('audioBitrate') || 128000) });
 const productPool = mode === 'carrier' ? new ProbePool() : null;
@@ -46,6 +47,8 @@ const poolState = () => productPool ? {
         ready: g.ready, failed: g.failed, output: g.output }))
 } : null;
 window.probeProgress = () => ({ phase, sourceFrame, errors, pool: poolState(),
+    sourceSize: { width: rawSource?.getSettings().width, height: rawSource?.getSettings().height },
+    captured: sourceFrames.slice(-3), decoded: monitors.map(m => ({ role: m.role, last: m.samples.at(-1) })),
     peers: peers.map(p => ({ connection: p.connectionState, ice: p.iceConnectionState })),
     audio: audioMonitors.map(m => ({ role: m.role, attached: m.attached, pulses: m.pulses.length })) });
 
@@ -231,10 +234,10 @@ async function run() {
         audioTrack = destination.stream.getAudioTracks()[0]; tracks.push(audioTrack);
     }
     const source = document.createElement('canvas');
-    source.width = high ? 1920 : 640; source.height = high ? 1080 : 360;
+    source.width = customSize?.width ?? (high ? 1920 : 640); source.height = customSize?.height ?? (high ? 1080 : 360);
     if (!nativeSource) document.body.prepend(source);
     const ctx = source.getContext('2d');
-    if (high) ctx.scale(3, 3);
+    ctx.scale(source.width / 640, source.height / 360);
     if (displaySource) {
         document.body.style.margin = '0';
         source.style.cssText = 'position:fixed;inset:0;width:100vw;height:100vh;z-index:10';
@@ -294,8 +297,10 @@ async function run() {
         let activated = null;
         for (;;) {
             const members = [...productPool.members];
+            // Compatible allocations share an owner; distinct BWE budgets must
+            // remain independent even when this synthetic scene encodes cheaply.
             const sharing = members.length === productPeers.length && members.every(m => m.current && m.carrier && !m.replacement) &&
-                new Set(members.map(m => m.current)).size === 1;
+                new Set(members.map(m => m.current)).size === new Set(members.map(m => m.budget)).size;
             if (sharing) activated ??= performance.now();
             else activated = null;
             if (activated !== null && monitors.every(m => {
@@ -335,16 +340,16 @@ async function run() {
             phase = name; await wait(duration); snapshots.push(await snapshot());
             if (name.startsWith('quiet-') || name.startsWith('paused-')) return;
             for (const monitor of monitors) {
-                const last = monitor.samples.at(-1), ceiling = { '480p': 480, '720p': 720, '1080p': 1080 }[appliedProfile.resolution];
+                const last = monitor.samples.at(-1), ceiling = appliedProfile.resolution;
                 if (last?.phase !== name || (!displaySource && (last.age === null || last.age >= 1000)) ||
-                    performance.now() - last.at >= 1000 || last.height > ceiling)
+                    performance.now() - last.at >= 1000 || last.width > ceiling.width || last.height > ceiling.height)
                     throw Error(name + ': receiver did not deliver current frames within the requested ceiling');
             }
         };
-        const p60 = { ...selectedProfile(), resolution: '720p', maxFramerate: 60, maxBitrate: 5000000 };
+        const p60 = { ...selectedProfile(), resolution: QUALITY_RESOLUTIONS['720p'], maxFramerate: 60, maxBitrate: 5000000 };
         phase = 'profile-720p60'; await apply(p60); await observe(phase);
         producing = false; phase = 'quiet-profile-480p30';
-        await apply({ ...p60, resolution: '480p', maxFramerate: 30, maxBitrate: 3000000 });
+        await apply({ ...p60, resolution: QUALITY_RESOLUTIONS['480p'], maxFramerate: 30, maxBitrate: 3000000 });
         await observe(phase, 2500);
         producing = true; await observe('resumed-480p30');
         rawSource.enabled = false; productPeers.forEach(peer => peer.setPaused(true));
diff --git a/scripts/browser-local-pool-probe.ts b/scripts/browser-local-pool-probe.ts
index 132a6b298..902d8cf34 100644
--- a/scripts/browser-local-pool-probe.ts
+++ b/scripts/browser-local-pool-probe.ts
@@ -6,15 +6,18 @@ import { join, resolve } from 'node:path';
 import { tmpdir } from 'node:os';
 import { CdpConnection, cleanupRun, createPage, evaluate, launchChrome, reservePort, waitForSample, waitForVersion } from './browser-gate-harness';
 import { createPoolShaper } from './browser-pool-shaper.mjs';
+import { parseVideoGateSize } from './media-gate-geometry';
 
 const mode = process.argv[2] || 'carrier', args = process.argv.slice(3);
 const flags = new Set(['--product', '--1080', '--h264', '--single', '--av', '--late', '--background',
     '--native-source', '--lifecycle', '--network', '--auto', '--relay', '--debug', '--short-pulse', '--display', '--quiet-start']);
 if (!['ordinary', 'carrier'].includes(mode)) throw Error('Expected ordinary|carrier');
-for (const arg of args) if (!flags.has(arg) && !arg.startsWith('--rate=') && !arg.startsWith('--preference=') && !arg.startsWith('--audio-bitrate='))
+for (const arg of args) if (!flags.has(arg) && !arg.startsWith('--rate=') && !arg.startsWith('--preference=') && !arg.startsWith('--audio-bitrate=') && !arg.startsWith('--size='))
     throw Error('Unsupported option: ' + arg);
 const codec = args.includes('--h264') ? 'H264' : 'VP8', network = args.includes('--network');
 const automatic = args.includes('--auto'), high = args.includes('--1080'), av = args.includes('--av');
+const sizeArgument = args.find(arg => arg.startsWith('--size='));
+const size = sizeArgument ? parseVideoGateSize(sizeArgument.slice('--size='.length)) : undefined;
 const single = args.includes('--single'), late = args.includes('--late'), background = args.includes('--background');
 const displaySource = args.includes('--display');
 const quietStart = args.includes('--quiet-start');
@@ -24,7 +27,7 @@ const shortPulse = args.includes('--short-pulse');
 const rate = Number(args.find(arg => arg.startsWith('--rate='))?.split('=')[1] || 120000);
 const audioBitrate = Number(args.find(arg => arg.startsWith('--audio-bitrate='))?.split('=')[1] || 128000);
 if (!Number.isInteger(audioBitrate) || audioBitrate < 6000 || audioBitrate > 320000) throw Error('Audio bitrate must be 6000..320000 bps');
-const preference = args.find(arg => arg.startsWith('--preference='))?.split('=')[1] || (high ? 'maintain-resolution' : 'balanced');
+const preference = args.find(arg => arg.startsWith('--preference='))?.split('=')[1] || (high || size ? 'maintain-resolution' : 'balanced');
 if (!['balanced', 'maintain-resolution', 'maintain-framerate'].includes(preference)) throw Error('Unsupported degradation preference');
 if (!Number.isInteger(rate) || rate <= 0) throw Error('Rate must be a positive integer in bps');
 if (lifecycle && (nativeSource || network || relay)) throw Error('Lifecycle uses direct canvas/display capture without network shaping');
@@ -76,7 +79,7 @@ const port = (server.address() as { port: number }).port, debugPort = await rese
 const profile = await mkdtemp(join(tmpdir(), 'piik-client-media-'));
 const chrome = await launchChrome(process.env.CHROME_PATH || 'C:/Program Files/Google/Chrome/Application/chrome.exe', debugPort, profile,
     ['--headless=new', '--no-first-run', '--autoplay-policy=no-user-gesture-required',
-        ...(displaySource ? ['--window-size=1920,1200', '--force-device-scale-factor=1',
+        ...(displaySource ? [`--window-size=${size?.width ?? 1920},${size?.height ?? 1200}`, '--force-device-scale-factor=1',
             '--auto-accept-this-tab-capture', '--auto-select-tab-capture-source-by-title=Browser local pool'] : []),
         ...(background ? [] : ['--disable-background-timer-throttling', '--disable-renderer-backgrounding']),
         ...(nativeSource ? ['--use-fake-device-for-media-stream', '--use-fake-ui-for-media-stream'] : [])]);
@@ -88,6 +91,9 @@ try {
     cdp = await CdpConnection.connect(version.webSocketDebuggerUrl, Date.now() + 5000);
     page = await createPage(cdp, 'about:blank');
     const query = new URLSearchParams({ mode, codec, rate: String(rate), preference, audioBitrate: String(audioBitrate) });
+    if (size) {
+        query.set('width', String(size.width)); query.set('height', String(size.height));
+    }
     if (process.argv.includes('--debug')) query.set('debug', '1');
     for (const [key, value] of Object.entries({ network, automatic, high, av, single, late, background, nativeSource, displaySource, quietStart, lifecycle, relay, shortPulse }))
         query.set(key, value ? '1' : '0');
diff --git a/scripts/media-gate-geometry.ts b/scripts/media-gate-geometry.ts
index 1d388ee5e..77b04a216 100644
--- a/scripts/media-gate-geometry.ts
+++ b/scripts/media-gate-geometry.ts
@@ -1,3 +1,14 @@
+import { captureFramerateCeiling } from "../src/client/media/quality";
+
+export function parseVideoGateSize(value: string) {
+  const match = /^(\d+)x(\d+)$/.exec(value);
+  const size = { width: Number(match?.[1]), height: Number(match?.[2]) };
+  if (captureFramerateCeiling(size) < 30) {
+    throw new Error("Video size must be WIDTHxHEIGHT within current 30 fps capture limits");
+  }
+  return size;
+}
+
 // Gate expectations derive from the decoded source instead of assuming a 16:9
 // canvas. Two pixels allow independent NV12 rounding at successive ceilings.
 export function fittedCaptureSize(source: { width: number; height: number }, width: number, height: number) {
diff --git a/tests/browser-gate-harness.test.ts b/tests/browser-gate-harness.test.ts
index f9919cd43..6baf43452 100644
--- a/tests/browser-gate-harness.test.ts
+++ b/tests/browser-gate-harness.test.ts
@@ -1,6 +1,16 @@
 import { expect, it } from "vitest";
 import { join } from "node:path";
 import { launchChrome } from "../scripts/browser-gate-harness";
+import { parseVideoGateSize } from "../scripts/media-gate-geometry";
+
+it("accepts bounded numeric gate sizes and rejects malformed or oversized sources", () => {
+  expect(parseVideoGateSize("3840x2160")).toEqual({ width: 3840, height: 2160 });
+  expect(parseVideoGateSize("2160x3840")).toEqual({ width: 2160, height: 3840 });
+  expect(parseVideoGateSize("960x600")).toEqual({ width: 960, height: 600 });
+  for (const value of ["", "1920", "1920x1080x2", "4.5x4", "0x1080", "1921x1080", "3840x3840", "8192x8192"]) {
+    expect(() => parseVideoGateSize(value)).toThrow("30 fps capture limits");
+  }
+});
 
 it("reports a missing browser executable through awaited startup", async () => {
   await expect(launchChrome(join(import.meta.dirname, "missing-browser.exe"), 9222,

From c75a20521a2d4eae4b6a5c1fe43c5e41f5ded2b0 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 18:39:24 +0800
Subject: [PATCH 076/262] fix(media): isolate incompatible receiver encoding
 fallback

---
 docs/research/browser-local-encoding-pool.md |  9 +++++
 docs/research/native-client-media.md         |  9 +++++
 docs/standards/media-quality.md              |  4 ++-
 src/client/media/browser-encoding-pool.ts    | 21 +++++++-----
 tests/browser-encoding-pool.test.ts          | 36 ++++++++++++++++----
 5 files changed, 64 insertions(+), 15 deletions(-)

diff --git a/docs/research/browser-local-encoding-pool.md b/docs/research/browser-local-encoding-pool.md
index 50e3d1eff..9a253b2f3 100644
--- a/docs/research/browser-local-encoding-pool.md
+++ b/docs/research/browser-local-encoding-pool.md
@@ -101,6 +101,15 @@ around fallback was 271 ms for H264 and 80 ms for VP8. Source-wide fallback
 therefore has a measurable handoff cost, even without a resolution drop or
 connection failure. This does not establish low-end hardware capacity.
 
+An unmatched negotiated codec is instead connection-local. A Chrome 154
+late-Viewer control reproduced all members losing pooling when only the new
+Viewer advertised different codec parameters. Scoped fallback now preserves
+the first Viewer's producer and delivers fresh pictures to both Viewers in
+VP8 1080p and H264 4K controls. Unit counterfactuals cover admission and active
+codec changes; producer failure retains its existing source-wide fallback.
+These controls establish membership isolation, not enforcement of physical
+decoder limits or the cause of field quality fluctuations.
+
 ### Local Connection Failure Control
 
 On 2026-10-08, Windows headless Chrome 154 ran the actual `HostPeer` and pool
diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index e2b15c7ef..8f770af35 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -646,6 +646,15 @@ general constraint solver or second recovery owner. Numeric limits describe
 ceilings, not a promise of a constant rate or resolution. A receiver's limits
 constrain its edge or existing local output group, not every Viewer in the room.
 
+Receiver-limit acceptance cannot rely on SDP matching alone. Chrome 154
+advertised H.264 Level 3.1 while decoding the 4K controls above. In isolated
+ordinary-sender checks, lowering the answer to Level 1.2, or adding VP8
+`max-fs=1200;max-fr=15`, did not reduce the received picture size. This is not
+evidence for a physical low-capability decoder. [RFC 6184's receive-level
+rules](https://www.rfc-editor.org/rfc/rfc6184.html#section-8.2.2) and actual
+framework behavior therefore need separate validation before promising
+automatic compatibility with smaller future capability sets.
+
 Codec support must distinguish encoding, decoding and encoded forwarding,
 including profile/packetization and SFU admission. Reuse SDP codec matching;
 describe only Native control and forwarding limits that it cannot express,
diff --git a/docs/standards/media-quality.md b/docs/standards/media-quality.md
index 2c2ba8349..7b0b3300b 100644
--- a/docs/standards/media-quality.md
+++ b/docs/standards/media-quality.md
@@ -273,7 +273,9 @@ bitrate still follows the Host ceiling; ordinary fallback restores its picture
 sender limits. Preparation and applied-budget completion re-evaluate pending
 membership immediately; accepting a recovery frame still commits the handoff.
 The first eligible consumer follows the same path; unsupported APIs or failed
-pooling use ordinary senders. Prepared ordinary quality candidates, Native
+pooling use ordinary senders. Negotiated codec incompatibility retires only
+that connection's pool membership; healthy siblings keep their producers.
+Prepared ordinary quality candidates, Native
 ingress and Browser SFU remain independent compositions.
 
 Each ordinary Browser PeerConnection owns stock WebRTC congestion control and
diff --git a/src/client/media/browser-encoding-pool.ts b/src/client/media/browser-encoding-pool.ts
index de152ad5e..8736cb8f9 100644
--- a/src/client/media/browser-encoding-pool.ts
+++ b/src/client/media/browser-encoding-pool.ts
@@ -158,16 +158,16 @@ export class BrowserEncodingPool {
           if (!report) { member.budget = undefined; return; }
           const codec = negotiatedCodec(report);
           if (!codec) {
-            if (member.current || member.pending) this.failSource(member.source);
+            if (member.current || member.pending) this.fallback(member);
             else {
               const outbound = videoOutbound(report);
-              if (outbound?.codecId && report.get(outbound.codecId)) this.failSource(member.source);
+              if (outbound?.codecId && report.get(outbound.codecId)) this.fallback(member);
             }
             return;
           }
           const key = codecIdentity(codec);
           if (member.codecKey && member.codecKey !== key && (member.current || member.pending)) {
-            this.failSource(member.source); return;
+            this.fallback(member); return;
           }
           member.codec = codec; member.codecKey = key;
           member.raw = videoOutbound(report);
@@ -375,14 +375,19 @@ export class BrowserEncodingPool {
       .finally(() => { member.replacement = undefined; this.prune(); });
   }
 
+  // Negotiated compatibility belongs to one connection. Its ordinary sender
+  // remains available without retiring a healthy sibling's shared producer.
+  private fallback(member: Member): void {
+    if (member.disabled || member.disposed) return;
+    member.disabled = true;
+    if (member.replacement) void member.replacement.then(() => this.restore(member));
+    else this.restore(member);
+  }
+
   private failSource(source: MediaStreamTrack): void {
     if (this.failedSources.has(source)) return;
     this.failedSources.add(source);
-    for (const member of this.members) if (member.source === source) {
-      member.disabled = true;
-      if (member.replacement) void member.replacement.then(() => this.restore(member));
-      else this.restore(member);
-    }
+    for (const member of this.members) if (member.source === source) this.fallback(member);
   }
 
   private updatePauses(): void {
diff --git a/tests/browser-encoding-pool.test.ts b/tests/browser-encoding-pool.test.ts
index 13209f3c3..6feacedbf 100644
--- a/tests/browser-encoding-pool.test.ts
+++ b/tests/browser-encoding-pool.test.ts
@@ -12,15 +12,15 @@ const producers = new Map<BrowserEncodingProducer, {
 }>();
 let pool: BrowserEncodingPool;
 
-function stats(row: Record<string, unknown>): RTCStatsReport {
+function stats(row: Record<string, unknown>, negotiated: RTCRtpCodec = codec): RTCStatsReport {
   return new Map([
     ["video", { id: "video", timestamp: Date.now(), type: "outbound-rtp", kind: "video", codecId: "codec", ...row }],
-    ["codec", { id: "codec", timestamp: Date.now(), type: "codec", ...codec }],
+    ["codec", { id: "codec", timestamp: Date.now(), type: "codec", ...negotiated }],
   ]) as unknown as RTCStatsReport;
 }
 
 function member(budget = 2_000_000) {
-  const demand = { budget };
+  const demand = { budget, codec: { ...codec } as RTCRtpCodec };
   let producerId: string | null = null;
   const select = vi.fn((id: string, _requestKey: () => Promise<void>, selected: () => void,
     accept: (metadata: RTCEncodedVideoFrameMetadata) => boolean) => {
@@ -31,14 +31,14 @@ function member(budget = 2_000_000) {
   });
   const cancelSelection = vi.fn(() => true);
   const encoded = {
-    select, cancelSelection, push: vi.fn(), passthrough: vi.fn(), setPaused: vi.fn(),
+    select, cancelSelection, push: vi.fn(), passthrough: vi.fn(() => { producerId = null; }), setPaused: vi.fn(),
     snapshot: () => ({ frames: producerId ? 30 : 0, width: 1920, height: 1080, timestamp: Date.now(), lastProducerId: producerId }),
   } as unknown as BrowserEncodingOutput;
-  const connection = { connectionState: "connected", getStats: async () => stats({ targetBitrate: demand.budget }) };
+  const connection = { connectionState: "connected", getStats: async () => stats({ targetBitrate: demand.budget }, demand.codec) };
   const fatal = vi.fn();
   const handle = pool.create(source, {} as RTCRtpSender, connection as RTCPeerConnection, profile,
     encoded, async () => true, async () => undefined, fatal)!;
-  return { demand, select, cancelSelection, fatal, handle, producerId: () => producerId };
+  return { demand, select, cancelSelection, fatal, handle, encoded, producerId: () => producerId };
 }
 
 async function sample(count = 1) {
@@ -86,6 +86,30 @@ afterEach(() => {
 });
 
 describe("Browser encoding pool ownership", () => {
+  it.each(["joining", "active", "changed"])("isolates codec fallback for a %s member from healthy siblings", async (state) => {
+    const healthy = member();
+    let limited = state === "joining" ? null : member();
+    await sample(4);
+    const producer = [...producers.keys()][0]!;
+    limited ??= member();
+    if (state === "changed") {
+      limited.demand.codec = { mimeType: "video/H264", clockRate: 90_000,
+        sdpFmtpLine: "packetization-mode=1;profile-level-id=42e01f" };
+      vi.stubGlobal("RTCRtpSender", { getCapabilities: () => ({ codecs: [codec, limited!.demand.codec] }) });
+    } else limited.demand.codec = { ...codec, sdpFmtpLine: "max-fr=15;max-fs=1200" };
+    await sample(3);
+
+    expect(limited.encoded.passthrough).toHaveBeenCalledTimes(1);
+    expect(limited.fatal).not.toHaveBeenCalled();
+    expect(healthy.producerId()).toBe(producer.id);
+    expect(healthy.encoded.passthrough).not.toHaveBeenCalled();
+    expect(producer.dispose).not.toHaveBeenCalled();
+    const later = member();
+    expect(later.handle).not.toBeNull();
+    await sample(3);
+    expect(later.producerId()).toBe(producer.id);
+  });
+
   it("pauses a shared producer only when all of its members pause", async () => {
     const first = member(), second = member();
     await sample(4);

From 209878fbefc9ee7f0fcced42c6968a06b2100812 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 18:57:47 +0800
Subject: [PATCH 077/262] test(media): verify numeric sizes across SFU recovery

---
 docs/research/native-client-media.md | 29 ++++++++++++++++++--
 docs/todo.md                         |  3 +-
 scripts/embedded-sfu-gate.ts         | 41 ++++++++++++++++------------
 scripts/embedded-sfu-page.ts         | 25 +++++++++--------
 4 files changed, 65 insertions(+), 33 deletions(-)

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 8f770af35..8c4621c9b 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -530,13 +530,13 @@ This is a code-derived result, not a new physical capture measurement. Evaluate
 orientation-independent limits and preservation of source aspect ratio together;
 adding numeric fields alone would retain the current geometry limitation.
 
-The candidate first changes the existing Windows output worker: it passes the
+The candidate changes the existing Windows output worker: it passes the
 source's fitted even dimensions to WebRTC, retaining the selected profile as a
 ceiling. A 640x480 source stays 640x480; portrait and ultrawide sources no longer
 require an encoded landscape canvas. The converter, adaptation owner, output
 generation and frame envelope are reused. Axis-specific limits still apply;
-this does not yet give portrait capture a transposed ceiling or add a 4K setting.
-Browser and macOS geometry remain separate pending work.
+portrait capture can use explicit width/height ceilings but does not transpose
+the selected ceiling automatically. Browser evidence follows below.
 
 Linux uses the existing [GStreamer scaler](https://gstreamer.freedesktop.org/documentation/videoconvertscale/videoscale.html)
 with bounded even-dimension ranges instead of fixed output dimensions. Square
@@ -547,6 +547,15 @@ one pipeline, checks the output ceiling and image corners, and exercises the
 smallest derived output. Compilation and those regressions passed on Linux;
 Portal capture and hardware encoder resizing still need a physical device.
 
+macOS remains a concrete implementation gap: ScreenCaptureKit and VideoToolbox
+currently use the requested dimensions as a fixed canvas. The capture adapter
+also ignores per-frame content geometry. Apple's
+[capture sample](https://developer.apple.com/documentation/screencapturekit/capturing-screen-content-in-macos)
+distinguishes buffer dimensions, content rectangle and pixel scale; changing only
+the initial window size would not cover live resizing or Retina scale changes.
+Review that boundary under the existing capture/encoder owners, then verify
+portrait, small-source and resizing behavior with the macOS SDK and hardware.
+
 Local synthetic-input controls exercised that production worker through four
 successive source sizes: 1080x1920, 3440x1440, 640x480 and 1920x1080. Under the
 1080p ceiling, H.264 and VP8 each produced 40 frames at 606x1080, 1920x802,
@@ -621,6 +630,20 @@ and `CHROME_PATH` set, then run `npm run gate:app-browser-fanout`.
 These local checks do not establish 4K60, physical 4K/game
 capture, sustained device performance, all Browser decoders or all route changes.
 
+The existing SFU gate accepts `PIIK_EMBEDDED_SFU_VIDEO_SIZE=WIDTHxHEIGHT` for a
+bounded 30 fps source; its default 720p15 control remains unchanged. Run
+`npm run gate:embedded-sfu` with `PIIK_EMBEDDED_SFU_GATE=true`,
+`PIIK_EMBEDDED_SFU_CODEC=h264` and `CHROME_PATH`; add
+`PIIK_EMBEDDED_SFU_DISPLAY=true` for actual tab capture. Synthetic 2160x3840 and
+real 3440x1440 tab sources passed decoded-picture delivery, aspect-preserving
+reduction, numeric audio updates, subscription/page recovery and retirement.
+The tab control also passed background capture, lower-layer demand, pause/resume
+and source replacement. A separate full-UI 2160x3840 control passed SFU-to-P2P
+commit and failed-P2P-to-SFU recovery through the room controller, keeping the
+old SFU picture during peer preparation. These checks use loopback and synthetic
+content; they do not establish physical 4K capture, every mixed Native/Browser
+handoff or cross-network performance.
+
 The proposed boundary follows the
 [Media Capture specification](https://www.w3.org/TR/mediacapture-streams/#constrainable-interface):
 requested constraints, supported capabilities and actual settings have different
diff --git a/docs/todo.md b/docs/todo.md
index 26e0d1449..0f6545e13 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -49,7 +49,8 @@ Implementation needs a concrete useful result within the product model.
   separate UI presets, numeric requests, bounded implementation capabilities and
   actual output. Numeric audio and video controls are implemented; the assessment
   owns local capture, codec, derived-output and SFU evidence. Next verify
-  route changes, limited receivers and cross-browser/camera orientation behavior.
+  mixed Native/Browser route changes, limited receivers and cross-browser/camera
+  orientation behavior.
   Browser display capture, Browser relay and Browser-to-Native fanout now have
   bounded high-resolution evidence. macOS geometry and physical 4K/game capture
   remain open. Preserve safety
diff --git a/scripts/embedded-sfu-gate.ts b/scripts/embedded-sfu-gate.ts
index 2da845877..8e5c4feca 100644
--- a/scripts/embedded-sfu-gate.ts
+++ b/scripts/embedded-sfu-gate.ts
@@ -12,7 +12,7 @@ import {
 import type { snapshot } from "./embedded-sfu-page";
 import { readAppEndpoint } from "./app-gate-endpoint";
 import { SOURCE_TITLE, sourceServer, startSourceBrowser, waitForCaptureWindow } from "./app-native-host-gate";
-import { fittedCaptureSize } from "./media-gate-geometry";
+import { fittedCaptureSize, parseVideoGateSize } from "./media-gate-geometry";
 
 const ROOT = resolve(import.meta.dirname, "..");
 const BUILD_ROOT = join(ROOT, "build", "embedded-media");
@@ -69,6 +69,9 @@ async function main(): Promise<void> {
   const sfuOnly = process.env.PIIK_EMBEDDED_SFU_ONLY === "true";
   const displayArm = process.env.PIIK_EMBEDDED_SFU_DISPLAY === "true";
   if (displayArm && nativeArm) throw new Error("Display and Native capture are separate arms");
+  const requestedSize = process.env.PIIK_EMBEDDED_SFU_VIDEO_SIZE?.trim();
+  const captureSize = parseVideoGateSize(requestedSize || "1280x720");
+  const sizeArgument = requestedSize ? JSON.stringify(captureSize) : "undefined";
   const twoRooms = process.env.PIIK_EMBEDDED_SFU_TWO_ROOMS === "true";
   if (twoRooms && !nativeArm) throw new Error("Two-room arm requires Native publication");
   const codec = process.env.PIIK_EMBEDDED_SFU_CODEC?.trim() || "vp8";
@@ -95,7 +98,7 @@ async function main(): Promise<void> {
   const sourceProfile = nativeArm ? await mkdtemp(join(tmpdir(), "piik-client-media-")) : null;
   const [sourcePort, sourceDebugPort] = nativeArm ? [await reservePort(), await reservePort()] : [0, 0];
   const result = { passed: false, arm: `${nativeArm ? "native" : displayArm ? "display" : "browser"}-${codec}-simulcast${twoRooms ? "-two-rooms" : ""}`, stage: "start",
-    sfuOnly, stereoSeparationDb: null as number[] | null,
+    sfuOnly, captureSize, stereoSeparationDb: null as number[] | null,
     startedAt: new Date().toISOString(), finishedAt: "", processes: [] as Array<{ role: string; pid: number | null }>,
     high: null as { frames: number; width: number; height: number } | null,
     low: null as { frames: number; width: number; height: number } | null,
@@ -166,10 +169,10 @@ async function main(): Promise<void> {
           if (request.url === "/embedded-sfu-source") {
             response.setHeader("Content-Type", "text/html; charset=utf-8");
             response.end(`<!doctype html><title>Piik SFU captured source</title><style>body{margin:0}canvas{width:100vw;height:100vh}</style>
-              <canvas width="1280" height="720"></canvas><script>
+              <canvas width="${captureSize.width}" height="${captureSize.height}"></canvas><script>
               const canvas=document.querySelector('canvas'),ctx=canvas.getContext('2d');let n=0;
-              function draw(){ctx.fillStyle='#167d8d';ctx.fillRect(0,0,1280,720);ctx.fillStyle='#f2d748';
-                ctx.fillRect((n++*17)%1280,60,100,100);requestAnimationFrame(draw)}draw();</script>`);
+              function draw(){ctx.fillStyle='#167d8d';ctx.fillRect(0,0,canvas.width,canvas.height);ctx.fillStyle='#f2d748';
+                ctx.fillRect((n++*17)%canvas.width,60,100,100);requestAnimationFrame(draw)}draw();</script>`);
             return;
           }
           if (request.url !== "/embedded-sfu-gate") return next();
@@ -229,15 +232,15 @@ async function main(): Promise<void> {
     }
     if (displayArm) {
       const sourcePage = await createPage(cdp, `${origin}/embedded-sfu-source`);
-      await cdp.call("Emulation.setDeviceMetricsOverride", { width: 1280, height: 720,
+      await cdp.call("Emulation.setDeviceMetricsOverride", { ...captureSize,
         deviceScaleFactor: 1, mobile: false }, sourcePage.sessionId, Date.now() + 3_000);
     }
     host = await createPage(cdp, `${origin}/embedded-sfu-gate`, AUDIO_PROBE);
     viewer = await createPage(cdp, `${origin}/embedded-sfu-gate`, AUDIO_PROBE);
     result.stage = "authenticate";
     const room = await call<CreateRoomResponse>(host, nativeArm
-      ? `gate.startHost(${JSON.stringify({ title: SOURCE_TITLE, port: nativePort })}, ${JSON.stringify(codec)})`
-      : `gate.startHost(undefined, ${JSON.stringify(codec)}, ${displayArm})`);
+      ? `gate.startHost(${JSON.stringify({ title: SOURCE_TITLE, port: nativePort })}, ${JSON.stringify(codec)}, false, ${sizeArgument})`
+      : `gate.startHost(undefined, ${JSON.stringify(codec)}, ${displayArm}, ${sizeArgument})`);
     await until(host, (value) => value.authenticated);
     await call(viewer, `gate.startViewer(${JSON.stringify(room)})`);
     result.stage = "simulcast-first-frame";
@@ -247,12 +250,12 @@ async function main(): Promise<void> {
       secondHost = await createPage(cdp, `${origin}/embedded-sfu-gate`);
       secondViewer = await createPage(cdp, `${origin}/embedded-sfu-gate`, AUDIO_PROBE);
       const secondRoom = await call<CreateRoomResponse>(secondHost,
-        `gate.startHost(${JSON.stringify({ title: SOURCE_TITLE, port: nativePort })}, ${JSON.stringify(codec)})`);
+        `gate.startHost(${JSON.stringify({ title: SOURCE_TITLE, port: nativePort })}, ${JSON.stringify(codec)}, false, ${sizeArgument})`);
       if (secondRoom.roomId === room.roomId) throw new Error("Native sessions did not create independent rooms");
       await until(secondHost, (value) => value.authenticated);
       await call(secondViewer, `gate.startViewer(${JSON.stringify(secondRoom)})`);
       await until(secondViewer, (value) => value.committed && value.audioKbps > 0);
-      await call(secondViewer, "gate.waitForFrames(1280, 720, 15, true)");
+      await call(secondViewer, `gate.waitForFrames(${captureSize.width}, ${captureSize.height}, 15, true)`);
       await waitForSample(() => call<number>(secondViewer!, "gate.audioEnergy()", 3_000),
         (energy) => { result.secondRoom!.audioBefore = energy; return energy > 0; }, 5_000);
       const second = await call<Snapshot>(secondHost, "gate.snapshot()");
@@ -267,7 +270,7 @@ async function main(): Promise<void> {
       : null;
     const sourceBefore = await sourceSample();
     try {
-      result.high = await call(viewer, nativeArm ? "gate.waitForFrames(1280, 720, 300, true)" : "gate.waitForFrames(1280, 720)", nativeArm ? 32_000 : 25_000);
+      result.high = await call(viewer, `gate.waitForFrames(${captureSize.width}, ${captureSize.height}, ${nativeArm ? "300, true" : "15"})`, nativeArm ? 32_000 : 25_000);
     } finally {
       const sourceAfter = await sourceSample().catch(() => null);
       if (sourceBefore && sourceAfter) result.sourceDrawing = {
@@ -300,26 +303,28 @@ async function main(): Promise<void> {
         throw new Error("Gate must capture a separate real tab with the Host hidden");
       }
       const hiddenStart = Date.now();
-      const hidden = await call<{ frames: number }>(viewer, "gate.waitForFrames(1280, 720, 150)", 32_000);
+      const fullSize = `${result.high!.width}, ${result.high!.height}`;
+      const hidden = await call<{ frames: number }>(viewer, `gate.waitForFrames(${fullSize}, 150)`, 32_000);
       result.displayLifecycle = { hiddenFrames: hidden.frames, hiddenElapsedMs: Date.now() - hiddenStart,
         lowLayerDecoded: false, resumed: false, replaced: false };
       result.mediaDiagnostics = await Promise.all([host, viewer].map(page =>
         evaluate(cdp!, page, "window.__piikGateMediaStats()", Date.now() + 3_000)));
       result.stage = "display-layer-demand";
       await call(host, "gate.demandLayers(1)");
-      await call(viewer, "gate.waitForFrames(640, 360)");
+      const half = fittedCaptureSize(result.high!, result.high!.width / 2, result.high!.height / 2);
+      await call(viewer, `gate.waitForFrames(${half.width}, ${half.height}, 15, false, 2)`);
       result.displayLifecycle.lowLayerDecoded = true;
       await call(host, "gate.demandLayers(2)");
-      await call(viewer, "gate.waitForFrames(1280, 720)");
+      await call(viewer, `gate.waitForFrames(${fullSize})`);
       result.stage = "display-pause-resume";
       await call(host, "gate.pause(true)");
       await new Promise(resolve => setTimeout(resolve, 500));
       await call(host, "gate.pause(false)");
-      await call(viewer, "gate.waitForFrames(1280, 720)");
+      await call(viewer, `gate.waitForFrames(${fullSize})`);
       result.displayLifecycle.resumed = true;
       result.stage = "display-source-replacement";
       if (!await call<boolean>(host, "gate.replaceSource()")) throw new Error("Display source replacement failed");
-      await call(viewer, "gate.waitForFrames(1280, 720)");
+      await call(viewer, `gate.waitForFrames(${fullSize})`);
       result.displayLifecycle.replaced = true;
     }
     result.stage = "live-profile";
@@ -327,8 +332,8 @@ async function main(): Promise<void> {
       result.host = await call(host, "gate.snapshot()");
       throw new Error("Live profile update failed");
     }
-    const lowSize = nativeArm ? fittedCaptureSize(result.high!, 854, 480) : { width: 854, height: 480 };
-    result.low = await call(viewer, `gate.waitForFrames(${lowSize.width}, ${lowSize.height}, 15, false, ${nativeArm ? 2 : 0})`);
+    const lowSize = fittedCaptureSize(result.high!, 854, 480);
+    result.low = await call(viewer, `gate.waitForFrames(${lowSize.width}, ${lowSize.height}, 15, false, 2)`);
     await waitForSample(() => call<number>(viewer!, "gate.audioEnergy()", 3_000),
       (energy) => { result.audioEnergy.low = energy; return energy > result.audioEnergy.high; }, 5_000);
     result.stage = "viewer-media-reload";
diff --git a/scripts/embedded-sfu-page.ts b/scripts/embedded-sfu-page.ts
index 13659cded..577878715 100644
--- a/scripts/embedded-sfu-page.ts
+++ b/scripts/embedded-sfu-page.ts
@@ -16,12 +16,12 @@ import { NativeSfuPublisher } from "../src/client/native/native-sfu-publisher";
 import { defaultNativeCapturePath } from "../src/client/native/capture-selection";
 import { HostSfuRoute, type HostPublisherTransport } from "../src/client/media/host-sfu-route";
 import { ViewerSfuRoute } from "../src/client/media/viewer-sfu-route";
+import { fittedCaptureSize } from "./media-gate-geometry";
 
 const high: QualitySettings = {
   resolution: { width: 1280, height: 720 }, maxFramerate: 15, maxBitrate: 2_000_000,
   degradationPreference: "maintain-resolution", maxAudioBitrate: 64000,
 };
-const low: QualitySettings = { ...high, resolution: { width: 854, height: 480 } };
 const shareGeneration = crypto.randomUUID();
 const clientId = crypto.randomUUID();
 let socket: WebSocket | null = null;
@@ -193,12 +193,13 @@ async function connect(room: CreateRoomResponse, host: boolean): Promise<void> {
     roomId: room.roomId, clientId } as const;
   send(host
     ? { ...common, role: "host", token: room.hostToken, shareGeneration,
-        qualitySettings: high, routePolicy: { peerOnly: false, topologyOptimization: false, natPrediction: false } }
+        qualitySettings: profile, routePolicy: { peerOnly: false, topologyOptimization: false, natPrediction: false } }
     : { ...common, role: "viewer", viewerGrant: new URLSearchParams(new URL(room.inviteUrl).hash.slice(1)).get("v")! });
 }
 
-export async function startHost(nativeSource?: { title: string; port: number }, selectedCodec: "vp8" | "h264" = "vp8", display = false): Promise<CreateRoomResponse> {
+export async function startHost(nativeSource?: { title: string; port: number }, selectedCodec: "vp8" | "h264" = "vp8", display = false, size?: QualitySettings["resolution"]): Promise<CreateRoomResponse> {
   codec = selectedCodec;
+  profile = size ? { ...high, resolution: size, maxFramerate: 30, maxBitrate: 8_000_000 } : high;
   const response = await fetch("/api/rooms", {
     method: "POST", headers: { "Content-Type": "application/json" },
     body: JSON.stringify({ codeEntryPolicy: "private" }),
@@ -215,7 +216,7 @@ export async function startHost(nativeSource?: { title: string; port: number },
       if (!stopping && event.type === "share-ended" && event.shareId === shareGeneration) failed("Native capture ended");
     });
     const started = await native.startShare({ shareId: shareGeneration, source: target,
-      codec, audio: true, profile: high, edgeCapacity: 2, ...path });
+      codec, audio: true, profile, edgeCapacity: 2, ...path });
     nativeShareStarted = true;
     source = new MediaStream();
     if (started.codec !== codec || !started.audio) throw new Error("Requested Native codec and Opus capture did not start");
@@ -223,8 +224,8 @@ export async function startHost(nativeSource?: { title: string; port: number },
     return room;
   }
   canvas = document.createElement("canvas");
-  canvas.width = 1280;
-  canvas.height = 720;
+  canvas.width = profile.resolution.width;
+  canvas.height = profile.resolution.height;
   canvas.style.cssText = "max-width:100%;width:640px";
   document.body.append(canvas);
   const context = canvas.getContext("2d")!;
@@ -237,10 +238,10 @@ export async function startHost(nativeSource?: { title: string; port: number },
     context.fillStyle = "#ffffff";
     context.font = "48px sans-serif";
     context.fillText(String(frame), 40, 240);
-  }, 1000 / 15);
+  }, 1000 / profile.maxFramerate);
   source = display ? await navigator.mediaDevices.getDisplayMedia({
-    video: { width: 1280, height: 720, frameRate: 15 }, audio: false,
-  }) : canvas.captureStream(15);
+    video: { ...profile.resolution, frameRate: profile.maxFramerate }, audio: false,
+  }) : canvas.captureStream(profile.maxFramerate);
   audio = new AudioContext();
   const gain = audio.createGain();
   gain.gain.value = 0.05;
@@ -377,11 +378,13 @@ export async function waitForFrames(width: number, height: number, minimumFrames
 
 export async function lowerProfile(): Promise<boolean> {
   if (!publisher) throw new Error("Publisher is unavailable");
+  const low = { ...profile, resolution: { width: 854, height: 480 } };
   if (native) await native.updateShare(shareGeneration, low);
   else {
     if (!canvas) throw new Error("Browser source is unavailable");
-    canvas.width = 854;
-    canvas.height = 480;
+    const size = fittedCaptureSize(canvas, low.resolution.width, low.resolution.height);
+    canvas.width = size.width;
+    canvas.height = size.height;
   }
   profile = low;
   send({ type: "set-quality-settings", qualitySettings: low });

From b9771b5e6a86cef54a3fadda60d1a54c9ae0f7ca Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 19:27:30 +0800
Subject: [PATCH 078/262] docs(transport): record bounded address-handoff
 evidence

---
 docs/research/nat-traversal.md | 21 +++++++++++++++++++++
 docs/todo.md                   |  3 +++
 2 files changed, 24 insertions(+)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 7a0cba49f..c8caaee01 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -635,6 +635,27 @@ reachable class. The control makes no explicit rediscovery call; its passing
 result validates the measurement and available-media baseline, not universal
 direct recovery. It does not run Piik's complete reconnect schedule.
 
+An actual local-address-change control on 2026-10-09 replaces one endpoint's
+IPv4 address, default route and public UDP mapping, allowing upstream network
+monitoring to react. Discovery stays available, without an explicit endpoint
+update or diagnostic Ping. With Piik's unchanged Viewer recovery owner and
+Trickle exchange, three repetitions per direction preserve Tailcat's same media
+session: direct delivery returns in 1.25–6.40 seconds with no owner restart.
+Both default inner checks and the isolated 64-check candidate pass this control.
+The ordinary Pion comparison requests one ICE restart and returns direct media
+in 9.14–9.24 seconds. Relay accounting separates first available media from
+direct delivery; another two seconds of fresh SRTP after DERP closes confirms it.
+
+The actual Native Engine's wildcard UDP socket is a separate baseline: both
+directions stop delivering after the address change without new SDP, and fresh
+Native discovery restores local playback on that same changed network. This
+avoids attributing only Pion's default per-interface socket behavior to Piik.
+These controls establish a bounded address-handoff benefit, not an additional
+initial NAT-reachability class, physical Wi-Fi roaming or complete App/decoder
+acceptance. They do not resolve the gateway-only or prolonged-outage controls
+above. Supported dependencies, room grants and representative network evidence
+remain prerequisites for product adoption.
+
 Dual-stack namespace controls enabled STUN and alternately blocked IPv4 UDP or
 IPv6 forwarding. Both stacks used the working family; Tailcat's direct proof
 required fresh bidirectional delivery after DERP closed. One side reporting a
diff --git a/docs/todo.md b/docs/todo.md
index 0f6545e13..e06200658 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -69,6 +69,9 @@ Implementation needs a concrete useful result within the product model.
   [matched comparisons](./research/nat-traversal.md#integration-cost-and-recovery-controls)
   have not established improved direct reachability. Seek a repeatable benefit
   before accepting room-scoped peer keys, flow admission and relay operation.
+  Isolated local-address changes now preserve the same session under the actual
+  Viewer recovery owner. Verify that bounded benefit through the complete App
+  pipeline and physical networks; it does not establish another reachable NAT class.
   Product adoption still needs supported
   [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary)
   and RTCP/MTU boundaries, retained-flow recovery beyond the passing serial

From bef002ed556a50a257acaf74ab595f73ee998cf3 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 20:02:37 +0800
Subject: [PATCH 079/262] fix(media): preserve camera framing across quality
 controls

---
 docs/research/native-client-media.md | 23 ++++++++++++++++++++---
 docs/standards/media-quality.md      |  8 ++++++--
 docs/todo.md                         |  6 +++---
 src/client/media/camera-previews.ts  |  8 +++-----
 src/client/media/capture-devices.ts  | 11 +++++++++++
 src/client/media/quality.ts          | 14 ++++++--------
 tests/camera-previews.test.ts        |  1 +
 tests/host-audio.test.ts             |  2 ++
 tests/host-peer-tracks.test.ts       |  4 ++--
 tests/quality.test.ts                | 13 +++++++------
 tests/sender-video-track.test.ts     |  2 +-
 11 files changed, 62 insertions(+), 30 deletions(-)

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 8c4621c9b..2969d94af 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -640,9 +640,26 @@ reduction, numeric audio updates, subscription/page recovery and retirement.
 The tab control also passed background capture, lower-layer demand, pause/resume
 and source replacement. A separate full-UI 2160x3840 control passed SFU-to-P2P
 commit and failed-P2P-to-SFU recovery through the room controller, keeping the
-old SFU picture during peer preparation. These checks use loopback and synthetic
-content; they do not establish physical 4K capture, every mixed Native/Browser
-handoff or cross-network performance.
+old SFU picture during peer preparation. The mixed Browser Host/Native Viewer
+control also passed those transitions. With clarity priority, its live
+2160x3840-to-360x640 edit retained the Native connection and playback track;
+SFU recovery retained that size and then restored 2160x3840. Firefox 155 received
+the same VP8 sizes from Chrome, retaining its track through both edits. All
+controls retired their receiving connections on stop. Balanced priority may
+deliver smaller adapted pictures. These local checks do not establish physical
+4K capture, every mixed handoff or cross-network performance.
+
+Chrome 154 camera controls exposed a separate constraint bug: lowering a
+540x960 input to the 1280x720 ceiling produced a cropped 540x720 picture when
+both axes also carried `ideal` values. Maximum-only constraints produced
+405x720, retained portrait shape through a subsequent 360x640 setting, and
+restored 540x960. Camera startup and picker requests could likewise crop to their
+ideal axes; they now share an uncropped device-format request (`resizeMode:
+{ exact: "none" }`). Portrait thumbnails then measured 180x320 instead of 320x180.
+A landscape control retained shape within rounding. Shared live constraints use
+ceilings without a fixed aspect ratio or rotation listener, following the Media
+Capture distinction below. Synthetic devices do not establish physical phone
+orientation behavior.
 
 The proposed boundary follows the
 [Media Capture specification](https://www.w3.org/TR/mediacapture-streams/#constrainable-interface):
diff --git a/docs/standards/media-quality.md b/docs/standards/media-quality.md
index 7b0b3300b..8a2eba030 100644
--- a/docs/standards/media-quality.md
+++ b/docs/standards/media-quality.md
@@ -18,7 +18,9 @@ contract. [Status](../status.md) indexes delivery and remaining acceptance.
   latter uses one supported native codec path and never infers a target from
   a title. An ordinary Web Host does not probe localhost.
 - Camera is a peer source choice in the same picker, including on phones. Only
-  the chosen source requests permission. Browser/camera Host microphone capture
+  the chosen source requests permission. Camera input and thumbnails request
+  an uncropped device format; sender constraints own later scaling.
+  Browser/camera Host microphone capture
   is explicit and defaults to Browser voice processing, separately from screen audio.
   The Host may turn that processing off for music or virtual audio inputs;
   the input change preserves the existing mixed output and leaves the previous
@@ -81,7 +83,9 @@ contract. [Status](../status.md) indexes delivery and remaining acceptance.
   not intentionally stop capture, encoding, or upload.
 - Live quality changes update the current capture and Host sender-track
   constraints plus sender ceilings without reopening source selection or
-  replacing a healthy route.
+  replacing a healthy route. Shared Browser capture constraints express size
+  ceilings, not ideal dimensions or a fixed aspect ratio: lowering a ceiling
+  must not request a crop, and source orientation remains Browser-owned.
 - Native quality changes use the same room settings. The App prepares a new
   platform capture/encoder generation, then replaces the old generation behind
   the same encoded source and PeerConnections; audio-only changes update the
diff --git a/docs/todo.md b/docs/todo.md
index e06200658..210f0a86b 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -48,9 +48,9 @@ Implementation needs a concrete useful result within the product model.
   [media assessment](./research/native-client-media.md#media-capability-extension-assessment):
   separate UI presets, numeric requests, bounded implementation capabilities and
   actual output. Numeric audio and video controls are implemented; the assessment
-  owns local capture, codec, derived-output and SFU evidence. Next verify
-  mixed Native/Browser route changes, limited receivers and cross-browser/camera
-  orientation behavior.
+  owns local capture, codec, derived-output, SFU and bounded mixed-route evidence.
+  Extend Browser interoperability and mixed-topology checks to limited receivers
+  and physical camera orientation behavior.
   Browser display capture, Browser relay and Browser-to-Native fanout now have
   bounded high-resolution evidence. macOS geometry and physical 4K/game capture
   remain open. Preserve safety
diff --git a/src/client/media/camera-previews.ts b/src/client/media/camera-previews.ts
index fd2804cfc..cceb177cd 100644
--- a/src/client/media/camera-previews.ts
+++ b/src/client/media/camera-previews.ts
@@ -1,4 +1,4 @@
-import { browserCameras, type CaptureDevice } from "./capture-devices";
+import { browserCameras, cameraCaptureConstraints, type CaptureDevice } from "./capture-devices";
 
 export type CameraPreview = CaptureDevice & { preview: string | null };
 
@@ -47,10 +47,8 @@ export async function loadCameraPreviews(signal: AbortSignal,
   const release = () => { owned?.getTracks().forEach(track => track.stop()); owned = null; };
   const open = async (id: string) => {
     signal.throwIfAborted();
-    owned = await navigator.mediaDevices.getUserMedia({ audio: false, video: {
-      ...(id ? { deviceId: { exact: id } } : { facingMode: { ideal: "environment" } }),
-      width: { ideal: 320 }, height: { ideal: 180 }, frameRate: { ideal: 15, max: 15 },
-    } });
+    owned = await navigator.mediaDevices.getUserMedia({ audio: false,
+      video: cameraCaptureConstraints({ width: 320, height: 180 }, 15, id) });
     // A permission promise can settle after the picker has closed.
     if (signal.aborted) { release(); signal.throwIfAborted(); }
     return owned;
diff --git a/src/client/media/capture-devices.ts b/src/client/media/capture-devices.ts
index 922ea4caf..0ec10f214 100644
--- a/src/client/media/capture-devices.ts
+++ b/src/client/media/capture-devices.ts
@@ -1,5 +1,16 @@
 export type CaptureDevice = { id: string; label: string };
 
+/** Choose a camera format without cropping; sender constraints own later scaling. */
+export function cameraCaptureConstraints(size: { width: number; height: number },
+  maxFramerate: number, deviceId = ""): MediaTrackConstraints & { resizeMode: ConstrainDOMString } {
+  return {
+    ...(deviceId ? { deviceId: { exact: deviceId } } : { facingMode: { ideal: "environment" } }),
+    resizeMode: { exact: "none" },
+    width: { ideal: size.width }, height: { ideal: size.height },
+    frameRate: { ideal: maxFramerate, max: maxFramerate },
+  };
+}
+
 // Enumeration never requests permission or opens a device. Device IDs remain
 // local; the capture owner applies an explicit choice when permission is given.
 export async function browserCaptureDevices(kind: "audioinput" | "videoinput"): Promise<CaptureDevice[]> {
diff --git a/src/client/media/quality.ts b/src/client/media/quality.ts
index 6f521c751..6482c1840 100644
--- a/src/client/media/quality.ts
+++ b/src/client/media/quality.ts
@@ -12,6 +12,7 @@ import { displayMediaOptions } from "./audio-capture";
 import { browserDebugEnabled, debugOperation } from "../lib/debug";
 import { debugTrack } from "../lib/debug-webrtc";
 import { applySenderCaptureConstraints, senderCaptureTrack } from "./sender-video-track";
+import { cameraCaptureConstraints } from "./capture-devices";
 
 export type {
   DegradationPreference,
@@ -212,8 +213,9 @@ export function qualitySettingsLabel(settings: QualitySettings): string {
 function captureConstraints(profile: QualityProfile): MediaTrackConstraints {
   const resolution = profile.resolution;
   return {
-    width: { ideal: resolution.width, max: resolution.width },
-    height: { ideal: resolution.height, max: resolution.height },
+    // A ceiling must not ask the Browser to fill both axes by cropping a source.
+    width: { max: resolution.width },
+    height: { max: resolution.height },
     frameRate: {
       ideal: profile.maxFramerate,
       max: profile.maxFramerate,
@@ -259,12 +261,8 @@ export type BrowserCaptureSource = "browser" | "camera";
 
 export async function captureBrowserSource(profile: QualityProfile, source: BrowserCaptureSource, deviceId = ""): Promise<MediaStream> {
   if (source !== "camera") return captureDisplay(profile);
-  const resolution = profile.resolution;
-  const stream = await navigator.mediaDevices.getUserMedia({ audio: false, video: {
-    ...(deviceId ? { deviceId: { exact: deviceId } } : { facingMode: { ideal: "environment" } }),
-    width: { ideal: resolution.width }, height: { ideal: resolution.height },
-    frameRate: { ideal: profile.maxFramerate, max: profile.maxFramerate },
-  } });
+  const stream = await navigator.mediaDevices.getUserMedia({ audio: false,
+    video: cameraCaptureConstraints(profile.resolution, profile.maxFramerate, deviceId) });
   const track = stream.getVideoTracks()[0];
   if (!track || track.readyState === "ended") {
     stream.getTracks().forEach((track) => track.stop());
diff --git a/tests/camera-previews.test.ts b/tests/camera-previews.test.ts
index b2019ab4f..b4d68441a 100644
--- a/tests/camera-previews.test.ts
+++ b/tests/camera-previews.test.ts
@@ -14,6 +14,7 @@ function setup({ permission = true, frames = true } = {}) {
   };
   const getUserMedia = vi.fn(async (options: MediaStreamConstraints) => {
     expect(options.audio).toBe(false);
+    expect(options.video).toHaveProperty("resizeMode", { exact: "none" });
     expect(tracks.filter(track => track.readyState === "live")).toHaveLength(0);
     permission = true;
     const id = (options.video as MediaTrackConstraints).deviceId as ConstrainDOMStringParameters | undefined;
diff --git a/tests/host-audio.test.ts b/tests/host-audio.test.ts
index 1daacc9bd..4112bdeed 100644
--- a/tests/host-audio.test.ts
+++ b/tests/host-audio.test.ts
@@ -52,6 +52,7 @@ test("camera is a bounded video source and never implicitly requests a microphon
   getUserMedia.mockResolvedValue(source);
   expect(await captureBrowserSource(QUALITY_PROFILES["1080p30"], "camera")).toBe(source);
   expect(getUserMedia).toHaveBeenCalledWith({ audio: false, video: {
+    resizeMode: { exact: "none" },
     facingMode: { ideal: "environment" }, width: { ideal: 1920 }, height: { ideal: 1080 },
     frameRate: { ideal: 30, max: 30 },
   } });
@@ -187,6 +188,7 @@ test("camera selection requests one exact device without microphone permission",
   getUserMedia.mockResolvedValue(media(new Track("video")));
   await captureBrowserSource(QUALITY_PROFILES["1080p30"], "camera", "front-camera");
   expect(getUserMedia).toHaveBeenCalledWith({ audio: false, video: expect.objectContaining({ deviceId: { exact: "front-camera" } }) });
+  expect(getUserMedia.mock.calls[0][0].video).toHaveProperty("resizeMode", { exact: "none" });
   expect(getUserMedia.mock.calls[0][0].video).not.toHaveProperty("facingMode");
 });
 
diff --git a/tests/host-peer-tracks.test.ts b/tests/host-peer-tracks.test.ts
index 0d367ace6..f1f070b73 100644
--- a/tests/host-peer-tracks.test.ts
+++ b/tests/host-peer-tracks.test.ts
@@ -1140,8 +1140,8 @@ describe("HostPeer source replacement", () => {
       peer.updateCaptureProfile(QUALITY_PROFILES["1080p60"]),
     ).resolves.toBe(true);
     expect(senderVideo.applyConstraints).toHaveBeenLastCalledWith({
-      width: { ideal: 1920, max: 1920 },
-      height: { ideal: 1080, max: 1080 },
+      width: { max: 1920 },
+      height: { max: 1080 },
       frameRate: { ideal: 60, max: 60 },
     });
     expect(sourceVideo.applyConstraints).not.toHaveBeenCalled();
diff --git a/tests/quality.test.ts b/tests/quality.test.ts
index a65ab7b37..b08fb7dd5 100644
--- a/tests/quality.test.ts
+++ b/tests/quality.test.ts
@@ -105,8 +105,8 @@ describe("realtime quality controls", () => {
 
     expect(getDisplayMedia).toHaveBeenCalledWith({
       video: {
-        width: { ideal: 1920, max: 1920 },
-        height: { ideal: 1080, max: 1080 },
+        width: { max: 1920 },
+        height: { max: 1080 },
         frameRate: { ideal: 30, max: 30 },
       },
       audio: {
@@ -123,19 +123,20 @@ describe("realtime quality controls", () => {
     expect(audioTrack.contentHint).toBe("music");
   });
 
-  it("changes custom capture ceilings without selecting the source again", async () => {
+  it("changes capture ceilings without requesting a crop or locking source orientation", async () => {
     const { stream, videoTrack } = createVideoStream();
+    videoTrack.getSettings = () => ({ width: 540, height: 960, aspectRatio: 9 / 16 });
 
     await applyCaptureProfile(stream, {
-      resolution: { width: 1920, height: 1200 },
+      resolution: { width: 1280, height: 720 },
       maxFramerate: 45,
       maxBitrate: 9_500_000,
       degradationPreference: "balanced",
     });
 
     expect(videoTrack.applyConstraints).toHaveBeenCalledWith({
-      width: { ideal: 1920, max: 1920 },
-      height: { ideal: 1200, max: 1200 },
+      width: { max: 1280 },
+      height: { max: 720 },
       frameRate: { ideal: 45, max: 45 },
     });
   });
diff --git a/tests/sender-video-track.test.ts b/tests/sender-video-track.test.ts
index 0fa005d97..6c60e7c53 100644
--- a/tests/sender-video-track.test.ts
+++ b/tests/sender-video-track.test.ts
@@ -79,7 +79,7 @@ describe("sender display-frame ownership", () => {
     expect(p.write).toHaveBeenCalledWith(frame);
     expect(frame.close).toHaveBeenCalledOnce();
     await applyVideoCaptureProfile(track, QUALITY_PROFILES["720p30"]);
-    expect(input.applyConstraints).toHaveBeenCalledWith(expect.objectContaining({ width: { ideal: 1280, max: 1280 } }));
+    expect(input.applyConstraints).toHaveBeenCalledWith(expect.objectContaining({ width: { max: 1280 } }));
     expect(input.applyConstraints).toHaveBeenLastCalledWith(expect.objectContaining({ frameRate: { min: 1, ideal: 30, max: 30 } }));
     expect((track as unknown as Track).applyConstraints).not.toHaveBeenCalled();
 

From 2f111daa9d88c36e96580e0829a85644461fe760 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 20:37:50 +0800
Subject: [PATCH 080/262] docs(research): record Native tunnel continuity
 limits

---
 docs/research/nat-traversal.md | 22 ++++++++++++++++++++++
 docs/todo.md                   |  3 +++
 2 files changed, 25 insertions(+)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index c8caaee01..805c25e41 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -656,6 +656,28 @@ acceptance. They do not resolve the gateway-only or prolonged-outage controls
 above. Supported dependencies, room grants and representative network evidence
 remain prerequisites for product adoption.
 
+The 2026-10-09 remote-socket overlay extends that comparison through the actual
+Native encoded source, sender, receiver and ordinary local playback. It leaves
+product files untouched and admits one fixture peer flow per engine. Unchanged
+ordinary/Tailcat controls pass, and both handoff directions can retain media
+after DERP closure. Stronger fresh-content checks expose a limit: two of three
+sender-handoff repetitions pause output for roughly two seconds while ICE stays
+connected; one remains paused at the fifteen-second observation boundary.
+The outgoing frame counter also stops as the sender estimate falls to about
+20 kbps. This locates those gaps at forwarding/adaptation, rather than proving
+that the underlay lost the connection.
+
+The fixed 8×8 input deliberately has no live rate-controllable encoder. Declaring
+it rate-controlled removes the later forwarding pauses in three repetitions,
+but all three still miss the strict first fresh-content window and later deliver
+about 34–37 frames per second instead of the requested 50. This is an ablation,
+not a valid capture implementation or a proposed product switch. Actual Native
+capture already declares its live lowest output controllable and applies codec
+budgets; raw forwarding retains the framework's pause policy. Full App acceptance
+must include that encoder owner, local Browser decode and recovery, and useful
+picture continuity. A preserved ICE session alone does not establish a net
+handoff benefit. No production adaptation rule or timeout changed.
+
 Dual-stack namespace controls enabled STUN and alternately blocked IPv4 UDP or
 IPv6 forwarding. Both stacks used the working family; Tailcat's direct proof
 required fresh bidirectional delivery after DERP closed. One side reporting a
diff --git a/docs/todo.md b/docs/todo.md
index 210f0a86b..b8a620a31 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -72,6 +72,9 @@ Implementation needs a concrete useful result within the product model.
   Isolated local-address changes now preserve the same session under the actual
   Viewer recovery owner. Verify that bounded benefit through the complete App
   pipeline and physical networks; it does not establish another reachable NAT class.
+  The actual Native media overlay can retain the transport but its fixed-input
+  continuity controls expose forwarding pauses. Include the live encoder and
+  decoded picture continuity; do not treat the rate-control ablation as a fix.
   Product adoption still needs supported
   [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary)
   and RTCP/MTU boundaries, retained-flow recovery beyond the passing serial

From 31f8297a1d32972e04a87e80dd4653e0edf8e313 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 22:22:05 +0800
Subject: [PATCH 081/262] fix(media): serialize forwarding probe padding once

---
 internal/media/forwarding/transport.go      | 15 +++++++++++++++
 internal/media/forwarding/transport_test.go | 20 ++++++++++++++++++++
 2 files changed, 35 insertions(+)

diff --git a/internal/media/forwarding/transport.go b/internal/media/forwarding/transport.go
index af7d71ead..0ab8a5474 100644
--- a/internal/media/forwarding/transport.go
+++ b/internal/media/forwarding/transport.go
@@ -636,6 +636,9 @@ func (ticket *pacedPacket) WriteRTP(*rtp.Header, []byte) (int, error) {
 	if packet == nil {
 		return 0, io.ErrClosedPipe
 	}
+	if packet.Header.Padding {
+		packet.WriteStream = pionPaddingWriter{packet.WriteStream}
+	}
 	written, err := queue.sender.SendPacket(packet)
 	if err == nil && written > 0 {
 		queue.packets.Add(1)
@@ -647,6 +650,18 @@ func (ticket *pacedPacket) WriteRTP(*rtp.Header, []byte) (int, error) {
 
 func (*pacedPacket) Write([]byte) (int, error) { return 0, io.ErrClosedPipe }
 
+// LiveKit's padding payload already includes its trailing padding bytes. Keep
+// that size for pacing/BWE, but let Pion serialize the padding exactly once.
+type pionPaddingWriter struct{ webrtc.TrackLocalWriter }
+
+func (writer pionPaddingWriter) WriteRTP(header *rtp.Header, payload []byte) (int, error) {
+	padding := int(header.PaddingSize)
+	if padding == 0 || padding > len(payload) {
+		return 0, errors.New("invalid forwarding padding")
+	}
+	return writer.TrackLocalWriter.WriteRTP(header, payload[:len(payload)-padding])
+}
+
 type closedPacketWriter struct{}
 
 func (closedPacketWriter) WriteRTP(*rtp.Header, []byte) (int, error) { return 0, io.ErrClosedPipe }
diff --git a/internal/media/forwarding/transport_test.go b/internal/media/forwarding/transport_test.go
index 2cb4eda68..59d7bda08 100644
--- a/internal/media/forwarding/transport_test.go
+++ b/internal/media/forwarding/transport_test.go
@@ -92,6 +92,7 @@ func TestTransportVideoFeedbackAudioAndClose(t *testing.T) {
 	defer receiver.Close()
 	var videoPackets, audioPackets atomic.Uint32
 	firstVideo := make(chan *rtp.Packet, 1)
+	paddingPackets := make(chan *rtp.Packet, 8)
 	var recoveryTimestamp atomic.Uint32
 	recovered := make(chan struct{}, 1)
 	var readers sync.WaitGroup
@@ -103,6 +104,12 @@ func TestTransportVideoFeedbackAudioAndClose(t *testing.T) {
 			if readErr != nil {
 				return
 			}
+			if packet.Padding {
+				select {
+				case paddingPackets <- packet:
+				default:
+				}
+			}
 			if len(packet.Payload) == 0 {
 				continue
 			}
@@ -244,6 +251,19 @@ func TestTransportVideoFeedbackAudioAndClose(t *testing.T) {
 	if ready || transport.prober.IsRunning() {
 		t.Fatal("transport probed before a receiver report")
 	}
+	// Exercise the library's real padding packet through Pion SRTP. Probe bytes
+	// must be stripped by RTP decoding, not exposed to the video decoder as media.
+	if transport.Output.WritePaddingRTP(255, true, false) == 0 {
+		t.Fatal("padding fixture did not emit a probe")
+	}
+	select {
+	case packet := <-paddingPackets:
+		if len(packet.Payload) != 0 || packet.Header.PaddingSize == 0 {
+			t.Fatalf("padding reached the receiver as video: payload=%d padding=%d", len(packet.Payload), packet.Header.PaddingSize)
+		}
+	case <-ctx.Done():
+		t.Fatal("padding packet did not arrive")
+	}
 	// A muted library sender returns zero padding bytes despite a connected PC
 	// and valid RR. Its probe must finish, and inconclusive feedback must not
 	// promote the BWE's internal initial-capacity sentinel into a codec budget.

From 420e1ff18e9d8a453c9f8961e3dae43a8e4b0707 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 22:36:03 +0800
Subject: [PATCH 082/262] test(media): keep one receiver feedback owner

---
 internal/app/mediaedge/edge_test.go                  | 3 ---
 internal/app/mediaedge/relay_network_fixture_test.go | 1 -
 internal/media/forwarding/publication_test.go        | 1 -
 internal/media/forwarding/recovery_test.go           | 1 -
 internal/media/forwarding/transport_test.go          | 1 -
 5 files changed, 7 deletions(-)

diff --git a/internal/app/mediaedge/edge_test.go b/internal/app/mediaedge/edge_test.go
index ac65c02b6..cc2424052 100644
--- a/internal/app/mediaedge/edge_test.go
+++ b/internal/app/mediaedge/edge_test.go
@@ -826,9 +826,6 @@ func newReceiverWithAudio(t *testing.T, includeAudio bool, bindAddress string) *
 		}
 	}
 	registry := &interceptor.Registry{}
-	if err := webrtc.ConfigureTWCCSender(mediaEngine, registry); err != nil {
-		t.Fatal(err)
-	}
 	if err := webrtc.RegisterDefaultInterceptors(mediaEngine, registry); err != nil {
 		t.Fatal(err)
 	}
diff --git a/internal/app/mediaedge/relay_network_fixture_test.go b/internal/app/mediaedge/relay_network_fixture_test.go
index a0e82c72f..ea8c1d550 100644
--- a/internal/app/mediaedge/relay_network_fixture_test.go
+++ b/internal/app/mediaedge/relay_network_fixture_test.go
@@ -124,7 +124,6 @@ func TestRelayNetworkVP8Fixture(t *testing.T) {
 		check(media.RegisterDefaultCodecs())
 		registry := &interceptor.Registry{}
 		check(webrtc.RegisterDefaultInterceptors(media, registry))
-		check(webrtc.ConfigureTWCCSender(media, registry))
 		receiver, createErr := webrtc.NewAPI(webrtc.WithMediaEngine(media), webrtc.WithInterceptorRegistry(registry),
 			webrtc.WithSettingEngine(settings)).NewPeerConnection(webrtc.Configuration{})
 		check(createErr)
diff --git a/internal/media/forwarding/publication_test.go b/internal/media/forwarding/publication_test.go
index 79ce6287d..2d5c221c2 100644
--- a/internal/media/forwarding/publication_test.go
+++ b/internal/media/forwarding/publication_test.go
@@ -105,7 +105,6 @@ func TestPublicationSimulcastReuseAudioDemandAndClose(t *testing.T) {
 	check(mediaEngine.RegisterHeaderExtension(webrtc.RTPHeaderExtensionCapability{URI: "urn:ietf:params:rtp-hdrext:sdes:mid"}, webrtc.RTPCodecTypeVideo))
 	registry := &interceptor.Registry{}
 	check(webrtc.RegisterDefaultInterceptors(mediaEngine, registry))
-	check(webrtc.ConfigureTWCCSender(mediaEngine, registry))
 	receiver, err := webrtc.NewAPI(webrtc.WithMediaEngine(mediaEngine), webrtc.WithInterceptorRegistry(registry), webrtc.WithSettingEngine(settings)).NewPeerConnection(webrtc.Configuration{})
 	check(err)
 	defer receiver.Close()
diff --git a/internal/media/forwarding/recovery_test.go b/internal/media/forwarding/recovery_test.go
index 7102f4e90..b9d764467 100644
--- a/internal/media/forwarding/recovery_test.go
+++ b/internal/media/forwarding/recovery_test.go
@@ -70,7 +70,6 @@ func TestTransportConstrainedDormantRecovery(t *testing.T) {
 	check(media.RegisterDefaultCodecs())
 	registry := &interceptor.Registry{}
 	check(webrtc.RegisterDefaultInterceptors(media, registry))
-	check(webrtc.ConfigureTWCCSender(media, registry))
 	receiver, err := webrtc.NewAPI(webrtc.WithMediaEngine(media), webrtc.WithInterceptorRegistry(registry),
 		webrtc.WithSettingEngine(receiveSettings)).NewPeerConnection(webrtc.Configuration{})
 	check(err)
diff --git a/internal/media/forwarding/transport_test.go b/internal/media/forwarding/transport_test.go
index 59d7bda08..b65e44fc5 100644
--- a/internal/media/forwarding/transport_test.go
+++ b/internal/media/forwarding/transport_test.go
@@ -83,7 +83,6 @@ func TestTransportVideoFeedbackAudioAndClose(t *testing.T) {
 	check(mediaEngine.RegisterDefaultCodecs())
 	registry := &interceptor.Registry{}
 	check(webrtc.RegisterDefaultInterceptors(mediaEngine, registry))
-	check(webrtc.ConfigureTWCCSender(mediaEngine, registry))
 	reports := &receiverReportGate{}
 	registry.Add(reports)
 	receiver, err := webrtc.NewAPI(webrtc.WithMediaEngine(mediaEngine), webrtc.WithInterceptorRegistry(registry),

From 10c86a4d3f83846eb38116a2bedba2f06054771f Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 22:44:50 +0800
Subject: [PATCH 083/262] fix(media): avoid stale send queues after connection
 recovery

---
 docs/research/node-local-media-design.md      | 53 +++++++++--
 internal/media/forwarding/publication.go      | 30 +++---
 internal/media/forwarding/publication_test.go | 38 ++++++--
 internal/media/forwarding/transport.go        | 29 ++----
 internal/media/forwarding/transport_test.go   | 92 +++++++++++++++++++
 5 files changed, 190 insertions(+), 52 deletions(-)

diff --git a/docs/research/node-local-media-design.md b/docs/research/node-local-media-design.md
index 03a8d1176..3a1e4cacb 100644
--- a/docs/research/node-local-media-design.md
+++ b/docs/research/node-local-media-design.md
@@ -387,18 +387,55 @@ Keep the dependency behind a shared media package. For one video per connection,
 use the public provisional allocation primitives, with exact typed child state
 read by its parent; do not parse DebugInfo or run a second multi-track allocator.
 The candidate now uses LiveKit SendSideBWE and Prober through their public APIs.
-Pacing reuses the upstream queue with admission capped by the existing packet
-cache bound; canceled probe tickets remain charged until actually dequeued.
-The pinned Pion pacer's 1.5 headroom applies only to pacing, not codec or BWE
-budgets. Adapted probe lifecycle code retains Apache-2.0 attribution. Probe
+Packet sending uses the pinned [LiveKit transport's send-side BWE default](https://github.com/livekit/livekit/blob/v1.13.6/pkg/rtc/transport.go),
+`NoQueue`: an asynchronous writer without a second bitrate throttle on already
+encoded packets. Admission stays capped by the existing packet cache bound;
+canceled probe tickets remain charged until actually dequeued. Congestion
+estimation, probes and codec/allocation budgets retain their existing owners.
+Adapted probe lifecycle code retains Apache-2.0 attribution. Probe
 promotion requires the upstream validity criterion and non-congestion signal;
 an empty or inconclusive attempt cannot promote the estimator's initial ceiling.
 
+#### Send Queue Recovery
+
+A bounded writer-stall control exposes a limitation in the former SFU queue:
+after the estimate falls from 500 to 8 kbps, only three of 32 already-encoded
+packets drain in two seconds. The upstream unthrottled writer drains the same
+input once the writer resumes. A separate real Windows VP8 codec and
+Native forwarding control reproduces stale decoded pictures after roughly one
+second of ordinary UDP loss; the packet-count cap alone does not prevent this.
+The [Native transport experiment](./nat-traversal.md#integration-cost-and-recovery-controls)
+owns the decoded-picture and address-change boundary.
+
+Congestion callbacks could also promote the estimator's unmeasured 100 Mbps
+initial capacity while a probe was pending. Congestion now only reduces the
+committed budget; a valid completed non-congesting probe owns increases.
+Publication allocation and encoder input use that same committed capacity after
+audio reservation. This follows the
+[upstream distinction between congestion events and completed probes](https://github.com/livekit/livekit/blob/v1.13.6/pkg/sfu/streamallocator/streamallocator.go),
+without introducing another estimator.
+
+Real decode also exposed a packet-format mismatch at the shared writer:
+LiveKit 1.13.6 includes padding in its probe payload, while Pion SRTP serializes
+another block from `Header.PaddingSize`. An actual library probe therefore
+arrived with 255 bytes of apparent video payload plus 255 bytes of padding.
+The adapter now removes the already-included block only at the Pion write
+boundary; pacing and TWCC retain the intended packet size. Both publication
+and single-child forwarding use that boundary. The regression checks decoded
+RTP payload emptiness after SRTP delivery, rather than treating any received
+packet as valid video. The primary owners are
+[LiveKit probe construction](https://github.com/livekit/livekit/blob/v1.13.6/pkg/sfu/downtrack.go)
+and [Pion packet serialization](https://github.com/pion/rtp/blob/v1.10.5/packet.go).
+
 The explicit `TestTransportConstrainedDormantRecovery` virtual-network trace uses real
-Pion RTP/TWCC through 6 Mbps -> 500 kbps -> 6 Mbps shaping. It measured a minimum
-budget about 497 kbps, stopped the upper output, and restored sustained 1.20 Mbps
-after release. Recovery occurred about 4.4 seconds after release in the recorded
-run; this is a bounded local trace, not a success-rate or game-latency claim.
+Pion RTP/TWCC through 6 Mbps -> 500 kbps -> 6 Mbps shaping. Three consecutive runs
+stop the upper output under that constraint and restore sustained 1.20 Mbps after
+release. The SDK latency-aware queue passes the same three controls but requires
+an extra adapter; it is not retained. Earlier flaky comparisons registered TWCC
+twice on the receiver, duplicating feedback; those results do not rank the queues.
+Product receivers already use the single default interceptor owner.
+No reset, retry owner or minimum quality is added. These are bounded local traces,
+not a field diagnosis, success-rate or game-latency claim.
 Ordinary focused checks cover NACK repair, no-RR probe admission, zero-write
 termination and exact shutdown. Before runtime cutover, complete actual codec,
 Browser and physical recovery checks rather than inferring them from this trace.
diff --git a/internal/media/forwarding/publication.go b/internal/media/forwarding/publication.go
index fa1222f5e..4e3a5cb6e 100644
--- a/internal/media/forwarding/publication.go
+++ b/internal/media/forwarding/publication.go
@@ -67,16 +67,14 @@ func NewPublication(options TransportOptions) (_ *Publication, err error) {
 	})}
 	publication.bandwidth.target.Store(int64(options.InitialBitrate))
 	publication.pacer = &publicationPacer{headers: make(map[uint32]publicationHeaders), boundedPacer: newBoundedPacer(
-		pacer.NewLeakyBucket(log, nil, 5*time.Millisecond, options.InitialBitrate), log, options.Source.maxPackets,
-	), bandwidth: publication.bandwidth}
+		pacer.NewNoQueue(log, nil), log, options.Source.maxPackets,
+	)}
 	publication.pacer.sender = pacer.NewBase(log, publication.bandwidth)
-	publication.bandwidth.pacer = publication.pacer
 	publication.allocator = streamallocator.NewStreamAllocator(streamallocator.StreamAllocatorParams{
 		Config: streamallocator.DefaultStreamAllocatorConfig, BWE: publication.bandwidth,
 		Pacer: publication.pacer, Logger: log,
 	}, true, true)
 	publication.allocator.Start()
-	publication.pacer.SetBitrate(options.InitialBitrate)
 	media := &webrtc.MediaEngine{}
 	codec := options.Source.Codec()
 	if err = media.RegisterCodec(codec, webrtc.RTPCodecTypeVideo); err != nil {
@@ -529,7 +527,11 @@ type publicationWriter struct {
 func (writer *publicationWriter) WriteRTP(header *rtp.Header, payload []byte) (int, error) {
 	written, err := writer.TrackLocalWriter.WriteRTP(header, payload)
 	if err == nil && written > 0 {
-		writer.bytes.Add(uint64(header.MarshalSize() + len(payload)))
+		size := header.MarshalSize() + len(payload)
+		if header.Padding {
+			size += int(header.PaddingSize)
+		}
+		writer.bytes.Add(uint64(size))
 		if writer.frames != nil && writer.primary && header.Marker && len(payload) > 0 {
 			writer.frames.Add(1)
 		}
@@ -563,7 +565,6 @@ type publicationBWE struct {
 	target         atomic.Int64
 	audio          atomic.Int64
 	observed       atomic.Bool
-	pacer          *publicationPacer
 	probeMu        sync.Mutex
 	completedProbe ccutils.ProbeClusterInfo
 }
@@ -578,11 +579,12 @@ func (bandwidth *publicationBWE) SetBWEListener(listener bwe.BWEListener) {
 	bandwidth.SendSideBWE.SetBWEListener(bandwidth)
 }
 func (bandwidth *publicationBWE) OnCongestionStateChange(from, to bwe.CongestionState, capacity int64) {
-	if capacity > 0 {
+	// As for an individual Transport, only a completed non-congesting probe
+	// can raise committed capacity. All consumers use that same accepted value.
+	if to == bwe.CongestionStateCongested && capacity > 0 && capacity < bandwidth.target.Load() {
 		bandwidth.target.Store(capacity)
-		bandwidth.pacer.SetBitrate(int(capacity))
 	}
-	bandwidth.listener.OnCongestionStateChange(from, to, max(capacity-bandwidth.audio.Load(), 0))
+	bandwidth.listener.OnCongestionStateChange(from, to, max(bandwidth.target.Load()-bandwidth.audio.Load(), 0))
 }
 func (bandwidth *publicationBWE) ProbeClusterDone(info ccutils.ProbeClusterInfo) {
 	bandwidth.probeMu.Lock()
@@ -601,18 +603,15 @@ func (bandwidth *publicationBWE) ProbeClusterFinalize() (ccutils.ProbeSignal, in
 			// StreamAllocator may upgrade on Inconclusive too. Its capacity must
 			// never promote the estimator's initial sentinel after an empty probe.
 			signal = ccutils.ProbeSignalInconclusive
-			capacity = min(capacity, bandwidth.target.Load())
 		} else if signal == ccutils.ProbeSignalNotCongesting && capacity > bandwidth.target.Load() {
 			bandwidth.target.Store(capacity)
-			bandwidth.pacer.SetBitrate(int(capacity))
 		}
 	}
-	return signal, max(capacity-bandwidth.audio.Load(), 0), done
+	return signal, max(bandwidth.target.Load()-bandwidth.audio.Load(), 0), done
 }
 
 type publicationPacer struct {
 	*boundedPacer
-	bandwidth *publicationBWE
 	headersMu sync.Mutex
 	headers   map[uint32]publicationHeaders
 }
@@ -634,13 +633,8 @@ func (queue *publicationPacer) Enqueue(packet *pacer.Packet) {
 	}
 	queue.boundedPacer.Enqueue(packet)
 }
-func (queue *publicationPacer) StartProbeCluster(info ccutils.ProbeClusterInfo) {
-	queue.boundedPacer.StartProbeCluster(info)
-	queue.SetBitrate(info.Goal.DesiredBps + int(queue.bandwidth.audio.Load()))
-}
 func (queue *publicationPacer) EndProbeCluster(id ccutils.ProbeClusterId) ccutils.ProbeClusterInfo {
 	info := queue.boundedPacer.EndProbeCluster(id)
 	queue.cancelProbes(id)
-	queue.SetBitrate(int(queue.bandwidth.target.Load()))
 	return info
 }
diff --git a/internal/media/forwarding/publication_test.go b/internal/media/forwarding/publication_test.go
index 2d5c221c2..a63d4cad8 100644
--- a/internal/media/forwarding/publication_test.go
+++ b/internal/media/forwarding/publication_test.go
@@ -30,19 +30,19 @@ func TestPublicationEmptyProbeCannotIncreaseCapacity(t *testing.T) {
 	})}
 	bandwidth.target.Store(target)
 	bandwidth.audio.Store(audio)
-	bandwidth.pacer = &publicationPacer{bandwidth: bandwidth, boundedPacer: newBoundedPacer(
-		pacer.NewLeakyBucket(log, nil, 5*time.Millisecond, int(target)), log, 500,
+	queue := &publicationPacer{boundedPacer: newBoundedPacer(
+		pacer.NewNoQueue(log, nil), log, 500,
 	)}
-	defer bandwidth.pacer.Stop()
+	defer queue.Stop()
 	info := ccutils.ProbeClusterInfo{Id: 1, CreatedAt: time.Now(), Goal: ccutils.ProbeClusterGoal{
 		AvailableBandwidthBps: int(target), ExpectedUsageBps: int(target - audio),
 		DesiredBps: int(target * 2), Duration: bandwidth.ProbeDuration(),
 	}}
 	info.Goal.DesiredBytes = int(float64(info.Goal.DesiredBps) * info.Goal.Duration.Seconds() / 8)
 	bandwidth.ProbeClusterStarting(info)
-	bandwidth.pacer.StartProbeCluster(info)
+	queue.StartProbeCluster(info)
 	time.Sleep(info.Goal.Duration)
-	info = bandwidth.pacer.EndProbeCluster(info.Id)
+	info = queue.EndProbeCluster(info.Id)
 	if info.Result.Bytes() != 0 || sendsidebwe.DefaultSendSideBWEConfig.CongestionDetector.ProbeSignal.IsValid(info) {
 		t.Fatal("fixture did not complete an empty invalid probe")
 	}
@@ -66,6 +66,29 @@ func TestPublicationEmptyProbeCannotIncreaseCapacity(t *testing.T) {
 	}
 }
 
+type publicationCapacityRecorder struct{ capacity int64 }
+
+func (recorder *publicationCapacityRecorder) OnCongestionStateChange(_, _ bwe.CongestionState, capacity int64) {
+	recorder.capacity = capacity
+}
+
+func TestPublicationCongestionUsesCommittedCapacity(t *testing.T) {
+	recorder := &publicationCapacityRecorder{}
+	bandwidth := &publicationBWE{listener: recorder}
+	bandwidth.target.Store(1_200_000)
+	bandwidth.audio.Store(64_000)
+	bandwidth.OnCongestionStateChange(bwe.CongestionStateNone, bwe.CongestionStateEarlyWarning, 100_000_000)
+	bandwidth.OnCongestionStateChange(bwe.CongestionStateEarlyWarning, bwe.CongestionStateCongested, 100_000_000)
+	if bandwidth.target.Load() != 1_200_000 || recorder.capacity != 1_136_000 {
+		t.Fatalf("publication promoted an unverified capacity: target=%d allocation=%d", bandwidth.target.Load(), recorder.capacity)
+	}
+	bandwidth.OnCongestionStateChange(bwe.CongestionStateCongested, bwe.CongestionStateCongested, 500_000)
+	bandwidth.OnCongestionStateChange(bwe.CongestionStateCongested, bwe.CongestionStateNone, 800_000)
+	if bandwidth.target.Load() != 500_000 || recorder.capacity != 436_000 {
+		t.Fatalf("publication disagrees with its committed audio/video budget: target=%d allocation=%d", bandwidth.target.Load(), recorder.capacity)
+	}
+}
+
 func TestPublicationSimulcastReuseAudioDemandAndClose(t *testing.T) {
 	ctx, cancel := context.WithTimeout(t.Context(), 8*time.Second)
 	defer cancel()
@@ -225,7 +248,10 @@ func TestPublicationSimulcastReuseAudioDemandAndClose(t *testing.T) {
 	if publication.bandwidth.CongestionState() != bwe.CongestionStateNone || !publication.Counters().Limited {
 		t.Fatalf("clear transport feedback hid the committed publication allocation deficit: state=%v counters=%+v low=%v high=%v", publication.bandwidth.CongestionState(), publication.Counters(), publication.tracks[0].IsDeficient(), publication.tracks[1].IsDeficient())
 	}
-	publication.bandwidth.OnCongestionStateChange(bwe.CongestionStateCongested, bwe.CongestionStateCongested, 1_000_000)
+	// Restore this allocation fixture's capacity explicitly. A congestion event
+	// cannot prove an increase; this test covers RID reuse, not bandwidth probing.
+	publication.bandwidth.target.Store(1_000_000)
+	publication.allocator.SetChannelCapacity(936_000)
 	check(publication.SetActiveCount(1))
 	if publication.RequiredActiveCount() != 1 {
 		t.Fatal("publication did not reduce its direct demand")
diff --git a/internal/media/forwarding/transport.go b/internal/media/forwarding/transport.go
index 0ab8a5474..3622f1350 100644
--- a/internal/media/forwarding/transport.go
+++ b/internal/media/forwarding/transport.go
@@ -136,11 +136,10 @@ func NewTransport(options TransportOptions) (_ *Transport, err error) {
 	})
 	transport.estimator.SetBWEListener(transport)
 	transport.prober = ccutils.NewProber(ccutils.ProberParams{Listener: transport, Logger: log})
-	// Use the pinned Pion pacer's 5 ms service cadence, with LiveKit packet
-	// ownership and a cap matching this connection's retransmission cache.
-	transport.pacer = newBoundedPacer(pacer.NewLeakyBucket(log, nil, 5*time.Millisecond, options.InitialBitrate),
+	// Match LiveKit's send-side BWE default: a reduced estimate must not throttle
+	// already-encoded frames into a stale backlog after the writer recovers.
+	transport.pacer = newBoundedPacer(pacer.NewNoQueue(log, nil),
 		log, options.Source.maxPackets)
-	transport.pacer.SetBitrate(options.InitialBitrate)
 	transport.pacer.sender = pacer.NewBase(log, transport.estimator)
 	transport.pacer.SetPacerProbeObserverListener(transport)
 	track, err := sfu.NewDownTrack(sfu.DownTrackParams{
@@ -312,11 +311,7 @@ func (transport *Transport) SetAudioBitrate(bitrate uint32) {
 }
 
 func (transport *Transport) refreshBudgetLocked() {
-	bitrate := int(transport.target.Load())
-	remaining := int64(bitrate) - int64(transport.audioBitrate)
-	if transport.probe.Id == ccutils.ProbeClusterIdInvalid || transport.probe.Result.EndTime != 0 {
-		transport.pacer.SetBitrate(bitrate)
-	}
+	remaining := transport.target.Load() - int64(transport.audioBitrate)
 	transport.Output.SetBudget(max(remaining, 0))
 }
 
@@ -357,9 +352,11 @@ func (transport *Transport) OnTransportCCFeedback(_ *sfu.DownTrack, packet *rtcp
 }
 
 // HandleTWCCFeedback invokes this synchronously under the transport's event
-// lock. Store the framework result without reentering that lock.
-func (transport *Transport) OnCongestionStateChange(_, _ bwe.CongestionState, capacity int64) {
-	if capacity > 0 {
+// lock. Congestion can reduce committed capacity; only a valid completed probe
+// can increase it. Warning/clear transitions can carry the estimator's initial
+// ceiling, especially while a probe is pending, rather than a new measurement.
+func (transport *Transport) OnCongestionStateChange(_, state bwe.CongestionState, capacity int64) {
+	if state == bwe.CongestionStateCongested && capacity > 0 && capacity < transport.target.Load() {
 		transport.target.Store(capacity)
 	}
 }
@@ -457,7 +454,6 @@ func (transport *Transport) driveProbeLocked() {
 	transport.probe = transport.prober.AddCluster(ccutils.ProbeClusterModeUniform, goal)
 	transport.estimator.ProbeClusterStarting(transport.probe)
 	transport.pacer.StartProbeCluster(transport.probe)
-	transport.pacer.SetBitrate(goal.DesiredBps)
 	transport.Output.SetProbeClusterId(transport.probe.Id)
 }
 
@@ -470,7 +466,6 @@ func (transport *Transport) stopProbeLocked() {
 	transport.estimator.ProbeClusterDone(transport.probe)
 	transport.prober.Reset(transport.probe)
 	transport.pacer.cancelProbes(transport.probe.Id)
-	transport.pacer.SetBitrate(int(transport.target.Load()))
 }
 
 // AddCluster returns the exact cluster synchronously. Initializing it there
@@ -524,12 +519,6 @@ func newBoundedPacer(packetPacer pacer.Pacer, log logger.Logger, limit int) *bou
 		pending: make(map[*pacedPacket]struct{}), limit: limit}
 }
 
-func (queue *boundedPacer) SetBitrate(bitrate int) {
-	// Pion interceptor v0.1.47 gcc.LeakyBucketPacer.SetTargetBitrate uses 1.5
-	// pacing headroom. Codec/allocation budgets retain the unscaled BWE result.
-	queue.Pacer.SetBitrate(int(1.5 * float64(bitrate)))
-}
-
 func (queue *boundedPacer) Enqueue(packet *pacer.Packet) {
 	queue.mu.Lock()
 	if queue.closed || len(queue.pending) >= queue.limit {
diff --git a/internal/media/forwarding/transport_test.go b/internal/media/forwarding/transport_test.go
index b65e44fc5..3a77fce4b 100644
--- a/internal/media/forwarding/transport_test.go
+++ b/internal/media/forwarding/transport_test.go
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/livekit/livekit-server/pkg/sfu"
+	"github.com/livekit/livekit-server/pkg/sfu/bwe"
 	"github.com/livekit/livekit-server/pkg/sfu/ccutils"
 	"github.com/livekit/livekit-server/pkg/sfu/pacer"
 	"github.com/livekit/protocol/logger"
@@ -343,6 +344,97 @@ func (writer *countingPacketWriter) WriteRTP(header *rtp.Header, payload []byte)
 
 func (*countingPacketWriter) Write([]byte) (int, error) { panic("unexpected byte write") }
 
+func TestTransportDoesNotPromoteUnverifiedCongestionCapacity(t *testing.T) {
+	transport := &Transport{}
+	transport.target.Store(1_200_000)
+	// A pending probe can leave the framework's initial 100 Mbps estimate in
+	// state-change callbacks. It is not proof that the connection can send it.
+	transport.OnCongestionStateChange(bwe.CongestionStateNone, bwe.CongestionStateEarlyWarning, 100_000_000)
+	transport.OnCongestionStateChange(bwe.CongestionStateEarlyWarning, bwe.CongestionStateCongested, 100_000_000)
+	if bitrate, _ := transport.TargetBitrate(); bitrate != 1_200_000 {
+		t.Fatalf("congestion promoted an unverified capacity: %d", bitrate)
+	}
+	transport.OnCongestionStateChange(bwe.CongestionStateCongested, bwe.CongestionStateCongested, 500_000)
+	transport.OnCongestionStateChange(bwe.CongestionStateCongested, bwe.CongestionStateNone, 800_000)
+	if bitrate, _ := transport.TargetBitrate(); bitrate != 500_000 {
+		t.Fatalf("clearing congestion replaced the committed reduction without a probe: %d", bitrate)
+	}
+}
+
+type stalledPacketWriter struct {
+	ready, release chan struct{}
+	written        chan struct{}
+	once           sync.Once
+}
+
+func (writer *stalledPacketWriter) WriteRTP(header *rtp.Header, payload []byte) (int, error) {
+	writer.once.Do(func() { close(writer.ready); <-writer.release })
+	writer.written <- struct{}{}
+	return header.MarshalSize() + len(payload), nil
+}
+
+func (*stalledPacketWriter) Write([]byte) (int, error) { panic("unexpected byte write") }
+
+func TestSendQueuesDrainAfterBandwidthReduction(t *testing.T) {
+	for _, kind := range []string{"transport", "publication"} {
+		t.Run(kind, func(t *testing.T) {
+			codec := webrtc.RTPCodecParameters{RTPCodecCapability: webrtc.RTPCodecCapability{
+				MimeType: webrtc.MimeTypeVP8, ClockRate: 90_000,
+			}, PayloadType: 96}
+			source, err := NewSource(SourceOptions{ID: "queue", StreamID: "queue", Codec: codec,
+				Formats: []LayerFormat{{Width: 320, Height: 180, Bitrate: 500_000}}, MaxPackets: 500})
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer source.Close()
+			options := TransportOptions{Source: source, ConnectionID: "queue", InitialBitrate: 500_000}
+			var queue *boundedPacer
+			if kind == "publication" {
+				publication, err := NewPublication(options)
+				if err != nil {
+					t.Fatal(err)
+				}
+				defer publication.Close()
+				queue = publication.pacer.boundedPacer
+			} else {
+				transport, err := NewTransport(options)
+				if err != nil {
+					t.Fatal(err)
+				}
+				defer transport.Close()
+				queue = transport.pacer
+			}
+			writer := &stalledPacketWriter{ready: make(chan struct{}), release: make(chan struct{}), written: make(chan struct{}, 32)}
+			release := sync.OnceFunc(func() { close(writer.release) })
+			defer release()
+			for index := range 32 {
+				header := &rtp.Header{Version: 2, SSRC: 1, SequenceNumber: uint16(index)}
+				queue.Enqueue(&pacer.Packet{Header: header, HeaderSize: header.MarshalSize(),
+					Payload: make([]byte, 1200), WriteStream: writer})
+			}
+			select {
+			case <-writer.ready:
+			case <-time.After(2 * time.Second):
+				t.Fatal("transport did not reach the stalled writer")
+			}
+			// A short outage reduces the bandwidth estimate after these packets were
+			// encoded. The recovered writer must not spend tens of seconds sending old
+			// video before it can deliver a new frame.
+			queue.SetBitrate(8_000)
+			release()
+			deadline := time.NewTimer(2 * time.Second)
+			defer deadline.Stop()
+			for range 32 {
+				select {
+				case <-writer.written:
+				case <-deadline.C:
+					t.Fatalf("writable transport retained old video: pending=%d sent=%d", queue.pendingCount(), queue.stats().Packets)
+				}
+			}
+		})
+	}
+}
+
 func TestBoundedPacerReleasesPacketsAndIsolatesBlockedQueue(t *testing.T) {
 	log := logger.GetDiscardLogger()
 	sender := pacer.NewPassThrough(log, nil)

From 5be56b45bff5edf61470db5721c65deb10e99a77 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 22:55:28 +0800
Subject: [PATCH 084/262] docs(research): bound Native tunnel handoff evidence

---
 docs/research/nat-traversal.md | 59 ++++++++++++++++++++++------------
 docs/todo.md                   |  9 ++++--
 2 files changed, 44 insertions(+), 24 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 805c25e41..a0b117086 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -656,27 +656,44 @@ acceptance. They do not resolve the gateway-only or prolonged-outage controls
 above. Supported dependencies, room grants and representative network evidence
 remain prerequisites for product adoption.
 
-The 2026-10-09 remote-socket overlay extends that comparison through the actual
-Native encoded source, sender, receiver and ordinary local playback. It leaves
-product files untouched and admits one fixture peer flow per engine. Unchanged
-ordinary/Tailcat controls pass, and both handoff directions can retain media
-after DERP closure. Stronger fresh-content checks expose a limit: two of three
-sender-handoff repetitions pause output for roughly two seconds while ICE stays
-connected; one remains paused at the fifteen-second observation boundary.
-The outgoing frame counter also stops as the sender estimate falls to about
-20 kbps. This locates those gaps at forwarding/adaptation, rather than proving
-that the underlay lost the connection.
-
-The fixed 8×8 input deliberately has no live rate-controllable encoder. Declaring
-it rate-controlled removes the later forwarding pauses in three repetitions,
-but all three still miss the strict first fresh-content window and later deliver
-about 34–37 frames per second instead of the requested 50. This is an ablation,
-not a valid capture implementation or a proposed product switch. Actual Native
-capture already declares its live lowest output controllable and applies codec
-budgets; raw forwarding retains the framework's pause policy. Full App acceptance
-must include that encoder owner, local Browser decode and recovery, and useful
-picture continuity. A preserved ICE session alone does not establish a net
-handoff benefit. No production adaptation rule or timeout changed.
+The remote-socket overlay extends that comparison through the actual Native
+encoded source, sender, receiver and local playback. It leaves product files
+untouched and admits one fixture peer flow per engine. Its fixed 8×8 input
+exposes forwarding pauses but cannot establish live encoder recovery; declaring
+those fixed bytes rate-controlled is only an ablation.
+
+The live control instead uses the Windows VP8 helper, Native output-plan owner
+and final FFmpeg decode. The top quarter of the input changes from red to blue
+after DERP closure, so buffered pictures cannot satisfy fresh-content acceptance.
+About one second of ordinary UDP loss can leave the former pacer sending old
+video from a queue of hundreds of packets. DownTrack frame counts precede actual
+paced writes and cannot prove delivery. The shared media assessment owns the
+[pacing comparison](./node-local-media-design.md#send-queue-recovery);
+it must pass constrained-bandwidth recovery as well as this short-loss control.
+
+Viewer address changes expose a separate confound: same-machine playback can
+select a LAN address that the experiment then removes. Restricting only the
+fixture receiver to loopback separates that leg from the remote underlay.
+With this control and the upstream default send queue, all six cases pass:
+unchanged ordinary/Tailcat paths, both address-change directions, and short
+ordinary/Tailcat loss. Each retains decoded fresh pictures in every post-DERP
+sample. These passes do not accept the default local-playback path or the
+complete App. Verify its Browser bridge
+and existing recovery owner before adopting a local-address policy.
+No additional NAT-reachability class, physical capture result or product
+Magicsock integration follows from these controls.
+
+A same-machine Windows Browser control rejects forcing the product bridge to
+loopback. Chrome 154 decodes from a Native sender bound to `127.0.0.1`, but
+Firefox 155 fails that connection; the same Firefox fixture decodes with the
+current wildcard bind and a non-loopback selected pair. Mozilla also keeps
+[ICE loopback disabled by default](https://searchfox.org/firefox-main/source/modules/libpref/init/all.js).
+These controls establish a compatibility limit, not its complete Browser cause
+or public-Site permission behavior. Keep the current address policy. The Host
+currently ends sharing when its required local bridge fails; the Viewer delegates
+that failure to its existing bounded connection-replacement owner. Complete App
+handoff acceptance must cover both, without treating the remote tunnel's survival
+as proof that local playback survived.
 
 Dual-stack namespace controls enabled STUN and alternately blocked IPv4 UDP or
 IPv6 forwarding. Both stacks used the working family; Tailcat's direct proof
diff --git a/docs/todo.md b/docs/todo.md
index b8a620a31..e9fb0be38 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -72,9 +72,12 @@ Implementation needs a concrete useful result within the product model.
   Isolated local-address changes now preserve the same session under the actual
   Viewer recovery owner. Verify that bounded benefit through the complete App
   pipeline and physical networks; it does not establish another reachable NAT class.
-  The actual Native media overlay can retain the transport but its fixed-input
-  continuity controls expose forwarding pauses. Include the live encoder and
-  decoded picture continuity; do not treat the rate-control ablation as a fix.
+  Live-encoder/decoded-picture controls now separate shared forwarding queue
+  delay from the local playback leg losing its selected LAN address. The shared
+  send-queue repair passes constrained-link recovery; verify the App's local
+  Browser bridge during address changes. A loopback-only policy fails the Firefox
+  control; retain the current address policy and verify both Host and Viewer
+  lifecycle behavior before claiming complete App recovery.
   Product adoption still needs supported
   [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary)
   and RTCP/MTU boundaries, retained-flow recovery beyond the passing serial

From efd9f6a415ca25fd420620561e9963c0718ddea5 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 23:07:34 +0800
Subject: [PATCH 085/262] test(gates): distinguish profile application from
 decoding

---
 scripts/app-native-host-gate.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/scripts/app-native-host-gate.ts b/scripts/app-native-host-gate.ts
index 0bf8c6053..c6c0f6d12 100644
--- a/scripts/app-native-host-gate.ts
+++ b/scripts/app-native-host-gate.ts
@@ -1022,12 +1022,13 @@ async function main(): Promise<void> {
       result.viewerWidth = viewerState.width;
       result.viewerHeight = viewerState.height;
       await assertVideoCodec(cdp, viewer, actualCodec);
-      stage = "native-4k-quality";
+      stage = "native-4k-preset";
       await clickHostControl(cdp, host, `document.querySelectorAll('button.lr-tile')[2]`);
       await waitForValue(deadline => evaluate<boolean>(cdp!, host,
         `document.querySelector('.lr-slider input[type="range"]')?.value === '60' &&
           document.querySelector('.lr-sharing-panel')?.getAttribute('aria-busy') === 'false'`,
         deadline), Boolean, 20_000);
+      stage = "native-4k-controls";
       const framesBefore4K = await evaluate<number>(cdp, viewer,
         `document.querySelector('video')?.getVideoPlaybackQuality().totalVideoFrames ?? 0`, Date.now() + 5_000);
       await evaluate<void>(cdp, host,
@@ -1038,6 +1039,7 @@ async function main(): Promise<void> {
         const height = document.querySelector('.lr-video-size input[name="height"]');
         return fps?.max === '30' && fps.value === '30' && width?.value === '3840' && height?.value === '2160';
       })()`, deadline), Boolean, 10_000);
+      stage = "native-4k-decode";
       result.fourKQualityChanged = await waitForValue(deadline => evaluate<boolean>(cdp!, viewer, `(() => {
         const video = document.querySelector('video');
         return Boolean(video && window.__piikGateFitsProfile(3840, 2160) &&

From 726a10507d8697c5c8b5e46116724b4324080e32 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Fri, 9 Oct 2026 23:50:37 +0800
Subject: [PATCH 086/262] fix(media): finalize bandwidth probes from
 acknowledged traffic

---
 docs/research/browser-screen-audio-quality.md |    9 +-
 docs/research/node-local-media-design.md      |   35 +-
 docs/todo.md                                  |    4 +-
 internal/media/forwarding/publication.go      |   32 +-
 internal/media/forwarding/publication_test.go |   80 +-
 internal/media/forwarding/recovery_test.go    |    3 +
 internal/media/forwarding/transport.go        |    5 +-
 internal/thirdparty/README.md                 |   23 +
 internal/thirdparty/livekit/LICENSE           |  202 +++
 internal/thirdparty/livekit/NOTICE            |   13 +
 .../sendsidebwe/congestion_detector.go        | 1164 +++++++++++++++++
 .../livekit/sendsidebwe/packet_group.go       |  310 +++++
 .../livekit/sendsidebwe/packet_info.go        |   45 +
 .../livekit/sendsidebwe/packet_tracker.go     |  168 +++
 .../livekit/sendsidebwe/probe_packet_group.go |  143 ++
 .../livekit/sendsidebwe/send_side_bwe.go      |  151 +++
 .../livekit/sendsidebwe/traffic_stats.go      |  191 +++
 .../livekit/sendsidebwe/twcc_feedback.go      |  127 ++
 18 files changed, 2662 insertions(+), 43 deletions(-)
 create mode 100644 internal/thirdparty/livekit/LICENSE
 create mode 100644 internal/thirdparty/livekit/NOTICE
 create mode 100644 internal/thirdparty/livekit/sendsidebwe/congestion_detector.go
 create mode 100644 internal/thirdparty/livekit/sendsidebwe/packet_group.go
 create mode 100644 internal/thirdparty/livekit/sendsidebwe/packet_info.go
 create mode 100644 internal/thirdparty/livekit/sendsidebwe/packet_tracker.go
 create mode 100644 internal/thirdparty/livekit/sendsidebwe/probe_packet_group.go
 create mode 100644 internal/thirdparty/livekit/sendsidebwe/send_side_bwe.go
 create mode 100644 internal/thirdparty/livekit/sendsidebwe/traffic_stats.go
 create mode 100644 internal/thirdparty/livekit/sendsidebwe/twcc_feedback.go

diff --git a/docs/research/browser-screen-audio-quality.md b/docs/research/browser-screen-audio-quality.md
index 153c7a605..e51a21eab 100644
--- a/docs/research/browser-screen-audio-quality.md
+++ b/docs/research/browser-screen-audio-quality.md
@@ -105,8 +105,13 @@ retirement also passed; the Browser run measured stereo separation. An ordinary
 Browser relay forwarded received tracks to two children at 320 kbps, with
 advancing decoded audio and successful cleanup. A direct Browser control now
 keeps requested 256/320 kbps below an explicit 192 kbps receive limit, while a
-510 kbps receiver permits both rates. These are local runtime checks; impaired
-networks, mobile playback and physical listening remain open.
+510 kbps receiver permits both rates. A native real-Opus control through
+6 Mbps -> 500 kbps -> 6 Mbps shaping retains decoded audio during live
+320/96/320 kbps changes. It exposed the shared
+[probe measurement repairs](./node-local-media-design.md#send-queue-recovery),
+but video allocation after returning to the high audio rate still needs
+verification. These are local runtime checks; physical networks, mobile playback
+and listening remain open.
 
 RFC 7587 gives an omitted receive bitrate a mode-dependent default, not an
 unrestricted value, and asks receivers to ignore out-of-range preferences.
diff --git a/docs/research/node-local-media-design.md b/docs/research/node-local-media-design.md
index 3a1e4cacb..4da1093a4 100644
--- a/docs/research/node-local-media-design.md
+++ b/docs/research/node-local-media-design.md
@@ -386,7 +386,8 @@ fixes and demand hooks beyond a thin adapter; do not maintain both candidates.
 Keep the dependency behind a shared media package. For one video per connection,
 use the public provisional allocation primitives, with exact typed child state
 read by its parent; do not parse DebugInfo or run a second multi-track allocator.
-The candidate now uses LiveKit SendSideBWE and Prober through their public APIs.
+The candidate uses LiveKit SendSideBWE and Prober through their public APIs,
+with the [scoped measurement repair](../../internal/thirdparty/README.md#livekit-send-side-bandwidth-estimation).
 Packet sending uses the pinned [LiveKit transport's send-side BWE default](https://github.com/livekit/livekit/blob/v1.13.6/pkg/rtc/transport.go),
 `NoQueue`: an asynchronous writer without a second bitrate throttle on already
 encoded packets. Admission stays capped by the existing packet cache bound;
@@ -415,6 +416,19 @@ audio reservation. This follows the
 [upstream distinction between congestion events and completed probes](https://github.com/livekit/livekit/blob/v1.13.6/pkg/sfu/streamallocator/streamallocator.go),
 without introducing another estimator.
 
+Two upstream measurement defects also affect completed probes. The pinned
+[finalizer](https://github.com/livekit/livekit/blob/v1.13.6/pkg/sfu/bwe/sendsidebwe/congestion_detector.go)
+returns retained capacity, initially 100 Mbps, rather than the current probe's
+acknowledged rate; no feedback can also be classified as non-congesting. The
+[probe packet group](https://github.com/livekit/livekit/blob/v1.13.6/pkg/sfu/bwe/sendsidebwe/probe_packet_group.go)
+includes the transport's preceding idle interval in the new measurement window.
+An 800 kbps probe after five idle seconds therefore either promotes 100 Mbps or,
+with only the return-value correction, fails to restore the existing budget.
+The scoped repair returns only current probe evidence, marks invalid or
+unacknowledged probes inconclusive, and starts timing at the first acknowledged
+probe packet. Removing either correction fails the real-TWCC regression. These
+changes preserve upstream estimation, loss handling and probe scheduling.
+
 Real decode also exposed a packet-format mismatch at the shared writer:
 LiveKit 1.13.6 includes padding in its probe payload, while Pion SRTP serializes
 another block from `Header.PaddingSize`. An actual library probe therefore
@@ -427,13 +441,18 @@ packet as valid video. The primary owners are
 [LiveKit probe construction](https://github.com/livekit/livekit/blob/v1.13.6/pkg/sfu/downtrack.go)
 and [Pion packet serialization](https://github.com/pion/rtp/blob/v1.10.5/packet.go).
 
-The explicit `TestTransportConstrainedDormantRecovery` virtual-network trace uses real
-Pion RTP/TWCC through 6 Mbps -> 500 kbps -> 6 Mbps shaping. Three consecutive runs
-stop the upper output under that constraint and restore sustained 1.20 Mbps after
-release. The SDK latency-aware queue passes the same three controls but requires
-an extra adapter; it is not retained. Earlier flaky comparisons registered TWCC
-twice on the receiver, duplicating feedback; those results do not rank the queues.
-Product receivers already use the single default interceptor owner.
+The explicit `TestTransportConstrainedDormantRecovery` virtual-network trace uses
+real Pion RTP/TWCC through 6 Mbps -> 500 kbps -> 6 Mbps shaping. The repaired
+library restores sustained 1.20 Mbps video after release, with a budget assertion
+that rejects the unmeasured initial capacity. Earlier passing recovery traces
+could promote 100 Mbps and do not establish correct budgeting. The SDK
+latency-aware queue requires an extra adapter and is not retained. Earlier
+flaky comparisons also registered TWCC twice on the receiver, duplicating
+feedback; those results do not rank the queues. Product receivers already use
+the single default interceptor owner. A separate real Opus 320/96/320 kbps
+control retains audio decoding under the same impairment; video can still
+return to a lower output after the high audio rate resumes. That allocation
+boundary remains open rather than being reported as complete recovery.
 No reset, retry owner or minimum quality is added. These are bounded local traces,
 not a field diagnosis, success-rate or game-latency claim.
 Ordinary focused checks cover NACK repair, no-RR probe admission, zero-write
diff --git a/docs/todo.md b/docs/todo.md
index e9fb0be38..53052b009 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -57,7 +57,9 @@ Implementation needs a concrete useful result within the product model.
   limits and framework-owned adaptation. The
   [audio controls](./research/browser-screen-audio-quality.md#numeric-bitrate-assessment)
   retain explicit receive-limit enforcement and the current 320 kbps sender
-  ceiling; physical listening and impaired-network evidence remain open.
+  ceiling. A real-Opus impaired-network control retains decoding; verify video
+  allocation after restoring high audio rates. Physical listening, mobile and
+  field-network acceptance remain open.
   New codecs need complete
   encode/decode/forward support and a late-Viewer policy before inclusion;
   selecting a codec cannot transcode an existing publication. Confirm live
diff --git a/internal/media/forwarding/publication.go b/internal/media/forwarding/publication.go
index 4e3a5cb6e..5404dec6a 100644
--- a/internal/media/forwarding/publication.go
+++ b/internal/media/forwarding/publication.go
@@ -12,10 +12,10 @@ import (
 	"time"
 
 	"github.com/TNTcraftHIM/Piik/internal/diagnostics"
+	"github.com/TNTcraftHIM/Piik/internal/thirdparty/livekit/sendsidebwe"
 	"github.com/livekit/livekit-server/pkg/sfu"
 	"github.com/livekit/livekit-server/pkg/sfu/buffer"
 	"github.com/livekit/livekit-server/pkg/sfu/bwe"
-	"github.com/livekit/livekit-server/pkg/sfu/bwe/sendsidebwe"
 	"github.com/livekit/livekit-server/pkg/sfu/ccutils"
 	"github.com/livekit/livekit-server/pkg/sfu/pacer"
 	"github.com/livekit/livekit-server/pkg/sfu/streamallocator"
@@ -561,12 +561,10 @@ func (context publicationAudioContext) WriteStream() webrtc.TrackLocalWriter { r
 // audio is conservative and does not claim that the estimator acknowledged it.
 type publicationBWE struct {
 	*sendsidebwe.SendSideBWE
-	listener       bwe.BWEListener
-	target         atomic.Int64
-	audio          atomic.Int64
-	observed       atomic.Bool
-	probeMu        sync.Mutex
-	completedProbe ccutils.ProbeClusterInfo
+	listener bwe.BWEListener
+	target   atomic.Int64
+	audio    atomic.Int64
+	observed atomic.Bool
 }
 
 func (bandwidth *publicationBWE) HandleTWCCFeedback(report *rtcp.TransportLayerCC) {
@@ -586,26 +584,10 @@ func (bandwidth *publicationBWE) OnCongestionStateChange(from, to bwe.Congestion
 	}
 	bandwidth.listener.OnCongestionStateChange(from, to, max(bandwidth.target.Load()-bandwidth.audio.Load(), 0))
 }
-func (bandwidth *publicationBWE) ProbeClusterDone(info ccutils.ProbeClusterInfo) {
-	bandwidth.probeMu.Lock()
-	defer bandwidth.probeMu.Unlock()
-	bandwidth.completedProbe = info
-	bandwidth.SendSideBWE.ProbeClusterDone(info)
-}
 func (bandwidth *publicationBWE) ProbeClusterFinalize() (ccutils.ProbeSignal, int64, bool) {
-	bandwidth.probeMu.Lock()
-	defer bandwidth.probeMu.Unlock()
 	signal, capacity, done := bandwidth.SendSideBWE.ProbeClusterFinalize()
-	if done {
-		valid := sendsidebwe.DefaultSendSideBWEConfig.CongestionDetector.ProbeSignal.IsValid(bandwidth.completedProbe)
-		bandwidth.completedProbe = ccutils.ProbeClusterInfoInvalid
-		if !valid {
-			// StreamAllocator may upgrade on Inconclusive too. Its capacity must
-			// never promote the estimator's initial sentinel after an empty probe.
-			signal = ccutils.ProbeSignalInconclusive
-		} else if signal == ccutils.ProbeSignalNotCongesting && capacity > bandwidth.target.Load() {
-			bandwidth.target.Store(capacity)
-		}
+	if done && signal == ccutils.ProbeSignalNotCongesting && capacity > bandwidth.target.Load() {
+		bandwidth.target.Store(capacity)
 	}
 	return signal, max(bandwidth.target.Load()-bandwidth.audio.Load(), 0), done
 }
diff --git a/internal/media/forwarding/publication_test.go b/internal/media/forwarding/publication_test.go
index a63d4cad8..bf5d36cd3 100644
--- a/internal/media/forwarding/publication_test.go
+++ b/internal/media/forwarding/publication_test.go
@@ -9,13 +9,15 @@ import (
 	"time"
 
 	"github.com/TNTcraftHIM/Piik/internal/media/encoded"
+	"github.com/TNTcraftHIM/Piik/internal/thirdparty/livekit/sendsidebwe"
 	"github.com/livekit/livekit-server/pkg/sfu"
 	"github.com/livekit/livekit-server/pkg/sfu/bwe"
-	"github.com/livekit/livekit-server/pkg/sfu/bwe/sendsidebwe"
 	"github.com/livekit/livekit-server/pkg/sfu/ccutils"
 	"github.com/livekit/livekit-server/pkg/sfu/pacer"
 	"github.com/livekit/protocol/logger"
 	"github.com/pion/interceptor"
+	"github.com/pion/interceptor/pkg/twcc"
+	"github.com/pion/rtcp"
 	"github.com/pion/rtp/codecs"
 	"github.com/pion/webrtc/v4"
 	"github.com/pion/webrtc/v4/pkg/media"
@@ -54,9 +56,6 @@ func TestPublicationEmptyProbeCannotIncreaseCapacity(t *testing.T) {
 			if signal != ccutils.ProbeSignalInconclusive || capacity > target-audio || bandwidth.target.Load() != target {
 				t.Fatalf("empty probe raised publication capacity: signal=%v capacity=%d target=%d", signal, capacity, bandwidth.target.Load())
 			}
-			if bandwidth.completedProbe.Id != ccutils.ProbeClusterIdInvalid {
-				t.Fatal("completed probe was retained after finalization")
-			}
 			break
 		}
 		if time.Now().After(deadline) {
@@ -66,6 +65,79 @@ func TestPublicationEmptyProbeCannotIncreaseCapacity(t *testing.T) {
 	}
 }
 
+func TestPublicationProbeUsesAcknowledgedCapacity(t *testing.T) {
+	for _, received := range []bool{true, false} {
+		t.Run(map[bool]string{true: "received", false: "no-feedback"}[received], func(t *testing.T) {
+			checkPublicationProbeCapacity(t, received)
+		})
+	}
+}
+
+func checkPublicationProbeCapacity(t *testing.T, received bool) {
+	t.Helper()
+	const target = int64(100_000)
+	const audio = int64(64_000)
+	bandwidth := &publicationBWE{SendSideBWE: sendsidebwe.NewSendSideBWE(sendsidebwe.SendSideBWEParams{
+		Config: sendsidebwe.DefaultSendSideBWEConfig, Logger: logger.GetDiscardLogger(),
+	})}
+	bandwidth.target.Store(target)
+	bandwidth.audio.Store(audio)
+	bandwidth.SetBWEListener(&publicationCapacityRecorder{})
+	// A real non-congesting probe after reset still carries the library's
+	// initial capacity. A successful 800 kbps probe cannot prove 100 Mbps.
+	start := time.Now().Add(-time.Second)
+	recorder := twcc.NewRecorder(42)
+	// Establish transport history before the idle interval. The initial packet
+	// has relative time zero, so include a subsequent packet as in a live stream.
+	for _, age := range []time.Duration{6 * time.Second, 5 * time.Second} {
+		previous := start.Add(-age).UnixMicro()
+		sequence := bandwidth.RecordPacketSendAndGetSequenceNumber(previous, 200, false, ccutils.ProbeClusterIdInvalid, false)
+		recorder.Record(42, sequence, previous+10_000)
+	}
+	for _, packet := range recorder.BuildFeedbackPacket() {
+		bandwidth.HandleTWCCFeedback(packet.(*rtcp.TransportLayerCC))
+	}
+	bandwidth.Reset()
+	info := ccutils.ProbeClusterInfo{Id: 1, CreatedAt: start, Goal: ccutils.ProbeClusterGoal{
+		AvailableBandwidthBps: int(target), DesiredBps: 800_000,
+		Duration: 200 * time.Millisecond, DesiredBytes: 20_000,
+	}}
+	bandwidth.ProbeClusterStarting(info)
+	for index := range 100 {
+		at := start.Add(time.Duration(index) * 2 * time.Millisecond).UnixMicro()
+		sequence := bandwidth.RecordPacketSendAndGetSequenceNumber(at, 200, false, info.Id, true)
+		recorder.Record(42, sequence, at+10_000)
+	}
+	info.Result = ccutils.ProbeClusterResult{StartTime: start.UnixNano(),
+		EndTime: start.Add(info.Goal.Duration).UnixNano(), PacketsProbe: 100, BytesProbe: 20_000, IsCompleted: true}
+	bandwidth.ProbeClusterDone(info)
+	if received {
+		for _, packet := range recorder.BuildFeedbackPacket() {
+			bandwidth.HandleTWCCFeedback(packet.(*rtcp.TransportLayerCC))
+		}
+	}
+	deadline := time.Now().Add(sendsidebwe.DefaultSendSideBWEConfig.CongestionDetector.ProbePacketGroup.SettleWaitMax + time.Second)
+	for {
+		signal, capacity, done := bandwidth.ProbeClusterFinalize()
+		if done {
+			if received {
+				// Allow the first-packet/time-window difference in the library's
+				// acknowledged rate, but never its untouched 100 Mbps initial value.
+				if signal != ccutils.ProbeSignalNotCongesting || capacity <= target-audio || capacity > 1_000_000-audio {
+					t.Fatalf("probe promoted unmeasured capacity: signal=%v committed=%d sent=%.0f", signal, capacity+audio, info.Result.Bitrate())
+				}
+			} else if signal != ccutils.ProbeSignalInconclusive || capacity != target-audio {
+				t.Fatalf("unacknowledged probe changed capacity: signal=%v committed=%d", signal, capacity+audio)
+			}
+			return
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("probe did not finalize within the library settle bound")
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+}
+
 type publicationCapacityRecorder struct{ capacity int64 }
 
 func (recorder *publicationCapacityRecorder) OnCongestionStateChange(_, _ bwe.CongestionState, capacity int64) {
diff --git a/internal/media/forwarding/recovery_test.go b/internal/media/forwarding/recovery_test.go
index b9d764467..ce003ac33 100644
--- a/internal/media/forwarding/recovery_test.go
+++ b/internal/media/forwarding/recovery_test.go
@@ -136,6 +136,9 @@ func TestTransportConstrainedDormantRecovery(t *testing.T) {
 		}
 		link.SetRate(capacity)
 		state := transport.Output.State()
+		if state.VideoBudget > 6_000_000 {
+			t.Fatalf("probe promoted capacity beyond this fixture's link: %+v", state)
+		}
 		_, observed := transport.TargetBitrate()
 		high := !observed || state.Target == 1 || state.Prepare == 1 || !state.Paused && state.Current == 1
 		if elapsed >= 7*time.Second && elapsed < 12*time.Second {
diff --git a/internal/media/forwarding/transport.go b/internal/media/forwarding/transport.go
index 3622f1350..32ac1521f 100644
--- a/internal/media/forwarding/transport.go
+++ b/internal/media/forwarding/transport.go
@@ -11,10 +11,10 @@ import (
 	"time"
 
 	"github.com/TNTcraftHIM/Piik/internal/diagnostics"
+	"github.com/TNTcraftHIM/Piik/internal/thirdparty/livekit/sendsidebwe"
 	"github.com/livekit/livekit-server/pkg/sfu"
 	"github.com/livekit/livekit-server/pkg/sfu/buffer"
 	"github.com/livekit/livekit-server/pkg/sfu/bwe"
-	"github.com/livekit/livekit-server/pkg/sfu/bwe/sendsidebwe"
 	"github.com/livekit/livekit-server/pkg/sfu/ccutils"
 	"github.com/livekit/livekit-server/pkg/sfu/pacer"
 	"github.com/livekit/livekit-server/pkg/sfu/streamallocator"
@@ -423,8 +423,7 @@ func (transport *Transport) driveProbeLocked() {
 		}
 		if transport.probe.Result.EndTime != 0 {
 			if signal, capacity, finalized := transport.estimator.ProbeClusterFinalize(); finalized {
-				valid := sendsidebwe.DefaultSendSideBWEConfig.CongestionDetector.ProbeSignal.IsValid(transport.probe)
-				if valid && signal == ccutils.ProbeSignalNotCongesting && capacity > transport.target.Load() {
+				if signal == ccutils.ProbeSignalNotCongesting && capacity > transport.target.Load() {
 					transport.target.Store(capacity)
 				}
 				transport.probe = ccutils.ProbeClusterInfoInvalid
diff --git a/internal/thirdparty/README.md b/internal/thirdparty/README.md
index 1352b9115..5be024b0a 100644
--- a/internal/thirdparty/README.md
+++ b/internal/thirdparty/README.md
@@ -24,3 +24,26 @@ pass, replace both local module directives with version pins, remove their sourc
 directories and the extra dependency test patterns in `scripts/check-go.mjs`.
 Until then, review updates against the named baselines; do not edit Go's shared
 module cache or apply build-time patches.
+
+## LiveKit Send-Side Bandwidth Estimation
+
+`livekit/sendsidebwe` retains only the eight source files from
+[LiveKit v1.13.6's package](https://github.com/livekit/livekit/tree/v1.13.6/pkg/sfu/bwe/sendsidebwe),
+with its original `LICENSE` and `NOTICE`. It uses the existing pinned LiveKit
+interfaces; the rest of LiveKit remains the normal Go dependency. There is no
+whole-module fork or build-time patch.
+
+Two measurement corrections are marked in the modified files: probe finalization
+returns the current acknowledged capacity and rejects invalid/empty feedback;
+probe timing begins with its first acknowledged packet, excluding pre-probe idle
+time. Piik's shared forwarding package uses this copy for both individual
+transports and publications. Its regression checks use real TWCC feedback and
+retain the no-feedback and idle-before-probe controls. The
+[media research owner](../../docs/research/node-local-media-design.md#send-queue-recovery)
+records the runtime evidence and remaining limits.
+
+The package notice collector still includes LiveKit's upstream license and
+notice through the other compiled LiveKit packages. When a maintained upstream
+version covers both corrections and the same regressions pass, remove this
+directory and restore the upstream imports. Review dependency bumps against the
+named baseline; do not evolve a separate congestion-control algorithm here.
diff --git a/internal/thirdparty/livekit/LICENSE b/internal/thirdparty/livekit/LICENSE
new file mode 100644
index 000000000..d64569567
--- /dev/null
+++ b/internal/thirdparty/livekit/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/internal/thirdparty/livekit/NOTICE b/internal/thirdparty/livekit/NOTICE
new file mode 100644
index 000000000..692adc992
--- /dev/null
+++ b/internal/thirdparty/livekit/NOTICE
@@ -0,0 +1,13 @@
+Copyright 2023 LiveKit, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
diff --git a/internal/thirdparty/livekit/sendsidebwe/congestion_detector.go b/internal/thirdparty/livekit/sendsidebwe/congestion_detector.go
new file mode 100644
index 000000000..32fb6bf68
--- /dev/null
+++ b/internal/thirdparty/livekit/sendsidebwe/congestion_detector.go
@@ -0,0 +1,1164 @@
+// Copyright 2023 LiveKit, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Modified by Piik: finalize probes from valid acknowledged measurements,
+// not the detector's retained initial capacity.
+package sendsidebwe
+
+import (
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/livekit/livekit-server/pkg/sfu/bwe"
+	"github.com/livekit/livekit-server/pkg/sfu/ccutils"
+	"github.com/livekit/protocol/logger"
+	"github.com/livekit/protocol/utils/mono"
+	"github.com/pion/rtcp"
+	"go.uber.org/zap/zapcore"
+)
+
+// -------------------------------------------------------------------------------
+
+type CongestionSignalConfig struct {
+	MinNumberOfGroups int           `yaml:"min_number_of_groups,omitempty"`
+	MinDuration       time.Duration `yaml:"min_duration,omitempty"`
+}
+
+func (c CongestionSignalConfig) IsTriggered(numGroups int, duration int64) bool {
+	return numGroups >= c.MinNumberOfGroups && duration >= c.MinDuration.Microseconds()
+}
+
+var (
+	defaultQueuingDelayEarlyWarningJQRConfig = CongestionSignalConfig{
+		MinNumberOfGroups: 2,
+		MinDuration:       200 * time.Millisecond,
+	}
+
+	defaultQueuingDelayEarlyWarningDQRConfig = CongestionSignalConfig{
+		MinNumberOfGroups: 3,
+		MinDuration:       300 * time.Millisecond,
+	}
+
+	defaultLossEarlyWarningJQRConfig = CongestionSignalConfig{
+		MinNumberOfGroups: 3,
+		MinDuration:       300 * time.Millisecond,
+	}
+
+	defaultLossEarlyWarningDQRConfig = CongestionSignalConfig{
+		MinNumberOfGroups: 4,
+		MinDuration:       400 * time.Millisecond,
+	}
+
+	defaultQueuingDelayCongestedJQRConfig = CongestionSignalConfig{
+		MinNumberOfGroups: 4,
+		MinDuration:       400 * time.Millisecond,
+	}
+
+	defaultQueuingDelayCongestedDQRConfig = CongestionSignalConfig{
+		MinNumberOfGroups: 5,
+		MinDuration:       500 * time.Millisecond,
+	}
+
+	defaultLossCongestedJQRConfig = CongestionSignalConfig{
+		MinNumberOfGroups: 6,
+		MinDuration:       600 * time.Millisecond,
+	}
+
+	defaultLossCongestedDQRConfig = CongestionSignalConfig{
+		MinNumberOfGroups: 6,
+		MinDuration:       600 * time.Millisecond,
+	}
+)
+
+// -------------------------------------------------------------------------------
+
+type ProbeSignalConfig struct {
+	MinBytesRatio    float64 `yaml:"min_bytes_ratio,omitempty"`
+	MinDurationRatio float64 `yaml:"min_duration_ratio,omitempty"`
+
+	JQRMinDelay time.Duration `yaml:"jqr_min_delay,omitempty"`
+	DQRMaxDelay time.Duration `yaml:"dqr_max_delay,omitempty"`
+
+	WeightedLoss       WeightedLossConfig `yaml:"weighted_loss,omitempty"`
+	JQRMinWeightedLoss float64            `yaml:"jqr_min_weighted_loss,omitempty"`
+	DQRMaxWeightedLoss float64            `yaml:"dqr_max_weighted_loss,omitempty"`
+}
+
+func (p ProbeSignalConfig) IsValid(pci ccutils.ProbeClusterInfo) bool {
+	return pci.Result.Bytes() > int(p.MinBytesRatio*float64(pci.Goal.DesiredBytes)) && pci.Result.Duration() > time.Duration(p.MinDurationRatio*float64(pci.Goal.Duration))
+}
+
+func (p ProbeSignalConfig) ProbeSignal(ppg *probePacketGroup) (ccutils.ProbeSignal, int64) {
+	ts := newTrafficStats(trafficStatsParams{
+		Config: p.WeightedLoss,
+	})
+	ts.Merge(ppg.Traffic())
+
+	pqd := ppg.PropagatedQueuingDelay()
+	if pqd > p.JQRMinDelay.Microseconds() || ts.WeightedLoss() > p.JQRMinWeightedLoss {
+		return ccutils.ProbeSignalCongesting, ts.AcknowledgedBitrate()
+	}
+
+	if pqd < p.DQRMaxDelay.Microseconds() && ts.WeightedLoss() < p.DQRMaxWeightedLoss {
+		return ccutils.ProbeSignalNotCongesting, ts.AcknowledgedBitrate()
+	}
+
+	return ccutils.ProbeSignalInconclusive, ts.AcknowledgedBitrate()
+}
+
+var (
+	defaultProbeSignalConfig = ProbeSignalConfig{
+		MinBytesRatio:    0.5,
+		MinDurationRatio: 0.5,
+
+		JQRMinDelay: 50 * time.Millisecond,
+		DQRMaxDelay: 20 * time.Millisecond,
+
+		WeightedLoss:       defaultWeightedLossConfig,
+		JQRMinWeightedLoss: 0.25,
+		DQRMaxWeightedLoss: 0.1,
+	}
+)
+
+// -------------------------------------------------------------------------------
+
+type queuingRegion int
+
+const (
+	queuingRegionDQR queuingRegion = iota
+	queuingRegionIndeterminate
+	queuingRegionJQR
+)
+
+func (q queuingRegion) String() string {
+	switch q {
+	case queuingRegionDQR:
+		return "DQR"
+	case queuingRegionIndeterminate:
+		return "INDETERMINATE"
+	case queuingRegionJQR:
+		return "JQR"
+	default:
+		return fmt.Sprintf("%d", int(q))
+	}
+}
+
+// -------------------------------------------------------------------------------
+
+type congestionReason int
+
+const (
+	congestionReasonNone congestionReason = iota
+	congestionReasonQueuingDelay
+	congestionReasonLoss
+)
+
+func (c congestionReason) String() string {
+	switch c {
+	case congestionReasonNone:
+		return "NONE"
+	case congestionReasonQueuingDelay:
+		return "QUEUING_DELAY"
+	case congestionReasonLoss:
+		return "LOSS"
+	default:
+		return fmt.Sprintf("%d", int(c))
+	}
+}
+
+// -------------------------------------------------------------------------------
+
+type qdMeasurement struct {
+	jqrConfig              CongestionSignalConfig
+	dqrConfig              CongestionSignalConfig
+	jqrMinDelay            int64
+	jqrMinTrendCoefficient float64
+	dqrMaxDelay            int64
+
+	numGroups               int
+	numJQRGroups            int
+	numDQRGroups            int
+	minSendTime             int64
+	maxSendTime             int64
+	propagatedQueuingDelays []int64
+
+	isSealed    bool
+	minGroupIdx int
+	maxGroupIdx int
+
+	queuingRegion queuingRegion
+}
+
+func newQDMeasurement(jqrConfig CongestionSignalConfig, dqrConfig CongestionSignalConfig, jqrMinDelay int64, jqrMinTrendCoefficient float64, dqrMaxDelay int64) *qdMeasurement {
+	return &qdMeasurement{
+		jqrConfig:              jqrConfig,
+		dqrConfig:              dqrConfig,
+		jqrMinDelay:            jqrMinDelay,
+		jqrMinTrendCoefficient: jqrMinTrendCoefficient,
+		dqrMaxDelay:            dqrMaxDelay,
+		queuingRegion:          queuingRegionIndeterminate,
+	}
+}
+
+func (q *qdMeasurement) ProcessPacketGroup(pg *packetGroup, groupIdx int) {
+	if q.isSealed {
+		return
+	}
+
+	pqd, pqdOk := pg.FinalizedPropagatedQueuingDelay()
+	if !pqdOk {
+		return
+	}
+
+	q.numGroups++
+	if q.minGroupIdx == 0 || q.minGroupIdx > groupIdx {
+		q.minGroupIdx = groupIdx
+	}
+	q.maxGroupIdx = max(q.maxGroupIdx, groupIdx)
+
+	minSendTime, maxSendTime := pg.SendWindow()
+	if q.minSendTime == 0 || minSendTime < q.minSendTime {
+		q.minSendTime = minSendTime
+	}
+	q.maxSendTime = max(q.maxSendTime, maxSendTime)
+
+	q.propagatedQueuingDelays = append(q.propagatedQueuingDelays, pqd)
+
+	switch {
+	case pqd < q.dqrMaxDelay:
+		q.numDQRGroups++
+		if q.numJQRGroups > 0 {
+			// broken continuity, seal
+			q.isSealed = true
+		} else if q.dqrConfig.IsTriggered(q.numDQRGroups, q.maxSendTime-q.minSendTime) {
+			q.isSealed = true
+			q.queuingRegion = queuingRegionDQR
+		}
+
+	case pqd > q.jqrMinDelay:
+		q.numJQRGroups++
+		if q.numDQRGroups > 0 {
+			// broken continuity, seal
+			q.isSealed = true
+		} else if q.jqrConfig.IsTriggered(q.numJQRGroups, q.maxSendTime-q.minSendTime) && q.trendCoefficient() > q.jqrMinTrendCoefficient {
+			q.isSealed = true
+			q.queuingRegion = queuingRegionJQR
+		}
+
+	default:
+		if q.numDQRGroups > 0 || q.numJQRGroups > 0 {
+			// broken continuity, seal
+			q.isSealed = true
+		}
+	}
+}
+
+func (q *qdMeasurement) IsSealed() bool {
+	return q.isSealed
+}
+
+func (q *qdMeasurement) QueuingRegion() queuingRegion {
+	return q.queuingRegion
+}
+
+func (q *qdMeasurement) GroupRange() (int, int) {
+	return max(0, q.minGroupIdx), max(0, q.maxGroupIdx)
+}
+
+func (q *qdMeasurement) MarshalLogObject(e zapcore.ObjectEncoder) error {
+	if q == nil {
+		return nil
+	}
+
+	e.AddInt("numGroups", q.numGroups)
+	e.AddInt("numJQRGroups", q.numJQRGroups)
+	e.AddInt("numDQRGroups", q.numDQRGroups)
+	e.AddInt64("minSendTime", q.minSendTime)
+	e.AddInt64("maxSendTime", q.maxSendTime)
+	e.AddArray("propagatedQueuingDelays", logger.Int64Slice(q.propagatedQueuingDelays))
+	e.AddFloat64("trendCoefficient", q.trendCoefficient())
+	e.AddDuration("duration", time.Duration((q.maxSendTime-q.minSendTime)*1000))
+	e.AddBool("isSealed", q.isSealed)
+	e.AddInt("minGroupIdx", q.minGroupIdx)
+	e.AddInt("maxGroupIdx", q.maxGroupIdx)
+	e.AddString("queuingRegion", q.queuingRegion.String())
+	return nil
+}
+
+func (q *qdMeasurement) trendCoefficient() float64 {
+	concordantPairs := 0
+	discordantPairs := 0
+
+	// the packet groups are processed from newest to oldest,
+	// so a concordant pair is when the value drops,
+	// i. e. the propagated queuing delay is increasing if newer (earlier entity in slice) is higher than older (later entity in slice)
+	for i := 0; i < len(q.propagatedQueuingDelays)-1; i++ {
+		for j := i + 1; j < len(q.propagatedQueuingDelays); j++ {
+			if q.propagatedQueuingDelays[i] > q.propagatedQueuingDelays[j] {
+				concordantPairs++
+			} else if q.propagatedQueuingDelays[i] < q.propagatedQueuingDelays[j] {
+				discordantPairs++
+			}
+		}
+	}
+
+	if (concordantPairs + discordantPairs) == 0 {
+		// if the min requirements is only one sample, trend calculation is not possible, declare highest trend value
+		if len(q.propagatedQueuingDelays) == 1 {
+			return 1.0
+		}
+
+		return 0.0
+	}
+
+	return (float64(concordantPairs) - float64(discordantPairs)) / (float64(concordantPairs) + float64(discordantPairs))
+}
+
+// -------------------------------------------------------------------------------
+
+type lossMeasurement struct {
+	jqrConfig  CongestionSignalConfig
+	dqrConfig  CongestionSignalConfig
+	jqrMinLoss float64
+	dqrMaxLoss float64
+
+	numGroups int
+	ts        *trafficStats
+
+	isJQRSealed bool
+	isDQRSealed bool
+	minGroupIdx int
+	maxGroupIdx int
+
+	weightedLoss float64
+
+	queuingRegion queuingRegion
+}
+
+func newLossMeasurement(
+	jqrConfig CongestionSignalConfig,
+	dqrConfig CongestionSignalConfig,
+	weightedLossConfig WeightedLossConfig,
+	jqrMinLoss float64,
+	dqrMaxLoss float64,
+	logger logger.Logger,
+) *lossMeasurement {
+	return &lossMeasurement{
+		jqrConfig:  jqrConfig,
+		dqrConfig:  dqrConfig,
+		jqrMinLoss: jqrMinLoss,
+		dqrMaxLoss: dqrMaxLoss,
+		ts: newTrafficStats(trafficStatsParams{
+			Config: weightedLossConfig,
+			Logger: logger,
+		}),
+		queuingRegion: queuingRegionIndeterminate,
+	}
+}
+
+func (l *lossMeasurement) ProcessPacketGroup(pg *packetGroup, groupIdx int) {
+	if (l.isJQRSealed && l.isDQRSealed) || !pg.IsFinalized() {
+		return
+	}
+
+	l.numGroups++
+	if l.minGroupIdx == 0 || l.minGroupIdx > groupIdx {
+		l.minGroupIdx = groupIdx
+	}
+	l.maxGroupIdx = max(l.maxGroupIdx, groupIdx)
+
+	l.ts.Merge(pg.Traffic())
+
+	if !l.isJQRSealed && l.jqrConfig.IsTriggered(l.numGroups, l.ts.Duration()) {
+		l.isJQRSealed = true
+
+		weightedLoss := l.ts.WeightedLoss()
+		if weightedLoss > l.jqrMinLoss {
+			l.weightedLoss = weightedLoss
+			l.queuingRegion = queuingRegionJQR
+			l.isDQRSealed = true // seal DQR also as queuing region has been determined
+			return
+		}
+	}
+
+	if !l.isDQRSealed && l.dqrConfig.IsTriggered(l.numGroups, l.ts.Duration()) {
+		l.isDQRSealed = true
+
+		weightedLoss := l.ts.WeightedLoss()
+		if weightedLoss < l.dqrMaxLoss {
+			l.weightedLoss = weightedLoss
+			l.queuingRegion = queuingRegionDQR
+			l.isJQRSealed = true // seal JQR also as queuing region has been determined
+			return
+		}
+	}
+}
+
+func (l *lossMeasurement) IsSealed() bool {
+	return l.isJQRSealed && l.isDQRSealed
+}
+
+func (l *lossMeasurement) QueuingRegion() queuingRegion {
+	return l.queuingRegion
+}
+
+func (l *lossMeasurement) GroupRange() (int, int) {
+	return max(0, l.minGroupIdx), max(0, l.maxGroupIdx)
+}
+
+func (l *lossMeasurement) MarshalLogObject(e zapcore.ObjectEncoder) error {
+	if l == nil {
+		return nil
+	}
+
+	e.AddInt("numGroups", l.numGroups)
+	e.AddObject("ts", l.ts)
+	e.AddBool("isJQRSealed", l.isJQRSealed)
+	e.AddBool("isDQRSealed", l.isDQRSealed)
+	e.AddInt("minGroupIdx", l.minGroupIdx)
+	e.AddInt("maxGroupIdx", l.maxGroupIdx)
+	e.AddFloat64("weightedLoss", l.weightedLoss)
+	e.AddString("queuingRegion", l.queuingRegion.String())
+	return nil
+}
+
+// -------------------------------------------------------------------------------
+
+type CongestionDetectorConfig struct {
+	PacketGroup       PacketGroupConfig `yaml:"packet_group,omitempty"`
+	PacketGroupMaxAge time.Duration     `yaml:"packet_group_max_age,omitempty"`
+
+	ProbePacketGroup ProbePacketGroupConfig       `yaml:"probe_packet_group,omitempty"`
+	ProbeRegulator   ccutils.ProbeRegulatorConfig `yaml:"probe_regulator,omitempty"`
+	ProbeSignal      ProbeSignalConfig            `yaml:"probe_signal,omitempty"`
+
+	JQRMinDelay            time.Duration `yaml:"jqr_min_delay,omitempty"`
+	JQRMinTrendCoefficient float64       `yaml:"jqr_min_trend_coefficient,omitempty"`
+	DQRMaxDelay            time.Duration `yaml:"dqr_max_delay,omitempty"`
+
+	WeightedLoss       WeightedLossConfig `yaml:"weighted_loss,omitempty"`
+	JQRMinWeightedLoss float64            `yaml:"jqr_min_weighted_loss,omitempty"`
+	DQRMaxWeightedLoss float64            `yaml:"dqr_max_weighted_loss,omitempty"`
+
+	QueuingDelayEarlyWarningJQR CongestionSignalConfig `yaml:"queuing_delay_early_warning_jqr,omitempty"`
+	QueuingDelayEarlyWarningDQR CongestionSignalConfig `yaml:"queuing_delay_early_warning_dqr,omitempty"`
+	LossEarlyWarningJQR         CongestionSignalConfig `yaml:"loss_early_warning_jqr,omitempty"`
+	LossEarlyWarningDQR         CongestionSignalConfig `yaml:"loss_early_warning_dqr,omitempty"`
+
+	QueuingDelayCongestedJQR CongestionSignalConfig `yaml:"queuing_delay_congested_jqr,omitempty"`
+	QueuingDelayCongestedDQR CongestionSignalConfig `yaml:"queuing_delay_congested_dqr,omitempty"`
+	LossCongestedJQR         CongestionSignalConfig `yaml:"loss_congested_jqr,omitempty"`
+	LossCongestedDQR         CongestionSignalConfig `yaml:"loss_congested_dqr,omitempty"`
+
+	CongestedCTRTrend    ccutils.TrendDetectorConfig `yaml:"congested_ctr_trend,omitempty"`
+	CongestedCTREpsilon  float64                     `yaml:"congested_ctr_epsilon,omitempty"`
+	CongestedPacketGroup PacketGroupConfig           `yaml:"congested_packet_group,omitempty"`
+
+	EstimationWindowDuration time.Duration `yaml:"estimaton_window_duration,omitempty"`
+}
+
+var (
+	defaultTrendDetectorConfigCongestedCTR = ccutils.TrendDetectorConfig{
+		RequiredSamples:        4,
+		RequiredSamplesMin:     2,
+		DownwardTrendThreshold: -0.5,
+		DownwardTrendMaxWait:   2 * time.Second,
+		CollapseThreshold:      500 * time.Millisecond,
+		ValidityWindow:         10 * time.Second,
+	}
+
+	defaultCongestedPacketGroupConfig = PacketGroupConfig{
+		MinPackets:        20,
+		MaxWindowDuration: 150 * time.Millisecond,
+	}
+
+	defaultCongestionDetectorConfig = CongestionDetectorConfig{
+		PacketGroup:       defaultPacketGroupConfig,
+		PacketGroupMaxAge: 10 * time.Second,
+
+		ProbePacketGroup: defaultProbePacketGroupConfig,
+		ProbeRegulator:   ccutils.DefaultProbeRegulatorConfig,
+		ProbeSignal:      defaultProbeSignalConfig,
+
+		JQRMinDelay:            50 * time.Millisecond,
+		JQRMinTrendCoefficient: 0.8,
+		DQRMaxDelay:            20 * time.Millisecond,
+
+		WeightedLoss:       defaultWeightedLossConfig,
+		JQRMinWeightedLoss: 0.25,
+		DQRMaxWeightedLoss: 0.1,
+
+		QueuingDelayEarlyWarningJQR: defaultQueuingDelayEarlyWarningJQRConfig,
+		QueuingDelayEarlyWarningDQR: defaultQueuingDelayEarlyWarningDQRConfig,
+		LossEarlyWarningJQR:         defaultLossEarlyWarningJQRConfig,
+		LossEarlyWarningDQR:         defaultLossEarlyWarningDQRConfig,
+
+		QueuingDelayCongestedJQR: defaultQueuingDelayCongestedJQRConfig,
+		QueuingDelayCongestedDQR: defaultQueuingDelayCongestedDQRConfig,
+		LossCongestedJQR:         defaultLossCongestedJQRConfig,
+		LossCongestedDQR:         defaultLossCongestedDQRConfig,
+
+		CongestedCTRTrend:    defaultTrendDetectorConfigCongestedCTR,
+		CongestedCTREpsilon:  0.05,
+		CongestedPacketGroup: defaultCongestedPacketGroupConfig,
+
+		EstimationWindowDuration: time.Second,
+	}
+)
+
+// -------------------------------------------------------------------------------
+
+type congestionDetectorParams struct {
+	Config CongestionDetectorConfig
+	Logger logger.Logger
+}
+
+type congestionDetector struct {
+	params congestionDetectorParams
+
+	lock sync.Mutex
+
+	rtt float64
+
+	*packetTracker
+	twccFeedback *twccFeedback
+
+	packetGroups []*packetGroup
+
+	probePacketGroup *probePacketGroup
+	probeRegulator   *ccutils.ProbeRegulator
+
+	estimatedAvailableChannelCapacity int64
+	estimateTrafficStats              *trafficStats
+
+	congestionState           bwe.CongestionState
+	congestionStateSwitchedAt time.Time
+
+	congestedCTRTrend     *ccutils.TrendDetector[float64]
+	congestedTrafficStats *trafficStats
+	congestedPacketGroup  *packetGroup
+
+	congestionReason congestionReason
+	qdMeasurement    *qdMeasurement
+	lossMeasurement  *lossMeasurement
+
+	bweListener bwe.BWEListener
+}
+
+func newCongestionDetector(params congestionDetectorParams) *congestionDetector {
+	c := &congestionDetector{
+		params:        params,
+		packetTracker: newPacketTracker(packetTrackerParams{Logger: params.Logger}),
+		twccFeedback:  newTWCCFeedback(twccFeedbackParams{Logger: params.Logger}),
+	}
+	c.Reset()
+
+	return c
+}
+
+func (c *congestionDetector) Reset() {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	c.rtt = bwe.DefaultRTT
+
+	c.packetGroups = nil
+
+	c.probePacketGroup = nil
+	c.probeRegulator = ccutils.NewProbeRegulator(ccutils.ProbeRegulatorParams{
+		Config: c.params.Config.ProbeRegulator,
+		Logger: c.params.Logger,
+	})
+
+	c.estimatedAvailableChannelCapacity = 100_000_000
+	c.estimateTrafficStats = nil
+
+	c.congestionState = bwe.CongestionStateNone
+	c.congestionStateSwitchedAt = mono.Now()
+
+	c.clearCTRTrend()
+
+	c.congestionReason = congestionReasonNone
+	c.qdMeasurement = nil
+	c.lossMeasurement = nil
+}
+
+func (c *congestionDetector) SetBWEListener(bweListener bwe.BWEListener) {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	c.bweListener = bweListener
+}
+
+func (c *congestionDetector) getBWEListener() bwe.BWEListener {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	return c.bweListener
+}
+
+func (c *congestionDetector) HandleTWCCFeedback(report *rtcp.TransportLayerCC) {
+	c.lock.Lock()
+	recvRefTime, _ := c.twccFeedback.ProcessReport(report, mono.Now())
+
+	if len(c.packetGroups) == 0 {
+		c.packetGroups = append(
+			c.packetGroups,
+			newPacketGroup(
+				packetGroupParams{
+					Config:       c.params.Config.PacketGroup,
+					WeightedLoss: c.params.Config.WeightedLoss,
+					Logger:       c.params.Logger,
+				},
+				0,
+			),
+		)
+	}
+
+	pg := c.packetGroups[len(c.packetGroups)-1]
+	trackPacketGroup := func(pi *packetInfo, sendDelta, recvDelta int64, isLost bool) {
+		if pi == nil {
+			return
+		}
+
+		c.updateCTRTrend(pi, sendDelta, recvDelta, isLost)
+
+		if c.probePacketGroup != nil {
+			c.probePacketGroup.Add(pi, sendDelta, recvDelta, isLost)
+		}
+
+		err := pg.Add(pi, sendDelta, recvDelta, isLost)
+		if err == nil {
+			return
+		}
+
+		if err == errGroupFinalized {
+			// previous group ended, start a new group
+			pg = newPacketGroup(
+				packetGroupParams{
+					Config:       c.params.Config.PacketGroup,
+					WeightedLoss: c.params.Config.WeightedLoss,
+					Logger:       c.params.Logger,
+				},
+				pg.PropagatedQueuingDelay(),
+			)
+			c.packetGroups = append(c.packetGroups, pg)
+
+			if err = pg.Add(pi, sendDelta, recvDelta, isLost); err != nil {
+				c.params.Logger.Warnw("send side bwe: could not add packet to new packet group", err, "packetInfo", pi, "packetGroup", pg)
+			}
+			return
+		}
+
+		// try an older group
+		for idx := len(c.packetGroups) - 2; idx >= 0; idx-- {
+			opg := c.packetGroups[idx]
+			if err := opg.Add(pi, sendDelta, recvDelta, isLost); err == nil {
+				return
+			} else if err == errGroupFinalized {
+				c.params.Logger.Infow("send side bwe: unexpected finalized group", "packetInfo", pi, "packetGroup", opg)
+			}
+		}
+	}
+
+	// 1. go through the TWCC feedback report and record receive time as reported by remote
+	// 2. process acknowledged packet and group them
+	//
+	// losses are not recorded if a feedback report is completely lost.
+	// RFC recommends treating lost reports by ignoring packets that would have been in it.
+	// -----------------------------------------------------------------------------------
+	// | From a congestion control perspective, lost feedback messages are               |
+	// | handled by ignoring packets which would have been reported as lost or           |
+	// | received in the lost feedback messages.  This behavior is similar to            |
+	// | how a lost RTCP receiver report is handled.                                     |
+	// -----------------------------------------------------------------------------------
+	// Reference: https://datatracker.ietf.org/doc/html/draft-holmer-rmcat-transport-wide-cc-extensions-01#page-4
+	sequenceNumber := report.BaseSequenceNumber
+	endSequenceNumberExclusive := sequenceNumber + report.PacketStatusCount
+	deltaIdx := 0
+	processSymbol := func(symbol uint16) {
+		recvTime := int64(0)
+		isLost := false
+		if symbol != rtcp.TypeTCCPacketNotReceived {
+			recvRefTime += report.RecvDeltas[deltaIdx].Delta
+			deltaIdx++
+
+			recvTime = recvRefTime
+		} else {
+			isLost = true
+		}
+		pi, sendDelta, recvDelta := c.packetTracker.RecordPacketIndicationFromRemote(sequenceNumber, recvTime)
+		if pi.sendTime != 0 {
+			trackPacketGroup(&pi, sendDelta, recvDelta, isLost)
+		}
+		sequenceNumber++
+	}
+	for _, chunk := range report.PacketChunks {
+		if sequenceNumber == endSequenceNumberExclusive {
+			break
+		}
+
+		switch chunk := chunk.(type) {
+		case *rtcp.RunLengthChunk:
+			for i := uint16(0); i < chunk.RunLength; i++ {
+				if sequenceNumber == endSequenceNumberExclusive {
+					break
+				}
+
+				processSymbol(chunk.PacketStatusSymbol)
+			}
+
+		case *rtcp.StatusVectorChunk:
+			for _, symbol := range chunk.SymbolList {
+				if sequenceNumber == endSequenceNumberExclusive {
+					break
+				}
+
+				processSymbol(symbol)
+			}
+		}
+	}
+
+	c.prunePacketGroups()
+	shouldNotify, fromState, toState, committedChannelCapacity := c.congestionDetectionStateMachine()
+	c.lock.Unlock()
+
+	if shouldNotify {
+		if bweListener := c.getBWEListener(); bweListener != nil {
+			bweListener.OnCongestionStateChange(fromState, toState, committedChannelCapacity)
+		}
+	}
+}
+
+func (c *congestionDetector) UpdateRTT(rtt float64) {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	if rtt == 0 {
+		c.rtt = bwe.DefaultRTT
+	} else {
+		if c.rtt == 0 {
+			c.rtt = rtt
+		} else {
+			c.rtt = bwe.RTTSmoothingFactor*rtt + (1.0-bwe.RTTSmoothingFactor)*c.rtt
+		}
+	}
+}
+
+func (c *congestionDetector) CongestionState() bwe.CongestionState {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	return c.congestionState
+}
+
+func (c *congestionDetector) CanProbe() bool {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	return c.congestionState == bwe.CongestionStateNone && c.probePacketGroup == nil && c.probeRegulator.CanProbe()
+}
+
+func (c *congestionDetector) ProbeDuration() time.Duration {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	return c.probeRegulator.ProbeDuration()
+}
+
+func (c *congestionDetector) ProbeClusterStarting(pci ccutils.ProbeClusterInfo) {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	c.probePacketGroup = newProbePacketGroup(
+		probePacketGroupParams{
+			Config:       c.params.Config.ProbePacketGroup,
+			WeightedLoss: c.params.Config.WeightedLoss,
+			Logger:       c.params.Logger,
+		},
+		pci,
+	)
+
+	c.packetTracker.ProbeClusterStarting(pci.Id)
+}
+
+func (c *congestionDetector) ProbeClusterDone(pci ccutils.ProbeClusterInfo) {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	c.packetTracker.ProbeClusterDone(pci.Id)
+	if c.probePacketGroup != nil {
+		c.probePacketGroup.ProbeClusterDone(pci)
+	}
+}
+
+func (c *congestionDetector) ProbeClusterIsGoalReached() bool {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	if c.probePacketGroup == nil || c.congestionState != bwe.CongestionStateNone {
+		return false
+	}
+
+	pci := c.probePacketGroup.ProbeClusterInfo()
+	if !c.params.Config.ProbeSignal.IsValid(pci) {
+		return false
+	}
+
+	probeSignal, estimatedAvailableChannelCapacity := c.params.Config.ProbeSignal.ProbeSignal(c.probePacketGroup)
+	return probeSignal != ccutils.ProbeSignalNotCongesting && estimatedAvailableChannelCapacity > int64(pci.Goal.DesiredBps)
+}
+
+func (c *congestionDetector) ProbeClusterFinalize() (ccutils.ProbeSignal, int64, bool) {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	if c.probePacketGroup == nil {
+		return ccutils.ProbeSignalInconclusive, 0, false
+	}
+
+	pci, isFinalized := c.probePacketGroup.MaybeFinalizeProbe(c.packetTracker.ProbeMaxSequenceNumber(), c.rtt)
+	if !isFinalized {
+		return ccutils.ProbeSignalInconclusive, 0, isFinalized
+	}
+
+	isSignalValid := c.params.Config.ProbeSignal.IsValid(pci)
+	c.params.Logger.Infow(
+		"send side bwe: probe finalized",
+		"isSignalValid", isSignalValid,
+		"probeClusterInfo", pci,
+		"probePacketGroup", c.probePacketGroup,
+		"congestionState", c.congestionState,
+		"rtt", c.rtt,
+	)
+
+	// if congestion signal changed during probe, defer to that signal
+	if c.congestionState != bwe.CongestionStateNone {
+		probeSignal := ccutils.ProbeSignalCongesting
+		c.probeRegulator.ProbeSignal(probeSignal, pci.CreatedAt)
+		c.probePacketGroup = nil
+		return probeSignal, c.estimatedAvailableChannelCapacity, true
+	}
+
+	probeSignal, estimatedAvailableChannelCapacity := c.params.Config.ProbeSignal.ProbeSignal(c.probePacketGroup)
+	if !isSignalValid || estimatedAvailableChannelCapacity <= 0 {
+		probeSignal = ccutils.ProbeSignalInconclusive
+	}
+	if probeSignal == ccutils.ProbeSignalNotCongesting && estimatedAvailableChannelCapacity > c.estimatedAvailableChannelCapacity {
+		c.estimatedAvailableChannelCapacity = estimatedAvailableChannelCapacity
+	}
+
+	c.probeRegulator.ProbeSignal(probeSignal, pci.CreatedAt)
+	c.probePacketGroup = nil
+	return probeSignal, estimatedAvailableChannelCapacity, true
+}
+
+func (c *congestionDetector) prunePacketGroups() {
+	if len(c.packetGroups) == 0 {
+		return
+	}
+
+	threshold, ok := c.packetTracker.BaseSendTimeThreshold(c.params.Config.PacketGroupMaxAge.Microseconds())
+	if !ok {
+		return
+	}
+
+	for idx, pg := range c.packetGroups {
+		if mst := pg.MinSendTime(); mst > threshold {
+			c.packetGroups = c.packetGroups[idx:]
+			return
+		}
+	}
+}
+
+func (c *congestionDetector) updateCongestionSignal(
+	qdJQRConfig CongestionSignalConfig,
+	qdDQRConfig CongestionSignalConfig,
+	lossJQRConfig CongestionSignalConfig,
+	lossDQRConfig CongestionSignalConfig,
+) queuingRegion {
+	c.qdMeasurement = newQDMeasurement(
+		qdJQRConfig,
+		qdDQRConfig,
+		c.params.Config.JQRMinDelay.Microseconds(),
+		c.params.Config.JQRMinTrendCoefficient,
+		c.params.Config.DQRMaxDelay.Microseconds(),
+	)
+	c.lossMeasurement = newLossMeasurement(
+		lossJQRConfig,
+		lossDQRConfig,
+		c.params.Config.WeightedLoss,
+		c.params.Config.JQRMinWeightedLoss,
+		c.params.Config.DQRMaxWeightedLoss,
+		c.params.Logger,
+	)
+
+	var idx int
+	for idx = len(c.packetGroups) - 1; idx >= 0; idx-- {
+		pg := c.packetGroups[idx]
+		c.qdMeasurement.ProcessPacketGroup(pg, idx)
+		c.lossMeasurement.ProcessPacketGroup(pg, idx)
+
+		// if both measurements have enough data to make a decision, stop processing groups
+		if c.qdMeasurement.IsSealed() && c.lossMeasurement.IsSealed() {
+			break
+		}
+	}
+
+	qr := queuingRegionIndeterminate
+	qdQueuingRegion := c.qdMeasurement.QueuingRegion()
+	lossQueuingRegion := c.lossMeasurement.QueuingRegion()
+	switch {
+	case qdQueuingRegion == queuingRegionJQR:
+		qr = queuingRegionJQR
+		c.congestionReason = congestionReasonQueuingDelay
+	case lossQueuingRegion == queuingRegionJQR:
+		qr = queuingRegionJQR
+		c.congestionReason = congestionReasonLoss
+	case qdQueuingRegion == queuingRegionDQR && lossQueuingRegion == queuingRegionDQR:
+		qr = queuingRegionDQR
+		c.congestionReason = congestionReasonNone
+	}
+
+	return qr
+}
+
+func (c *congestionDetector) updateEarlyWarningSignal() queuingRegion {
+	return c.updateCongestionSignal(
+		c.params.Config.QueuingDelayEarlyWarningJQR,
+		c.params.Config.QueuingDelayEarlyWarningDQR,
+		c.params.Config.LossEarlyWarningJQR,
+		c.params.Config.LossEarlyWarningDQR,
+	)
+}
+
+func (c *congestionDetector) updateCongestedSignal() queuingRegion {
+	return c.updateCongestionSignal(
+		c.params.Config.QueuingDelayCongestedJQR,
+		c.params.Config.QueuingDelayCongestedDQR,
+		c.params.Config.LossCongestedJQR,
+		c.params.Config.LossCongestedDQR,
+	)
+}
+
+func (c *congestionDetector) congestionDetectionStateMachine() (bool, bwe.CongestionState, bwe.CongestionState, int64) {
+	fromState := c.congestionState
+	toState := c.congestionState
+
+	switch fromState {
+	case bwe.CongestionStateNone:
+		if c.updateEarlyWarningSignal() == queuingRegionJQR {
+			toState = bwe.CongestionStateEarlyWarning
+		}
+
+	case bwe.CongestionStateEarlyWarning:
+		if c.updateCongestedSignal() == queuingRegionJQR {
+			toState = bwe.CongestionStateCongested
+		} else if c.updateEarlyWarningSignal() == queuingRegionDQR {
+			toState = bwe.CongestionStateNone
+		}
+
+	case bwe.CongestionStateCongested:
+		if c.updateCongestedSignal() == queuingRegionDQR {
+			toState = bwe.CongestionStateNone
+		}
+	}
+
+	shouldNotify := false
+	if toState != fromState {
+		c.estimateAvailableChannelCapacity()
+		fromState, toState = c.updateCongestionState(toState)
+		shouldNotify = true
+	}
+
+	if c.congestedCTRTrend != nil && c.congestedCTRTrend.GetDirection() == ccutils.TrendDirectionDownward {
+		congestedAckedBitrate := c.congestedTrafficStats.AcknowledgedBitrate()
+		if congestedAckedBitrate < c.estimatedAvailableChannelCapacity {
+			c.estimatedAvailableChannelCapacity = congestedAckedBitrate
+
+			c.params.Logger.Infow(
+				"send side bwe: captured traffic ratio is trending downward",
+				"channel", c.congestedCTRTrend,
+				"trafficStats", c.congestedTrafficStats,
+				"estimatedAvailableChannelCapacity", c.estimatedAvailableChannelCapacity,
+			)
+
+			shouldNotify = true
+		}
+
+		// reset to get new set of samples for next trend
+		c.resetCTRTrend()
+	}
+
+	return shouldNotify, fromState, toState, c.estimatedAvailableChannelCapacity
+}
+
+func (c *congestionDetector) createCTRTrend() {
+	c.resetCTRTrend()
+	c.congestedPacketGroup = nil
+}
+
+func (c *congestionDetector) resetCTRTrend() {
+	c.congestedCTRTrend = ccutils.NewTrendDetector[float64](ccutils.TrendDetectorParams{
+		Name:   "ssbwe-ctr",
+		Logger: c.params.Logger,
+		Config: c.params.Config.CongestedCTRTrend,
+	})
+	c.congestedTrafficStats = newTrafficStats(trafficStatsParams{
+		Config: c.params.Config.WeightedLoss,
+		Logger: c.params.Logger,
+	})
+}
+
+func (c *congestionDetector) clearCTRTrend() {
+	c.congestedCTRTrend = nil
+	c.congestedTrafficStats = nil
+	c.congestedPacketGroup = nil
+}
+
+func (c *congestionDetector) updateCTRTrend(pi *packetInfo, sendDelta, recvDelta int64, isLost bool) {
+	if c.congestedCTRTrend == nil {
+		return
+	}
+
+	if c.congestedPacketGroup == nil {
+		c.congestedPacketGroup = newPacketGroup(
+			packetGroupParams{
+				Config:       c.params.Config.CongestedPacketGroup,
+				WeightedLoss: c.params.Config.WeightedLoss,
+				Logger:       c.params.Logger,
+			},
+			0,
+		)
+	}
+
+	if err := c.congestedPacketGroup.Add(pi, sendDelta, recvDelta, isLost); err == errGroupFinalized {
+		// progressively keep increasing the window and make measurements over longer windows,
+		// if congestion is not relieving, CTR will trend down
+		c.congestedTrafficStats.Merge(c.congestedPacketGroup.Traffic())
+
+		ts := newTrafficStats(trafficStatsParams{
+			Config: c.params.Config.WeightedLoss,
+			Logger: c.params.Logger,
+		})
+		ts.Merge(c.congestedPacketGroup.Traffic())
+		ctr := ts.CapturedTrafficRatio()
+
+		// quantise CTR to filter out small changes
+		c.congestedCTRTrend.AddValue(float64(int((ctr+(c.params.Config.CongestedCTREpsilon/2))/c.params.Config.CongestedCTREpsilon)) * c.params.Config.CongestedCTREpsilon)
+
+		c.congestedPacketGroup = newPacketGroup(
+			packetGroupParams{
+				Config:       c.params.Config.CongestedPacketGroup,
+				WeightedLoss: c.params.Config.WeightedLoss,
+				Logger:       c.params.Logger,
+			},
+			c.congestedPacketGroup.PropagatedQueuingDelay(),
+		)
+	}
+}
+
+func (c *congestionDetector) estimateAvailableChannelCapacity() {
+	c.estimateTrafficStats = nil
+	if len(c.packetGroups) == 0 || c.probePacketGroup != nil {
+		return
+	}
+
+	// when congested, use contributing groups,
+	// else use a time windowed measurement
+	useWindow := false
+	isAggValid := true
+	minGroupIdx := 0
+	maxGroupIdx := len(c.packetGroups) - 1
+	switch c.congestionReason {
+	case congestionReasonQueuingDelay:
+		minGroupIdx, maxGroupIdx = c.qdMeasurement.GroupRange()
+	case congestionReasonLoss:
+		minGroupIdx, maxGroupIdx = c.lossMeasurement.GroupRange()
+	default:
+		useWindow = true
+		isAggValid = false
+	}
+
+	agg := newTrafficStats(trafficStatsParams{
+		Config: c.params.Config.WeightedLoss,
+		Logger: c.params.Logger,
+	})
+	for idx := maxGroupIdx; idx >= minGroupIdx; idx-- {
+		pg := c.packetGroups[idx]
+		if !pg.IsFinalized() {
+			continue
+		}
+
+		agg.Merge(pg.Traffic())
+		if useWindow && agg.Duration() > c.params.Config.EstimationWindowDuration.Microseconds() {
+			isAggValid = true
+			break
+		}
+	}
+
+	if isAggValid {
+		c.estimatedAvailableChannelCapacity = agg.AcknowledgedBitrate()
+		c.estimateTrafficStats = agg
+	}
+}
+
+func (c *congestionDetector) updateCongestionState(state bwe.CongestionState) (bwe.CongestionState, bwe.CongestionState) {
+	loggingFields := []any{
+		"from", c.congestionState,
+		"to", state,
+		"congestionReason", c.congestionReason,
+		"qdMeasurement", c.qdMeasurement,
+		"lossMeasurement", c.lossMeasurement,
+		"numPacketGroups", len(c.packetGroups),
+		"estimatedAvailableChannelCapacity", c.estimatedAvailableChannelCapacity,
+		"estimateTrafficStats", c.estimateTrafficStats,
+	}
+	if c.congestionReason != congestionReasonNone {
+		var minGroupIdx, maxGroupIdx int
+		switch c.congestionReason {
+		case congestionReasonQueuingDelay:
+			minGroupIdx, maxGroupIdx = c.qdMeasurement.GroupRange()
+		case congestionReasonLoss:
+			minGroupIdx, maxGroupIdx = c.lossMeasurement.GroupRange()
+		}
+		loggingFields = append(
+			loggingFields,
+			"contributingGroups", logger.ObjectSlice(c.packetGroups[minGroupIdx:maxGroupIdx+1]),
+		)
+	}
+	c.params.Logger.Infow("send side bwe: congestion state change", loggingFields...)
+
+	if state != c.congestionState {
+		c.congestionStateSwitchedAt = mono.Now()
+	}
+
+	fromState := c.congestionState
+	c.congestionState = state
+
+	// when in congested state, monitor changes in captured traffic ratio (CTR)
+	// to ensure allocations are in line with latest estimates, it is possible that
+	// the estimate is incorrect when congestion starts and the allocation may be
+	// sub-optimal and not enough to reduce/relieve congestion, by monitoring CTR
+	// on a continuous basis allocations can be adjusted in the direction of
+	// reducing/relieving congestion
+	if state == bwe.CongestionStateCongested && fromState != bwe.CongestionStateCongested {
+		c.createCTRTrend()
+	} else if state != bwe.CongestionStateCongested {
+		c.clearCTRTrend()
+	}
+
+	return fromState, c.congestionState
+}
diff --git a/internal/thirdparty/livekit/sendsidebwe/packet_group.go b/internal/thirdparty/livekit/sendsidebwe/packet_group.go
new file mode 100644
index 000000000..b64727fdf
--- /dev/null
+++ b/internal/thirdparty/livekit/sendsidebwe/packet_group.go
@@ -0,0 +1,310 @@
+// Copyright 2023 LiveKit, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package sendsidebwe
+
+import (
+	"errors"
+	"time"
+
+	"github.com/livekit/protocol/logger"
+	"github.com/livekit/protocol/utils"
+	"go.uber.org/zap/zapcore"
+)
+
+// -------------------------------------------------------------
+
+var (
+	errGroupFinalized = errors.New("packet group is finalized")
+	errOldPacket      = errors.New("packet is older than packet group start")
+)
+
+// -------------------------------------------------------------
+
+type PacketGroupConfig struct {
+	MinPackets        int           `yaml:"min_packets,omitempty"`
+	MaxWindowDuration time.Duration `yaml:"max_window_duration,omitempty"`
+}
+
+var (
+	defaultPacketGroupConfig = PacketGroupConfig{
+		MinPackets:        30,
+		MaxWindowDuration: 500 * time.Millisecond,
+	}
+)
+
+// -------------------------------------------------------------
+
+type stat struct {
+	numPackets int
+	numBytes   int
+}
+
+func (s *stat) add(size int) {
+	s.numPackets++
+	s.numBytes += size
+}
+
+func (s *stat) remove(size int) {
+	s.numPackets--
+	s.numBytes -= size
+}
+
+func (s *stat) getNumPackets() int {
+	return s.numPackets
+}
+
+func (s *stat) getNumBytes() int {
+	return s.numBytes
+}
+
+func (s stat) MarshalLogObject(e zapcore.ObjectEncoder) error {
+	e.AddInt("numPackets", s.numPackets)
+	e.AddInt("numBytes", s.numBytes)
+	return nil
+}
+
+// -------------------------------------------------------------
+
+type classStat struct {
+	primary stat
+	rtx     stat
+	probe   stat
+}
+
+func (c *classStat) add(size int, isRTX bool, isProbe bool) {
+	if isRTX {
+		c.rtx.add(size)
+	} else if isProbe {
+		c.probe.add(size)
+	} else {
+		c.primary.add(size)
+	}
+}
+
+func (c *classStat) remove(size int, isRTX bool, isProbe bool) {
+	if isRTX {
+		c.rtx.remove(size)
+	} else if isProbe {
+		c.probe.remove(size)
+	} else {
+		c.primary.remove(size)
+	}
+}
+
+func (c *classStat) numPackets() int {
+	return c.primary.getNumPackets() + c.rtx.getNumPackets() + c.probe.getNumPackets()
+}
+
+func (c *classStat) numBytes() int {
+	return c.primary.getNumBytes() + c.rtx.getNumBytes() + c.probe.getNumBytes()
+}
+
+func (c classStat) MarshalLogObject(e zapcore.ObjectEncoder) error {
+	e.AddObject("primary", c.primary)
+	e.AddObject("rtx", c.rtx)
+	e.AddObject("probe", c.probe)
+	return nil
+}
+
+// -------------------------------------------------------------
+
+type packetGroupParams struct {
+	Config       PacketGroupConfig
+	WeightedLoss WeightedLossConfig
+	Logger       logger.Logger
+}
+
+type packetGroup struct {
+	params packetGroupParams
+
+	minSequenceNumber uint64
+	maxSequenceNumber uint64
+
+	minSendTime int64
+	maxSendTime int64
+
+	minRecvTime int64 // for information only
+	maxRecvTime int64 // for information only
+
+	acked    classStat
+	lost     classStat
+	snBitmap *utils.Bitmap[uint64]
+
+	aggregateSendDelta    int64
+	aggregateRecvDelta    int64
+	inheritedQueuingDelay int64
+
+	isFinalized bool
+}
+
+func newPacketGroup(params packetGroupParams, inheritedQueuingDelay int64) *packetGroup {
+	return &packetGroup{
+		params:                params,
+		inheritedQueuingDelay: inheritedQueuingDelay,
+		snBitmap:              utils.NewBitmap[uint64](params.Config.MinPackets),
+	}
+}
+
+func (p *packetGroup) Add(pi *packetInfo, sendDelta, recvDelta int64, isLost bool) error {
+	if isLost {
+		return p.lostPacket(pi)
+	}
+
+	if err := p.inGroup(pi.sequenceNumber); err != nil {
+		return err
+	}
+
+	if p.minSequenceNumber == 0 || pi.sequenceNumber < p.minSequenceNumber {
+		p.minSequenceNumber = pi.sequenceNumber
+	}
+	p.maxSequenceNumber = max(p.maxSequenceNumber, pi.sequenceNumber)
+
+	if p.minSendTime == 0 || (pi.sendTime-sendDelta) < p.minSendTime {
+		p.minSendTime = pi.sendTime - sendDelta
+	}
+	p.maxSendTime = max(p.maxSendTime, pi.sendTime)
+
+	if p.minRecvTime == 0 || (pi.recvTime-recvDelta) < p.minRecvTime {
+		p.minRecvTime = pi.recvTime - recvDelta
+	}
+	p.maxRecvTime = max(p.maxRecvTime, pi.recvTime)
+
+	p.acked.add(int(pi.size), pi.isRTX, pi.isProbe)
+	if int(pi.sequenceNumber-p.minSequenceNumber) < p.snBitmap.Len() && p.snBitmap.IsSet(pi.sequenceNumber-p.minSequenceNumber) {
+		// an earlier packet reported as lost has been received
+		p.snBitmap.Clear(pi.sequenceNumber - p.minSequenceNumber)
+		p.lost.remove(int(pi.size), pi.isRTX, pi.isProbe)
+	}
+
+	// note that out-of-order deliveries will amplify the queueing delay.
+	// for e.g. a, b, c getting delivered as a, c, b.
+	// let us say packets are delivered with interval of `x`
+	//   send delta aggregate will go up by x((a, c) = 2x + (c, b) -1x)
+	//   recv delta aggregate will go up by 3x((a, c) = 2x + (c, b) 1x)
+	p.aggregateSendDelta += sendDelta
+	p.aggregateRecvDelta += recvDelta
+
+	if p.acked.numPackets() == p.params.Config.MinPackets || (pi.sendTime-p.minSendTime) > p.params.Config.MaxWindowDuration.Microseconds() {
+		p.isFinalized = true
+	}
+	return nil
+}
+
+func (p *packetGroup) lostPacket(pi *packetInfo) error {
+	if pi.recvTime != 0 {
+		// previously received packet, so not lost
+		return nil
+	}
+
+	if err := p.inGroup(pi.sequenceNumber); err != nil {
+		return err
+	}
+
+	if p.minSequenceNumber == 0 || pi.sequenceNumber < p.minSequenceNumber {
+		p.minSequenceNumber = pi.sequenceNumber
+	}
+	p.maxSequenceNumber = max(p.maxSequenceNumber, pi.sequenceNumber)
+	p.snBitmap.Set(pi.sequenceNumber - p.minSequenceNumber)
+
+	p.lost.add(int(pi.size), pi.isRTX, pi.isProbe)
+	return nil
+}
+
+func (p *packetGroup) MinSendTime() int64 {
+	return p.minSendTime
+}
+
+func (p *packetGroup) SendWindow() (int64, int64) {
+	return p.minSendTime, p.maxSendTime
+}
+
+func (p *packetGroup) PropagatedQueuingDelay() int64 {
+	if p.inheritedQueuingDelay+p.aggregateRecvDelta-p.aggregateSendDelta > 0 {
+		return p.inheritedQueuingDelay + p.aggregateRecvDelta - p.aggregateSendDelta
+	}
+
+	return max(0, p.aggregateRecvDelta-p.aggregateSendDelta)
+}
+
+func (p *packetGroup) FinalizedPropagatedQueuingDelay() (int64, bool) {
+	if !p.isFinalized {
+		return 0, false
+	}
+
+	return p.PropagatedQueuingDelay(), true
+}
+
+func (p *packetGroup) IsFinalized() bool {
+	return p.isFinalized
+}
+
+func (p *packetGroup) Traffic() *trafficStats {
+	return &trafficStats{
+		minSendTime:  p.minSendTime,
+		maxSendTime:  p.maxSendTime,
+		sendDelta:    p.aggregateSendDelta,
+		recvDelta:    p.aggregateRecvDelta,
+		ackedPackets: p.acked.numPackets(),
+		ackedBytes:   p.acked.numBytes(),
+		lostPackets:  p.lost.numPackets(),
+		lostBytes:    p.lost.numBytes(),
+	}
+}
+
+func (p *packetGroup) MarshalLogObject(e zapcore.ObjectEncoder) error {
+	if p == nil {
+		return nil
+	}
+
+	e.AddUint64("minSequenceNumber", p.minSequenceNumber)
+	e.AddUint64("maxSequenceNumber", p.maxSequenceNumber)
+	e.AddObject("acked", p.acked)
+	e.AddObject("lost", p.lost)
+
+	e.AddInt64("minRecvTime", p.minRecvTime)
+	e.AddInt64("maxRecvTime", p.maxRecvTime)
+	recvDuration := time.Duration((p.maxRecvTime - p.minRecvTime) * 1000)
+	e.AddDuration("recvDuration", recvDuration)
+
+	recvBitrate := float64(0)
+	if recvDuration != 0 {
+		recvBitrate = float64(p.acked.numBytes()*8) / recvDuration.Seconds()
+		e.AddFloat64("recvBitrate", recvBitrate)
+	}
+
+	ts := newTrafficStats(trafficStatsParams{
+		Config: p.params.WeightedLoss,
+		Logger: p.params.Logger,
+	})
+	ts.Merge(p.Traffic())
+	e.AddObject("trafficStats", ts)
+	e.AddInt64("inheritedQueuingDelay", p.inheritedQueuingDelay)
+	e.AddInt64("propagatedQueuingDelay", p.PropagatedQueuingDelay())
+
+	e.AddBool("isFinalized", p.isFinalized)
+	return nil
+}
+
+func (p *packetGroup) inGroup(sequenceNumber uint64) error {
+	if p.isFinalized && sequenceNumber > p.maxSequenceNumber {
+		return errGroupFinalized
+	}
+
+	if sequenceNumber < p.minSequenceNumber {
+		return errOldPacket
+	}
+
+	return nil
+}
diff --git a/internal/thirdparty/livekit/sendsidebwe/packet_info.go b/internal/thirdparty/livekit/sendsidebwe/packet_info.go
new file mode 100644
index 000000000..730e2a7e6
--- /dev/null
+++ b/internal/thirdparty/livekit/sendsidebwe/packet_info.go
@@ -0,0 +1,45 @@
+// Copyright 2023 LiveKit, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package sendsidebwe
+
+import (
+	"github.com/livekit/livekit-server/pkg/sfu/ccutils"
+	"go.uber.org/zap/zapcore"
+)
+
+type packetInfo struct {
+	sequenceNumber uint64
+	sendTime       int64
+	recvTime       int64
+	probeClusterId ccutils.ProbeClusterId
+	size           uint16
+	isRTX          bool
+	isProbe        bool
+}
+
+func (pi *packetInfo) MarshalLogObject(e zapcore.ObjectEncoder) error {
+	if pi == nil {
+		return nil
+	}
+
+	e.AddUint64("sequenceNumber", pi.sequenceNumber)
+	e.AddInt64("sendTime", pi.sendTime)
+	e.AddInt64("recvTime", pi.recvTime)
+	e.AddUint32("probeClusterId", uint32(pi.probeClusterId))
+	e.AddUint16("size", pi.size)
+	e.AddBool("isRTX", pi.isRTX)
+	e.AddBool("isProbe", pi.isProbe)
+	return nil
+}
diff --git a/internal/thirdparty/livekit/sendsidebwe/packet_tracker.go b/internal/thirdparty/livekit/sendsidebwe/packet_tracker.go
new file mode 100644
index 000000000..a41e50fee
--- /dev/null
+++ b/internal/thirdparty/livekit/sendsidebwe/packet_tracker.go
@@ -0,0 +1,168 @@
+// Copyright 2023 LiveKit, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package sendsidebwe
+
+import (
+	"math/rand"
+	"sync"
+
+	"github.com/livekit/livekit-server/pkg/sfu/ccutils"
+	"github.com/livekit/protocol/logger"
+	"github.com/livekit/protocol/utils/mono"
+)
+
+// -------------------------------------------------------------------------------
+
+type packetTrackerParams struct {
+	Logger logger.Logger
+}
+
+type packetTracker struct {
+	params packetTrackerParams
+
+	lock sync.Mutex
+
+	sequenceNumber uint64
+
+	baseSendTime int64
+	packetInfos  [2048]packetInfo
+
+	baseRecvTime int64
+	piLastRecv   *packetInfo
+
+	probeClusterId         ccutils.ProbeClusterId
+	probeMaxSequenceNumber uint64
+}
+
+func newPacketTracker(params packetTrackerParams) *packetTracker {
+	return &packetTracker{
+		params:         params,
+		sequenceNumber: uint64(rand.Intn(1<<14)) + uint64(1<<15), // a random number in third quartile of sequence number space
+	}
+}
+
+func (p *packetTracker) RecordPacketSendAndGetSequenceNumber(
+	atMicro int64,
+	size int,
+	isRTX bool,
+	probeClusterId ccutils.ProbeClusterId,
+	isProbe bool,
+) uint16 {
+	p.lock.Lock()
+	defer p.lock.Unlock()
+
+	if p.baseSendTime == 0 {
+		p.baseSendTime = atMicro
+	}
+
+	pi := p.getPacketInfo(uint16(p.sequenceNumber))
+	*pi = packetInfo{
+		sequenceNumber: p.sequenceNumber,
+		sendTime:       atMicro - p.baseSendTime,
+		size:           uint16(size),
+		isRTX:          isRTX,
+		probeClusterId: probeClusterId,
+		isProbe:        isProbe,
+	}
+
+	p.sequenceNumber++
+
+	// extreme case of wrap around before receiving any feedback
+	if pi == p.piLastRecv {
+		p.piLastRecv = nil
+	}
+
+	if p.probeClusterId != ccutils.ProbeClusterIdInvalid && p.probeClusterId == pi.probeClusterId && pi.sequenceNumber > p.probeMaxSequenceNumber {
+		p.probeMaxSequenceNumber = pi.sequenceNumber
+	}
+
+	return uint16(pi.sequenceNumber)
+}
+
+func (p *packetTracker) BaseSendTimeThreshold(threshold int64) (int64, bool) {
+	p.lock.Lock()
+	defer p.lock.Unlock()
+
+	if p.baseSendTime == 0 {
+		return 0, false
+	}
+
+	return mono.UnixMicro() - p.baseSendTime - threshold, true
+}
+
+func (p *packetTracker) RecordPacketIndicationFromRemote(sn uint16, recvTime int64) (piRecv packetInfo, sendDelta, recvDelta int64) {
+	p.lock.Lock()
+	defer p.lock.Unlock()
+
+	pi := p.getPacketInfoExisting(sn)
+	if pi == nil {
+		return
+	}
+
+	if recvTime == 0 {
+		// maybe lost OR already received but reported lost in a later report
+		piRecv = *pi
+		return
+	}
+
+	if p.baseRecvTime == 0 {
+		p.baseRecvTime = recvTime
+		p.piLastRecv = pi
+	}
+
+	pi.recvTime = recvTime - p.baseRecvTime
+	piRecv = *pi
+	if p.piLastRecv != nil {
+		sendDelta, recvDelta = pi.sendTime-p.piLastRecv.sendTime, pi.recvTime-p.piLastRecv.recvTime
+	}
+	p.piLastRecv = pi
+	return
+}
+
+func (p *packetTracker) getPacketInfo(sn uint16) *packetInfo {
+	return &p.packetInfos[int(sn)%len(p.packetInfos)]
+}
+
+func (p *packetTracker) getPacketInfoExisting(sn uint16) *packetInfo {
+	pi := &p.packetInfos[int(sn)%len(p.packetInfos)]
+	if uint16(pi.sequenceNumber) == sn {
+		return pi
+	}
+
+	return nil
+}
+
+func (p *packetTracker) ProbeClusterStarting(probeClusterId ccutils.ProbeClusterId) {
+	p.lock.Lock()
+	defer p.lock.Unlock()
+
+	p.probeClusterId = probeClusterId
+}
+
+func (p *packetTracker) ProbeClusterDone(probeClusterId ccutils.ProbeClusterId) {
+	p.lock.Lock()
+	defer p.lock.Unlock()
+
+	if p.probeClusterId == probeClusterId {
+		p.probeClusterId = ccutils.ProbeClusterIdInvalid
+	}
+}
+
+func (p *packetTracker) ProbeMaxSequenceNumber() uint64 {
+	p.lock.Lock()
+	defer p.lock.Unlock()
+
+	return p.probeMaxSequenceNumber
+}
diff --git a/internal/thirdparty/livekit/sendsidebwe/probe_packet_group.go b/internal/thirdparty/livekit/sendsidebwe/probe_packet_group.go
new file mode 100644
index 000000000..8d0d1d72a
--- /dev/null
+++ b/internal/thirdparty/livekit/sendsidebwe/probe_packet_group.go
@@ -0,0 +1,143 @@
+// Copyright 2023 LiveKit, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Modified by Piik: start probe timing at its first acknowledged packet.
+package sendsidebwe
+
+import (
+	"time"
+
+	"github.com/livekit/livekit-server/pkg/sfu/ccutils"
+	"github.com/livekit/protocol/logger"
+	"github.com/livekit/protocol/utils/mono"
+	"go.uber.org/zap/zapcore"
+)
+
+// -------------------------------------------------------------
+
+type ProbePacketGroupConfig struct {
+	PacketGroup PacketGroupConfig `yaml:"packet_group,omitempty"`
+
+	SettleWaitNumRTT uint32        `yaml:"settle_wait_num_rtt,omitempty"`
+	SettleWaitMin    time.Duration `yaml:"settle_wait_min,omitempty"`
+	SettleWaitMax    time.Duration `yaml:"settle_wait_max,omitempty"`
+}
+
+var (
+	// large numbers to treat a probe packet group as one
+	defaultProbePacketGroupConfig = ProbePacketGroupConfig{
+		PacketGroup: PacketGroupConfig{
+			MinPackets:        16384,
+			MaxWindowDuration: time.Minute,
+		},
+
+		SettleWaitNumRTT: 5,
+		SettleWaitMin:    250 * time.Millisecond,
+		SettleWaitMax:    5 * time.Second,
+	}
+)
+
+// -------------------------------------------------------------
+
+type probePacketGroupParams struct {
+	Config       ProbePacketGroupConfig
+	WeightedLoss WeightedLossConfig
+	Logger       logger.Logger
+}
+
+type probePacketGroup struct {
+	params probePacketGroupParams
+	pci    ccutils.ProbeClusterInfo
+	*packetGroup
+	maxSequenceNumber uint64
+	doneAt            time.Time
+}
+
+func newProbePacketGroup(params probePacketGroupParams, pci ccutils.ProbeClusterInfo) *probePacketGroup {
+	return &probePacketGroup{
+		params: params,
+		pci:    pci,
+		packetGroup: newPacketGroup(
+			packetGroupParams{
+				Config:       params.Config.PacketGroup,
+				WeightedLoss: params.WeightedLoss,
+				Logger:       params.Logger,
+			},
+			0,
+		),
+	}
+}
+
+func (p *probePacketGroup) ProbeClusterDone(pci ccutils.ProbeClusterInfo) {
+	if p.pci.Id != pci.Id {
+		return
+	}
+
+	p.pci.Result = pci.Result
+	p.doneAt = mono.Now()
+}
+
+func (p *probePacketGroup) ProbeClusterInfo() ccutils.ProbeClusterInfo {
+	return p.pci
+}
+
+func (p *probePacketGroup) MaybeFinalizeProbe(maxSequenceNumber uint64, rtt float64) (ccutils.ProbeClusterInfo, bool) {
+	if p.doneAt.IsZero() {
+		return ccutils.ProbeClusterInfoInvalid, false
+	}
+
+	if maxSequenceNumber != 0 && p.maxSequenceNumber >= maxSequenceNumber {
+		return p.pci, true
+	}
+
+	settleWait := time.Duration(float64(p.params.Config.SettleWaitNumRTT) * rtt * float64(time.Second))
+	if settleWait < p.params.Config.SettleWaitMin {
+		settleWait = p.params.Config.SettleWaitMin
+	}
+	if settleWait > p.params.Config.SettleWaitMax {
+		settleWait = p.params.Config.SettleWaitMax
+	}
+	if time.Since(p.doneAt) < settleWait {
+		return ccutils.ProbeClusterInfoInvalid, false
+	}
+
+	return p.pci, true
+}
+
+func (p *probePacketGroup) Add(pi *packetInfo, sendDelta, recvDelta int64, isLost bool) error {
+	if pi.probeClusterId != p.pci.Id {
+		return nil
+	}
+
+	p.maxSequenceNumber = max(p.maxSequenceNumber, pi.sequenceNumber)
+
+	// The first received probe packet starts this measurement window.
+	// The transport's previous packet may precede it by an idle interval.
+	if !isLost && p.acked.numPackets() == 0 {
+		sendDelta, recvDelta = 0, 0
+	}
+	return p.packetGroup.Add(pi, sendDelta, recvDelta, isLost)
+}
+
+func (p *probePacketGroup) MarshalLogObject(e zapcore.ObjectEncoder) error {
+	if p == nil {
+		return nil
+	}
+
+	e.AddObject("pci", p.pci)
+	e.AddObject("packetGroup", p.packetGroup)
+	e.AddUint64("maxSequenceNumber", p.maxSequenceNumber)
+	e.AddTime("doneAt", p.doneAt)
+	return nil
+}
diff --git a/internal/thirdparty/livekit/sendsidebwe/send_side_bwe.go b/internal/thirdparty/livekit/sendsidebwe/send_side_bwe.go
new file mode 100644
index 000000000..df631f27e
--- /dev/null
+++ b/internal/thirdparty/livekit/sendsidebwe/send_side_bwe.go
@@ -0,0 +1,151 @@
+// Copyright 2023 LiveKit, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package sendsidebwe
+
+import (
+	"time"
+
+	"github.com/livekit/livekit-server/pkg/sfu/bwe"
+	"github.com/livekit/livekit-server/pkg/sfu/ccutils"
+	"github.com/livekit/protocol/logger"
+	"github.com/pion/rtcp"
+)
+
+var _ bwe.BWE = (*SendSideBWE)(nil)
+
+//
+// Based on a simplified/modified version of JitterPath paper
+// (https://homepage.iis.sinica.edu.tw/papers/lcs/2114-F.pdf)
+//
+// TWCC feedback is used to calculate delta one-way-delay.
+// It is accumulated/propagated to determine in which region
+// groups of packets are operating in.
+//
+// In simplified terms,
+//   o JQR (Join Queuing Region) is when channel is congested.
+//   o DQR (Disjoint Queuing Region) is when channel is not.
+//
+// Packets are grouped and thresholds applied to smooth over
+// small variations. For example, in the paper,
+//    if propagated_queuing_delay + delta_one_way_delay > 0 {
+//       possibly_operating_in_jqr
+//    }
+// But, in this implementation it is checked at packet group level,
+// i. e. using queuing delay and aggregated delta one-way-delay of
+// the group and a minimum value threshold is applied before declaring
+// that a group is in JQR.
+//
+// There is also hysteresis to make transisitons smoother, i.e. if the
+// metric is above a certain threshold, it is JQR and it is DQR only if it
+// is below a certain value and the gap in between those two thresholds
+// are treated as interdeterminate groups.
+//
+
+// ---------------------------------------------------------------------------
+
+type SendSideBWEConfig struct {
+	CongestionDetector CongestionDetectorConfig `yaml:"congestion_detector,omitempty"`
+}
+
+var (
+	DefaultSendSideBWEConfig = SendSideBWEConfig{
+		CongestionDetector: defaultCongestionDetectorConfig,
+	}
+)
+
+// ---------------------------------------------------------------------------
+
+type SendSideBWEParams struct {
+	Config SendSideBWEConfig
+	Logger logger.Logger
+}
+
+type SendSideBWE struct {
+	bwe.NullBWE
+
+	params SendSideBWEParams
+
+	*congestionDetector
+}
+
+func NewSendSideBWE(params SendSideBWEParams) *SendSideBWE {
+	return &SendSideBWE{
+		params: params,
+		congestionDetector: newCongestionDetector(congestionDetectorParams{
+			Config: params.Config.CongestionDetector,
+			Logger: params.Logger,
+		}),
+	}
+}
+
+func (s *SendSideBWE) Type() bwe.BWEType {
+	return bwe.BWETypeSendSide
+}
+
+func (s *SendSideBWE) SetBWEListener(bweListener bwe.BWEListener) {
+	s.congestionDetector.SetBWEListener(bweListener)
+}
+
+func (s *SendSideBWE) Reset() {
+	s.congestionDetector.Reset()
+}
+
+func (s *SendSideBWE) RecordPacketSendAndGetSequenceNumber(
+	atMicro int64,
+	size int,
+	isRTX bool,
+	probeClusterId ccutils.ProbeClusterId,
+	isProbe bool,
+) uint16 {
+	return s.congestionDetector.RecordPacketSendAndGetSequenceNumber(atMicro, size, isRTX, probeClusterId, isProbe)
+}
+
+func (s *SendSideBWE) HandleTWCCFeedback(report *rtcp.TransportLayerCC) {
+	s.congestionDetector.HandleTWCCFeedback(report)
+}
+
+func (s *SendSideBWE) UpdateRTT(rtt float64) {
+	s.congestionDetector.UpdateRTT(rtt)
+}
+
+func (s *SendSideBWE) CongestionState() bwe.CongestionState {
+	return s.congestionDetector.CongestionState()
+}
+
+func (s *SendSideBWE) CanProbe() bool {
+	return s.congestionDetector.CanProbe()
+}
+
+func (s *SendSideBWE) ProbeDuration() time.Duration {
+	return s.congestionDetector.ProbeDuration()
+}
+
+func (s *SendSideBWE) ProbeClusterStarting(pci ccutils.ProbeClusterInfo) {
+	s.congestionDetector.ProbeClusterStarting(pci)
+}
+
+func (s *SendSideBWE) ProbeClusterDone(pci ccutils.ProbeClusterInfo) {
+	s.congestionDetector.ProbeClusterDone(pci)
+}
+
+func (s *SendSideBWE) ProbeClusterIsGoalReached() bool {
+	return s.congestionDetector.ProbeClusterIsGoalReached()
+}
+
+func (s *SendSideBWE) ProbeClusterFinalize() (ccutils.ProbeSignal, int64, bool) {
+	return s.congestionDetector.ProbeClusterFinalize()
+}
+
+// ------------------------------------------------
diff --git a/internal/thirdparty/livekit/sendsidebwe/traffic_stats.go b/internal/thirdparty/livekit/sendsidebwe/traffic_stats.go
new file mode 100644
index 000000000..f1c07d54e
--- /dev/null
+++ b/internal/thirdparty/livekit/sendsidebwe/traffic_stats.go
@@ -0,0 +1,191 @@
+// Copyright 2023 LiveKit, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package sendsidebwe
+
+import (
+	"math"
+	"time"
+
+	"github.com/livekit/protocol/logger"
+	"go.uber.org/zap/zapcore"
+)
+
+// -----------------------------------------------------------
+
+type WeightedLossConfig struct {
+	MinDurationForLossValidity time.Duration `yaml:"min_duration_for_loss_validity,omitempty"`
+	BaseDuration               time.Duration `yaml:"base_duration,omitempty"`
+	BasePPS                    int           `yaml:"base_pps,omitempty"`
+	LossPenaltyFactor          float64       `yaml:"loss_penalty_factor,omitempty"`
+}
+
+var (
+	defaultWeightedLossConfig = WeightedLossConfig{
+		MinDurationForLossValidity: 100 * time.Millisecond,
+		BaseDuration:               500 * time.Millisecond,
+		BasePPS:                    30,
+		LossPenaltyFactor:          0.25,
+	}
+)
+
+// -----------------------------------------------------------
+
+type trafficStatsParams struct {
+	Config WeightedLossConfig
+	Logger logger.Logger
+}
+
+type trafficStats struct {
+	params trafficStatsParams
+
+	minSendTime  int64
+	maxSendTime  int64
+	sendDelta    int64
+	recvDelta    int64
+	ackedPackets int
+	ackedBytes   int
+	lostPackets  int
+	lostBytes    int
+}
+
+func newTrafficStats(params trafficStatsParams) *trafficStats {
+	return &trafficStats{
+		params: params,
+	}
+}
+
+func (ts *trafficStats) Merge(rhs *trafficStats) {
+	if ts.minSendTime == 0 || rhs.minSendTime < ts.minSendTime {
+		ts.minSendTime = rhs.minSendTime
+	}
+	if rhs.maxSendTime > ts.maxSendTime {
+		ts.maxSendTime = rhs.maxSendTime
+	}
+	ts.sendDelta += rhs.sendDelta
+	ts.recvDelta += rhs.recvDelta
+	ts.ackedPackets += rhs.ackedPackets
+	ts.ackedBytes += rhs.ackedBytes
+	ts.lostPackets += rhs.lostPackets
+	ts.lostBytes += rhs.lostBytes
+}
+
+func (ts *trafficStats) NumBytes() int {
+	return ts.ackedBytes + ts.lostBytes
+}
+
+func (ts *trafficStats) Duration() int64 {
+	return ts.maxSendTime - ts.minSendTime
+}
+
+func (ts *trafficStats) AcknowledgedBitrate() int64 {
+	duration := ts.Duration()
+	if duration == 0 {
+		return 0
+	}
+
+	ackedBitrate := float64(ts.ackedBytes) * 8 * 1e6 / float64(ts.Duration())
+	return int64(ackedBitrate * ts.CapturedTrafficRatio())
+}
+
+func (ts *trafficStats) CapturedTrafficRatio() float64 {
+	if ts.recvDelta == 0 {
+		return 0.0
+	}
+
+	// apply a penalty for lost packets,
+	// the rationale being packet dropping is a strategy to relieve congestion
+	// and if they were not dropped, they would have increased queuing delay,
+	// as it is not possible to know the reason for the losses,
+	// apply a small penalty to receive delta aggregate to simulate those packets
+	// building up queuing delay.
+	return min(1.0, float64(ts.sendDelta)/float64(ts.recvDelta+ts.lossPenalty()))
+}
+
+func (ts *trafficStats) WeightedLoss() float64 {
+	durationMicro := ts.Duration()
+	if time.Duration(durationMicro*1000) < ts.params.Config.MinDurationForLossValidity {
+		return 0.0
+	}
+
+	totalPackets := float64(ts.lostPackets + ts.ackedPackets)
+	pps := totalPackets * 1e6 / float64(durationMicro)
+
+	// longer duration, i. e. more time resolution, lower pps is acceptable as the measurement is more stable
+	deltaDuration := time.Duration(durationMicro*1000) - ts.params.Config.BaseDuration
+	if deltaDuration < 0 {
+		deltaDuration = 0
+	}
+	threshold := math.Exp(-deltaDuration.Seconds()) * float64(ts.params.Config.BasePPS)
+	if pps < threshold {
+		return 0.0
+	}
+
+	lossRatio := float64(0.0)
+	if totalPackets != 0 {
+		lossRatio = float64(ts.lostPackets) / totalPackets
+	}
+
+	// Log10 is used to give higher weight for the same loss ratio at higher packet rates,
+	// for e.g.
+	//    - 10% loss at 20 pps = 0.1 * log10(20) = 0.130
+	//    - 10% loss at 100 pps = 0.1 * log10(100) = 0.2
+	//    - 10% loss at 1000 pps = 0.1 * log10(1000) = 0.3
+	return lossRatio * math.Log10(pps)
+}
+
+func (ts *trafficStats) lossPenalty() int64 {
+	return int64(float64(ts.recvDelta) * ts.WeightedLoss() * ts.params.Config.LossPenaltyFactor)
+}
+
+func (ts *trafficStats) MarshalLogObject(e zapcore.ObjectEncoder) error {
+	if ts == nil {
+		return nil
+	}
+
+	e.AddInt64("minSendTime", ts.minSendTime)
+	e.AddInt64("maxSendTime", ts.maxSendTime)
+	duration := time.Duration(ts.Duration() * 1000)
+	e.AddDuration("duration", duration)
+
+	e.AddInt("ackedPackets", ts.ackedPackets)
+	e.AddInt("ackedBytes", ts.ackedBytes)
+	e.AddInt("lostPackets", ts.lostPackets)
+	e.AddInt("lostBytes", ts.lostBytes)
+
+	bitrate := float64(0)
+	if duration != 0 {
+		bitrate = float64(ts.ackedBytes*8) / duration.Seconds()
+		e.AddFloat64("bitrate", bitrate)
+	}
+
+	e.AddInt64("sendDelta", ts.sendDelta)
+	e.AddInt64("recvDelta", ts.recvDelta)
+	e.AddInt64("groupDelay", ts.recvDelta-ts.sendDelta)
+
+	totalPackets := ts.lostPackets + ts.ackedPackets
+	if duration != 0 {
+		e.AddFloat64("pps", float64(totalPackets)/duration.Seconds())
+	}
+	if (totalPackets) != 0 {
+		e.AddFloat64("rawLoss", float64(ts.lostPackets)/float64(totalPackets))
+	}
+	e.AddFloat64("weightedLoss", ts.WeightedLoss())
+	e.AddInt64("lossPenalty", ts.lossPenalty())
+
+	capturedTrafficRatio := ts.CapturedTrafficRatio()
+	e.AddFloat64("capturedTrafficRatio", capturedTrafficRatio)
+	e.AddFloat64("estimatedAvailableChannelCapacity", bitrate*capturedTrafficRatio)
+	return nil
+}
diff --git a/internal/thirdparty/livekit/sendsidebwe/twcc_feedback.go b/internal/thirdparty/livekit/sendsidebwe/twcc_feedback.go
new file mode 100644
index 000000000..2b2c843e8
--- /dev/null
+++ b/internal/thirdparty/livekit/sendsidebwe/twcc_feedback.go
@@ -0,0 +1,127 @@
+// Copyright 2023 LiveKit, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package sendsidebwe
+
+import (
+	"time"
+
+	"github.com/livekit/protocol/logger"
+	"github.com/pion/rtcp"
+	"go.uber.org/zap/zapcore"
+)
+
+// ------------------------------------------------------
+
+const (
+	cOutlierReportFactor            = 3
+	cEstimatedFeedbackIntervalAlpha = float64(0.9)
+
+	cReferenceTimeMask       = (1 << 24) - 1
+	cReferenceTimeResolution = 64 // 64 ms
+)
+
+// ------------------------------------------------------
+
+type twccFeedbackParams struct {
+	Logger logger.Logger
+}
+
+type twccFeedback struct {
+	params twccFeedbackParams
+
+	lastFeedbackTime          time.Time
+	estimatedFeedbackInterval time.Duration
+	numReports                int
+	numReportsOutOfOrder      int
+
+	highestFeedbackCount uint8
+
+	cycles               int64
+	highestReferenceTime uint32
+}
+
+func newTWCCFeedback(params twccFeedbackParams) *twccFeedback {
+	return &twccFeedback{
+		params: params,
+	}
+}
+
+func (t *twccFeedback) ProcessReport(report *rtcp.TransportLayerCC, at time.Time) (int64, bool) {
+	t.numReports++
+	if t.lastFeedbackTime.IsZero() {
+		t.lastFeedbackTime = at
+		t.highestReferenceTime = report.ReferenceTime
+		t.highestFeedbackCount = report.FbPktCount
+		return (t.cycles + int64(report.ReferenceTime)) * cReferenceTimeResolution * 1000, false
+	}
+
+	isOutOfOrder := false
+	if (report.FbPktCount - t.highestFeedbackCount) > (1 << 7) {
+		t.numReportsOutOfOrder++
+		isOutOfOrder = true
+		t.params.Logger.Infow(
+			"send side bwe: received out-of-order feedback report",
+			"highestFeedbackCount", t.highestFeedbackCount,
+			"fbPktCount", report.FbPktCount,
+			"numReportsOutOfOrder", t.numReportsOutOfOrder,
+		)
+	}
+
+	// reference time wrap around handling
+	var referenceTime int64
+	if (report.ReferenceTime-t.highestReferenceTime)&cReferenceTimeMask < (1 << 23) {
+		if report.ReferenceTime < t.highestReferenceTime {
+			t.cycles += (1 << 24)
+		}
+		t.highestReferenceTime = report.ReferenceTime
+		referenceTime = t.cycles + int64(report.ReferenceTime)
+	} else {
+		cycles := t.cycles
+		if report.ReferenceTime > t.highestReferenceTime && cycles >= (1<<24) {
+			cycles -= (1 << 24)
+		}
+		referenceTime = cycles + int64(report.ReferenceTime)
+	}
+
+	if !isOutOfOrder {
+		sinceLast := at.Sub(t.lastFeedbackTime)
+		if t.estimatedFeedbackInterval == 0 {
+			t.estimatedFeedbackInterval = sinceLast
+		} else {
+			// filter out outliers from estimate
+			if sinceLast > t.estimatedFeedbackInterval/cOutlierReportFactor && sinceLast < cOutlierReportFactor*t.estimatedFeedbackInterval {
+				// smoothed version of inter feedback interval
+				t.estimatedFeedbackInterval = time.Duration(cEstimatedFeedbackIntervalAlpha*float64(t.estimatedFeedbackInterval) + (1.0-cEstimatedFeedbackIntervalAlpha)*float64(sinceLast))
+			}
+		}
+		t.lastFeedbackTime = at
+		t.highestFeedbackCount = report.FbPktCount
+	}
+
+	return referenceTime * cReferenceTimeResolution * 1000, isOutOfOrder
+}
+
+func (t *twccFeedback) MarshalLogObject(e zapcore.ObjectEncoder) error {
+	if t == nil {
+		return nil
+	}
+
+	e.AddTime("lastFeedbackTime", t.lastFeedbackTime)
+	e.AddDuration("estimatedFeedbackInterval", t.estimatedFeedbackInterval)
+	e.AddInt("numReports", t.numReports)
+	e.AddInt("numReportsOutOfOrder", t.numReportsOutOfOrder)
+	e.AddInt64("cycles", t.cycles/(1<<24))
+	return nil
+}

From 76bfa1a0ec6591ac29b666cae87a1ef25a1cab23 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 00:12:14 +0800
Subject: [PATCH 087/262] fix(media): keep bandwidth accounting scoped to video

---
 docs/research/browser-screen-audio-quality.md |   9 +-
 docs/research/node-local-media-design.md      |  28 +++--
 docs/todo.md                                  |   5 +-
 internal/app/mediaedge/audio.go               |  14 +--
 internal/app/mediaedge/edge.go                |   1 -
 internal/app/mediaedge/publication.go         |   2 -
 internal/app/mediaedge/quality.go             |  10 +-
 internal/app/mediaedge/quality_test.go        |   6 +-
 internal/media/forwarding/output.go           |   2 +-
 internal/media/forwarding/publication.go      |  15 +--
 internal/media/forwarding/publication_test.go |  36 +++---
 internal/media/forwarding/recovery_test.go    | 117 ++++++++++++++++--
 internal/media/forwarding/transport.go        |  17 +--
 internal/media/forwarding/transport_test.go   |   5 +-
 internal/server/sfu/media.go                  |  12 --
 15 files changed, 168 insertions(+), 111 deletions(-)

diff --git a/docs/research/browser-screen-audio-quality.md b/docs/research/browser-screen-audio-quality.md
index e51a21eab..b45c08c7d 100644
--- a/docs/research/browser-screen-audio-quality.md
+++ b/docs/research/browser-screen-audio-quality.md
@@ -107,11 +107,10 @@ advancing decoded audio and successful cleanup. A direct Browser control now
 keeps requested 256/320 kbps below an explicit 192 kbps receive limit, while a
 510 kbps receiver permits both rates. A native real-Opus control through
 6 Mbps -> 500 kbps -> 6 Mbps shaping retains decoded audio during live
-320/96/320 kbps changes. It exposed the shared
-[probe measurement repairs](./node-local-media-design.md#send-queue-recovery),
-but video allocation after returning to the high audio rate still needs
-verification. These are local runtime checks; physical networks, mobile playback
-and listening remain open.
+320/96/320 kbps changes, with sustained high video after the shared
+[probe measurement and video-budget repairs](./node-local-media-design.md#send-queue-recovery).
+These are local runtime checks; physical networks, mobile playback and listening
+remain open.
 
 RFC 7587 gives an omitted receive bitrate a mode-dependent default, not an
 unrestricted value, and asks receivers to ignore out-of-range preferences.
diff --git a/docs/research/node-local-media-design.md b/docs/research/node-local-media-design.md
index 4da1093a4..18589d465 100644
--- a/docs/research/node-local-media-design.md
+++ b/docs/research/node-local-media-design.md
@@ -223,8 +223,8 @@ input anchor, not independently to each encoder's completion time.
 
 Local capture replacement keeps its RTP source and cumulative counters while
 rebasing only the input packetizers. It must not also restart the RTP projector.
-Unconnected edges reserve capacity without asking for output. Existing audio
-settings or observed relay-audio bytes reserve that portion of the PC budget.
+Unconnected edges reserve child slots without asking for output. Video capacity
+comes from its tracked traffic; untracked audio must not be subtracted again.
 
 Capture producers now implement the coordinated v5 multi-output boundary below;
 the packaged runtime has not been physically accepted. A bounded real libvpx
@@ -411,8 +411,8 @@ owns the decoded-picture and address-change boundary.
 Congestion callbacks could also promote the estimator's unmeasured 100 Mbps
 initial capacity while a probe was pending. Congestion now only reduces the
 committed budget; a valid completed non-congesting probe owns increases.
-Publication allocation and encoder input use that same committed capacity after
-audio reservation. This follows the
+Publication allocation and encoder input use that same committed video capacity.
+This follows the
 [upstream distinction between congestion events and completed probes](https://github.com/livekit/livekit/blob/v1.13.6/pkg/sfu/streamallocator/streamallocator.go),
 without introducing another estimator.
 
@@ -449,10 +449,22 @@ could promote 100 Mbps and do not establish correct budgeting. The SDK
 latency-aware queue requires an extra adapter and is not retained. Earlier
 flaky comparisons also registered TWCC twice on the receiver, duplicating
 feedback; those results do not rank the queues. Product receivers already use
-the single default interceptor owner. A separate real Opus 320/96/320 kbps
-control retains audio decoding under the same impairment; video can still
-return to a lower output after the high audio rate resumes. That allocation
-boundary remains open rather than being reported as complete recovery.
+the single default interceptor owner.
+
+Live audio changes exposed a related scope mismatch: Piik's TWCC tracks only
+video, but the adapter deducted audio from that measured capacity and included
+audio in expected probe usage. After restoring 320 kbps Opus, this could remove
+an already recovered video layer on a healthy 6 Mbps link. The adapter now uses
+the measured video capacity directly, matching the upstream allocator's
+video-only usage accounting. Native and SFU share this rule; quality reports
+compare video capacity with video payload while retaining total traffic in
+diagnostics. Opus rate and transport behavior are unchanged. The retained
+network gate exercises video-only and real Opus 320/96/320 kbps cases, requiring
+sustained high video and decoded audio after recovery. The former subtraction
+fails a matched trace but can be masked by later probe traffic; a passing
+recovery alone does not establish correct accounting. This is not proof of
+perceptual audio quality or behavior on every physical network.
+
 No reset, retry owner or minimum quality is added. These are bounded local traces,
 not a field diagnosis, success-rate or game-latency claim.
 Ordinary focused checks cover NACK repair, no-RR probe admission, zero-write
diff --git a/docs/todo.md b/docs/todo.md
index 53052b009..f23a4bae3 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -57,9 +57,8 @@ Implementation needs a concrete useful result within the product model.
   limits and framework-owned adaptation. The
   [audio controls](./research/browser-screen-audio-quality.md#numeric-bitrate-assessment)
   retain explicit receive-limit enforcement and the current 320 kbps sender
-  ceiling. A real-Opus impaired-network control retains decoding; verify video
-  allocation after restoring high audio rates. Physical listening, mobile and
-  field-network acceptance remain open.
+  ceiling. Physical listening, mobile and field-network acceptance remain open;
+  research owns the bounded real-Opus impairment and video-recovery control.
   New codecs need complete
   encode/decode/forward support and a late-Viewer policy before inclusion;
   selecting a codec cannot transcode an existing publication. Confirm live
diff --git a/internal/app/mediaedge/audio.go b/internal/app/mediaedge/audio.go
index d658dfbfe..a3b840507 100644
--- a/internal/app/mediaedge/audio.go
+++ b/internal/app/mediaedge/audio.go
@@ -147,19 +147,7 @@ func (source *AudioSource) SetBitrate(bitrate int) error {
 	if closed {
 		return errors.New("native audio source is closed")
 	}
-	if err := source.encoder.SetBitrate(bitrate); err != nil {
-		return err
-	}
-	source.mu.Lock()
-	edges := make([]*Edge, 0, len(source.edges))
-	for edge := range source.edges {
-		edges = append(edges, edge)
-	}
-	source.mu.Unlock()
-	for _, edge := range edges {
-		edge.transport.SetAudioBitrate(uint32(bitrate))
-	}
-	return nil
+	return source.encoder.SetBitrate(bitrate)
 }
 
 func (source *AudioSource) configuredBitrate() uint32 {
diff --git a/internal/app/mediaedge/edge.go b/internal/app/mediaedge/edge.go
index 16bd3dc24..ea79d8923 100644
--- a/internal/app/mediaedge/edge.go
+++ b/internal/app/mediaedge/edge.go
@@ -105,7 +105,6 @@ func (engine *Engine) NewEdge(source *Source, options EdgeOptions) (_ *Edge, err
 	}
 	connection := transport.PC
 	log := slog.Default().With("connectionId", diagnostics.ID(options.ConnectionID), "rtcPeerId", diagnostics.ID(connection.ID()))
-	transport.SetAudioBitrate(options.Audio.configuredBitrate())
 	edge := &Edge{
 		connectionID:  options.ConnectionID,
 		engine:        engine,
diff --git a/internal/app/mediaedge/publication.go b/internal/app/mediaedge/publication.go
index a860e08c6..11ad63ba3 100644
--- a/internal/app/mediaedge/publication.go
+++ b/internal/app/mediaedge/publication.go
@@ -82,7 +82,6 @@ func (engine *Engine) NewPublication(source *Source, options EdgeOptions) (*Publ
 		return nil, err
 	}
 	publication.transport = transport
-	transport.SetAudioBitrate(options.Audio.configuredBitrate())
 	publication.signaling.connection = transport.PC
 	publication.signaling.audioSource = options.Audio
 	publication.signaling.localCandidates = newLocalCandidateGathering(socket, options.ICEServers, nil, options.Events.LocalCandidate)
@@ -208,7 +207,6 @@ func (publication *Publication) Media() PublicationMedia {
 		media.Layers[index] = PublicationLayer{RID: forwarding.PublicationRID(index, len(info.Layers)),
 			Width: layer.Width, Height: layer.Height, Bitrate: layer.Bitrate}
 	}
-	publication.transport.SetAudioBitrate(media.AudioBitrate)
 	return media
 }
 
diff --git a/internal/app/mediaedge/quality.go b/internal/app/mediaedge/quality.go
index f164c0573..354c24b74 100644
--- a/internal/app/mediaedge/quality.go
+++ b/internal/app/mediaedge/quality.go
@@ -52,11 +52,9 @@ func (edge *Edge) QualitySample(now time.Time) (QualitySample, bool) {
 		return QualitySample{}, false
 	}
 	frames := framesNow - previous.frames
-	bytes := bytesNow - previous.videoBytes + audioBytes - previous.audioBytes
+	videoBytes := bytesNow - previous.videoBytes
+	bytes := videoBytes + audioBytes - previous.audioBytes
 	seconds := window.Seconds()
-	if edge.audioSource != nil && edge.audioSource.encoder == nil {
-		edge.transport.SetAudioBitrate(uint32(float64((audioBytes-previous.audioBytes)*8) / seconds))
-	}
 	bitrate := float64(bytes*8) / seconds
 	sample := QualitySample{
 		SampleTimestampMs:     now.UnixMilli(),
@@ -87,7 +85,9 @@ func (edge *Edge) QualitySample(now time.Time) (QualitySample, bool) {
 	sample.AvailableOutgoingKbps = float64(target) / 1000
 	reason := "none"
 	sample.State = "healthy"
-	if edge.transport.Output.IsDeficient() || float64(target) < bitrate {
+	// The estimator tracks video only. Keep total traffic in diagnostics, but
+	// compare its capacity with the corresponding video payload.
+	if edge.transport.Output.IsDeficient() || float64(target) < float64(videoBytes*8)/seconds {
 		reason = "bandwidth"
 		sample.State = "degraded"
 	}
diff --git a/internal/app/mediaedge/quality_test.go b/internal/app/mediaedge/quality_test.go
index 971c8d634..7e225ade1 100644
--- a/internal/app/mediaedge/quality_test.go
+++ b/internal/app/mediaedge/quality_test.go
@@ -105,6 +105,7 @@ func TestQualitySampleUsesEstimatorCapacityAgainstEncodedPayload(t *testing.T) {
 	output.UpTrackMaxPublishedLayerChange(1)
 	output.UpTrackMaxTemporalLayerSeenChange(0)
 	output.SetMaxSpatialLayer(1)
+	edge.audioSource = &AudioSource{}
 	for index, check := range []struct {
 		budget, sent int
 		layer        int32
@@ -128,8 +129,11 @@ func TestQualitySampleUsesEstimatorCapacityAgainstEncodedPayload(t *testing.T) {
 			stats.Update(started.Add(time.Duration(number)*time.Second/30).UnixNano(), number,
 				number*3000, true, 12, size, 0, false)
 		}
+		// Audio remains in total traffic diagnostics, but cannot turn a healthy
+		// 900 kbps video into an apparent overrun of its 1 Mbps video estimate.
+		edge.audioSource.bytes.Add(80_000) // 320 kbps during this two-second window.
 		sample, ok = edge.QualitySample(started.Add(time.Duration(index+2) * 2 * time.Second))
-		if !ok || sample.State != check.state || sample.BitrateKbps != float64(check.sent)/1000 {
+		if !ok || sample.State != check.state || sample.BitrateKbps != float64(check.sent)/1000+320 {
 			t.Fatalf("allocation %d quality = %+v, %v", index, sample, ok)
 		}
 	}
diff --git a/internal/media/forwarding/output.go b/internal/media/forwarding/output.go
index 000f92b77..469afc7a4 100644
--- a/internal/media/forwarding/output.go
+++ b/internal/media/forwarding/output.go
@@ -38,7 +38,7 @@ type Output struct {
 type Snapshot struct {
 	Prepare, Target, Requested, Current int32
 	Paused                              bool
-	// VideoBudget is the current connection estimate after audio reservation.
+	// VideoBudget is the committed estimate for this connection's tracked video.
 	// It is codec input, not a claim that this bitrate is available or delivered.
 	VideoBudget int64
 }
diff --git a/internal/media/forwarding/publication.go b/internal/media/forwarding/publication.go
index 5404dec6a..08537672a 100644
--- a/internal/media/forwarding/publication.go
+++ b/internal/media/forwarding/publication.go
@@ -292,11 +292,8 @@ func (publication *Publication) RequiredActiveCount() int {
 	return publication.activeCount
 }
 
-func (publication *Publication) SetAudioBitrate(bitrate uint32) {
-	publication.bandwidth.audio.Store(int64(bitrate))
-}
 func (publication *Publication) VideoBudget() int64 {
-	return max(publication.bandwidth.target.Load()-publication.bandwidth.audio.Load(), 0)
+	return publication.bandwidth.target.Load()
 }
 func (publication *Publication) LowestLayerBudget() int64 {
 	remaining := publication.VideoBudget()
@@ -556,14 +553,12 @@ type publicationAudioContext struct {
 
 func (context publicationAudioContext) WriteStream() webrtc.TrackLocalWriter { return context.writer }
 
-// Opus uses its one existing encoder at an explicit fixed ceiling. Reserve its
-// bytes from allocator capacities. TWCC observes video; reserving unobserved
-// audio is conservative and does not claim that the estimator acknowledged it.
+// TWCC measures video and its probes. Audio shares the path but is not counted
+// in this estimate; subtracting it here would understate the video budget.
 type publicationBWE struct {
 	*sendsidebwe.SendSideBWE
 	listener bwe.BWEListener
 	target   atomic.Int64
-	audio    atomic.Int64
 	observed atomic.Bool
 }
 
@@ -582,14 +577,14 @@ func (bandwidth *publicationBWE) OnCongestionStateChange(from, to bwe.Congestion
 	if to == bwe.CongestionStateCongested && capacity > 0 && capacity < bandwidth.target.Load() {
 		bandwidth.target.Store(capacity)
 	}
-	bandwidth.listener.OnCongestionStateChange(from, to, max(bandwidth.target.Load()-bandwidth.audio.Load(), 0))
+	bandwidth.listener.OnCongestionStateChange(from, to, bandwidth.target.Load())
 }
 func (bandwidth *publicationBWE) ProbeClusterFinalize() (ccutils.ProbeSignal, int64, bool) {
 	signal, capacity, done := bandwidth.SendSideBWE.ProbeClusterFinalize()
 	if done && signal == ccutils.ProbeSignalNotCongesting && capacity > bandwidth.target.Load() {
 		bandwidth.target.Store(capacity)
 	}
-	return signal, max(bandwidth.target.Load()-bandwidth.audio.Load(), 0), done
+	return signal, bandwidth.target.Load(), done
 }
 
 type publicationPacer struct {
diff --git a/internal/media/forwarding/publication_test.go b/internal/media/forwarding/publication_test.go
index bf5d36cd3..9dc2d8570 100644
--- a/internal/media/forwarding/publication_test.go
+++ b/internal/media/forwarding/publication_test.go
@@ -25,19 +25,17 @@ import (
 
 func TestPublicationEmptyProbeCannotIncreaseCapacity(t *testing.T) {
 	const target = int64(1_000_000)
-	const audio = int64(64_000)
 	log := logger.GetDiscardLogger()
 	bandwidth := &publicationBWE{SendSideBWE: sendsidebwe.NewSendSideBWE(sendsidebwe.SendSideBWEParams{
 		Config: sendsidebwe.DefaultSendSideBWEConfig, Logger: log,
 	})}
 	bandwidth.target.Store(target)
-	bandwidth.audio.Store(audio)
 	queue := &publicationPacer{boundedPacer: newBoundedPacer(
 		pacer.NewNoQueue(log, nil), log, 500,
 	)}
 	defer queue.Stop()
 	info := ccutils.ProbeClusterInfo{Id: 1, CreatedAt: time.Now(), Goal: ccutils.ProbeClusterGoal{
-		AvailableBandwidthBps: int(target), ExpectedUsageBps: int(target - audio),
+		AvailableBandwidthBps: int(target), ExpectedUsageBps: int(target),
 		DesiredBps: int(target * 2), Duration: bandwidth.ProbeDuration(),
 	}}
 	info.Goal.DesiredBytes = int(float64(info.Goal.DesiredBps) * info.Goal.Duration.Seconds() / 8)
@@ -53,7 +51,7 @@ func TestPublicationEmptyProbeCannotIncreaseCapacity(t *testing.T) {
 	for {
 		signal, capacity, done := bandwidth.ProbeClusterFinalize()
 		if done {
-			if signal != ccutils.ProbeSignalInconclusive || capacity > target-audio || bandwidth.target.Load() != target {
+			if signal != ccutils.ProbeSignalInconclusive || capacity > target || bandwidth.target.Load() != target {
 				t.Fatalf("empty probe raised publication capacity: signal=%v capacity=%d target=%d", signal, capacity, bandwidth.target.Load())
 			}
 			break
@@ -76,12 +74,10 @@ func TestPublicationProbeUsesAcknowledgedCapacity(t *testing.T) {
 func checkPublicationProbeCapacity(t *testing.T, received bool) {
 	t.Helper()
 	const target = int64(100_000)
-	const audio = int64(64_000)
 	bandwidth := &publicationBWE{SendSideBWE: sendsidebwe.NewSendSideBWE(sendsidebwe.SendSideBWEParams{
 		Config: sendsidebwe.DefaultSendSideBWEConfig, Logger: logger.GetDiscardLogger(),
 	})}
 	bandwidth.target.Store(target)
-	bandwidth.audio.Store(audio)
 	bandwidth.SetBWEListener(&publicationCapacityRecorder{})
 	// A real non-congesting probe after reset still carries the library's
 	// initial capacity. A successful 800 kbps probe cannot prove 100 Mbps.
@@ -123,11 +119,11 @@ func checkPublicationProbeCapacity(t *testing.T, received bool) {
 			if received {
 				// Allow the first-packet/time-window difference in the library's
 				// acknowledged rate, but never its untouched 100 Mbps initial value.
-				if signal != ccutils.ProbeSignalNotCongesting || capacity <= target-audio || capacity > 1_000_000-audio {
-					t.Fatalf("probe promoted unmeasured capacity: signal=%v committed=%d sent=%.0f", signal, capacity+audio, info.Result.Bitrate())
+				if signal != ccutils.ProbeSignalNotCongesting || capacity <= target || capacity > 1_000_000 {
+					t.Fatalf("unexpected acknowledged probe capacity: signal=%v committed=%d sent=%.0f", signal, capacity, info.Result.Bitrate())
 				}
-			} else if signal != ccutils.ProbeSignalInconclusive || capacity != target-audio {
-				t.Fatalf("unacknowledged probe changed capacity: signal=%v committed=%d", signal, capacity+audio)
+			} else if signal != ccutils.ProbeSignalInconclusive || capacity != target {
+				t.Fatalf("unacknowledged probe changed capacity: signal=%v committed=%d", signal, capacity)
 			}
 			return
 		}
@@ -148,16 +144,15 @@ func TestPublicationCongestionUsesCommittedCapacity(t *testing.T) {
 	recorder := &publicationCapacityRecorder{}
 	bandwidth := &publicationBWE{listener: recorder}
 	bandwidth.target.Store(1_200_000)
-	bandwidth.audio.Store(64_000)
 	bandwidth.OnCongestionStateChange(bwe.CongestionStateNone, bwe.CongestionStateEarlyWarning, 100_000_000)
 	bandwidth.OnCongestionStateChange(bwe.CongestionStateEarlyWarning, bwe.CongestionStateCongested, 100_000_000)
-	if bandwidth.target.Load() != 1_200_000 || recorder.capacity != 1_136_000 {
+	if bandwidth.target.Load() != 1_200_000 || recorder.capacity != 1_200_000 {
 		t.Fatalf("publication promoted an unverified capacity: target=%d allocation=%d", bandwidth.target.Load(), recorder.capacity)
 	}
 	bandwidth.OnCongestionStateChange(bwe.CongestionStateCongested, bwe.CongestionStateCongested, 500_000)
 	bandwidth.OnCongestionStateChange(bwe.CongestionStateCongested, bwe.CongestionStateNone, 800_000)
-	if bandwidth.target.Load() != 500_000 || recorder.capacity != 436_000 {
-		t.Fatalf("publication disagrees with its committed audio/video budget: target=%d allocation=%d", bandwidth.target.Load(), recorder.capacity)
+	if bandwidth.target.Load() != 500_000 || recorder.capacity != 500_000 {
+		t.Fatalf("publication disagrees with its committed video budget: target=%d allocation=%d", bandwidth.target.Load(), recorder.capacity)
 	}
 }
 
@@ -187,9 +182,8 @@ func TestPublicationSimulcastReuseAudioDemandAndClose(t *testing.T) {
 	publication, err := NewPublication(TransportOptions{Source: source.Source, Settings: settings, ConnectionID: "publication", InitialBitrate: 1_000_000, Audio: audio})
 	check(err)
 	defer publication.Close()
-	publication.SetAudioBitrate(64_000)
-	if publication.VideoBudget() != 936_000 {
-		t.Fatal("audio did not reserve the shared budget")
+	if publication.VideoBudget() != 1_000_000 {
+		t.Fatal("audio changed the video capacity estimate")
 	}
 	if len(publication.PC.GetSenders()) != 2 || len(publication.PC.GetSenders()[0].GetParameters().Encodings) != 2 {
 		t.Fatal("publication must use one simulcast video sender and one audio sender")
@@ -293,7 +287,7 @@ func TestPublicationSimulcastReuseAudioDemandAndClose(t *testing.T) {
 		t.Fatalf("successful RTP writes were not accounted per encoding: %+v", counters)
 	}
 	// Once real bitrate measurements exist, one shared capacity update must
-	// constrain the sum of both RID allocations after reserving Opus.
+	// constrain the sum of both video RID allocations.
 	for {
 		_, rates := source.GetLayeredBitrate()
 		if rates[0][0] > 0 && rates[1][0] > 0 {
@@ -306,12 +300,12 @@ func TestPublicationSimulcastReuseAudioDemandAndClose(t *testing.T) {
 			t.Fatal("publication did not measure both available encodings")
 		}
 	}
-	publication.bandwidth.OnCongestionStateChange(bwe.CongestionStateNone, bwe.CongestionStateCongested, 65_000)
+	publication.bandwidth.OnCongestionStateChange(bwe.CongestionStateNone, bwe.CongestionStateCongested, 1_000)
 	for publication.tracks[0].BandwidthRequested()+publication.tracks[1].BandwidthRequested() > 1_000 {
 		select {
 		case <-time.After(5 * time.Millisecond):
 		case <-ctx.Done():
-			t.Fatal("simulcast allocations exceeded their shared post-audio capacity")
+			t.Fatal("simulcast allocations exceeded their shared video capacity")
 		}
 	}
 	if publication.LowestLayerBudget() != 1_000 {
@@ -323,7 +317,7 @@ func TestPublicationSimulcastReuseAudioDemandAndClose(t *testing.T) {
 	// Restore this allocation fixture's capacity explicitly. A congestion event
 	// cannot prove an increase; this test covers RID reuse, not bandwidth probing.
 	publication.bandwidth.target.Store(1_000_000)
-	publication.allocator.SetChannelCapacity(936_000)
+	publication.allocator.SetChannelCapacity(1_000_000)
 	check(publication.SetActiveCount(1))
 	if publication.RequiredActiveCount() != 1 {
 		t.Fatal("publication did not reduce its direct demand")
diff --git a/internal/media/forwarding/recovery_test.go b/internal/media/forwarding/recovery_test.go
index ce003ac33..6edcae045 100644
--- a/internal/media/forwarding/recovery_test.go
+++ b/internal/media/forwarding/recovery_test.go
@@ -2,11 +2,16 @@ package forwarding
 
 import (
 	"context"
+	"encoding/binary"
+	"math"
+	"math/rand/v2"
 	"os"
+	"sync"
 	"sync/atomic"
 	"testing"
 	"time"
 
+	"github.com/TNTcraftHIM/Piik/internal/app/nativeaudio"
 	"github.com/TNTcraftHIM/Piik/internal/media/encoded"
 	"github.com/livekit/livekit-server/pkg/sfu"
 	"github.com/pion/ice/v4"
@@ -14,15 +19,24 @@ import (
 	"github.com/pion/logging"
 	"github.com/pion/transport/v4/vnet"
 	"github.com/pion/webrtc/v4"
+	rtmedia "github.com/pion/webrtc/v4/pkg/media"
+	"github.com/thesyncim/gopus"
 )
 
 // Explicit CPU-only network gate: synthetic VP8-shaped payload, actual Pion
-// ICE/DTLS/RTP/TWCC, and the production allocator/pacer/probe driver. No decoder,
+// ICE/DTLS/RTP/TWCC, and the production allocator/pacer/probe driver. The audio
+// case adds real Opus encode/decode and live bitrate changes. No video decoder,
 // capture device or physical network participates.
 func TestTransportConstrainedDormantRecovery(t *testing.T) {
 	if os.Getenv("PIIK_TRANSPORT_RECOVERY") == "" {
 		t.Skip("set PIIK_TRANSPORT_RECOVERY=1 for the bounded virtual-network gate")
 	}
+	t.Run("video-only", func(t *testing.T) { checkTransportRecovery(t, false) })
+	t.Run("numeric-audio", func(t *testing.T) { checkTransportRecovery(t, true) })
+}
+
+func checkTransportRecovery(t *testing.T, withAudio bool) {
+	t.Helper()
 	ctx, cancel := context.WithTimeout(t.Context(), 32*time.Second)
 	defer cancel()
 	check := func(err error) {
@@ -58,8 +72,36 @@ func TestTransportConstrainedDormantRecovery(t *testing.T) {
 	sendSettings.SetNet(sendNet)
 	sendSettings.SetNetworkTypes([]webrtc.NetworkType{webrtc.NetworkTypeUDP4})
 	sendSettings.SetICEMulticastDNSMode(ice.MulticastDNSModeDisabled)
+	var audio *webrtc.TrackLocalStaticSample
+	var encoder *nativeaudio.Encoder
+	var audioTicks <-chan time.Time
+	var pcm []byte
+	if withAudio {
+		audio, err = webrtc.NewTrackLocalStaticSample(webrtc.RTPCodecCapability{
+			MimeType: webrtc.MimeTypeOpus, ClockRate: 48000, Channels: 2,
+			SDPFmtpLine: "minptime=10;useinbandfec=1",
+		}, "audio", "recovery")
+		check(err)
+		encoder, err = nativeaudio.NewEncoder(320_000)
+		check(err)
+		ticker := time.NewTicker(20 * time.Millisecond)
+		defer ticker.Stop()
+		audioTicks = ticker.C
+		pcm = make([]byte, nativeaudio.FrameBytes)
+		random := rand.New(rand.NewPCG(42, 1))
+		for frame := range nativeaudio.FrameSamples {
+			for channel := range nativeaudio.Channels {
+				value := 8000*math.Sin(2*math.Pi*float64(500+channel*1000)*float64(frame)/48000) + 4000*(random.Float64()*2-1)
+				binary.LittleEndian.PutUint16(pcm[(frame*2+channel)*2:], uint16(int16(value)))
+			}
+		}
+	}
+	var audioTrack webrtc.TrackLocal
+	if audio != nil {
+		audioTrack = audio
+	}
 	transport, err := NewTransport(TransportOptions{Source: source.Source, Settings: sendSettings,
-		ConnectionID: "recovery-child", InitialBitrate: 1_200_000})
+		ConnectionID: "recovery-child", InitialBitrate: 1_200_000, Audio: audioTrack})
 	check(err)
 	defer transport.Close()
 	receiveSettings := webrtc.SettingEngine{}
@@ -73,9 +115,39 @@ func TestTransportConstrainedDormantRecovery(t *testing.T) {
 	receiver, err := webrtc.NewAPI(webrtc.WithMediaEngine(media), webrtc.WithInterceptorRegistry(registry),
 		webrtc.WithSettingEngine(receiveSettings)).NewPeerConnection(webrtc.Configuration{})
 	check(err)
+	var readers sync.WaitGroup
+	defer readers.Wait()
 	defer receiver.Close()
-	var received atomic.Uint64
+	var received, audioDecoded, audioErrors atomic.Uint64
 	receiver.OnTrack(func(track *webrtc.TrackRemote, _ *webrtc.RTPReceiver) {
+		readers.Add(1)
+		defer readers.Done()
+		if track.Kind() == webrtc.RTPCodecTypeAudio {
+			decoder, err := gopus.NewDecoder(gopus.DefaultDecoderConfig(48000, 2))
+			if err != nil {
+				audioErrors.Add(1)
+				return
+			}
+			pcm := make([]int16, nativeaudio.FrameSamples*nativeaudio.Channels)
+			for {
+				packet, _, err := track.ReadRTP()
+				if err != nil {
+					return
+				}
+				count, err := decoder.DecodeInt16(packet.Payload, pcm)
+				if err != nil || count != nativeaudio.FrameSamples {
+					audioErrors.Add(1)
+					continue
+				}
+				var energy int64
+				for _, sample := range pcm {
+					energy += int64(sample) * int64(sample)
+				}
+				if energy > int64(len(pcm))*100 {
+					audioDecoded.Add(1)
+				}
+			}
+		}
 		for {
 			packet, _, readErr := track.ReadRTP()
 			if readErr != nil {
@@ -116,12 +188,26 @@ func TestTransportConstrainedDormantRecovery(t *testing.T) {
 	ticker := time.NewTicker(period)
 	defer ticker.Stop()
 	start, lastReport := time.Now(), time.Now()
-	var previousReceived uint64
-	var dormant, recovered bool
+	var previousReceived, previousAudio uint64
+	var dormant bool
+	var recoveredWindows, audioWindows int
 	minimum := int64(1_200_000)
-	for frame := 0; ; frame++ {
+	frame := 0
+	for {
 		select {
 		case <-ticker.C:
+		case <-audioTicks:
+			bitrate := 320_000
+			if elapsed := time.Since(start); elapsed >= 8*time.Second && elapsed < 16*time.Second {
+				bitrate = 96_000
+			}
+			if encoder.Bitrate() != bitrate {
+				check(encoder.SetBitrate(bitrate))
+			}
+			packet, err := encoder.Encode(pcm)
+			check(err)
+			check(audio.WriteSample(rtmedia.Sample{Data: packet, Duration: 20 * time.Millisecond}))
+			continue
 		case <-ctx.Done():
 			t.Fatal(ctx.Err())
 		}
@@ -156,6 +242,7 @@ func TestTransportConstrainedDormantRecovery(t *testing.T) {
 			copy(data, sfu.VP8KeyFrame8x8)
 			check(source.WriteFrame(layer, encoded.Frame{Data: data, PTS: pts, Duration: period}))
 		}
+		frame++
 		if now.Sub(lastReport) >= time.Second {
 			bytes := received.Load()
 			receivedBps := float64((bytes-previousReceived)*8) / now.Sub(lastReport).Seconds()
@@ -164,15 +251,23 @@ func TestTransportConstrainedDormantRecovery(t *testing.T) {
 				elapsed.Seconds(), capacity, state.VideoBudget, state.Target, state.Current, high, receivedBps,
 				transport.estimator.CongestionState(), transport.paddingReady, transport.probe.Id, transport.Egress())
 			transport.mu.Unlock()
-			if elapsed > 15*time.Second && state.Current == 1 && receivedBps > 800_000 {
-				recovered = true
+			if elapsed >= 20*time.Second && state.Current == 1 && receivedBps > 800_000 {
+				recoveredWindows++
+			}
+			decoded := audioDecoded.Load()
+			if withAudio {
+				t.Logf("audio decoded=%d errors=%d bitrate=%d", decoded-previousAudio, audioErrors.Load(), encoder.Bitrate())
+				if elapsed >= 20*time.Second && decoded-previousAudio >= 35 {
+					audioWindows++
+				}
 			}
+			previousAudio = decoded
 			lastReport, previousReceived = now, bytes
 		}
 	}
-	if !dormant || minimum >= 1_200_000 || !recovered {
-		t.Fatalf("missing real constrained/dormant/released recovery: dormant=%v minimum=%d recovered=%v state=%+v",
-			dormant, minimum, recovered, transport.Output.State())
+	if !dormant || minimum >= 1_200_000 || recoveredWindows < 5 || withAudio && (audioWindows < 5 || audioErrors.Load() != 0) {
+		t.Fatalf("missing constrained/dormant/released recovery: dormant=%v minimum=%d videoWindows=%d audioWindows=%d audioErrors=%d state=%+v",
+			dormant, minimum, recoveredWindows, audioWindows, audioErrors.Load(), transport.Output.State())
 	}
 	check(transport.Close())
 	if transport.prober.IsRunning() {
diff --git a/internal/media/forwarding/transport.go b/internal/media/forwarding/transport.go
index 32ac1521f..eb33fed90 100644
--- a/internal/media/forwarding/transport.go
+++ b/internal/media/forwarding/transport.go
@@ -55,7 +55,6 @@ type Transport struct {
 	mu           sync.Mutex
 	attached     bool
 	closed       bool
-	audioBitrate uint32
 	paddingReady bool
 	closeOnce    sync.Once
 	closeErr     error
@@ -274,6 +273,7 @@ func validateReplacement(current, next *Source) error {
 	return nil
 }
 
+// TargetBitrate reports capacity for TWCC-tracked video, not total link capacity.
 func (transport *Transport) TargetBitrate() (int, bool) {
 	return int(transport.target.Load()), transport.observed.Load()
 }
@@ -299,20 +299,8 @@ func (transport *Transport) Egress() EgressStats {
 	return transport.pacer.stats()
 }
 
-// SetAudioBitrate reserves the current audio owner's contribution to this PC's
-// shared estimate. Zero means no audio demand; the transport invents no profile.
-func (transport *Transport) SetAudioBitrate(bitrate uint32) {
-	transport.mu.Lock()
-	defer transport.mu.Unlock()
-	if !transport.closed {
-		transport.audioBitrate = bitrate
-		transport.refreshBudgetLocked()
-	}
-}
-
 func (transport *Transport) refreshBudgetLocked() {
-	remaining := transport.target.Load() - int64(transport.audioBitrate)
-	transport.Output.SetBudget(max(remaining, 0))
+	transport.Output.SetBudget(transport.target.Load())
 }
 
 func (transport *Transport) Close() error {
@@ -446,7 +434,6 @@ func (transport *Transport) driveProbeLocked() {
 	if delta <= 0 {
 		return
 	}
-	usage += int64(transport.audioBitrate)
 	goal := ccutils.ProbeClusterGoal{AvailableBandwidthBps: int(transport.target.Load()),
 		ExpectedUsageBps: int(usage), DesiredBps: int(usage + max(delta*config.ProbeOveragePct/100, config.ProbeMinBps)),
 		Duration: transport.estimator.ProbeDuration()}
diff --git a/internal/media/forwarding/transport_test.go b/internal/media/forwarding/transport_test.go
index 3a77fce4b..a0d5ef4fe 100644
--- a/internal/media/forwarding/transport_test.go
+++ b/internal/media/forwarding/transport_test.go
@@ -70,9 +70,8 @@ func TestTransportVideoFeedbackAudioAndClose(t *testing.T) {
 	check(err)
 	defer transport.Close()
 	transport.Output.SetMaxSpatialLayer(0)
-	transport.SetAudioBitrate(64_000)
-	if state := transport.Output.State(); state.VideoBudget != 936_000 {
-		t.Fatalf("audio reservation did not reach the video codec budget: %+v", state)
+	if state := transport.Output.State(); state.VideoBudget != 1_000_000 {
+		t.Fatalf("audio changed the video capacity estimate: %+v", state)
 	}
 	if len(source.GetDownTracks()) != 0 {
 		t.Fatal("unconnected transport claimed source output")
diff --git a/internal/server/sfu/media.go b/internal/server/sfu/media.go
index ad90a3efd..4c2be04f7 100644
--- a/internal/server/sfu/media.go
+++ b/internal/server/sfu/media.go
@@ -392,15 +392,6 @@ func (media *Media) UpdatePublication(fence ResourceFence, connectionID string,
 	metadata.Formats, metadata.RIDs = slices.Clone(metadata.Formats), slices.Clone(metadata.RIDs)
 	publication.metadata = metadata
 	publication.wakeDemand()
-	bitrate := uint32(0)
-	if metadata.Audio {
-		bitrate = metadata.AudioBitrate
-	}
-	for _, subscriber := range publication.subscribers {
-		if subscriber.transport != nil {
-			subscriber.transport.SetAudioBitrate(bitrate)
-		}
-	}
 	return nil
 }
 
@@ -579,9 +570,6 @@ func (media *Media) PrepareSubscriber(ctx context.Context, fence SubscriptionFen
 	if err != nil {
 		return webrtc.SessionDescription{}, err
 	}
-	if metadata.Audio {
-		transport.SetAudioBitrate(metadata.AudioBitrate)
-	}
 	publication.mu.Lock()
 	if publication.closed || publication.failure != nil || publication.subscribers[key] != subscriber || ctx.Err() != nil || lifetime.Err() != nil {
 		publication.mu.Unlock()

From d9e477d091f954198a5879ba7ec9f698b405fec4 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 00:26:33 +0800
Subject: [PATCH 088/262] test(media): verify receiver admission preserves
 healthy siblings

---
 docs/research/browser-screen-audio-quality.md |  6 ++-
 internal/app/mediaedge/edge_test.go           | 37 ++++++++++++++++++-
 internal/server/sfu/media_test.go             | 27 +++++++++++++-
 3 files changed, 66 insertions(+), 4 deletions(-)

diff --git a/docs/research/browser-screen-audio-quality.md b/docs/research/browser-screen-audio-quality.md
index b45c08c7d..0591bdea5 100644
--- a/docs/research/browser-screen-audio-quality.md
+++ b/docs/research/browser-screen-audio-quality.md
@@ -105,7 +105,11 @@ retirement also passed; the Browser run measured stereo separation. An ordinary
 Browser relay forwarded received tracks to two children at 320 kbps, with
 advancing decoded audio and successful cleanup. A direct Browser control now
 keeps requested 256/320 kbps below an explicit 192 kbps receive limit, while a
-510 kbps receiver permits both rates. A native real-Opus control through
+510 kbps receiver permits both rates. Native and SFU adapter controls reject
+an insufficient 192 kbps answer before binding it; retiring or correcting that
+preparation leaves the original source and healthy sibling delivering media.
+These controls do not establish the complete room-route response to rejection.
+A native real-Opus control through
 6 Mbps -> 500 kbps -> 6 Mbps shaping retains decoded audio during live
 320/96/320 kbps changes, with sustained high video after the shared
 [probe measurement and video-budget repairs](./node-local-media-design.md#send-queue-recovery).
diff --git a/internal/app/mediaedge/edge_test.go b/internal/app/mediaedge/edge_test.go
index cc2424052..95a4269b9 100644
--- a/internal/app/mediaedge/edge_test.go
+++ b/internal/app/mediaedge/edge_test.go
@@ -696,11 +696,11 @@ func TestAudioSourceDeliversOpusOnTheVideoPeerConnection(t *testing.T) {
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { _ = engine.Close() })
-	video, err := engine.NewSource("h264", 1, 1, nil)
+	video, err := engine.NewSource("h264", 2, 1, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
-	audio, err := engine.NewAudioSource(1, 128_000)
+	audio, err := engine.NewAudioSource(2, 128_000)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -722,6 +722,39 @@ func TestAudioSourceDeliversOpusOnTheVideoPeerConnection(t *testing.T) {
 		}
 	})
 	connectEdgeToReceiver(t, edge, receiver)
+	limited, err := engine.NewEdge(video, EdgeOptions{ConnectionID: "limited-audio-edge", Audio: audio})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = limited.Close() })
+	limitedReceiver := newAudioReceiver(t)
+	t.Cleanup(func() { _ = limitedReceiver.Close() })
+	offer, err := limited.CreateOffer()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = limitedReceiver.SetRemoteDescription(offer); err != nil {
+		t.Fatal(err)
+	}
+	answer, err := (&Receiver{connection: limitedReceiver}).createAnswer()
+	if err != nil {
+		t.Fatal(err)
+	}
+	answer.SDP = strings.ReplaceAll(answer.SDP, "maxaveragebitrate=510000", "maxaveragebitrate=192000")
+	if err = limited.SetAnswer(answer); err == nil {
+		t.Fatal("shared audio accepted an insufficient receiver limit")
+	}
+	if limited.connection.RemoteDescription() != nil {
+		t.Fatal("rejected answer was applied before admission")
+	}
+	if err = limited.Close(); err != nil {
+		t.Fatal(err)
+	}
+	// Rejecting and retiring this edge must leave the shared audio source and
+	// the first receiver usable, without reducing the source's live setting.
+	if audio.configuredBitrate() != 128_000 {
+		t.Fatal("receiver admission changed the shared audio setting")
+	}
 	if err = audio.WritePCM(make([]byte, nativeaudio.FrameBytes), 20*time.Millisecond); err != nil {
 		t.Fatal(err)
 	}
diff --git a/internal/server/sfu/media_test.go b/internal/server/sfu/media_test.go
index 3fe701873..19b78aa78 100644
--- a/internal/server/sfu/media_test.go
+++ b/internal/server/sfu/media_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"net"
+	"strings"
 	"sync"
 	"sync/atomic"
 	"testing"
@@ -310,7 +311,31 @@ func runMediaFanout(t *testing.T, codec string, layerCount int) {
 		}
 		answer, answerErr := receiver.CreateAnswer(nil)
 		check(answerErr)
-		check(service.ApplySubscriberAnswer(subscription, "subscriber_123456", waitGathering(receiver, answer)))
+		answer = waitGathering(receiver, answer)
+		if index == 1 {
+			// Admission of one limited receiver must not bind its incompatible
+			// audio or disturb the publication and its already-playing sibling.
+			limited := answer
+			limited.SDP = strings.ReplaceAll(limited.SDP, "maxaveragebitrate=510000", "maxaveragebitrate=192000")
+			if limited.SDP == answer.SDP {
+				t.Fatal("receiver fixture did not declare its Opus limit")
+			}
+			if service.ApplySubscriberAnswer(subscription, "subscriber_123456", limited) == nil {
+				t.Fatal("shared audio accepted an insufficient receiver limit")
+			}
+			if physical.transport.PC.RemoteDescription() != nil {
+				t.Fatal("rejected answer was applied before admission")
+			}
+			beforeVideo, beforeAudio := videoPackets[0].Load(), audioPackets[0].Load()
+			for videoPackets[0].Load() < beforeVideo+3 || audioPackets[0].Load() < beforeAudio+3 {
+				select {
+				case <-time.After(10 * time.Millisecond):
+				case <-ctx.Done():
+					t.Fatal("receiver rejection interrupted its healthy sibling")
+				}
+			}
+		}
+		check(service.ApplySubscriberAnswer(subscription, "subscriber_123456", answer))
 	}
 	for videoPackets[0].Load() < 3 || videoPackets[1].Load() < 3 ||
 		audioPackets[0].Load() < 3 || audioPackets[1].Load() < 3 {

From 08a99f7479b55bb3a551f6be8753e61ee0e03f2e Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 02:59:08 +0800
Subject: [PATCH 089/262] docs(research): record complete App address-change
 limits

---
 docs/research/nat-traversal.md | 21 ++++++++++++++++++---
 docs/todo.md                   | 11 ++++++-----
 2 files changed, 24 insertions(+), 8 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index a0b117086..aea279b16 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -691,9 +691,24 @@ current wildcard bind and a non-loopback selected pair. Mozilla also keeps
 These controls establish a compatibility limit, not its complete Browser cause
 or public-Site permission behavior. Keep the current address policy. The Host
 currently ends sharing when its required local bridge fails; the Viewer delegates
-that failure to its existing bounded connection-replacement owner. Complete App
-handoff acceptance must cover both, without treating the remote tunnel's survival
-as proof that local playback survived.
+that failure to its existing bounded connection-replacement owner.
+
+Complete App UI controls on 2026-10-10 confirm this distinction in a disposable
+Linux network namespace, with automatic topology optimization disabled and no
+product source changes. Chromium 152 retains its loopback playback connection
+when the namespace's LAN address changes. Firefox 151 selects that LAN address:
+the Viewer resumes decoded pictures through the existing Browser fallback after
+the local connection fails, roughly 30 seconds later. A Firefox Host instead
+ends sharing on that preview failure, including a still-delivering downstream
+connection; the Chromium Host control continues. The Host source is generated
+VP8 delivered through the real capture-process interface, not physical capture.
+Acceptance checks fresh rendered frames at the end, not accumulated frames from
+before the interruption. All controls retire their App, Browsers and interfaces.
+These are ordinary-transport controls of the current App, not integrated
+Magicsock or physical roaming evidence. A faster remote tunnel alone cannot
+establish complete App handoff; local playback composition remains an adoption
+boundary. Retain the existing failure owners and address policy until a bounded
+alternative passes both Browser and Host/Viewer controls.
 
 Dual-stack namespace controls enabled STUN and alternately blocked IPv4 UDP or
 IPv6 forwarding. Both stacks used the working family; Tailcat's direct proof
diff --git a/docs/todo.md b/docs/todo.md
index f23a4bae3..617e59f8d 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -1,6 +1,6 @@
 # Current TODO Ledger
 
-Last reviewed: 2026-10-09
+Last reviewed: 2026-10-10
 
 The current 2.0 preparation includes independent investigation across this
 ledger. Explicit owner holds remain in force; an investigation does not itself
@@ -75,10 +75,11 @@ Implementation needs a concrete useful result within the product model.
   pipeline and physical networks; it does not establish another reachable NAT class.
   Live-encoder/decoded-picture controls now separate shared forwarding queue
   delay from the local playback leg losing its selected LAN address. The shared
-  send-queue repair passes constrained-link recovery; verify the App's local
-  Browser bridge during address changes. A loopback-only policy fails the Firefox
-  control; retain the current address policy and verify both Host and Viewer
-  lifecycle behavior before claiming complete App recovery.
+  send-queue repair passes constrained-link recovery. The complete App controls
+  confirm that its local Browser bridge is a separate handoff limit, especially
+  for Host preview. Resolve that composition within the existing owners before
+  claiming complete App recovery. A loopback-only policy fails the Firefox
+  control; retain the current address policy.
   Product adoption still needs supported
   [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary)
   and RTCP/MTU boundaries, retained-flow recovery beyond the passing serial

From 75fb78ced9f47ce009259735da6efdfe54612f78 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 03:29:15 +0800
Subject: [PATCH 090/262] fix(media): refresh interface addresses during ICE
 gathering

---
 docs/research/nat-traversal.md              |  16 +++
 docs/todo.md                                |   5 +-
 internal/app/mediaedge/ice_socket.go        |   3 +-
 internal/media/forwarding/ice.go            |  29 +++++
 internal/media/forwarding/ice_linux_test.go | 120 ++++++++++++++++++++
 internal/server/app/app.go                  |   3 +-
 6 files changed, 173 insertions(+), 3 deletions(-)
 create mode 100644 internal/media/forwarding/ice.go
 create mode 100644 internal/media/forwarding/ice_linux_test.go

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index aea279b16..8cd7d204c 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -710,6 +710,22 @@ establish complete App handoff; local playback composition remains an adoption
 boundary. Retain the existing failure owners and address policy until a bounded
 alternative passes both Browser and Host/Viewer controls.
 
+The local restart control exposed a separate address-cache defect: Pion ICE
+v4.4.0's [wildcard UDP mux](https://github.com/pion/ice/blob/v4.4.0/udp_mux.go)
+retains its own `stdnet.Net` interface snapshot across
+gatherings. After an interface address changes, both ICE restart and a new SFU
+connection sharing that mux can advertise the removed address. The shared mux
+adapter now takes a private current snapshot when gathering; it changes neither
+socket identity nor Pion's candidate filters and adds no monitor or timer.
+The isolated regression covers restart and a new connection; restoring the
+former constructor fails on the stale candidate. Firefox also resumes fresh
+rendered frames on the same track after a standard ICE restart, including from
+the failed state, while a separately bound loopback sibling keeps receiving.
+That browser control uses complete SDP through a lab-only restart entry point.
+It establishes the underlying repair, not product local-bridge recovery: the
+App's current local bridge still negotiates only once, and its existing failure
+owners remain unchanged.
+
 Dual-stack namespace controls enabled STUN and alternately blocked IPv4 UDP or
 IPv6 forwarding. Both stacks used the working family; Tailcat's direct proof
 required fresh bidirectional delivery after DERP closed. One side reporting a
diff --git a/docs/todo.md b/docs/todo.md
index 617e59f8d..3df84315e 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -79,7 +79,10 @@ Implementation needs a concrete useful result within the product model.
   confirm that its local Browser bridge is a separate handoff limit, especially
   for Host preview. Resolve that composition within the existing owners before
   claiming complete App recovery. A loopback-only policy fails the Firefox
-  control; retain the current address policy.
+  control; retain the current address policy. Fresh interface gathering fixes
+  stale host candidates, and a lab-only standard ICE restart preserves the local
+  track. Product bridge renegotiation, its generation fence and bounded recovery
+  are still unimplemented; do not count that experiment as complete App recovery.
   Product adoption still needs supported
   [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary)
   and RTCP/MTU boundaries, retained-flow recovery beyond the passing serial
diff --git a/internal/app/mediaedge/ice_socket.go b/internal/app/mediaedge/ice_socket.go
index c3e2bac4a..0e458aee9 100644
--- a/internal/app/mediaedge/ice_socket.go
+++ b/internal/app/mediaedge/ice_socket.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/TNTcraftHIM/Piik/internal/app/portmapping"
 	"github.com/TNTcraftHIM/Piik/internal/diagnostics"
+	"github.com/TNTcraftHIM/Piik/internal/media/forwarding"
 	"github.com/pion/ice/v4"
 	"github.com/pion/stun/v3"
 	"github.com/pion/webrtc/v4"
@@ -45,7 +46,7 @@ func (engine *Engine) newICESocket(servers []webrtc.ICEServer, mapping bool) (*i
 	socket := &iceSocket{
 		engine: engine, ctx: ctx, cancel: cancel,
 		localPort: connection.LocalAddr().(*net.UDPAddr).Port,
-		mux: ice.NewUDPMuxDefault(ice.UDPMuxParams{
+		mux: forwarding.NewUDPMux(ice.UDPMuxParams{
 			Logger: diagnostics.PionLoggerFactory().NewLogger("piik-ice"), UDPConn: connection,
 		}),
 	}
diff --git a/internal/media/forwarding/ice.go b/internal/media/forwarding/ice.go
new file mode 100644
index 000000000..cafec6f81
--- /dev/null
+++ b/internal/media/forwarding/ice.go
@@ -0,0 +1,29 @@
+package forwarding
+
+import (
+	"github.com/pion/ice/v4"
+	"github.com/pion/transport/v4"
+	"github.com/pion/transport/v4/stdnet"
+)
+
+// NewUDPMux retains Pion's socket and candidate policy, but reads current local
+// addresses at each gathering. Its default stdnet snapshot otherwise survives
+// ICE restart (and every new SFU connection sharing that mux).
+func NewUDPMux(params ice.UDPMuxParams) *ice.UDPMuxDefault {
+	if params.Net == nil {
+		params.Net = &muxNetwork{}
+	}
+	return ice.NewUDPMuxDefault(params)
+}
+
+// UDPMux uses Net only to enumerate interfaces. Take a fresh, private snapshot
+// per read instead of mutating a shared stdnet.Net during concurrent gatherings.
+type muxNetwork struct{ stdnet.Net }
+
+func (*muxNetwork) Interfaces() ([]*transport.Interface, error) {
+	network, err := stdnet.NewNet()
+	if err != nil {
+		return nil, err
+	}
+	return network.Interfaces()
+}
diff --git a/internal/media/forwarding/ice_linux_test.go b/internal/media/forwarding/ice_linux_test.go
new file mode 100644
index 000000000..59828e25d
--- /dev/null
+++ b/internal/media/forwarding/ice_linux_test.go
@@ -0,0 +1,120 @@
+package forwarding
+
+import (
+	"net"
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pion/ice/v4"
+	"github.com/pion/webrtc/v4"
+)
+
+// Run only in a disposable network namespace with lab0 at 10.77.0.2/24.
+// This exercises real interface replacement without changing the host network.
+func TestUDPMuxRefreshesHostCandidates(t *testing.T) {
+	if os.Getenv("PIIK_INTERFACE_LAB") != "1" {
+		t.Skip("requires the isolated Linux interface fixture")
+	}
+	self, err := os.Readlink("/proc/self/ns/net")
+	if err != nil {
+		t.Fatal(err)
+	}
+	initial, err := os.Readlink("/proc/1/ns/net")
+	if err != nil || self == initial {
+		t.Fatal("refusing to change the initial network namespace")
+	}
+	iface, err := net.InterfaceByName("lab0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	addresses, err := iface.Addrs()
+	if err != nil {
+		t.Fatal(err)
+	}
+	found := false
+	for _, address := range addresses {
+		found = found || address.String() == "10.77.0.2/24"
+	}
+	if !found {
+		t.Fatal("fixture address is absent")
+	}
+	change := func(action, address string) {
+		t.Helper()
+		if output, err := exec.Command("ip", "addr", action, address, "dev", "lab0").CombinedOutput(); err != nil {
+			t.Fatalf("fixture address change: %v: %s", err, output)
+		}
+	}
+	udp, err := net.ListenPacket("udp4", "0.0.0.0:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	mux := NewUDPMux(ice.UDPMuxParams{UDPConn: udp})
+	t.Cleanup(func() { _ = mux.Close() })
+	settings := webrtc.SettingEngine{}
+	settings.SetICEUDPMux(mux)
+	settings.SetNetworkTypes([]webrtc.NetworkType{webrtc.NetworkTypeUDP4})
+	newPeer := func() (*webrtc.PeerConnection, *webrtc.PeerConnection) {
+		t.Helper()
+		peer, err := webrtc.NewAPI(webrtc.WithSettingEngine(settings)).NewPeerConnection(webrtc.Configuration{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		t.Cleanup(func() { _ = peer.Close() })
+		if _, err = peer.AddTransceiverFromKind(webrtc.RTPCodecTypeVideo); err != nil {
+			t.Fatal(err)
+		}
+		remote, err := webrtc.NewPeerConnection(webrtc.Configuration{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		t.Cleanup(func() { _ = remote.Close() })
+		return peer, remote
+	}
+	gather := func(peer, remote *webrtc.PeerConnection, restart bool, want, reject string) {
+		t.Helper()
+		offer, err := peer.CreateOffer(&webrtc.OfferOptions{ICERestart: restart})
+		if err != nil {
+			t.Fatal(err)
+		}
+		complete := webrtc.GatheringCompletePromise(peer)
+		if err = peer.SetLocalDescription(offer); err != nil {
+			t.Fatal(err)
+		}
+		select {
+		case <-complete:
+		case <-time.After(3 * time.Second):
+			t.Fatal("candidate gathering did not finish")
+		}
+		sdp := peer.LocalDescription().SDP
+		if !strings.Contains(sdp, " "+want+" ") || (reject != "" && strings.Contains(sdp, " "+reject+" ")) {
+			t.Fatalf("gathering did not replace the old interface address: want=%s reject=%s", want, reject)
+		}
+		if err = remote.SetRemoteDescription(*peer.LocalDescription()); err != nil {
+			t.Fatal(err)
+		}
+		answer, err := remote.CreateAnswer(nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err = remote.SetLocalDescription(answer); err != nil {
+			t.Fatal(err)
+		}
+		if err = peer.SetRemoteDescription(answer); err != nil {
+			t.Fatal(err)
+		}
+	}
+	peer, remote := newPeer()
+	gather(peer, remote, false, "10.77.0.2", "")
+	change("del", "10.77.0.2/24")
+	t.Cleanup(func() { change("add", "10.77.0.2/24") })
+	change("add", "10.77.0.3/24")
+	t.Cleanup(func() { change("del", "10.77.0.3/24") })
+	// App recovery retains its connection and socket; SFU also reuses its mux
+	// across independent connections. Both must enumerate the current address.
+	gather(peer, remote, true, "10.77.0.3", "10.77.0.2")
+	peer, remote = newPeer()
+	gather(peer, remote, false, "10.77.0.3", "10.77.0.2")
+}
diff --git a/internal/server/app/app.go b/internal/server/app/app.go
index 4f3e75b47..7a7ae1d4c 100644
--- a/internal/server/app/app.go
+++ b/internal/server/app/app.go
@@ -30,6 +30,7 @@ import (
 	"time"
 
 	"github.com/TNTcraftHIM/Piik/internal/diagnostics"
+	"github.com/TNTcraftHIM/Piik/internal/media/forwarding"
 	"github.com/TNTcraftHIM/Piik/internal/server/config"
 	"github.com/TNTcraftHIM/Piik/internal/server/room"
 	"github.com/TNTcraftHIM/Piik/internal/server/sfu"
@@ -250,7 +251,7 @@ func (s *Server) start(ctx context.Context) (int, error) {
 			return 0, fmt.Errorf("Piik SFU listener failed: %w", listenErr)
 		}
 		factory := diagnostics.PionLoggerFactory()
-		s.mediaMux = ice.NewUDPMuxDefault(ice.UDPMuxParams{UDPConn: connection, Logger: factory.NewLogger("sfu-udp")})
+		s.mediaMux = forwarding.NewUDPMux(ice.UDPMuxParams{UDPConn: connection, Logger: factory.NewLogger("sfu-udp")})
 		settings := webrtc.SettingEngine{LoggerFactory: factory}
 		settings.SetNetworkTypes([]webrtc.NetworkType{webrtc.NetworkTypeUDP4})
 		settings.SetICEUDPMux(s.mediaMux)

From 132c73337164788c973c6e278fd4f8d99c96dc81 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 04:03:07 +0800
Subject: [PATCH 091/262] fix(media): recover local native bridges on retained
 connections

Use bounded, offer-scoped ICE restart for the App's local Browser leg while preserving its stream and terminal owners. Gather local candidates in the SDP transaction and reject stale answers. Start legacy audio from the fixed output owner instead of racing source replacement.

Validated with focused Browser/Go tests, complete Chromium/Firefox Host and Viewer address-change controls, and Linux race checks. Capture subprocess fixtures use GORACE=atexit_sleep_ms=0; restoring the old audio-owner read still reproduces the race under that setting.
---
 docs/research/nat-traversal.md                |  43 ++-
 docs/standards/presentation-lifecycle.md      |   8 +-
 docs/todo.md                                  |  12 +-
 internal/app/mediaedge/edge.go                |  78 +++++-
 internal/app/mediaedge/edge_test.go           |   6 +-
 internal/app/mediaedge/local_edge_test.go     |  94 +++++++
 internal/app/mediaedge/publication.go         |   2 +-
 .../app/mediaedge/receiver_overlap_test.go    |   2 +-
 .../app/mediaedge/relay_chain_fixture_test.go |   2 +-
 internal/app/nativecontrol/session.go         |   9 +-
 internal/app/nativecontrol/wire.go            |   2 +
 internal/app/nativehost/audio_mix_test.go     |   4 +-
 internal/app/nativehost/audio_test.go         |   4 +-
 internal/app/nativehost/session.go            |  32 ++-
 internal/app/nativeviewer/session.go          |  31 ++-
 internal/app/nativeviewer/session_test.go     |   2 +-
 src/client/native/client.ts                   |   9 +-
 src/client/native/media-bridge.ts             | 254 +++++++++---------
 tests/native-client.test.ts                   |  41 +++
 tests/native-media-bridge.test.ts             | 209 ++++++--------
 20 files changed, 530 insertions(+), 314 deletions(-)
 create mode 100644 internal/app/mediaedge/local_edge_test.go

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 8cd7d204c..c3f578dca 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -689,12 +689,13 @@ Firefox 155 fails that connection; the same Firefox fixture decodes with the
 current wildcard bind and a non-loopback selected pair. Mozilla also keeps
 [ICE loopback disabled by default](https://searchfox.org/firefox-main/source/modules/libpref/init/all.js).
 These controls establish a compatibility limit, not its complete Browser cause
-or public-Site permission behavior. Keep the current address policy. The Host
-currently ends sharing when its required local bridge fails; the Viewer delegates
-that failure to its existing bounded connection-replacement owner.
+or public-Site permission behavior. Keep the current address policy. A terminal
+local-bridge failure ends the Host share or delegates Viewer recovery to its
+existing connection owner.
 
-Complete App UI controls on 2026-10-10 confirm this distinction in a disposable
-Linux network namespace, with automatic topology optimization disabled and no
+Before local-bridge recovery, complete App UI controls on 2026-10-10 confirmed
+this distinction in a disposable Linux network namespace, with automatic
+topology optimization disabled and no
 product source changes. Chromium 152 retains its loopback playback connection
 when the namespace's LAN address changes. Firefox 151 selects that LAN address:
 the Viewer resumes decoded pictures through the existing Browser fallback after
@@ -704,11 +705,9 @@ connection; the Chromium Host control continues. The Host source is generated
 VP8 delivered through the real capture-process interface, not physical capture.
 Acceptance checks fresh rendered frames at the end, not accumulated frames from
 before the interruption. All controls retire their App, Browsers and interfaces.
-These are ordinary-transport controls of the current App, not integrated
-Magicsock or physical roaming evidence. A faster remote tunnel alone cannot
-establish complete App handoff; local playback composition remains an adoption
-boundary. Retain the existing failure owners and address policy until a bounded
-alternative passes both Browser and Host/Viewer controls.
+These are ordinary-transport controls, not integrated Magicsock or physical
+roaming evidence. A faster remote tunnel alone cannot establish complete App
+handoff; both the network and Browser playback legs must recover.
 
 The local restart control exposed a separate address-cache defect: Pion ICE
 v4.4.0's [wildcard UDP mux](https://github.com/pion/ice/blob/v4.4.0/udp_mux.go)
@@ -721,10 +720,26 @@ The isolated regression covers restart and a new connection; restoring the
 former constructor fails on the stale candidate. Firefox also resumes fresh
 rendered frames on the same track after a standard ICE restart, including from
 the failed state, while a separately bound loopback sibling keeps receiving.
-That browser control uses complete SDP through a lab-only restart entry point.
-It establishes the underlying repair, not product local-bridge recovery: the
-App's current local bridge still negotiates only once, and its existing failure
-owners remain unchanged.
+Replacing only the Native PeerConnection while retaining the Browser connection
+instead reported connected without fresh decoded pictures in the same fixture;
+it is not the accepted recovery mechanism.
+
+The 2.0 candidate now uses the existing bridge owner for one standard ICE restart
+after a three-second disconnect grace, or immediately after failure. Initial and
+restart negotiations use complete local SDP with the request ID fencing the answer;
+there is no separate local trickle queue. The negotiation has an eight-second
+deadline, including a five-second Native gathering bound. Retirement cancels it;
+failure retains the existing Host/Viewer terminal owners. Paused sources need not
+produce new frames to prove a transport connection.
+
+Matched complete App controls retain the same Firefox Host and Viewer media track
+through the namespace address change. The Host keeps sharing and decoding, its
+downstream Viewer keeps rendering, and the Native Viewer resumes fresh rendered
+frames without replacing its route or falling back to Browser reception.
+Chromium Host/Viewer controls retain their working loopback leg without a restart.
+These controls use ordinary Pion and generated media. They close the reproduced local
+bridge gap, not the remaining Magicsock composition, physical roaming or platform
+acceptance boundaries.
 
 Dual-stack namespace controls enabled STUN and alternately blocked IPv4 UDP or
 IPv6 forwarding. Both stacks used the working family; Tailcat's direct proof
diff --git a/docs/standards/presentation-lifecycle.md b/docs/standards/presentation-lifecycle.md
index dc55a650c..c511e28ab 100644
--- a/docs/standards/presentation-lifecycle.md
+++ b/docs/standards/presentation-lifecycle.md
@@ -235,7 +235,13 @@ recovery state still requires a fresh current frame to clear. SFU media is
 retained independently of transient room-signaling loss, but Browser or OS
 suspension and page reclamation remain outside Web guarantees.
 
-Failure of the local Native media bridge disables Native reception for the
+The local Native media bridge owns bounded ICE recovery on its existing
+connection and stream. Its offer identity fences each answer; retirement cancels
+pending negotiation and cannot recreate a source or receiver. Connection recovery
+does not assert fresh media, and an intentionally paused source is not a failure.
+First-frame and playback owners retain their existing evidence requirements.
+
+Terminal failure of the local Native media bridge disables Native reception for the
 current Viewer session before route recovery runs. Future peers in that session
 use Browser reception; existing healthy peers are not torn down by this choice.
 Parent-network failure alone is not evidence that the local Native capability
diff --git a/docs/todo.md b/docs/todo.md
index 3df84315e..595f08993 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -76,13 +76,11 @@ Implementation needs a concrete useful result within the product model.
   Live-encoder/decoded-picture controls now separate shared forwarding queue
   delay from the local playback leg losing its selected LAN address. The shared
   send-queue repair passes constrained-link recovery. The complete App controls
-  confirm that its local Browser bridge is a separate handoff limit, especially
-  for Host preview. Resolve that composition within the existing owners before
-  claiming complete App recovery. A loopback-only policy fails the Firefox
-  control; retain the current address policy. Fresh interface gathering fixes
-  stale host candidates, and a lab-only standard ICE restart preserves the local
-  track. Product bridge renegotiation, its generation fence and bounded recovery
-  are still unimplemented; do not count that experiment as complete App recovery.
+  exposed a separate local Browser bridge limit. Fresh interface gathering and
+  bounded bridge renegotiation now preserve the local track in complete ordinary
+  Pion App controls, including Firefox Host and Viewer. Retain the existing
+  address policy: forcing loopback fails Firefox. Verify the combined Magicsock
+  and Browser pipeline before claiming complete App recovery through that transport.
   Product adoption still needs supported
   [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary)
   and RTCP/MTU boundaries, retained-flow recovery beyond the passing serial
diff --git a/internal/app/mediaedge/edge.go b/internal/app/mediaedge/edge.go
index ea79d8923..9caf9617d 100644
--- a/internal/app/mediaedge/edge.go
+++ b/internal/app/mediaedge/edge.go
@@ -1,12 +1,14 @@
 package mediaedge
 
 import (
+	"context"
 	"errors"
 	"io"
 	"log/slog"
 	"strconv"
 	"strings"
 	"sync"
+	"time"
 
 	"github.com/TNTcraftHIM/Piik/internal/app/nativeaudio"
 	"github.com/TNTcraftHIM/Piik/internal/diagnostics"
@@ -51,6 +53,7 @@ type Edge struct {
 	qualityMu            sync.Mutex
 	qualityBaseline      qualityBaseline
 	answerMu             sync.Mutex
+	localOfferID         string
 	localCandidates      *localCandidateGathering
 }
 
@@ -143,15 +146,14 @@ func (engine *Engine) NewEdge(source *Source, options EdgeOptions) (_ *Edge, err
 			return nil, err
 		}
 	}
-	edge.localCandidates = newLocalCandidateGathering(
-		socket,
-		options.ICEServers,
-		prepareMapping,
-		options.Events.LocalCandidate,
-	)
-	connection.OnICECandidate(func(candidate *webrtc.ICECandidate) {
-		edge.localCandidates.addPion(candidate)
-	})
+	if !options.Local {
+		edge.localCandidates = newLocalCandidateGathering(
+			socket, options.ICEServers, prepareMapping, options.Events.LocalCandidate,
+		)
+		connection.OnICECandidate(func(candidate *webrtc.ICECandidate) {
+			edge.localCandidates.addPion(candidate)
+		})
+	}
 	connection.OnICEConnectionStateChange(func(state webrtc.ICEConnectionState) {
 		log.Debug("piik-client", "event", "media-ice-state", "direction", "outbound", "local", options.Local, "state", state.String())
 	})
@@ -226,6 +228,9 @@ func (edge *Edge) SetTargetLayer(layer int) error {
 }
 
 func (edge *Edge) CreateOffer() (webrtc.SessionDescription, error) {
+	if edge.local {
+		return webrtc.SessionDescription{}, errors.New("local media requires an identified offer")
+	}
 	offer, err := edge.connection.CreateOffer(nil)
 	if err != nil {
 		return webrtc.SessionDescription{}, err
@@ -237,9 +242,54 @@ func (edge *Edge) CreateOffer() (webrtc.SessionDescription, error) {
 	return offer, nil
 }
 
-func (edge *Edge) SetAnswer(answer webrtc.SessionDescription) error {
+// Local bridges have no STUN or gateway discovery. Complete SDP keeps their
+// candidates and answer in one bounded negotiation, including ICE restarts.
+func (edge *Edge) CreateLocalOffer(ctx context.Context, offerID string, restart bool) (webrtc.SessionDescription, error) {
 	edge.answerMu.Lock()
 	defer edge.answerMu.Unlock()
+	edge.mu.Lock()
+	available := edge.local && !edge.closed && offerID != "" && offerID != edge.localOfferID &&
+		((!restart && edge.localOfferID == "") || (restart && edge.remoteDescriptionSet))
+	edge.mu.Unlock()
+	if !available {
+		return webrtc.SessionDescription{}, errors.New("local media negotiation is unavailable")
+	}
+	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+	if err := ctx.Err(); err != nil {
+		return webrtc.SessionDescription{}, err
+	}
+	offer, err := edge.connection.CreateOffer(&webrtc.OfferOptions{ICERestart: restart})
+	if err != nil {
+		return webrtc.SessionDescription{}, err
+	}
+	gathered := webrtc.GatheringCompletePromise(edge.connection)
+	if err = edge.connection.SetLocalDescription(offer); err != nil {
+		return webrtc.SessionDescription{}, err
+	}
+	edge.localOfferID = offerID
+	edge.mu.Lock()
+	edge.remoteDescriptionSet = false
+	edge.mu.Unlock()
+	select {
+	case <-gathered:
+		if description := edge.connection.LocalDescription(); description != nil {
+			return *description, nil
+		}
+		return webrtc.SessionDescription{}, io.ErrClosedPipe
+	case <-ctx.Done():
+		return webrtc.SessionDescription{}, ctx.Err()
+	case <-edge.socket.ctx.Done():
+		return webrtc.SessionDescription{}, io.ErrClosedPipe
+	}
+}
+
+func (edge *Edge) SetAnswer(answer webrtc.SessionDescription, offerID string) error {
+	edge.answerMu.Lock()
+	defer edge.answerMu.Unlock()
+	if (edge.local && (offerID == "" || offerID != edge.localOfferID)) || (!edge.local && offerID != "") {
+		return errors.New("native media answer does not match its offer")
+	}
 	if answer.Type != webrtc.SDPTypeAnswer {
 		return errors.New("native media edge requires an SDP answer")
 	}
@@ -249,9 +299,8 @@ func (edge *Edge) SetAnswer(answer webrtc.SessionDescription) error {
 		return errors.New("native media edge is closed")
 	}
 	if edge.remoteDescriptionSet {
-		// The connection identity fences the answer to one edge. A repeated
-		// answer is a retransmission; the first applied description remains
-		// authoritative.
+		// A repeated answer within the same connection/offer is a
+		// retransmission; its first applied description remains authoritative.
 		edge.mu.Unlock()
 		return nil
 	}
@@ -280,6 +329,9 @@ func (edge *Edge) SetAnswer(answer webrtc.SessionDescription) error {
 }
 
 func (edge *Edge) AddRemoteCandidate(candidate *webrtc.ICECandidateInit) error {
+	if edge.local {
+		return errors.New("local media candidates belong in the SDP answer")
+	}
 	if malformedRemoteCandidate(candidate) {
 		slog.Debug("media-candidate-rejected", "connectionId", diagnostics.ID(edge.connectionID), "stage", "malformed")
 		return nil
diff --git a/internal/app/mediaedge/edge_test.go b/internal/app/mediaedge/edge_test.go
index 95a4269b9..a4e78c2a4 100644
--- a/internal/app/mediaedge/edge_test.go
+++ b/internal/app/mediaedge/edge_test.go
@@ -467,7 +467,7 @@ func TestRepeatedAnswerIsIdempotent(t *testing.T) {
 	if answer == nil {
 		t.Fatal("receiver did not retain its answer")
 	}
-	if err = edge.SetAnswer(*answer); err != nil {
+	if err = edge.SetAnswer(*answer, ""); err != nil {
 		t.Fatalf("repeated answer was not idempotent: %v", err)
 	}
 }
@@ -741,7 +741,7 @@ func TestAudioSourceDeliversOpusOnTheVideoPeerConnection(t *testing.T) {
 		t.Fatal(err)
 	}
 	answer.SDP = strings.ReplaceAll(answer.SDP, "maxaveragebitrate=510000", "maxaveragebitrate=192000")
-	if err = limited.SetAnswer(answer); err == nil {
+	if err = limited.SetAnswer(answer, ""); err == nil {
 		t.Fatal("shared audio accepted an insufficient receiver limit")
 	}
 	if limited.connection.RemoteDescription() != nil {
@@ -822,7 +822,7 @@ func connectEdgeToReceiver(
 		t.Fatal(err)
 	}
 	waitSignal(t, gatherAnswer, "answer ICE gathering")
-	if err = edge.SetAnswer(*receiver.LocalDescription()); err != nil {
+	if err = edge.SetAnswer(*receiver.LocalDescription(), ""); err != nil {
 		t.Fatal(err)
 	}
 	deadline := time.Now().Add(5 * time.Second)
diff --git a/internal/app/mediaedge/local_edge_test.go b/internal/app/mediaedge/local_edge_test.go
new file mode 100644
index 000000000..9d3584656
--- /dev/null
+++ b/internal/app/mediaedge/local_edge_test.go
@@ -0,0 +1,94 @@
+package mediaedge
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pion/webrtc/v4"
+)
+
+func TestLocalRestartRetainsMediaAndRejectsStaleAnswers(t *testing.T) {
+	ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
+	defer cancel()
+	check := func(err error) {
+		t.Helper()
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	engine, err := NewEngine(EngineOptions{BindAddress: "127.0.0.1:0", IncludeLoopback: true})
+	check(err)
+	t.Cleanup(func() { _ = engine.Close() })
+	source, err := engine.NewSource("vp8", 1, 1, nil)
+	check(err)
+	t.Cleanup(func() { _ = source.Close() })
+	edge, err := engine.NewEdge(source, EdgeOptions{ConnectionID: "local-preview", Local: true})
+	check(err)
+	t.Cleanup(func() { _ = edge.Close() })
+	receiver := newReceiver(t)
+	t.Cleanup(func() { _ = receiver.Close() })
+	connection, transport, sender := edge.connection, edge.transport, edge.sender
+	answer := func(offer webrtc.SessionDescription) webrtc.SessionDescription {
+		t.Helper()
+		check(receiver.SetRemoteDescription(offer))
+		description, err := receiver.CreateAnswer(nil)
+		check(err)
+		gathered := webrtc.GatheringCompletePromise(receiver)
+		check(receiver.SetLocalDescription(description))
+		select {
+		case <-gathered:
+		case <-ctx.Done():
+			t.Fatal(ctx.Err())
+		}
+		return *receiver.LocalDescription()
+	}
+	ufrag := func(sdp string) string {
+		for _, line := range strings.Split(sdp, "\r\n") {
+			if strings.HasPrefix(line, "a=ice-ufrag:") {
+				return line
+			}
+		}
+		t.Fatal("missing ICE credentials")
+		return ""
+	}
+	initial, err := edge.CreateLocalOffer(ctx, "local_offer_1", false)
+	check(err)
+	if !strings.Contains(initial.SDP, "a=candidate:") || edge.localCandidates != nil {
+		t.Fatal("local bridge did not use complete SDP")
+	}
+	oldAnswer := answer(initial)
+	check(edge.SetAnswer(oldAnswer, "local_offer_1"))
+	check(edge.SetAnswer(oldAnswer, "local_offer_1")) // Same transaction is idempotent.
+	for _, offerID := range []string{"local_offer_2", "local_offer_3"} {
+		offer, err := edge.CreateLocalOffer(ctx, offerID, true)
+		check(err)
+		if ufrag(initial.SDP) == ufrag(offer.SDP) {
+			t.Fatal("restart reused ICE credentials")
+		}
+		if err = edge.SetAnswer(oldAnswer, "local_offer_1"); err == nil {
+			t.Fatal("stale answer was accepted into a newer negotiation")
+		}
+		if _, err = edge.CreateLocalOffer(ctx, "overlapping_offer", true); err == nil {
+			t.Fatal("an unanswered negotiation was replaced")
+		}
+		check(edge.SetAnswer(answer(offer), offerID))
+		if edge.connection != connection || edge.transport != transport || edge.sender != sender || edge.source != source {
+			t.Fatal("ICE recovery replaced a media owner")
+		}
+		initial = offer
+	}
+	canceled, stop := context.WithCancel(ctx)
+	stop()
+	if _, err = edge.CreateLocalOffer(canceled, "canceled_offer", true); err == nil {
+		t.Fatal("canceled operation changed negotiation")
+	}
+	if edge.localOfferID != "local_offer_3" {
+		t.Fatal("canceled operation replaced offer identity")
+	}
+	check(edge.Close())
+	if _, err = edge.CreateLocalOffer(ctx, "retired_offer", true); err == nil {
+		t.Fatal("restart reopened a retired edge")
+	}
+}
diff --git a/internal/app/mediaedge/publication.go b/internal/app/mediaedge/publication.go
index 11ad63ba3..39613630e 100644
--- a/internal/app/mediaedge/publication.go
+++ b/internal/app/mediaedge/publication.go
@@ -117,7 +117,7 @@ func (publication *Publication) CreateOffer() (webrtc.SessionDescription, error)
 	return publication.signaling.CreateOffer()
 }
 func (publication *Publication) SetAnswer(answer webrtc.SessionDescription) error {
-	return publication.signaling.SetAnswer(answer)
+	return publication.signaling.SetAnswer(answer, "")
 }
 func (publication *Publication) AddRemoteCandidate(candidate *webrtc.ICECandidateInit) error {
 	return publication.signaling.AddRemoteCandidate(candidate)
diff --git a/internal/app/mediaedge/receiver_overlap_test.go b/internal/app/mediaedge/receiver_overlap_test.go
index 7b6b1fef2..082eb7d19 100644
--- a/internal/app/mediaedge/receiver_overlap_test.go
+++ b/internal/app/mediaedge/receiver_overlap_test.go
@@ -51,7 +51,7 @@ func TestNativeReceiverOverlapKeepsCurrentMedia(t *testing.T) {
 				}
 				t.Cleanup(func() { _ = receiver.Close() })
 				waitSignal(t, webrtc.GatheringCompletePromise(receiver.connection), "Native answer")
-				if err = edge.SetAnswer(*receiver.connection.LocalDescription()); err != nil {
+				if err = edge.SetAnswer(*receiver.connection.LocalDescription(), ""); err != nil {
 					t.Fatal(err)
 				}
 				waitConnected(t, edge.connection, id)
diff --git a/internal/app/mediaedge/relay_chain_fixture_test.go b/internal/app/mediaedge/relay_chain_fixture_test.go
index 5d1170a8e..b15913eca 100644
--- a/internal/app/mediaedge/relay_chain_fixture_test.go
+++ b/internal/app/mediaedge/relay_chain_fixture_test.go
@@ -138,7 +138,7 @@ func TestRelayChainEncodedFixture(t *testing.T) {
 		check(createErr)
 		relays = append(relays, receiver)
 		waitSignal(t, webrtc.GatheringCompletePromise(receiver.connection), "chain answer gathering")
-		check(edge.SetAnswer(*receiver.connection.LocalDescription()))
+		check(edge.SetAnswer(*receiver.connection.LocalDescription(), ""))
 		waitConnected(t, edge.connection, "chain upstream")
 		waitConnected(t, receiver.connection, "chain native receiver")
 		check(receiver.Source().SetRelayProfile(nativecapture.VideoProfile{
diff --git a/internal/app/nativecontrol/session.go b/internal/app/nativecontrol/session.go
index 74c488593..ca1af8cf7 100644
--- a/internal/app/nativecontrol/session.go
+++ b/internal/app/nativecontrol/session.go
@@ -57,7 +57,7 @@ type Session struct {
 }
 
 type outboundMediaSession interface {
-	SetAnswer(string, webrtc.SessionDescription) error
+	SetAnswer(string, webrtc.SessionDescription, string) error
 	AddCandidate(string, *webrtc.ICECandidateInit) error
 	CloseEdge(string)
 }
@@ -355,7 +355,8 @@ func (session *Session) Handle(ctx context.Context, payload []byte) (result any,
 		var request edgeAnswerRequest
 		if err := decodeStrict(payload, &request); err != nil ||
 			request.Type != envelope.Type ||
-			!validIdentities(request.ShareID, request.ConnectionID) {
+			!validIdentities(request.ShareID, request.ConnectionID) ||
+			(request.OfferID != "" && !identityPattern.MatchString(request.OfferID)) {
 			return nil, protocolViolation("native edge-answer request is invalid")
 		}
 		if !validSDP(request.SDP) {
@@ -368,6 +369,7 @@ func (session *Session) Handle(ctx context.Context, payload []byte) (result any,
 		if err := media.SetAnswer(
 			request.ConnectionID,
 			webrtc.SessionDescription{Type: webrtc.SDPTypeAnswer, SDP: request.SDP},
+			request.OfferID,
 		); err != nil {
 			return nil, err
 		}
@@ -696,12 +698,13 @@ func (session *Session) prepareLocalEdge(
 	var offer webrtc.SessionDescription
 	var err error
 	if host := session.current(request.ShareID); host != nil && request.SourceConnectionID == "" {
-		offer, err = host.PrepareLocalEdge(request.ConnectionID)
+		offer, err = host.PrepareLocalEdge(request.ConnectionID, envelope.ID, request.Restart)
 	} else if viewer := session.currentViewer(request.ShareID); viewer != nil &&
 		identityPattern.MatchString(request.SourceConnectionID) {
 		offer, err = viewer.PrepareLocalEdge(
 			request.SourceConnectionID,
 			request.ConnectionID,
+			envelope.ID, request.Restart,
 		)
 	} else {
 		return nil, errors.New("native media source does not exist")
diff --git a/internal/app/nativecontrol/wire.go b/internal/app/nativecontrol/wire.go
index eddcda346..96da3830f 100644
--- a/internal/app/nativecontrol/wire.go
+++ b/internal/app/nativecontrol/wire.go
@@ -125,6 +125,7 @@ type prepareLocalEdgeRequest struct {
 	ShareID            string `json:"shareId"`
 	ConnectionID       string `json:"connectionId"`
 	SourceConnectionID string `json:"sourceConnectionId,omitempty"`
+	Restart            bool   `json:"restart"`
 }
 
 type receiveOfferRequest struct {
@@ -170,6 +171,7 @@ type edgeAnswerRequest struct {
 	ShareID      string `json:"shareId"`
 	ConnectionID string `json:"connectionId"`
 	SDP          string `json:"sdp"`
+	OfferID      string `json:"offerId,omitempty"`
 }
 
 type edgeCandidateRequest struct {
diff --git a/internal/app/nativehost/audio_mix_test.go b/internal/app/nativehost/audio_mix_test.go
index 1e72e84c1..318963bdc 100644
--- a/internal/app/nativehost/audio_mix_test.go
+++ b/internal/app/nativehost/audio_mix_test.go
@@ -171,7 +171,7 @@ func TestAudioExclusionFailureMutesOnlySourceAndNeverFallsBack(t *testing.T) {
 
 func TestSameVideoSourceAudioChangesPreserveCaptureAndConnections(t *testing.T) {
 	session, options, _ := startMixedFixture(t)
-	if _, err := session.PrepareLocalEdge("audio_change"); err != nil {
+	if _, err := session.PrepareLocalEdge("audio_change", "local_offer_1", false); err != nil {
 		t.Fatal(err)
 	}
 	video, source, output, edge := session.stream, session.source, session.audioSource, session.edge("audio_change")
@@ -210,7 +210,7 @@ func TestNativeMicrophonePreservesMediaOwnersAcrossInputChanges(t *testing.T) {
 	if !session.HasAudio() || session.SourceAudio() == nil || *session.SourceAudio() {
 		t.Fatal("silent mixed output was not reserved independently of source")
 	}
-	_, err := session.PrepareLocalEdge("mixed_edge")
+	_, err := session.PrepareLocalEdge("mixed_edge", "local_offer_1", false)
 	check(err)
 	edge, source := session.edge("mixed_edge"), session.audioSource
 	enabled, gain := true, 1.0
diff --git a/internal/app/nativehost/audio_test.go b/internal/app/nativehost/audio_test.go
index 51bd8725a..a51ed0966 100644
--- a/internal/app/nativehost/audio_test.go
+++ b/internal/app/nativehost/audio_test.go
@@ -147,7 +147,7 @@ func TestAudioEOFWaitsForExplicitSourceReplacement(t *testing.T) {
 			}
 		}
 	})
-	offer, err := session.PrepareLocalEdge("audio-edge")
+	offer, err := session.PrepareLocalEdge("audio-edge", "local_offer_1", false)
 	check(err)
 	check(receiver.SetRemoteDescription(offer))
 	// A receive preference belongs to this answer, not the upstream offer.
@@ -184,7 +184,7 @@ func TestAudioEOFWaitsForExplicitSourceReplacement(t *testing.T) {
 	case <-ctx.Done():
 		t.Fatal("receiver gathering timed out")
 	}
-	check(session.SetAnswer("audio-edge", *receiver.LocalDescription()))
+	check(session.SetAnswer("audio-edge", *receiver.LocalDescription(), "local_offer_1"))
 	waitPackets := func(counter *atomic.Uint64, minimum uint64, label string) {
 		t.Helper()
 		deadline := time.Now().Add(3 * time.Second)
diff --git a/internal/app/nativehost/session.go b/internal/app/nativehost/session.go
index 2fa37f301..4868a3b2c 100644
--- a/internal/app/nativehost/session.go
+++ b/internal/app/nativehost/session.go
@@ -235,19 +235,27 @@ func (session *Session) PrepareEdge(
 	connectionID string,
 	iceServers []webrtc.ICEServer,
 ) (webrtc.SessionDescription, error) {
-	return session.prepareEdge(connectionID, iceServers, false)
+	return session.prepareEdge(connectionID, iceServers, "")
 }
 
 func (session *Session) PrepareLocalEdge(
-	connectionID string,
+	connectionID, offerID string,
+	restart bool,
 ) (webrtc.SessionDescription, error) {
-	return session.prepareEdge(connectionID, nil, true)
+	if restart {
+		edge := session.edge(connectionID)
+		if edge == nil {
+			return webrtc.SessionDescription{}, errors.New("native local media edge does not exist")
+		}
+		return edge.CreateLocalOffer(session.ctx, offerID, true)
+	}
+	return session.prepareEdge(connectionID, nil, offerID)
 }
 
 func (session *Session) prepareEdge(
 	connectionID string,
 	iceServers []webrtc.ICEServer,
-	local bool,
+	localOfferID string,
 ) (webrtc.SessionDescription, error) {
 	session.mu.Lock()
 	if session.closed || session.edges[connectionID] != nil {
@@ -259,7 +267,7 @@ func (session *Session) prepareEdge(
 		ConnectionID: connectionID,
 		ICEServers:   iceServers,
 		Audio:        session.audioSource,
-		Local:        local,
+		Local:        localOfferID != "",
 		Events: mediaedge.EdgeEvents{
 			LocalCandidate: func(candidate *webrtc.ICECandidateInit) {
 				session.emit(Event{
@@ -296,7 +304,12 @@ func (session *Session) prepareEdge(
 	}
 	session.edges[connectionID] = edge
 	session.mu.Unlock()
-	offer, err := edge.CreateOffer()
+	var offer webrtc.SessionDescription
+	if localOfferID != "" {
+		offer, err = edge.CreateLocalOffer(session.ctx, localOfferID, false)
+	} else {
+		offer, err = edge.CreateOffer()
+	}
 	if err != nil {
 		session.CloseEdge(connectionID)
 		return webrtc.SessionDescription{}, err
@@ -304,12 +317,12 @@ func (session *Session) prepareEdge(
 	return offer, nil
 }
 
-func (session *Session) SetAnswer(connectionID string, answer webrtc.SessionDescription) error {
+func (session *Session) SetAnswer(connectionID string, answer webrtc.SessionDescription, offerID string) error {
 	edge := session.edge(connectionID)
 	if edge == nil {
 		return errors.New("native media edge does not exist")
 	}
-	return edge.SetAnswer(answer)
+	return edge.SetAnswer(answer, offerID)
 }
 
 func (session *Session) AddCandidate(
@@ -709,7 +722,8 @@ func (session *Session) run() {
 	}()
 	if session.mixer != nil {
 		go func() { session.mixer.run(); close(audioDone) }()
-	} else if session.audioStream == nil {
+	} else if session.audioSource == nil {
+		// The session's output shape is fixed; source inputs can change concurrently.
 		close(audioDone)
 	} else {
 		go func() {
diff --git a/internal/app/nativeviewer/session.go b/internal/app/nativeviewer/session.go
index c48ad5d6c..a2aa88cb7 100644
--- a/internal/app/nativeviewer/session.go
+++ b/internal/app/nativeviewer/session.go
@@ -203,9 +203,20 @@ func (session *Session) AddReceiverCandidate(
 
 func (session *Session) PrepareLocalEdge(
 	sourceConnectionID string,
-	connectionID string,
+	connectionID, offerID string,
+	restart bool,
 ) (webrtc.SessionDescription, error) {
-	return session.prepareEdge(sourceConnectionID, connectionID, nil, true)
+	if restart {
+		session.mu.Lock()
+		current := session.edges[connectionID]
+		available := !session.closed && current.edge != nil && current.sourceConnectionID == sourceConnectionID
+		session.mu.Unlock()
+		if !available {
+			return webrtc.SessionDescription{}, errors.New("native local Viewer edge does not exist")
+		}
+		return current.edge.CreateLocalOffer(session.ctx, offerID, true)
+	}
+	return session.prepareEdge(sourceConnectionID, connectionID, nil, offerID)
 }
 
 func (session *Session) PrepareEdge(
@@ -213,15 +224,16 @@ func (session *Session) PrepareEdge(
 	connectionID string,
 	iceServers []webrtc.ICEServer,
 ) (webrtc.SessionDescription, error) {
-	return session.prepareEdge(sourceConnectionID, connectionID, iceServers, false)
+	return session.prepareEdge(sourceConnectionID, connectionID, iceServers, "")
 }
 
 func (session *Session) prepareEdge(
 	sourceConnectionID string,
 	connectionID string,
 	iceServers []webrtc.ICEServer,
-	local bool,
+	localOfferID string,
 ) (webrtc.SessionDescription, error) {
+	local := localOfferID != ""
 	receiver := session.receiver(sourceConnectionID)
 	if receiver == nil {
 		return webrtc.SessionDescription{}, errors.New("native Viewer source does not exist")
@@ -279,7 +291,12 @@ func (session *Session) prepareEdge(
 		edge: edge, sourceConnectionID: sourceConnectionID,
 	}
 	session.mu.Unlock()
-	offer, err := edge.CreateOffer()
+	var offer webrtc.SessionDescription
+	if local {
+		offer, err = edge.CreateLocalOffer(session.ctx, localOfferID, false)
+	} else {
+		offer, err = edge.CreateOffer()
+	}
 	if err != nil {
 		session.CloseEdge(connectionID)
 		return webrtc.SessionDescription{}, err
@@ -287,12 +304,12 @@ func (session *Session) prepareEdge(
 	return offer, nil
 }
 
-func (session *Session) SetAnswer(connectionID string, answer webrtc.SessionDescription) error {
+func (session *Session) SetAnswer(connectionID string, answer webrtc.SessionDescription, offerID string) error {
 	edge := session.edge(connectionID)
 	if edge == nil {
 		return errors.New("native Viewer edge does not exist")
 	}
-	return edge.SetAnswer(answer)
+	return edge.SetAnswer(answer, offerID)
 }
 
 func (session *Session) AddCandidate(connectionID string, candidate *webrtc.ICECandidateInit) error {
diff --git a/internal/app/nativeviewer/session_test.go b/internal/app/nativeviewer/session_test.go
index b5aafbe5b..5123c12b5 100644
--- a/internal/app/nativeviewer/session_test.go
+++ b/internal/app/nativeviewer/session_test.go
@@ -47,7 +47,7 @@ func TestOfferReuseKeepsSourceAndChildOwnership(t *testing.T) {
 				t.Fatal("incompatible source retained its old edge")
 			}
 			receiver := session.receiver("upstream")
-			if _, err = session.PrepareLocalEdge("upstream", "local-playback"); err != nil {
+			if _, err = session.PrepareLocalEdge("upstream", "local-playback", "local_offer_1", false); err != nil {
 				t.Fatal(err)
 			}
 			child := session.edge("local-playback")
diff --git a/src/client/native/client.ts b/src/client/native/client.ts
index 84ae94de3..81e04d8c5 100644
--- a/src/client/native/client.ts
+++ b/src/client/native/client.ts
@@ -501,12 +501,14 @@ export class NativeClient {
     shareId: string,
     connectionId: string,
     sourceConnectionId?: string,
-  ): Promise<RTCSessionDescriptionInit> {
+    restart = false,
+  ): Promise<RTCSessionDescriptionInit & { offerId: string }> {
     const response = await this.request(
       "prepare-local-edge",
       {
         shareId,
         connectionId,
+        restart,
         ...(sourceConnectionId ? { sourceConnectionId } : {}),
       },
       edgeOfferResponseSchema,
@@ -517,7 +519,7 @@ export class NativeClient {
     ) {
       throw new Error("Native local edge identity changed");
     }
-    return { type: "offer", sdp: response.sdp };
+    return { type: "offer", sdp: response.sdp, offerId: response.id };
   }
 
   async receiveOffer(
@@ -591,13 +593,14 @@ export class NativeClient {
     shareId: string,
     connectionId: string,
     payload: SignalPayload,
+    offerId?: string,
   ): Promise<void> {
     if (payload.connectionId !== connectionId) return;
     if (payload.kind === "description") {
       if (payload.description.type !== "answer") return;
       await this.request(
         "edge-answer",
-        { shareId, connectionId, sdp: payload.description.sdp },
+        { shareId, connectionId, sdp: payload.description.sdp, ...(offerId ? { offerId } : {}) },
         nativeAckResponseSchema,
       );
       return;
diff --git a/src/client/native/media-bridge.ts b/src/client/native/media-bridge.ts
index dcaf209f5..b04db9867 100644
--- a/src/client/native/media-bridge.ts
+++ b/src/client/native/media-bridge.ts
@@ -3,7 +3,6 @@ import { createOpaqueId } from "../lib/opaque-id";
 import { browserDebugEnabled, debugError, debugEvent } from "../lib/debug";
 import { observeDebugConnection } from "../lib/debug-webrtc";
 import type { ConnectionMetrics } from "../types";
-import { addRemoteIceCandidate, type SignalCandidate } from "../webrtc/nat-prediction";
 import { preferScreenAudioStereo } from "../webrtc/screen-audio-sdp";
 import {
   collectConnectionMetrics,
@@ -13,7 +12,7 @@ import {
 import type { NativeClientEvent } from "./wire";
 
 const BRIDGE_TIMEOUT_MS = 8_000;
-const MAX_PENDING_CANDIDATES = 64;
+const DISCONNECTED_GRACE_MS = 3_000;
 
 export class NativeMediaBridgeError extends Error {}
 export class NativeMediaBridgeInitializationError extends NativeMediaBridgeError {}
@@ -23,11 +22,13 @@ export interface NativeMediaBridgeControl {
     shareId: string,
     connectionId: string,
     sourceConnectionId?: string,
-  ): Promise<RTCSessionDescriptionInit>;
+    restart?: boolean,
+  ): Promise<RTCSessionDescriptionInit & { offerId: string }>;
   acceptSignal(
     shareId: string,
     connectionId: string,
     payload: SignalPayload,
+    offerId?: string,
   ): Promise<void>;
   closeEdge(shareId: string, connectionId: string): Promise<void>;
   onEvent(listener: (event: NativeClientEvent) => void): () => void;
@@ -38,14 +39,16 @@ export class NativeMediaBridge {
   readonly connectionId = createOpaqueId();
 
   private readonly peer: RTCPeerConnection;
-  private readonly pendingCandidates: SignalCandidate[] = [];
+  private readonly lifetime = new AbortController();
   private unsubscribe: (() => void) | null = null;
   private edgeRequested = false;
-  private remoteDescriptionSet = false;
   private ready = false;
   private disposed = false;
-  private startTimer: number | null = null;
-  private rejectStart: ((error: Error) => void) | null = null;
+  private expectedAudio = false;
+  private deadline: number | null = null;
+  private disconnectTimer: number | null = null;
+  private completeNegotiation: (() => void) | null = null;
+  private rejectNegotiation: ((error: Error) => void) | null = null;
 
   constructor(
     private readonly shareId: string,
@@ -81,39 +84,16 @@ export class NativeMediaBridge {
     if (this.disposed || this.unsubscribe) {
       throw new NativeMediaBridgeError("Native media bridge is unavailable");
     }
-    const started = new Promise<MediaStream>((resolve, reject) => {
-      this.rejectStart = reject;
-      this.startTimer = window.setTimeout(() => this.fail("timeout"), BRIDGE_TIMEOUT_MS);
-      const complete = () => {
-        if (
-          !this.ready &&
-          this.peer.connectionState === "connected" &&
-          this.stream.getVideoTracks().length > 0 &&
-          (!expectedAudio || this.stream.getAudioTracks().length > 0)
-        ) {
-          this.ready = true;
-          this.rejectStart = null;
-          this.clearStartTimer();
-          resolve(this.stream);
-        }
-      };
-      this.peer.addEventListener("track", (event) => {
-        if (!this.stream.getTracks().includes(event.track)) {
-          this.stream.addTrack(event.track);
-        }
-        complete();
-      });
-      this.peer.addEventListener("connectionstatechange", () => {
-        debugEvent("native-bridge", "connection-state", { state: this.peer.connectionState });
-        if (
-          this.peer.connectionState === "failed" ||
-          this.peer.connectionState === "closed"
-        ) {
-          this.fail("connection-state");
-          return;
-        }
-        complete();
-      });
+    this.expectedAudio = expectedAudio;
+    this.peer.addEventListener("track", (event) => {
+      if (this.disposed) return;
+      if (!this.stream.getTracks().includes(event.track)) this.stream.addTrack(event.track);
+      this.completeNegotiation?.();
+    });
+    this.peer.addEventListener("connectionstatechange", () => {
+      debugEvent("native-bridge", "connection-state", { state: this.peer.connectionState });
+      this.connectionStateChanged(this.peer.connectionState);
+      this.completeNegotiation?.();
     });
     this.peer.addEventListener("iceconnectionstatechange", () => {
       debugEvent("native-bridge", "ice-state", { state: this.peer.iceConnectionState });
@@ -121,25 +101,6 @@ export class NativeMediaBridge {
     this.peer.addEventListener("icegatheringstatechange", () => {
       debugEvent("native-bridge", "ice-gathering-state", { state: this.peer.iceGatheringState });
     });
-    this.peer.addEventListener("icecandidate", (event) => {
-      if (this.disposed) return;
-      void this.control.acceptSignal(
-        this.shareId,
-        this.connectionId,
-        {
-          kind: "candidate",
-          connectionId: this.connectionId,
-          candidate: event.candidate
-            ? {
-                candidate: event.candidate.candidate,
-                sdpMid: event.candidate.sdpMid,
-                sdpMLineIndex: event.candidate.sdpMLineIndex,
-                usernameFragment: event.candidate.usernameFragment,
-              }
-            : null,
-        },
-      ).catch((error) => this.fail("candidate-signal", error));
-    });
     this.unsubscribe = this.control.onEvent((event) => {
       if (event.shareId !== this.shareId) return;
       if (event.type === "share-ended") {
@@ -152,77 +113,22 @@ export class NativeMediaBridge {
       ) {
         return;
       }
-      if (event.type === "edge-candidate") {
-        if (!this.remoteDescriptionSet) {
-          if (this.pendingCandidates.length >= MAX_PENDING_CANDIDATES) {
-            this.fail("candidate-overflow");
-          } else {
-            this.pendingCandidates.push(event.candidate);
-          }
-          return;
-        }
-        void addRemoteIceCandidate(this.peer, event.candidate)
-          .catch((error) => this.fail("candidate-apply", error));
-      } else if (
-        event.type === "edge-state" &&
-        (event.state === "failed" || event.state === "closed")
-      ) {
-        this.fail("native-state");
-      }
+      if (event.type === "edge-state") this.connectionStateChanged(event.state);
     });
-
-    const negotiate = async () => {
-      this.edgeRequested = true;
-      const offer = await this.control.prepareLocalEdge(
-        this.shareId,
-        this.connectionId,
-        this.sourceConnectionId,
-      );
-      if (this.disposed) return await started;
-      await this.peer.setRemoteDescription(offer);
-      this.remoteDescriptionSet = true;
-      for (const candidate of this.pendingCandidates.splice(0)) {
-        await addRemoteIceCandidate(this.peer, candidate);
-      }
-      const answer = preferScreenAudioStereo(await this.peer.createAnswer());
-      if (!answer.sdp) {
-        throw new Error("Native media bridge produced no SDP answer");
-      }
-      await this.peer.setLocalDescription(answer);
-      if (this.disposed) return await started;
-      await this.control.acceptSignal(
-        this.shareId,
-        this.connectionId,
-        {
-          kind: "description",
-          connectionId: this.connectionId,
-          description: {
-            type: "answer",
-            sdp: answer.sdp,
-          },
-        },
-      );
-      return await started;
-    };
-    try {
-      return await Promise.race([negotiate(), started]);
-    } catch (error) {
-      this.fail("negotiation", error);
-      throw error instanceof NativeMediaBridgeError
-        ? error
-        : new NativeMediaBridgeError("Native media bridge failed", { cause: error });
-    }
+    return this.negotiate(false);
   }
 
   dispose(): void {
     if (this.disposed) return;
     this.disposed = true;
-    this.rejectStart?.(new NativeMediaBridgeError("Native media bridge failed"));
-    this.rejectStart = null;
+    this.lifetime.abort();
+    this.rejectNegotiation?.(new NativeMediaBridgeError("Native media bridge failed"));
+    this.rejectNegotiation = null;
+    this.completeNegotiation = null;
     this.unsubscribe?.();
     this.unsubscribe = null;
-    this.clearStartTimer();
-    this.pendingCandidates.length = 0;
+    this.clearDeadline();
+    this.clearDisconnectTimer();
     this.peer.close();
     this.stream.getTracks().forEach((track) => track.stop());
     if (this.edgeRequested) {
@@ -232,12 +138,102 @@ export class NativeMediaBridge {
     }
   }
 
+  private connectionStateChanged(state: RTCPeerConnectionState): void {
+    if (this.disposed) return;
+    if (state === "closed" || (!this.ready && state === "failed")) {
+      this.fail("connection-state");
+      return;
+    }
+    if (state === "connected") {
+      if (this.peer.connectionState === "connected") this.clearDisconnectTimer();
+      return;
+    }
+    if (!this.ready || this.completeNegotiation) return;
+    const restart = () => {
+      this.clearDisconnectTimer();
+      if (this.disposed || this.completeNegotiation) return;
+      debugEvent("native-bridge", "restart");
+      void this.negotiate(true).catch(() => undefined);
+    };
+    if (state === "failed") restart();
+    else if (state === "disconnected" && this.disconnectTimer === null) {
+      this.disconnectTimer = window.setTimeout(restart, DISCONNECTED_GRACE_MS);
+    }
+  }
+
+  private negotiate(restart: boolean): Promise<MediaStream> {
+    return new Promise((resolve, reject) => {
+      let signaled = false;
+      this.rejectNegotiation = reject;
+      this.deadline = window.setTimeout(() => this.fail("timeout"), BRIDGE_TIMEOUT_MS);
+      this.completeNegotiation = () => {
+        if (!signaled || this.disposed || this.peer.connectionState !== "connected" ||
+            this.stream.getVideoTracks().length === 0 ||
+            (this.expectedAudio && this.stream.getAudioTracks().length === 0)) return;
+        // This proves the local transport. First-frame/playback owners still
+        // prove media progress; an intentionally paused source can remain quiet.
+        this.ready = true;
+        this.completeNegotiation = null;
+        this.rejectNegotiation = null;
+        this.clearDeadline();
+        resolve(this.stream);
+      };
+      void this.exchangeDescriptions(restart).then(() => {
+        signaled = true;
+        this.completeNegotiation?.();
+      }).catch(error => this.fail("negotiation", error));
+    });
+  }
+
+  private async exchangeDescriptions(restart: boolean): Promise<void> {
+    this.edgeRequested = true;
+    const { offerId, ...offer } = await this.control.prepareLocalEdge(
+      this.shareId, this.connectionId, this.sourceConnectionId, restart,
+    );
+    this.lifetime.signal.throwIfAborted();
+    await this.peer.setRemoteDescription(offer);
+    this.lifetime.signal.throwIfAborted();
+    const answer = preferScreenAudioStereo(await this.peer.createAnswer());
+    this.lifetime.signal.throwIfAborted();
+    await this.peer.setLocalDescription(answer);
+    await this.gatherCandidates();
+    this.lifetime.signal.throwIfAborted();
+    const sdp = this.peer.localDescription?.sdp;
+    if (!sdp) throw new Error("Native media bridge produced no SDP answer");
+    await this.control.acceptSignal(this.shareId, this.connectionId, {
+      kind: "description", connectionId: this.connectionId,
+      description: { type: "answer", sdp },
+    }, offerId);
+  }
+
+  private gatherCandidates(): Promise<void> {
+    const signal = this.lifetime.signal;
+    signal.throwIfAborted();
+    if (this.peer.iceGatheringState === "complete") return Promise.resolve();
+    return new Promise((resolve, reject) => {
+      const cleanup = () => {
+        this.peer.removeEventListener("icegatheringstatechange", complete);
+        signal.removeEventListener("abort", aborted);
+      };
+      const complete = () => {
+        if (this.peer.iceGatheringState !== "complete") return;
+        cleanup();
+        resolve();
+      };
+      const aborted = () => { cleanup(); reject(signal.reason); };
+      this.peer.addEventListener("icegatheringstatechange", complete);
+      signal.addEventListener("abort", aborted, { once: true });
+    });
+  }
+
   private fail(reason: string, error?: unknown): void {
     if (this.disposed) return;
     const details = { type: reason, state: this.ready ? "active" : "starting" };
     if (error === undefined) debugEvent("native-bridge", "failed", details);
     else debugError("native-bridge", "failed", error, details);
     void this.reportFailureDiagnostics();
+    this.rejectNegotiation?.(new NativeMediaBridgeError("Native media bridge failed", { cause: error }));
+    this.rejectNegotiation = null;
     if (this.ready) this.onFailed();
     this.dispose();
   }
@@ -276,9 +272,15 @@ export class NativeMediaBridge {
     }
   }
 
-  private clearStartTimer(): void {
-    if (this.startTimer === null) return;
-    window.clearTimeout(this.startTimer);
-    this.startTimer = null;
+  private clearDeadline(): void {
+    if (this.deadline === null) return;
+    window.clearTimeout(this.deadline);
+    this.deadline = null;
+  }
+
+  private clearDisconnectTimer(): void {
+    if (this.disconnectTimer === null) return;
+    window.clearTimeout(this.disconnectTimer);
+    this.disconnectTimer = null;
   }
 }
diff --git a/tests/native-client.test.ts b/tests/native-client.test.ts
index 1879b9674..180f776c5 100644
--- a/tests/native-client.test.ts
+++ b/tests/native-client.test.ts
@@ -39,6 +39,47 @@ describe("native App private wire", () => {
     expect(nativeHealthSchema.safeParse({ ...health, nativeMedia: { ...nativeMedia, maxVideoMacroblocksPerSecond: -1 } }).success).toBe(false);
   });
 
+  it("binds a local answer to its prepare request across an ICE restart", async () => {
+    const requests: Record<string, unknown>[] = [];
+    class Socket extends EventTarget {
+      static readonly OPEN = 1;
+      static readonly CLOSING = 2;
+      readyState = Socket.OPEN;
+      protocol = `piik-client-v10.${health.instanceToken}`;
+      constructor() { super(); queueMicrotask(() => this.dispatchEvent(new Event("open"))); }
+      close() { this.readyState = Socket.CLOSING; }
+      send(payload: string) {
+        const request = JSON.parse(payload) as Record<string, unknown>;
+        requests.push(request);
+        const fields = request.type === "hello" ? { type: "ready" }
+          : request.type === "prepare-local-edge" ? {
+            type: "edge-offer", shareId: request.shareId, connectionId: request.connectionId, sdp: "v=0\r\n",
+          } : { type: "edge-answer-accepted" };
+        queueMicrotask(() => this.dispatchEvent(new MessageEvent("message", {
+          data: JSON.stringify({ version: 10, id: request.id, ...fields }),
+        })));
+      }
+    }
+    vi.stubGlobal("WebSocket", Socket);
+    vi.stubGlobal("window", { setTimeout, clearTimeout });
+    vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify(health))));
+    const client = (await NativeClient.connect())!;
+    try {
+      let lastOffer = "";
+      for (const restart of [false, true]) {
+        const offer = await client.prepareLocalEdge("share_123456", "local_123456", "source_123456", restart);
+        expect(offer.offerId).toBe(requests.at(-1)?.id);
+        expect(offer.offerId).not.toBe(lastOffer);
+        expect(requests.at(-1)).toMatchObject({ type: "prepare-local-edge", restart, sourceConnectionId: "source_123456" });
+        await client.acceptSignal("share_123456", "local_123456", {
+          kind: "description", connectionId: "local_123456", description: { type: "answer", sdp: "v=0\r\n" },
+        }, offer.offerId);
+        expect(requests.at(-1)).toMatchObject({ type: "edge-answer", offerId: offer.offerId });
+        lastOffer = offer.offerId;
+      }
+    } finally { client.close(); }
+  });
+
   it.each(["prompt", "denied"] as const)("does not hold Viewer reception for %s permission and observes a later grant", async (state) => {
     vi.stubGlobal("window", { setTimeout, clearTimeout, location: { hostname: "piik.example" } });
     const query = vi.fn().mockResolvedValue({ state });
diff --git a/tests/native-media-bridge.test.ts b/tests/native-media-bridge.test.ts
index da1273ee7..52efbc2b8 100644
--- a/tests/native-media-bridge.test.ts
+++ b/tests/native-media-bridge.test.ts
@@ -38,7 +38,8 @@ class FakeMediaStream {
 class FakePeerConnection extends EventTarget {
   connectionState: RTCPeerConnectionState = "new";
   iceConnectionState: RTCIceConnectionState = "new";
-  iceGatheringState: RTCIceGatheringState = "new";
+  iceGatheringState: RTCIceGatheringState = "complete";
+  localDescription: RTCSessionDescriptionInit | null = null;
   readonly getReceivers = vi.fn<() => RTCRtpReceiver[]>(() => []);
   readonly getSenders = vi.fn<() => RTCRtpSender[]>(() => []);
   readonly getStats = vi.fn(async () => new Map());
@@ -48,7 +49,9 @@ class FakePeerConnection extends EventTarget {
     type: "answer" as const,
     sdp: "v=0\r\n",
   }));
-  readonly setLocalDescription = vi.fn(async (): Promise<void> => undefined);
+  readonly setLocalDescription = vi.fn(async (description: RTCSessionDescriptionInit): Promise<void> => {
+    this.localDescription = description;
+  });
   readonly close = vi.fn(() => {
     this.connectionState = "closed";
   });
@@ -78,20 +81,11 @@ function fixture(options: {
   });
   const prepareLocalEdge = vi.fn<
     NativeMediaBridgeControl["prepareLocalEdge"]
-  >(async (_shareId, connectionId) => {
-      listener?.({
-        version: 10,
-        type: "edge-candidate",
-        shareId: "share_123456",
-        connectionId,
-        candidate: {
-          candidate: "candidate:1 1 udp 1 127.0.0.1 9 typ host",
-        },
-      });
+  >(async () => {
       if (options.hangPreparation) {
-        return await new Promise<RTCSessionDescriptionInit>(() => undefined);
+        return await new Promise<RTCSessionDescriptionInit & { offerId: string }>(() => undefined);
       }
-      return { type: "offer", sdp: "v=0\r\n" };
+      return { type: "offer", sdp: "v=0\r\n", offerId: "local_offer_1" };
     });
   const control: NativeMediaBridgeControl = {
     prepareLocalEdge,
@@ -130,6 +124,82 @@ afterEach(() => {
 });
 
 describe("native media bridge", () => {
+  it("recovers one retained transport after a disconnect grace, including a quiet source", async () => {
+    vi.useFakeTimers();
+    const current = fixture();
+    const starting = current.bridge.start(true);
+    const video = { kind: "video", stop: vi.fn() } as unknown as MediaStreamTrack;
+    const audio = { kind: "audio", stop: vi.fn() } as unknown as MediaStreamTrack;
+    current.peer().emitTrack(video);
+    current.peer().emitTrack(audio);
+    current.peer().setState("connected");
+    await starting;
+
+    current.peer().setState("disconnected");
+    await vi.advanceTimersByTimeAsync(2_000);
+    current.peer().setState("connected");
+    await vi.advanceTimersByTimeAsync(3_000);
+    expect(current.control.prepareLocalEdge).toHaveBeenCalledTimes(1);
+
+    vi.mocked(current.control.prepareLocalEdge).mockResolvedValueOnce({
+      type: "offer", sdp: "v=0\r\n", offerId: "local_offer_2",
+    });
+    current.peer().setState("disconnected");
+    await vi.advanceTimersByTimeAsync(3_000);
+    current.emit({ version: 10, type: "edge-state", shareId: "share_123456",
+      connectionId: current.bridge.connectionId, state: "failed" });
+    expect(current.control.prepareLocalEdge).toHaveBeenLastCalledWith(
+      "share_123456", current.bridge.connectionId, undefined, true,
+    );
+    expect(current.control.prepareLocalEdge).toHaveBeenCalledTimes(2);
+    expect(current.control.acceptSignal).toHaveBeenLastCalledWith(
+      "share_123456", current.bridge.connectionId, expect.objectContaining({ kind: "description" }), "local_offer_2",
+    );
+    current.peer().setState("connected");
+    await vi.advanceTimersByTimeAsync(8_000);
+    expect(current.bridge.stream.getTracks()).toEqual([video, audio]);
+    expect(video.stop).not.toHaveBeenCalled();
+    expect(audio.stop).not.toHaveBeenCalled();
+    expect(current.peer().close).not.toHaveBeenCalled();
+    expect(current.onFailed).not.toHaveBeenCalled();
+    current.bridge.dispose();
+  });
+
+  it("bounds a failed restart and ignores its late offer after disposal", async () => {
+    vi.useFakeTimers();
+    const current = fixture();
+    const starting = current.bridge.start();
+    current.peer().emitTrack({ kind: "video", stop: vi.fn() } as unknown as MediaStreamTrack);
+    current.peer().setState("connected");
+    await starting;
+    let finish!: (offer: RTCSessionDescriptionInit & { offerId: string }) => void;
+    vi.mocked(current.control.prepareLocalEdge).mockImplementationOnce(() => new Promise(resolve => { finish = resolve; }));
+    current.peer().setState("failed");
+    current.peer().setState("failed");
+    expect(current.control.prepareLocalEdge).toHaveBeenCalledTimes(2);
+    await vi.advanceTimersByTimeAsync(8_000);
+    finish({ type: "offer", sdp: "v=0\r\n", offerId: "late_offer" });
+    await vi.advanceTimersByTimeAsync(1);
+    expect(current.onFailed).toHaveBeenCalledOnce();
+    expect(current.peer().setRemoteDescription).toHaveBeenCalledOnce();
+    expect(current.control.acceptSignal).toHaveBeenCalledOnce();
+    expect(current.control.closeEdge).toHaveBeenCalledOnce();
+  });
+
+  it("gathers the answer before signaling and cancels gathering on disposal", async () => {
+    const current = fixture();
+    current.peer().iceGatheringState = "gathering";
+    const starting = current.bridge.start();
+    const rejected = expect(starting).rejects.toBeInstanceOf(NativeMediaBridgeError);
+    await vi.waitFor(() => expect(current.peer().setLocalDescription).toHaveBeenCalledOnce());
+    expect(current.control.acceptSignal).not.toHaveBeenCalled();
+    current.bridge.dispose();
+    current.peer().iceGatheringState = "complete";
+    current.peer().dispatchEvent(new Event("icegatheringstatechange"));
+    await rejected;
+    expect(current.control.acceptSignal).not.toHaveBeenCalled();
+  });
+
   it("advertises the same Opus receive range on local preview as remote viewers", async () => {
     const current = fixture();
     current.peer().createAnswer.mockResolvedValueOnce({ type: "answer", sdp:
@@ -143,7 +213,7 @@ describe("native media bridge", () => {
         kind: "description", description: expect.objectContaining({
           sdp: expect.stringContaining("stereo=1;maxaveragebitrate=510000"),
         }),
-      }),
+      }), "local_offer_1",
     ));
     expect(current.peer().setLocalDescription).toHaveBeenCalledWith(expect.objectContaining({
       sdp: expect.stringContaining("stereo=1;maxaveragebitrate=510000"),
@@ -197,107 +267,6 @@ describe("native media bridge", () => {
     expect(current.onFailed).not.toHaveBeenCalled();
   });
 
-  it.each(["candidate-signal", "candidate-apply"])("preserves the active %s failure and retires once", async (stage) => {
-    const current = fixture();
-    const starting = current.bridge.start();
-    await vi.waitFor(() => expect(current.peer().setLocalDescription).toHaveBeenCalledOnce());
-    current.peer().emitTrack({ kind: "video", stop: vi.fn() } as unknown as MediaStreamTrack);
-    current.peer().setState("connected");
-    await starting;
-    const cause = new DOMException("Connection is unavailable", "InvalidStateError");
-    if (stage === "candidate-signal") {
-      vi.mocked(current.control.acceptSignal).mockRejectedValueOnce(cause);
-      current.peer().dispatchEvent(Object.assign(new Event("icecandidate"), { candidate: null }));
-    } else {
-      current.peer().addIceCandidate.mockRejectedValueOnce(cause);
-      current.emit({ version: 10, type: "edge-candidate", shareId: "share_123456",
-        connectionId: current.bridge.connectionId, candidate: null });
-    }
-    await vi.waitFor(() => expect(current.onFailed).toHaveBeenCalledOnce());
-    expect(debugError).toHaveBeenCalledWith("native-bridge", "failed", cause, { type: stage, state: "active" });
-    expect(current.peer().close).toHaveBeenCalledOnce();
-    expect(current.control.closeEdge).toHaveBeenCalledOnce();
-  });
-
-  it.each(["queued", "active"])("keeps media alive after a %s candidate is rejected", async (phase) => {
-    const current = fixture();
-    const peer = current.peer();
-    if (phase === "queued") {
-      peer.addIceCandidate.mockRejectedValueOnce(new DOMException("Rejected candidate", "OperationError"));
-    }
-    const starting = current.bridge.start();
-    // Register a rejection observer before allowing negotiation to run.
-    const result = starting.catch((error: unknown) => error);
-    if (phase === "queued") {
-      current.emit({
-        version: 10, type: "edge-candidate", shareId: "share_123456",
-        connectionId: current.bridge.connectionId,
-        candidate: { candidate: "candidate:2 1 udp 1 127.0.0.1 10 typ host" },
-      });
-    }
-    await vi.waitFor(() => expect(peer.setLocalDescription).toHaveBeenCalledOnce());
-    const track = { kind: "video", stop: vi.fn() } as unknown as MediaStreamTrack;
-    peer.emitTrack(track);
-    peer.setState("connected");
-    await expect(result).resolves.toBe(current.bridge.stream);
-    if (phase === "active") {
-      peer.addIceCandidate.mockRejectedValueOnce(new DOMException("Rejected candidate", "OperationError"));
-      current.emit({
-        version: 10, type: "edge-candidate", shareId: "share_123456",
-        connectionId: current.bridge.connectionId,
-        candidate: { candidate: "candidate:2 1 udp 1 127.0.0.1 10 typ host" },
-      });
-    }
-    current.emit({
-      version: 10, type: "edge-candidate", shareId: "share_123456",
-      connectionId: current.bridge.connectionId, candidate: null,
-    });
-    await vi.waitFor(() => expect(debugError).toHaveBeenCalledWith(
-      "webrtc", "remote-candidate-rejected", expect.any(DOMException), { origin: "ordinary" },
-    ));
-    expect(peer.addIceCandidate).toHaveBeenCalledWith(null);
-    expect(peer.close).not.toHaveBeenCalled();
-    expect(track.stop).not.toHaveBeenCalled();
-    expect(current.onFailed).not.toHaveBeenCalled();
-    current.bridge.dispose();
-  });
-
-  it("still rejects invalid negotiation state when applying a candidate", async () => {
-    const current = fixture();
-    current.peer().addIceCandidate.mockRejectedValueOnce(new DOMException("No description", "InvalidStateError"));
-    await expect(current.bridge.start()).rejects.toBeInstanceOf(NativeMediaBridgeError);
-    expect(current.peer().close).toHaveBeenCalledOnce();
-    expect(current.control.closeEdge).toHaveBeenCalledOnce();
-  });
-
-  it("orders an early native candidate after the remote offer", async () => {
-    const current = fixture();
-    const starting = current.bridge.start();
-    await vi.waitFor(() => {
-      expect(current.peer().setLocalDescription).toHaveBeenCalledOnce();
-    });
-    const track = {
-      kind: "video",
-      stop: vi.fn(),
-    } as unknown as MediaStreamTrack;
-    current.peer().emitTrack(track);
-    current.peer().setState("connected");
-
-    await expect(starting).resolves.toBe(current.bridge.stream);
-    expect(current.peer().addIceCandidate).toHaveBeenCalledWith(
-      expect.objectContaining({ candidate: expect.stringContaining("127.0.0.1") }),
-    );
-    expect(current.control.acceptSignal).toHaveBeenCalledWith(
-      "share_123456",
-      current.bridge.connectionId,
-      expect.objectContaining({ kind: "description" }),
-    );
-    current.bridge.dispose();
-    expect(current.peer().close).toHaveBeenCalledOnce();
-    expect(track.stop).toHaveBeenCalledOnce();
-    expect(current.control.closeEdge).toHaveBeenCalledOnce();
-  });
-
   it("releases a local edge when preparation exceeds the total deadline", async () => {
     vi.useFakeTimers();
     const current = fixture({ hangPreparation: true });
@@ -389,7 +358,7 @@ describe("native media bridge", () => {
     );
   });
 
-  it("reports an active native failure once and retires its edge", async () => {
+  it("retires an actively closed native edge once", async () => {
     const current = fixture();
     const starting = current.bridge.start();
     await vi.waitFor(() => {
@@ -407,14 +376,14 @@ describe("native media bridge", () => {
       type: "edge-state",
       shareId: "share_123456",
       connectionId: current.bridge.connectionId,
-      state: "failed",
+      state: "closed",
     });
     current.emit({
       version: 10,
       type: "edge-state",
       shareId: "share_123456",
       connectionId: current.bridge.connectionId,
-      state: "failed",
+      state: "closed",
     });
 
     expect(current.onFailed).toHaveBeenCalledOnce();
@@ -445,7 +414,7 @@ describe("native media bridge", () => {
     if (stage === "prepare") {
       vi.mocked(current.control.prepareLocalEdge).mockImplementationOnce(async () => {
         await pending;
-        return { type: "offer", sdp: "v=0\r\n" };
+        return { type: "offer", sdp: "v=0\r\n", offerId: "local_offer_1" };
       });
     } else {
       current.peer().setLocalDescription.mockImplementationOnce(() => pending);

From 6436e4a53e7ecf06d818f58a44d8e7e6afcfc87b Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 04:30:55 +0800
Subject: [PATCH 092/262] docs(research): record combined browser transport
 evidence

---
 docs/research/nat-traversal.md | 17 +++++++++++++++++
 docs/todo.md                   |  7 +++++--
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index c3f578dca..fd7368fb0 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -741,6 +741,23 @@ These controls use ordinary Pion and generated media. They close the reproduced
 bridge gap, not the remaining Magicsock composition, physical roaming or platform
 acceptance boundaries.
 
+The aligned candidate also combines the real Native encoder/forwarder/receiver
+with the actual Browser bridge over the experimental Tailcat socket. Chromium
+152 and Firefox 151 each pass an unchanged ordinary-Pion control and both
+Tailcat address-change directions. After DERP closes, new blue content keeps
+rendering on the same track. Firefox renegotiates its local leg once when that
+endpoint moves; Chromium retains its working loopback leg. Local HTTP replaces
+Native control only in this fixture; App authorization and the room controller
+are not exercised. No product timeout or address policy changes for this check.
+
+The matching FFmpeg matrix passed five of six cases. One source-address handoff
+kept decoded-frame counts advancing but lost the expected new colour; three
+focused repetitions then passed. Decoder errors and this intermittent result
+remain unresolved. The FFmpeg sink's direct SDK assembler differs from the
+product relay-input owner, so the observation needs a matched bitstream/assembler
+control before attributing it to product transport. Browser passes do not erase
+that failed control or establish universal continuity.
+
 Dual-stack namespace controls enabled STUN and alternately blocked IPv4 UDP or
 IPv6 forwarding. Both stacks used the working family; Tailcat's direct proof
 required fresh bidirectional delivery after DERP closed. One side reporting a
diff --git a/docs/todo.md b/docs/todo.md
index 595f08993..76918972e 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -79,8 +79,11 @@ Implementation needs a concrete useful result within the product model.
   exposed a separate local Browser bridge limit. Fresh interface gathering and
   bounded bridge renegotiation now preserve the local track in complete ordinary
   Pion App controls, including Firefox Host and Viewer. Retain the existing
-  address policy: forcing loopback fails Firefox. Verify the combined Magicsock
-  and Browser pipeline before claiming complete App recovery through that transport.
+  address policy: forcing loopback fails Firefox. Combined Native-engine/Browser
+  bridge controls pass both handoff directions in Chromium and Firefox; full App
+  authorization and room routing remain outside that fixture. Resolve the
+  intermittent FFmpeg decoded-content failure with a matched assembler/bitstream
+  control before claiming complete recovery through that transport.
   Product adoption still needs supported
   [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary)
   and RTCP/MTU boundaries, retained-flow recovery beyond the passing serial

From 8867a1e9e8afddcf5f5b8869e7d9d2222c82344b Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 04:43:41 +0800
Subject: [PATCH 093/262] docs(research): reconcile decoded transport controls

Record the matched assembler comparison and aligned six-case acceptance without claiming complete Magicsock product integration. Keep remaining work in TODO and completed evidence in its research owner.
---
 docs/research/nat-traversal.md | 19 ++++++++++++-------
 docs/todo.md                   | 19 +++++--------------
 2 files changed, 17 insertions(+), 21 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index fd7368fb0..9623ec70f 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -750,13 +750,18 @@ endpoint moves; Chromium retains its working loopback leg. Local HTTP replaces
 Native control only in this fixture; App authorization and the room controller
 are not exercised. No product timeout or address policy changes for this check.
 
-The matching FFmpeg matrix passed five of six cases. One source-address handoff
-kept decoded-frame counts advancing but lost the expected new colour; three
-focused repetitions then passed. Decoder errors and this intermittent result
-remain unresolved. The FFmpeg sink's direct SDK assembler differs from the
-product relay-input owner, so the observation needs a matched bitstream/assembler
-control before attributing it to product transport. Browser passes do not erase
-that failed control or establish universal continuity.
+The earlier FFmpeg matrix had one decoded-content failure. Matched synthetic
+bitstream/RTP replay identifies a receiver-fixture mismatch: its separate SDK
+assembler emits a truncated startup frame and can resume dependent frames after
+a sequence gap without their reference. Increasing that builder's window instead
+stalls recovery. On identical unchanged and source-handoff recordings, the
+product relay-input owner's independent-keyframe boundary produces only
+byte-matched source frames, with no decoder errors or corrupted colours.
+The fixture now reuses that owner. All six unchanged, address-change and loss
+controls pass with actual encoding/decoding and Linux race detection, without
+decoder errors or changes to product timeout, adaptation or recovery policy.
+The original failed run has no packet recording, so its exact cause remains
+unassigned; this correction does not establish universal media continuity.
 
 Dual-stack namespace controls enabled STUN and alternately blocked IPv4 UDP or
 IPv6 forwarding. Both stacks used the working family; Tailcat's direct proof
diff --git a/docs/todo.md b/docs/todo.md
index 76918972e..a91eb987e 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -70,20 +70,11 @@ Implementation needs a concrete useful result within the product model.
   [matched comparisons](./research/nat-traversal.md#integration-cost-and-recovery-controls)
   have not established improved direct reachability. Seek a repeatable benefit
   before accepting room-scoped peer keys, flow admission and relay operation.
-  Isolated local-address changes now preserve the same session under the actual
-  Viewer recovery owner. Verify that bounded benefit through the complete App
-  pipeline and physical networks; it does not establish another reachable NAT class.
-  Live-encoder/decoded-picture controls now separate shared forwarding queue
-  delay from the local playback leg losing its selected LAN address. The shared
-  send-queue repair passes constrained-link recovery. The complete App controls
-  exposed a separate local Browser bridge limit. Fresh interface gathering and
-  bounded bridge renegotiation now preserve the local track in complete ordinary
-  Pion App controls, including Firefox Host and Viewer. Retain the existing
-  address policy: forcing loopback fails Firefox. Combined Native-engine/Browser
-  bridge controls pass both handoff directions in Chromium and Firefox; full App
-  authorization and room routing remain outside that fixture. Resolve the
-  intermittent FFmpeg decoded-content failure with a matched assembler/bitstream
-  control before claiming complete recovery through that transport.
+  Verify the measured local-address handoff benefit through the complete App,
+  mixed Browser/Native topology and physical networks. Current Native-engine,
+  Browser-bridge and decoded-picture controls do not cover App authorization or
+  room routing, and do not establish another reachable NAT class. Preserve the
+  existing local address policy; forcing loopback fails Firefox.
   Product adoption still needs supported
   [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary)
   and RTCP/MTU boundaries, retained-flow recovery beyond the passing serial

From 20cb07de015f61653a6d2988765f783e6d7070ad Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 05:05:37 +0800
Subject: [PATCH 094/262] docs(research): record fresh-flow recovery
 alternative

Keep the supported dependency, complete App and room authorization gates explicit. The isolated preface-free experiment narrows recovery composition without accepting a product transport or timeout change.
---
 docs/research/nat-traversal.md | 16 ++++++++++++++++
 docs/todo.md                   |  7 ++++---
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 9623ec70f..3950a02f0 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -607,6 +607,22 @@ retained-flow/64-check nine-/eleven-second, permanent-loss and retirement cases.
 These checks do not define room-grant integration or establish full App
 interoperability or any additional direct-reachability benefit.
 
+A preface-free alternative uses Tailcat's existing
+[UDP listener](https://github.com/tailscale/tailcat/blob/b4dc28e8aa8936f0a90a41ad8293a64e3d6b645f/listen.go)
+to reserve the address before SDP, allowing ICE to supply the first authenticated
+datagram. Each replacement owns a fresh flow; no old mux survives it. An
+unaccepted write returns a socket error instead of blocking ICE's event loop.
+In the combined dependency candidate, 64-check nine-/eleven-second controls
+each pass two Linux race repetitions under the actual Viewer owner. Setup takes
+12–15 ms; fresh media returns at about 14.2 seconds from blackout onset, within
+the unchanged two-request and initial-connection budgets. Permanent loss still
+exhausts recovery, and retirement closes pending work. Local race controls cover
+mutable deadlines, closing during ICE, peer rejection and continuous sibling
+audio/video. Default inner checks still fail in the matched outage controls.
+This removes the fixture-preface and retained-flow lifetime requirements; it
+does not accept a product Binding limit, implement room grants or establish
+full App/decoded-media acceptance of this alternative.
+
 Separate checks preserve continuous sibling audio/video through a local ICE
 restart, failed-flow retirement, both callers' pending cancellation/deadline,
 revocation during a Server probe and unknown-peer rejection. Canceling a probe
diff --git a/docs/todo.md b/docs/todo.md
index a91eb987e..f1891a97a 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -77,9 +77,10 @@ Implementation needs a concrete useful result within the product model.
   existing local address policy; forcing loopback fails Firefox.
   Product adoption still needs supported
   [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary)
-  and RTCP/MTU boundaries, retained-flow recovery beyond the passing serial
-  Trickle/64-check experiment, and mixed Browser/Native verification. Default
-  inner checks still fail; no new product setting or flow owner is accepted.
+  and RTCP/MTU boundaries, complete recovery with fresh per-connection flows
+  beyond the isolated Trickle/64-check experiment, and mixed Browser/Native
+  verification. Default inner checks still fail; no new product setting or flow
+  owner is accepted.
   Keep isolated dependency patches and
   recovery counterfactuals outside product routing; a diagnostic reply is not
   media-readiness authority. Research owns the experiments and their limits.

From 4735acd31762282947f9327709a5825ea5943e91 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 05:24:52 +0800
Subject: [PATCH 095/262] docs(transport): distinguish native recovery branches

---
 docs/research/nat-traversal.md      | 57 ++++++++++++++++-------------
 docs/standards/routing-transport.md |  6 ++-
 docs/todo.md                        |  8 ++--
 3 files changed, 41 insertions(+), 30 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 3950a02f0..32cda4b0a 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -590,22 +590,14 @@ A retained-flow counterfactual reuses Pion's existing
 [UDP mux](https://github.com/pion/ice/blob/v4.4.0/udp_mux.go) after closing the old
 PeerConnection. It keeps the accepted Tailcat flow and replaces ICE/DTLS/SRTP,
 without another listener or preparation exchange. Setup falls from about 913 ms
-to 11–20 ms, but only three of six default-check nine-/eleven-second controls
-recover. The other three exhaust inner checks without fresh SRTP. This removes
-flow creation from those failures; it does not by itself resolve recovery.
-Combining retained flow with 16 checks still fails two of six cases. With 64
-checks, all six nine-/eleven-second cases recover; permanent loss still exhausts
-the existing two-request budget after the replacement's 15-second initial
-deadline, and disposal cancels recovery. This identifies a bounded composition
-candidate without another timer or readiness probe. Each retained flow is serial:
-overlapping connections still use separate flows. Three local race controls keep
-sibling audio/video flowing through two retained-flow replacements and another
-flow's rollback; peer revocation stops fresh media on both remaining flows.
-The combined listener-state, Tailcat/WireGuard revocation and bounded-TWCC
-candidates also pass Linux race checks for those isolation boundaries and the
-retained-flow/64-check nine-/eleven-second, permanent-loss and retirement cases.
-These checks do not define room-grant integration or establish full App
-interoperability or any additional direct-reachability benefit.
+to 11–20 ms. Nine-/eleven-second recovery passes three of six default-check
+cases, four of six with 16 checks and six of six with 64. Removing flow creation
+alone therefore does not resolve recovery. Combined listener/revocation/TWCC
+patches pass Linux race checks for 64-check recovery, bounded exhaustion,
+retirement and sibling audio/video through serial replacements and rollback.
+Overlapping connections still use separate flows, and revocation stops both.
+This counterfactual does not accept retained flow as a product owner; the fresh
+flow alternative below avoids that extra lifetime.
 
 A preface-free alternative uses Tailcat's existing
 [UDP listener](https://github.com/tailscale/tailcat/blob/b4dc28e8aa8936f0a90a41ad8293a64e3d6b645f/listen.go)
@@ -618,10 +610,22 @@ each pass two Linux race repetitions under the actual Viewer owner. Setup takes
 the unchanged two-request and initial-connection budgets. Permanent loss still
 exhausts recovery, and retirement closes pending work. Local race controls cover
 mutable deadlines, closing during ICE, peer rejection and continuous sibling
-audio/video. Default inner checks still fail in the matched outage controls.
+audio/video. Default inner checks still fail in these restart-then-rebuild controls.
 This removes the fixture-preface and retained-flow lifetime requirements; it
 does not accept a product Binding limit, implement room grants or establish
-full App/decoded-media acceptance of this alternative.
+full App recovery acceptance of this alternative.
+
+The sender's [restart capability](../standards/routing-transport.md#reconciliation)
+changes that schedule. Modeling the current Native sender's first-request
+replacement under the same Viewer owner on 2026-10-10, default checks recover both
+nine- and eleven-second outages at about 23.3 seconds after two replacements. Their first
+replacement still exhausts eight checks; the second starts after its existing
+15-second initial deadline. With 64 checks, these controls recover after one
+replacement at about 12.2 and 15.3 seconds respectively. Permanent loss exhausts
+two replacements at about 38.3 seconds, and disposal cancels pending recovery.
+This narrows the earlier failure claim to its tested sender behavior; it is not a universal Native failure
+or an accepted product tuning. Native control and decoding remain stubbed in
+this owner fixture, distinct from the decoded handoff checks below.
 
 Separate checks preserve continuous sibling audio/video through a local ICE
 restart, failed-flow retirement, both callers' pending cancellation/deadline,
@@ -758,13 +762,16 @@ bridge gap, not the remaining Magicsock composition, physical roaming or platfor
 acceptance boundaries.
 
 The aligned candidate also combines the real Native encoder/forwarder/receiver
-with the actual Browser bridge over the experimental Tailcat socket. Chromium
-152 and Firefox 151 each pass an unchanged ordinary-Pion control and both
-Tailcat address-change directions. After DERP closes, new blue content keeps
-rendering on the same track. Firefox renegotiates its local leg once when that
-endpoint moves; Chromium retains its working loopback leg. Local HTTP replaces
-Native control only in this fixture; App authorization and the room controller
-are not exercised. No product timeout or address policy changes for this check.
+with the actual Browser bridge over the experimental Tailcat socket. The fresh
+flow adapter now replaces its synthetic preface: SDP starts before peer admission,
+and ICE supplies the first datagram. All six FFmpeg-decoded controls pass Linux
+race checks. Chromium 152 and Firefox 151 each pass an unchanged ordinary-Pion
+control and both Tailcat address-change directions. After DERP closes, new blue
+content keeps rendering on the same track. Firefox renegotiates its local leg
+once when that endpoint moves; Chromium retains its working loopback leg. Local
+HTTP replaces Native control only in this fixture; App authorization, room routing
+and prolonged-outage replacement are not exercised. No product timeout, address
+policy or inner Binding setting changes for these handoff checks.
 
 The earlier FFmpeg matrix had one decoded-content failure. Matched synthetic
 bitstream/RTP replay identifies a receiver-fixture mismatch: its separate SDK
diff --git a/docs/standards/routing-transport.md b/docs/standards/routing-transport.md
index 4397c54b9..1044a7af3 100644
--- a/docs/standards/routing-transport.md
+++ b/docs/standards/routing-transport.md
@@ -119,8 +119,10 @@ deadline or start an independent recovery loop.
 When NAT traversal enhancement is enabled, another operation may use the
 remaining connection-attempt budget after rollback. The waiting display uses the actual
 server-issued attempt ordinal; it never counts time as an attempted connection.
-Committed P2P recovery first restarts ICE on the same connection, then
-rebuilds that connection if necessary, within the existing two-request budget.
+Committed P2P recovery first requests an ICE restart, then requests a rebuild
+if necessary, within the existing two-request budget. A sender without restart
+support, including the current Native sender, replaces its connection on that
+first request.
 The budget belongs to the current parent and survives physical connection or
 Browser/Native backend replacement. Only a connected transport or a new parent
 resets it; replacing an unconnected backend cannot renew recovery indefinitely.
diff --git a/docs/todo.md b/docs/todo.md
index f1891a97a..5838625e6 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -78,9 +78,11 @@ Implementation needs a concrete useful result within the product model.
   Product adoption still needs supported
   [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary)
   and RTCP/MTU boundaries, complete recovery with fresh per-connection flows
-  beyond the isolated Trickle/64-check experiment, and mixed Browser/Native
-  verification. Default inner checks still fail; no new product setting or flow
-  owner is accepted.
+  beyond the isolated owner and decoded-handoff checks, including each sender's
+  recovery capability, and mixed Browser/Native verification. Inner checks can
+  exhaust before the underlay recovers; research distinguishes eventual recovery
+  from exhaustion by sender behavior. No new product setting or flow owner is
+  accepted.
   Keep isolated dependency patches and
   recovery counterfactuals outside product routing; a diagnostic reply is not
   media-readiness authority. Research owns the experiments and their limits.

From e780440c6e38204bc31d7fecc01d437710fc2f12 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 05:42:33 +0800
Subject: [PATCH 096/262] docs(research): record native admission ordering
 constraint

---
 docs/research/nat-traversal.md | 20 ++++++++++++++++++++
 docs/todo.md                   |  2 ++
 2 files changed, 22 insertions(+)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 32cda4b0a..4c5a5527c 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -773,6 +773,15 @@ HTTP replaces Native control only in this fixture; App authorization, room routi
 and prolonged-outage replacement are not exercised. No product timeout, address
 policy or inner Binding setting changes for these handoff checks.
 
+A separate Linux race check now passes those experimental flows through real
+Native control commands and the Viewer session's existing receiver owner.
+Closing a receiver releases its physical flow; replacement and a healthy sibling
+keep receiving fresh RTP after DERP closes, including after late cleanup for the
+old connection ID. Stopping reception or closing the control session releases
+both remaining flows. Omitting receiver retirement in the test overlay is
+detected. Keys are still pre-granted locally: this establishes resource cleanup,
+not room authorization, automatic App recovery or Browser decoding in this check.
+
 The earlier FFmpeg matrix had one decoded-content failure. Matched synthetic
 bitstream/RTP replay identifies a receiver-fixture mismatch: its separate SDK
 assembler emits a truncated startup frame and can resume dependent frames after
@@ -864,6 +873,17 @@ NAT, dual-stack, rebinding and weak-network controls also pass. Supported depend
 contracts and demonstrated network benefit remain open. The probe retains the
 isolated patches; Piik's production transport is unchanged.
 
+Admission ordering is also an integration constraint. Upstream
+[`Client.DialUDPPort`](https://github.com/tailscale/tailcat/blob/52fbad323e9d352f1febb623e0975368e9a8cbdd/tailcat.go)
+waits for the server to admit the client's key before returning a socket.
+Piik creates the receiver and its socket before returning a media answer.
+Authorizing that key only after receiving the answer would therefore introduce
+a circular wait. Existing fixtures pre-grant keys and do not test this exchange.
+A product design must resolve that ordering within the existing assigned
+connection's authority; accepting arbitrary keys or passing room credentials
+into Native control is not an equivalent shortcut. This is a source-traced
+integration constraint, not a defect in Piik's current transport.
+
 ## Native Mapping Cache And Retry Lifetimes
 
 Pion ICE `v4.4.0` caches a shared socket's STUN mapping by destination for 25
diff --git a/docs/todo.md b/docs/todo.md
index 5838625e6..838fc799e 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -83,6 +83,8 @@ Implementation needs a concrete useful result within the product model.
   exhaust before the underlay recovers; research distinguishes eventual recovery
   from exhaustion by sender behavior. No new product setting or flow owner is
   accepted.
+  Resolve admission-before-answer ordering at the assigned-connection owner;
+  research owns the Native control retirement checks and their pre-granted scope.
   Keep isolated dependency patches and
   recovery counterfactuals outside product routing; a diagnostic reply is not
   media-readiness authority. Research owns the experiments and their limits.

From 1ba6021e0a2e8cc14c952881299fa52d817cb9db Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 06:05:00 +0800
Subject: [PATCH 097/262] fix(app): bound native viewer upstream receivers

---
 internal/app/nativeviewer/session.go      | 12 +++++-
 internal/app/nativeviewer/session_test.go | 48 +++++++++++++++++++++++
 2 files changed, 58 insertions(+), 2 deletions(-)

diff --git a/internal/app/nativeviewer/session.go b/internal/app/nativeviewer/session.go
index a2aa88cb7..4ee448813 100644
--- a/internal/app/nativeviewer/session.go
+++ b/internal/app/nativeviewer/session.go
@@ -37,6 +37,9 @@ type sessionEdge struct {
 	sourceConnectionID string
 }
 
+// One current upstream and one prepared route may overlap during a handoff.
+const receiverCapacity = 2
+
 // Session owns the native media implementation for one Browser Viewer. Room,
 // participant, route, and recovery authority remain in the Browser/server.
 type Session struct {
@@ -123,11 +126,16 @@ func (session *Session) AcceptOffer(
 	}
 	session.mu.Lock()
 	closed := session.closed
+	receiver := session.receivers[connectionID]
+	atCapacity := len(session.receivers) >= receiverCapacity && receiver == nil
 	session.mu.Unlock()
 	if closed {
 		return OfferResult{}, errors.New("native Viewer session is closed")
 	}
-	if receiver := session.receiver(connectionID); reuse && receiver != nil {
+	if atCapacity {
+		return OfferResult{}, errors.New("native Viewer receiver capacity reached")
+	}
+	if reuse && receiver != nil {
 		answer, reused, err := receiver.Renegotiate(offer, iceServers)
 		if err != nil {
 			return OfferResult{}, err
@@ -173,7 +181,7 @@ func (session *Session) AcceptOffer(
 		return OfferResult{}, err
 	}
 	session.mu.Lock()
-	if session.closed || session.receivers[connectionID] != nil {
+	if session.closed || session.receivers[connectionID] != nil || len(session.receivers) >= receiverCapacity {
 		session.mu.Unlock()
 		_ = receiver.Close()
 		return OfferResult{}, errors.New("native Viewer receiver is unavailable")
diff --git a/internal/app/nativeviewer/session_test.go b/internal/app/nativeviewer/session_test.go
index 5123c12b5..3ce6837c9 100644
--- a/internal/app/nativeviewer/session_test.go
+++ b/internal/app/nativeviewer/session_test.go
@@ -86,3 +86,51 @@ func TestViewerProfileHasNoImplicitCaptureDefault(t *testing.T) {
 		t.Fatal("closed Viewer accepted a profile")
 	}
 }
+
+func TestReceiverCapacityPreservesCurrentAndPreparedSources(t *testing.T) {
+	peer, err := webrtc.NewPeerConnection(webrtc.Configuration{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = peer.Close() })
+	if _, err = peer.AddTransceiverFromKind(webrtc.RTPCodecTypeVideo); err != nil {
+		t.Fatal(err)
+	}
+	offer, err := peer.CreateOffer(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	session, err := Start(t.Context(), Options{ShareID: "viewer-session", EdgeCapacity: 2})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = session.Close() })
+	for _, id := range []string{"active", "candidate"} {
+		if _, err = session.AcceptOffer(id, offer, nil, false); err != nil {
+			t.Fatal(err)
+		}
+	}
+	active, candidate := session.receiver("active"), session.receiver("candidate")
+	if _, err = session.AcceptOffer("excess", offer, nil, false); err == nil {
+		t.Fatal("a third receiver bypassed the active/candidate bound")
+	}
+	if session.receiver("active") != active || session.receiver("candidate") != candidate || session.receiver("excess") != nil {
+		t.Fatal("capacity rejection changed an existing receiver")
+	}
+	if result, err := session.AcceptOffer("active", offer, nil, true); err != nil || !result.Reused {
+		t.Fatalf("existing receiver could not renegotiate at capacity: %v", err)
+	}
+	if _, err = session.PrepareLocalEdge("active", "local-preview", "preview-offer", false); err != nil {
+		t.Fatalf("capacity rejection stopped local playback preparation: %v", err)
+	}
+	if _, err = session.AcceptOffer("candidate", offer, nil, false); err != nil {
+		t.Fatalf("existing receiver could not be replaced at capacity: %v", err)
+	}
+	if session.receiver("active") != active || session.receiver("candidate") == candidate || session.edge("local-preview") == nil {
+		t.Fatal("receiver replacement changed the active source or its playback")
+	}
+	session.CloseReceiver("candidate")
+	if _, err = session.AcceptOffer("replacement", offer, nil, false); err != nil {
+		t.Fatalf("retired receiver did not release its slot: %v", err)
+	}
+}

From 18144a7665e246dad0b604e646980a7a4528f57b Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 06:19:21 +0800
Subject: [PATCH 098/262] fix(media): initialize source state before feedback
 starts

---
 docs/standards/engineering.md                 |  2 ++
 internal/app/mediaedge/edge_test.go           |  6 ++--
 internal/app/mediaedge/engine.go              | 15 +++++++--
 internal/app/mediaedge/receiver.go            |  7 ++---
 internal/app/mediaedge/relay_fixture_test.go  | 18 +++++------
 .../mediaedge/relay_network_fixture_test.go   |  9 +++---
 internal/app/mediaedge/source_test.go         | 31 +++++++++++++++++++
 7 files changed, 63 insertions(+), 25 deletions(-)

diff --git a/docs/standards/engineering.md b/docs/standards/engineering.md
index 048a4bc80..f59b0501f 100644
--- a/docs/standards/engineering.md
+++ b/docs/standards/engineering.md
@@ -171,6 +171,8 @@ above rather than searching the tree.
   Construction is part of acquisition: if it throws, release resources created
   before the failure and report through the existing operation owner. A failed
   allocation does not erase the operation's authoritative identity.
+  Initialize callback-visible state before registration or binding; library
+  constructors can start background work before returning.
   Ordered shutdown may require a ready auxiliary transport to outlive the stop
   request; its owner closes it after dependants retire. External convenience
   actions must not block lifecycle handling, and repeated attempts stay bounded.
diff --git a/internal/app/mediaedge/edge_test.go b/internal/app/mediaedge/edge_test.go
index a4e78c2a4..f251d31be 100644
--- a/internal/app/mediaedge/edge_test.go
+++ b/internal/app/mediaedge/edge_test.go
@@ -125,12 +125,11 @@ func TestRelayFailureCannotRetireReconfiguredProfile(t *testing.T) {
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { _ = engine.Close() })
-	source, err := engine.NewSource("vp8", 1, 2, nil)
+	source, err := engine.newSource("vp8", 1, 2, &RelayOptions{}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { _ = source.Close() })
-	source.relay = &relayDerivation{source: source}
 	_ = source.SetFormat(1, 640, 360)
 	profile := nativecapture.VideoProfile{Width: 1280, Height: 720, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"}
 	if err = source.SetRelayProfile(profile); err != nil {
@@ -182,12 +181,11 @@ func TestRetiredRelayFailureCannotDisableLaterDemand(t *testing.T) {
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { _ = engine.Close() })
-	source, err := engine.NewSource("vp8", 2, 2, nil)
+	source, err := engine.newSource("vp8", 2, 2, &RelayOptions{}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { _ = source.Close() })
-	source.relay = &relayDerivation{source: source}
 	if err = source.SetFormat(1, 640, 360); err != nil {
 		t.Fatal(err)
 	}
diff --git a/internal/app/mediaedge/engine.go b/internal/app/mediaedge/engine.go
index 3f444b52c..351494c96 100644
--- a/internal/app/mediaedge/engine.go
+++ b/internal/app/mediaedge/engine.go
@@ -137,6 +137,10 @@ func stunServers(servers []webrtc.ICEServer) []webrtc.ICEServer {
 // NewSource coalesces recovery requests by physical output slot; [-1] requests
 // all outputs. The callback runs outside the source lock and forwarding path.
 func (engine *Engine) NewSource(codec string, capacity, layers int, requestKeyFrame func([]int)) (*Source, error) {
+	return engine.newSource(codec, capacity, layers, nil, requestKeyFrame)
+}
+
+func (engine *Engine) newSource(codec string, capacity, layers int, relay *RelayOptions, requestKeyFrame func([]int)) (*Source, error) {
 	_, supported := videoCodecs[codec]
 	if !supported {
 		return nil, errors.New("native video codec is unsupported")
@@ -157,6 +161,15 @@ func (engine *Engine) NewSource(codec string, capacity, layers int, requestKeyFr
 		capacity: capacity, requestKeyFrame: requestKeyFrame, edges: make(map[*Edge]bool),
 		publications: make(map[*Publication]struct{}),
 	}
+	// Binding forwarding buffers can start asynchronous PLI callbacks. Publish
+	// their immutable inputs before binding, and start our worker only on success.
+	if requestKeyFrame != nil {
+		source.recoveryRequests = make(chan struct{}, 1)
+		source.recoveryStopped = make(chan struct{})
+	}
+	if relay != nil {
+		source.relay = &relayDerivation{source: source, options: *relay}
+	}
 	media, err := forwarding.NewEncodedSource(forwarding.SourceOptions{
 		ID: "screen", StreamID: "piik-native", Codec: videoCodecs[codec],
 		Formats: make([]forwarding.LayerFormat, layers), MaxPackets: encoded.MaxPacketWindow,
@@ -174,8 +187,6 @@ func (engine *Engine) NewSource(codec string, capacity, layers int, requestKeyFr
 	}
 	source.media = media
 	if requestKeyFrame != nil {
-		source.recoveryRequests = make(chan struct{}, 1)
-		source.recoveryStopped = make(chan struct{})
 		go source.runRecovery()
 	}
 	return source, nil
diff --git a/internal/app/mediaedge/receiver.go b/internal/app/mediaedge/receiver.go
index 4ca2a18f9..e9d01a30b 100644
--- a/internal/app/mediaedge/receiver.go
+++ b/internal/app/mediaedge/receiver.go
@@ -92,10 +92,12 @@ func (engine *Engine) NewReceiver(options ReceiverOptions) (_ *Receiver, _ webrt
 		prepareMapping: prepareMapping,
 	}
 	layers := 1
+	var relay *RelayOptions
 	if _, supported := relayBackend(videoCodec, options.Relay); supported {
 		layers = 2
+		relay = options.Relay
 	}
-	receiver.source, err = engine.NewSource(videoCodec, options.EdgeCapacity, layers, func([]int) {
+	receiver.source, err = engine.newSource(videoCodec, options.EdgeCapacity, layers, relay, func([]int) {
 		// Local output slots all derive from this one upstream encoded stream.
 		receiver.RequestKeyFrame()
 	})
@@ -103,9 +105,6 @@ func (engine *Engine) NewReceiver(options ReceiverOptions) (_ *Receiver, _ webrt
 		_ = connection.Close()
 		return nil, webrtc.SessionDescription{}, err
 	}
-	if layers > 1 {
-		receiver.source.relay = &relayDerivation{source: receiver.source, options: *options.Relay}
-	}
 	if hasAudio {
 		receiver.audioSource, err = engine.NewRelayedAudioSource(options.EdgeCapacity)
 		if err != nil {
diff --git a/internal/app/mediaedge/relay_fixture_test.go b/internal/app/mediaedge/relay_fixture_test.go
index 79f050b43..3add2670d 100644
--- a/internal/app/mediaedge/relay_fixture_test.go
+++ b/internal/app/mediaedge/relay_fixture_test.go
@@ -51,15 +51,14 @@ func TestRelayDerivationFixture(t *testing.T) {
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { _ = engine.Close() })
-	source, err := engine.NewSource("vp8", 2, 2, nil)
+	source, err := engine.newSource("vp8", 2, 2, &RelayOptions{
+		CaptureProcess: executable,
+		Capabilities:   nativecapture.Capabilities{SoftwareVP8: true, Adapters: []nativecapture.Adapter{{Index: 0}}},
+	}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { _ = source.Close() })
-	source.relay = &relayDerivation{source: source, options: RelayOptions{
-		CaptureProcess: executable,
-		Capabilities:   nativecapture.Capabilities{SoftwareVP8: true, Adapters: []nativecapture.Adapter{{Index: 0}}},
-	}}
 	profile := nativecapture.VideoProfile{Width: 1280, Height: 720, Framerate: 30, Bitrate: 2_000_000, Preference: "balanced"}
 	if err = source.SetRelayProfile(profile); err != nil {
 		t.Fatal(err)
@@ -330,13 +329,12 @@ func TestRelayIndependentSpatialFixture(t *testing.T) {
 	engine, err := NewEngine(EngineOptions{BindAddress: "127.0.0.1:0", IncludeLoopback: true})
 	check(err)
 	defer engine.Close()
-	source, err := engine.NewSource("vp8", 2, 2, nil)
-	check(err)
-	defer source.Close()
-	source.relay = &relayDerivation{source: source, options: RelayOptions{
+	source, err := engine.newSource("vp8", 2, 2, &RelayOptions{
 		CaptureProcess: executable,
 		Capabilities:   nativecapture.Capabilities{SoftwareVP8: true, Adapters: []nativecapture.Adapter{{Index: 0}}},
-	}}
+	}, nil)
+	check(err)
+	defer source.Close()
 	check(source.SetRelayProfile(nativecapture.VideoProfile{
 		Width: 1920, Height: 1080, Framerate: 30, Bitrate: 5_000_000, Preference: "maintain-framerate",
 	}))
diff --git a/internal/app/mediaedge/relay_network_fixture_test.go b/internal/app/mediaedge/relay_network_fixture_test.go
index ea8c1d550..8f1958b0e 100644
--- a/internal/app/mediaedge/relay_network_fixture_test.go
+++ b/internal/app/mediaedge/relay_network_fixture_test.go
@@ -66,13 +66,12 @@ func TestRelayNetworkVP8Fixture(t *testing.T) {
 	engine, err := NewEngine(EngineOptions{BindAddress: "127.0.0.1:0", InitialBitrate: 1_200_000})
 	check(err)
 	defer engine.Close()
-	source, err := engine.NewSource("vp8", 2, 2, nil)
-	check(err)
-	defer source.Close()
-	source.relay = &relayDerivation{source: source, options: RelayOptions{
+	source, err := engine.newSource("vp8", 2, 2, &RelayOptions{
 		CaptureProcess: os.Getenv("PIIK_NATIVE_CAPTURE"),
 		Capabilities:   nativecapture.Capabilities{SoftwareVP8: true, Adapters: []nativecapture.Adapter{{Index: 0}}},
-	}}
+	}, nil)
+	check(err)
+	defer source.Close()
 	check(source.SetRelayProfile(nativecapture.VideoProfile{Width: 1280, Height: 720,
 		Framerate: 30, Bitrate: 2_000_000, Preference: "balanced"}))
 	router, err := vnet.NewRouter(&vnet.RouterConfig{CIDR: "10.0.0.0/24", MinDelay: 20 * time.Millisecond,
diff --git a/internal/app/mediaedge/source_test.go b/internal/app/mediaedge/source_test.go
index 7d70a28d4..c9687a788 100644
--- a/internal/app/mediaedge/source_test.go
+++ b/internal/app/mediaedge/source_test.go
@@ -56,6 +56,37 @@ func TestSourceRecoveryCoalescesTargetsWithoutWakingUnrelatedOutputs(t *testing.
 	}
 }
 
+func TestSourceStartupFeedbackRequestsRecovery(t *testing.T) {
+	for _, relay := range []*RelayOptions{nil, {}} {
+		t.Run(fmt.Sprintf("relay-%t", relay != nil), func(t *testing.T) {
+			requested := make(chan []int, 4)
+			source, err := (&Engine{}).newSource("vp8", 2, 2, relay, func(layers []int) {
+				select {
+				case requested <- layers:
+				default:
+				}
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer source.Close()
+			// LiveKit can request startup keyframes as soon as its buffers are bound.
+			// Wait for that real asynchronous callback, without manually sending PLI.
+			select {
+			case layers := <-requested:
+				if len(layers) == 0 {
+					t.Fatal("startup recovery has no output identity")
+				}
+				if (source.groupRecovery.Load() != 0) != (relay != nil) {
+					t.Fatal("startup recovery used the wrong capture/relay owner")
+				}
+			case <-time.After(3 * time.Second):
+				t.Fatal("startup feedback lost its recovery notification")
+			}
+		})
+	}
+}
+
 func TestSourceRecoveryRetainsLocalPlanWithoutDirectCaptureCallback(t *testing.T) {
 	for _, relay := range []bool{false, true} {
 		t.Run(fmt.Sprint(relay), func(t *testing.T) {

From e1209e3e25bf457ee4ef7dd71922d59bf0bd30e6 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 06:19:48 +0800
Subject: [PATCH 099/262] docs(research): qualify native admission ordering
 evidence

---
 docs/research/nat-traversal.md | 21 ++++++++++++++++-----
 docs/todo.md                   |  9 +++++++--
 2 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 4c5a5527c..7ddcdb0f1 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -878,11 +878,22 @@ Admission ordering is also an integration constraint. Upstream
 waits for the server to admit the client's key before returning a socket.
 Piik creates the receiver and its socket before returning a media answer.
 Authorizing that key only after receiving the answer would therefore introduce
-a circular wait. Existing fixtures pre-grant keys and do not test this exchange.
-A product design must resolve that ordering within the existing assigned
-connection's authority; accepting arbitrary keys or passing room credentials
-into Native control is not an equivalent shortcut. This is a source-traced
-integration constraint, not a defect in Piik's current transport.
+a circular wait. An isolated `PrepareUDPPort` patch reserves the local address
+without waiting for admission. Through real Native control, it can return the
+answer first and receive fresh RTP if the fixture holds remote ICE candidates
+until the grant completes. Both receiver/control retirement paths retain their
+cleanup checks; the pre-granted control uses the same client/server orientation.
+Without that experimental candidate gate, Native sends five ICE checks before
+the roughly one-second grant acknowledgment, reaches eight and receives no RTP
+within the unchanged bound. Complete-SDP and early-trickle controls both fail.
+The early-trickle counterfactual is opt-in and intentionally fails its media check.
+
+This establishes a startup-order constraint, not a product integration or a Piik
+field defect. Keys and grants remain local fixture inputs; the candidate gate
+and unsupported dependency method are not accepted product mechanisms.
+The existing assigned-connection owner must resolve key exchange and admission
+before ICE starts. Accepting arbitrary keys, passing room credentials into Native
+control or enlarging its timeout is not an equivalent solution.
 
 ## Native Mapping Cache And Retry Lifetimes
 
diff --git a/docs/todo.md b/docs/todo.md
index 838fc799e..ad7ee5107 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -16,6 +16,10 @@ Git/PRs own completed history.
   Prepare one coherent candidate and stop before publication. Preserve the existing
   product model; evaluate held features against measurable benefit and total complexity
   before accepting a changed contract.
+  Isolate the intermittent Linux race-suite no-output result in
+  `TestQualityDimensionsFollowAssignedSource`; focused repetitions and the next
+  full package run pass. No product cause is established; preserve its assertion
+  and timeout while collecting a matched failure.
 - [ ] **Independent Gitee mirror recovery.** Implementation and local acceptance
   are complete. Integrate through the next owner-approved publishing merge and
   verify the separate workflow with its original CI artifacts. Mirror failure
@@ -83,8 +87,9 @@ Implementation needs a concrete useful result within the product model.
   exhaust before the underlay recovers; research distinguishes eventual recovery
   from exhaustion by sender behavior. No new product setting or flow owner is
   accepted.
-  Resolve admission-before-answer ordering at the assigned-connection owner;
-  research owns the Native control retirement checks and their pre-granted scope.
+  Resolve key exchange and admission before ICE at the assigned-connection owner;
+  research owns the Native control retirement checks and the isolated candidate
+  gate. Neither the pre-granted nor gated fixture implements room authorization.
   Keep isolated dependency patches and
   recovery counterfactuals outside product routing; a diagnostic reply is not
   media-readiness authority. Research owns the experiments and their limits.

From 9067d8c18ad004411f6426e25858dff36fc2f84c Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 06:46:26 +0800
Subject: [PATCH 100/262] docs(research): record cross-browser H264 receiving
 limits

---
 docs/research/native-client-media.md | 17 +++++++++++++++--
 docs/todo.md                         |  3 +++
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 2969d94af..77e1047b3 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -644,11 +644,24 @@ old SFU picture during peer preparation. The mixed Browser Host/Native Viewer
 control also passed those transitions. With clarity priority, its live
 2160x3840-to-360x640 edit retained the Native connection and playback track;
 SFU recovery retained that size and then restored 2160x3840. Firefox 155 received
-the same VP8 sizes from Chrome, retaining its track through both edits. All
-controls retired their receiving connections on stop. Balanced priority may
+the same VP8 and H.264 sizes from Chrome 154, retaining its track through both
+edits. All controls retired their receiving connections on stop. Balanced priority may
 deliver smaller adapted pictures. These local checks do not establish physical
 4K capture, every mixed handoff or cross-network performance.
 
+The H.264 control supplies OpenH264 2.6.0 to an isolated Firefox profile, using
+the artifact and SHA-512 from [Mozilla's codec manifest](https://github.com/mozilla-firefox/firefox/blob/main/toolkit/content/gmp-sources/openh264.json).
+This follows the [Web Platform Tests setup](https://github.com/web-platform-tests/wpt/blob/master/tools/wpt/browser.py).
+A fresh-profile control did not advertise H.264 and could not receive the
+H.264-only share, so codec availability must be established before attributing
+that result to resolution or networking. Firefox owns its component installation;
+the [upstream report](https://bugzilla.mozilla.org/show_bug.cgi?id=1766638) records
+the separate first-use installation boundary.
+A controlled receiver with H.264 unavailable reaches the current generic
+“No media route available” presentation. Receiving feedback does not yet retain
+that confirmed incompatibility through route exhaustion; capability work needs
+to distinguish it without introducing another retry or failure owner.
+
 Chrome 154 camera controls exposed a separate constraint bug: lowering a
 540x960 input to the 1280x720 ceiling produced a cropped 540x720 picture when
 both axes also carried `ideal` values. Maximum-only constraints produced
diff --git a/docs/todo.md b/docs/todo.md
index ad7ee5107..05919cf1e 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -55,6 +55,9 @@ Implementation needs a concrete useful result within the product model.
   owns local capture, codec, derived-output, SFU and bounded mixed-route evidence.
   Extend Browser interoperability and mixed-topology checks to limited receivers
   and physical camera orientation behavior.
+  Preserve confirmed decoder incompatibility in receiving feedback: the local
+  H.264-unavailable control currently ends with generic route exhaustion.
+  Keep the existing presentation and recovery owners.
   Browser display capture, Browser relay and Browser-to-Native fanout now have
   bounded high-resolution evidence. macOS geometry and physical 4K/game capture
   remain open. Preserve safety

From ae9014b42af2b1d5c71c7082564d5e2f3a352ec9 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 07:00:13 +0800
Subject: [PATCH 101/262] fix(viewer): preserve negotiated video rejection

---
 docs/research/native-client-media.md         | 16 ++++++----
 docs/todo.md                                 |  3 --
 src/client/locales/en.ts                     |  1 +
 src/client/locales/zh.ts                     |  1 +
 src/client/media/viewer-presentation.ts      | 15 ++++++++++
 src/client/media/viewer-sfu-route.ts         | 13 ++++----
 src/client/native/media-bridge.ts            |  2 ++
 src/client/pages/ViewerPage.tsx              | 13 ++++++++
 src/client/pages/status-preview-scenarios.ts |  6 ++++
 src/client/sfu/subscriber.ts                 | 17 ++++++-----
 src/client/ui/media-status.ts                |  1 +
 src/client/webrtc/video-codec.ts             | 24 +++++++++++++++
 src/client/webrtc/viewer-peer.ts             |  6 +++-
 tests/native-media-bridge.test.ts            | 11 +++++++
 tests/route-transition.test.ts               |  8 +++++
 tests/sfu-client.test.ts                     | 14 +++++++++
 tests/video-codec.test.ts                    | 20 ++++++++++++-
 tests/viewer-peer-generation.test.ts         | 22 +++++++++++++-
 tests/viewer-presentation.test.ts            | 31 ++++++++++++++++++++
 19 files changed, 199 insertions(+), 25 deletions(-)

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 77e1047b3..da70412a5 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -645,8 +645,9 @@ control also passed those transitions. With clarity priority, its live
 2160x3840-to-360x640 edit retained the Native connection and playback track;
 SFU recovery retained that size and then restored 2160x3840. Firefox 155 received
 the same VP8 and H.264 sizes from Chrome 154, retaining its track through both
-edits. All controls retired their receiving connections on stop. Balanced priority may
-deliver smaller adapted pictures. These local checks do not establish physical
+edits; H.264 also passed through embedded SFU. All controls retired their
+receiving connections on stop. Balanced priority may deliver smaller adapted pictures.
+These local checks do not establish physical
 4K capture, every mixed handoff or cross-network performance.
 
 The H.264 control supplies OpenH264 2.6.0 to an isolated Firefox profile, using
@@ -657,10 +658,13 @@ H.264-only share, so codec availability must be established before attributing
 that result to resolution or networking. Firefox owns its component installation;
 the [upstream report](https://bugzilla.mozilla.org/show_bug.cgi?id=1766638) records
 the separate first-use installation boundary.
-A controlled receiver with H.264 unavailable reaches the current generic
-“No media route available” presentation. Receiving feedback does not yet retain
-that confirmed incompatibility through route exhaustion; capability work needs
-to distinguish it without introducing another retry or failure owner.
+With H.264 unavailable, the Browser accepts the offer but rejects its video
+section in the answer. The shared receiving check uses this
+[JSEP rejection](https://www.rfc-editor.org/rfc/rfc8829.html#section-5.3.1), rather
+than inferring support from a codec list. P2P and SFU controls now retain that
+cause through route exhaustion instead of reporting only a media-route failure;
+the Native local bridge uses the same check and its existing failure path.
+An answer rejection alone does not identify the decoder or platform cause.
 
 Chrome 154 camera controls exposed a separate constraint bug: lowering a
 540x960 input to the 1280x720 ceiling produced a cropped 540x720 picture when
diff --git a/docs/todo.md b/docs/todo.md
index 05919cf1e..ad7ee5107 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -55,9 +55,6 @@ Implementation needs a concrete useful result within the product model.
   owns local capture, codec, derived-output, SFU and bounded mixed-route evidence.
   Extend Browser interoperability and mixed-topology checks to limited receivers
   and physical camera orientation behavior.
-  Preserve confirmed decoder incompatibility in receiving feedback: the local
-  H.264-unavailable control currently ends with generic route exhaustion.
-  Keep the existing presentation and recovery owners.
   Browser display capture, Browser relay and Browser-to-Native fanout now have
   bounded high-resolution evidence. macOS geometry and physical 4K/game capture
   remain open. Preserve safety
diff --git a/src/client/locales/en.ts b/src/client/locales/en.ts
index 95f3a59fd..161c5fb86 100644
--- a/src/client/locales/en.ts
+++ b/src/client/locales/en.ts
@@ -464,6 +464,7 @@ export const en: Record<CopyKey, string> = {
   "viewer.msg.hostPaused": "Host paused",
   "viewer.msg.recovering": "Recovering connection",
   "viewer.msg.routeFailed": "No media route available; reload to retry",
+  "viewer.msg.videoRejected": "This browser cannot receive the video; try another browser",
   "viewer.msg.playbackFailed": "Cannot play this stream; reload to retry",
   "viewer.msg.hostOffline": "Host connection lost",
   "viewer.msg.serverError": "Connection service unavailable",
diff --git a/src/client/locales/zh.ts b/src/client/locales/zh.ts
index f17f1bbc4..2e6e02930 100644
--- a/src/client/locales/zh.ts
+++ b/src/client/locales/zh.ts
@@ -464,6 +464,7 @@ export const zh = {
   "viewer.msg.hostPaused": "房主已暂停分享",
   "viewer.msg.recovering": "正在恢复连接",
   "viewer.msg.routeFailed": "没有可用的媒体线路，可刷新重试",
+  "viewer.msg.videoRejected": "当前浏览器无法接收画面，请尝试更换浏览器",
   "viewer.msg.playbackFailed": "无法播放当前画面，请刷新重试",
   "viewer.msg.hostOffline": "房主连接已中断",
   "viewer.msg.serverError": "连接服务暂时不可用",
diff --git a/src/client/media/viewer-presentation.ts b/src/client/media/viewer-presentation.ts
index a833369f9..535770944 100644
--- a/src/client/media/viewer-presentation.ts
+++ b/src/client/media/viewer-presentation.ts
@@ -25,6 +25,7 @@ export type ViewerFailureCode =
   | "HOST_OFFLINE"
   | "ROUTE_EXHAUSTED"
   | "AUTOPLAY_BLOCKED"
+  | "VIDEO_REJECTED"
   | "PLAYBACK_FAILED";
 
 export type ViewerMessageKey = Extract<CopyKey, `viewer.msg.${string}`>;
@@ -46,6 +47,7 @@ export type ViewerStage =
   | "playing"
   | "recovering"
   | "route-failed"
+  | "video-rejected"
   | "playback-failed"
   | "waiting-host"
   | "host-offline"
@@ -92,6 +94,7 @@ export interface ViewerPresentationState {
   autoplayBlockedGeneration: number | null;
   playbackFailedGeneration: number | null;
   runtimeFailure: "SERVER_ERROR" | null;
+  receiveFailure: "VIDEO_REJECTED" | null;
 }
 
 export type ViewerPresentationAction =
@@ -101,6 +104,7 @@ export type ViewerPresentationAction =
       failure?: ViewerFailureCode | null;
     }
   | { type: "signal"; signal: SignalConnectionState }
+  | { type: "receive-failure"; revision: number; failure: "VIDEO_REJECTED" | null }
   | { type: "host"; host: ViewerHostState }
   | {
       type: "route";
@@ -159,6 +163,7 @@ export const INITIAL_VIEWER_PRESENTATION_STATE: ViewerPresentationState = {
   autoplayBlockedGeneration: null,
   playbackFailedGeneration: null,
   runtimeFailure: null,
+  receiveFailure: null,
 };
 
 export function reduceViewerPresentation(
@@ -181,6 +186,10 @@ export function reduceViewerPresentation(
       };
     case "signal":
       return { ...state, signal: action.signal };
+    case "receive-failure":
+      if (state.revision !== null && action.revision < state.revision) return state;
+      if (state.receiveFailure === action.failure) return state;
+      return { ...state, receiveFailure: action.failure };
     case "host": {
       if (action.host === "offline" && state.host === "stopped") {
         return state;
@@ -202,6 +211,7 @@ export function reduceViewerPresentation(
       return {
         ...state,
         revision: action.revision,
+        receiveFailure: action.authoritative ? null : state.receiveFailure,
         route: {
           revision: action.revision,
           phase: action.phase,
@@ -303,6 +313,7 @@ export function reduceViewerPresentation(
         retainedFrame: false,
         routeStatus: null,
         playbackFailedGeneration: null,
+        receiveFailure: null,
       };
     case "frame-proof-reset":
       if (!state.media || state.media.generation !== action.generation) {
@@ -376,6 +387,7 @@ export function reduceViewerPresentation(
         autoplayBlockedGeneration: null,
         playbackFailedGeneration: null,
         runtimeFailure: null,
+        receiveFailure: null,
       };
     case "server-error":
       return { ...state, runtimeFailure: "SERVER_ERROR" };
@@ -498,6 +510,9 @@ export function deriveViewerPresentation(
   // A failed route explains missing media only while the Host can publish.
   // Keep the fact: Host reconnection alone does not repair that route.
   if (state.host === "online" && state.routeStatus?.state === "failed") {
+    if (state.receiveFailure === "VIDEO_REJECTED") {
+      return presentation("video-rejected", "viewer.msg.videoRejected", frameOverlay, state, "VIDEO_REJECTED");
+    }
     return presentation(
       "route-failed",
       "viewer.msg.routeFailed",
diff --git a/src/client/media/viewer-sfu-route.ts b/src/client/media/viewer-sfu-route.ts
index dc2b271d8..bcd26d222 100644
--- a/src/client/media/viewer-sfu-route.ts
+++ b/src/client/media/viewer-sfu-route.ts
@@ -85,6 +85,7 @@ interface ViewerSfuRouteEvents {
     state: "connected" | "reconnecting",
     revision: number,
   ) => void;
+  onSfuFailure?: (failure: "VIDEO_REJECTED" | null, revision: number) => void;
   send: (message: ClientMessage) => boolean;
   createSubscriber?: (
     events: {
@@ -93,7 +94,7 @@ interface ViewerSfuRouteEvents {
       onStats: (metrics: ConnectionMetrics) => void;
       onFirstDecodedFrame: () => boolean;
       onState: (state: "connected" | "reconnecting") => void;
-      onDisconnected: () => void;
+      onDisconnected: (failure?: "VIDEO_REJECTED") => void;
     },
   ) => ViewerSubscriberTransport;
 }
@@ -468,7 +469,7 @@ export class ViewerSfuRoute {
           this.events.onSfuState?.(state, slot.revision);
         }
       },
-      onDisconnected: () => this.failSubscriberSlot(slot),
+      onDisconnected: (failure?: "VIDEO_REJECTED") => this.failSubscriberSlot(slot, failure),
     };
     const subscriber =
       this.events.createSubscriber?.(subscriberEvents) ??
@@ -494,6 +495,7 @@ export class ViewerSfuRoute {
       activationToken: null,
     };
     this.pending = slot;
+    this.events.onSfuFailure?.(null, slot.revision);
     try {
       const connected = await subscriber.connect(message);
       if (!connected) {
@@ -906,7 +908,7 @@ export class ViewerSfuRoute {
     await disconnectSubscriber(active.subscriber);
   }
 
-  private handleFailure(slot: ViewerSubscriberSlot): void {
+  private handleFailure(slot: ViewerSubscriberSlot, failure?: "VIDEO_REJECTED"): void {
     if (this.closed || slot.failed) {
       return;
     }
@@ -916,6 +918,7 @@ export class ViewerSfuRoute {
       slot.failed = true;
       return;
     }
+    this.events.onSfuFailure?.(failure ?? null, slot.revision);
     slot.failed = true;
     slot.subscriber.stopDecodedFrameProof();
     if (this.pending === slot) {
@@ -950,12 +953,12 @@ export class ViewerSfuRoute {
     }
   }
 
-  private failSubscriberSlot(slot: ViewerSubscriberSlot): void {
+  private failSubscriberSlot(slot: ViewerSubscriberSlot, failure?: "VIDEO_REJECTED"): void {
     if (this.pending !== slot && this.active !== slot) {
       slot.failed = true;
       return;
     }
-    this.handleFailure(slot);
+    this.handleFailure(slot, failure);
   }
 
   private routeFailed(
diff --git a/src/client/native/media-bridge.ts b/src/client/native/media-bridge.ts
index b04db9867..a50870b61 100644
--- a/src/client/native/media-bridge.ts
+++ b/src/client/native/media-bridge.ts
@@ -4,6 +4,7 @@ import { browserDebugEnabled, debugError, debugEvent } from "../lib/debug";
 import { observeDebugConnection } from "../lib/debug-webrtc";
 import type { ConnectionMetrics } from "../types";
 import { preferScreenAudioStereo } from "../webrtc/screen-audio-sdp";
+import { requireReceivingVideo } from "../webrtc/video-codec";
 import {
   collectConnectionMetrics,
   decodedVideoFrames,
@@ -195,6 +196,7 @@ export class NativeMediaBridge {
     this.lifetime.signal.throwIfAborted();
     const answer = preferScreenAudioStereo(await this.peer.createAnswer());
     this.lifetime.signal.throwIfAborted();
+    requireReceivingVideo(offer, answer);
     await this.peer.setLocalDescription(answer);
     await this.gatherCandidates();
     this.lifetime.signal.throwIfAborted();
diff --git a/src/client/pages/ViewerPage.tsx b/src/client/pages/ViewerPage.tsx
index 9207c3062..71db4c215 100644
--- a/src/client/pages/ViewerPage.tsx
+++ b/src/client/pages/ViewerPage.tsx
@@ -1093,6 +1093,11 @@ export function ViewerPage({
         currentPeerMetrics: () => activePeerMetrics,
         qualityProbeEligible: () =>
           qualityPresentationEligible(committedTransportConnected()),
+        onSfuFailure: (failure, revision) => {
+          if (active && viewerSfuRoute === route) {
+            dispatchPresentation({ type: "receive-failure", revision, failure });
+          }
+        },
         onSfuState: (state, revision) => {
           if (active && viewerSfuRoute === route) {
             const connected = state === "connected";
@@ -1288,6 +1293,7 @@ export function ViewerPage({
             if (pendingPeer === probe) {
               if (snapshot.connectionId !== probe.candidateConnectionId) return;
               probe.snapshot = snapshot;
+              noteReceiveFailure(snapshot, probe.revision);
               if (probe.qualityProbe) {
                 if (
                   pageSuspended ||
@@ -1319,6 +1325,7 @@ export function ViewerPage({
               }
               provePendingPeer();
             } else if (active && peerRef.current === peer) {
+              noteReceiveFailure(snapshot, currentRouteRevision);
               activePeerMetrics = snapshot.metrics;
               offerPeerQualityEvidence(snapshot, peer);
               setPeerSnapshot(snapshot);
@@ -1407,6 +1414,7 @@ export function ViewerPage({
           },
           onUpdate: (snapshot) => {
             if (active) {
+              noteReceiveFailure(snapshot, currentRouteRevision);
               activePeerMetrics = snapshot.metrics;
               offerPeerQualityEvidence(snapshot, peer);
               if (
@@ -1454,6 +1462,11 @@ export function ViewerPage({
       return peer;
     }
 
+    function noteReceiveFailure(snapshot: PeerSnapshot, revision: number): void {
+      dispatchPresentation({ type: "receive-failure", revision,
+        failure: snapshot.error?.key === "viewer.msg.videoRejected" ? "VIDEO_REJECTED" : null });
+    }
+
     async function handleMessage(
       message: ServerMessage,
       authorityToken: number,
diff --git a/src/client/pages/status-preview-scenarios.ts b/src/client/pages/status-preview-scenarios.ts
index 73501f3b0..0de019f91 100644
--- a/src/client/pages/status-preview-scenarios.ts
+++ b/src/client/pages/status-preview-scenarios.ts
@@ -104,6 +104,12 @@ export const STATUS_SCENARIOS: readonly StatusScenario[] = [
   scenario("playback-failed", "浏览器播放失败", "连接存在，但播放器无法呈现画面。", [
     ...receiving, { type: "playback-failed", generation: 1, revision: 1 },
   ]),
+  scenario("video-rejected", "浏览器拒绝视频协商", "浏览器明确拒绝接收画面；沿用媒体恢复和呈现归属，不误报为网络线路故障。", [
+    ...ready,
+    { type: "route", revision: 1, phase: "prepare", kind: "p2p" },
+    { type: "receive-failure", revision: 1, failure: "VIDEO_REJECTED" },
+    { type: "route-status", revision: 1, state: "failed" },
+  ]),
   scenario("waiting-host", "等待房主开始分享", "房间存在，当前没有共享源。", [{ type: "access", access: "ready" }]),
   scenario("host-absence-snapshot", "重连后只确认房主不在线", "快照没有说明房主为何不在线；用中性等待，不推断主动停播或连接中断。", [
     ...ready, { type: "host", host: "unknown" },
diff --git a/src/client/sfu/subscriber.ts b/src/client/sfu/subscriber.ts
index a492ee250..85bf51b55 100644
--- a/src/client/sfu/subscriber.ts
+++ b/src/client/sfu/subscriber.ts
@@ -7,6 +7,7 @@ import {
   decodedVideoFrames,
 } from "../webrtc/stats";
 import { preferScreenAudioStereo } from "../webrtc/screen-audio-sdp";
+import { requireReceivingVideo, VideoReceiveRejectedError } from "../webrtc/video-codec";
 import { observeDecodedFrameProof } from "../media/decoded-frame-proof";
 import { SfuPeer, type SfuConnectionConfig } from "./peer";
 
@@ -17,7 +18,7 @@ interface SubscriberEvents {
   onStats?: (metrics: ConnectionMetrics) => void;
   onFirstDecodedFrame?: () => boolean;
   onState?: (state: "connected" | "reconnecting") => void;
-  onDisconnected?: () => void;
+  onDisconnected?: (failure?: "VIDEO_REJECTED") => void;
 }
 
 interface SubscribedTrack {
@@ -80,13 +81,13 @@ export class SfuSubscriber {
           throw new Error("SFU subscriber expected an offer");
         await peer.waitForOperation(() => peer.pc.setRemoteDescription(description));
         if (this.peer !== peer) return;
-        await peer.sendDescription(
-          preferScreenAudioStereo(await peer.waitForOperation(() => peer.pc.createAnswer())),
-        );
+        const answer = preferScreenAudioStereo(await peer.waitForOperation(() => peer.pc.createAnswer()));
+        requireReceivingVideo(description, answer);
+        await peer.sendDescription(answer);
         if (peer.pc.connectionState === "connected") this.restartPending = false;
       });
-    } catch {
-      if (this.peer === peer) this.fail();
+    } catch (error) {
+      if (this.peer === peer) this.fail(error instanceof VideoReceiveRejectedError ? "VIDEO_REJECTED" : undefined);
     }
   }
 
@@ -148,10 +149,10 @@ export class SfuSubscriber {
     this.streamEmitted = false;
   }
 
-  private fail(): void {
+  private fail(failure?: "VIDEO_REJECTED"): void {
     if (this.closed) return;
     void this.disconnect();
-    this.events.onDisconnected?.();
+    this.events.onDisconnected?.(failure);
   }
 
   private addTrack({ track, receiver }: RTCTrackEvent): void {
diff --git a/src/client/ui/media-status.ts b/src/client/ui/media-status.ts
index b31be001d..3bc3ac159 100644
--- a/src/client/ui/media-status.ts
+++ b/src/client/ui/media-status.ts
@@ -67,6 +67,7 @@ const STAGE_VISUALS = {
   playing: { tone: "live", icon: "play", comic: "media-playing" },
   recovering: { tone: "warn", icon: "refresh", comic: "recovering", pulse: true },
   "route-failed": { tone: "bad", icon: "wifiOff", comic: "route-failed" },
+  "video-rejected": { tone: "bad", icon: "alert", comic: "playback-failed" },
   "playback-failed": { tone: "bad", icon: "alert", comic: "playback-failed" },
   "waiting-host": { tone: "off", icon: "moon", comic: "waiting-for-host" },
   "host-offline": { tone: "bad", icon: "wifiOff", comic: "host-offline" },
diff --git a/src/client/webrtc/video-codec.ts b/src/client/webrtc/video-codec.ts
index 2b416059c..22b7194af 100644
--- a/src/client/webrtc/video-codec.ts
+++ b/src/client/webrtc/video-codec.ts
@@ -1,3 +1,5 @@
+import { parse } from "sdp-transform";
+
 export type BrowserVideoCodec = "h264" | "vp8";
 export type BrowserVideoCodecMode = "vp8" | "auto" | "h264";
 
@@ -135,3 +137,25 @@ export function normalizeVideoOfferSdp(sdp: string): string {
   });
   return changed ? lines.join(sdp.includes("\r\n") ? "\r\n" : "\n") : sdp;
 }
+
+export class VideoReceiveRejectedError extends Error {
+  constructor() { super("Browser rejected the offered video"); }
+}
+
+// JSEP rejects a media section with port zero. Let the Browser negotiate codecs;
+// reject only an answer that explicitly declines every offered sending video.
+export function requireReceivingVideo(
+  offer: RTCSessionDescriptionInit,
+  answer: RTCSessionDescriptionInit,
+): void {
+  if (offer.type !== "offer" || answer.type !== "answer" || !offer.sdp || !answer.sdp) return;
+  const remote = parse(offer.sdp), local = parse(answer.sdp);
+  const sendingVideo = remote.media.flatMap((media, index) => {
+    const direction = media.direction ?? remote.direction;
+    return media.type === "video" && (media.port !== 0 || media.bundleOnly !== undefined) &&
+      direction !== "inactive" && direction !== "recvonly" ? [index] : [];
+  });
+  if (sendingVideo.length > 0 && sendingVideo.every(index =>
+    local.media[index]?.type === "video" && local.media[index]?.port === 0,
+  )) throw new VideoReceiveRejectedError();
+}
diff --git a/src/client/webrtc/viewer-peer.ts b/src/client/webrtc/viewer-peer.ts
index cd3f70138..d5da408e0 100644
--- a/src/client/webrtc/viewer-peer.ts
+++ b/src/client/webrtc/viewer-peer.ts
@@ -14,6 +14,7 @@ import {
   type StatsAccumulator,
 } from "./stats";
 import { preferScreenAudioStereo } from "./screen-audio-sdp";
+import { requireReceivingVideo, VideoReceiveRejectedError } from "./video-codec";
 import { observeDecodedFrameProof } from "../media/decoded-frame-proof";
 import {
   addRemoteIceCandidate,
@@ -388,6 +389,8 @@ export class ViewerPeer implements ViewerMediaPeer {
       if (!this.isCurrentConnection(connection, connectionId)) {
         return;
       }
+      requireReceivingVideo(payload.description, answer);
+      if (this.snapshot) this.snapshot = { ...this.snapshot, error: null };
       await this.waitForOperation(connection, () => connection.setLocalDescription(answer));
       if (!this.isCurrentConnection(connection, connectionId)) {
         return;
@@ -416,7 +419,8 @@ export class ViewerPeer implements ViewerMediaPeer {
   }
 
   private failOffer(error: unknown, parentPeerId: string, connectionId: string): void {
-    this.setError(error, "host.fail.connection");
+    this.setError(error, error instanceof VideoReceiveRejectedError
+      ? "viewer.msg.videoRejected" : "host.fail.connection");
     if (
       this.recoveryOwner === "viewer" &&
       !this.recoveryBudget.exhaustedReported &&
diff --git a/tests/native-media-bridge.test.ts b/tests/native-media-bridge.test.ts
index 52efbc2b8..da5c6a281 100644
--- a/tests/native-media-bridge.test.ts
+++ b/tests/native-media-bridge.test.ts
@@ -124,6 +124,17 @@ afterEach(() => {
 });
 
 describe("native media bridge", () => {
+  it("retires rejected local video through the existing bridge failure path", async () => {
+    const current = fixture();
+    vi.mocked(current.control.prepareLocalEdge).mockResolvedValueOnce({ type: "offer", offerId: "local_offer_1",
+      sdp: "m=video 9 UDP/TLS/RTP/SAVPF 96\r\na=sendonly\r\n" });
+    current.peer().createAnswer.mockResolvedValueOnce({ type: "answer", sdp: "m=video 0 UDP/TLS/RTP/SAVPF 120\r\n" });
+    await expect(current.bridge.start()).rejects.toBeInstanceOf(NativeMediaBridgeError);
+    expect(current.control.acceptSignal).not.toHaveBeenCalled();
+    expect(current.control.closeEdge).toHaveBeenCalledOnce();
+    expect(current.peer().close).toHaveBeenCalledOnce();
+  });
+
   it("recovers one retained transport after a disconnect grace, including a quiet source", async () => {
     vi.useFakeTimers();
     const current = fixture();
diff --git a/tests/route-transition.test.ts b/tests/route-transition.test.ts
index 516f9238d..fa26fce4b 100644
--- a/tests/route-transition.test.ts
+++ b/tests/route-transition.test.ts
@@ -1118,6 +1118,7 @@ describe("minimal route transition contracts", () => {
   });
 
   it("ignores a retired subscriber failure after same-generation resync", async () => {
+    const onSfuFailure = vi.fn();
     let releaseOldConnect!: () => void;
     const oldConnectGate = new Promise<void>((resolve) => {
       releaseOldConnect = resolve;
@@ -1125,6 +1126,7 @@ describe("minimal route transition contracts", () => {
     const messages: ClientMessage[] = [];
     const subscribers: ReturnType<typeof createFakeSubscriber>[] = [];
     const route = new ViewerSfuRoute("viewer_12345678", {
+      onSfuFailure,
       activatePeer: () => true,
       reconcileSfuChildren: () => undefined,
       onSfuStream: () => undefined,
@@ -1182,6 +1184,12 @@ describe("minimal route transition contracts", () => {
       [],
     );
     expect(subscribers[2]?.activate).toHaveBeenCalledOnce();
+    onSfuFailure.mockClear();
+    subscribers[1]?.events.onDisconnected("VIDEO_REJECTED");
+    expect(onSfuFailure).not.toHaveBeenCalled();
+    subscribers[2]?.events.onDisconnected("VIDEO_REJECTED");
+    expect(onSfuFailure).toHaveBeenCalledExactlyOnceWith("VIDEO_REJECTED", 2);
+    await route.disconnect();
   });
 
 
diff --git a/tests/sfu-client.test.ts b/tests/sfu-client.test.ts
index fdce7d900..8d3fffb35 100644
--- a/tests/sfu-client.test.ts
+++ b/tests/sfu-client.test.ts
@@ -631,6 +631,20 @@ describe("embedded SFU browser transport", () => {
     expect(onStream).toHaveBeenLastCalledWith(null);
   });
 
+  it("reports Browser video rejection through the existing SFU failure owner", async () => {
+    const send = vi.fn(() => true), onDisconnected = vi.fn();
+    const subscriber = new SfuSubscriber({ send, onStream: vi.fn(), onDisconnected });
+    cleanups.push(() => subscriber.disconnect());
+    await subscriber.connect(config);
+    const pc = FakePc.instances[0]!;
+    pc.createAnswer.mockResolvedValueOnce({ type: "answer", sdp: "m=video 0 UDP/TLS/RTP/SAVPF 120\r\n" });
+    await subscriber.acceptSignal(signal({ description: { type: "offer",
+      sdp: "m=video 9 UDP/TLS/RTP/SAVPF 96\r\na=sendonly\r\n" } }));
+    expect(onDisconnected).toHaveBeenCalledExactlyOnceWith("VIDEO_REJECTED");
+    expect(pc.close).toHaveBeenCalledOnce();
+    expect(send).not.toHaveBeenCalled();
+  });
+
   it.each([
     [false, false], [true, false], [false, true], [true, true],
   ])("retires an unfinished ICE restart on reauthentication (send=%s, answer=%s)", async (sent, answered) => {
diff --git a/tests/video-codec.test.ts b/tests/video-codec.test.ts
index 014d3bab7..a7eea66bc 100644
--- a/tests/video-codec.test.ts
+++ b/tests/video-codec.test.ts
@@ -1,5 +1,23 @@
 import { expect, it } from "vitest";
-import { normalizeVideoOfferSdp } from "../src/client/webrtc/video-codec";
+import { normalizeVideoOfferSdp, requireReceivingVideo, VideoReceiveRejectedError } from "../src/client/webrtc/video-codec";
+
+it("recognizes a Browser-rejected video answer without inferring codec support", () => {
+  const offer = (sdp: string): RTCSessionDescriptionInit => ({ type: "offer", sdp });
+  const answer = (sdp: string): RTCSessionDescriptionInit => ({ type: "answer", sdp });
+  const video = "m=video 9 UDP/TLS/RTP/SAVPF 96\r\na=sendonly\r\na=rtpmap:96 H264/90000\r\n";
+  const rejected = "m=video 0 UDP/TLS/RTP/SAVPF 120\r\n";
+  expect(() => requireReceivingVideo(offer(video), answer(rejected))).toThrow(VideoReceiveRejectedError);
+  for (const [offered, accepted] of [
+    [video, video.replace("sendonly", "recvonly")],
+    [video + video, rejected + video.replace("sendonly", "recvonly")],
+    [video.replace("9 UDP", "0 UDP"), rejected],
+    [video.replace("sendonly", "inactive"), rejected],
+    [video.replace("sendonly", "recvonly"), rejected],
+    ["m=audio 9 UDP/TLS/RTP/SAVPF 111\r\n", "m=audio 0 UDP/TLS/RTP/SAVPF 111\r\n"],
+  ]) expect(() => requireReceivingVideo(offer(offered!), answer(accepted!))).not.toThrow();
+  expect(() => requireReceivingVideo(offer(video.replace("9 UDP", "0 UDP") + "a=bundle-only\r\n"),
+    answer(rejected))).toThrow(VideoReceiveRejectedError);
+});
 
 it.each(["\r\n", "\n"])("removes orphan codec attributes within each offered video section (%j)", newline => {
   const lines = [
diff --git a/tests/viewer-peer-generation.test.ts b/tests/viewer-peer-generation.test.ts
index fcef6b920..db3d440f9 100644
--- a/tests/viewer-peer-generation.test.ts
+++ b/tests/viewer-peer-generation.test.ts
@@ -35,6 +35,7 @@ const ANSWER_SDP = [
 interface ConnectionPlan {
   constructorError?: Error;
   answerError?: Error;
+  answerSdp?: string;
   candidateGates?: Promise<void>[];
   localDescriptionGate?: Promise<void>;
   statsGate?: Promise<RTCStatsReport>;
@@ -75,6 +76,7 @@ class FakePeerConnection extends EventTarget {
   private readonly candidateGates: Promise<void>[];
   private readonly localDescriptionGate: Promise<void> | null;
   private readonly answerError: Error | null;
+  private readonly answerSdp: string;
 
   readonly addIceCandidate = vi.fn(async (_candidate: RTCIceCandidateInit | null) => {
     const gate = this.candidateGates.shift();
@@ -107,6 +109,7 @@ class FakePeerConnection extends EventTarget {
     this.candidateGates = [...(plan.candidateGates ?? [])];
     this.localDescriptionGate = plan.localDescriptionGate ?? null;
     this.answerError = plan.answerError ?? null;
+    this.answerSdp = plan.answerSdp ?? ANSWER_SDP;
     this.statsGate = plan.statsGate ?? null;
     FakePeerConnection.instances.push(this);
   }
@@ -123,7 +126,7 @@ class FakePeerConnection extends EventTarget {
     }
     return {
       type: "answer",
-      sdp: ANSWER_SDP,
+      sdp: this.answerSdp,
     };
   }
 
@@ -344,6 +347,23 @@ describe("ViewerPeer connection generations", () => {
     peer.dispose();
   });
 
+  it("returns rejected video to the existing route owner with its receiving cause", async () => {
+    const restart = vi.fn(() => true), exhausted = vi.fn(() => true), sendSignal = vi.fn(() => true);
+    const updates: PeerSnapshot[] = [];
+    const peer = new ViewerPeer({ iceServers: [] }, { sendSignal, sendRestartRequest: restart,
+      onStream: () => undefined, onUpdate: value => updates.push(value), onRecoveryExhausted: exhausted },
+      { recoveryOwner: "route" });
+    FakePeerConnection.plans.push({ answerSdp: "m=video 0 UDP/TLS/RTP/SAVPF 120\r\n" });
+    await peer.acceptSignal("host", { kind: "description", connectionId: "rejected",
+      description: { type: "offer", sdp: "m=video 9 UDP/TLS/RTP/SAVPF 96\r\na=sendonly\r\n" } });
+    expect(updates.at(-1)?.error).toEqual({ key: "viewer.msg.videoRejected" });
+    expect(exhausted).toHaveBeenCalledExactlyOnceWith("host", "rejected");
+    expect(sendSignal).not.toHaveBeenCalled();
+    expect(restart).not.toHaveBeenCalled();
+    expect(timeoutCallbacks.size).toBe(0);
+    peer.dispose();
+  });
+
   it("answers after a rejected queued candidate and still applies later candidates", async () => {
     const signals: SignalPayload[] = [];
     const snapshots: PeerSnapshot[] = [];
diff --git a/tests/viewer-presentation.test.ts b/tests/viewer-presentation.test.ts
index f3c117854..04657c668 100644
--- a/tests/viewer-presentation.test.ts
+++ b/tests/viewer-presentation.test.ts
@@ -23,6 +23,37 @@ function applyFrom(
 }
 
 describe("Viewer presentation reducer", () => {
+  it("retains receiving rejection through route exhaustion but not fresh negotiation or stop", () => {
+    const failed = apply(
+      { type: "access", access: "ready" }, { type: "host", host: "online" },
+      { type: "route", revision: 2, phase: "prepare", kind: "p2p" },
+      { type: "receive-failure", revision: 2, failure: "VIDEO_REJECTED" },
+      { type: "route", revision: 3, phase: "active", kind: "none" },
+      { type: "route-status", revision: 3, state: "failed" },
+    );
+    expect(deriveViewerPresentation(failed)).toMatchObject({ stage: "video-rejected", failureCode: "VIDEO_REJECTED" });
+    const late = applyFrom(failed, { type: "receive-failure", revision: 2, failure: null });
+    expect(late).toBe(failed);
+    expect(deriveViewerPresentation(applyFrom(failed, { type: "host", host: "offline" })).stage).toBe("host-offline");
+    expect(deriveViewerPresentation(applyFrom(failed,
+      { type: "receive-failure", revision: 3, failure: null })).stage).toBe("route-failed");
+    expect(applyFrom(failed, { type: "sharing-stopped" }).receiveFailure).toBeNull();
+    expect(applyFrom(failed, { type: "route", revision: 1, phase: "active", kind: "p2p", authoritative: true })
+      .receiveFailure).toBeNull();
+  });
+
+  it("does not replace a healthy picture with a rejected preparation", () => {
+    const state = apply(
+      { type: "access", access: "ready" }, { type: "host", host: "online" },
+      { type: "media-bound", generation: 1, revision: 1 },
+      { type: "frame-presented", generation: 1, proofEpoch: 0, revision: 1 },
+      { type: "route", revision: 2, phase: "prepare", kind: "sfu" },
+      { type: "receive-failure", revision: 2, failure: "VIDEO_REJECTED" },
+    );
+    expect(deriveViewerPresentation(state).stage).toBe("playing");
+    expect(applyFrom(state, { type: "frame-presented", generation: 1, proofEpoch: 0, revision: 2 }).receiveFailure).toBeNull();
+  });
+
   it("derives connection stages from typed current-revision facts", () => {
     const preparing = apply(
       { type: "access", access: "ready" },

From 2f9e7712ea48bcfa1b0d1dbcb21f2223800b38cc Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 07:08:56 +0800
Subject: [PATCH 102/262] docs(network): record native admission startup
 boundary

---
 docs/research/nat-traversal.md | 10 ++++++++++
 docs/todo.md                   |  4 ++--
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 7ddcdb0f1..50e0de4b5 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -888,6 +888,16 @@ the roughly one-second grant acknowledgment, reaches eight and receives no RTP
 within the unchanged bound. Complete-SDP and early-trickle controls both fail.
 The early-trickle counterfactual is opt-in and intentionally fails its media check.
 
+The simpler pre-ICE control uses supported `DialUDPPort` in both Native
+listener/dialer orientations. With keys already admitted, the real Native control
+session receives fresh RTP, replaces a flow without interrupting its sibling and
+retires all flows on stop or control close. All four Linux race cases and vet
+pass with `PrepareUDPPort` removed from the copied dependency, without an explicit
+diagnostic ping or an admission-dependent candidate gate. The other isolated
+dependency corrections remain. This removes the need for that extra startup API
+when key admission precedes media negotiation; it does not implement room-scoped
+key exchange or demonstrate higher direct reachability.
+
 This establishes a startup-order constraint, not a product integration or a Piik
 field defect. Keys and grants remain local fixture inputs; the candidate gate
 and unsupported dependency method are not accepted product mechanisms.
diff --git a/docs/todo.md b/docs/todo.md
index ad7ee5107..2456ac601 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -88,8 +88,8 @@ Implementation needs a concrete useful result within the product model.
   from exhaustion by sender behavior. No new product setting or flow owner is
   accepted.
   Resolve key exchange and admission before ICE at the assigned-connection owner;
-  research owns the Native control retirement checks and the isolated candidate
-  gate. Neither the pre-granted nor gated fixture implements room authorization.
+  research owns the supported pre-ICE dial/retirement checks and the isolated
+  gated counterfactual. Neither fixture implements room authorization.
   Keep isolated dependency patches and
   recovery counterfactuals outside product routing; a diagnostic reply is not
   media-readiness authority. Research owns the experiments and their limits.

From dabc7a5afe049a5b28d2dfd3bba53f2cce73ada6 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 07:22:59 +0800
Subject: [PATCH 103/262] docs(network): record room-scoped key signaling
 evidence

---
 docs/research/nat-traversal.md | 13 ++++++++++++-
 docs/todo.md                   |  4 +++-
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 50e0de4b5..428025830 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -898,8 +898,19 @@ dependency corrections remain. This removes the need for that extra startup API
 when key admission precedes media negotiation; it does not implement room-scoped
 key exchange or demonstrate higher direct reachability.
 
+An isolated Go signaling extension now carries one bounded public key through
+the real room WebSocket and existing assigned-connection authorizer. It forwards
+candidate and retained-connection metadata, rejects unrelated peers/rooms and
+retired connection IDs, and cannot adopt a new connection from a key message.
+Ordinary invitation revocation still closes the authenticated Viewer session.
+The protocol/signaling race suites pass; removing the connection guard fails
+the scoped probe. This establishes metadata authorization only: Native key
+installation and flow retirement are not yet connected to those room events.
+The generated extension adds no server key registry and does not change the
+product wire format or Browser implementation.
+
 This establishes a startup-order constraint, not a product integration or a Piik
-field defect. Keys and grants remain local fixture inputs; the candidate gate
+field defect. The Native media checks still use local grants; the candidate gate
 and unsupported dependency method are not accepted product mechanisms.
 The existing assigned-connection owner must resolve key exchange and admission
 before ICE starts. Accepting arbitrary keys, passing room credentials into Native
diff --git a/docs/todo.md b/docs/todo.md
index 2456ac601..6d0e3b1d4 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -89,7 +89,9 @@ Implementation needs a concrete useful result within the product model.
   accepted.
   Resolve key exchange and admission before ICE at the assigned-connection owner;
   research owns the supported pre-ICE dial/retirement checks and the isolated
-  gated counterfactual. Neither fixture implements room authorization.
+  gated counterfactual. A Go-only overlay verifies room-scoped key signaling;
+  Native key installation and flow revocation still need to follow those room
+  events. No product wire extension or Browser integration is implemented.
   Keep isolated dependency patches and
   recovery counterfactuals outside product routing; a diagnostic reply is not
   media-readiness authority. Research owns the experiments and their limits.

From 49edc9c6647af948c82f0a7e13b5126b593dc013 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 07:38:54 +0800
Subject: [PATCH 104/262] docs(network): record native flow and relay policy
 boundaries

---
 docs/research/nat-traversal.md | 20 ++++++++++++++++++++
 docs/todo.md                   |  5 ++++-
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 428025830..93a3454b7 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -366,6 +366,15 @@ UDP pairs within the observation window. Tailcat delivered those cases while
 the fixture relay remained available. This demonstrates relay coverage, not
 an additional P2P reachability class or a field success rate.
 
+Relay policy remains a separate integration boundary. Tailcat's documented
+fallback may carry media through DERP during startup or recovery. Closing DERP
+or counting its packets in a fixture measures the path; neither enforces Piik's
+product policy. The reviewed Tailcat API does not expose a direct-only media
+policy that retains discovery. Disabling DERP also removes bootstrap/endpoint
+exchange, and polling a direct-path status cannot authorize each later packet.
+Product adoption needs that separation or an accepted transport-policy change;
+it must not silently add a media relay to P2P-only rooms or bypass SFU-only sites.
+
 Replacing one gateway mapping without notifying endpoints separated recovery
 from initial reachability. Neither established direct path delivered within
 20 seconds with the relay closed. Fresh Pion discovery/exchange recovered in
@@ -909,6 +918,17 @@ installation and flow retirement are not yet connected to those room events.
 The generated extension adds no server key registry and does not change the
 product wire format or Browser implementation.
 
+A separate Native control check derives admission from its actual owned inbound
+flows. Closing one flow retains the shared peer's authorization while another
+flow remains; closing the last disconnects that peer. Final revocation and a new
+grant serialize without holding the flow-map lock through Tailcat callbacks.
+Stop and control-close cases pass under the race detector, including fresh
+sibling RTP before preparing a replacement. Counterfactuals that disconnect on
+every close or never disconnect fail those checks. This composes physical-flow
+cleanup with the Native session; keys still come from the local fixture, not
+the room signaling experiment above. Complete room-to-App authorization remains
+open.
+
 This establishes a startup-order constraint, not a product integration or a Piik
 field defect. The Native media checks still use local grants; the candidate gate
 and unsupported dependency method are not accepted product mechanisms.
diff --git a/docs/todo.md b/docs/todo.md
index 6d0e3b1d4..6f38b2d79 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -90,8 +90,11 @@ Implementation needs a concrete useful result within the product model.
   Resolve key exchange and admission before ICE at the assigned-connection owner;
   research owns the supported pre-ICE dial/retirement checks and the isolated
   gated counterfactual. A Go-only overlay verifies room-scoped key signaling;
-  Native key installation and flow revocation still need to follow those room
+  a separate Native control fixture ties key revocation to its last owned flow.
+  Native key installation and flow retirement still need to follow those room
   events. No product wire extension or Browser integration is implemented.
+  Resolve direct-only media enforcement while retaining discovery; DERP must
+  not silently become another media fallback or bypass site/share route policy.
   Keep isolated dependency patches and
   recovery counterfactuals outside product routing; a diagnostic reply is not
   media-readiness authority. Research owns the experiments and their limits.

From 0225dbacbad2bb0c64978d9dc582349b96ce2ba7 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 08:18:31 +0800
Subject: [PATCH 105/262] docs(network): retain direct media startup boundary

Record the isolated relay-policy controls and unresolved Pion and Native cold-start timing without accepting a product transport or retry change.
---
 docs/research/nat-traversal.md | 34 ++++++++++++++++++++++++++++++++--
 docs/todo.md                   |  8 ++++++--
 2 files changed, 38 insertions(+), 4 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 93a3454b7..b30b5a32a 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -372,8 +372,38 @@ or counting its packets in a fixture measures the path; neither enforces Piik's
 product policy. The reviewed Tailcat API does not expose a direct-only media
 policy that retains discovery. Disabling DERP also removes bootstrap/endpoint
 exchange, and polling a direct-path status cannot authorize each later packet.
-Product adoption needs that separation or an accepted transport-policy change;
-it must not silently add a media relay to P2P-only rooms or bypass SFU-only sites.
+
+An isolated packet-policy overlay separates discovery and fixed
+[WireGuard handshake messages](https://www.wireguard.com/protocol/#key-exchange-and-data-packets)
+from encapsulated data. Blocked UDP carries no media; a relay-allowed peer's
+incoming data is also rejected. Removing either direction's guard fails its
+corresponding control. The ordinary-NAT Pion fixture delivered fresh direct SRTP
+in an initial run but failed cold startup on a repeat, so it is not a passing
+acceptance gate.
+The relay counts encrypted data envelopes without recording keys or payloads;
+ordinary relay delivery validates that counter. The stricter variant that also
+blocks WireGuard handshakes leaves inner ICE connecting without media after
+20 seconds, even after the outer endpoint is known. Native control replacement,
+sibling continuity and final retirement pass with the media-only restriction
+on loopback. These checks do not establish Native startup through NAT.
+
+The complete Native Engine/receiver/playback fixture also fails cold startup through
+ordinary kernel NAT with this restriction, before any address move. Its
+relay-allowed control passes and retains fresh playback after DERP closes.
+Discovery traces show one direction's initial ping unanswered: one endpoint
+confirms direct access promptly, while the other confirms it around six seconds
+later. Native's eight initial ICE writes end around 1.4 seconds; a pending UDP
+flow may still be unaccepted then. The late direct path does not revive that
+exhausted generation. The late side can be either endpoint. A one-shot supported
+`Client.DiscoPing` before ICE returns the relay result in milliseconds and does
+not fix startup. Diagnostic replies and successful key admission therefore
+cannot stand in for bidirectional transport preparation.
+
+Authentication, key handling, retry timers and Pion budgets remain unchanged.
+The experiment narrows the missing direct-media preparation contract; it is not
+a supported upstream option, passing adoption gate or improvement to
+direct NAT reachability. Product adoption must preserve site/share policy,
+including P2P-only and SFU-only rooms, without silently adding another relay.
 
 Replacing one gateway mapping without notifying endpoints separated recovery
 from initial reachability. Neither established direct path delivered within
diff --git a/docs/todo.md b/docs/todo.md
index 6f38b2d79..877e25639 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -93,8 +93,12 @@ Implementation needs a concrete useful result within the product model.
   a separate Native control fixture ties key revocation to its last owned flow.
   Native key installation and flow retirement still need to follow those room
   events. No product wire extension or Browser integration is implemented.
-  Resolve direct-only media enforcement while retaining discovery; DERP must
-  not silently become another media fallback or bypass site/share route policy.
+  Obtain a supported direct-media policy that retains discovery/handshakes;
+  the isolated packet-policy control is not a product API. Resolve its cold-start
+  failures in Pion and Native fixtures: direct discovery can complete after
+  initial ICE checks are exhausted. One diagnostic ping before ICE does not fix it.
+  DERP must not silently become another media fallback or bypass site/share
+  route policy.
   Keep isolated dependency patches and
   recovery counterfactuals outside product routing; a diagnostic reply is not
   media-readiness authority. Research owns the experiments and their limits.

From 4a10af77ecfa2f9c4057a71ecc636b26fd202586 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 08:33:15 +0800
Subject: [PATCH 106/262] docs(network): record preparation cost and remaining
 integration gates

---
 docs/research/nat-traversal.md | 21 ++++++++++++++++++---
 docs/todo.md                   |  6 ++++--
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index b30b5a32a..ea0db5ece 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -387,9 +387,10 @@ blocks WireGuard handshakes leaves inner ICE connecting without media after
 sibling continuity and final retirement pass with the media-only restriction
 on loopback. These checks do not establish Native startup through NAT.
 
-The complete Native Engine/receiver/playback fixture also fails cold startup through
-ordinary kernel NAT with this restriction, before any address move. Its
-relay-allowed control passes and retains fresh playback after DERP closes.
+Without another preparation step, the complete Native Engine/receiver/playback
+fixture also fails cold startup through ordinary kernel NAT with this restriction,
+before any address move. Its relay-allowed control passes and retains fresh
+playback after DERP closes.
 Discovery traces show one direction's initial ping unanswered: one endpoint
 confirms direct access promptly, while the other confirms it around six seconds
 later. Native's eight initial ICE writes end around 1.4 seconds; a pending UDP
@@ -399,6 +400,20 @@ exhausted generation. The late side can be either endpoint. A one-shot supported
 not fix startup. Diagnostic replies and successful key admission therefore
 cannot stand in for bidirectional transport preparation.
 
+A separate startup control uses supported Tailcat TCP establishment inside the
+same tunnel before Native ICE, within the existing eight-second preparation
+deadline. The server checks the assigned peer key and both sides close the
+temporary TCP flow; media still uses UDP. With relayed data prohibited, ordinary
+NAT reaches actual Native receiver/local playback, while blocked UDP expires
+before Native emits SDP or ICE. Relay data counts remain zero throughout.
+Preparation costs about seven seconds in the repeated local runs. This exceeds
+the spare startup time in the existing handoff check: its fifteen seconds of
+post-start observation do not finish inside the unchanged twenty-second bound,
+although fresh playback continues after DERP closes. The startup check therefore
+does not establish migration acceptance or justify extending product deadlines.
+The extra listener and delay are integration costs, not an accepted product
+readiness mechanism or evidence of improved NAT reachability.
+
 Authentication, key handling, retry timers and Pion budgets remain unchanged.
 The experiment narrows the missing direct-media preparation contract; it is not
 a supported upstream option, passing adoption gate or improvement to
diff --git a/docs/todo.md b/docs/todo.md
index 877e25639..105e695d0 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -95,8 +95,10 @@ Implementation needs a concrete useful result within the product model.
   events. No product wire extension or Browser integration is implemented.
   Obtain a supported direct-media policy that retains discovery/handshakes;
   the isolated packet-policy control is not a product API. Resolve its cold-start
-  failures in Pion and Native fixtures: direct discovery can complete after
-  initial ICE checks are exhausted. One diagnostic ping before ICE does not fix it.
+  preparation cost and full handoff boundary: direct discovery can finish after
+  initial ICE checks are exhausted, and the working isolated TCP preparation
+  consumes most of the existing preparation budget. Research owns the controls;
+  neither diagnostic replies nor startup alone establish recovery acceptance.
   DERP must not silently become another media fallback or bypass site/share
   route policy.
   Keep isolated dependency patches and

From 9fad61712c79d9f7af9a4e0c4e2ce966b1525db5 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 08:56:04 +0800
Subject: [PATCH 107/262] docs(network): record bounded discovery repair and
 integration limits

---
 docs/research/nat-traversal.md | 36 ++++++++++++++++++++++------------
 docs/todo.md                   | 10 ++++------
 2 files changed, 27 insertions(+), 19 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index ea0db5ece..3dc8c79dc 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -400,19 +400,29 @@ exhausted generation. The late side can be either endpoint. A one-shot supported
 not fix startup. Diagnostic replies and successful key admission therefore
 cannot stand in for bidirectional transport preparation.
 
-A separate startup control uses supported Tailcat TCP establishment inside the
-same tunnel before Native ICE, within the existing eight-second preparation
-deadline. The server checks the assigned peer key and both sides close the
-temporary TCP flow; media still uses UDP. With relayed data prohibited, ordinary
-NAT reaches actual Native receiver/local playback, while blocked UDP expires
-before Native emits SDP or ICE. Relay data counts remain zero throughout.
-Preparation costs about seven seconds in the repeated local runs. This exceeds
-the spare startup time in the existing handoff check: its fifteen seconds of
-post-start observation do not finish inside the unchanged twenty-second bound,
-although fresh playback continues after DERP closes. The startup check therefore
-does not establish migration acceptance or justify extending product deadlines.
-The extra listener and delay are integration costs, not an accepted product
-readiness mechanism or evidence of improved NAT reachability.
+The producer/consumer review identifies a bootstrap contract mismatch:
+[Tailcat's initial endpoint advertisement](https://github.com/tailscale/tailcat/blob/b4dc28e8aa8936f0a90a41ad8293a64e3d6b645f/tailcat.go#L1570)
+uses CallMeMaybe without first sending direct UDP, while
+[magicsock's receiver](https://github.com/tailscale/tailscale/blob/a0e471a35b8f/wgengine/magicsock/endpoint.go#L2146)
+assumes that send has already opened the peer's stateful firewall. A dependency
+candidate follows pings to newly learned endpoints with the existing endpoint
+advertisement. Identical advertisements do not cause another reply, and no
+timer, retry count or cryptographic check changes.
+
+With that candidate, three fresh Pion starts deliver direct SRTP within
+68–87 ms of their observation start; blocked-UDP and incoming-relay controls
+still enforce the media policy. The real Windows VP8 encoder, Native receiver
+and actual Chromium/Firefox bridge also retain fresh decoded pictures through
+both local-address handoff directions and subsequent DERP closure, within the
+unchanged observation bound. The Native fixture counts relayed data from before
+bootstrap, not only after direct-path discovery. These are isolated, generated-
+media checks; full App/room integration and physical networks remain open.
+
+A separate TCP preparation control restored startup at about seven seconds of
+extra cost but exceeded the spare time in the full handoff check. That extra
+flow is not retained; the library bootstrap candidate supersedes it. Fixed-frame
+or bare-Pion playback controls still expose the separate encoder and local-bridge
+boundaries described below.
 
 Authentication, key handling, retry timers and Pion budgets remain unchanged.
 The experiment narrows the missing direct-media preparation contract; it is not
diff --git a/docs/todo.md b/docs/todo.md
index 105e695d0..977c07157 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -93,12 +93,10 @@ Implementation needs a concrete useful result within the product model.
   a separate Native control fixture ties key revocation to its last owned flow.
   Native key installation and flow retirement still need to follow those room
   events. No product wire extension or Browser integration is implemented.
-  Obtain a supported direct-media policy that retains discovery/handshakes;
-  the isolated packet-policy control is not a product API. Resolve its cold-start
-  preparation cost and full handoff boundary: direct discovery can finish after
-  initial ICE checks are exhausted, and the working isolated TCP preparation
-  consumes most of the existing preparation budget. Research owns the controls;
-  neither diagnostic replies nor startup alone establish recovery acceptance.
+  Obtain supported direct-media and initial endpoint-discovery contracts;
+  the isolated packet-policy overlay and bootstrap repair are not product APIs.
+  Carry the repaired library ordering through the complete room/App composition;
+  neither diagnostic replies nor isolated handoffs establish full recovery.
   DERP must not silently become another media fallback or bypass site/share
   route policy.
   Keep isolated dependency patches and

From 0f669d697fa24b29f38fa7f9899ad6baf942c0d4 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 09:09:57 +0800
Subject: [PATCH 108/262] docs(network): record composed room and native
 admission evidence

---
 docs/research/nat-traversal.md | 30 +++++++++++++++++++-----------
 docs/todo.md                   |  9 +++++----
 2 files changed, 24 insertions(+), 15 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 3dc8c79dc..369229705 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -968,10 +968,9 @@ candidate and retained-connection metadata, rejects unrelated peers/rooms and
 retired connection IDs, and cannot adopt a new connection from a key message.
 Ordinary invitation revocation still closes the authenticated Viewer session.
 The protocol/signaling race suites pass; removing the connection guard fails
-the scoped probe. This establishes metadata authorization only: Native key
-installation and flow retirement are not yet connected to those room events.
-The generated extension adds no server key registry and does not change the
-product wire format or Browser implementation.
+the scoped probe. This establishes metadata authorization. The generated
+extension adds no server key registry and does not change the product wire
+format or Browser implementation.
 
 A separate Native control check derives admission from its actual owned inbound
 flows. Closing one flow retains the shared peer's authorization while another
@@ -980,13 +979,22 @@ grant serialize without holding the flow-map lock through Tailcat callbacks.
 Stop and control-close cases pass under the race detector, including fresh
 sibling RTP before preparing a replacement. Counterfactuals that disconnect on
 every close or never disconnect fail those checks. This composes physical-flow
-cleanup with the Native session; keys still come from the local fixture, not
-the room signaling experiment above. Complete room-to-App authorization remains
-open.
-
-This establishes a startup-order constraint, not a product integration or a Piik
-field defect. The Native media checks still use local grants; the candidate gate
-and unsupported dependency method are not accepted product mechanisms.
+cleanup with the Native session; keys in that control remain local fixture inputs.
+
+The composed room/Native control passes actual room-authorized key exchange,
+SDP/candidates and RTP delivery, same-parent replacement after DERP closure,
+late old-receiver cleanup and invitation-driven final retirement. Rebuilding
+uses the current assignment to exchange the key before ICE; the subsequent SDP
+offer adopts the replacement ID. Trying to exchange a key on the new ID first
+is rejected. Thus pre-ICE preparation does not require giving metadata the power
+to adopt a connection. The fixture still supplies the tunnel bootstrap address
+and translates the room event into the Native stop command; complete Browser/App
+authorization and transport selection remain open. This check establishes
+packet reception and resource retirement, not decoded playback or field benefit.
+
+These checks establish startup-order and ownership constraints, not a product
+integration or a Piik field defect. The earlier candidate gate and unsupported
+dependency method are not accepted product mechanisms.
 The existing assigned-connection owner must resolve key exchange and admission
 before ICE starts. Accepting arbitrary keys, passing room credentials into Native
 control or enlarging its timeout is not an equivalent solution.
diff --git a/docs/todo.md b/docs/todo.md
index 977c07157..3f289209c 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -89,10 +89,11 @@ Implementation needs a concrete useful result within the product model.
   accepted.
   Resolve key exchange and admission before ICE at the assigned-connection owner;
   research owns the supported pre-ICE dial/retirement checks and the isolated
-  gated counterfactual. A Go-only overlay verifies room-scoped key signaling;
-  a separate Native control fixture ties key revocation to its last owned flow.
-  Native key installation and flow retirement still need to follow those room
-  events. No product wire extension or Browser integration is implemented.
+  gated counterfactual. The Go-only room/Native composition verifies authorized
+  key exchange, same-parent replacement and invitation-driven retirement;
+  bootstrap addresses and event-to-control dispatch remain fixture inputs.
+  Integrate those boundaries at the existing Browser/App connection owners.
+  No product wire extension or Browser integration is implemented.
   Obtain supported direct-media and initial endpoint-discovery contracts;
   the isolated packet-policy overlay and bootstrap repair are not product APIs.
   Carry the repaired library ordering through the complete room/App composition;

From 2c56580312c8422a1187d052616823259d8b7c02 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 09:15:32 +0800
Subject: [PATCH 109/262] docs(network): record pending-flow isolation evidence

---
 docs/research/nat-traversal.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 369229705..253f78f76 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -980,6 +980,9 @@ Stop and control-close cases pass under the race detector, including fresh
 sibling RTP before preparing a replacement. Counterfactuals that disconnect on
 every close or never disconnect fail those checks. This composes physical-flow
 cleanup with the Native session; keys in that control remain local fixture inputs.
+The pending-flow adapter also rejects a different admitted peer without consuming
+the assigned listener. The two-peer control reproduced the former premature
+close; the repair permits the expected peer or cancels through the same owner.
 
 The composed room/Native control passes actual room-authorized key exchange,
 SDP/candidates and RTP delivery, same-parent replacement after DERP closure,

From cf06f29c1ab6b15a974d7b35b758aadb4ca3c85a Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 09:31:53 +0800
Subject: [PATCH 110/262] docs(network): record scoped bootstrap exchange
 boundary

---
 docs/research/nat-traversal.md | 20 ++++++++++++++------
 docs/todo.md                   |  3 ++-
 2 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 253f78f76..d6a2573e3 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -962,7 +962,7 @@ dependency corrections remain. This removes the need for that extra startup API
 when key admission precedes media negotiation; it does not implement room-scoped
 key exchange or demonstrate higher direct reachability.
 
-An isolated Go signaling extension now carries one bounded public key through
+An isolated Go signaling extension now carries bounded bootstrap metadata through
 the real room WebSocket and existing assigned-connection authorizer. It forwards
 candidate and retained-connection metadata, rejects unrelated peers/rooms and
 retired connection IDs, and cannot adopt a new connection from a key message.
@@ -984,16 +984,24 @@ The pending-flow adapter also rejects a different admitted peer without consumin
 the assigned listener. The two-peer control reproduced the former premature
 close; the repair permits the expected peer or cancels through the same owner.
 
-The composed room/Native control passes actual room-authorized key exchange,
+The composed room/Native control passes actual room-authorized bootstrap exchange,
 SDP/candidates and RTP delivery, same-parent replacement after DERP closure,
 late old-receiver cleanup and invitation-driven final retirement. Rebuilding
 uses the current assignment to exchange the key before ICE; the subsequent SDP
 offer adopts the replacement ID. Trying to exchange a key on the new ID first
 is rejected. Thus pre-ICE preparation does not require giving metadata the power
-to adopt a connection. The fixture still supplies the tunnel bootstrap address
-and translates the room event into the Native stop command; complete Browser/App
-authorization and transport selection remain open. This check establishes
-packet reception and resource retirement, not decoded playback or field benefit.
+to adopt a connection. Listener metadata exchanges the node and discovery keys,
+a nonzero shared key and a bounded port; it carries no relay URLs or region IDs.
+The dialer constructs the upstream address from received fields and a trusted
+local relay configuration. Strict shape checks and the existing route diagnostic
+owner keep connection material out of its output; complete protocol/signaling
+race suites and the direct-media composition pass.
+Trusted relay configuration and room-event dispatch to Native control remain
+fixture inputs. Complete Browser/App authorization and transport selection remain
+open: the current Native-capable Viewer chooses its backend on the SDP offer,
+so it does not yet advertise Native transport availability before negotiation.
+This check establishes packet reception and resource retirement, not decoded
+playback or field benefit.
 
 These checks establish startup-order and ownership constraints, not a product
 integration or a Piik field defect. The earlier candidate gate and unsupported
diff --git a/docs/todo.md b/docs/todo.md
index 3f289209c..e4ceeee53 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -91,7 +91,8 @@ Implementation needs a concrete useful result within the product model.
   research owns the supported pre-ICE dial/retirement checks and the isolated
   gated counterfactual. The Go-only room/Native composition verifies authorized
   key exchange, same-parent replacement and invitation-driven retirement;
-  bootstrap addresses and event-to-control dispatch remain fixture inputs.
+  connection material now travels through that assigned-connection owner;
+  trusted relay configuration and event-to-control dispatch remain fixture inputs.
   Integrate those boundaries at the existing Browser/App connection owners.
   No product wire extension or Browser integration is implemented.
   Obtain supported direct-media and initial endpoint-discovery contracts;

From 1a6816316949b905e11a94e842c3c7a3efa15227 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 10:01:06 +0800
Subject: [PATCH 111/262] docs(network): record session capability experiment
 boundary

---
 docs/research/nat-traversal.md | 19 +++++++++++++++++++
 docs/todo.md                   |  5 ++++-
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index d6a2573e3..828f94ac9 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1003,6 +1003,25 @@ so it does not yet advertise Native transport availability before negotiation.
 This check establishes packet reception and resource retirement, not decoded
 playback or field benefit.
 
+An isolated session-capability candidate addresses that timing boundary without
+a second exchange or room-wide key registry. Viewer authentication supplies its
+public Native receiver key; the existing preparing and committed assignments
+project it only to assigned parents. Public presence and unrelated participants
+receive none. The existing restart request can replace or clear the key only
+for the current physical connection; a retired request cannot change it.
+Invitation revocation removes it with the authenticated session. Browser-only
+and Native cases pass through real room WebSockets under the race detector.
+The actual App key producer and sender/receiver consumers are still unimplemented;
+advertised availability is a fixture input, not a new media-readiness authority.
+
+`room-browser.mjs` bundles the real Browser schemas and diagnostics with matching
+experimental fields. It accepts the Go fixture's twelve route/restart messages,
+rejects malformed capability/listener fields and removes scoped keys from both
+console events and exported reports while retaining connection and keyframe
+evidence. The Go and Browser optional-map null checks agree. This is a Node-run
+producer/consumer check, not Browser UI or complete App transport acceptance.
+The product wire and diagnostic implementation remain unchanged.
+
 These checks establish startup-order and ownership constraints, not a product
 integration or a Piik field defect. The earlier candidate gate and unsupported
 dependency method are not accepted product mechanisms.
diff --git a/docs/todo.md b/docs/todo.md
index e4ceeee53..8c79104b1 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -93,7 +93,10 @@ Implementation needs a concrete useful result within the product model.
   key exchange, same-parent replacement and invitation-driven retirement;
   connection material now travels through that assigned-connection owner;
   trusted relay configuration and event-to-control dispatch remain fixture inputs.
-  Integrate those boundaries at the existing Browser/App connection owners.
+  The isolated authenticated-session capability projection and Browser schema/
+  diagnostic checks pass; App key production, early discovery and transport
+  consumption remain open. Integrate those boundaries at the existing
+  Browser/App connection owners.
   No product wire extension or Browser integration is implemented.
   Obtain supported direct-media and initial endpoint-discovery contracts;
   the isolated packet-policy overlay and bootstrap repair are not product APIs.

From cacad624155f82e9e282a22dd9c80d1455e99104 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 10:37:33 +0800
Subject: [PATCH 112/262] docs(network): record native socket ownership
 boundary

---
 docs/research/nat-traversal.md | 23 ++++++++++++++++++++---
 docs/todo.md                   |  4 +++-
 2 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 828f94ac9..5b76b5b8c 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -742,9 +742,16 @@ remain prerequisites for product adoption.
 
 The remote-socket overlay extends that comparison through the actual Native
 encoded source, sender, receiver and local playback. It leaves product files
-untouched and admits one fixture peer flow per engine. Its fixed 8×8 input
-exposes forwarding pauses but cannot establish live encoder recovery; declaring
-those fixed bytes rate-controlled is only an ablation.
+untouched and binds the supplied socket to each connection-creation request.
+Its fixed 8×8 input exposes forwarding pauses but cannot establish live encoder
+recovery; declaring those fixed bytes rate-controlled is only an ablation.
+The fixed-frame Viewer-address handoff pauses with both the former and current
+socket adapters, including a matched control with isolated loopback playback.
+Under that same playback isolation, the real Windows VP8/FFmpeg control passes
+with the current adapter in all three checked cases: ordinary unchanged, source
+address change and Viewer address change. These controls separate the adapter
+change from the fixed-input recovery failure; they do not establish its complete
+cause or justify relaxing media acceptance.
 
 The live control instead uses the Windows VP8 helper, Native output-plan owner
 and final FFmpeg decode. The top quarter of the input changes from red to blue
@@ -846,6 +853,16 @@ both remaining flows. Omitting receiver retirement in the test overlay is
 detected. Keys are still pre-granted locally: this establishes resource cleanup,
 not room authorization, automatic App recovery or Browser decoding in this check.
 
+The request-scoped adapter removes the former Engine-wide next-socket slot and
+temporary bootstrap receiver. A lazy factory reaches the existing physical
+socket owner only after input/capacity admission; reuse does not allocate again.
+Unsupported-codec failure, independent receiver retirement, control close and
+cancellation of a still-opening socket pass under the race detector. The Native
+engine, Host, Viewer and control package suites also pass with the overlay.
+Actual control-WebSocket cancellation during slow transport preparation remains
+open: direct invocation and explicit session close do not cover the loopback
+command queue. The experiment has no new recovery loop or room resource registry.
+
 The earlier FFmpeg matrix had one decoded-content failure. Matched synthetic
 bitstream/RTP replay identifies a receiver-fixture mismatch: its separate SDK
 assembler emits a truncated startup frame and can resume dependent frames after
diff --git a/docs/todo.md b/docs/todo.md
index 8c79104b1..928a30ff4 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -94,7 +94,9 @@ Implementation needs a concrete useful result within the product model.
   connection material now travels through that assigned-connection owner;
   trusted relay configuration and event-to-control dispatch remain fixture inputs.
   The isolated authenticated-session capability projection and Browser schema/
-  diagnostic checks pass; App key production, early discovery and transport
+  diagnostic checks pass. Socket binding now follows the individual Native
+  request and its existing media owner; complete loopback cancellation during
+  slow preparation, App key production, early discovery and transport
   consumption remain open. Integrate those boundaries at the existing
   Browser/App connection owners.
   No product wire extension or Browser integration is implemented.

From ac6816f5fbecaa3b2ea65b6b4e29cbd621fcfa57 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 10:42:31 +0800
Subject: [PATCH 113/262] docs(network): record loopback cancellation evidence

---
 docs/research/nat-traversal.md | 13 ++++++++++---
 docs/todo.md                   | 10 +++++-----
 2 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 5b76b5b8c..87142477b 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -859,9 +859,16 @@ socket owner only after input/capacity admission; reuse does not allocate again.
 Unsupported-codec failure, independent receiver retirement, control close and
 cancellation of a still-opening socket pass under the race detector. The Native
 engine, Host, Viewer and control package suites also pass with the overlay.
-Actual control-WebSocket cancellation during slow transport preparation remains
-open: direct invocation and explicit session close do not cover the loopback
-command queue. The experiment has no new recovery loop or room resource registry.
+The complete loopback WebSocket check exposes one additional integration gap:
+delayed socket preparation waits for its media owner, while deferred session
+close waits for that synchronous command. Client disconnect and server shutdown
+both leave it waiting in the unmodified owner. The isolated correction runs
+session close on control-context cancellation and joins it before releasing the
+capacity slot. Both cases, the direct-owner checks and loopback/control package
+suites pass under the race detector. This is an experimental slow-transport
+requirement, not an established published failure. Browser-driven key production,
+discovery and transport consumption remain open; no new recovery loop or room
+resource registry is added.
 
 The earlier FFmpeg matrix had one decoded-content failure. Matched synthetic
 bitstream/RTP replay identifies a receiver-fixture mismatch: its separate SDK
diff --git a/docs/todo.md b/docs/todo.md
index 928a30ff4..b641e696e 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -94,11 +94,11 @@ Implementation needs a concrete useful result within the product model.
   connection material now travels through that assigned-connection owner;
   trusted relay configuration and event-to-control dispatch remain fixture inputs.
   The isolated authenticated-session capability projection and Browser schema/
-  diagnostic checks pass. Socket binding now follows the individual Native
-  request and its existing media owner; complete loopback cancellation during
-  slow preparation, App key production, early discovery and transport
-  consumption remain open. Integrate those boundaries at the existing
-  Browser/App connection owners.
+  diagnostic checks pass. Socket binding follows the individual Native request
+  and its existing media owner. The isolated loopback correction cancels slow
+  preparation when the control ends and joins cleanup; App key production, early
+  discovery and transport consumption remain open. Integrate those boundaries
+  at the existing Browser/App connection owners.
   No product wire extension or Browser integration is implemented.
   Obtain supported direct-media and initial endpoint-discovery contracts;
   the isolated packet-policy overlay and bootstrap repair are not product APIs.

From 068eba8b51d359a604a7a861b693b21cd46ff7a6 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 10:56:32 +0800
Subject: [PATCH 114/262] docs(network): record native handshake identity
 evidence

---
 docs/research/nat-traversal.md | 19 ++++++++++++++-----
 docs/todo.md                   |  7 ++++---
 2 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 87142477b..21f408893 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -866,9 +866,9 @@ both leave it waiting in the unmodified owner. The isolated correction runs
 session close on control-context cancellation and joins it before releasing the
 capacity slot. Both cases, the direct-owner checks and loopback/control package
 suites pass under the race detector. This is an experimental slow-transport
-requirement, not an established published failure. Browser-driven key production,
-discovery and transport consumption remain open; no new recovery loop or room
-resource registry is added.
+requirement, not an established published failure. Viewer-page startup and
+transport consumption remain open; no new recovery loop or room resource
+registry is added.
 
 The earlier FFmpeg matrix had one decoded-content failure. Matched synthetic
 bitstream/RTP replay identifies a receiver-fixture mismatch: its separate SDK
@@ -1035,8 +1035,17 @@ receive none. The existing restart request can replace or clear the key only
 for the current physical connection; a retired request cannot change it.
 Invitation revocation removes it with the authenticated session. Browser-only
 and Native cases pass through real room WebSockets under the race detector.
-The actual App key producer and sender/receiver consumers are still unimplemented;
-advertised availability is a fixture input, not a new media-readiness authority.
+The isolated Native control now generates the private key in its existing
+session and supplies only the public half in the ordinary `ready` handshake.
+There is no persisted device identity or additional query. A Node-driven real
+Browser `NativeClient` connects through loopback HTTP/WebSocket: independent
+sessions have different keys, ordinary commands retain them, and retirement
+clears the advertised identity without affecting its sibling. Diagnostic export
+and console output exclude those keys; loopback/control race suites and the App
+composition build pass. This does not cover Browser local-network permission.
+The Viewer page still discovers Native on the offer rather than before room
+authentication, and sender/receiver transport consumption remains unimplemented.
+The key is availability metadata, not media-readiness authority.
 
 `room-browser.mjs` bundles the real Browser schemas and diagnostics with matching
 experimental fields. It accepts the Go fixture's twelve route/restart messages,
diff --git a/docs/todo.md b/docs/todo.md
index b641e696e..1e19dfd7f 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -96,9 +96,10 @@ Implementation needs a concrete useful result within the product model.
   The isolated authenticated-session capability projection and Browser schema/
   diagnostic checks pass. Socket binding follows the individual Native request
   and its existing media owner. The isolated loopback correction cancels slow
-  preparation when the control ends and joins cleanup; App key production, early
-  discovery and transport consumption remain open. Integrate those boundaries
-  at the existing Browser/App connection owners.
+  preparation when the control ends and joins cleanup. App session key production
+  and the actual NativeClient discovery/hello pass in a Node-driven local check;
+  early Viewer-page discovery, reconnect updates and transport consumption remain
+  open. Integrate those boundaries at the existing Browser/App connection owners.
   No product wire extension or Browser integration is implemented.
   Obtain supported direct-media and initial endpoint-discovery contracts;
   the isolated packet-policy overlay and bootstrap repair are not product APIs.

From c10561b5b999c866b49a92efe91064c2e048aadb Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 11:14:48 +0800
Subject: [PATCH 115/262] docs(network): record viewer startup experiment
 boundary

---
 docs/research/nat-traversal.md | 16 ++++++++++++----
 docs/todo.md                   |  9 ++++++---
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 21f408893..ac22df87c 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1022,8 +1022,7 @@ owner keep connection material out of its output; complete protocol/signaling
 race suites and the direct-media composition pass.
 Trusted relay configuration and room-event dispatch to Native control remain
 fixture inputs. Complete Browser/App authorization and transport selection remain
-open: the current Native-capable Viewer chooses its backend on the SDP offer,
-so it does not yet advertise Native transport availability before negotiation.
+open: the product Native-capable Viewer chooses its backend on the SDP offer.
 This check establishes packet reception and resource retirement, not decoded
 playback or field benefit.
 
@@ -1043,8 +1042,17 @@ sessions have different keys, ordinary commands retain them, and retirement
 clears the advertised identity without affecting its sibling. Diagnostic export
 and console output exclude those keys; loopback/control race suites and the App
 composition build pass. This does not cover Browser local-network permission.
-The Viewer page still discovers Native on the offer rather than before room
-authentication, and sender/receiver transport consumption remains unimplemented.
+The isolated Browser overlay now preflights the existing Viewer connection
+promise before authentication only for App-launched pages. Missing App discovery
+retains Browser fallback. The existing signaling identity supplies the current
+key on authentication, restart and reconnect; control loss or disabled Native
+reception clears it without initiating another recovery operation. Owner checks
+cover stale cleanup, completion after unmount and disabling Native during
+discovery. They exercise extracted page logic and the real signaling serializer,
+not rendered UI or Browser permissions. Full overlaid frontend type checking
+still fails where media consumers assume every signal is SDP/ICE. Native metadata
+dispatch and sender/receiver transport consumption remain unimplemented;
+the scoped startup checks do not establish complete Browser integration.
 The key is availability metadata, not media-readiness authority.
 
 `room-browser.mjs` bundles the real Browser schemas and diagnostics with matching
diff --git a/docs/todo.md b/docs/todo.md
index 1e19dfd7f..d74801bfc 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -98,9 +98,12 @@ Implementation needs a concrete useful result within the product model.
   and its existing media owner. The isolated loopback correction cancels slow
   preparation when the control ends and joins cleanup. App session key production
   and the actual NativeClient discovery/hello pass in a Node-driven local check;
-  early Viewer-page discovery, reconnect updates and transport consumption remain
-  open. Integrate those boundaries at the existing Browser/App connection owners.
-  No product wire extension or Browser integration is implemented.
+  the isolated Viewer startup owner now preflights App discovery and carries its
+  current identity through authentication/restart/reconnect. Rendered Browser
+  acceptance, Native metadata dispatch and transport consumption remain open;
+  full overlaid frontend type checking still exposes the unimplemented dispatch
+  boundary. Integrate these at the existing Browser/App connection owners.
+  No product wire extension or complete Browser integration is implemented.
   Obtain supported direct-media and initial endpoint-discovery contracts;
   the isolated packet-policy overlay and bootstrap repair are not product APIs.
   Carry the repaired library ordering through the complete room/App composition;

From 8629bf6cba9bf00e8b0308529914aeca304db0b5 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 11:29:23 +0800
Subject: [PATCH 116/262] docs(network): record single-offer transport evidence

---
 docs/research/nat-traversal.md | 36 ++++++++++++++++------------------
 docs/todo.md                   | 12 ++++++------
 2 files changed, 23 insertions(+), 25 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index ac22df87c..a29ff569c 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -986,15 +986,13 @@ dependency corrections remain. This removes the need for that extra startup API
 when key admission precedes media negotiation; it does not implement room-scoped
 key exchange or demonstrate higher direct reachability.
 
-An isolated Go signaling extension now carries bounded bootstrap metadata through
-the real room WebSocket and existing assigned-connection authorizer. It forwards
-candidate and retained-connection metadata, rejects unrelated peers/rooms and
-retired connection IDs, and cannot adopt a new connection from a key message.
-Ordinary invitation revocation still closes the authenticated Viewer session.
-The protocol/signaling race suites pass; removing the connection guard fails
-the scoped probe. This establishes metadata authorization. The generated
-extension adds no server key registry and does not change the product wire
-format or Browser implementation.
+The isolated signaling extension carries bounded listener metadata on the
+assigned parent's ordinary SDP offer. SDP/ICE remain the signal variants;
+there is no extra key-exchange message or router authorization branch. Actual
+room WebSocket checks reject unrelated peers/rooms, retired candidates and
+listener metadata on answers or ICE candidates. Ordinary invitation revocation
+still closes the authenticated Viewer session. Protocol/signaling race suites
+pass. The generated extension adds no server key registry or product wire change.
 
 A separate Native control check derives admission from its actual owned inbound
 flows. Closing one flow retains the shared peer's authorization while another
@@ -1008,13 +1006,13 @@ The pending-flow adapter also rejects a different admitted peer without consumin
 the assigned listener. The two-peer control reproduced the former premature
 close; the repair permits the expected peer or cancels through the same owner.
 
-The composed room/Native control passes actual room-authorized bootstrap exchange,
-SDP/candidates and RTP delivery, same-parent replacement after DERP closure,
-late old-receiver cleanup and invitation-driven final retirement. Rebuilding
-uses the current assignment to exchange the key before ICE; the subsequent SDP
-offer adopts the replacement ID. Trying to exchange a key on the new ID first
-is rejected. Thus pre-ICE preparation does not require giving metadata the power
-to adopt a connection. Listener metadata exchanges the node and discovery keys,
+The composed room/Native control receives the child's authenticated key through
+its assigned-parent projection. The parent prepares a listener before its offer;
+the child dials from that offer before creating its ICE agent. RTP delivery,
+same-parent replacement after DERP closure, late old-receiver cleanup and
+invitation-driven final retirement pass under the race detector. The ordinary
+offer adopts a replacement ID; the parent's updated assignment retires its
+listener while the Viewer stops receiving. Listener metadata carries the node and discovery keys,
 a nonzero shared key and a bounded port; it carries no relay URLs or region IDs.
 The dialer constructs the upstream address from received fields and a trusted
 local relay configuration. Strict shape checks and the existing route diagnostic
@@ -1049,9 +1047,9 @@ key on authentication, restart and reconnect; control loss or disabled Native
 reception clears it without initiating another recovery operation. Owner checks
 cover stale cleanup, completion after unmount and disabling Native during
 discovery. They exercise extracted page logic and the real signaling serializer,
-not rendered UI or Browser permissions. Full overlaid frontend type checking
-still fails where media consumers assume every signal is SDP/ICE. Native metadata
-dispatch and sender/receiver transport consumption remain unimplemented;
+not rendered UI or Browser permissions. Full overlaid frontend and lifecycle-test
+type checking now pass with the single offer field. Native command binding
+and sender/receiver transport consumption remain unimplemented;
 the scoped startup checks do not establish complete Browser integration.
 The key is availability metadata, not media-readiness authority.
 
diff --git a/docs/todo.md b/docs/todo.md
index d74801bfc..3cccc9c35 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -89,9 +89,9 @@ Implementation needs a concrete useful result within the product model.
   accepted.
   Resolve key exchange and admission before ICE at the assigned-connection owner;
   research owns the supported pre-ICE dial/retirement checks and the isolated
-  gated counterfactual. The Go-only room/Native composition verifies authorized
-  key exchange, same-parent replacement and invitation-driven retirement;
-  connection material now travels through that assigned-connection owner;
+  gated counterfactual. The Go-only room/Native composition verifies the
+  authenticated receiver key and listener metadata on the ordinary SDP offer,
+  same-parent replacement and invitation-driven retirement;
   trusted relay configuration and event-to-control dispatch remain fixture inputs.
   The isolated authenticated-session capability projection and Browser schema/
   diagnostic checks pass. Socket binding follows the individual Native request
@@ -100,9 +100,9 @@ Implementation needs a concrete useful result within the product model.
   and the actual NativeClient discovery/hello pass in a Node-driven local check;
   the isolated Viewer startup owner now preflights App discovery and carries its
   current identity through authentication/restart/reconnect. Rendered Browser
-  acceptance, Native metadata dispatch and transport consumption remain open;
-  full overlaid frontend type checking still exposes the unimplemented dispatch
-  boundary. Integrate these at the existing Browser/App connection owners.
+  acceptance, Native command binding and transport consumption remain open.
+  Full overlaid frontend type checking passes without extra signal variants.
+  Integrate the remaining work at the existing Browser/App connection owners.
   No product wire extension or complete Browser integration is implemented.
   Obtain supported direct-media and initial endpoint-discovery contracts;
   the isolated packet-policy overlay and bootstrap repair are not product APIs.

From 046d990be1b4b37387edd2ad84be41eb1a06e6d5 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 11:59:33 +0800
Subject: [PATCH 117/262] docs(network): record receiver binding and identity
 limits

---
 docs/research/nat-traversal.md | 39 ++++++++++++++++-----
 docs/todo.md                   | 62 +++++++++++-----------------------
 2 files changed, 50 insertions(+), 51 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index a29ff569c..5857caf72 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -866,9 +866,10 @@ both leave it waiting in the unmodified owner. The isolated correction runs
 session close on control-context cancellation and joins it before releasing the
 capacity slot. Both cases, the direct-owner checks and loopback/control package
 suites pass under the race detector. This is an experimental slow-transport
-requirement, not an established published failure. Viewer-page startup and
-transport consumption remain open; no new recovery loop or room resource
-registry is added.
+requirement, not an established published failure. The
+[authorization boundary](#peer-authorization-boundary) owns the subsequent
+Viewer startup and receive-command evidence; no new recovery loop or room
+resource registry is added.
 
 The earlier FFmpeg matrix had one decoded-content failure. Matched synthetic
 bitstream/RTP replay identifies a receiver-fixture mismatch: its separate SDK
@@ -1032,8 +1033,9 @@ receive none. The existing restart request can replace or clear the key only
 for the current physical connection; a retired request cannot change it.
 Invitation revocation removes it with the authenticated session. Browser-only
 and Native cases pass through real room WebSockets under the race detector.
-The isolated Native control now generates the private key in its existing
-session and supplies only the public half in the ordinary `ready` handshake.
+The explicitly configured experimental Native control generates its private key
+and supplies only the public half in the ordinary `ready` handshake. An
+unconfigured control advertises no experimental transport.
 There is no persisted device identity or additional query. A Node-driven real
 Browser `NativeClient` connects through loopback HTTP/WebSocket: independent
 sessions have different keys, ordinary commands retain them, and retirement
@@ -1047,12 +1049,31 @@ key on authentication, restart and reconnect; control loss or disabled Native
 reception clears it without initiating another recovery operation. Owner checks
 cover stale cleanup, completion after unmount and disabling Native during
 discovery. They exercise extracted page logic and the real signaling serializer,
-not rendered UI or Browser permissions. Full overlaid frontend and lifecycle-test
-type checking now pass with the single offer field. Native command binding
-and sender/receiver transport consumption remain unimplemented;
-the scoped startup checks do not establish complete Browser integration.
+not rendered UI or Browser permissions. The overlaid NativeViewerPeer and
+NativeClient forward the offer's listener to `receive-offer`; full frontend
+type checking passes. The actual command now creates the Tailcat flow lazily
+under its admitted Native receiver, using the control's key and locally trusted
+relay. Shared strict decoding rejects null or untrusted configuration fields;
+unavailable transport is an operation failure. Control retirement cancels a
+real pending dial. Same-parent overlap shares one client across two physical
+flows; final retirement releases it. Room/Native RTP and cancellation checks pass
+under the race detector. Sender binding, rendered Browser acceptance and complete
+recovery remain open. These checks do not establish complete Browser integration.
 The key is availability metadata, not media-readiness authority.
 
+The independent-parent control on 2026-10-10 exposes an identity-scope limit.
+It receives RTP on both local direct paths, but two parent-bound Tailcat clients
+using the same control key produce two duplicate relay registrations; the
+same-parent control produces none. Upstream
+[DERP registration](https://github.com/tailscale/tailscale/blob/main/derp/derpserver/derpserver.go)
+selects an active connection among duplicates, so local direct delivery does not
+prove reliable discovery/recovery across parents. Revisit connection identity or
+supported shared-underlay ownership before adoption; do not weaken overlap or
+add a route-specific fallback to conceal this limit. The same test exposed a
+pending-listener close race: the dependency may clear its remote address before
+a final datagram write. Retaining the already-authorized address makes that
+write fail normally; the focused retirement and concurrent ICE checks pass.
+
 `room-browser.mjs` bundles the real Browser schemas and diagnostics with matching
 experimental fields. It accepts the Go fixture's twelve route/restart messages,
 rejects malformed capability/listener fields and removes scoped keys from both
diff --git a/docs/todo.md b/docs/todo.md
index 3cccc9c35..91e34582d 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -72,49 +72,27 @@ Implementation needs a concrete useful result within the product model.
   of v1.9.2.
 - [ ] **Native Magicsock.** Go reuse is feasible, but the
   [matched comparisons](./research/nat-traversal.md#integration-cost-and-recovery-controls)
-  have not established improved direct reachability. Seek a repeatable benefit
-  before accepting room-scoped peer keys, flow admission and relay operation.
-  Verify the measured local-address handoff benefit through the complete App,
-  mixed Browser/Native topology and physical networks. Current Native-engine,
-  Browser-bridge and decoded-picture controls do not cover App authorization or
-  room routing, and do not establish another reachable NAT class. Preserve the
-  existing local address policy; forcing loopback fails Firefox.
-  Product adoption still needs supported
-  [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary)
-  and RTCP/MTU boundaries, complete recovery with fresh per-connection flows
-  beyond the isolated owner and decoded-handoff checks, including each sender's
-  recovery capability, and mixed Browser/Native verification. Inner checks can
-  exhaust before the underlay recovers; research distinguishes eventual recovery
-  from exhaustion by sender behavior. No new product setting or flow owner is
-  accepted.
-  Resolve key exchange and admission before ICE at the assigned-connection owner;
-  research owns the supported pre-ICE dial/retirement checks and the isolated
-  gated counterfactual. The Go-only room/Native composition verifies the
-  authenticated receiver key and listener metadata on the ordinary SDP offer,
-  same-parent replacement and invitation-driven retirement;
-  trusted relay configuration and event-to-control dispatch remain fixture inputs.
-  The isolated authenticated-session capability projection and Browser schema/
-  diagnostic checks pass. Socket binding follows the individual Native request
-  and its existing media owner. The isolated loopback correction cancels slow
-  preparation when the control ends and joins cleanup. App session key production
-  and the actual NativeClient discovery/hello pass in a Node-driven local check;
-  the isolated Viewer startup owner now preflights App discovery and carries its
-  current identity through authentication/restart/reconnect. Rendered Browser
-  acceptance, Native command binding and transport consumption remain open.
-  Full overlaid frontend type checking passes without extra signal variants.
-  Integrate the remaining work at the existing Browser/App connection owners.
+  have not established another reachable NAT class. Verify the measured local
+  address-handoff benefit through the complete App, mixed Browser/Native topology
+  and physical networks before adoption. Resolve the measured independent-parent
+  identity collision: separate Tailcat clients with the same session key register
+  duplicate relay connections even while local direct media passes.
+  Verify receiver reuse when the same connection ID receives changed listener
+  metadata; its existing UDP flow must not silently retain the previous listener.
+  Complete sender binding, room-event dispatch, rendered Browser acceptance and
+  recovery at the existing assigned-connection owners. Key exchange/admission
+  must precede ICE; diagnostic replies are not media-readiness evidence, and inner
+  checks may exhaust before the underlay recovers. Research owns the verified
+  receive-command, key/lifecycle and local RTP evidence and their limits.
+  Obtain supported [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary),
+  direct-media, endpoint-discovery and RTCP/MTU contracts plus a trusted relay
+  configuration. Experimental dependency patches are not product APIs.
+  Preserve the local address policy (forcing loopback fails Firefox), existing
+  recovery deadlines and single route/resource owners. DERP must not become
+  another media fallback or bypass site/share policy. No new setting, timeout
+  change or transport integration is accepted; the P2P evidence work below owns
+  network/interop acceptance.
   No product wire extension or complete Browser integration is implemented.
-  Obtain supported direct-media and initial endpoint-discovery contracts;
-  the isolated packet-policy overlay and bootstrap repair are not product APIs.
-  Carry the repaired library ordering through the complete room/App composition;
-  neither diagnostic replies nor isolated handoffs establish full recovery.
-  DERP must not silently become another media fallback or bypass site/share
-  route policy.
-  Keep isolated dependency patches and
-  recovery counterfactuals outside product routing; a diagnostic reply is not
-  media-readiness authority. Research owns the experiments and their limits.
-  No timeout change or transport integration is accepted; the P2P evidence work
-  below owns the network/interop acceptance boundary.
 - [ ] **Small external test before 2.0.** First use the isolated transport
   experiment on the same difficult network pairs as current Piik, measuring
   direct success separately from relay delivery, first-picture time, recovery

From a705e65d842afaae33266a221176259f1a8fdce6 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 12:28:42 +0800
Subject: [PATCH 118/262] docs(network): record experimental receiver recovery
 boundary

---
 docs/research/nat-traversal.md | 15 ++++++++++++++-
 docs/todo.md                   |  6 ++++--
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 5857caf72..c6f586db1 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1057,7 +1057,11 @@ relay. Shared strict decoding rejects null or untrusted configuration fields;
 unavailable transport is an operation failure. Control retirement cancels a
 real pending dial. Same-parent overlap shares one client across two physical
 flows; final retirement releases it. Room/Native RTP and cancellation checks pass
-under the race detector. Sender binding, rendered Browser acceptance and complete
+under the race detector. Receiver reuse additionally requires identical listener
+metadata. The changed-port control fails without that check; with a shared
+client retained by a sibling, replacement receives fresh RTP and leaves the
+sibling working. Ordinary Native reuse/control race suites still pass.
+Sender binding, rendered Browser acceptance and complete
 recovery remain open. These checks do not establish complete Browser integration.
 The key is availability metadata, not media-readiness authority.
 
@@ -1074,6 +1078,15 @@ pending-listener close race: the dependency may clear its remote address before
 a final datagram write. Retaining the already-authorized address makes that
 write fail normally; the focused retirement and concurrent ICE checks pass.
 
+Last-receiver replacement exposes a separate recovery limit: recreating the
+client with the same key completes bootstrap but delivers no RTP within the
+unchanged five-second window. A tunnel-only generated-UDP control reproduces
+the failure without Piik or Pion; explicitly retiring the parent's peer before
+recreating the client passes. Allowing local relay data or re-advertising server
+endpoints on a known-key handshake does not repair it. The precise retained
+dependency state remains unisolated. Keep this opt-in negative control with the
+identity-scope work above; do not add a parent reset that would retire siblings.
+
 `room-browser.mjs` bundles the real Browser schemas and diagnostics with matching
 experimental fields. It accepts the Go fixture's twelve route/restart messages,
 rejects malformed capability/listener fields and removes scoped keys from both
diff --git a/docs/todo.md b/docs/todo.md
index 91e34582d..5fc1e4e61 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -77,8 +77,10 @@ Implementation needs a concrete useful result within the product model.
   and physical networks before adoption. Resolve the measured independent-parent
   identity collision: separate Tailcat clients with the same session key register
   duplicate relay connections even while local direct media passes.
-  Verify receiver reuse when the same connection ID receives changed listener
-  metadata; its existing UDP flow must not silently retain the previous listener.
+  Resolve same-key client recreation while the parent retains its peer: bootstrap
+  succeeds but both the UDP-only control and last-receiver replacement deliver
+  no datagrams within their unchanged bounds. Retiring the parent peer passes
+  the control; that is evidence, not permission to reset healthy sibling paths.
   Complete sender binding, room-event dispatch, rendered Browser acceptance and
   recovery at the existing assigned-connection owners. Key exchange/admission
   must precede ICE; diagnostic replies are not media-readiness evidence, and inner

From e47326bd46e909c9fadbe704f0af76372b7f8a76 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 12:49:38 +0800
Subject: [PATCH 119/262] docs(network): record bounded discovery recovery
 evidence

---
 docs/research/nat-traversal.md | 19 ++++++++++++++-----
 docs/todo.md                   |  7 +++----
 2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index c6f586db1..49a0c69b1 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1081,11 +1081,20 @@ write fail normally; the focused retirement and concurrent ICE checks pass.
 Last-receiver replacement exposes a separate recovery limit: recreating the
 client with the same key completes bootstrap but delivers no RTP within the
 unchanged five-second window. A tunnel-only generated-UDP control reproduces
-the failure without Piik or Pion; explicitly retiring the parent's peer before
-recreating the client passes. Allowing local relay data or re-advertising server
-endpoints on a known-key handshake does not repair it. The precise retained
-dependency state remains unisolated. Keep this opt-in negative control with the
-identity-scope work above; do not add a parent reset that would retire siblings.
+the failure without Piik or Pion. Keyless event counters isolate the first
+WireGuard response going to the old endpoint; the next normal handshake uses
+the new endpoint and delivers data after the original window. This is delayed
+recovery, not permanent loss. Allowing relay data or repeating endpoint
+advertisement alone does not meet the original bound.
+
+`tailcat-discovery-lifetime.patch` gives each new client engine a fresh discovery
+key while preserving its authorized node key. The authenticated meow updates an
+immutable peer snapshot, so existing Magicsock invalidation retires the cached
+path. Server discovery identity stays stable for published addresses. UDP-only
+and actual Native last-receiver replacement now pass without changing timeouts
+or resetting the parent's peer; sibling, revocation, listener and upstream
+admission checks pass under the race detector. This remains an isolated
+dependency candidate, not a supported API or a fix for duplicate relay identities.
 
 `room-browser.mjs` bundles the real Browser schemas and diagnostics with matching
 experimental fields. It accepts the Go fixture's twelve route/restart messages,
diff --git a/docs/todo.md b/docs/todo.md
index 5fc1e4e61..17925307b 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -77,10 +77,9 @@ Implementation needs a concrete useful result within the product model.
   and physical networks before adoption. Resolve the measured independent-parent
   identity collision: separate Tailcat clients with the same session key register
   duplicate relay connections even while local direct media passes.
-  Resolve same-key client recreation while the parent retains its peer: bootstrap
-  succeeds but both the UDP-only control and last-receiver replacement deliver
-  no datagrams within their unchanged bounds. Retiring the parent peer passes
-  the control; that is evidence, not permission to reset healthy sibling paths.
+  Obtain supported client discovery-lifetime behavior: the isolated repair meets
+  the original reconnect bounds without resetting the parent peer, but remains
+  another dependency patch rather than a product-ready integration.
   Complete sender binding, room-event dispatch, rendered Browser acceptance and
   recovery at the existing assigned-connection owners. Key exchange/admission
   must precede ICE; diagnostic replies are not media-readiness evidence, and inner

From 12628a5e578b96f9144fa0493fb214914010716a Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 13:17:42 +0800
Subject: [PATCH 120/262] docs(network): record client-scoped transport
 evidence

---
 docs/research/nat-traversal.md | 143 +++++++++++++--------------------
 docs/todo.md                   |  11 +--
 2 files changed, 59 insertions(+), 95 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 49a0c69b1..f25493008 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1007,94 +1007,61 @@ The pending-flow adapter also rejects a different admitted peer without consumin
 the assigned listener. The two-peer control reproduced the former premature
 close; the repair permits the expected peer or cancels through the same owner.
 
-The composed room/Native control receives the child's authenticated key through
-its assigned-parent projection. The parent prepares a listener before its offer;
-the child dials from that offer before creating its ICE agent. RTP delivery,
-same-parent replacement after DERP closure, late old-receiver cleanup and
-invitation-driven final retirement pass under the race detector. The ordinary
-offer adopts a replacement ID; the parent's updated assignment retires its
-listener while the Viewer stops receiving. Listener metadata carries the node and discovery keys,
-a nonzero shared key and a bounded port; it carries no relay URLs or region IDs.
-The dialer constructs the upstream address from received fields and a trusted
-local relay configuration. Strict shape checks and the existing route diagnostic
-owner keep connection material out of its output; complete protocol/signaling
-race suites and the direct-media composition pass.
-Trusted relay configuration and room-event dispatch to Native control remain
-fixture inputs. Complete Browser/App authorization and transport selection remain
-open: the product Native-capable Viewer chooses its backend on the SDP offer.
-This check establishes packet reception and resource retirement, not decoded
-playback or field benefit.
-
-An isolated session-capability candidate addresses that timing boundary without
-a second exchange or room-wide key registry. Viewer authentication supplies its
-public Native receiver key; the existing preparing and committed assignments
-project it only to assigned parents. Public presence and unrelated participants
-receive none. The existing restart request can replace or clear the key only
-for the current physical connection; a retired request cannot change it.
-Invitation revocation removes it with the authenticated session. Browser-only
-and Native cases pass through real room WebSockets under the race detector.
-The explicitly configured experimental Native control generates its private key
-and supplies only the public half in the ordinary `ready` handshake. An
-unconfigured control advertises no experimental transport.
-There is no persisted device identity or additional query. A Node-driven real
-Browser `NativeClient` connects through loopback HTTP/WebSocket: independent
-sessions have different keys, ordinary commands retain them, and retirement
-clears the advertised identity without affecting its sibling. Diagnostic export
-and console output exclude those keys; loopback/control race suites and the App
-composition build pass. This does not cover Browser local-network permission.
-The isolated Browser overlay now preflights the existing Viewer connection
-promise before authentication only for App-launched pages. Missing App discovery
-retains Browser fallback. The existing signaling identity supplies the current
-key on authentication, restart and reconnect; control loss or disabled Native
-reception clears it without initiating another recovery operation. Owner checks
-cover stale cleanup, completion after unmount and disabling Native during
-discovery. They exercise extracted page logic and the real signaling serializer,
-not rendered UI or Browser permissions. The overlaid NativeViewerPeer and
-NativeClient forward the offer's listener to `receive-offer`; full frontend
-type checking passes. The actual command now creates the Tailcat flow lazily
-under its admitted Native receiver, using the control's key and locally trusted
-relay. Shared strict decoding rejects null or untrusted configuration fields;
-unavailable transport is an operation failure. Control retirement cancels a
-real pending dial. Same-parent overlap shares one client across two physical
-flows; final retirement releases it. Room/Native RTP and cancellation checks pass
-under the race detector. Receiver reuse additionally requires identical listener
-metadata. The changed-port control fails without that check; with a shared
-client retained by a sibling, replacement receives fresh RTP and leaves the
-sibling working. Ordinary Native reuse/control race suites still pass.
-Sender binding, rendered Browser acceptance and complete
-recovery remain open. These checks do not establish complete Browser integration.
-The key is availability metadata, not media-readiness authority.
-
-The independent-parent control on 2026-10-10 exposes an identity-scope limit.
-It receives RTP on both local direct paths, but two parent-bound Tailcat clients
-using the same control key produce two duplicate relay registrations; the
-same-parent control produces none. Upstream
+The composed room/Native experiment separates session availability from actual
+transport identity. Native control advertises only availability in its ordinary
+ready response; authentication and existing assignments project that fact only
+to assigned parents. Restart/reconnect can clear it through the same owners.
+No persistent device key or room-wide key registry is added. App-launched Viewer
+startup uses its existing discovery promise; missing App retains Browser fallback.
+Late discovery, unmount, control replacement and stale close remain fenced.
+
+The parent reserves its listener and sends its bounded metadata with the ordinary
+SDP offer. The actual receive command creates or reuses the parent-bound Tailcat
+client and emits its public key through a connection-scoped Native event before
+dialing. An experimental `native-peer` signal returns that key to the exact
+assigned listener; its grant precedes receiver ICE. Parent-side binding checks
+the complete listener identity, is immutable after binding, and ends with that
+physical flow. Preparing and committed routes use the existing authorizer;
+reverse, unrelated, cross-room and retired-connection messages are rejected.
+Listener metadata accepts no relay URL or region. Trusted relay configuration
+remains local, and diagnostics exclude connection keys.
+
+On 2026-10-10 the previous session-wide key produced duplicate DERP registrations
+when two distinct parent-bound clients overlapped. Upstream
 [DERP registration](https://github.com/tailscale/tailscale/blob/main/derp/derpserver/derpserver.go)
-selects an active connection among duplicates, so local direct delivery does not
-prove reliable discovery/recovery across parents. Revisit connection identity or
-supported shared-underlay ownership before adoption; do not weaken overlap or
-add a route-specific fallback to conceal this limit. The same test exposed a
-pending-listener close race: the dependency may clear its remote address before
-a final datagram write. Retaining the already-authorized address makes that
-write fail normally; the focused retirement and concurrent ICE checks pass.
-
-Last-receiver replacement exposes a separate recovery limit: recreating the
-client with the same key completes bootstrap but delivers no RTP within the
-unchanged five-second window. A tunnel-only generated-UDP control reproduces
-the failure without Piik or Pion. Keyless event counters isolate the first
-WireGuard response going to the old endpoint; the next normal handshake uses
-the new endpoint and delivers data after the original window. This is delayed
-recovery, not permanent loss. Allowing relay data or repeating endpoint
-advertisement alone does not meet the original bound.
-
-`tailcat-discovery-lifetime.patch` gives each new client engine a fresh discovery
-key while preserving its authorized node key. The authenticated meow updates an
-immutable peer snapshot, so existing Magicsock invalidation retires the cached
-path. Server discovery identity stays stable for published addresses. UDP-only
-and actual Native last-receiver replacement now pass without changing timeouts
-or resetting the parent's peer; sibling, revocation, listener and upstream
-admission checks pass under the race detector. This remains an isolated
-dependency candidate, not a supported API or a fix for duplicate relay identities.
+selects among duplicate connections; local direct RTP had hidden this conflict.
+The corrected adapter uses Tailcat's default fresh identity per client, sharing
+that client only across physical flows to the same parent address. Both the
+same-parent and independent-tunnel-parent controls now require zero duplicates
+and fresh RTP before and after old-flow retirement. These controls use one
+assigned room parent with two listener instances; they do not yet prove a full
+room-controller handoff between different participant parents.
+
+Fresh client identity also avoids the measured same-key recreation delay: the
+old first WireGuard response went to a cached endpoint and data arrived only on
+the next handshake. Last-receiver replacement now meets the original five-second
+media bound without resetting the parent, extending timeouts or patching client
+discovery lifetime. The superseded dependency patch is removed. Receiver reuse
+still requires identical listener metadata; a changed listener replaces the
+source/transport through its existing owner. Sibling and ordinary reuse checks
+retain their behavior.
+
+Control close cancels dialing and joins each pending construction before final
+client close: Tailcat's close-before-initialization is not terminal. Queued
+identity events lose authority with the flow. Native control, loopback and
+listener retirement checks cover cancellation and ordinary cleanup; the parent
+adapter also retains its already-authorized remote address so a late write fails
+normally when the dependency clears its endpoint.
+
+The overlaid Browser NativeViewerPeer forwards the listener and returns scoped
+identity events while receive-offer is pending. Wrong share/connection and
+post-disposal events are ignored; there is no extra preparation timer or pending
+identity registry. Node-driven discovery, serializer, schema and lifecycle checks
+are separate from rendered media acceptance. Complete sender binding, room-event
+dispatch, actual multi-participant handoff and rendered Browser recovery remain
+open. The fixture still supplies parent binding and translates revocation into
+Native stop/listener retirement. Availability, public keys and handshake replies
+are not decoded-frame readiness or evidence of additional field reachability.
 
 `room-browser.mjs` bundles the real Browser schemas and diagnostics with matching
 experimental fields. It accepts the Go fixture's twelve route/restart messages,
@@ -1108,7 +1075,7 @@ These checks establish startup-order and ownership constraints, not a product
 integration or a Piik field defect. The earlier candidate gate and unsupported
 dependency method are not accepted product mechanisms.
 The existing assigned-connection owner must resolve key exchange and admission
-before ICE starts. Accepting arbitrary keys, passing room credentials into Native
+before receiver ICE starts. Accepting arbitrary keys, passing room credentials into Native
 control or enlarging its timeout is not an equivalent solution.
 
 ## Native Mapping Cache And Retry Lifetimes
diff --git a/docs/todo.md b/docs/todo.md
index 17925307b..5238fe919 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -74,15 +74,12 @@ Implementation needs a concrete useful result within the product model.
   [matched comparisons](./research/nat-traversal.md#integration-cost-and-recovery-controls)
   have not established another reachable NAT class. Verify the measured local
   address-handoff benefit through the complete App, mixed Browser/Native topology
-  and physical networks before adoption. Resolve the measured independent-parent
-  identity collision: separate Tailcat clients with the same session key register
-  duplicate relay connections even while local direct media passes.
-  Obtain supported client discovery-lifetime behavior: the isolated repair meets
-  the original reconnect bounds without resetting the parent peer, but remains
-  another dependency patch rather than a product-ready integration.
+  and physical networks before adoption. Extend the isolated client-identity and
+  listener-binding checks to actual room handoffs between different participants;
+  the current two-listener fixture does not establish that complete lifecycle.
   Complete sender binding, room-event dispatch, rendered Browser acceptance and
   recovery at the existing assigned-connection owners. Key exchange/admission
-  must precede ICE; diagnostic replies are not media-readiness evidence, and inner
+  must precede receiver ICE; diagnostic replies are not media-readiness evidence, and inner
   checks may exhaust before the underlay recovers. Research owns the verified
   receive-command, key/lifecycle and local RTP evidence and their limits.
   Obtain supported [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary),

From 92f32389f9d70c80db8fa6a22c74555b47d7bace Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 13:28:24 +0800
Subject: [PATCH 121/262] docs(network): record native sender ownership checks

---
 docs/research/nat-traversal.md | 22 ++++++++++++++++++----
 docs/todo.md                   |  4 ++--
 2 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index f25493008..b3c683b04 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1053,14 +1053,28 @@ listener retirement checks cover cancellation and ordinary cleanup; the parent
 adapter also retains its already-authorized remote address so a late write fails
 normally when the dependency clears its endpoint.
 
+The isolated Native sender now prepares its listener through the existing
+Host/Viewer edge socket factory. Its offer returns metadata, and a strict
+connection-scoped control command binds the reply through that same edge.
+There is no additional control-level listener registry. The raw transport checks
+and Native overlay compile the same admission/socket adapters. Closing an edge
+revokes its listener; retiring the source releases its remaining children.
+`TestNativeSenderOwnsListener` carries a generated VP8 source through the actual
+Native receive/relay commands to two Native children. It checks fresh sibling
+RTP after one child retires, idempotent replies and rejection of another listener
+or a retired connection. Host/media-edge/Viewer/control race suites pass. This
+fixture still pumps events instead of running the Browser route owners; it is
+not physical Host capture or complete room-controller acceptance.
+
 The overlaid Browser NativeViewerPeer forwards the listener and returns scoped
 identity events while receive-offer is pending. Wrong share/connection and
 post-disposal events are ignored; there is no extra preparation timer or pending
 identity registry. Node-driven discovery, serializer, schema and lifecycle checks
-are separate from rendered media acceptance. Complete sender binding, room-event
-dispatch, actual multi-participant handoff and rendered Browser recovery remain
-open. The fixture still supplies parent binding and translates revocation into
-Native stop/listener retirement. Availability, public keys and handshake replies
+are separate from rendered media acceptance. Browser sender selection/binding,
+room-event dispatch, actual multi-participant handoff and rendered Browser
+recovery remain open. The composed room fixture still supplies parent binding
+and translates revocation into Native stop/listener retirement. Availability,
+public keys and handshake replies
 are not decoded-frame readiness or evidence of additional field reachability.
 
 `room-browser.mjs` bundles the real Browser schemas and diagnostics with matching
diff --git a/docs/todo.md b/docs/todo.md
index 5238fe919..09a22abee 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -77,11 +77,11 @@ Implementation needs a concrete useful result within the product model.
   and physical networks before adoption. Extend the isolated client-identity and
   listener-binding checks to actual room handoffs between different participants;
   the current two-listener fixture does not establish that complete lifecycle.
-  Complete sender binding, room-event dispatch, rendered Browser acceptance and
+  Complete Browser sender selection/binding, room-event dispatch, rendered acceptance and
   recovery at the existing assigned-connection owners. Key exchange/admission
   must precede receiver ICE; diagnostic replies are not media-readiness evidence, and inner
   checks may exhaust before the underlay recovers. Research owns the verified
-  receive-command, key/lifecycle and local RTP evidence and their limits.
+  sender/receiver command, key/lifecycle and local RTP evidence and their limits.
   Obtain supported [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary),
   direct-media, endpoint-discovery and RTCP/MTU contracts plus a trusted relay
   configuration. Experimental dependency patches are not product APIs.

From a5efc2c7328d4eb29a1abfdbb62e15275efa57ad Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 14:02:21 +0800
Subject: [PATCH 122/262] docs(network): record rendered mixed-route acceptance

---
 docs/research/nat-traversal.md | 32 +++++++++++++++++++++++++-------
 docs/todo.md                   |  5 ++++-
 2 files changed, 29 insertions(+), 8 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index b3c683b04..7dabf6fa5 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1069,13 +1069,31 @@ not physical Host capture or complete room-controller acceptance.
 The overlaid Browser NativeViewerPeer forwards the listener and returns scoped
 identity events while receive-offer is pending. Wrong share/connection and
 post-disposal events are ignored; there is no extra preparation timer or pending
-identity registry. Node-driven discovery, serializer, schema and lifecycle checks
-are separate from rendered media acceptance. Browser sender selection/binding,
-room-event dispatch, actual multi-participant handoff and rendered Browser
-recovery remain open. The composed room fixture still supplies parent binding
-and translates revocation into Native stop/listener retirement. Availability,
-public keys and handshake replies
-are not decoded-frame readiness or evidence of additional field reachability.
+identity registry. The sender reads capability from the current preparation,
+assignment or recovery message, without a second capability cache. Existing
+Browser owners dispatch the reply to the listener's Native edge. Focused tests
+cover stale replies, deep-copied assignment capability and recovery after a
+capability change.
+
+An owned Linux/Chromium 152 run exercises the actual UI and room controller with
+a generated 640×360 VP8 canvas source and one outbound copy per participant:
+Browser Host → Native Viewer → Native Viewer → Browser Viewer. The inner Native
+pair uses Tailcat; the outer Browser links retain ordinary WebRTC. Reconnecting
+the second Native Viewer replaces its listener/client without accumulating
+resources. After the first Native Viewer leaves, the next Viewer changes to the
+Browser Host and both remaining Viewers resume decoded, changing pixels. Removing
+the second Native Viewer then restores an ordinary Browser-to-Browser route.
+All transport counters are zero at retirement. This is bounded local rendered
+acceptance, not physical capture, difficult-NAT reachability, sustained recovery
+or a handoff between two different Native parents.
+
+Composition also exposed duplicate address discovery: the shared candidate
+collector still sent ordinary STUN probes through the injected virtual socket.
+The experimental socket boundary now leaves outer discovery to Tailcat. A local
+STUN control fails before this correction and passes after it; ordinary Native
+gathering still produces its observed candidate. There is no timeout extension
+or additional retry owner. Availability, public keys and handshake replies
+remain distinct from decoded-frame readiness and additional field reachability.
 
 `room-browser.mjs` bundles the real Browser schemas and diagnostics with matching
 experimental fields. It accepts the Go fixture's twelve route/restart messages,
diff --git a/docs/todo.md b/docs/todo.md
index 09a22abee..cab427fd8 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -90,7 +90,10 @@ Implementation needs a concrete useful result within the product model.
   another media fallback or bypass site/share policy. No new setting, timeout
   change or transport integration is accepted; the P2P evidence work below owns
   network/interop acceptance.
-  No product wire extension or complete Browser integration is implemented.
+  Rendered local Browser/Native chains now cover reconnect and upstream departure;
+  the assessment owns the limits. Different Native-parent handoffs, sustained and
+  difficult-network recovery remain open. No product transport integration is
+  accepted; all experimental wire changes remain isolated.
 - [ ] **Small external test before 2.0.** First use the isolated transport
   experiment on the same difficult network pairs as current Piik, measuring
   direct success separately from relay delivery, first-picture time, recovery

From 0c6e41cfee92b06467507bdc43a626c6274df907 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 14:19:28 +0800
Subject: [PATCH 123/262] docs(network): reconcile native handoff acceptance

---
 docs/research/nat-traversal.md | 18 +++++++++++++++---
 docs/todo.md                   | 20 ++++++++------------
 2 files changed, 23 insertions(+), 15 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 7dabf6fa5..b5456cc48 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1083,9 +1083,21 @@ the second Native Viewer replaces its listener/client without accumulating
 resources. After the first Native Viewer leaves, the next Viewer changes to the
 Browser Host and both remaining Viewers resume decoded, changing pixels. Removing
 the second Native Viewer then restores an ordinary Browser-to-Browser route.
-All transport counters are zero at retirement. This is bounded local rendered
-acceptance, not physical capture, difficult-NAT reachability, sustained recovery
-or a handoff between two different Native parents.
+All transport counters are zero at retirement. A second rendered run uses H264
+and three Native Viewers across two App instances. When the middle Native Viewer
+leaves, the last Viewer changes to the first Native Viewer, receives a new scoped
+connection and resumes decoded, changing pixels; the departed participant retains
+no transport resources. The normal App control-session and origin limits remain.
+This is bounded local rendered acceptance, not physical capture, difficult-NAT
+reachability, sustained recovery or a healthy overlapping-parent handoff.
+
+Cold receiver preparation initially took about three seconds in this fixture.
+The local DERP region had no STUN service: two preauthorized registration controls
+took about four seconds without STUN and 15–16 ms with it. Reusing Piik's STUN
+server in the UI fixture reduced cold receive-offer responses to 21–25 ms. Keep
+unavailable-STUN controls separate from healthy startup measurements. This finding
+changes the test environment, not product timeouts or retry behavior; it does not
+predict public-network latency.
 
 Composition also exposed duplicate address discovery: the shared candidate
 collector still sent ordinary STUN probes through the injected virtual socket.
diff --git a/docs/todo.md b/docs/todo.md
index cab427fd8..bb4919cd4 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -73,12 +73,11 @@ Implementation needs a concrete useful result within the product model.
 - [ ] **Native Magicsock.** Go reuse is feasible, but the
   [matched comparisons](./research/nat-traversal.md#integration-cost-and-recovery-controls)
   have not established another reachable NAT class. Verify the measured local
-  address-handoff benefit through the complete App, mixed Browser/Native topology
-  and physical networks before adoption. Extend the isolated client-identity and
-  listener-binding checks to actual room handoffs between different participants;
-  the current two-listener fixture does not establish that complete lifecycle.
-  Complete Browser sender selection/binding, room-event dispatch, rendered acceptance and
-  recovery at the existing assigned-connection owners. Key exchange/admission
+  address-handoff benefit through the complete App and physical networks before
+  adoption. Bounded rendered Browser/Native chains cover reconnect and departure
+  with a different Native parent; healthy overlapping-parent handoffs, sustained
+  and difficult-network recovery remain open. Preserve the existing Browser
+  sender, room-event and assigned-connection owners. Key exchange/admission
   must precede receiver ICE; diagnostic replies are not media-readiness evidence, and inner
   checks may exhaust before the underlay recovers. Research owns the verified
   sender/receiver command, key/lifecycle and local RTP evidence and their limits.
@@ -88,12 +87,9 @@ Implementation needs a concrete useful result within the product model.
   Preserve the local address policy (forcing loopback fails Firefox), existing
   recovery deadlines and single route/resource owners. DERP must not become
   another media fallback or bypass site/share policy. No new setting, timeout
-  change or transport integration is accepted; the P2P evidence work below owns
-  network/interop acceptance.
-  Rendered local Browser/Native chains now cover reconnect and upstream departure;
-  the assessment owns the limits. Different Native-parent handoffs, sustained and
-  difficult-network recovery remain open. No product transport integration is
-  accepted; all experimental wire changes remain isolated.
+  change or product transport integration is accepted; all experimental wire
+  changes remain isolated. The P2P evidence work below owns network/interop
+  acceptance.
 - [ ] **Small external test before 2.0.** First use the isolated transport
   experiment on the same difficult network pairs as current Piik, measuring
   direct success separately from relay delivery, first-picture time, recovery

From d5c812a8d266bc43f2821830cc393479ba5cd03b Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 14:30:47 +0800
Subject: [PATCH 124/262] docs(network): record invitation retirement
 acceptance

---
 docs/research/nat-traversal.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index b5456cc48..c811c3691 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1088,6 +1088,10 @@ and three Native Viewers across two App instances. When the middle Native Viewer
 leaves, the last Viewer changes to the first Native Viewer, receives a new scoped
 connection and resumes decoded, changing pixels; the departed participant retains
 no transport resources. The normal App control-session and origin limits remain.
+In the mixed Browser/Native chain, revoking a private room's invitation removes
+all Viewers and Native transport resources while the Host continues sharing.
+The old invitation remains rejected after rotation; a fresh invitation restores
+the chain and decoded media without retaining the retired transports.
 This is bounded local rendered acceptance, not physical capture, difficult-NAT
 reachability, sustained recovery or a healthy overlapping-parent handoff.
 

From d55de819dd84dcc7cfcf18375ef7752c5509f7df Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 14:44:24 +0800
Subject: [PATCH 125/262] docs(network): record overlapping parent acceptance

---
 docs/research/nat-traversal.md | 10 +++++++++-
 docs/todo.md                   |  6 +++---
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index c811c3691..540c318c8 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1092,8 +1092,16 @@ In the mixed Browser/Native chain, revoking a private room's invitation removes
 all Viewers and Native transport resources while the Host continues sharing.
 The old invitation remains rejected after rotation; a fresh invitation restores
 the chain and decoded media without retaining the retired transports.
+With copy capacity two, four Native Viewers exercise the overlapping path:
+the Browser Host feeds Native A/B, and A initially feeds C/D. Controlled
+relay-capacity messages move D from A to B and back through the real controller.
+Holding D's first-frame acknowledgement leaves two Native client/flow pairs
+alive while its old displayed picture advances; releasing it commits the new
+parent and retires only the old pair. C keeps its connection and continues
+decoding. Final resource and race checks pass. This exercises transport ownership
+under a capacity change, not the quality-degradation trigger or its thresholds.
 This is bounded local rendered acceptance, not physical capture, difficult-NAT
-reachability, sustained recovery or a healthy overlapping-parent handoff.
+reachability or sustained recovery.
 
 Cold receiver preparation initially took about three seconds in this fixture.
 The local DERP region had no STUN service: two preauthorized registration controls
diff --git a/docs/todo.md b/docs/todo.md
index bb4919cd4..3b393f431 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -74,9 +74,9 @@ Implementation needs a concrete useful result within the product model.
   [matched comparisons](./research/nat-traversal.md#integration-cost-and-recovery-controls)
   have not established another reachable NAT class. Verify the measured local
   address-handoff benefit through the complete App and physical networks before
-  adoption. Bounded rendered Browser/Native chains cover reconnect and departure
-  with a different Native parent; healthy overlapping-parent handoffs, sustained
-  and difficult-network recovery remain open. Preserve the existing Browser
+  adoption. Bounded rendered Browser/Native chains cover reconnect, departure and
+  overlapping Native-parent changes. Sustained and difficult-network recovery
+  remain open. Preserve the existing Browser
   sender, room-event and assigned-connection owners. Key exchange/admission
   must precede receiver ICE; diagnostic replies are not media-readiness evidence, and inner
   checks may exhaust before the underlay recovers. Research owns the verified

From fc54af8aec5f9d7d8de8cd600b4445dc4cdfd598 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 15:06:08 +0800
Subject: [PATCH 126/262] fix(media): retain source discovery during
 subscription

---
 docs/research/node-local-media-design.md |  9 ++++
 docs/todo.md                             |  4 --
 internal/app/mediaedge/quality_test.go   |  7 ++-
 internal/media/forwarding/source.go      | 13 +++++
 internal/media/forwarding/source_test.go | 62 ++++++++++++++++++++++++
 5 files changed, 89 insertions(+), 6 deletions(-)

diff --git a/docs/research/node-local-media-design.md b/docs/research/node-local-media-design.md
index 18589d465..2f8db494f 100644
--- a/docs/research/node-local-media-design.md
+++ b/docs/research/node-local-media-design.md
@@ -212,6 +212,15 @@ The replaced local Group/
 Selection and receiving-PC sender-estimator registry are deleted, not retained
 as alternate implementations. There is no mirrored counter summing unused layers.
 
+Source subscription must retain layer discovery that happens during registration.
+LiveKit's `ReceiverBase.AddDownTrack` delivers initial layer metadata before
+registering the subscriber, leaving a notification gap. The shared Source
+refreshes that metadata after successful registration; DownTrack keeps its
+highest observed layers, so a concurrent newer notification cannot be undone.
+This boundary serves both Native outputs and SFU publication. A controlled
+discovery in that gap reproduces the failure without retries or network loss;
+it does not establish the cause of unmatched field reports.
+
 The parent reads child state at actual capture InputBegin. A controlled layer
 switch uses the existing DownTrack resync before outputs for that input, retaining
 its target; this prevents an old-layer packet winning the same presentation time.
diff --git a/docs/todo.md b/docs/todo.md
index 3b393f431..87e7b69ac 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -16,10 +16,6 @@ Git/PRs own completed history.
   Prepare one coherent candidate and stop before publication. Preserve the existing
   product model; evaluate held features against measurable benefit and total complexity
   before accepting a changed contract.
-  Isolate the intermittent Linux race-suite no-output result in
-  `TestQualityDimensionsFollowAssignedSource`; focused repetitions and the next
-  full package run pass. No product cause is established; preserve its assertion
-  and timeout while collecting a matched failure.
 - [ ] **Independent Gitee mirror recovery.** Implementation and local acceptance
   are complete. Integrate through the next owner-approved publishing merge and
   verify the separate workflow with its original CI artifacts. Mirror failure
diff --git a/internal/app/mediaedge/quality_test.go b/internal/app/mediaedge/quality_test.go
index 7e225ade1..3a62e7e71 100644
--- a/internal/app/mediaedge/quality_test.go
+++ b/internal/app/mediaedge/quality_test.go
@@ -53,8 +53,11 @@ func TestQualityDimensionsFollowAssignedSource(t *testing.T) {
 		}
 		time.Sleep(time.Second / 30)
 	}
-	_, _, format := edge.videoCounters()
-	t.Fatalf("quality dimensions still refer to original source: %dx%d", uint32(format>>32), uint32(format))
+	frames, _, format := edge.videoCounters()
+	available, rates := assigned.GetLayeredBitrate()
+	t.Fatalf("assigned quality: %dx%d, frames=%d, source=%t, state=%+v, layers=%v, rates=%v",
+		uint32(format>>32), uint32(format), frames, edge.transport.CurrentSource() == assigned.Source,
+		edge.transport.Output.State(), available, rates)
 }
 
 func TestQualitySampleUsesEstimatorCapacityAgainstEncodedPayload(t *testing.T) {
diff --git a/internal/media/forwarding/source.go b/internal/media/forwarding/source.go
index c4037299a..a1b553be5 100644
--- a/internal/media/forwarding/source.go
+++ b/internal/media/forwarding/source.go
@@ -96,6 +96,19 @@ func (source *Source) TrackInfo() *livekit.TrackInfo {
 	return utils.CloneProto(source.currentTrackInfo.Load())
 }
 
+// ReceiverBase reads initial metadata before registering the subscriber. A
+// concurrent discovery notification can fall into that gap. Refresh after
+// registration; DownTrack's seen-layer setters retain the highest observation.
+func (source *Source) AddDownTrack(track sfu.TrackSender) error {
+	if err := source.ReceiverBase.AddDownTrack(track); err != nil {
+		return err
+	}
+	tracker := source.StreamTrackerManager()
+	track.UpTrackMaxPublishedLayerChange(tracker.GetMaxPublishedLayer())
+	track.UpTrackMaxTemporalLayerSeenChange(tracker.GetMaxTemporalLayerSeen())
+	return nil
+}
+
 func canonicalHeaderExtensions(extensions []webrtc.RTPHeaderExtensionParameter) []webrtc.RTPHeaderExtensionParameter {
 	result := slices.Clone(extensions)
 	slices.SortFunc(result, func(left, right webrtc.RTPHeaderExtensionParameter) int {
diff --git a/internal/media/forwarding/source_test.go b/internal/media/forwarding/source_test.go
index e7a24002f..a3123ddcd 100644
--- a/internal/media/forwarding/source_test.go
+++ b/internal/media/forwarding/source_test.go
@@ -2,6 +2,7 @@ package forwarding
 
 import (
 	"errors"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -14,6 +15,67 @@ import (
 	"github.com/pion/webrtc/v4"
 )
 
+type subscribingSourceTrack struct {
+	*Output
+	publish func()
+	spatial atomic.Int32
+}
+
+func (track *subscribingSourceTrack) UpTrackMaxPublishedLayerChange(layer int32) {
+	if layer < 0 {
+		track.publish()
+	}
+	track.Output.UpTrackMaxPublishedLayerChange(layer)
+	track.spatial.Store(layer)
+}
+
+type observedSourceLayers struct {
+	sfu.StreamTrackerManagerListener
+	published chan struct{}
+}
+
+func (observer *observedSourceLayers) OnMaxPublishedLayerChanged(layer int32) {
+	observer.StreamTrackerManagerListener.OnMaxPublishedLayerChanged(layer)
+	observer.published <- struct{}{}
+}
+
+func TestSourceSubscriptionRetainsConcurrentLayerDiscovery(t *testing.T) {
+	source, err := NewSource(SourceOptions{ID: "screen", StreamID: "subscription",
+		Codec: webrtc.RTPCodecParameters{RTPCodecCapability: webrtc.RTPCodecCapability{
+			MimeType: webrtc.MimeTypeVP8, ClockRate: 90_000,
+		}, PayloadType: 96},
+		Formats: []LayerFormat{{Width: 8, Height: 8, Bitrate: 300_000}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(source.Close)
+	transport, err := NewTransport(TransportOptions{Source: source, ConnectionID: "joining", InitialBitrate: 1_000_000})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = transport.Close() })
+	observed := &observedSourceLayers{StreamTrackerManagerListener: source.ReceiverBase, published: make(chan struct{}, 1)}
+	source.StreamTrackerManager().SetListener(observed)
+	track := &subscribingSourceTrack{Output: transport.Output}
+	track.publish = func() {
+		// Discover a layer after reading the initial snapshot but before the
+		// subscriber is registered. Complete its real notification in that gap.
+		source.StreamTrackerManager().AddTracker(0)
+		select {
+		case <-observed.published:
+		case <-time.After(time.Second):
+			t.Fatal("source did not publish its discovered layer")
+		}
+	}
+	if err = source.AddDownTrack(track); err != nil {
+		t.Fatal(err)
+	}
+	if track.spatial.Load() != source.StreamTrackerManager().GetMaxPublishedLayer() {
+		t.Fatalf("subscriber retained the pre-discovery snapshot: %d", track.spatial.Load())
+	}
+}
+
 func TestSourceLayerBindingFeedbackAndClose(t *testing.T) {
 	codec := webrtc.RTPCodecParameters{RTPCodecCapability: webrtc.RTPCodecCapability{
 		MimeType: webrtc.MimeTypeVP8, ClockRate: 90_000,

From 011437f76ecd2e41aa5edaf2f471bea6bdd6b391 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 15:15:20 +0800
Subject: [PATCH 127/262] docs(media): record bounded receiver acceptance

---
 docs/research/browser-screen-audio-quality.md | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/docs/research/browser-screen-audio-quality.md b/docs/research/browser-screen-audio-quality.md
index 0591bdea5..23cefb767 100644
--- a/docs/research/browser-screen-audio-quality.md
+++ b/docs/research/browser-screen-audio-quality.md
@@ -103,12 +103,17 @@ live 320/96 kbps changes retained the same subscription, with advancing decoded
 audio energy and video frames. Video profile changes, reload, recovery and
 retirement also passed; the Browser run measured stereo separation. An ordinary
 Browser relay forwarded received tracks to two children at 320 kbps, with
-advancing decoded audio and successful cleanup. A direct Browser control now
-keeps requested 256/320 kbps below an explicit 192 kbps receive limit, while a
-510 kbps receiver permits both rates. Native and SFU adapter controls reject
-an insufficient 192 kbps answer before binding it; retiring or correcting that
-preparation leaves the original source and healthy sibling delivering media.
-These controls do not establish the complete room-route response to rejection.
+advancing decoded audio and successful cleanup. Direct Browser controls keep
+requested 256/320 kbps below an explicit 192 kbps receive limit, while a
+510 kbps receiver permits both rates. The full Browser room also retains both
+receiving tracks and advancing decoded audio/video through 320/96/320 kbps edits;
+only the limited child's sender is capped at 192 kbps.
+Native and SFU adapter controls reject an insufficient answer before binding it.
+In a full-UI SFU-only room, that rejection exhausts only the limited Viewer's
+route and retires its connection. The Host, healthy sibling and subsequent
+capable Viewer continue; the service Debug event retains the receive-limit
+cause. Stop retires the remaining media. These are controlled SDP-limit checks,
+not physical low-capability decoder measurements.
 A native real-Opus control through
 6 Mbps -> 500 kbps -> 6 Mbps shaping retains decoded audio during live
 320/96/320 kbps changes, with sustained high video after the shared

From bc7762e6daf6e62a8f9c6a57eb83029441d8fcc5 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 15:37:25 +0800
Subject: [PATCH 128/262] docs(network): clarify optional transport adoption
 boundary

---
 docs/research/nat-traversal.md | 20 ++++++++++++++++++++
 docs/todo.md                   |  2 ++
 2 files changed, 22 insertions(+)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 540c318c8..b37bd5583 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1119,6 +1119,26 @@ gathering still produces its observed candidate. There is no timeout extension
 or additional retry owner. Availability, public keys and handshake replies
 remain distinct from decoded-frame readiness and additional field reachability.
 
+A separate optional-path check uses Pion's public
+[`NewMultiUDPMuxDefault`](https://github.com/pion/ice/blob/v4.4.0/udp_mux_multi.go)
+to advertise ordinary UDP and one prepared Tailcat flow on the same
+PeerConnection. Fresh audio/video passes with either path unavailable, and
+normal ICE restart selects the remaining path in both directions. Making the
+unused tunnel available or closing it preserves the ordinary session and its
+ICE credentials. Windows and Linux race checks pass without an application
+path selector or changed ICE budgets. These local tests permit DERP and prepare
+the tunnel before ICE; they establish composition, not direct-media policy,
+NAT gain or cold-bootstrap independence.
+
+The current Native overlay still replaces its ordinary socket with the tunnel.
+`DialUDPPort` waits for remote admission, while Pion's stock multi-mux requires
+the sockets' addresses at construction. Simply combining them synchronously
+would let unavailable bootstrap delay otherwise usable ordinary ICE. A supported
+way to prepare an optional socket independently remains an adoption requirement;
+the earlier private `PrepareUDPPort` patch is not a supported upstream API.
+Do not replace this gap with two racing PeerConnections, a second recovery
+controller or a larger product timeout.
+
 `room-browser.mjs` bundles the real Browser schemas and diagnostics with matching
 experimental fields. It accepts the Go fixture's twelve route/restart messages,
 rejects malformed capability/listener fields and removes scoped keys from both
diff --git a/docs/todo.md b/docs/todo.md
index 87e7b69ac..b12211f03 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -80,6 +80,8 @@ Implementation needs a concrete useful result within the product model.
   Obtain supported [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary),
   direct-media, endpoint-discovery and RTCP/MTU contracts plus a trusted relay
   configuration. Experimental dependency patches are not product APIs.
+  Preserve ordinary ICE when optional bootstrap is unavailable; the current
+  tunnel-only Native overlay does not yet satisfy that integration boundary.
   Preserve the local address policy (forcing loopback fails Firefox), existing
   recovery deadlines and single route/resource owners. DERP must not become
   another media fallback or bypass site/share policy. No new setting, timeout

From 41d34fd8c6f8b5a0e6cf86705af03b9d19c83a70 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 16:27:47 +0800
Subject: [PATCH 129/262] docs(network): record optional native composition and
 remaining gates

---
 docs/research/nat-traversal.md | 43 ++++++++++++++++++++++++++++++----
 docs/todo.md                   | 10 ++++----
 2 files changed, 45 insertions(+), 8 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index b37bd5583..ba5c994b9 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1130,7 +1130,7 @@ path selector or changed ICE budgets. These local tests permit DERP and prepare
 the tunnel before ICE; they establish composition, not direct-media policy,
 NAT gain or cold-bootstrap independence.
 
-The current Native overlay still replaces its ordinary socket with the tunnel.
+The default Native overlay replaces its ordinary socket with the tunnel.
 `DialUDPPort` waits for remote admission, while Pion's stock multi-mux requires
 the sockets' addresses at construction. Simply combining them synchronously
 would let unavailable bootstrap delay otherwise usable ordinary ICE. A supported
@@ -1139,6 +1139,40 @@ the earlier private `PrepareUDPPort` patch is not a supported upstream API.
 Do not replace this gap with two racing PeerConnections, a second recovery
 controller or a larger product timeout.
 
+An isolated Linux race control combines that reservation patch with the same
+multi-mux: ordinary SRTP starts while remote admission is denied or bootstrap is
+unavailable, and continues through a delayed grant. For a tunnel-only pair,
+publishing its candidate only after admission establishes fresh audio/video in
+the same ICE generation. Ordinary candidates are available immediately;
+end-of-candidates follows the optional producer. Publishing the tunnel candidate
+early instead leaves both peers connecting with no media in the matched control.
+The candidate ordering uses [Trickle ICE](https://www.rfc-editor.org/rfc/rfc8838.html),
+without another PeerConnection, timeout extension or application retry loop.
+After ordinary ICE has nominated a pair, a late optional candidate is omitted;
+it may participate in a subsequent gathering. This raw fixture permits DERP and
+edits its own SDP; it does not establish direct-media policy or greater NAT coverage.
+
+The separate optional Native overlay now preserves the ordinary socket's STUN
+and mapping owner and adds its virtual socket to that same Pion connection.
+The receiver's existing candidate collector owns delayed advertisement, EOC and
+cancellation; its SDP answer cannot bypass that collector. The existing flow
+owner joins admission work on close. Native controls establish ordinary media
+before the tunnel grant and with bootstrap unavailable. A tunnel-only control
+establishes media after delayed admission, then preserves a sibling and a new
+receiver through old cleanup. Candidate events continue during the delay:
+bypassing the readiness gate leaves the sender checking with no media. Linux
+race checks pass. These are bounded Native control/media checks, not complete
+rendered App recovery, direct-only policy or physical-network acceptance.
+
+This composition also exposes an upstream address-lookup mismatch: Pion's
+multi-mux enumerates current child addresses but `GetConn` only consults its
+construction-time table. A newly enumerated address therefore has no mux. The
+isolated correction resolves uncached addresses against those same child muxes,
+without another address cache or socket owner; the unchanged control fails.
+This preserves the ordinary socket's fresh-address contract in the experiment.
+The copied dependency correction and socket-reservation method remain adoption
+requirements, not supported APIs or changes to the published Piik dependency.
+
 `room-browser.mjs` bundles the real Browser schemas and diagnostics with matching
 experimental fields. It accepts the Go fixture's twelve route/restart messages,
 rejects malformed capability/listener fields and removes scoped keys from both
@@ -1150,9 +1184,10 @@ The product wire and diagnostic implementation remain unchanged.
 These checks establish startup-order and ownership constraints, not a product
 integration or a Piik field defect. The earlier candidate gate and unsupported
 dependency method are not accepted product mechanisms.
-The existing assigned-connection owner must resolve key exchange and admission
-before receiver ICE starts. Accepting arbitrary keys, passing room credentials into Native
-control or enlarging its timeout is not an equivalent solution.
+The existing assigned-connection and candidate owners must order admission and
+advertisement so the usable tunnel receives live ICE checks; ordinary ICE need
+not wait for that optional producer. Accepting arbitrary keys, passing room credentials
+into Native control or enlarging its timeout is not an equivalent solution.
 
 ## Native Mapping Cache And Retry Lifetimes
 
diff --git a/docs/todo.md b/docs/todo.md
index b12211f03..efe63f8e9 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -73,15 +73,17 @@ Implementation needs a concrete useful result within the product model.
   adoption. Bounded rendered Browser/Native chains cover reconnect, departure and
   overlapping Native-parent changes. Sustained and difficult-network recovery
   remain open. Preserve the existing Browser
-  sender, room-event and assigned-connection owners. Key exchange/admission
-  must precede receiver ICE; diagnostic replies are not media-readiness evidence, and inner
+  sender, room-event and assigned-connection owners. Order admission and candidate
+  delivery without exhausting inner checks; diagnostic replies are not media-readiness evidence, and inner
   checks may exhaust before the underlay recovers. Research owns the verified
   sender/receiver command, key/lifecycle and local RTP evidence and their limits.
   Obtain supported [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary),
   direct-media, endpoint-discovery and RTCP/MTU contracts plus a trusted relay
   configuration. Experimental dependency patches are not product APIs.
-  Preserve ordinary ICE when optional bootstrap is unavailable; the current
-  tunnel-only Native overlay does not yet satisfy that integration boundary.
+  Complete optional-path App and mixed-route acceptance while preserving ordinary
+  ICE when bootstrap is unavailable. The bounded Native composition still needs
+  a private socket-reservation API and a multi-mux address-lookup correction;
+  verify physical interface changes and direct-only policy before adoption.
   Preserve the local address policy (forcing loopback fails Firefox), existing
   recovery deadlines and single route/resource owners. DERP must not become
   another media fallback or bypass site/share policy. No new setting, timeout

From 96f06f9d9be9cd18428ddc24a52df383ca9c8b63 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 16:50:46 +0800
Subject: [PATCH 130/262] docs(network): reconcile optional recovery evidence

---
 docs/research/nat-traversal.md | 21 ++++++++++++++++++---
 docs/todo.md                   |  5 +++--
 2 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index ba5c994b9..147102b9e 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1161,15 +1161,30 @@ before the tunnel grant and with bootstrap unavailable. A tunnel-only control
 establishes media after delayed admission, then preserves a sibling and a new
 receiver through old cleanup. Candidate events continue during the delay:
 bypassing the readiness gate leaves the sender checking with no media. Linux
-race checks pass. These are bounded Native control/media checks, not complete
-rendered App recovery, direct-only policy or physical-network acceptance.
+race checks pass.
+
+A bounded Chromium 152 UI check also runs the optional composition through a
+Browser Host, two Native relays and a Browser Viewer. Changing decoded pixels
+advance at every hop, after the second relay's manual reconnect, and after each
+Native relay departs. Departure recovery respects the existing signaling grace;
+retired Native transport counts reach zero. Host stop projects waiting for a
+share, and the race-enabled fixture closes cleanly. This uses a synthetic source
+on one local network; ordinary ICE may win. It establishes coexistence and these
+recovery paths, not a tunnel-success rate, physical capture or complete App
+acceptance. Optional-path invitation revocation and overlapping-parent checks
+remain separate from the earlier tunnel-only UI evidence.
 
 This composition also exposes an upstream address-lookup mismatch: Pion's
 multi-mux enumerates current child addresses but `GetConn` only consults its
 construction-time table. A newly enumerated address therefore has no mux. The
 isolated correction resolves uncached addresses against those same child muxes,
 without another address cache or socket owner; the unchanged control fails.
-This preserves the ordinary socket's fresh-address contract in the experiment.
+A private Linux network namespace also replaces the real interface address
+while retaining the sockets and PeerConnections. ICE restart gathers only the
+new address and restores fresh phase-tagged audio/video. Removing only the
+multi-mux correction loses that candidate in the matched control. The race
+check preserves ordinary discovery; it does not exercise physical Wi-Fi handoff
+or prove the optional tunnel's recovery benefit.
 The copied dependency correction and socket-reservation method remain adoption
 requirements, not supported APIs or changes to the published Piik dependency.
 
diff --git a/docs/todo.md b/docs/todo.md
index efe63f8e9..31d8d1523 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -80,8 +80,9 @@ Implementation needs a concrete useful result within the product model.
   Obtain supported [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary),
   direct-media, endpoint-discovery and RTCP/MTU contracts plus a trusted relay
   configuration. Experimental dependency patches are not product APIs.
-  Complete optional-path App and mixed-route acceptance while preserving ordinary
-  ICE when bootstrap is unavailable. The bounded Native composition still needs
+  Extend optional-path acceptance to invitation revocation and overlapping-parent
+  transitions; bounded rendered chain/reconnect/departure checks pass. Preserve
+  ordinary ICE when bootstrap is unavailable. The Native composition still needs
   a private socket-reservation API and a multi-mux address-lookup correction;
   verify physical interface changes and direct-only policy before adoption.
   Preserve the local address policy (forcing loopback fails Firefox), existing

From ed7118a8bbad212ba82382a1d1397290c05837e2 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 17:12:35 +0800
Subject: [PATCH 131/262] fix(viewer): release native control when room access
 ends

---
 docs/research/nat-traversal.md               | 12 ++--
 docs/research/native-client-lifecycle.md     | 13 ++++
 docs/standards/presentation-lifecycle.md     |  3 +-
 docs/todo.md                                 |  4 +-
 src/client/pages/ViewerPage.tsx              | 74 +++++++-------------
 tests/viewer-native-client-ownership.test.ts | 56 +++++++++++++--
 tests/viewer-route-health.test.ts            |  2 +-
 7 files changed, 100 insertions(+), 64 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 147102b9e..c358e1397 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1171,8 +1171,12 @@ retired Native transport counts reach zero. Host stop projects waiting for a
 share, and the race-enabled fixture closes cleanly. This uses a synthetic source
 on one local network; ordinary ICE may win. It establishes coexistence and these
 recovery paths, not a tunnel-success rate, physical capture or complete App
-acceptance. Optional-path invitation revocation and overlapping-parent checks
-remain separate from the earlier tunnel-only UI evidence.
+acceptance. Optional invitation revocation also rejects old links, clears media
+resources and permits new Native reception across four grant generations. This
+check exposed and now covers the shared Viewer's
+[control-retirement gap](./native-client-lifecycle.md#viewer-control-retirement).
+Optional overlapping-parent checks remain separate from the earlier tunnel-only
+UI evidence.
 
 This composition also exposes an upstream address-lookup mismatch: Pion's
 multi-mux enumerates current child addresses but `GetConn` only consults its
@@ -1196,8 +1200,8 @@ evidence. The Go and Browser optional-map null checks agree. This is a Node-run
 producer/consumer check, not Browser UI or complete App transport acceptance.
 The product wire and diagnostic implementation remain unchanged.
 
-These checks establish startup-order and ownership constraints, not a product
-integration or a Piik field defect. The earlier candidate gate and unsupported
+These transport checks establish startup-order and ownership constraints, not a
+product integration or the cause of unmatched field reports. The earlier candidate gate and unsupported
 dependency method are not accepted product mechanisms.
 The existing assigned-connection and candidate owners must order admission and
 advertisement so the usable tunnel receives live ICE checks; ordinary ICE need
diff --git a/docs/research/native-client-lifecycle.md b/docs/research/native-client-lifecycle.md
index b6e2e30a5..31da5b30b 100644
--- a/docs/research/native-client-lifecycle.md
+++ b/docs/research/native-client-lifecycle.md
@@ -37,6 +37,19 @@ waiting; later grants can be used by later connections without replacing healthy
 Browser media. These checks do not identify the original missing-window
 reporter's cause or establish other browsers' permission behavior.
 
+### Viewer Control Retirement
+
+A denied Viewer page can stay mounted or enter the Browser's
+[back/forward cache](https://web.dev/articles/bfcache). Chromium 152 retained its
+App control socket after invitation revocation; repeated entry eventually
+exhausted the App's two control slots and used Browser reception instead.
+The Viewer room owner now releases control on access loss and rejects discovery
+that completes after retirement. A rendered optional-transport fixture retained
+the denied pages across four invitation generations: each new generation used
+Native reception with changing decoded pixels, old grants remained rejected,
+and revocation cleared media resources. This is local synthetic-media evidence;
+it does not establish physical network or all Browser navigation behavior.
+
 ## Scope Decisions
 
 - Keep one strict loopback wire and one-share/one-session fence.
diff --git a/docs/standards/presentation-lifecycle.md b/docs/standards/presentation-lifecycle.md
index c511e28ab..ab386115d 100644
--- a/docs/standards/presentation-lifecycle.md
+++ b/docs/standards/presentation-lifecycle.md
@@ -28,7 +28,8 @@ A capable, opted-in authenticated room session
 outlives its current publication. Stopping capture retires media, not chat;
 restoring an existing room joins it without starting capture. Entering the page
 alone does not create a room. Room close, lost authority and page teardown still
-retire the session. Connected Viewers may keep interacting while the Host page
+retire the session, including its App control connection and pending discovery.
+That retirement cannot wait for the denied page to unmount. Connected Viewers may keep interacting while the Host page
 is absent, provided the room service and their admitted sessions remain available.
 [Rooms and access](./rooms-access.md#room-interactions) owns interaction authority
 and retention; [status](../status.md#accepted-interaction-phase) owns release readiness.
diff --git a/docs/todo.md b/docs/todo.md
index 31d8d1523..144416620 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -80,8 +80,8 @@ Implementation needs a concrete useful result within the product model.
   Obtain supported [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary),
   direct-media, endpoint-discovery and RTCP/MTU contracts plus a trusted relay
   configuration. Experimental dependency patches are not product APIs.
-  Extend optional-path acceptance to invitation revocation and overlapping-parent
-  transitions; bounded rendered chain/reconnect/departure checks pass. Preserve
+  Extend optional-path acceptance to overlapping-parent transitions; bounded
+  rendered chain/reconnect/departure and invitation-revocation checks pass. Preserve
   ordinary ICE when bootstrap is unavailable. The Native composition still needs
   a private socket-reservation API and a multi-mux address-lookup correction;
   verify physical interface changes and direct-only policy before adoption.
diff --git a/src/client/pages/ViewerPage.tsx b/src/client/pages/ViewerPage.tsx
index 71db4c215..da1177c65 100644
--- a/src/client/pages/ViewerPage.tsx
+++ b/src/client/pages/ViewerPage.tsx
@@ -90,6 +90,7 @@ import {
   deriveViewerPresentation,
   reduceViewerPresentation,
   viewerFailureFromServerCode,
+  type ViewerFailureCode,
   type ViewerPresentationAction,
   type ViewerRouteKind,
 } from "../media/viewer-presentation";
@@ -483,11 +484,17 @@ export function ViewerPage({
     let nativeViewerAvailable = true;
     const nativeViewerSessionId = createOpaqueId();
 
+    const releaseNativeClient = (): void => {
+      const connecting = nativeClientPromise;
+      nativeClientPromise = null;
+      void connecting?.then((client) => client?.close());
+    };
+
     const acquireNativeClient = async (): Promise<NativeClient | null> => {
       if (!active || !launchedByClient || !nativeViewerAvailable) return null;
       if (!nativeClientPromise) {
         const connecting: Promise<NativeClient | null> = NativeClient.connect({ waitForPermission: false }).catch(() => null).then((client) => {
-          if (!client || !active) {
+          if (!client || !active || nativeClientPromise !== connecting) {
             if (nativeClientPromise === connecting) nativeClientPromise = null;
             client?.close();
             return null;
@@ -581,29 +588,11 @@ export function ViewerPage({
           if (!active) {
             return;
           }
-          messageAuthority.invalidate();
-          setAssignedRoute(null);
-          clearViewerSfuRoute();
-          clearPeerState(true);
-          clearParticipantPresence();
-          dispatchPresentation({
-            type: "access",
-            access: "denied",
-            failure: reason,
-          });
+          denyRoomAccess(reason);
         },
         onAccessRequired: () => {
           if (active) {
-            messageAuthority.invalidate();
-            setAssignedRoute(null);
-            clearViewerSfuRoute();
-            clearPeerState(true);
-            clearParticipantPresence();
-            dispatchPresentation({
-              type: "access",
-              access: "denied",
-              failure: "INVALID_TOKEN",
-            });
+            denyRoomAccess("INVALID_TOKEN");
           }
         },
         onMessage: (message) => {
@@ -1243,6 +1232,17 @@ export function ViewerPage({
       viewerRelay?.stop();
     }
 
+    function denyRoomAccess(failure: ViewerFailureCode): void {
+      messageAuthority.invalidate();
+      setAssignedRoute(null);
+      clearViewerSfuRoute();
+      clearPeerState(true);
+      clearParticipantPresence();
+      // A denied page can remain mounted or enter the back/forward cache.
+      releaseNativeClient();
+      dispatchPresentation({ type: "access", access: "denied", failure });
+    }
+
     function applyMediaAssignment(assignment: MediaAssignment, preserveUpstream = false): void {
       const nextAssignment = limitMediaAssignment(
         assignment,
@@ -1776,43 +1776,19 @@ export function ViewerPage({
         }
         viewerAuthorizationGeneration = null;
         clearViewerGrant(roomId);
-        setAssignedRoute(null);
-        clearViewerSfuRoute();
-        clearPeerState(true);
-        clearParticipantPresence();
-        dispatchPresentation({
-          type: "access",
-          access: "denied",
-          failure: "INVALID_TOKEN",
-        });
+        denyRoomAccess("INVALID_TOKEN");
         signal.stop();
         return;
       }
       if (message.type === "room-closed") {
-        setAssignedRoute(null);
-        clearViewerSfuRoute();
-        clearPeerState(true);
-        clearParticipantPresence();
-        dispatchPresentation({
-          type: "access",
-          access: "denied",
-          failure: "ROOM_CLOSED",
-        });
+        denyRoomAccess("ROOM_CLOSED");
         signal.stop();
         return;
       }
       if (message.type === "error") {
         const failure = viewerFailureFromServerCode(message.code);
         if (failure !== null && failure !== "SERVER_ERROR") {
-          setAssignedRoute(null);
-          clearViewerSfuRoute();
-          clearPeerState(true);
-          clearParticipantPresence();
-          dispatchPresentation({
-            type: "access",
-            access: "denied",
-            failure,
-          });
+          denyRoomAccess(failure);
         }
         if (message.code === "INVALID_TOKEN") {
           clearViewerGrant(roomId);
@@ -1866,7 +1842,7 @@ export function ViewerPage({
       viewerRelay?.dispose();
       viewerRelay = null;
       viewerRelaySourceKey = null;
-      void nativeClientPromise?.then((client) => client?.close());
+      releaseNativeClient();
     };
   }, [roomId, viewerGrant, viewerPasswordAttempt, launchedByClient, connectionAttemptProgress4]);
 
diff --git a/tests/viewer-native-client-ownership.test.ts b/tests/viewer-native-client-ownership.test.ts
index 7e799eb83..d16e5c7c2 100644
--- a/tests/viewer-native-client-ownership.test.ts
+++ b/tests/viewer-native-client-ownership.test.ts
@@ -8,26 +8,28 @@ import { NativeCompatibilityError } from "../src/client/native/client";
 const source = ts.createSourceFile("ViewerPage.tsx", readFileSync(
   new URL("../src/client/pages/ViewerPage.tsx", import.meta.url), "utf8",
 ), ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
-const owners = new Set(["nativeClientPromise", "nativeViewerAvailable", "acquireNativeClient"]);
+const owners = new Set(["nativeClientPromise", "nativeViewerAvailable", "acquireNativeClient", "releaseNativeClient"]);
 const declarations: string[] = [];
-let cleanup = "";
+let denyAccess = "";
 function collect(node: ts.Node): void {
   if (ts.isVariableDeclaration(node) && owners.has(node.name.getText(source))) {
     declarations.push(`let ${node.getText(source)};`);
   }
-  if (ts.isExpressionStatement(node) && node.getText(source).startsWith("void nativeClientPromise?.then")) {
-    cleanup = node.getText(source);
+  if (ts.isFunctionDeclaration(node) && node.name?.text === "denyRoomAccess") {
+    denyAccess = node.getText(source);
   }
   ts.forEachChild(node, collect);
 }
 collect(source);
-if (declarations.length !== owners.size || !cleanup) throw new Error("Viewer Native owner was not found");
+if (declarations.length !== owners.size || !denyAccess) throw new Error("Viewer Native owner was not found");
 const executable = ts.transpile(`
   let active = true;
   ${declarations.join("\n")}
+  ${denyAccess}
   globalThis.acquire = acquireNativeClient;
+  globalThis.deny = denyRoomAccess;
   globalThis.disable = () => { nativeViewerAvailable = false; };
-  globalThis.dispose = () => { active = false; ${cleanup} };
+  globalThis.dispose = () => { active = false; releaseNativeClient(); };
 `, { target: ts.ScriptTarget.ES2022 });
 
 function control() {
@@ -41,12 +43,18 @@ function control() {
 
 function fixture(launchedByClient = true) {
   const connect = vi.fn(async (): Promise<ReturnType<typeof control> | null> => null);
-  const context = createContext({ launchedByClient, NativeClient: { connect } });
+  const context = createContext({
+    launchedByClient, NativeClient: { connect },
+    messageAuthority: { invalidate: vi.fn() }, setAssignedRoute: vi.fn(),
+    clearViewerSfuRoute: vi.fn(), clearPeerState: vi.fn(), clearParticipantPresence: vi.fn(),
+    dispatchPresentation: vi.fn(),
+  });
   runInContext(executable, context);
   return {
     connect,
     acquire: context.acquire as () => Promise<ReturnType<typeof control> | null>,
     disable: context.disable as () => void,
+    deny: context.deny as (reason: string) => void,
     dispose: context.dispose as () => void,
   };
 }
@@ -67,6 +75,40 @@ it.each([false, true])("retries an absent or rejected App on the next offer: rej
   expect(client.close).toHaveBeenCalledOnce();
 });
 
+it.each(["INVALID_TOKEN", "ROOM_CLOSED", "SESSION_REPLACED", "ROOM_ACCESS_DENIED"])(
+  "releases Native control on %s without waiting for the denied page to unmount", async (reason) => {
+    const current = fixture();
+    const client = control();
+    current.connect.mockResolvedValueOnce(client);
+    await current.acquire();
+    current.deny(reason);
+    await Promise.resolve();
+    expect(client.close).toHaveBeenCalledOnce();
+    current.dispose();
+    await Promise.resolve();
+    expect(client.close).toHaveBeenCalledOnce();
+  },
+);
+
+it("retires pending discovery after access loss without replacing or closing a newer connection", async () => {
+  const current = fixture();
+  const obsolete = control();
+  let resolve!: (value: typeof obsolete) => void;
+  current.connect.mockReturnValueOnce(new Promise((done) => { resolve = done; }));
+  const pending = current.acquire();
+  current.deny("INVALID_TOKEN");
+  const replacement = control();
+  current.connect.mockResolvedValueOnce(replacement);
+  await expect(current.acquire()).resolves.toBe(replacement);
+  resolve(obsolete);
+  await expect(pending).resolves.toBeNull();
+  expect(obsolete.close).toHaveBeenCalledOnce();
+  expect(replacement.close).not.toHaveBeenCalled();
+  await expect(current.acquire()).resolves.toBe(replacement);
+  expect(current.connect).toHaveBeenCalledTimes(2);
+  current.dispose();
+});
+
 it("keeps Browser fallback available after an App mismatch and retries on the next offer", async () => {
   const current = fixture();
   current.connect.mockRejectedValueOnce(new NativeCompatibilityError(8));
diff --git a/tests/viewer-route-health.test.ts b/tests/viewer-route-health.test.ts
index b41dd0b0e..6000fa40a 100644
--- a/tests/viewer-route-health.test.ts
+++ b/tests/viewer-route-health.test.ts
@@ -9,7 +9,7 @@ import type { ViewerPeerEvents } from "../src/client/webrtc/viewer-peer";
 const source = ts.createSourceFile("ViewerPage.tsx", readFileSync(
   new URL("../src/client/pages/ViewerPage.tsx", import.meta.url), "utf8",
 ), ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
-const owners = new Set(["ensurePeer", "reportActivePeerFailure"]);
+const owners = new Set(["ensurePeer", "reportActivePeerFailure", "noteReceiveFailure"]);
 const functions: string[] = [];
 function collect(node: ts.Node): void {
   if (ts.isFunctionDeclaration(node) && node.name && owners.delete(node.name.text)) {

From e405e5ace1380ee32feb946aea6514642616ed77 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 17:30:15 +0800
Subject: [PATCH 132/262] docs(network): record optional transport acceptance
 evidence

---
 docs/research/nat-traversal.md | 15 +++++++++++++--
 docs/todo.md                   |  4 ++--
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index c358e1397..1bfe27f13 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1175,8 +1175,19 @@ acceptance. Optional invitation revocation also rejects old links, clears media
 resources and permits new Native reception across four grant generations. This
 check exposed and now covers the shared Viewer's
 [control-retirement gap](./native-client-lifecycle.md#viewer-control-retirement).
-Optional overlapping-parent checks remain separate from the earlier tunnel-only
-UI evidence.
+A second optional UI check moves one Native Viewer between two Native parents
+in both directions through the real room controller. Holding candidate readiness
+within the unchanged operation deadline preserves the old video element, stream
+and advancing frames while both receiver flows exist. Releasing readiness commits
+the new parent and retires only the old flow; a sibling retains its connection
+and advancing decoded pictures throughout. Final transport counts reach zero
+under the race detector. The fixture disables automatic quality tuning and
+changes advertised capacity to isolate overlapping ownership. This local synthetic
+check does not measure handoff latency, difficult-network success or tunnel selection.
+The optional composition separately passes the kernel-NAT unchanged-path control
+with zero relayed encrypted data, retaining fresh Native playback packets after DERP
+closes. This fixed-encoded-input check establishes direct transport through the
+virtual socket, not rendered App recovery or another reachable NAT class.
 
 This composition also exposes an upstream address-lookup mismatch: Pion's
 multi-mux enumerates current child addresses but `GetConn` only consults its
diff --git a/docs/todo.md b/docs/todo.md
index 144416620..bfede8972 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -80,8 +80,8 @@ Implementation needs a concrete useful result within the product model.
   Obtain supported [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary),
   direct-media, endpoint-discovery and RTCP/MTU contracts plus a trusted relay
   configuration. Experimental dependency patches are not product APIs.
-  Extend optional-path acceptance to overlapping-parent transitions; bounded
-  rendered chain/reconnect/departure and invitation-revocation checks pass. Preserve
+  Bounded optional-path checks cover rendered chain/reconnect/departure,
+  invitation revocation and overlapping-parent transitions in both directions. Preserve
   ordinary ICE when bootstrap is unavailable. The Native composition still needs
   a private socket-reservation API and a multi-mux address-lookup correction;
   verify physical interface changes and direct-only policy before adoption.

From 25630fe5eb7e07da1c072b3ea6717d3e839f1220 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 18:02:25 +0800
Subject: [PATCH 133/262] docs(network): record optional transport recovery and
 field-test boundary

---
 docs/research/nat-traversal.md | 21 +++++++++++++++++----
 docs/todo.md                   |  3 ++-
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 1bfe27f13..1e89227b7 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1184,10 +1184,23 @@ and advancing decoded pictures throughout. Final transport counts reach zero
 under the race detector. The fixture disables automatic quality tuning and
 changes advertised capacity to isolate overlapping ownership. This local synthetic
 check does not measure handoff latency, difficult-network success or tunnel selection.
-The optional composition separately passes the kernel-NAT unchanged-path control
-with zero relayed encrypted data, retaining fresh Native playback packets after DERP
-closes. This fixed-encoded-input check establishes direct transport through the
-virtual socket, not rendered App recovery or another reachable NAT class.
+The optional composition also passes the kernel-NAT real-codec controls with
+Chromium 152 and Firefox 151: unchanged paths, either endpoint's address change,
+and a short complete interruption. Ordinary Pion supplies unchanged/interruption
+controls. New blue content renders on the same track after DERP closes, with
+zero relayed encrypted data. Firefox renegotiates its local leg once when its
+endpoint moves; Chromium retains that leg. No timeout or address policy changes.
+These synthetic-source checks exercise the Native engine and Browser bridge,
+not complete App startup, physical roaming or another reachable NAT class.
+
+A non-race Chromium comparison also measures the isolated Go workers. One
+roughly 18-second, 640x360/30 connection used peak RSS of 64/65 MiB for ordinary
+sender/receiver workers and 72/72 MiB with the optional tunnel. Live goroutines
+rose from 39/65 to 96/122; final cumulative CPU times were 0.48/0.54 seconds and
+0.67/0.67 seconds respectively. These are bounded observations, not App budgets:
+the codec, Browser and relay run separately, and both controls link the same
+binary. Shared listeners and clients also prevent linear extrapolation to a
+room. Full App package size, sustained load and multi-peer cost remain unmeasured.
 
 This composition also exposes an upstream address-lookup mismatch: Pion's
 multi-mux enumerates current child addresses but `GetConn` only consults its
diff --git a/docs/todo.md b/docs/todo.md
index bfede8972..7ea8381c5 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -91,7 +91,8 @@ Implementation needs a concrete useful result within the product model.
   change or product transport integration is accepted; all experimental wire
   changes remain isolated. The P2P evidence work below owns network/interop
   acceptance.
-- [ ] **Small external test before 2.0.** First use the isolated transport
+- [ ] **Small external test before 2.0.** The owner will arrange testers after
+  the internal package and paired comparison steps are ready. First use the isolated transport
   experiment on the same difficult network pairs as current Piik, measuring
   direct success separately from relay delivery, first-picture time, recovery
   and added resource cost. This evidence can precede other feature work.

From ff147f0535fcce720042a0c413580d55e6a18b03 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 18:34:14 +0800
Subject: [PATCH 134/262] docs(network): record complete App fallback evidence

---
 docs/research/nat-traversal.md | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 1e89227b7..a5625583b 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1200,7 +1200,20 @@ rose from 39/65 to 96/122; final cumulative CPU times were 0.48/0.54 seconds and
 0.67/0.67 seconds respectively. These are bounded observations, not App budgets:
 the codec, Browser and relay run separately, and both controls link the same
 binary. Shared listeners and clients also prevent linear extrapolation to a
-room. Full App package size, sustained load and multi-peer cost remain unmeasured.
+room. A stripped Windows App build grows from 44.1 to 59.8 MiB with the isolated
+composition, using the same embedded UI and module selection. This excludes
+capture/tunnel helpers and ZIP compression. Sustained and multi-peer cost remain
+unmeasured.
+
+The isolated App overlay now installs that constructor in the actual process-level
+control factory. Its matched experimental wire identity rejects product builds,
+local CLI configuration selects the TLS bootstrap, and DERP media is disabled in
+the binary rather than by an optional environment setting. Actual Windows App
+and embedded-UI checks retain fresh decoded pixels and manual reconnect through
+ordinary ICE when the experimental bootstrap is unavailable. Two independent
+control sessions and process retirement also pass a race check. Successful
+bootstrap through the full App and a distributable test package remain open;
+these controls do not establish field success or physical capture compatibility.
 
 This composition also exposes an upstream address-lookup mismatch: Pion's
 multi-mux enumerates current child addresses but `GetConn` only consults its

From e9538f5d202ea01d1fcde7541ed77e9fbd6e7897 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 19:09:58 +0800
Subject: [PATCH 135/262] docs(preview): record internal package and field
 acceptance boundary

---
 docs/research/nat-traversal.md | 19 ++++++++++++++++---
 docs/status.md                 | 12 +++++++-----
 docs/todo.md                   | 11 +++++------
 3 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index a5625583b..aec5032fb 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1211,9 +1211,22 @@ local CLI configuration selects the TLS bootstrap, and DERP media is disabled in
 the binary rather than by an optional environment setting. Actual Windows App
 and embedded-UI checks retain fresh decoded pixels and manual reconnect through
 ordinary ICE when the experimental bootstrap is unavailable. Two independent
-control sessions and process retirement also pass a race check. Successful
-bootstrap through the full App and a distributable test package remain open;
-these controls do not establish field success or physical capture compatibility.
+control sessions and process retirement also pass a race check. The Linux full-App
+fixture also selects Magicsock with ordinary remote candidates withheld, renders
+generated Browser pixels through both Native sessions, and restores pictures on
+a new selected connection after manual Viewer reconnect. Closing its process-owned
+TLS bootstrap still leaves 300 new frames over ten seconds at 640x360/30, with
+changed decoded pixels; App retirement passes the race check. This is local
+integration evidence, not another reachable NAT class.
+
+A frozen Windows internal package includes the numeric-media candidate, matched
+experimental UI, helpers and notices, separate ordinary/experimental launchers
+and bilingual paired-test instructions. Final-package checks cover native discovery,
+two control sessions, unselected-origin denial, shutdown and Explorer ZIP members
+with extracted-file hashes. Its experimental launcher selects the
+[upstream public bootstrap](https://github.com/tailscale/tailcat#tailcat) for the
+future paired test; local acceptance used owned or unavailable bootstrap only.
+Physical capture, public-invitation operation and field benefit remain open.
 
 This composition also exposes an upstream address-lookup mismatch: Pion's
 multi-mux enumerates current child addresses but `GetConn` only consults its
diff --git a/docs/status.md b/docs/status.md
index ff0bf8a74..e7c9edee6 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -1,6 +1,6 @@
 # Current Status
 
-Last updated: 2026-10-09
+Last updated: 2026-10-10
 
 This is the compact execution/deployment index. Product modules own behavior,
 [verification status](./verification-status.md) owns unresolved physical limits,
@@ -72,10 +72,12 @@ The [media assessment](./research/native-client-media.md#media-capability-extens
 owns local codec, derived-output, SFU, Browser/Native fanout and live-control
 evidence. macOS geometry, cross-browser/device and route-change acceptance, and
 additional codecs remain open.
-Native Magicsock remains an isolated experiment with incomplete product
-integration and unresolved recovery cases. These proposals do not yet change
-the accepted contract or transport. A small external test is proposed before
-release; publication remains subject to the owner's final acceptance.
+Native Magicsock remains an isolated experiment. Full-App local transport and
+reconnect checks pass, and a frozen Windows internal package is available for
+paired testing. Physical-network benefit, sustained recovery and supported
+dependency contracts remain open; this does not accept product integration.
+The owner will arrange external testers. Publication remains subject to final
+acceptance.
 Immutable release artifacts own delivery completion; [TODO](./todo.md#now) owns
 remaining work.
 
diff --git a/docs/todo.md b/docs/todo.md
index 7ea8381c5..c26546aef 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -91,15 +91,14 @@ Implementation needs a concrete useful result within the product model.
   change or product transport integration is accepted; all experimental wire
   changes remain isolated. The P2P evidence work below owns network/interop
   acceptance.
-- [ ] **Small external test before 2.0.** The owner will arrange testers after
-  the internal package and paired comparison steps are ready. First use the isolated transport
+- [ ] **Small external test before 2.0.** The frozen Windows internal package and
+  paired comparison steps are ready; the owner will arrange testers. Use the isolated transport
   experiment on the same difficult network pairs as current Piik, measuring
   direct success separately from relay delivery, first-picture time, recovery
   and added resource cost. This evidence can precede other feature work.
-  A combined product test package requires room-scoped authorization/revocation,
-  mixed Browser/Native behavior and bounded recovery to pass first. Freeze and
-  identify each test build; do not describe the present Magicsock experiment as
-  a feature-complete product awaiting only acceptance. The final candidate then
+  Keep each test build frozen and identifiable. The combined local package and
+  bounded authorization/recovery evidence do not establish a feature-complete
+  product or additional real-network reachability. The final candidate then
   receives the combined feature/UI and regression check.
 - [ ] **Managed Demo hosting.** The [provider assessment](./operations/website.md#managed-hosting-assessment)
   identifies UDP/storage requirements but establishes no cost saving. Keep the

From caec5810595f1426574ca4c89c4c3904f7528285 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 19:26:46 +0800
Subject: [PATCH 136/262] docs(preview): require a coherent candidate before
 external testing

---
 docs/research/nat-traversal.md | 16 ++++++++++++++--
 docs/status.md                 |  6 +++---
 docs/todo.md                   | 10 +++++++---
 3 files changed, 24 insertions(+), 8 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index aec5032fb..bee317aa3 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1202,8 +1202,8 @@ the codec, Browser and relay run separately, and both controls link the same
 binary. Shared listeners and clients also prevent linear extrapolation to a
 room. A stripped Windows App build grows from 44.1 to 59.8 MiB with the isolated
 composition, using the same embedded UI and module selection. This excludes
-capture/tunnel helpers and ZIP compression. Sustained and multi-peer cost remain
-unmeasured.
+capture/tunnel helpers and ZIP compression. Sustained and full-room cost remain
+open.
 
 The isolated App overlay now installs that constructor in the actual process-level
 control factory. Its matched experimental wire identity rejects product builds,
@@ -1219,6 +1219,18 @@ TLS bootstrap still leaves 300 new frames over ten seconds at 640x360/30, with
 changed decoded pixels; App retirement passes the race check. This is local
 integration evidence, not another reachable NAT class.
 
+A non-race full-App comparison uses one Native and three plain-Browser Viewers
+with a generated 640x360/30 source. Each Viewer receives 300–301 new frames and
+changing pixels over its ten-second observation. Ordinary/optional runs peak
+at 81.8/93.2 MiB RSS and use 3.76/4.08 seconds of Go CPU during the roughly
+forty-second observation sequence. Live goroutines fall from 211/327 to 27 in
+both modes after tabs close, then the App exits normally. The optional run
+selects Magicsock on the Native pair with ordinary remote candidates withheld;
+Web edges retain ordinary ICE. Both measurements include the same owned TLS
+bootstrap/STUN fixture and exclude separate Browser/codec processes. This is a
+bounded mixed-room cost and retirement check, not endurance, a 20-Viewer budget
+or a network-success comparison.
+
 A frozen Windows internal package includes the numeric-media candidate, matched
 experimental UI, helpers and notices, separate ordinary/experimental launchers
 and bilingual paired-test instructions. Final-package checks cover native discovery,
diff --git a/docs/status.md b/docs/status.md
index e7c9edee6..bb37ad6fe 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -74,10 +74,10 @@ evidence. macOS geometry, cross-browser/device and route-change acceptance, and
 additional codecs remain open.
 Native Magicsock remains an isolated experiment. Full-App local transport and
 reconnect checks pass, and a frozen Windows internal package is available for
-paired testing. Physical-network benefit, sustained recovery and supported
+engineering checks. The owner has not used it and will arrange paired testing
+once the main features form a coherent usable candidate. Physical-network benefit, sustained recovery and supported
 dependency contracts remain open; this does not accept product integration.
-The owner will arrange external testers. Publication remains subject to final
-acceptance.
+Publication remains subject to final acceptance.
 Immutable release artifacts own delivery completion; [TODO](./todo.md#now) owns
 remaining work.
 
diff --git a/docs/todo.md b/docs/todo.md
index c26546aef..66b26005b 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -92,10 +92,14 @@ Implementation needs a concrete useful result within the product model.
   changes remain isolated. The P2P evidence work below owns network/interop
   acceptance.
 - [ ] **Small external test before 2.0.** The frozen Windows internal package and
-  paired comparison steps are ready; the owner will arrange testers. Use the isolated transport
-  experiment on the same difficult network pairs as current Piik, measuring
+  paired comparison steps are engineering evidence only. The owner has not used
+  that package and will arrange testers after the main features, especially
+  Magicsock, form a coherent usable candidate. Finish local App/room lifecycle,
+  mixed Browser/Native behavior, recovery, resource and dependency boundaries
+  before requesting that test. Use the candidate on the same difficult network
+  pairs as current Piik, measuring
   direct success separately from relay delivery, first-picture time, recovery
-  and added resource cost. This evidence can precede other feature work.
+  and added resource cost.
   Keep each test build frozen and identifiable. The combined local package and
   bounded authorization/recovery evidence do not establish a feature-complete
   product or additional real-network reachability. The final candidate then

From 78b26230e4cab2575f888c16bb02de295c3aaf19 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 19:35:14 +0800
Subject: [PATCH 137/262] docs(network): record bounded full-room App
 acceptance

---
 docs/research/nat-traversal.md | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index bee317aa3..2a72b91c3 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1202,8 +1202,7 @@ the codec, Browser and relay run separately, and both controls link the same
 binary. Shared listeners and clients also prevent linear extrapolation to a
 room. A stripped Windows App build grows from 44.1 to 59.8 MiB with the isolated
 composition, using the same embedded UI and module selection. This excludes
-capture/tunnel helpers and ZIP compression. Sustained and full-room cost remain
-open.
+capture/tunnel helpers and ZIP compression. Sustained cost remains open.
 
 The isolated App overlay now installs that constructor in the actual process-level
 control factory. Its matched experimental wire identity rejects product builds,
@@ -1231,6 +1230,13 @@ bootstrap/STUN fixture and exclude separate Browser/codec processes. This is a
 bounded mixed-room cost and retirement check, not endurance, a 20-Viewer budget
 or a network-success comparison.
 
+A bounded full-room run with one Native and nineteen Web Viewers also retains
+changing 640x360/30 pictures: each ten-second observation advances 296–301 frames.
+The twenty-first code-only attempt receives the existing generic admission
+denial, a retained Viewer keeps receiving, and the App exits normally after
+all tabs close. The Go process peaks at 99.3 MiB RSS. These Viewers share one
+machine; this does not cover twenty Native peers or physical-network endurance.
+
 A frozen Windows internal package includes the numeric-media candidate, matched
 experimental UI, helpers and notices, separate ordinary/experimental launchers
 and bilingual paired-test instructions. Final-package checks cover native discovery,

From 0a6582f151ec4693ab6a239bd4bc2c0ce11447e8 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 21:48:51 +0800
Subject: [PATCH 138/262] docs(network): prioritize browser-compatible
 connectivity

---
 docs/research/nat-traversal.md | 42 ++++++++++++++++++++++-
 docs/status.md                 | 10 +++---
 docs/todo.md                   | 62 +++++++++++-----------------------
 3 files changed, 65 insertions(+), 49 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 2a72b91c3..83a25f5c6 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1,6 +1,6 @@
 # Browser And Native NAT Traversal
 
-Last reviewed: 2026-10-09
+Last reviewed: 2026-10-10
 
 This document owns evidence for improving direct ICE without adding a
 new relay or a custom transport. The current product contract remains standard
@@ -344,8 +344,48 @@ OS network-change detection, decoded playback or real-router behavior. Its
 seven-pair direct matrix matched Pion within four-second windows. Go reuse is
 feasible; product integration and network benefit require the controls below.
 
+### Browser-Compatible Follow-Up
+
+The product target remains App-to-Browser and Browser-to-Browser sharing without
+requiring every Viewer to install software. Existing IPv6, bounded gateway
+mapping and standard ICE can benefit those edges; a new transport must be judged
+against that same endpoint pair and relay policy.
+
+- The [2026 DCUtR measurement](https://arxiv.org/abs/2604.12484) covers 4.4 million
+  attempts across more than 85,000 networks. Its roughly 70% success is conditional
+  on relay reservation and address discovery; 97.6% of successful punches occur
+  on the first attempt. These are libp2p results, not a Piik baseline. They justify
+  separating preparation failures from hole-punch failures and measuring the
+  marginal benefit of retries, not copying a retry count or replacing ICE.
+- [QUIC hole punching and migration](https://arxiv.org/abs/2408.01791) reports
+  shorter connection/restoration latency than its TCP/re-punching controls.
+  It does not demonstrate a drop-in improvement for Browser WebRTC. Current
+  [WebTransport](https://www.w3.org/TR/webtransport/) targets Browser-to-server
+  transport; it is not an arbitrary UDP socket for Magicsock.
+- [ICE renomination](https://datatracker.ietf.org/doc/draft-thatcher-tsvwg-renomination/)
+  proposes changing the selected candidate pair without a full restart. It
+  remains an Internet-Draft. Pinned Pion WebRTC v4.2.19 already exposes
+  `SetICERenomination`; Piik does not enable it. Its ICE v4.4.0 implementation
+  references an earlier draft and automatically probes and reselects candidate
+  pairs. Verify wire-version agreement, Browser interoperability, probe cost and
+  recovery benefit before enabling it. This targets path changes after connection,
+  not a demonstrated increase in initial NAT reachability. Keep selection in the
+  framework; do not add a Piik path-selection loop.
+- [Direct Sockets](https://developer.chrome.com/docs/iwa/direct-sockets) is
+  restricted to explicitly installed Isolated Web Apps. It does not remove the
+  installation requirement for an ordinary invitation page.
+
 ### Integration Cost And Recovery Controls
 
+**Current decision: no-go for the 2.0 candidate.** This composition requires
+Native App transport at both ends of the enhanced edge. An App Host with a plain
+Browser Viewer still uses ordinary WebRTC; mixed relaying does not enhance that
+Browser edge. The owner therefore stopped integration and field-package work.
+Retain the isolated evidence, not a product dependency or a promised feature.
+Independently verified ordinary ICE/media repairs remain useful without this
+stack. Reopen only for a concrete Browser-compatible benefit or an explicitly
+accepted App-only scope; no additional reachable NAT class has been established.
+
 The isolated `spike/magicsock-assessment` branch retains the comparison probes.
 The nested modules are outside Piik's build. Local bootstrap, peer denial and
 synthetic SRTP media checks passed. Initial withdrawal checks observed stopped
diff --git a/docs/status.md b/docs/status.md
index bb37ad6fe..8e2fd55fe 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -72,11 +72,11 @@ The [media assessment](./research/native-client-media.md#media-capability-extens
 owns local codec, derived-output, SFU, Browser/Native fanout and live-control
 evidence. macOS geometry, cross-browser/device and route-change acceptance, and
 additional codecs remain open.
-Native Magicsock remains an isolated experiment. Full-App local transport and
-reconnect checks pass, and a frozen Windows internal package is available for
-engineering checks. The owner has not used it and will arrange paired testing
-once the main features form a coherent usable candidate. Physical-network benefit, sustained recovery and supported
-dependency contracts remain open; this does not accept product integration.
+Magicsock adoption is no-go for this candidate: its App-to-App augmentation does
+not improve the core App-to-Browser use case. The
+[assessment](./research/nat-traversal.md#integration-cost-and-recovery-controls)
+owns the retained experiment and product decision. Its package is retired;
+independent ordinary ICE and media repairs remain in the candidate.
 Publication remains subject to final acceptance.
 Immutable release artifacts own delivery completion; [TODO](./todo.md#now) owns
 remaining work.
diff --git a/docs/todo.md b/docs/todo.md
index 66b26005b..ba1de36da 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -23,6 +23,15 @@ Git/PRs own completed history.
 
 ## Held By Owner
 
+- [ ] **Magicsock adoption: no-go for this candidate.** Its direct-path
+  augmentation requires App transport at both ends and does not improve the
+  core App-to-Browser edge. Stop product integration, combined packaging and
+  Magicsock field-test recruitment. Retain isolated evidence in Git; preserve
+  independently verified ordinary ICE/media repairs. The
+  [assessment](./research/nat-traversal.md#integration-cost-and-recovery-controls)
+  owns the rationale. Reopen only for a concrete Browser-compatible benefit
+  with acceptable complexity, or a newly accepted App-only product scope.
+
 - [ ] **Browser-internal encoder work.** Paused by the owner on 2026-10-01.
   [Comparisons and Chromium traces](./research/browser-local-encoding-pool.md#sustained-h264-recovery)
   own the evidence for synchronous H264 initialization, native adaptation and
@@ -66,44 +75,10 @@ Implementation needs a concrete useful result within the product model.
   mismatch before accepting the replacement contract. The published 1.x enums
   remain that major's baseline; the PR is not a compatible enum-only extension
   of v1.9.2.
-- [ ] **Native Magicsock.** Go reuse is feasible, but the
-  [matched comparisons](./research/nat-traversal.md#integration-cost-and-recovery-controls)
-  have not established another reachable NAT class. Verify the measured local
-  address-handoff benefit through the complete App and physical networks before
-  adoption. Bounded rendered Browser/Native chains cover reconnect, departure and
-  overlapping Native-parent changes. Sustained and difficult-network recovery
-  remain open. Preserve the existing Browser
-  sender, room-event and assigned-connection owners. Order admission and candidate
-  delivery without exhausting inner checks; diagnostic replies are not media-readiness evidence, and inner
-  checks may exhaust before the underlay recovers. Research owns the verified
-  sender/receiver command, key/lifecycle and local RTP evidence and their limits.
-  Obtain supported [authorization/revocation](./research/nat-traversal.md#peer-authorization-boundary),
-  direct-media, endpoint-discovery and RTCP/MTU contracts plus a trusted relay
-  configuration. Experimental dependency patches are not product APIs.
-  Bounded optional-path checks cover rendered chain/reconnect/departure,
-  invitation revocation and overlapping-parent transitions in both directions. Preserve
-  ordinary ICE when bootstrap is unavailable. The Native composition still needs
-  a private socket-reservation API and a multi-mux address-lookup correction;
-  verify physical interface changes and direct-only policy before adoption.
-  Preserve the local address policy (forcing loopback fails Firefox), existing
-  recovery deadlines and single route/resource owners. DERP must not become
-  another media fallback or bypass site/share policy. No new setting, timeout
-  change or product transport integration is accepted; all experimental wire
-  changes remain isolated. The P2P evidence work below owns network/interop
-  acceptance.
-- [ ] **Small external test before 2.0.** The frozen Windows internal package and
-  paired comparison steps are engineering evidence only. The owner has not used
-  that package and will arrange testers after the main features, especially
-  Magicsock, form a coherent usable candidate. Finish local App/room lifecycle,
-  mixed Browser/Native behavior, recovery, resource and dependency boundaries
-  before requesting that test. Use the candidate on the same difficult network
-  pairs as current Piik, measuring
-  direct success separately from relay delivery, first-picture time, recovery
-  and added resource cost.
-  Keep each test build frozen and identifiable. The combined local package and
-  bounded authorization/recovery evidence do not establish a feature-complete
-  product or additional real-network reachability. The final candidate then
-  receives the combined feature/UI and regression check.
+- [ ] **2.0 candidate acceptance.** Finish the combined numeric-media UI,
+  App/room lifecycle, ordinary Browser/Native routes and regression checks before
+  asking the owner to arrange external testing. Keep each test build frozen and
+  identifiable; the retired Magicsock package is not the current candidate.
 - [ ] **Managed Demo hosting.** The [provider assessment](./operations/website.md#managed-hosting-assessment)
   identifies UDP/storage requirements but establishes no cost saving. Keep the
   existing P2P-only Demo until a provider and operating boundary are accepted.
@@ -234,11 +209,12 @@ to connection generations without raw endpoints. Verify survey responses and
 P2P/SFU handoffs, including background direct attempts behind working SFU media.
 The [iroh/Tailscale comparison](./research/nat-traversal.md#iroh-and-tailscale-comparison)
 records the isolated Go media/migration experiment and Browser/relay limits.
-Before adopting magicsock in the product, establish a benefit on matched network
-pairs and define room-authorized peer keys, endpoint exchange, MTU/resource limits
-and mixed Browser/Native behavior. Keep the experiment isolated from the
-production [routing contract](./standards/routing-transport.md); Go reuse already
-works, so a Rust alternative needs a concrete Go limitation.
+Prioritize one-App-to-Browser and Browser-to-Browser controls using existing
+ICE, IPv6 and gateway mapping, with changing interfaces, lost mappings and
+asymmetric network restrictions. The
+[Browser-compatible assessment](./research/nat-traversal.md#browser-compatible-follow-up)
+owns current literature and applicability. Do not infer a benefit from another
+stack's success percentage or add a new retry/transport owner without evidence.
 
 ## Parked Product Work
 

From 3148c19dea0f4a0c1b6e8c25743114a8211bb286 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 22:08:29 +0800
Subject: [PATCH 139/262] docs(network): record browser renomination boundary

---
 docs/research/nat-traversal.md | 21 +++++++++++++++++++++
 docs/todo.md                   |  3 +++
 2 files changed, 24 insertions(+)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 83a25f5c6..a164a4a95 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -375,6 +375,27 @@ against that same endpoint pair and relay policy.
   restricted to explicitly installed Isolated Web Apps. It does not remove the
   installation requirement for an ordinary invitation page.
 
+#### Pion Renomination Preflight
+
+The current decision is not to enable automatic renomination. An isolated
+two-UDP-path control with pinned WebRTC v4.2.19/ICE v4.4.0 cut the selected socket
+after stable VP8 playback. Chromium 152 recovered video and reverse feedback
+without new SDP after about 5.6 seconds. Firefox 151.0.3 repeatedly resumed video
+after about 5.7 seconds but retained the failed outbound candidate: RTCP reception
+and echoed data stopped for the full 20-second observation while new video kept
+decoding. An explicit ICE restart on that same connection selected the surviving
+path and restored both reverse flows. The stock-ICE controls also recovered
+through restart.
+
+Both Browsers answered with only `trickle`; the enabled Pion call nevertheless
+sent the older nomination attribute. Thus receiving new frames alone cannot
+establish compatible path migration. In these fixtures, steady Binding requests
+also rose from 3 to 27-75 per five seconds, depending on interface enumeration.
+These are local transport controls, not physical-network success measurements or
+a defect in Piik's currently disabled feature. Reopen only for negotiated Browser
+support and bounded probe/recovery behavior; do not add UA exceptions, a second
+recovery loop or a Browser fork to enable this option.
+
 ### Integration Cost And Recovery Controls
 
 **Current decision: no-go for the 2.0 candidate.** This composition requires
diff --git a/docs/todo.md b/docs/todo.md
index ba1de36da..e843c1e71 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -215,6 +215,9 @@ asymmetric network restrictions. The
 [Browser-compatible assessment](./research/nat-traversal.md#browser-compatible-follow-up)
 owns current literature and applicability. Do not infer a benefit from another
 stack's success percentage or add a new retry/transport owner without evidence.
+The [renomination preflight](./research/nat-traversal.md#pion-renomination-preflight)
+rejects enabling the current automatic option: Firefox's recovered video did not
+restore reverse feedback. Keep standard ICE recovery while that boundary remains.
 
 ## Parked Product Work
 

From 950de1d00ce6c12afe02e10819aa01288fcd0087 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 22:19:07 +0800
Subject: [PATCH 140/262] docs(network): assess browser-compatible upstream
 improvements

---
 docs/research/nat-traversal.md | 26 +++++++++++++++++++++++---
 docs/todo.md                   |  3 +++
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index a164a4a95..d10f40a7f 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -351,12 +351,17 @@ requiring every Viewer to install software. Existing IPv6, bounded gateway
 mapping and standard ICE can benefit those edges; a new transport must be judged
 against that same endpoint pair and relay policy.
 
-- The [2026 DCUtR measurement](https://arxiv.org/abs/2604.12484) covers 4.4 million
-  attempts across more than 85,000 networks. Its roughly 70% success is conditional
+- The [2026 DCUtR paper](https://arxiv.org/abs/2604.12484) covers 4.4 million
+  attempts across more than 85,000 networks, collected in December 2022 through
+  January 2023. Its roughly 70% success is conditional
   on relay reservation and address discovery; 97.6% of successful punches occur
   on the first attempt. These are libp2p results, not a Piik baseline. They justify
   separating preparation failures from hole-punch failures and measuring the
-  marginal benefit of retries, not copying a retry count or replacing ICE.
+  marginal benefit of retries, not copying a retry count or replacing ICE. Its
+  proposed role reversal and probabilistic port probing are future work, not
+  measured improvements in that campaign. Standard full ICE already checks in
+  both directions; a QUIC initiator-role proposal is not evidence for changing
+  Piik's Host authority or adding another retry owner.
 - [QUIC hole punching and migration](https://arxiv.org/abs/2408.01791) reports
   shorter connection/restoration latency than its TCP/re-punching controls.
   It does not demonstrate a drop-in improvement for Browser WebRTC. Current
@@ -374,6 +379,21 @@ against that same endpoint pair and relay policy.
 - [Direct Sockets](https://developer.chrome.com/docs/iwa/direct-sockets) is
   restricted to explicitly installed Isolated Web Apps. It does not remove the
   installation requirement for an ordinary invitation page.
+- [SPED](https://datatracker.ietf.org/doc/draft-hancke-webrtc-sped/) carries DTLS
+  handshake data in STUN so ICE and encryption setup can overlap. Its target is
+  setup latency and handshake loss recovery, not newly reachable NAT classes.
+  The March 2026 individual draft is expired as of this review; implementation
+  interest does not establish interoperable product support. Evaluate only
+  framework-owned negotiation and stock Browser builds, retaining authentication
+  and ordinary fallback. A Browser field-trial flag is not an adoption path.
+
+The 2026-10-10 upstream review found stable Pion WebRTC v4.2.23 / ICE v4.4.7
+beyond the current pins. The [ICE changes](https://github.com/pion/ice/compare/v4.4.0...v4.4.7)
+include STUN retransmission, gathering-generation ownership, Chromium mDNS
+compatibility and pre-created mux lifetime corrections. Inspect applicability
+and test the shared Native/SFU composition before adopting them: this range also
+changes STUN/transport package majors. A release-note match alone does not
+establish a Piik defect or a connectivity gain.
 
 #### Pion Renomination Preflight
 
diff --git a/docs/todo.md b/docs/todo.md
index e843c1e71..44e83b061 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -215,6 +215,9 @@ asymmetric network restrictions. The
 [Browser-compatible assessment](./research/nat-traversal.md#browser-compatible-follow-up)
 owns current literature and applicability. Do not infer a benefit from another
 stack's success percentage or add a new retry/transport owner without evidence.
+Review the newer stable Pion ICE/WebRTC fixes against the pinned Native/SFU
+composition, especially gathering generations, STUN retransmission and mDNS;
+accept dependency changes only after focused interoperability/recovery controls.
 The [renomination preflight](./research/nat-traversal.md#pion-renomination-preflight)
 rejects enabling the current automatic option: Firefox's recovered video did not
 restore reverse feedback. Keep standard ICE recovery while that boundary remains.

From 04fd696e6d6a489b479f4074466c5a0ab681036b Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 22:47:41 +0800
Subject: [PATCH 141/262] fix(media): update Pion for browser ICE
 interoperability

---
 docs/research/nat-traversal.md                | 43 +++++++++++----
 docs/todo.md                                  |  7 +--
 go.mod                                        | 27 +++++-----
 go.sum                                        | 52 +++++++++----------
 internal/app/mediaedge/ice_socket.go          |  2 +-
 internal/app/mediaedge/receiver_test.go       |  2 +-
 .../mediaedge/relay_network_fixture_test.go   |  2 +-
 internal/app/mediaedge/stun.go                |  2 +-
 internal/app/mediaedge/stun_test.go           |  2 +-
 internal/media/forwarding/ice.go              |  4 +-
 internal/media/forwarding/packet_buffer.go    | 26 ++++++++++
 .../media/forwarding/packet_buffer_test.go    | 43 +++++++++++++++
 internal/media/forwarding/publication.go      |  4 +-
 internal/media/forwarding/recovery_test.go    |  2 +-
 internal/media/forwarding/transport.go        |  4 +-
 internal/server/stun/server_test.go           |  2 +-
 16 files changed, 160 insertions(+), 64 deletions(-)
 create mode 100644 internal/media/forwarding/packet_buffer.go
 create mode 100644 internal/media/forwarding/packet_buffer_test.go

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index d10f40a7f..e6f7f266e 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -369,8 +369,8 @@ against that same endpoint pair and relay policy.
   transport; it is not an arbitrary UDP socket for Magicsock.
 - [ICE renomination](https://datatracker.ietf.org/doc/draft-thatcher-tsvwg-renomination/)
   proposes changing the selected candidate pair without a full restart. It
-  remains an Internet-Draft. Pinned Pion WebRTC v4.2.19 already exposes
-  `SetICERenomination`; Piik does not enable it. Its ICE v4.4.0 implementation
+  remains an Internet-Draft. The tested Pion WebRTC v4.2.19 already exposed
+  `SetICERenomination`; Piik does not enable it. That ICE v4.4.0 implementation
   references an earlier draft and automatically probes and reselects candidate
   pairs. Verify wire-version agreement, Browser interoperability, probe cost and
   recovery benefit before enabling it. This targets path changes after connection,
@@ -387,13 +387,38 @@ against that same endpoint pair and relay policy.
   framework-owned negotiation and stock Browser builds, retaining authentication
   and ordinary fallback. A Browser field-trial flag is not an adoption path.
 
-The 2026-10-10 upstream review found stable Pion WebRTC v4.2.23 / ICE v4.4.7
-beyond the current pins. The [ICE changes](https://github.com/pion/ice/compare/v4.4.0...v4.4.7)
-include STUN retransmission, gathering-generation ownership, Chromium mDNS
-compatibility and pre-created mux lifetime corrections. Inspect applicability
-and test the shared Native/SFU composition before adopting them: this range also
-changes STUN/transport package majors. A release-note match alone does not
-establish a Piik defect or a connectivity gain.
+#### Stable Pion Interoperability
+
+The candidate uses Pion WebRTC v4.2.23 / ICE v4.4.7. The
+[upstream changes](https://github.com/pion/ice/compare/v4.4.0...v4.4.7) include
+STUN retransmission, gathering-generation ownership, Chromium mDNS compatibility
+and pre-created mux lifetime corrections. This updates the shared Native/SFU
+composition; ordinary Browser-to-Browser ICE remains Browser-owned.
+
+A controlled Chrome 152 check reproduced the
+[mDNS query incompatibility](https://github.com/pion/mdns/commit/5b0a717e4ff6e81300d54ce2fef53e635b95fe3c):
+after the Browser's initial announcement, a fresh v2.1.0 resolver could not resolve
+its generated `.local` candidate before the fixture's four-second deadline.
+v2.2.2 resolved the same name in about 12 ms; another fresh old resolver still
+timed out. The upstream repair sends separate A/AAAA questions without the
+unicast-response bit that Chromium rejects. This fixes an address-resolution
+boundary useful to App-to-Browser edges; it is not a field success-rate result
+or proof of the cause of an unmatched report. Peer-reflexive discovery can also
+let a connection succeed despite failed mDNS resolution.
+
+The package-major adaptations retain Pion's STUN transaction owner and SRTP
+buffer bounds/attributes. LiveKit forwarding and the existing ICE recovery
+owners remain unchanged. Chrome 152 and Firefox 151.0.3 recovered synthetic VP8,
+reverse RTCP and echoed data through ordinary ICE restart after the selected
+UDP path was cut. Shared forwarding, Native edges, SFU and STUN tests passed,
+including Linux race checks and a disposable-namespace interface-replacement
+control. No new automatic renomination, probing loop or retry budget is enabled.
+
+Keep Piik's fresh-interface mux and connection-owned STUN/mapping repairs: the
+newer framework still snapshots its default interface view and caches successful
+universal-mux observations. An upstream release-note match is not sufficient to
+remove these protections. Physical network/device coverage remains in
+[verification status](../verification-status.md#remaining-device-and-network-acceptance).
 
 #### Pion Renomination Preflight
 
diff --git a/docs/todo.md b/docs/todo.md
index 44e83b061..cfb17f607 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -215,9 +215,10 @@ asymmetric network restrictions. The
 [Browser-compatible assessment](./research/nat-traversal.md#browser-compatible-follow-up)
 owns current literature and applicability. Do not infer a benefit from another
 stack's success percentage or add a new retry/transport owner without evidence.
-Review the newer stable Pion ICE/WebRTC fixes against the pinned Native/SFU
-composition, especially gathering generations, STUN retransmission and mDNS;
-accept dependency changes only after focused interoperability/recovery controls.
+The candidate's stable Pion upgrade has local Browser resolution and
+interoperability/recovery evidence in that assessment. Include the upgraded
+Native/SFU composition in physical-network acceptance; local success is not a
+measured increase in field hole-punching success.
 The [renomination preflight](./research/nat-traversal.md#pion-renomination-preflight)
 rejects enabling the current automatic option: Firefox's recovered video did not
 restore reverse feedback. Keep standard ICE recovery while that boundary remains.
diff --git a/go.mod b/go.mod
index eaef584e7..8d97a75d7 100644
--- a/go.mod
+++ b/go.mod
@@ -21,16 +21,16 @@ require (
 	github.com/livekit/protocol v1.50.5-0.20260821144838-17c16cf496fd
 	github.com/livekit/server-sdk-go/v2 v2.14.0
 	github.com/netbirdio/go-nat v0.0.0-20260821095157-6b2c8c5c74e8
-	github.com/pion/ice/v4 v4.4.0
-	github.com/pion/interceptor v0.1.47
+	github.com/pion/ice/v4 v4.4.7
+	github.com/pion/interceptor v0.1.49
 	github.com/pion/logging v0.2.4
-	github.com/pion/rtcp v1.2.17
+	github.com/pion/rtcp v1.2.19
 	github.com/pion/rtp v1.10.5
-	github.com/pion/sdp/v3 v3.0.19
-	github.com/pion/stun/v3 v3.1.7
-	github.com/pion/transport/v4 v4.1.1
-	github.com/pion/turn/v5 v5.0.13
-	github.com/pion/webrtc/v4 v4.2.19
+	github.com/pion/sdp/v3 v3.0.20
+	github.com/pion/stun/v4 v4.0.1
+	github.com/pion/transport/v5 v5.1.1
+	github.com/pion/turn/v5 v5.1.2
+	github.com/pion/webrtc/v4 v4.2.23
 	github.com/thesyncim/gopus v0.1.1
 	go.uber.org/zap v1.28.0
 	golang.org/x/crypto v0.56.0
@@ -96,12 +96,13 @@ require (
 	github.com/nats-io/nuid v1.0.1 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/petermattis/goid v0.0.0-20260725062400-500c67a39b75 // indirect
-	github.com/pion/datachannel v1.6.2 // indirect
-	github.com/pion/dtls/v3 v3.1.5 // indirect
-	github.com/pion/mdns/v2 v2.1.0 // indirect
+	github.com/pion/datachannel v1.6.3 // indirect
+	github.com/pion/dtls/v3 v3.1.10 // indirect
+	github.com/pion/mdns/v2 v2.2.2 // indirect
 	github.com/pion/randutil v0.1.0 // indirect
-	github.com/pion/sctp v1.11.1 // indirect
-	github.com/pion/srtp/v3 v3.0.13 // indirect
+	github.com/pion/sctp v1.12.0 // indirect
+	github.com/pion/srtp/v3 v3.1.3 // indirect
+	github.com/pion/transport/v4 v4.1.1 // indirect
 	github.com/prometheus/client_golang v1.24.1 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.70.1 // indirect
diff --git a/go.sum b/go.sum
index d5c5957be..00b20a39a 100644
--- a/go.sum
+++ b/go.sum
@@ -235,40 +235,40 @@ github.com/ory/dockertest/v4 v4.0.0 h1:i19aFsO/VXE0VrMk4ifnKW4G/KIJ93PCjLOslxXoP
 github.com/ory/dockertest/v4 v4.0.0/go.mod h1:b5Ofu8VIxWNhXFvQcLu17pRNQdoUBKtXBW74G4Ygzx8=
 github.com/petermattis/goid v0.0.0-20260725062400-500c67a39b75 h1:VmZ6mKVkxavKEhEy4ZYyV7BwBYBFBP0TwIqmLk84fpU=
 github.com/petermattis/goid v0.0.0-20260725062400-500c67a39b75/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
-github.com/pion/datachannel v1.6.2 h1:7EXQ8TH3vTouBUdRWYbcX2edSx9Yj6k5zl5P+qyxEPc=
-github.com/pion/datachannel v1.6.2/go.mod h1:pzbdAZvyGtXbcHM1hBbsFaOTf40lZizU/dNlvVOak6E=
-github.com/pion/dtls/v3 v3.1.5 h1:9xJtVsHwMYeSjPp5Hh1FTis4DchnQWtnOa5o+6ygqfc=
-github.com/pion/dtls/v3 v3.1.5/go.mod h1:gz1K4jg6c+fq86oQMH4pilpCEOEPwmEr2jY+VcF/mkU=
-github.com/pion/ice/v4 v4.4.0 h1:wvHDDqimaC38Y7MVpD46Y63p246ChvXd87VKoLYS5b4=
-github.com/pion/ice/v4 v4.4.0/go.mod h1:obAyD+J+Hzs7QA7Y8YXHp5uIn6gb7z87pKedXZkrcFU=
-github.com/pion/interceptor v0.1.47 h1:yw8t5pJ2f8t78NgU+8EmxhaqYLXS7uFCC/tAGOaSDBo=
-github.com/pion/interceptor v0.1.47/go.mod h1:7yoRBzaIDETPC6cIN8Zj9EyGqHv1ImOpcTFPha6MuOM=
+github.com/pion/datachannel v1.6.3 h1:HZAYLpunVI0xi057ZiANl558d0uSpomcWw4UEPz3qXs=
+github.com/pion/datachannel v1.6.3/go.mod h1:oRmkXVVXxkUbqa8MatgdNHW29kvtQY3HUdjJQsfv2GE=
+github.com/pion/dtls/v3 v3.1.10 h1:HWC+QCZitP/ApADS/6+g7UIw2YmLgoK3CsynnjPJgMo=
+github.com/pion/dtls/v3 v3.1.10/go.mod h1:iKFQNYrjsN2TiA2YKKMqB9MOZaFpjFULBI/A4sW0eyc=
+github.com/pion/ice/v4 v4.4.7 h1:JiI6VId3XnIztxKE8RjTC0SeXrp7ppkAO0jGez3/sIE=
+github.com/pion/ice/v4 v4.4.7/go.mod h1:zCRRg4Mkpdbx9B+75fd4z2APvIXeIraeUOB7IMPt8mU=
+github.com/pion/interceptor v0.1.49 h1:iyBsNHRoLNNXZiJA/DdGvJgdyfS8YWDCzxIAlVjt5nY=
+github.com/pion/interceptor v0.1.49/go.mod h1:MZ6PJkja/TCo350HAnBrs/rUIyad9mWjpcvytrf3ViQ=
 github.com/pion/logging v0.2.4 h1:tTew+7cmQ+Mc1pTBLKH2puKsOvhm32dROumOZ655zB8=
 github.com/pion/logging v0.2.4/go.mod h1:DffhXTKYdNZU+KtJ5pyQDjvOAh/GsNSyv1lbkFbe3so=
-github.com/pion/mdns/v2 v2.1.0 h1:3IJ9+Xio6tWYjhN6WwuY142P/1jA0D5ERaIqawg/fOY=
-github.com/pion/mdns/v2 v2.1.0/go.mod h1:pcez23GdynwcfRU1977qKU0mDxSeucttSHbCSfFOd9A=
+github.com/pion/mdns/v2 v2.2.2 h1:qq9Kj3PnjF0mfSwd8Icu0CXy5aoYdQKnNUIsGPeUpgk=
+github.com/pion/mdns/v2 v2.2.2/go.mod h1:ZX5f0AAH1D6TOjdjvcBORZZHaZuG0t9+br78lHEwiJ4=
 github.com/pion/randutil v0.1.0 h1:CFG1UdESneORglEsnimhUjf33Rwjubwj6xfiOXBa3mA=
 github.com/pion/randutil v0.1.0/go.mod h1:XcJrSMMbbMRhASFVOlj/5hQial/Y8oH/HVo7TBZq+j8=
-github.com/pion/rtcp v1.2.17 h1:PxiT6L79yPZKtXIsXdG1eakBl6dtBj4x+4oVEL0DlSw=
-github.com/pion/rtcp v1.2.17/go.mod h1:7kBpuBJaWwax4hzc/pgexY8vkOpvh8atgYDbaKZq0iU=
+github.com/pion/rtcp v1.2.19 h1:T79lR2Tfd/7zj+41nsUrftrUEee+Z03NQr9GSPSQ/WU=
+github.com/pion/rtcp v1.2.19/go.mod h1:vX7Es6skWYm4oVvOSC5+4WHLYUTZHcbGNmk5wjzMGH4=
 github.com/pion/rtp v1.10.5 h1:ip0HhO/wYZqQ4bKS+R99KnZh/GRCmIT0jDXikub7vlE=
 github.com/pion/rtp v1.10.5/go.mod h1:Au8fc6cEByy8RLTwKTQTEeQqDB/SJDxwL4mZuxYA5Pk=
-github.com/pion/sctp v1.11.1 h1:O4dIFyURw1KTST7w+gtD4gLeYXkhPa0xXLHMMoe/OSA=
-github.com/pion/sctp v1.11.1/go.mod h1:7KFmTwLcoYgJs/Z+99nJvsWL0qDpuyloSI0RbAqlrz0=
-github.com/pion/sdp/v3 v3.0.19 h1:1VMKs3gIkTQV5M3hNKfTAPrDXSNrYtOlmOD8+mSZUGQ=
-github.com/pion/sdp/v3 v3.0.19/go.mod h1:dE5WOSlzXrtiE/iuZqe9n+AcEbOjtAd3k5m5NtlV/qU=
-github.com/pion/srtp/v3 v3.0.13 h1:FmQaqgNbN1vUtMhEsmj8trldc3lNZr1xmN7nl8CyX+Q=
-github.com/pion/srtp/v3 v3.0.13/go.mod h1:7qR3L69t8RX0EPVQwGNwCa1Gy9keKKNDpWwQzZbeXDY=
-github.com/pion/stun/v3 v3.1.7 h1:uRXMTlGLf89WgItGNyZ6aR5jMTX0NBbybXADpQCzn+E=
-github.com/pion/stun/v3 v3.1.7/go.mod h1:Nq77RW4aRrSNrltf2ksUJLjxWeipj4lnlgdsYIxC8g8=
-github.com/pion/transport/v3 v3.1.1 h1:Tr684+fnnKlhPceU+ICdrw6KKkTms+5qHMgw6bIkYOM=
-github.com/pion/transport/v3 v3.1.1/go.mod h1:+c2eewC5WJQHiAA46fkMMzoYZSuGzA/7E2FPrOYHctQ=
+github.com/pion/sctp v1.12.0 h1:AzUdVkVBNyGY1W4crWO1/aOWzMaW3zsVHGrNuAfFQiI=
+github.com/pion/sctp v1.12.0/go.mod h1:6k1zrpkrxSwbisitn/AlzDQaa15DR49MFsrMochG/yc=
+github.com/pion/sdp/v3 v3.0.20 h1:TS6DViqcmp+49f0+mjw9anbr9xY3vJtsZewxAvlMCRQ=
+github.com/pion/sdp/v3 v3.0.20/go.mod h1:slIMXDK5OKj0nhISwjfeN18AzTBCt2LYZq9uPw0cU5Q=
+github.com/pion/srtp/v3 v3.1.3 h1:O3sfbfWfq/OyEaXRbX02Z0SNQRijS9nDdc/DEb8jxlU=
+github.com/pion/srtp/v3 v3.1.3/go.mod h1:v3uQtrCz9LH3aahau0jtzRDsWGwKkh4a0BiBwzzxhtQ=
+github.com/pion/stun/v4 v4.0.1 h1:S2ggK4hsUJJKoZfpL90uIqIRTj6xJ0NOIEkXgcpQif0=
+github.com/pion/stun/v4 v4.0.1/go.mod h1:byktbPA8U7HjJ2H8w3moP7nzq0Q+kYNulvMLPaubQL4=
 github.com/pion/transport/v4 v4.1.1 h1:kEBtbp1sRad0tnkREDNJ3fmop/CR8p/YxXnpFbn9tqo=
 github.com/pion/transport/v4 v4.1.1/go.mod h1:Oxo5oODQvjFF7NkHBBz3f4fZXLB7x03uLVuzfYeA5pE=
-github.com/pion/turn/v5 v5.0.13 h1:erHOsJyxuV6QK54+PjWJhe8u1O7BM3a/US0zYJJsnx4=
-github.com/pion/turn/v5 v5.0.13/go.mod h1:btdOovUYdYc8iBnvt87JHN4Pa1XV5UiLaCYe4ay3o9A=
-github.com/pion/webrtc/v4 v4.2.19 h1:2usG6s7eXMF08tqqoP3A4CX5XHArZsi1qeXDIIvXMeE=
-github.com/pion/webrtc/v4 v4.2.19/go.mod h1:jWMn3KOGxyYFYJohzIHhBc4VrJiyS+94A1OfErYzN34=
+github.com/pion/transport/v5 v5.1.1 h1:Sauq8YJqRopgRfIgnpfKpdpKG14g0N4jWlRgpWsEfN8=
+github.com/pion/transport/v5 v5.1.1/go.mod h1:Qxw6fCEjFWQkRDZOhS4Vf+neJBcihauvA3uyEa1J1F0=
+github.com/pion/turn/v5 v5.1.2 h1:acEOO+D5txJ52vKfcilmSMItfP23Q9K6pJ1LM5P2VV0=
+github.com/pion/turn/v5 v5.1.2/go.mod h1:57Oadc8fHnac15VFyCd6nEaBTVZBxQe2POUMD4lsHRA=
+github.com/pion/webrtc/v4 v4.2.23 h1:AlVixhTtQmxrheSv6lAH0w2sH5qjM7OTos5Lt811nk0=
+github.com/pion/webrtc/v4 v4.2.23/go.mod h1:vzf5RQ0uMBuXAYTK2pabZUtnZyj2t3TF88eL4xzQZvI=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=
diff --git a/internal/app/mediaedge/ice_socket.go b/internal/app/mediaedge/ice_socket.go
index 0e458aee9..5c5ff9798 100644
--- a/internal/app/mediaedge/ice_socket.go
+++ b/internal/app/mediaedge/ice_socket.go
@@ -14,7 +14,7 @@ import (
 	"github.com/TNTcraftHIM/Piik/internal/diagnostics"
 	"github.com/TNTcraftHIM/Piik/internal/media/forwarding"
 	"github.com/pion/ice/v4"
-	"github.com/pion/stun/v3"
+	"github.com/pion/stun/v4"
 	"github.com/pion/webrtc/v4"
 	"golang.org/x/sync/singleflight"
 )
diff --git a/internal/app/mediaedge/receiver_test.go b/internal/app/mediaedge/receiver_test.go
index af8ecc8dd..46e3c0a5d 100644
--- a/internal/app/mediaedge/receiver_test.go
+++ b/internal/app/mediaedge/receiver_test.go
@@ -12,7 +12,7 @@ import (
 	"github.com/livekit/livekit-server/pkg/sfu"
 	"github.com/pion/rtp"
 	"github.com/pion/sdp/v3"
-	"github.com/pion/stun/v3"
+	"github.com/pion/stun/v4"
 	"github.com/pion/webrtc/v4"
 )
 
diff --git a/internal/app/mediaedge/relay_network_fixture_test.go b/internal/app/mediaedge/relay_network_fixture_test.go
index 8f1958b0e..9d80ef25e 100644
--- a/internal/app/mediaedge/relay_network_fixture_test.go
+++ b/internal/app/mediaedge/relay_network_fixture_test.go
@@ -19,7 +19,7 @@ import (
 	"github.com/pion/rtcp"
 	"github.com/pion/rtp"
 	"github.com/pion/rtp/codecs"
-	"github.com/pion/transport/v4/vnet"
+	"github.com/pion/transport/v5/vnet"
 	"github.com/pion/webrtc/v4"
 )
 
diff --git a/internal/app/mediaedge/stun.go b/internal/app/mediaedge/stun.go
index c6e3b4e22..82dacd97e 100644
--- a/internal/app/mediaedge/stun.go
+++ b/internal/app/mediaedge/stun.go
@@ -6,7 +6,7 @@ import (
 	"net"
 
 	"github.com/TNTcraftHIM/Piik/internal/diagnostics"
-	"github.com/pion/stun/v3"
+	"github.com/pion/stun/v4"
 )
 
 // Only in-flight discovery is shared. Completed observations must not survive
diff --git a/internal/app/mediaedge/stun_test.go b/internal/app/mediaedge/stun_test.go
index d41f278ff..f4beaa41a 100644
--- a/internal/app/mediaedge/stun_test.go
+++ b/internal/app/mediaedge/stun_test.go
@@ -11,7 +11,7 @@ import (
 
 	"github.com/livekit/livekit-server/pkg/sfu"
 	"github.com/pion/rtp"
-	"github.com/pion/stun/v3"
+	"github.com/pion/stun/v4"
 	"github.com/pion/webrtc/v4"
 )
 
diff --git a/internal/media/forwarding/ice.go b/internal/media/forwarding/ice.go
index cafec6f81..85c99f018 100644
--- a/internal/media/forwarding/ice.go
+++ b/internal/media/forwarding/ice.go
@@ -2,8 +2,8 @@ package forwarding
 
 import (
 	"github.com/pion/ice/v4"
-	"github.com/pion/transport/v4"
-	"github.com/pion/transport/v4/stdnet"
+	"github.com/pion/transport/v5"
+	"github.com/pion/transport/v5/stdnet"
 )
 
 // NewUDPMux retains Pion's socket and candidate policy, but reads current local
diff --git a/internal/media/forwarding/packet_buffer.go b/internal/media/forwarding/packet_buffer.go
new file mode 100644
index 000000000..ebd6d514b
--- /dev/null
+++ b/internal/media/forwarding/packet_buffer.go
@@ -0,0 +1,26 @@
+package forwarding
+
+import "github.com/pion/transport/v5/packetio"
+
+// packetBuffer adapts Pion's bounded packet queue to its SRTP BufferFactory's
+// io.ReadWriteCloser contract, retaining optional packet attributes.
+type packetBuffer struct {
+	*packetio.Buffer
+}
+
+func (buffer *packetBuffer) Read(payload []byte) (int, error) {
+	n, _, err := buffer.Buffer.Read(payload, nil)
+	return n, err
+}
+
+func (buffer *packetBuffer) Write(payload []byte) (int, error) {
+	return buffer.Buffer.Write(payload, nil)
+}
+
+func (buffer *packetBuffer) ReadWithAttributes(payload []byte, attributes packetio.Attributes) (int, packetio.Attributes, error) {
+	return buffer.Buffer.Read(payload, attributes)
+}
+
+func (buffer *packetBuffer) WriteWithAttributes(payload []byte, attributes packetio.Attributes) (int, error) {
+	return buffer.Buffer.Write(payload, attributes)
+}
diff --git a/internal/media/forwarding/packet_buffer_test.go b/internal/media/forwarding/packet_buffer_test.go
new file mode 100644
index 000000000..84096224d
--- /dev/null
+++ b/internal/media/forwarding/packet_buffer_test.go
@@ -0,0 +1,43 @@
+package forwarding
+
+import (
+	"errors"
+	"io"
+	"testing"
+	"time"
+
+	"github.com/pion/transport/v5/packetio"
+)
+
+func TestPacketBufferRetainsSRTPContract(t *testing.T) {
+	buffer := &packetBuffer{Buffer: packetio.NewBuffer()}
+	buffer.SetLimitCount(2)
+	if err := buffer.SetReadDeadline(time.Now().Add(time.Second)); err != nil {
+		t.Fatal(err)
+	}
+	var stream io.ReadWriteCloser = buffer
+	t.Cleanup(func() { _ = stream.Close() })
+	if _, err := stream.Write([]byte{1}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := buffer.WriteWithAttributes([]byte{2}, packetio.Attributes{{Key: "arrival", Value: 7}}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := stream.Write([]byte{3}); !errors.Is(err, packetio.ErrFull) {
+		t.Fatalf("queue limit lost at SRTP boundary: %v", err)
+	}
+	payload := make([]byte, 8)
+	if n, err := stream.Read(payload); err != nil || n != 1 || payload[0] != 1 {
+		t.Fatalf("ordinary SRTP read: n=%d err=%v", n, err)
+	}
+	n, attributes, err := buffer.ReadWithAttributes(payload, nil)
+	if err != nil || n != 1 || payload[0] != 2 || attributes.Get("arrival") != 7 {
+		t.Fatalf("packet or attributes lost: n=%d attributes=%v err=%v", n, attributes, err)
+	}
+	if err := stream.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := stream.Read(payload); !errors.Is(err, io.EOF) {
+		t.Fatalf("closed SRTP buffer did not finish: %v", err)
+	}
+}
diff --git a/internal/media/forwarding/publication.go b/internal/media/forwarding/publication.go
index 08537672a..84c1922c6 100644
--- a/internal/media/forwarding/publication.go
+++ b/internal/media/forwarding/publication.go
@@ -23,7 +23,7 @@ import (
 	"github.com/pion/interceptor"
 	"github.com/pion/rtcp"
 	"github.com/pion/rtp"
-	"github.com/pion/transport/v4/packetio"
+	"github.com/pion/transport/v5/packetio"
 	"github.com/pion/webrtc/v4"
 )
 
@@ -110,7 +110,7 @@ func NewPublication(options TransportOptions) (_ *Publication, err error) {
 				return reader
 			}
 		}
-		input := packetio.NewBuffer()
+		input := &packetBuffer{Buffer: packetio.NewBuffer()}
 		limit := 1_000_000
 		if kind == packetio.RTCPBufferPacket {
 			limit = 100_000
diff --git a/internal/media/forwarding/recovery_test.go b/internal/media/forwarding/recovery_test.go
index 6edcae045..733ad6ede 100644
--- a/internal/media/forwarding/recovery_test.go
+++ b/internal/media/forwarding/recovery_test.go
@@ -17,7 +17,7 @@ import (
 	"github.com/pion/ice/v4"
 	"github.com/pion/interceptor"
 	"github.com/pion/logging"
-	"github.com/pion/transport/v4/vnet"
+	"github.com/pion/transport/v5/vnet"
 	"github.com/pion/webrtc/v4"
 	rtmedia "github.com/pion/webrtc/v4/pkg/media"
 	"github.com/thesyncim/gopus"
diff --git a/internal/media/forwarding/transport.go b/internal/media/forwarding/transport.go
index eb33fed90..2f872a9a6 100644
--- a/internal/media/forwarding/transport.go
+++ b/internal/media/forwarding/transport.go
@@ -23,7 +23,7 @@ import (
 	"github.com/pion/interceptor"
 	"github.com/pion/rtcp"
 	"github.com/pion/rtp"
-	"github.com/pion/transport/v4/packetio"
+	"github.com/pion/transport/v5/packetio"
 	"github.com/pion/webrtc/v4"
 )
 
@@ -102,7 +102,7 @@ func NewTransport(options TransportOptions) (_ *Transport, err error) {
 			}
 		}
 		// Preserve stock Pion SRTP/SRTCP bounds for unclaimed streams, including audio.
-		input := packetio.NewBuffer()
+		input := &packetBuffer{Buffer: packetio.NewBuffer()}
 		limit := 1_000_000
 		if kind == packetio.RTCPBufferPacket {
 			limit = 100_000
diff --git a/internal/server/stun/server_test.go b/internal/server/stun/server_test.go
index 958f644ad..0c620bc69 100644
--- a/internal/server/stun/server_test.go
+++ b/internal/server/stun/server_test.go
@@ -6,7 +6,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/pion/stun/v3"
+	"github.com/pion/stun/v4"
 )
 
 func TestThreeSTUNListenersWithoutRelayAndWithCompleteShutdown(t *testing.T) {

From 091df10fa814ceb4def09230540bc930956c35c6 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 22:58:20 +0800
Subject: [PATCH 142/262] docs(network): assess browser handshake latency
 proposals

---
 docs/research/nat-traversal.md | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index e6f7f266e..6ac18b01e 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -386,6 +386,16 @@ against that same endpoint pair and relay policy.
   interest does not establish interoperable product support. Evaluate only
   framework-owned negotiation and stock Browser builds, retaining authentication
   and ordinary fallback. A Browser field-trial flag is not an adoption path.
+- The July 2026 [WARP draft](https://datatracker.ietf.org/doc/html/draft-uberti-tsvwg-warp-00)
+  combines SPED, SCTP setup negotiation (SNAP) and DTLS 1.3. Its combined model
+  reduces media-and-data setup from six round trips to two; media alone starts
+  after four round trips in its baseline. These are handshake savings, not
+  evidence that previously unreachable NAT pairs connect. Pion's
+  [ICE v5 release candidate](https://github.com/pion/ice/releases/tag/v5.0.0-rc.6)
+  already contains SPED/DTLS 1.3 work, so an expired individual draft does not
+  imply abandoned implementation. Follow stable framework support and negotiated
+  stock-Browser interoperability before a latency comparison; this assessment
+  does not accept a prerelease transport upgrade or changes to ICE consent.
 
 #### Stable Pion Interoperability
 

From 55f5f6be8b29c09497ee6bbf8a921dbc65276112 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 23:12:52 +0800
Subject: [PATCH 143/262] fix(ui): align media input drafts and responsive
 settings

---
 .../components/living/QualityPresets.tsx      | 71 +++++++++++++--
 src/client/pages/ControlsPreview.tsx          |  9 +-
 src/client/pages/HostPage.tsx                 | 87 +------------------
 src/client/styles.css                         |  4 +-
 4 files changed, 78 insertions(+), 93 deletions(-)

diff --git a/src/client/components/living/QualityPresets.tsx b/src/client/components/living/QualityPresets.tsx
index 7765e3e59..289147fda 100644
--- a/src/client/components/living/QualityPresets.tsx
+++ b/src/client/components/living/QualityPresets.tsx
@@ -1,10 +1,13 @@
-import { Fragment } from "react";
+import { Fragment, useRef } from "react";
+import { MIN_AUDIO_BITRATE } from "../../../shared/protocol";
 import {
   QUALITY_PROFILES, QUALITY_PROFILE_KEYS, QUALITY_RESOLUTIONS, qualityResolutionEqual,
   captureFramerateCeiling, VIDEO_CAPTURE_LIMITS, type VideoCaptureLimits, type QualityProfileId, type QualityResolution,
+  SCREEN_AUDIO_BITRATES, type ScreenAudioPreset,
 } from "../../media/quality";
-import { useCopy } from "../../ui/copy";
-import { Chip } from "./primitives";
+import { useCopy, type CopyKey } from "../../ui/copy";
+import { Glyph } from "../../ui/icons";
+import { Cap, Chip } from "./primitives";
 import { QualityTileGlyph } from "./QualityTileGlyph";
 import { Tooltip } from "./Tooltip";
 
@@ -40,6 +43,7 @@ export function ResolutionControl({ value, limits, disabled, onChange }: {
   onChange: (resolution: QualityResolution) => void;
 }) {
   const { t, vis } = useCopy();
+  const controls = useRef<HTMLDivElement>(null);
   const axes = ["width", "height"] as const;
   const reset = (container: HTMLElement) => {
     for (const axis of axes) container.querySelector<HTMLInputElement>(`input[name="${axis}"]`)!.value = String(value[axis]);
@@ -58,7 +62,7 @@ export function ResolutionControl({ value, limits, disabled, onChange }: {
     }
     if (!qualityResolutionEqual(value, next)) onChange(next);
   };
-  return <div className="lr-resolution-controls"
+  return <div className="lr-resolution-controls" ref={controls}
     onBlur={event => {
       if (!event.currentTarget.contains(event.relatedTarget)) apply(event.currentTarget);
     }}
@@ -73,7 +77,11 @@ export function ResolutionControl({ value, limits, disabled, onChange }: {
       {Object.entries(QUALITY_RESOLUTIONS).map(([label, resolution]) => <Chip key={label}
         selected={qualityResolutionEqual(value, resolution)}
         disabled={disabled || captureFramerateCeiling(resolution, limits) < 15}
-        title={label} hint="hint-quality" onClick={() => onChange(resolution)}>{label}</Chip>)}
+        title={label} hint="hint-quality" onClick={() => {
+          // Selecting even the current preset replaces an unsubmitted draft.
+          reset(controls.current!);
+          onChange(resolution);
+        }}>{label}</Chip>)}
     </div>
     <Tooltip kind="hint-quality" text={vis ? undefined : t("host.video.resolutionHint", {
       width: String(limits.maxVideoResolution.width), height: String(limits.maxVideoResolution.height),
@@ -92,3 +100,56 @@ export function ResolutionControl({ value, limits, disabled, onChange }: {
     </Tooltip>
   </div>;
 }
+
+const AUDIO_QUALITY_CAPTIONS: Record<ScreenAudioPreset, CopyKey> = {
+  saver: "host.advanced.audio.saver",
+  music: "host.advanced.audio.music",
+  "very-high": "host.advanced.audio.veryHigh",
+};
+
+export function AudioBitrateControl({ value, max, disabled, onChange }: {
+  value: number;
+  max: number;
+  disabled: boolean;
+  onChange: (bitrate: number) => void;
+}) {
+  const { t, vis } = useCopy();
+  return <div className="lr-door-group">
+    <span className="lr-door-glyph"><Glyph name="speaker" size={19} /><Cap k="host.advanced.audio" /></span>
+    <div className="lr-row-group" role="group" aria-label={t("host.advanced.audio")}>
+      {(Object.keys(SCREEN_AUDIO_BITRATES) as ScreenAudioPreset[]).map(preset => {
+        const bitrate = SCREEN_AUDIO_BITRATES[preset];
+        return <Chip key={preset} selected={value === bitrate} disabled={disabled || bitrate > max}
+          title={t("host.audio.title", { label: t(AUDIO_QUALITY_CAPTIONS[preset]), kbps: String(bitrate / 1_000) })}
+          hint="hint-audio-quality" onClick={() => onChange(bitrate)}>
+          <Cap k={AUDIO_QUALITY_CAPTIONS[preset]} /><small className="lr-audio-rate">{bitrate / 1_000}</small>
+        </Chip>;
+      })}
+    </div>
+    <Tooltip kind="hint-audio-quality" text={vis ? undefined : t("host.audio.bitrateHint", {
+      min: String(MIN_AUDIO_BITRATE / 1_000), max: String(max / 1_000),
+    })}>
+      <label className="lr-input lr-audio-bitrate">
+        <input type="number" inputMode="numeric" name="audioBitrate" key={value}
+          defaultValue={value / 1_000} min={MIN_AUDIO_BITRATE / 1_000} max={max / 1_000} step={1}
+          disabled={disabled} aria-label={t("host.advanced.audioBitrate")}
+          onBlur={event => {
+            const input = event.currentTarget;
+            if (!input.validity.valid || !Number.isFinite(input.valueAsNumber)) {
+              input.value = String(value / 1_000);
+              return;
+            }
+            if (input.valueAsNumber * 1_000 !== value) onChange(input.valueAsNumber * 1_000);
+          }}
+          onKeyDown={event => {
+            if (event.key !== "Enter" && event.key !== "Escape") return;
+            event.preventDefault();
+            event.stopPropagation();
+            if (event.key === "Escape") event.currentTarget.value = String(value / 1_000);
+            event.currentTarget.blur();
+          }} />
+        <span>kbps</span>
+      </label>
+    </Tooltip>
+  </div>;
+}
diff --git a/src/client/pages/ControlsPreview.tsx b/src/client/pages/ControlsPreview.tsx
index c639369b2..88380015d 100644
--- a/src/client/pages/ControlsPreview.tsx
+++ b/src/client/pages/ControlsPreview.tsx
@@ -19,9 +19,9 @@ import { LauncherForm, type AppMode } from "../components/living/LauncherForm";
 import { AppReleaseNotice } from "../components/living/AppReleaseNotice";
 import { useTheaterMode } from "../components/living/use-theater-mode";
 
-import { QualityPresets, ResolutionControl } from "../components/living/QualityPresets";
+import { AudioBitrateControl, QualityPresets, ResolutionControl } from "../components/living/QualityPresets";
 import { RoomCodeInput } from "../components/living/RoomCodeInput";
-import { VIDEO_CAPTURE_LIMITS, QUALITY_PROFILES, type QualityProfileId, type QualityResolution } from "../media/quality";
+import { MAX_SCREEN_AUDIO_BITRATE, VIDEO_CAPTURE_LIMITS, QUALITY_PROFILES, type QualityProfileId, type QualityResolution } from "../media/quality";
 import type { loadCameraPreviews } from "../media/camera-previews";
 import { Tooltip } from "../components/living/Tooltip";
 import { StatusIndicator } from "../components/living/StatusIndicator";
@@ -58,6 +58,7 @@ export function ControlsPreview() {
   const [microphoneDevice, setMicrophoneDevice] = useState("");
   const [sharingSettings, setSharingSettings] = useState(false);
   const [resolution, setResolution] = useState<QualityResolution>(QUALITY_PROFILES["1080p30"].resolution);
+  const [audioBitrate, setAudioBitrate] = useState<number>(QUALITY_PROFILES["1080p30"].maxAudioBitrate);
   const [launchMode, setLaunchMode] = useState<AppMode>("link");
   const [majorUpdate, setMajorUpdate] = useState(true);
   const releaseVersion = majorUpdate ? "v2.0.0" : "v1.1.0";
@@ -127,7 +128,9 @@ export function ControlsPreview() {
             <LiveAudioExclusion load={previewApplications} value={excludedAudio} onChange={setExcludedAudio} disabled={!sound || paused} />
           </div><HostMicrophoneSettings deviceId={microphoneDevice} onDevice={setMicrophoneDevice} loadDevices={previewMicrophones}
             native enabled={microphone} disabled={paused} volume={microphoneVolume} onVolume={setMicrophoneVolume}
-            voiceProcessing={voiceProcessing} onVoiceProcessing={setVoiceProcessing} /></>}
+            voiceProcessing={voiceProcessing} onVoiceProcessing={setVoiceProcessing} />
+            <AudioBitrateControl value={audioBitrate} max={MAX_SCREEN_AUDIO_BITRATE}
+              disabled={false} onChange={setAudioBitrate} /></>}
         />
       </section>
       <section id="option-preview" className="cp-card">
diff --git a/src/client/pages/HostPage.tsx b/src/client/pages/HostPage.tsx
index 8991adcc4..a305eaccd 100644
--- a/src/client/pages/HostPage.tsx
+++ b/src/client/pages/HostPage.tsx
@@ -10,7 +10,6 @@ import {
 import {
   DEFAULT_ROUTE_POLICY,
   MAX_VIEWER_PASSWORD_LENGTH,
-  MIN_AUDIO_BITRATE,
   viewerPasswordSchema,
   type CreateRoomResponse,
   type ClientMessage,
@@ -53,7 +52,7 @@ import type { ComicKind } from "../components/living/Comic";
 import type { HintKind } from "../ui/visual-kinds";
 import type { ComicTone } from "../components/living/comic-presentation";
 import { Tooltip } from "../components/living/Tooltip";
-import { QualityPresets, ResolutionControl } from "../components/living/QualityPresets";
+import { AudioBitrateControl, QualityPresets, ResolutionControl } from "../components/living/QualityPresets";
 import { RoomCodeInput, RoomCodeError } from "../components/living/RoomCodeInput";
 import { MetricCell } from "../components/living/Metrics";
 import {
@@ -135,12 +134,10 @@ import {
   qualitySettingsLabel,
   screenAudioBitrate,
   MAX_SCREEN_AUDIO_BITRATE,
-  SCREEN_AUDIO_BITRATES,
   setMediaPaused,
   videoQualitySettingsEqual,
   type DegradationPreference,
   type QualitySettings,
-  type ScreenAudioPreset,
 } from "../media/quality";
 import { HostSfuRoute } from "../media/host-sfu-route";
 import { BrowserEncodingPool } from "../media/browser-encoding-pool";
@@ -236,12 +233,6 @@ const PREFERENCE_PRESENTATION: Record<
   },
 };
 
-const AUDIO_QUALITY_CAPTIONS: Record<ScreenAudioPreset, CopyKey> = {
-  saver: "host.advanced.audio.saver",
-  music: "host.advanced.audio.music",
-  "very-high": "host.advanced.audio.veryHigh",
-};
-
 type ViewerQualityEvidence = Extract<
   ServerMessage,
   { type: "viewer-quality-evidence" }
@@ -3992,79 +3983,9 @@ export function HostPage({
                   onVoiceProcessing={enabled => void changeMicrophone(microphoneEnabled, microphoneDevices.browser, enabled)}
                 />
               ) : null}
-              <div className="lr-door-group">
-                <span
-                  className="lr-door-glyph"
-                >
-                  <Glyph name="speaker" size={19} />
-                  <Cap k="host.advanced.audio" />
-                </span>
-                <div
-                  className="lr-row-group"
-                  role="group"
-                  aria-label={t("host.advanced.audio")}
-                >
-                  {(
-                    Object.keys(
-                      AUDIO_QUALITY_CAPTIONS,
-                    ) as ScreenAudioPreset[]
-                  ).map((audioQuality) => (
-                    <Chip
-                      key={audioQuality}
-                      selected={
-                        screenAudioBitrate(
-                          advancedQuality.maxAudioBitrate,
-                        ) === SCREEN_AUDIO_BITRATES[audioQuality]
-                      }
-                      disabled={phase === "starting" || switchingSource ||
-                        SCREEN_AUDIO_BITRATES[audioQuality] > audioBitrateCeiling}
-                      title={t("host.audio.title", {
-                        label: t(AUDIO_QUALITY_CAPTIONS[audioQuality]),
-                        kbps: String(
-                          SCREEN_AUDIO_BITRATES[audioQuality] / 1_000,
-                        ),
-                      })}
-                      hint="hint-audio-quality"
-                      onClick={() => changeMaxAudioBitrate(SCREEN_AUDIO_BITRATES[audioQuality])}
-                    >
-                      <Cap k={AUDIO_QUALITY_CAPTIONS[audioQuality]} />
-                      <small className="lr-audio-rate">
-                        {SCREEN_AUDIO_BITRATES[audioQuality] / 1_000}
-                      </small>
-                    </Chip>
-                  ))}
-                </div>
-                <Tooltip kind="hint-audio-quality" text={vis ? undefined : t("host.audio.bitrateHint", {
-                  min: String(MIN_AUDIO_BITRATE / 1_000), max: String(audioBitrateCeiling / 1_000),
-                })}>
-                  <label className="lr-input lr-audio-bitrate">
-                    <input type="number" inputMode="numeric"
-                      key={screenAudioBitrate(advancedQuality.maxAudioBitrate)}
-                      defaultValue={screenAudioBitrate(advancedQuality.maxAudioBitrate) / 1_000}
-                      min={MIN_AUDIO_BITRATE / 1_000}
-                      max={audioBitrateCeiling / 1_000} step={1}
-                      disabled={phase === "starting" || switchingSource}
-                      aria-label={t("host.advanced.audioBitrate")}
-                      onBlur={event => {
-                        const input = event.currentTarget;
-                        if (!input.validity.valid || !Number.isFinite(input.valueAsNumber)) {
-                          input.value = String(screenAudioBitrate(advancedQuality.maxAudioBitrate) / 1_000);
-                          return;
-                        }
-                        changeMaxAudioBitrate(input.valueAsNumber * 1_000);
-                      }}
-                      onKeyDown={event => {
-                        if (event.key === "Enter") event.currentTarget.blur();
-                        if (event.key === "Escape") {
-                          event.currentTarget.value = String(screenAudioBitrate(advancedQuality.maxAudioBitrate) / 1_000);
-                          event.currentTarget.blur();
-                          event.stopPropagation();
-                        }
-                      }} />
-                    <span>kbps</span>
-                  </label>
-                </Tooltip>
-              </div>
+              <AudioBitrateControl value={screenAudioBitrate(advancedQuality.maxAudioBitrate)}
+                max={audioBitrateCeiling} disabled={phase === "starting" || switchingSource}
+                onChange={changeMaxAudioBitrate} />
             </>}
             technical={<>
               <div className="lr-door-group">
diff --git a/src/client/styles.css b/src/client/styles.css
index fa225d2ac..7fd85d532 100644
--- a/src/client/styles.css
+++ b/src/client/styles.css
@@ -1822,7 +1822,7 @@ html[data-theme="dark"] .lr-switch::after { background: var(--ink); }
   margin: 10px auto 0;
 }
 .lr-stage-notices:empty { display: none; }
-.lr-sharing-settings { width: min(820px, 100%); margin: 0 auto; }
+.lr-sharing-settings { width: min(820px, 100%); margin: 0 auto; container: sharing-settings / inline-size; }
 .lr-sharing-panel {
   margin-top: 14px; padding: 22px; background: var(--paper);
   border: 1px solid var(--control-edge); border-radius: 24px; box-shadow: var(--control-shadow);
@@ -1851,7 +1851,7 @@ html[data-theme="dark"] .lr-switch::after { background: var(--ink); }
 .lr-sharing-technical > div { display: grid; gap: 18px; padding-top: 16px; }
 @keyframes lr-sharing-enter { from { opacity: 0; transform: translateY(-6px); } to { opacity: 1; transform: translateY(0); } }
 @media (prefers-reduced-motion: reduce) { .lr-sharing-panel { animation: none; } }
-@media (max-width: 680px) {
+@container sharing-settings (max-width: 680px) {
   .lr-sharing-panel { padding: 16px; border-radius: 20px; }
   .lr-sharing-columns { grid-template-columns: 1fr; gap: 22px; }
   .lr-sharing-limits { grid-template-columns: 1fr; }

From 82e3f253935cf4d74b5c0773dbf074e9858d7a54 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 23:29:49 +0800
Subject: [PATCH 144/262] fix(media): preserve macOS content geometry within
 output limits

---
 docs/research/native-client-media.md |  24 ++-
 docs/status.md                       |   3 +-
 docs/todo.md                         |   6 +-
 native/capture/darwin/README.md      |  10 +-
 native/capture/darwin/main.swift     | 270 ++++++++++++++++++++-------
 scripts/check-go.mjs                 |   1 +
 6 files changed, 230 insertions(+), 84 deletions(-)

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index da70412a5..614f16f4b 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -547,14 +547,22 @@ one pipeline, checks the output ceiling and image corners, and exercises the
 smallest derived output. Compilation and those regressions passed on Linux;
 Portal capture and hardware encoder resizing still need a physical device.
 
-macOS remains a concrete implementation gap: ScreenCaptureKit and VideoToolbox
-currently use the requested dimensions as a fixed canvas. The capture adapter
-also ignores per-frame content geometry. Apple's
-[capture sample](https://developer.apple.com/documentation/screencapturekit/capturing-screen-content-in-macos)
-distinguishes buffer dimensions, content rectangle and pixel scale; changing only
-the initial window size would not cover live resizing or Retina scale changes.
-Review that boundary under the existing capture/encoder owners, then verify
-portrait, small-source and resizing behavior with the macOS SDK and hardware.
+The macOS candidate now interprets ScreenCaptureKit's per-frame content rectangle,
+pixel scale and content scale, following Apple's
+[frame-metadata guidance](https://developer.apple.com/videos/play/wwdc2022/10155/).
+It retains the bounded capture surface, describes its content through CoreVideo's
+clean aperture and uses VideoToolbox's
+[source-aperture scaling](https://developer.apple.com/documentation/videotoolbox/kvtscalingmode_cropsourcetocleanaperture).
+Each existing output worker fits the unscaled source within its ceiling and
+replaces only its compression session when the fitted size changes. The frame
+envelope carries actual dimensions; declared output limits and room/route
+identity remain unchanged. Encoded-input derivation uses the same worker.
+
+This implementation has not yet been compiled with the macOS SDK or executed on
+macOS. The existing native check now includes content-geometry validation and
+extends hardware self-testing across successive source shapes. Run those checks
+on Apple silicon and Intel, then verify real window resizing, Retina transitions,
+cropped image fidelity and quiet-source recovery before accepting this boundary.
 
 Local synthetic-input controls exercised that production worker through four
 successive source sizes: 1080x1920, 3440x1440, 640x480 and 1920x1080. Under the
diff --git a/docs/status.md b/docs/status.md
index 8e2fd55fe..5f550cea1 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -70,7 +70,8 @@ Custom width/height controls apply combined size and frame-rate limits, admittin
 4K30. Windows and Linux output preserve source shape within the selected ceiling.
 The [media assessment](./research/native-client-media.md#media-capability-extension-assessment)
 owns local codec, derived-output, SFU, Browser/Native fanout and live-control
-evidence. macOS geometry, cross-browser/device and route-change acceptance, and
+evidence. The macOS geometry implementation still needs SDK compilation and
+hardware verification; cross-browser/device and route-change acceptance, and
 additional codecs remain open.
 Magicsock adoption is no-go for this candidate: its App-to-App augmentation does
 not improve the core App-to-Browser use case. The
diff --git a/docs/todo.md b/docs/todo.md
index cfb17f607..59d5b6d57 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -61,9 +61,9 @@ Implementation needs a concrete useful result within the product model.
   Extend Browser interoperability and mixed-topology checks to limited receivers
   and physical camera orientation behavior.
   Browser display capture, Browser relay and Browser-to-Native fanout now have
-  bounded high-resolution evidence. macOS geometry and physical 4K/game capture
-  remain open. Preserve safety
-  limits and framework-owned adaptation. The
+  bounded high-resolution evidence. macOS geometry SDK/hardware checks and
+  physical 4K/game capture remain open. Preserve safety limits and
+  framework-owned adaptation. The
   [audio controls](./research/browser-screen-audio-quality.md#numeric-bitrate-assessment)
   retain explicit receive-limit enforcement and the current 320 kbps sender
   ceiling. Physical listening, mobile and field-network acceptance remain open;
diff --git a/native/capture/darwin/README.md b/native/capture/darwin/README.md
index 610f63522..f0600fa1c 100644
--- a/native/capture/darwin/README.md
+++ b/native/capture/darwin/README.md
@@ -14,13 +14,17 @@ machine's architecture:
 
 ```sh
 sh native/capture/darwin/build.sh /outside/repository/build
+/outside/repository/build/piik-capture --geometry-self-test
 /outside/repository/build/piik-capture --self-test
 /outside/repository/build/piik-capture --probe
 ```
 
-`--self-test` encodes one in-memory 420v frame through the same hardware-only
-VideoToolbox path and requires a constrained-baseline SPS/PPS/IDR. It needs no
-Screen Recording permission. Real source selection, capture, and recovery still
+`--geometry-self-test` checks content cropping, Retina scaling and rejection of
+invalid frame geometry without requiring a hardware encoder. `--self-test`
+encodes successive landscape, portrait, ultrawide and small 420v buffers through
+one output worker, requiring the fitted dimensions and a constrained-baseline
+SPS/PPS/IDR after each size change. Neither needs Screen Recording permission.
+Real source selection, window resizing, display-scale changes and recovery still
 require a physical macOS gate.
 
 The first source-list or capture request is subject to the normal macOS Screen
diff --git a/native/capture/darwin/main.swift b/native/capture/darwin/main.swift
index 6e05e6a3a..716fa1724 100644
--- a/native/capture/darwin/main.swift
+++ b/native/capture/darwin/main.swift
@@ -47,6 +47,61 @@ private struct OutputProfile: Codable {
     var frameInterval: CMTime { CMTime(value: 1, timescale: fps) }
 }
 
+// Keep the captured pixels, their clean aperture and their unscaled size together.
+// ScreenCaptureKit may place scaled window content inside a larger fixed surface.
+private struct VideoImage {
+    let buffer: CVPixelBuffer
+    let size: CGSize
+
+    init(_ buffer: CVPixelBuffer) {
+        self.buffer = buffer
+        self.size = CVImageBufferGetCleanRect(buffer).size
+    }
+
+    init?(_ buffer: CVPixelBuffer, attachments: [SCStreamFrameInfo: Any]) {
+        guard let dictionary = attachments[.contentRect] as? [String: Any],
+              let rect = CGRect(dictionaryRepresentation: dictionary as CFDictionary),
+              let scale = attachments[.scaleFactor] as? CGFloat,
+              let contentScale = attachments[.contentScale] as? CGFloat,
+              scale.isFinite, scale > 0, contentScale.isFinite, contentScale > 0 else {
+            return nil
+        }
+        let crop = CGRect(x: rect.minX * scale, y: rect.minY * scale,
+                          width: rect.width * scale, height: rect.height * scale)
+        let bounds = CGRect(x: 0, y: 0, width: CVPixelBufferGetWidth(buffer),
+                            height: CVPixelBufferGetHeight(buffer))
+        guard crop.minX.isFinite, crop.minY.isFinite,
+              crop.width.isFinite, crop.height.isFinite,
+              crop.width > 0, crop.height > 0, bounds.contains(crop) else { return nil }
+        let size = CGSize(width: crop.width / contentScale, height: crop.height / contentScale)
+        guard size.width.isFinite, size.height.isFinite else { return nil }
+        // Set once before sharing the retained buffer with the output workers.
+        let aperture: [String: Any] = [
+            kCVImageBufferCleanApertureWidthKey as String: crop.width,
+            kCVImageBufferCleanApertureHeightKey as String: crop.height,
+            kCVImageBufferCleanApertureHorizontalOffsetKey as String: crop.midX - bounds.midX,
+            kCVImageBufferCleanApertureVerticalOffsetKey as String: crop.midY - bounds.midY,
+        ]
+        CVBufferSetAttachment(buffer, kCVImageBufferCleanApertureKey,
+                              aperture as CFDictionary, .shouldPropagate)
+        self.buffer = buffer
+        self.size = size
+    }
+
+    func fitted(to profile: OutputProfile) throws -> OutputProfile {
+        guard size.width.isFinite, size.height.isFinite, size.width > 0, size.height > 0 else {
+            throw CaptureFailure(description: "invalid video content size")
+        }
+        let scale = min(1, CGFloat(profile.width) / size.width,
+                        CGFloat(profile.height) / size.height)
+        return OutputProfile(
+            width: max(2, Int((size.width * scale / 2).rounded(.down)) * 2),
+            height: max(2, Int((size.height * scale / 2).rounded(.down)) * 2),
+            fps: profile.fps, bitrate: profile.bitrate
+        )
+    }
+}
+
 private enum CaptureControl {
     case keyFrame(Int)
     case active(Int, Bool)
@@ -220,21 +275,8 @@ private func shareableWindows(_ content: SCShareableContent) -> [(SCWindow, Capt
     }
 }
 
-private func hardwareH264Available() -> Bool {
-    do {
-        let encoder = try HardwareEncoder(
-            writer: ProtocolWriter(),
-            done: StopSignal()
-        )
-        encoder.close()
-        return true
-    } catch {
-        return false
-    }
-}
-
 private func probe() throws {
-    let encoders = hardwareH264Available()
+    let encoders = HardwareEncoder.isAvailable()
         ? [EncoderProbe(
             index: 0,
             name: "VideoToolbox H.264",
@@ -522,7 +564,7 @@ private func h264ProfileLevelID(_ payload: Data) -> String? {
 
 private final class HardwareEncoder {
     private struct Input {
-        let image: CVImageBuffer
+        let image: VideoImage
         let timestamp: CMTime
     }
 
@@ -542,9 +584,11 @@ private final class HardwareEncoder {
     private var currentBitrate: Int
     private var lastFrameBucket: Int64?
     private let sourceFrameRate: Int32
+    private let preference: DegradationPreference
     private let profile: OutputProfile
+    private var output: OutputProfile?
     private let layer: UInt8
-    private let onActive: (String) throws -> Void
+    private let onActive: (String, OutputProfile) throws -> Void
     private let onFailure: (Error) -> Void
 
     init(
@@ -553,9 +597,9 @@ private final class HardwareEncoder {
         profile sourceProfile: VideoProfile = defaultVideoProfile,
         output: OutputProfile? = nil,
         layer: UInt8 = 0,
-        onActive: @escaping (String) throws -> Void = { _ in },
+        onActive: @escaping (String, OutputProfile) throws -> Void = { _, _ in },
         onFailure: ((Error) -> Void)? = nil
-    ) throws {
+    ) {
         self.writer = writer
         let profile = output ?? OutputProfile(
             width: sourceProfile.width, height: sourceProfile.height,
@@ -563,12 +607,40 @@ private final class HardwareEncoder {
         )
         self.profile = profile
         self.sourceFrameRate = sourceProfile.frameRate
+        self.preference = sourceProfile.preference
         self.layer = layer
         self.onActive = onActive
         self.onFailure = onFailure ?? { done.signal($0) }
         self.queue = DispatchQueue(label: "piik.capture.encoder.\(layer)")
         desiredBitrate = profile.bitrate
         currentBitrate = profile.bitrate
+    }
+
+    static func isAvailable() -> Bool {
+        let encoder = HardwareEncoder(writer: ProtocolWriter(), done: StopSignal())
+        defer { encoder.close() }
+        do {
+            _ = try encoder.queue.sync {
+                try encoder.prepare(encoder.profile, bitrate: encoder.profile.bitrate)
+            }
+            return true
+        } catch {
+            return false
+        }
+    }
+
+    // Called only by the encoder queue after the previous frame has completed.
+    // A size change replaces this output's codec, not its capture or media route.
+    private func prepare(_ requested: OutputProfile, bitrate: Int) throws -> Bool {
+        if let output, output.width == requested.width, output.height == requested.height {
+            return false
+        }
+        if let session { VTCompressionSessionInvalidate(session) }
+        if let transfer { VTPixelTransferSessionInvalidate(transfer) }
+        session = nil
+        transfer = nil
+        output = nil
+        let profile = requested
         let specification = [
             kVTVideoEncoderSpecification_RequireHardwareAcceleratedVideoEncoder as String: true,
         ] as CFDictionary
@@ -603,20 +675,32 @@ private final class HardwareEncoder {
             try set(kVTCompressionPropertyKey_AllowFrameReordering, kCFBooleanFalse)
             try set(kVTCompressionPropertyKey_ProfileLevel,
                     kVTProfileLevel_H264_ConstrainedBaseline_AutoLevel)
-            try set(kVTCompressionPropertyKey_AverageBitRate, NSNumber(value: profile.bitrate))
+            try set(kVTCompressionPropertyKey_AverageBitRate, NSNumber(value: bitrate))
             try set(kVTCompressionPropertyKey_ExpectedFrameRate, NSNumber(value: profile.fps))
             try set(kVTCompressionPropertyKey_MaxKeyFrameInterval, NSNumber(value: profile.fps * 2))
-            if sourceProfile.preference != .balanced {
+            if preference != .balanced {
                 try? set(
                     kVTCompressionPropertyKey_PrioritizeEncodingSpeedOverQuality,
-                    sourceProfile.preference == .framerate ? kCFBooleanTrue : kCFBooleanFalse
+                    preference == .framerate ? kCFBooleanTrue : kCFBooleanFalse
                 )
             }
             try require(VTPixelTransferSessionCreate(
                 allocator: nil, pixelTransferSessionOut: &transfer
             ), "videotoolbox-scaler-create")
+            guard let transfer else {
+                throw CaptureFailure(description: "VideoToolbox returned no scaler")
+            }
+            try require(VTSessionSetProperty(transfer,
+                key: kVTPixelTransferPropertyKey_ScalingMode,
+                value: kVTScalingMode_CropSourceToCleanAperture), "videotoolbox-scale-mode")
             try require(VTCompressionSessionPrepareToEncodeFrames(created),
                         "videotoolbox-prepare")
+            output = profile
+            currentBitrate = bitrate
+            lock.lock()
+            decodable = false
+            lock.unlock()
+            return true
         } catch {
             VTCompressionSessionInvalidate(created)
             if let transfer { VTPixelTransferSessionInvalidate(transfer) }
@@ -646,7 +730,7 @@ private final class HardwareEncoder {
         lock.unlock()
     }
 
-    func encode(_ image: CVImageBuffer, timestamp: CMTime) {
+    func encode(_ image: VideoImage, timestamp: CMTime) {
         lock.lock()
         guard !closed, !failed else {
             lock.unlock()
@@ -678,18 +762,22 @@ private final class HardwareEncoder {
             return
         }
         pending = nil
-        let force = forceKeyFrame
+        var force = forceKeyFrame
         forceKeyFrame = false
         let bitrate = desiredBitrate
         encodingTimestamp = input.timestamp
         lock.unlock()
-        guard let session else { return }
         do {
+            let output = try input.image.fitted(to: profile)
+            if try prepare(output, bitrate: bitrate) { force = true }
+            guard let session else {
+                throw CaptureFailure(description: "VideoToolbox encoder is unavailable")
+            }
             if currentBitrate != bitrate {
                 try set(kVTCompressionPropertyKey_AverageBitRate, NSNumber(value: bitrate))
                 currentBitrate = bitrate
             }
-            let image = try scaled(input.image)
+            let image = try scaled(input.image.buffer, output: output)
             let properties = force
                 ? [kVTEncodeFrameOptionKey_ForceKeyFrame as String: true] as CFDictionary
                 : nil
@@ -731,7 +819,7 @@ private final class HardwareEncoder {
                         throw CaptureFailure(description: "invalid H.264 timestamp")
                     }
                     try writer.writeH264(
-                        payload, keyFrame: keyFrame, layer: layer, profile: profile,
+                        payload, keyFrame: keyFrame, layer: layer, profile: output,
                         timestamp: UInt64(CMTimeConvertScale(
                             pts, timescale: 10_000_000, method: .roundTowardZero
                         ).value),
@@ -741,7 +829,7 @@ private final class HardwareEncoder {
                         guard let profileLevelId = h264ProfileLevelID(payload) else {
                             throw CaptureFailure(description: "H.264 key frame has no SPS profile")
                         }
-                        try onActive(profileLevelId)
+                        try onActive(profileLevelId, output)
                     }
                 } catch {
                     if force { requestKeyFrame() }
@@ -769,9 +857,11 @@ private final class HardwareEncoder {
         if current { queue.async { self.encodePending() } }
     }
 
-    private func scaled(_ image: CVImageBuffer) throws -> CVPixelBuffer {
-        if CVPixelBufferGetWidth(image) == profile.width &&
-            CVPixelBufferGetHeight(image) == profile.height {
+    private func scaled(_ image: CVImageBuffer, output: OutputProfile) throws -> CVPixelBuffer {
+        let bounds = CGRect(x: 0, y: 0, width: CVPixelBufferGetWidth(image),
+                            height: CVPixelBufferGetHeight(image))
+        if Int(bounds.width) == output.width && Int(bounds.height) == output.height &&
+            CVImageBufferGetCleanRect(image) == bounds {
             return image
         }
         guard let session, let transfer,
@@ -857,22 +947,18 @@ private final class EncoderGroup {
         try writer.writeStatus(StartingStatus(outputs: outputs))
         if !encoded {
             for index in 0...originalOutput { setActive(index, true) }
-            if encoders[originalOutput] == nil {
-                close()
-                throw CaptureFailure(description: "original hardware video output is unavailable")
-            }
         }
     }
 
-    private func reportActive(_ profileLevelId: String) throws {
+    private func reportActive(_ profileLevelId: String, output: OutputProfile) throws {
         lock.lock()
         let publish = !active
         active = true
         lock.unlock()
         if publish {
             try writer.writeStatus(ActiveStatus(
-                profileLevelId: profileLevelId, width: profile.width,
-                height: profile.height, fps: profile.frameRate, outputs: outputs
+                profileLevelId: profileLevelId, width: output.width,
+                height: output.height, fps: profile.frameRate, outputs: outputs
             ))
         }
     }
@@ -890,7 +976,7 @@ private final class EncoderGroup {
         if allFailed || startupFailed { done.signal(error) }
     }
 
-    func encode(_ image: CVImageBuffer, timestamp: CMTime) throws {
+    func encode(_ image: VideoImage, timestamp: CMTime) throws {
         lifecycle.lock()
         defer { lifecycle.unlock() }
         if closed { return }
@@ -928,21 +1014,17 @@ private final class EncoderGroup {
         lock.lock()
         failedLayers.remove(layer)
         lock.unlock()
-        do {
-            let encoder = try HardwareEncoder(
-                writer: writer, done: done, profile: profile,
-                output: outputs[index], layer: layer,
-                onActive: { [weak self] profileLevelId in
-                    guard let self, index == self.originalOutput else { return }
-                    try self.reportActive(profileLevelId)
-                },
-                onFailure: { [weak self] in self?.unavailable(layer, $0) }
-            )
-            encoder.setBitrate(bitrates[index])
-            encoders[index] = encoder
-        } catch {
-            unavailable(layer, error)
-        }
+        let encoder = HardwareEncoder(
+            writer: writer, done: done, profile: profile,
+            output: outputs[index], layer: layer,
+            onActive: { [weak self] profileLevelId, output in
+                guard let self, index == self.originalOutput else { return }
+                try self.reportActive(profileLevelId, output: output)
+            },
+            onFailure: { [weak self] in self?.unavailable(layer, $0) }
+        )
+        encoder.setBitrate(bitrates[index])
+        encoders[index] = encoder
     }
 
     func setBitrate(_ layer: Int, _ bitrate: Int) {
@@ -978,7 +1060,9 @@ private final class EnvelopeCollector {
     }
 }
 
-private func syntheticPixelBuffer() throws -> CVPixelBuffer {
+private func syntheticPixelBuffer(
+    width imageWidth: Int = width, height imageHeight: Int = height
+) throws -> CVPixelBuffer {
     let attributes = [
         kCVPixelBufferIOSurfacePropertiesKey as String: [:] as CFDictionary,
     ] as CFDictionary
@@ -986,8 +1070,8 @@ private func syntheticPixelBuffer() throws -> CVPixelBuffer {
     try require(
         CVPixelBufferCreate(
             kCFAllocatorDefault,
-            width,
-            height,
+            imageWidth,
+            imageHeight,
             kCVPixelFormatType_420YpCbCr8BiPlanarVideoRange,
             attributes,
             &value
@@ -1032,15 +1116,57 @@ private func containsRequiredH264Units(_ envelope: Data) -> Bool {
 private func selfTest() throws {
     let collector = EnvelopeCollector()
     let writer = ProtocolWriter(output: { collector.append($0) })
-    let encoder = try HardwareEncoder(writer: writer, done: StopSignal())
-    encoder.encode(
-        try syntheticPixelBuffer(),
-        timestamp: CMTime(value: 1, timescale: frameRate)
-    )
-    encoder.flush()
-    encoder.close()
-    guard collector.snapshot().contains(where: containsRequiredH264Units) else {
-        throw CaptureFailure(description: "hardware H.264 self-test produced no IDR")
+    let encoder = HardwareEncoder(writer: writer, done: StopSignal())
+    defer { encoder.close() }
+    let cases = [(1280, 720, 1280, 720), (720, 1280, 404, 720),
+                 (1720, 720, 1280, 534), (640, 480, 640, 480), (1280, 720, 1280, 720)]
+    for (index, item) in cases.enumerated() {
+        let previous = collector.snapshot().count
+        encoder.encode(
+            VideoImage(try syntheticPixelBuffer(width: item.0, height: item.1)),
+            timestamp: CMTime(value: Int64(index + 1), timescale: frameRate)
+        )
+        encoder.flush()
+        guard let envelope = collector.snapshot().dropFirst(previous).first(where: containsRequiredH264Units),
+              Int(envelope[24]) * 256 + Int(envelope[25]) == item.2,
+              Int(envelope[26]) * 256 + Int(envelope[27]) == item.3 else {
+            throw CaptureFailure(description: "hardware H.264 resize self-test failed at \(index)")
+        }
+    }
+}
+
+private func geometrySelfTest() throws {
+    let buffer = try syntheticPixelBuffer()
+    let ceiling = OutputProfile(width: 1280, height: 720, fps: frameRate, bitrate: bitrate)
+    let rect = CGRect(x: 50, y: 40, width: 200, height: 300)
+    let attachments: [SCStreamFrameInfo: Any] = [
+        .contentRect: rect.dictionaryRepresentation,
+        .scaleFactor: CGFloat(2), .contentScale: CGFloat(1),
+    ]
+    guard let image = VideoImage(buffer, attachments: attachments),
+          try image.fitted(to: ceiling).width == 400,
+          try image.fitted(to: ceiling).height == 600,
+          CVImageBufferGetCleanRect(buffer) == CGRect(x: 100, y: 80, width: 400, height: 600) else {
+        throw CaptureFailure(description: "capture content geometry self-test failed")
+    }
+    var upscaled = attachments
+    upscaled[.contentScale] = CGFloat(2)
+    guard let smaller = VideoImage(buffer, attachments: upscaled),
+          try smaller.fitted(to: ceiling).width == 200,
+          try smaller.fitted(to: ceiling).height == 300 else {
+        throw CaptureFailure(description: "small capture was enlarged")
+    }
+    for value in [CGFloat(0), -.infinity, .nan] {
+        var invalid = attachments
+        invalid[.contentScale] = value
+        guard VideoImage(buffer, attachments: invalid) == nil else {
+            throw CaptureFailure(description: "invalid capture scale was accepted")
+        }
+    }
+    var outside = attachments
+    outside[.contentRect] = CGRect(x: 700, y: 0, width: 200, height: 300).dictionaryRepresentation
+    guard VideoImage(buffer, attachments: outside) == nil else {
+        throw CaptureFailure(description: "out-of-bounds capture content was accepted")
     }
 }
 
@@ -1239,7 +1365,7 @@ private final class CaptureOutput: NSObject, SCStreamOutput, SCStreamDelegate {
     private let done: StopSignal
     private let queue: DispatchQueue
     private let profile: VideoProfile
-    private var lastImage: CVImageBuffer?
+    private var lastImage: VideoImage?
     private var lastTimestamp = CMTime.invalid
 
     init(
@@ -1287,9 +1413,11 @@ private final class CaptureOutput: NSObject, SCStreamOutput, SCStreamDelegate {
                 sampleBuffer,
                 createIfNecessary: false
               ) as? [[SCStreamFrameInfo: Any]],
-              let rawStatus = attachments.first?[.status] as? Int,
+              let attachments = attachments.first,
+              let rawStatus = attachments[.status] as? Int,
               SCFrameStatus(rawValue: rawStatus) == .complete,
-              let image = CMSampleBufferGetImageBuffer(sampleBuffer) else {
+              let buffer = CMSampleBufferGetImageBuffer(sampleBuffer),
+              let image = VideoImage(buffer, attachments: attachments) else {
             return
         }
         let capturedTimestamp = CMSampleBufferGetPresentationTimeStamp(sampleBuffer)
@@ -1630,7 +1758,7 @@ private final class H264InputDecoder {
         try require(decodeStatus, "decode-output")
         guard let image else { throw CaptureFailure(description: "decoder did not produce an image") }
         lastTimestamp = input.timestamp
-        try encoders.encode(image, timestamp: input.timestamp)
+        try encoders.encode(VideoImage(image), timestamp: input.timestamp)
     }
 }
 
@@ -1696,6 +1824,8 @@ private func capture(_ arguments: [String]) async throws {
     let configuration = SCStreamConfiguration()
     configuration.width = profile.width
     configuration.height = profile.height
+    configuration.scalesToFit = true
+    if #available(macOS 14.0, *) { configuration.preservesAspectRatio = true }
     configuration.minimumFrameInterval = profile.frameInterval
     configuration.queueDepth = 5
     configuration.pixelFormat = kCVPixelFormatType_420YpCbCr8BiPlanarVideoRange
@@ -1920,6 +2050,8 @@ private struct PiikCapture {
                 try probe()
             } else if arguments.count == 2, arguments[1] == "--self-test" {
                 try selfTest()
+            } else if arguments.count == 2, arguments[1] == "--geometry-self-test" {
+                try geometrySelfTest()
             } else if arguments.count == 2, arguments[1] == "--list" {
                 try await listSources()
             } else if arguments.count == 2, arguments[1] == "--list-microphones" {
diff --git a/scripts/check-go.mjs b/scripts/check-go.mjs
index bb709206a..b84d1b65b 100644
--- a/scripts/check-go.mjs
+++ b/scripts/check-go.mjs
@@ -193,6 +193,7 @@ function checkPlatformCapture() {
     throw new Error("Native capture probe returned an invalid contract");
   }
   if (process.platform === "darwin") {
+    run(executable, ["--geometry-self-test"]);
     if (probe.adapters.some(adapter => adapter.hardwareH264.length > 0)) {
       run(executable, ["--self-test"]);
     } else {

From f9ba6d9984f845849709ede71d53dadecd6ccde9 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sat, 10 Oct 2026 23:48:41 +0800
Subject: [PATCH 145/262] docs(network): separate ICE evidence from retired
 transport experiment

---
 docs/research/nat-traversal.md           | 1125 ++++------------------
 docs/research/node-local-media-design.md |    4 +-
 2 files changed, 187 insertions(+), 942 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 6ac18b01e..b6d53fc49 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -336,13 +336,8 @@ hold endpoint pairs, NAT/filtering, IPv6, network transitions and relay policy
 constant, measuring direct success, relay use and first media separately.
 No new transport or universal success-rate claim is accepted by this review.
 
-The initial Go control carried Pion ICE/DTLS/SRTP over magicsock and delivered
-fresh media after both UDP endpoints changed without new SDP. Loopback and
-separate address-and-port-filtering NATs passed five race repetitions. The
-fixture supplied peer identities and endpoint updates; it did not prove automatic
-OS network-change detection, decoded playback or real-router behavior. Its
-seven-pair direct matrix matched Pion within four-second windows. Go reuse is
-feasible; product integration and network benefit require the controls below.
+The [retired Go experiment](#integration-cost-and-recovery-controls) establishes
+reuse feasibility and its cost, not a Browser-compatible reachability gain.
 
 ### Browser-Compatible Follow-Up
 
@@ -456,941 +451,191 @@ recovery loop or a Browser fork to enable this option.
 **Current decision: no-go for the 2.0 candidate.** This composition requires
 Native App transport at both ends of the enhanced edge. An App Host with a plain
 Browser Viewer still uses ordinary WebRTC; mixed relaying does not enhance that
-Browser edge. The owner therefore stopped integration and field-package work.
-Retain the isolated evidence, not a product dependency or a promised feature.
-Independently verified ordinary ICE/media repairs remain useful without this
-stack. Reopen only for a concrete Browser-compatible benefit or an explicitly
-accepted App-only scope; no additional reachable NAT class has been established.
-
-The isolated `spike/magicsock-assessment` branch retains the comparison probes.
-The nested modules are outside Piik's build. Local bootstrap, peer denial and
-synthetic SRTP media checks passed. Initial withdrawal checks observed stopped
-outbound media; the stronger authorization checks below found revocation defects.
-The raw magicsock direct-path matrix found the same reachable classes as fresh
-Pion ICE. Retired mapping-cache reproductions remain controls, not the baseline.
-
-[Tailcat](https://github.com/tailscale/tailcat/blob/b4dc28e8aa8936f0a90a41ad8293a64e3d6b645f/README.md)
-provides an upstream Go reuse candidate: magicsock plus WireGuard, with DERP bootstrap
-and relay fallback. Its Browser path at that pin is relay-only. Tailscale's open
-[Browser P2P proposal](https://github.com/tailscale/tailscale/issues/21027) uses
-WebRTC because the Browser cannot expose raw UDP; it is not an implemented
-Browser Magicsock hole-puncher. In the isolated
-Linux kernel NAT comparison on 2026-10-05, both stacks connected directly through
-ordinary/ordinary and open/hard gateways in either direction. Neither delivered
-fresh direct payloads through ordinary/hard, hard/ordinary, hard/hard or blocked
-UDP pairs within the observation window. Tailcat delivered those cases while
-the fixture relay remained available. This demonstrates relay coverage, not
-an additional P2P reachability class or a field success rate.
-
-Relay policy remains a separate integration boundary. Tailcat's documented
-fallback may carry media through DERP during startup or recovery. Closing DERP
-or counting its packets in a fixture measures the path; neither enforces Piik's
-product policy. The reviewed Tailcat API does not expose a direct-only media
-policy that retains discovery. Disabling DERP also removes bootstrap/endpoint
-exchange, and polling a direct-path status cannot authorize each later packet.
-
-An isolated packet-policy overlay separates discovery and fixed
-[WireGuard handshake messages](https://www.wireguard.com/protocol/#key-exchange-and-data-packets)
-from encapsulated data. Blocked UDP carries no media; a relay-allowed peer's
-incoming data is also rejected. Removing either direction's guard fails its
-corresponding control. The ordinary-NAT Pion fixture delivered fresh direct SRTP
-in an initial run but failed cold startup on a repeat, so it is not a passing
-acceptance gate.
-The relay counts encrypted data envelopes without recording keys or payloads;
-ordinary relay delivery validates that counter. The stricter variant that also
-blocks WireGuard handshakes leaves inner ICE connecting without media after
-20 seconds, even after the outer endpoint is known. Native control replacement,
-sibling continuity and final retirement pass with the media-only restriction
-on loopback. These checks do not establish Native startup through NAT.
-
-Without another preparation step, the complete Native Engine/receiver/playback
-fixture also fails cold startup through ordinary kernel NAT with this restriction,
-before any address move. Its relay-allowed control passes and retains fresh
-playback after DERP closes.
-Discovery traces show one direction's initial ping unanswered: one endpoint
-confirms direct access promptly, while the other confirms it around six seconds
-later. Native's eight initial ICE writes end around 1.4 seconds; a pending UDP
-flow may still be unaccepted then. The late direct path does not revive that
-exhausted generation. The late side can be either endpoint. A one-shot supported
-`Client.DiscoPing` before ICE returns the relay result in milliseconds and does
-not fix startup. Diagnostic replies and successful key admission therefore
-cannot stand in for bidirectional transport preparation.
-
-The producer/consumer review identifies a bootstrap contract mismatch:
-[Tailcat's initial endpoint advertisement](https://github.com/tailscale/tailcat/blob/b4dc28e8aa8936f0a90a41ad8293a64e3d6b645f/tailcat.go#L1570)
-uses CallMeMaybe without first sending direct UDP, while
-[magicsock's receiver](https://github.com/tailscale/tailscale/blob/a0e471a35b8f/wgengine/magicsock/endpoint.go#L2146)
-assumes that send has already opened the peer's stateful firewall. A dependency
-candidate follows pings to newly learned endpoints with the existing endpoint
-advertisement. Identical advertisements do not cause another reply, and no
-timer, retry count or cryptographic check changes.
-
-With that candidate, three fresh Pion starts deliver direct SRTP within
-68–87 ms of their observation start; blocked-UDP and incoming-relay controls
-still enforce the media policy. The real Windows VP8 encoder, Native receiver
-and actual Chromium/Firefox bridge also retain fresh decoded pictures through
-both local-address handoff directions and subsequent DERP closure, within the
-unchanged observation bound. The Native fixture counts relayed data from before
-bootstrap, not only after direct-path discovery. These are isolated, generated-
-media checks; full App/room integration and physical networks remain open.
-
-A separate TCP preparation control restored startup at about seven seconds of
-extra cost but exceeded the spare time in the full handoff check. That extra
-flow is not retained; the library bootstrap candidate supersedes it. Fixed-frame
-or bare-Pion playback controls still expose the separate encoder and local-bridge
-boundaries described below.
-
-Authentication, key handling, retry timers and Pion budgets remain unchanged.
-The experiment narrows the missing direct-media preparation contract; it is not
-a supported upstream option, passing adoption gate or improvement to
-direct NAT reachability. Product adoption must preserve site/share policy,
-including P2P-only and SFU-only rooms, without silently adding another relay.
-
-Replacing one gateway mapping without notifying endpoints separated recovery
-from initial reachability. Neither established direct path delivered within
-20 seconds with the relay closed. Fresh Pion discovery/exchange recovered in
-about 0.6 seconds after it was started. Tailcat recovered delivery in about
-6.5 seconds through its retained relay; closing it immediately lost delivery
-again. Keeping traffic and discovery alive for 45 seconds allowed subsequent
-direct delivery after relay closure. Both gateway directions were checked.
-These timings have different detection/setup boundaries and are not a Piik
-startup or playback benchmark.
-
-The raw Bind adapter also has a composition cost: it consumes unwrapped STUN
-payloads, and its discovery retry can outlive Pion's initial check budget.
-Dropping the first discovery packet in each direction reproduced that failure;
-increasing only the fixture's ICE budget recovered media. The ordinary Pion
-loss control recovered without that override. Do not adopt packet prefixes,
-diagnostic Ping polling or wider product deadlines as integration shortcuts.
-
-Keep product integration conditional on a repeatable benefit on matched networks,
-with direct coverage, relay coverage, recovery and first picture measured
-separately. Go feasibility alone does not establish that benefit. The actual
-Native-engine controls below cover gateway mapping, prediction and IPv6;
-physical routers and the full mixed Piik topology remain outside the comparison.
-
-### Isolated Connection-Layer Acceptance
-
-The 2026-10-07 experiment through `f0ca8056` keeps Pion's ICE/DTLS/SRTP over
-Tailcat. Each physical connection owns a virtual UDP tuple and mux; its one-shot
-listener retires after admission. Connections to one authorized peer may share
-the tunnel. Closing or aborting one flow preserves healthy siblings. Initial
-revocation checks stopped outbound media and denied a fresh client; they did not
-prove that the old client's inbound traffic was rejected. These checks do not
-implement Piik room grants or endpoint exchange.
-
-Repeated lifecycle and Linux race checks cover overlapping media preparation,
-rollback, replacement, canceled preparation followed by retry, bounded datagrams
-and blocked-reader retirement. A 350 ms interruption of one flow preserved its
-sibling and recovered without replacing SDP. Piik's actual encoded source,
-LiveKit forwarder and pacer also carried a small VP8/Opus fixture over ordinary
-Pion and Tailcat, including TWCC and keyframe requests. Tailcat recovered an
-injected missing video packet through existing NACK handling after DERP closed.
-This is forwarding evidence, not throughput or room-controller acceptance.
-
-A 2026-10-09 inbound-only control found that opening or closing an unrelated
-Tailcat listener discards an accepted UDP flow's filter state. The unchanged
-control passes; both listener changes stop delivery. Continuous outbound media
-can recreate the reverse-flow entry, explaining why bidirectional checks alone
-miss this boundary. The isolated repair passes the previous filter to Tailscale's
-[existing shared-state API](https://github.com/tailscale/tailscale/blob/a0e471a35b8f/wgengine/filter/filter.go#L218).
-Three race repetitions, the copied Tailcat listener suite and the combined
-revocation/isolation controls pass. The patch remains experimental; it neither
-changes Piik nor fixes the independent inner-ICE recovery failure below.
-
-Real Browser controls forward generated H.264/Opus and VP8/Opus through Browser
-WebRTC → Pion/Tailcat/Pion → Browser WebRTC without re-encoding. Both decode at
-640×360 and, with the combined dependency candidate, 1920×1080. The larger input
-requests 60 fps with a 6 Mbps ceiling and fixed dimensions; actual encoding
-cadence varies, so it establishes neither 1080p60 delivery nor a throughput
-advantage. Fresh picture/audio arrive in each two-second window across eight
-seconds after DERP closure and stop after revocation. At about 3.6–4.3 Mbps,
-reported RTP loss is zero and the largest Tailcat datagram is 1208 bytes, with
-no size rejection. This does not bound all RTCP workloads or establish physical
-capture, Browser-native Magicsock or complete Piik relay interoperability.
-
-The 1200-byte Native packetization envelope with TWCC and short MID/RID headers
-produced at most 1228-byte encrypted datagrams across Pion's three default SRTP
-profiles. Only four bytes remain below Tailcat's 1232-byte ceiling; larger
-headers and maximum compound RTCP remain integration checks. The small actual
-forwarder fixture does not establish those limits.
-
-A feedback control found a concrete mismatch: Pion's TWCC recorder generated
-a 1244-byte encrypted report and a 1268-byte compound batch. Ordinary Pion
-delivered both; the bounded adapter rejected them, and unwrapped Tailcat did
-not deliver either within two seconds. A 1144-byte report arrived before and
-after. Windows and Linux race checks repeated this result three times each.
-Pion ICE treats non-close socket write errors as packet loss, so `WriteRTCP`
-returning no error did not prove delivery. This does not establish how often
-Piik would produce these batches. Tailcat's
-[documented payload bound](https://github.com/tailscale/tailcat/blob/b4dc28e8aa8936f0a90a41ad8293a64e3d6b645f/tailcat.go#L574)
-needs a supported feedback-size boundary before integration; reducing RTP
-packetization alone does not bound RTCP. No product transport or custom packet
-fragmentation was added for this check.
-The related [Pion feedback-MTU report](https://github.com/pion/interceptor/issues/416)
-remains open as of 2026-10-07. Its out-of-order packet evidence does not establish
-the cause of any Piik field report; the pinned recorder has no byte-size option.
-
-A 2026-10-08 reordering control flushed twelve 100-arrival reports, then supplied
-one delayed packet. The recorder included already reported history and generated
-a 1248-byte encrypted report from that one new arrival. Shortening the feedback
-interval alone cannot bound its size. Windows and three Linux race repetitions
-passed the reproduction. The latest tagged
-[interceptor v0.1.49 recorder](https://github.com/pion/interceptor/blob/v0.1.49/pkg/twcc/twcc.go)
-is byte-identical to the pinned recorder; Tailcat's
-[October 7 revision](https://github.com/tailscale/tailcat/blob/52fbad323e9d352f1febb623e0975368e9a8cbdd/tailcat.go#L574) retains
-the same payload limit and Tailscale dependency. A dependency bump does not
-supply the missing per-report and compound-batch size boundary.
-
-A local upstream-layer repair candidate now bounds TWCC reports through the
-existing recorder split loop and sends them separately before encryption. Its
-fixed 1200-byte plaintext budget is experimental, not a supported upstream
-option. Unit checks preserve loss, reordered history, wrapped sequence numbers
-and arrival times; restoring either old recorder or writer fails its regression
-check. A real interceptor-to-Tailcat control delivered all 1500 statuses in two
-reports after DERP closed, with a largest encrypted datagram of 1212 bytes.
-Windows and three Linux race repetitions passed, as did the upstream TWCC suite
-with the candidate. The isolated probe retains the opt-in patch and reproduction;
-production dependencies are unchanged. This narrows one integration obstacle,
-not the missing direct-reachability benefit or a supported upstream MTU contract.
-
-The current Go feedback paths were also traced end to end. Pion's default NACK
-generator retains a 512-packet window and writes one report per media SSRC;
-a full-loss/wrapped-gap control with two SSRCs stays within 156 encrypted bytes.
-Normal sender/receiver reports are written separately per stream. Piik's SFU
-ingress callback forwards only PLI/FIR, and LiveKit's reachable XR response contains one
-DLRR block. No additional oversized producer was found in these paths; this
-does not bound arbitrary caller-created RTCP batches or future configurations.
-
-Kernel queue controls compare established Pion and Tailcat SRTP under delay,
-jitter, 5% loss and reordering with DERP closed. Both retained their session and
-resumed after a 350 ms blackout in three race repetitions, and after a separate
-nine-second blackout. Fresh tags and unique sequences exclude queued/duplicate
-success. These are bounded recovery checks, not decoded quality or field coverage.
-
-Kernel gateway rebinding retained full WebRTC: DERP restored fresh media in about
-6.4–6.5 seconds and ICE `connected` in 7.1–8.1 seconds, without new SDP. Its recorded
-disconnected interval was about two seconds, inside Piik's three-second grace;
-the nine-second blackout reached about four seconds disconnected. Actual Native
-Viewer-owner replays cancel grace or request one restart, clear recovery on
-connection and retain the receiver. They mock App events, so do not exercise the
-restart exchange over Tailcat or prove full integration. With DERP closed, neither
-gateway direction recovered within 20 seconds. Fresh media, ICE state and a
-unilateral direct address are separate facts. Underlay setup must fit the existing
-operation deadline. Local cold setup of about 3.3 seconds for Tailcat versus 0.2
-seconds for Pion disabled STUN/gateway mapping; it is not a WAN startup comparison.
-
-Actual ICE-restart controls on 2026-10-08 exposed a composition failure.
-After a nine-second kernel blackout, ordinary Pion resumed media, but default
-Tailcat sometimes exhausted eight inner Binding requests before outer discovery
-recovered about 2.4 seconds after restoration. Pion's
-[candidate-pair check budget](https://github.com/pion/ice/blob/v4.4.0/agent.go#L790)
-and Magicsock's
-[rate-limited discovery](https://github.com/tailscale/tailscale/blob/a0e471a35b8f/wgengine/magicsock/endpoint.go#L1421)
-are independent: outer recovery does not restart exhausted inner checks.
-Keeping the accepted listener open did not help; a new ICE generation after
-underlay recovery delivered three fresh packets in about 63 ms. This distinguishes
-check scheduling from permanently retired resources. The isolated authorization
-and feedback patches retain this failure.
-
-The following counterfactuals preserve sockets, keys and NAT mappings. Unless
-noted, recovery starts after network restoration; none runs Piik's complete
-disconnect-grace, restart and rebuild schedule.
-
-| Tailcat recovery control | Observation |
+Browser edge. The owner stopped integration and field-package work. Reopen only
+for a concrete Browser-compatible benefit or an explicitly accepted App-only
+scope. The controls established no additional reachable NAT class.
+
+The isolated experiment remains at `d67f0d6d` on
+`spike/magicsock-assessment`, outside Piik's production dependency graph.
+`git show d67f0d6d:scripts/tailcat-probe/README.md` retrieves its commands,
+fixture boundaries and opt-in dependency patches. The complete experimental
+observations remain in `git show 82e3f253:docs/research/nat-traversal.md`.
+Its internal package is retired, not a current 2.0 test deliverable.
+
+#### Reachability And Cost
+
+The October 5-10, 2026 controls used
+[Tailcat](https://github.com/tailscale/tailcat/blob/b4dc28e8aa8936f0a90a41ad8293a64e3d6b645f/README.md):
+Magicsock/WireGuard with DERP bootstrap and relay fallback. Its Browser path at
+that pin is relay-only. Tailscale's
+[Browser P2P proposal](https://github.com/tailscale/tailscale/issues/21027)
+uses WebRTC; it is not an implemented Browser Magicsock hole-puncher.
+
+| Controlled question | Result and boundary |
 | --- | --- |
-| Increase only the fixture's Binding request budget to 64 | Media recovered in about 1.9 seconds inside the fixture's eight-second window. This does not accept a product timeout change. |
-| 16 Binding requests, three-second recovery window | Nine-second blackout recovered in about 1.9 seconds across three default-library repetitions; eleven seconds did not recover in budget. Other checked phases reached about 2.9 seconds. The authorization/feedback candidate reproduced both outcomes. |
-| One client-side `DiscoPing` before default-Pion restart | Failures remained even after a diagnostic reply; that reply does not prove bidirectional encrypted media readiness. |
-| One probe on each side before default-Pion restart | Nine- and eleven-second blackouts recovered in three race-detector repetitions, including both probes and SDP exchange inside three seconds. This requires an isolated, unsupported Server hook. |
-| Same bilateral probe begins while the network is still down | After eight seconds of blackout, restoration one or two seconds into the probe still left it waiting until its three-second deadline in repeated race checks. Post-restoration controls continued to pass. |
-| Lost bilateral probes, retain the existing media connection | In six race checks, both probes expired while WebRTC was already connected; a subsequent observation received fresh SRTP without new SDP, sockets or credentials. The separate three-second observation is not a product recovery extension. |
-| New flow confirms encrypted UDP in both directions before inner ICE | With the listener-state repair and actual Viewer owner, one of four nine-/eleven-second controls recovered; three timed out in the existing three-second preparation, before SDP. The bounded fixture echo changes where waiting occurs, not the underlying recovery limit. |
-
-These controls limit the bilateral proposal: a
-[`DiscoPing` call](https://github.com/tailscale/tailcat/blob/b4dc28e8aa8936f0a90a41ad8293a64e3d6b645f/tailcat.go#L2258)
-waits for its own diagnostic reply, not an ongoing connection-readiness event.
-Later network restoration cannot guarantee that a lost probe completes.
-The earlier passing phase therefore does not establish a universal recovery
-barrier, and probe expiry does not establish media failure or justify replacing
-healthy media. These controls use fixture SDP exchange; they do not diagnose the
-product's Trickle ICE or an existing user's failure.
-
-Manually phased replacement controls give ICE restart and inner-flow replacement
-three seconds each, retaining the tunnel, outer mappings and default Pion checks.
-Post-restoration controls pass after eight-, nine- and eleven-second blackouts;
-two Tailcat controls starting before restoration also pass two further race
-repetitions. These windows are stricter than a replacement receiver's actual
-15-second initial-connection deadline, not a reproduction of the Viewer schedule.
-A bounded repeated fixture preface prevents a lost first UDP packet from blocking
-listener acceptance before ICE. It is not product signaling or media-health proof.
-
-A separate fixture feeds kernel connection states into the actual
-`NativeCapableViewerPeer`. Each rebuild gets a new connection ID, as in the
-product, while preserving the parent's recovery budget. Renewing that budget
-on replacement hid the nine-second outage: three repetitions recovered only
-after a third automatic request, outside the two-request contract. The corrected
-owner and fixture retain the count across Native and Browser backend replacement.
-
-The actual-owner fixture now supports incremental SDP/candidate exchange,
-matching Piik's [Trickle ICE generation boundary](https://www.rfc-editor.org/rfc/rfc8838.html#section-13).
-With this enabled, ordinary Pion recovers two-, nine- and eleven-second outages
-in three runs each. Without it, the same eleven-second control still fails at
-the fixture's three-second gathering barrier while the network is unavailable.
-That negative control is a fixture limitation, not a product defect.
-
-In the matched Trickle run with the isolated listener-state repair, Tailcat
-recovers two- and seven-second interruptions. Nine- and eleven-second outages
-exhaust recovery: the replacement sends eight inner Binding checks, receives
-none, and delivers no fresh SRTP during its initial deadline or a separate
-three-second observation after exhaustion. Both 16-check cases pass; one
-64-check replacement instead fails before SDP while awaiting its inner flow.
-Permanent loss exhausts the existing budget and disposal cancels recovery.
-No observation grants another attempt or extends a deadline. Native control
-and local decoding remain stubs, and events are sampled within 100 ms. These
-limits prevent claiming full App integration or diagnosing a field failure;
-the composition gap remains an adoption concern.
-
-Bounded anonymous traces further localize two Tailcat encrypted-echo failures.
-The replacement flow is accepted and its client preface read at the server,
-but the reverse read expires after three seconds before SDP. The server selects
-its direct path near the end of that window; the client has selected its path
-about two seconds earlier. No filter-drop event was observed, which is not
-packet-delivery proof. Other timing phases recover. This supports a directional
-underlay scheduling limit; it does not establish a new authorization defect,
-a safe readiness barrier, or a reason to widen product deadlines.
-
-Varying the existing [Pion Binding-request setting](https://github.com/pion/webrtc/blob/v4.2.19/settingengine.go#L506)
-can bridge a discovery delay, but repeated controls also fail before SDP during
-new-flow setup. Paired counters separately show the server receiving inner STUN
-while the client receives none. More checks cannot repair every setup failure;
-neither a new readiness owner nor a longer product deadline is accepted.
-
-A retained-flow counterfactual reuses Pion's existing
-[UDP mux](https://github.com/pion/ice/blob/v4.4.0/udp_mux.go) after closing the old
-PeerConnection. It keeps the accepted Tailcat flow and replaces ICE/DTLS/SRTP,
-without another listener or preparation exchange. Setup falls from about 913 ms
-to 11–20 ms. Nine-/eleven-second recovery passes three of six default-check
-cases, four of six with 16 checks and six of six with 64. Removing flow creation
-alone therefore does not resolve recovery. Combined listener/revocation/TWCC
-patches pass Linux race checks for 64-check recovery, bounded exhaustion,
-retirement and sibling audio/video through serial replacements and rollback.
-Overlapping connections still use separate flows, and revocation stops both.
-This counterfactual does not accept retained flow as a product owner; the fresh
-flow alternative below avoids that extra lifetime.
-
-A preface-free alternative uses Tailcat's existing
-[UDP listener](https://github.com/tailscale/tailcat/blob/b4dc28e8aa8936f0a90a41ad8293a64e3d6b645f/listen.go)
-to reserve the address before SDP, allowing ICE to supply the first authenticated
-datagram. Each replacement owns a fresh flow; no old mux survives it. An
-unaccepted write returns a socket error instead of blocking ICE's event loop.
-In the combined dependency candidate, 64-check nine-/eleven-second controls
-each pass two Linux race repetitions under the actual Viewer owner. Setup takes
-12–15 ms; fresh media returns at about 14.2 seconds from blackout onset, within
-the unchanged two-request and initial-connection budgets. Permanent loss still
-exhausts recovery, and retirement closes pending work. Local race controls cover
-mutable deadlines, closing during ICE, peer rejection and continuous sibling
-audio/video. Default inner checks still fail in these restart-then-rebuild controls.
-This removes the fixture-preface and retained-flow lifetime requirements; it
-does not accept a product Binding limit, implement room grants or establish
-full App recovery acceptance of this alternative.
-
-The sender's [restart capability](../standards/routing-transport.md#reconciliation)
-changes that schedule. Modeling the current Native sender's first-request
-replacement under the same Viewer owner on 2026-10-10, default checks recover both
-nine- and eleven-second outages at about 23.3 seconds after two replacements. Their first
-replacement still exhausts eight checks; the second starts after its existing
-15-second initial deadline. With 64 checks, these controls recover after one
-replacement at about 12.2 and 15.3 seconds respectively. Permanent loss exhausts
-two replacements at about 38.3 seconds, and disposal cancels pending recovery.
-This narrows the earlier failure claim to its tested sender behavior; it is not a universal Native failure
-or an accepted product tuning. Native control and decoding remain stubbed in
-this owner fixture, distinct from the decoded handoff checks below.
-
-Separate checks preserve continuous sibling audio/video through a local ICE
-restart, failed-flow retirement, both callers' pending cancellation/deadline,
-revocation during a Server probe and unknown-peer rejection. Canceling a probe
-ends the caller's wait, not upstream packets: existing five-second discovery and
-ten-second TSMP timers bound callback retention. These local checks do not prove
-impaired-network recovery.
-
-The opt-in experiment retains the failing single-restart and blocking-probe
-assertions. It is not an all-green acceptance gate or a supported adapter. Do not
-widen product timeouts or add diagnostic Ping polling to hide these failures.
-Room-authorized integration and the complete recovery lifecycle remain unverified.
-
-A discovery-retained control on 2026-10-08 addresses a limit of closing DERP:
-closure also removes its endpoint exchange. The upstream relay's packet-class
-counters distinguish discovery from WireGuard traffic. A 500 ms window with
-connected WebRTC, at least three fresh tagged SRTP packets and no non-discovery
-relay packets proves direct media while keeping endpoint exchange available.
-Ordinary NAT passes that proof; blocked UDP correctly remains relay-only. Both
-orientations of the hard-NAT pair deliver through DERP without a proved direct
-window in 20 seconds. After either gateway mapping changes, media returns in
-about six seconds. Default-library repetitions do not prove direct recovery in
-20 seconds. The combined isolated candidate proves it once per direction at
-about 17 seconds, but neither of two further repetitions per direction does.
-This variation does not establish a repeatable candidate advantage or an extra
-reachable class. The control makes no explicit rediscovery call; its passing
-result validates the measurement and available-media baseline, not universal
-direct recovery. It does not run Piik's complete reconnect schedule.
-
-An actual local-address-change control on 2026-10-09 replaces one endpoint's
-IPv4 address, default route and public UDP mapping, allowing upstream network
-monitoring to react. Discovery stays available, without an explicit endpoint
-update or diagnostic Ping. With Piik's unchanged Viewer recovery owner and
-Trickle exchange, three repetitions per direction preserve Tailcat's same media
-session: direct delivery returns in 1.25–6.40 seconds with no owner restart.
-Both default inner checks and the isolated 64-check candidate pass this control.
-The ordinary Pion comparison requests one ICE restart and returns direct media
-in 9.14–9.24 seconds. Relay accounting separates first available media from
-direct delivery; another two seconds of fresh SRTP after DERP closes confirms it.
-
-The actual Native Engine's wildcard UDP socket is a separate baseline: both
-directions stop delivering after the address change without new SDP, and fresh
-Native discovery restores local playback on that same changed network. This
-avoids attributing only Pion's default per-interface socket behavior to Piik.
-These controls establish a bounded address-handoff benefit, not an additional
-initial NAT-reachability class, physical Wi-Fi roaming or complete App/decoder
-acceptance. They do not resolve the gateway-only or prolonged-outage controls
-above. Supported dependencies, room grants and representative network evidence
-remain prerequisites for product adoption.
-
-The remote-socket overlay extends that comparison through the actual Native
-encoded source, sender, receiver and local playback. It leaves product files
-untouched and binds the supplied socket to each connection-creation request.
-Its fixed 8×8 input exposes forwarding pauses but cannot establish live encoder
-recovery; declaring those fixed bytes rate-controlled is only an ablation.
-The fixed-frame Viewer-address handoff pauses with both the former and current
-socket adapters, including a matched control with isolated loopback playback.
-Under that same playback isolation, the real Windows VP8/FFmpeg control passes
-with the current adapter in all three checked cases: ordinary unchanged, source
-address change and Viewer address change. These controls separate the adapter
-change from the fixed-input recovery failure; they do not establish its complete
-cause or justify relaxing media acceptance.
-
-The live control instead uses the Windows VP8 helper, Native output-plan owner
-and final FFmpeg decode. The top quarter of the input changes from red to blue
-after DERP closure, so buffered pictures cannot satisfy fresh-content acceptance.
-About one second of ordinary UDP loss can leave the former pacer sending old
-video from a queue of hundreds of packets. DownTrack frame counts precede actual
-paced writes and cannot prove delivery. The shared media assessment owns the
-[pacing comparison](./node-local-media-design.md#send-queue-recovery);
-it must pass constrained-bandwidth recovery as well as this short-loss control.
-
-Viewer address changes expose a separate confound: same-machine playback can
-select a LAN address that the experiment then removes. Restricting only the
-fixture receiver to loopback separates that leg from the remote underlay.
-With this control and the upstream default send queue, all six cases pass:
-unchanged ordinary/Tailcat paths, both address-change directions, and short
-ordinary/Tailcat loss. Each retains decoded fresh pictures in every post-DERP
-sample. These passes do not accept the default local-playback path or the
-complete App. Verify its Browser bridge
-and existing recovery owner before adopting a local-address policy.
-No additional NAT-reachability class, physical capture result or product
-Magicsock integration follows from these controls.
-
-A same-machine Windows Browser control rejects forcing the product bridge to
-loopback. Chrome 154 decodes from a Native sender bound to `127.0.0.1`, but
-Firefox 155 fails that connection; the same Firefox fixture decodes with the
-current wildcard bind and a non-loopback selected pair. Mozilla also keeps
+| Does it reach more NAT classes than fresh ordinary ICE? | In the initial kernel-NAT matrix without a usable gateway mapping, both connected directly through ordinary/ordinary and open/hard gateways in either direction. Neither established direct media through the other tested hard/blocked combinations within the observation windows. DERP delivered otherwise unreachable cases, establishing relay coverage rather than additional P2P coverage. |
+| Does network-change handling help? | Some local-address changes recovered on the same session without new SDP. Gateway-only rebinding and longer interruptions had separate discovery/recovery failures. These results do not establish physical roaming, a universal recovery improvement or increased initial reachability. |
+| Does it coexist with ordinary ICE? | An isolated optional multi-mux composition retained ordinary media with bootstrap unavailable and used a delayed tunnel candidate when needed. It required dependency patches and readiness/cancellation integration; it is not a supported plug-in. |
+| What is the bounded cost? | Matched stripped Windows App builds grew from 44.1 to 59.8 MiB. A local four-Viewer full-App comparison peaked at 81.8/93.2 MiB RSS for ordinary/optional modes; final goroutines returned to the same baseline. Codec and Browser processes were separate. These are not sustained or per-room budgets. |
+
+Closing DERP removes endpoint exchange as well as relay media. Later controls
+therefore retained discovery and counted encrypted relay traffic separately;
+a selected direct address alone was insufficient. Tests required fresh media
+and either no relayed data or continued delivery after relay closure. The
+Native mapping, prediction and dual-stack controls are retained
+[below](#gateway-and-address-family-controls).
+
+#### Integration Boundaries
+
+The experimental composition exposed costs that a future adoption must address
+without another retry owner, timeout extension or silent relay policy change:
+
+- **Relay policy:** the reviewed upstream API has no direct-only media policy
+  retaining discovery. An isolated overlay filtered encrypted data in both
+  directions while allowing discovery/handshakes. This is not an accepted
+  product mechanism; disabled UDP must not silently become DERP media.
+- **Startup and recovery:** outer discovery can outlast the inner ICE check
+  budget. A diagnostic `DiscoPing` reply did not prove bidirectional media
+  readiness. Experiments with more checks, extra prefaces and readiness probes
+  did not establish a universal fix. Initial advertisement also needed an
+  isolated dependency correction to send direct probes before relying on the
+  peer's stateful firewall. Ordinary ICE must remain independently usable.
+- **Datagram bounds:** Tailcat's reviewed payload ceiling is 1232 bytes. Actual
+  encrypted TWCC reports reached 1244 bytes, with compound batches larger still;
+  ordinary Pion delivered them while the tunnel did not. A delayed packet could
+  grow a report despite a shorter feedback interval. The isolated recorder/writer
+  split preserves statuses, but is not a supported upstream option. The
+  [feedback-MTU issue](https://github.com/pion/interceptor/issues/416) and recorded
+  dependency patches own this finding; reducing RTP size alone is insufficient.
+- **Authorization:** the pinned Tailcat/WireGuard composition could retain a
+  revoked inbound peer or install it from a late authorization result. Scoped
+  experimental corrections passed revocation, unrelated-peer, sibling-media
+  and race controls. Piik's production transport does not use these dependencies;
+  the result is an adoption requirement, not a published Piik defect.
+- **Flow ownership:** unrelated listener changes could discard an existing
+  inbound filter entry. Duplicate client identities could collide at DERP;
+  close-before-initialization was not terminal. Isolated repairs preserved
+  filter state, used fresh parent-bound clients and joined canceled creation.
+  New media flows must retire through their existing connection owner.
+- **Optional candidate lifecycle:** stock multi-mux construction and supported
+  dialing do not independently provide the required delayed socket admission.
+  A private reservation API plus the existing candidate collector kept ordinary
+  ICE independent, advertised the tunnel only when ready, fenced cancellation
+  and delayed end-of-candidates. Its multi-mux also needed a correction for
+  newly enumerated child addresses. These remain experimental dependency changes.
+
+#### Scope Of The Retained Evidence
+
+The isolated overlays exercised real Pion/LiveKit forwarding, H264/VP8 and Opus,
+Browser decoding, Native control and room authorization. Bounded rendered checks
+covered reconnect, invitation revocation, overlapping parent replacement,
+healthy siblings, denial at the room capacity limit and final resource cleanup.
+Generated changing pixels distinguished fresh output from retained frames.
+The final full-App controls could select the tunnel with ordinary remote
+candidates withheld, while ordinary Web edges retained ICE.
+
+Those checks established local composition and ownership behavior. They did
+not establish physical capture, difficult-network benefit, broad mobile support
+or sustained field reliability. The experiment's detailed intermediate controls,
+failed counterfactuals and package evidence remain in Git rather than this
+candidate's work ledger. Independent ordinary-media findings are retained here
+and in their existing owners.
+
+## Ordinary ICE And Media Recovery
+
+These findings apply without Magicsock. They must remain part of candidate
+acceptance independently of the retired experiment.
+
+### Interface Refresh And Local Browser Bridge
+
+The local restart control reproduced an address-cache defect: Pion ICE v4.4.0's
+[wildcard UDP mux](https://github.com/pion/ice/blob/v4.4.0/udp_mux.go) retained its
+own `stdnet.Net` interface snapshot across gatherings. After an interface address
+changed, both ICE restart and a new SFU connection sharing that mux could
+advertise the removed address. The shared mux now takes a private current
+snapshot when gathering. Socket identity and Pion's candidate filters remain;
+no monitor or timer is added. The regression covers both restart and a new
+connection, and restoring the former constructor fails on the stale candidate.
+The [stable Pion update](#stable-pion-interoperability) still needs this adapter.
+
+Forcing the same-machine Browser bridge to loopback is not a portable solution.
+A Windows control decoded through `127.0.0.1` in Chrome 154 but failed in
+Firefox 155; Firefox decoded using the current wildcard bind and a non-loopback
+pair. Mozilla keeps
 [ICE loopback disabled by default](https://searchfox.org/firefox-main/source/modules/libpref/init/all.js).
-These controls establish a compatibility limit, not its complete Browser cause
-or public-Site permission behavior. Keep the current address policy. A terminal
-local-bridge failure ends the Host share or delegates Viewer recovery to its
-existing connection owner.
-
-Before local-bridge recovery, complete App UI controls on 2026-10-10 confirmed
-this distinction in a disposable Linux network namespace, with automatic
-topology optimization disabled and no
-product source changes. Chromium 152 retains its loopback playback connection
-when the namespace's LAN address changes. Firefox 151 selects that LAN address:
-the Viewer resumes decoded pictures through the existing Browser fallback after
-the local connection fails, roughly 30 seconds later. A Firefox Host instead
-ends sharing on that preview failure, including a still-delivering downstream
-connection; the Chromium Host control continues. The Host source is generated
-VP8 delivered through the real capture-process interface, not physical capture.
-Acceptance checks fresh rendered frames at the end, not accumulated frames from
-before the interruption. All controls retire their App, Browsers and interfaces.
-These are ordinary-transport controls, not integrated Magicsock or physical
-roaming evidence. A faster remote tunnel alone cannot establish complete App
-handoff; both the network and Browser playback legs must recover.
-
-The local restart control exposed a separate address-cache defect: Pion ICE
-v4.4.0's [wildcard UDP mux](https://github.com/pion/ice/blob/v4.4.0/udp_mux.go)
-retains its own `stdnet.Net` interface snapshot across
-gatherings. After an interface address changes, both ICE restart and a new SFU
-connection sharing that mux can advertise the removed address. The shared mux
-adapter now takes a private current snapshot when gathering; it changes neither
-socket identity nor Pion's candidate filters and adds no monitor or timer.
-The isolated regression covers restart and a new connection; restoring the
-former constructor fails on the stale candidate. Firefox also resumes fresh
-rendered frames on the same track after a standard ICE restart, including from
-the failed state, while a separately bound loopback sibling keeps receiving.
-Replacing only the Native PeerConnection while retaining the Browser connection
-instead reported connected without fresh decoded pictures in the same fixture;
-it is not the accepted recovery mechanism.
-
-The 2.0 candidate now uses the existing bridge owner for one standard ICE restart
-after a three-second disconnect grace, or immediately after failure. Initial and
-restart negotiations use complete local SDP with the request ID fencing the answer;
-there is no separate local trickle queue. The negotiation has an eight-second
-deadline, including a five-second Native gathering bound. Retirement cancels it;
-failure retains the existing Host/Viewer terminal owners. Paused sources need not
-produce new frames to prove a transport connection.
-
-Matched complete App controls retain the same Firefox Host and Viewer media track
-through the namespace address change. The Host keeps sharing and decoding, its
-downstream Viewer keeps rendering, and the Native Viewer resumes fresh rendered
-frames without replacing its route or falling back to Browser reception.
-Chromium Host/Viewer controls retain their working loopback leg without a restart.
-These controls use ordinary Pion and generated media. They close the reproduced local
-bridge gap, not the remaining Magicsock composition, physical roaming or platform
-acceptance boundaries.
-
-The aligned candidate also combines the real Native encoder/forwarder/receiver
-with the actual Browser bridge over the experimental Tailcat socket. The fresh
-flow adapter now replaces its synthetic preface: SDP starts before peer admission,
-and ICE supplies the first datagram. All six FFmpeg-decoded controls pass Linux
-race checks. Chromium 152 and Firefox 151 each pass an unchanged ordinary-Pion
-control and both Tailcat address-change directions. After DERP closes, new blue
-content keeps rendering on the same track. Firefox renegotiates its local leg
-once when that endpoint moves; Chromium retains its working loopback leg. Local
-HTTP replaces Native control only in this fixture; App authorization, room routing
-and prolonged-outage replacement are not exercised. No product timeout, address
-policy or inner Binding setting changes for these handoff checks.
-
-A separate Linux race check now passes those experimental flows through real
-Native control commands and the Viewer session's existing receiver owner.
-Closing a receiver releases its physical flow; replacement and a healthy sibling
-keep receiving fresh RTP after DERP closes, including after late cleanup for the
-old connection ID. Stopping reception or closing the control session releases
-both remaining flows. Omitting receiver retirement in the test overlay is
-detected. Keys are still pre-granted locally: this establishes resource cleanup,
-not room authorization, automatic App recovery or Browser decoding in this check.
-
-The request-scoped adapter removes the former Engine-wide next-socket slot and
-temporary bootstrap receiver. A lazy factory reaches the existing physical
-socket owner only after input/capacity admission; reuse does not allocate again.
-Unsupported-codec failure, independent receiver retirement, control close and
-cancellation of a still-opening socket pass under the race detector. The Native
-engine, Host, Viewer and control package suites also pass with the overlay.
-The complete loopback WebSocket check exposes one additional integration gap:
-delayed socket preparation waits for its media owner, while deferred session
-close waits for that synchronous command. Client disconnect and server shutdown
-both leave it waiting in the unmodified owner. The isolated correction runs
-session close on control-context cancellation and joins it before releasing the
-capacity slot. Both cases, the direct-owner checks and loopback/control package
-suites pass under the race detector. This is an experimental slow-transport
-requirement, not an established published failure. The
-[authorization boundary](#peer-authorization-boundary) owns the subsequent
-Viewer startup and receive-command evidence; no new recovery loop or room
-resource registry is added.
-
-The earlier FFmpeg matrix had one decoded-content failure. Matched synthetic
-bitstream/RTP replay identifies a receiver-fixture mismatch: its separate SDK
-assembler emits a truncated startup frame and can resume dependent frames after
-a sequence gap without their reference. Increasing that builder's window instead
-stalls recovery. On identical unchanged and source-handoff recordings, the
-product relay-input owner's independent-keyframe boundary produces only
-byte-matched source frames, with no decoder errors or corrupted colours.
-The fixture now reuses that owner. All six unchanged, address-change and loss
-controls pass with actual encoding/decoding and Linux race detection, without
-decoder errors or changes to product timeout, adaptation or recovery policy.
-The original failed run has no packet recording, so its exact cause remains
-unassigned; this correction does not establish universal media continuity.
-
-Dual-stack namespace controls enabled STUN and alternately blocked IPv4 UDP or
-IPv6 forwarding. Both stacks used the working family; Tailcat's direct proof
-required fresh bidirectional delivery after DERP closed. One side reporting a
-direct address did not establish that both directions were direct. IPv4 TCP
-still supplied bootstrap, so this is not an IPv6-only or physical ISP check.
-These controls add no demonstrated direct-reachability advantage for Magicsock.
-
-The actual Native `mediaedge.Engine` Host/Viewer now runs through the same kernel
-gateways, including local playback and the unchanged TypeScript survey predictor.
-Three Linux race repetitions received ten distinct RTP packets containing the
-generated VP8 frame, excluding padding/duplicates. With no gateway service,
-mapping enabled did not hold ordinary media behind discovery: delivery took
-about 0.8 seconds. Either usable IP family also carried media. Sequential-port
-NAT failed without prediction and delivered through a predicted candidate when
-enabled, with the changing-port gateway on either endpoint; random-port NAT
-remained unreachable in the bounded checks. A real
-MiniUPnPd gateway made a hard/hard pair reachable when mapping was enabled.
-These are encoded-media checks, not capture, Browser decode or room admission.
-
-Tailcat's matched controls explicitly link its [optional portmapper feature](https://github.com/tailscale/tailscale/blob/a0e471a35b8f/feature/portmapper/portmapper.go);
-clearing its disable flag alone does not register that optional feature. Gateway
-mapping then passed three race repetitions after DERP closure. The 20-second
-comparison distinguishes fresh direct SRTP from relay delivery and retains the
-same gateway filtering. Its relay bootstrap and Piik's local playback differ,
-so startup timings are not a first-picture benchmark.
-
-A 2026-10-08 fairness control found that Tailcat's single bootstrap region leaves
-`MappingVariesByDestIP` unknown even with three STUN addresses: upstream
-[netcheck](https://github.com/tailscale/tailscale/blob/a0e471a35b8f/net/netcheck/netcheck.go)
-cancels the region's other probes after its first reply. A lab-only map projection
-gives those real addresses independent probe regions and pins the original relay;
-it is not a supported Tailcat option. Twelve Linux race cases verify classification
-on the actual media socket, keep media flowing until relay closure at 12 seconds,
-and require a fresh payload before the 20-second bound. Random/sequential pairs
-remain relay-only in both directions, with or without an absent-gateway mapping
-probe; an available gateway still establishes direct media. No extra direct path
-over Piik was found. Physical routers and field success rates remain unmeasured.
-Product dependencies and routing are unchanged.
-
-The experiment's README owns commands and fixture boundaries; raw output remains
-ignored. Further product work needs a measurable network benefit and accepted
-room authorization, resource and relay-operation owners, not more loopback
-successes.
-
-### Peer Authorization Boundary
-
-The 2026-10-08 three-peer control found that Tailcat forgets a revoked key but
-leaves its WireGuard session alive: fresh inbound UDP still arrives after
-`DisconnectClient` returns and `PeerKey` no longer recognizes it. A separate
-controlled race lets a late positive `AllowClient` result re-admit a revoked
-key. Both defects were independently reproduced; Tailcat's checked
-[October 7 source](https://github.com/tailscale/tailcat/blob/52fbad323e9d352f1febb623e0975368e9a8cbdd/tailcat.go)
-retains both mechanisms. Piik's current transport does not use this dependency.
-
-An opt-in Tailcat patch syncs the existing engine after releasing the backend
-lock and invalidates late results in its pending-hook map. Three Windows
-repetitions and three Linux race runs reject both traffic directions and new
-admission, preserve two healthy peers' media and permit a later explicit grant.
-Removing either correction fails its regression; upstream admission/disconnect
-checks pass. This repairs the Tailcat layer only.
-
-A deeper unit reproduction pauses WireGuard's lazy peer-config lookup, withdraws
-authority and calls `RemovePeer`, then releases the old result. `LookupPeer`
-still installs an active peer. Both the pinned `0a83b87f7908` and
-[October 2 revision](https://github.com/tailscale/wireguard-go/blob/18e99eba5393b8c9ea513ab7a1db1a12625422ca/device/device.go)
-reproduce it. An isolated patch on the newer version tracks in-flight config
-lookups at the peer table and starts lazy peers under that same lock. Removing
-a key retires only its pending calls; lookup replacement and close retire all.
-Tokens are reclaimed on completion without accumulating historical keys.
-An unrelated-key control rejects a global generation fence: it cancels valid
-concurrent admission. Scoped tokens preserve that admission, overlapping grants
-and cleanup; removing the retirement check reproduces stale installation.
-The full device suite and lock-order analyzer pass, including three Linux race
-runs. Combined media and TWCC checks pass on Windows and Linux; the Linux kernel
-NAT, dual-stack, rebinding and weak-network controls also pass. Supported dependency
-contracts and demonstrated network benefit remain open. The probe retains the
-isolated patches; Piik's production transport is unchanged.
-
-Admission ordering is also an integration constraint. Upstream
-[`Client.DialUDPPort`](https://github.com/tailscale/tailcat/blob/52fbad323e9d352f1febb623e0975368e9a8cbdd/tailcat.go)
-waits for the server to admit the client's key before returning a socket.
-Piik creates the receiver and its socket before returning a media answer.
-Authorizing that key only after receiving the answer would therefore introduce
-a circular wait. An isolated `PrepareUDPPort` patch reserves the local address
-without waiting for admission. Through real Native control, it can return the
-answer first and receive fresh RTP if the fixture holds remote ICE candidates
-until the grant completes. Both receiver/control retirement paths retain their
-cleanup checks; the pre-granted control uses the same client/server orientation.
-Without that experimental candidate gate, Native sends five ICE checks before
-the roughly one-second grant acknowledgment, reaches eight and receives no RTP
-within the unchanged bound. Complete-SDP and early-trickle controls both fail.
-The early-trickle counterfactual is opt-in and intentionally fails its media check.
-
-The simpler pre-ICE control uses supported `DialUDPPort` in both Native
-listener/dialer orientations. With keys already admitted, the real Native control
-session receives fresh RTP, replaces a flow without interrupting its sibling and
-retires all flows on stop or control close. All four Linux race cases and vet
-pass with `PrepareUDPPort` removed from the copied dependency, without an explicit
-diagnostic ping or an admission-dependent candidate gate. The other isolated
-dependency corrections remain. This removes the need for that extra startup API
-when key admission precedes media negotiation; it does not implement room-scoped
-key exchange or demonstrate higher direct reachability.
-
-The isolated signaling extension carries bounded listener metadata on the
-assigned parent's ordinary SDP offer. SDP/ICE remain the signal variants;
-there is no extra key-exchange message or router authorization branch. Actual
-room WebSocket checks reject unrelated peers/rooms, retired candidates and
-listener metadata on answers or ICE candidates. Ordinary invitation revocation
-still closes the authenticated Viewer session. Protocol/signaling race suites
-pass. The generated extension adds no server key registry or product wire change.
-
-A separate Native control check derives admission from its actual owned inbound
-flows. Closing one flow retains the shared peer's authorization while another
-flow remains; closing the last disconnects that peer. Final revocation and a new
-grant serialize without holding the flow-map lock through Tailcat callbacks.
-Stop and control-close cases pass under the race detector, including fresh
-sibling RTP before preparing a replacement. Counterfactuals that disconnect on
-every close or never disconnect fail those checks. This composes physical-flow
-cleanup with the Native session; keys in that control remain local fixture inputs.
-The pending-flow adapter also rejects a different admitted peer without consuming
-the assigned listener. The two-peer control reproduced the former premature
-close; the repair permits the expected peer or cancels through the same owner.
-
-The composed room/Native experiment separates session availability from actual
-transport identity. Native control advertises only availability in its ordinary
-ready response; authentication and existing assignments project that fact only
-to assigned parents. Restart/reconnect can clear it through the same owners.
-No persistent device key or room-wide key registry is added. App-launched Viewer
-startup uses its existing discovery promise; missing App retains Browser fallback.
-Late discovery, unmount, control replacement and stale close remain fenced.
-
-The parent reserves its listener and sends its bounded metadata with the ordinary
-SDP offer. The actual receive command creates or reuses the parent-bound Tailcat
-client and emits its public key through a connection-scoped Native event before
-dialing. An experimental `native-peer` signal returns that key to the exact
-assigned listener; its grant precedes receiver ICE. Parent-side binding checks
-the complete listener identity, is immutable after binding, and ends with that
-physical flow. Preparing and committed routes use the existing authorizer;
-reverse, unrelated, cross-room and retired-connection messages are rejected.
-Listener metadata accepts no relay URL or region. Trusted relay configuration
-remains local, and diagnostics exclude connection keys.
-
-On 2026-10-10 the previous session-wide key produced duplicate DERP registrations
-when two distinct parent-bound clients overlapped. Upstream
-[DERP registration](https://github.com/tailscale/tailscale/blob/main/derp/derpserver/derpserver.go)
-selects among duplicate connections; local direct RTP had hidden this conflict.
-The corrected adapter uses Tailcat's default fresh identity per client, sharing
-that client only across physical flows to the same parent address. Both the
-same-parent and independent-tunnel-parent controls now require zero duplicates
-and fresh RTP before and after old-flow retirement. These controls use one
-assigned room parent with two listener instances; they do not yet prove a full
-room-controller handoff between different participant parents.
-
-Fresh client identity also avoids the measured same-key recreation delay: the
-old first WireGuard response went to a cached endpoint and data arrived only on
-the next handshake. Last-receiver replacement now meets the original five-second
-media bound without resetting the parent, extending timeouts or patching client
-discovery lifetime. The superseded dependency patch is removed. Receiver reuse
-still requires identical listener metadata; a changed listener replaces the
-source/transport through its existing owner. Sibling and ordinary reuse checks
-retain their behavior.
-
-Control close cancels dialing and joins each pending construction before final
-client close: Tailcat's close-before-initialization is not terminal. Queued
-identity events lose authority with the flow. Native control, loopback and
-listener retirement checks cover cancellation and ordinary cleanup; the parent
-adapter also retains its already-authorized remote address so a late write fails
-normally when the dependency clears its endpoint.
-
-The isolated Native sender now prepares its listener through the existing
-Host/Viewer edge socket factory. Its offer returns metadata, and a strict
-connection-scoped control command binds the reply through that same edge.
-There is no additional control-level listener registry. The raw transport checks
-and Native overlay compile the same admission/socket adapters. Closing an edge
-revokes its listener; retiring the source releases its remaining children.
-`TestNativeSenderOwnsListener` carries a generated VP8 source through the actual
-Native receive/relay commands to two Native children. It checks fresh sibling
-RTP after one child retires, idempotent replies and rejection of another listener
-or a retired connection. Host/media-edge/Viewer/control race suites pass. This
-fixture still pumps events instead of running the Browser route owners; it is
-not physical Host capture or complete room-controller acceptance.
-
-The overlaid Browser NativeViewerPeer forwards the listener and returns scoped
-identity events while receive-offer is pending. Wrong share/connection and
-post-disposal events are ignored; there is no extra preparation timer or pending
-identity registry. The sender reads capability from the current preparation,
-assignment or recovery message, without a second capability cache. Existing
-Browser owners dispatch the reply to the listener's Native edge. Focused tests
-cover stale replies, deep-copied assignment capability and recovery after a
-capability change.
-
-An owned Linux/Chromium 152 run exercises the actual UI and room controller with
-a generated 640×360 VP8 canvas source and one outbound copy per participant:
-Browser Host → Native Viewer → Native Viewer → Browser Viewer. The inner Native
-pair uses Tailcat; the outer Browser links retain ordinary WebRTC. Reconnecting
-the second Native Viewer replaces its listener/client without accumulating
-resources. After the first Native Viewer leaves, the next Viewer changes to the
-Browser Host and both remaining Viewers resume decoded, changing pixels. Removing
-the second Native Viewer then restores an ordinary Browser-to-Browser route.
-All transport counters are zero at retirement. A second rendered run uses H264
-and three Native Viewers across two App instances. When the middle Native Viewer
-leaves, the last Viewer changes to the first Native Viewer, receives a new scoped
-connection and resumes decoded, changing pixels; the departed participant retains
-no transport resources. The normal App control-session and origin limits remain.
-In the mixed Browser/Native chain, revoking a private room's invitation removes
-all Viewers and Native transport resources while the Host continues sharing.
-The old invitation remains rejected after rotation; a fresh invitation restores
-the chain and decoded media without retaining the retired transports.
-With copy capacity two, four Native Viewers exercise the overlapping path:
-the Browser Host feeds Native A/B, and A initially feeds C/D. Controlled
-relay-capacity messages move D from A to B and back through the real controller.
-Holding D's first-frame acknowledgement leaves two Native client/flow pairs
-alive while its old displayed picture advances; releasing it commits the new
-parent and retires only the old pair. C keeps its connection and continues
-decoding. Final resource and race checks pass. This exercises transport ownership
-under a capacity change, not the quality-degradation trigger or its thresholds.
-This is bounded local rendered acceptance, not physical capture, difficult-NAT
-reachability or sustained recovery.
-
-Cold receiver preparation initially took about three seconds in this fixture.
-The local DERP region had no STUN service: two preauthorized registration controls
-took about four seconds without STUN and 15–16 ms with it. Reusing Piik's STUN
-server in the UI fixture reduced cold receive-offer responses to 21–25 ms. Keep
-unavailable-STUN controls separate from healthy startup measurements. This finding
-changes the test environment, not product timeouts or retry behavior; it does not
-predict public-network latency.
-
-Composition also exposed duplicate address discovery: the shared candidate
-collector still sent ordinary STUN probes through the injected virtual socket.
-The experimental socket boundary now leaves outer discovery to Tailcat. A local
-STUN control fails before this correction and passes after it; ordinary Native
-gathering still produces its observed candidate. There is no timeout extension
-or additional retry owner. Availability, public keys and handshake replies
-remain distinct from decoded-frame readiness and additional field reachability.
-
-A separate optional-path check uses Pion's public
-[`NewMultiUDPMuxDefault`](https://github.com/pion/ice/blob/v4.4.0/udp_mux_multi.go)
-to advertise ordinary UDP and one prepared Tailcat flow on the same
-PeerConnection. Fresh audio/video passes with either path unavailable, and
-normal ICE restart selects the remaining path in both directions. Making the
-unused tunnel available or closing it preserves the ordinary session and its
-ICE credentials. Windows and Linux race checks pass without an application
-path selector or changed ICE budgets. These local tests permit DERP and prepare
-the tunnel before ICE; they establish composition, not direct-media policy,
-NAT gain or cold-bootstrap independence.
-
-The default Native overlay replaces its ordinary socket with the tunnel.
-`DialUDPPort` waits for remote admission, while Pion's stock multi-mux requires
-the sockets' addresses at construction. Simply combining them synchronously
-would let unavailable bootstrap delay otherwise usable ordinary ICE. A supported
-way to prepare an optional socket independently remains an adoption requirement;
-the earlier private `PrepareUDPPort` patch is not a supported upstream API.
-Do not replace this gap with two racing PeerConnections, a second recovery
-controller or a larger product timeout.
-
-An isolated Linux race control combines that reservation patch with the same
-multi-mux: ordinary SRTP starts while remote admission is denied or bootstrap is
-unavailable, and continues through a delayed grant. For a tunnel-only pair,
-publishing its candidate only after admission establishes fresh audio/video in
-the same ICE generation. Ordinary candidates are available immediately;
-end-of-candidates follows the optional producer. Publishing the tunnel candidate
-early instead leaves both peers connecting with no media in the matched control.
-The candidate ordering uses [Trickle ICE](https://www.rfc-editor.org/rfc/rfc8838.html),
-without another PeerConnection, timeout extension or application retry loop.
-After ordinary ICE has nominated a pair, a late optional candidate is omitted;
-it may participate in a subsequent gathering. This raw fixture permits DERP and
-edits its own SDP; it does not establish direct-media policy or greater NAT coverage.
-
-The separate optional Native overlay now preserves the ordinary socket's STUN
-and mapping owner and adds its virtual socket to that same Pion connection.
-The receiver's existing candidate collector owns delayed advertisement, EOC and
-cancellation; its SDP answer cannot bypass that collector. The existing flow
-owner joins admission work on close. Native controls establish ordinary media
-before the tunnel grant and with bootstrap unavailable. A tunnel-only control
-establishes media after delayed admission, then preserves a sibling and a new
-receiver through old cleanup. Candidate events continue during the delay:
-bypassing the readiness gate leaves the sender checking with no media. Linux
-race checks pass.
-
-A bounded Chromium 152 UI check also runs the optional composition through a
-Browser Host, two Native relays and a Browser Viewer. Changing decoded pixels
-advance at every hop, after the second relay's manual reconnect, and after each
-Native relay departs. Departure recovery respects the existing signaling grace;
-retired Native transport counts reach zero. Host stop projects waiting for a
-share, and the race-enabled fixture closes cleanly. This uses a synthetic source
-on one local network; ordinary ICE may win. It establishes coexistence and these
-recovery paths, not a tunnel-success rate, physical capture or complete App
-acceptance. Optional invitation revocation also rejects old links, clears media
-resources and permits new Native reception across four grant generations. This
-check exposed and now covers the shared Viewer's
-[control-retirement gap](./native-client-lifecycle.md#viewer-control-retirement).
-A second optional UI check moves one Native Viewer between two Native parents
-in both directions through the real room controller. Holding candidate readiness
-within the unchanged operation deadline preserves the old video element, stream
-and advancing frames while both receiver flows exist. Releasing readiness commits
-the new parent and retires only the old flow; a sibling retains its connection
-and advancing decoded pictures throughout. Final transport counts reach zero
-under the race detector. The fixture disables automatic quality tuning and
-changes advertised capacity to isolate overlapping ownership. This local synthetic
-check does not measure handoff latency, difficult-network success or tunnel selection.
-The optional composition also passes the kernel-NAT real-codec controls with
-Chromium 152 and Firefox 151: unchanged paths, either endpoint's address change,
-and a short complete interruption. Ordinary Pion supplies unchanged/interruption
-controls. New blue content renders on the same track after DERP closes, with
-zero relayed encrypted data. Firefox renegotiates its local leg once when its
-endpoint moves; Chromium retains that leg. No timeout or address policy changes.
-These synthetic-source checks exercise the Native engine and Browser bridge,
-not complete App startup, physical roaming or another reachable NAT class.
-
-A non-race Chromium comparison also measures the isolated Go workers. One
-roughly 18-second, 640x360/30 connection used peak RSS of 64/65 MiB for ordinary
-sender/receiver workers and 72/72 MiB with the optional tunnel. Live goroutines
-rose from 39/65 to 96/122; final cumulative CPU times were 0.48/0.54 seconds and
-0.67/0.67 seconds respectively. These are bounded observations, not App budgets:
-the codec, Browser and relay run separately, and both controls link the same
-binary. Shared listeners and clients also prevent linear extrapolation to a
-room. A stripped Windows App build grows from 44.1 to 59.8 MiB with the isolated
-composition, using the same embedded UI and module selection. This excludes
-capture/tunnel helpers and ZIP compression. Sustained cost remains open.
-
-The isolated App overlay now installs that constructor in the actual process-level
-control factory. Its matched experimental wire identity rejects product builds,
-local CLI configuration selects the TLS bootstrap, and DERP media is disabled in
-the binary rather than by an optional environment setting. Actual Windows App
-and embedded-UI checks retain fresh decoded pixels and manual reconnect through
-ordinary ICE when the experimental bootstrap is unavailable. Two independent
-control sessions and process retirement also pass a race check. The Linux full-App
-fixture also selects Magicsock with ordinary remote candidates withheld, renders
-generated Browser pixels through both Native sessions, and restores pictures on
-a new selected connection after manual Viewer reconnect. Closing its process-owned
-TLS bootstrap still leaves 300 new frames over ten seconds at 640x360/30, with
-changed decoded pixels; App retirement passes the race check. This is local
-integration evidence, not another reachable NAT class.
-
-A non-race full-App comparison uses one Native and three plain-Browser Viewers
-with a generated 640x360/30 source. Each Viewer receives 300–301 new frames and
-changing pixels over its ten-second observation. Ordinary/optional runs peak
-at 81.8/93.2 MiB RSS and use 3.76/4.08 seconds of Go CPU during the roughly
-forty-second observation sequence. Live goroutines fall from 211/327 to 27 in
-both modes after tabs close, then the App exits normally. The optional run
-selects Magicsock on the Native pair with ordinary remote candidates withheld;
-Web edges retain ordinary ICE. Both measurements include the same owned TLS
-bootstrap/STUN fixture and exclude separate Browser/codec processes. This is a
-bounded mixed-room cost and retirement check, not endurance, a 20-Viewer budget
-or a network-success comparison.
-
-A bounded full-room run with one Native and nineteen Web Viewers also retains
-changing 640x360/30 pictures: each ten-second observation advances 296–301 frames.
-The twenty-first code-only attempt receives the existing generic admission
-denial, a retained Viewer keeps receiving, and the App exits normally after
-all tabs close. The Go process peaks at 99.3 MiB RSS. These Viewers share one
-machine; this does not cover twenty Native peers or physical-network endurance.
-
-A frozen Windows internal package includes the numeric-media candidate, matched
-experimental UI, helpers and notices, separate ordinary/experimental launchers
-and bilingual paired-test instructions. Final-package checks cover native discovery,
-two control sessions, unselected-origin denial, shutdown and Explorer ZIP members
-with extracted-file hashes. Its experimental launcher selects the
-[upstream public bootstrap](https://github.com/tailscale/tailcat#tailcat) for the
-future paired test; local acceptance used owned or unavailable bootstrap only.
-Physical capture, public-invitation operation and field benefit remain open.
-
-This composition also exposes an upstream address-lookup mismatch: Pion's
-multi-mux enumerates current child addresses but `GetConn` only consults its
-construction-time table. A newly enumerated address therefore has no mux. The
-isolated correction resolves uncached addresses against those same child muxes,
-without another address cache or socket owner; the unchanged control fails.
-A private Linux network namespace also replaces the real interface address
-while retaining the sockets and PeerConnections. ICE restart gathers only the
-new address and restores fresh phase-tagged audio/video. Removing only the
-multi-mux correction loses that candidate in the matched control. The race
-check preserves ordinary discovery; it does not exercise physical Wi-Fi handoff
-or prove the optional tunnel's recovery benefit.
-The copied dependency correction and socket-reservation method remain adoption
-requirements, not supported APIs or changes to the published Piik dependency.
-
-`room-browser.mjs` bundles the real Browser schemas and diagnostics with matching
-experimental fields. It accepts the Go fixture's twelve route/restart messages,
-rejects malformed capability/listener fields and removes scoped keys from both
-console events and exported reports while retaining connection and keyframe
-evidence. The Go and Browser optional-map null checks agree. This is a Node-run
-producer/consumer check, not Browser UI or complete App transport acceptance.
-The product wire and diagnostic implementation remain unchanged.
-
-These transport checks establish startup-order and ownership constraints, not a
-product integration or the cause of unmatched field reports. The earlier candidate gate and unsupported
-dependency method are not accepted product mechanisms.
-The existing assigned-connection and candidate owners must order admission and
-advertisement so the usable tunnel receives live ICE checks; ordinary ICE need
-not wait for that optional producer. Accepting arbitrary keys, passing room credentials
-into Native control or enlarging its timeout is not an equivalent solution.
+These observations establish a compatibility limit, not every Browser permission
+or public-Site behavior. Keep the existing address policy.
+
+Complete App controls on October 10, 2026 reproduced the consequence in a
+disposable Linux namespace. Chromium 152 retained its loopback bridge after a
+LAN address change. Firefox 151 selected the removed LAN address: its Host
+ended an otherwise healthy share, while its Viewer eventually used Browser
+fallback. Fresh rendered frames, rather than accumulated frame counts, were
+used for acceptance. The source was generated VP8 through the real capture
+process boundary, not physical capture.
+
+The corrected existing bridge owner performs standard ICE restart after a
+three-second disconnect grace or immediately on failure. Initial and restart
+negotiations use complete SDP and fence answers by request ID. The eight-second
+negotiation bound includes up to five seconds of Native gathering; retirement
+cancels it. Existing Host/Viewer terminal owners handle failure, and paused
+sources need not produce frames to establish the transport connection.
+There is no second local candidate queue or recovery controller.
+
+Matched controls retained the same Firefox Host and Viewer tracks through the
+address change. Host sharing and downstream decoding continued; the Native
+Viewer recovered without a route replacement or Browser fallback. Chromium
+retained its working loopback leg. Replacing only the Native PeerConnection,
+while keeping the Browser connection, instead reported connected without fresh
+pictures in a counterfactual. The tests therefore support standard ICE restart,
+not unilateral reconstruction or a claim of physical roaming coverage.
+
+### Recovery Ownership And Forwarding
+
+A real Viewer-owner fixture retained sockets and external conditions through
+interruption and replacement. It exposed recovery counts being renewed with a
+new Native/Browser backend, permitting an extra request. The corrected budget
+belongs to the parent opportunity, as specified by the existing
+[recovery owner](../standards/routing-transport.md#reconciliation).
+Trickle-exchange controls recovered ordinary Pion after two-, nine- and
+eleven-second interruptions in three runs each. A full-gathering fixture failed
+while the network was unavailable; that negative control was a fixture limit,
+not evidence for extending product deadlines.
+
+A separate live Windows VP8/Native forwarding control exposed stale decoded
+pictures after roughly one second of UDP loss: hundreds of already-encoded
+packets remained in the former throttled queue. Forwarder frame counts preceded
+actual paced writes and could not prove delivery. With the upstream default send
+queue and the local playback leg isolated, all six ordinary/experimental
+unchanged, address-change and short-loss controls retained fresh decoded
+content after relay closure. The
+[send-queue assessment](./node-local-media-design.md#send-queue-recovery)
+owns the constrained-bandwidth comparison and adopted correction. This is not
+proof that every brief blur or unmatched interruption shares that cause.
+
+The same full-room work found a denied Viewer retaining its App control slot
+across repeated invitation generations. The
+[control-retirement assessment](./native-client-lifecycle.md#viewer-control-retirement)
+owns that independent repair and its rendered acceptance boundary.
+
+### Gateway And Address-Family Controls
+
+The actual Native `mediaedge.Engine` Host/Viewer also ran through Linux kernel
+gateways with local playback and the unchanged TypeScript predictor. Three race
+repetitions required distinct generated VP8 RTP, excluding padding and duplicate
+packets. Without a gateway service, best-effort mapping did not block ordinary
+media behind discovery. Either usable IP family carried media when the other
+was blocked. Sequential-port NAT failed without prediction and used a predicted
+candidate when enabled, with the changing-port gateway on either endpoint;
+random-port NAT remained unreachable in the bounded controls. A real MiniUPnPd
+gateway made a hard/hard pair reachable with mapping enabled.
+
+These are encoded-media controls, not physical capture, Browser decode, complete
+room admission or a new field-success measurement. The matched Tailcat controls
+needed its optional portmapper module and a fair multi-region STUN projection;
+they still established no additional direct path. Existing mapping, prediction
+and IPv6 should be assessed against the same endpoints and relay policy before
+another mechanism is proposed.
 
 ## Native Mapping Cache And Retry Lifetimes
 
diff --git a/docs/research/node-local-media-design.md b/docs/research/node-local-media-design.md
index 2f8db494f..1ccecb116 100644
--- a/docs/research/node-local-media-design.md
+++ b/docs/research/node-local-media-design.md
@@ -414,8 +414,8 @@ packets drain in two seconds. The upstream unthrottled writer drains the same
 input once the writer resumes. A separate real Windows VP8 codec and
 Native forwarding control reproduces stale decoded pictures after roughly one
 second of ordinary UDP loss; the packet-count cap alone does not prevent this.
-The [Native transport experiment](./nat-traversal.md#integration-cost-and-recovery-controls)
-owns the decoded-picture and address-change boundary.
+The [ordinary media controls](./nat-traversal.md#recovery-ownership-and-forwarding)
+retain the decoded-picture and address-change evidence boundary.
 
 Congestion callbacks could also promote the estimator's unmeasured 100 Mbps
 initial capacity while a probe was pending. Congestion now only reduces the

From 680fba2e2dc0ec74a08546098282b15b02c6093d Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 00:21:23 +0800
Subject: [PATCH 146/262] fix(media): distinguish H264 display areas from
 decoder storage

---
 docs/research/native-client-media.md          |  24 ++++-
 native/capture/darwin/README.md               |   3 +-
 native/capture/darwin/main.swift              |  69 +++++++++++----
 native/capture/windows/h264_decoder.h         |  31 ++++++-
 native/capture/windows/main.cpp               |  40 ++++++---
 native/capture/windows/output_worker.test.cpp |  83 +++++++++++++++++-
 native/fixtures/h264-padding/README.md        |  22 +++++
 native/fixtures/h264-padding/aperture.h264    | Bin 0 -> 25534 bytes
 8 files changed, 237 insertions(+), 35 deletions(-)
 create mode 100644 native/fixtures/h264-padding/README.md
 create mode 100644 native/fixtures/h264-padding/aperture.h264

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 614f16f4b..469907aab 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -3,8 +3,8 @@
 - Reviewed: 2026-10-06
 - Scope: platform capture, shared encoded sources, Pion transport and Browser
   decode; current behavior belongs to [media quality](../standards/media-quality.md)
-- Status: Windows physical native Host and Viewer gates passed; macOS and Linux adapters
-  compile and package but still require physical media gates
+- Status: Windows physical native Host and Viewer gates passed; current macOS
+  changes await SDK compilation, and macOS/Linux physical media gates remain open
 
 ## Windows Audio Exclusion
 
@@ -614,6 +614,26 @@ An isolated Level 5.2 trial was rejected by this machine's hardware encoder at
 output-type setup; it did not reach the decoder. The candidate therefore keeps
 Level 5.1 and rejects 4K60 before allocating an encoder.
 
+Decoder format checks must distinguish storage from visible content. On
+2026-10-11, the Windows decoder rejected a valid 3840x2160 picture stored in a
+3840x2176 surface because its output check applied the visible-pixel bound to
+codec padding. Media Foundation's [display aperture](https://learn.microsoft.com/en-us/windows/win32/medfound/picture-aspect-ratio)
+and CoreMedia's [clean aperture](https://developer.apple.com/documentation/coremedia/cmvideoformatdescriptiongetcleanaperture(_:originisattopleft:))
+own visible dimensions; both adapters now validate these separately from bounded
+coded storage. Windows copies the aperture while retaining the decoder surface,
+so downstream outputs receive the visible picture. The native regression checks
+right/bottom H.264 padding with real software decoding, visible edge pixels, and
+an offset NV12 aperture through the DXGI-buffer path. Oversized coded/reference
+storage remains rejected; the macOS SDK boundary above still applies.
+
+An additional nonzero left/top SPS crop exposed a local Media Foundation software
+decoder limit: its raw output omitted right/bottom picture pixels before Piik's
+surface copy. FFmpeg decoded the same generated frame correctly. Removing the
+input-size hint or changing output-aperture attributes did not restore them.
+The passing ordinary alignment-padding controls do not establish arbitrary SPS
+crop support on that decoder; no bitstream rewrite or replacement decoder is
+introduced for this unreported platform edge case.
+
 Current production Windows code encoded and decoded 30 synthetic frames in each
 4K orientation, both with and without a D3D decoder manager. Retaining/uploading
 the decoded surface also passed. The normal Go/native encoded-input path then
diff --git a/native/capture/darwin/README.md b/native/capture/darwin/README.md
index f0600fa1c..a2cf08487 100644
--- a/native/capture/darwin/README.md
+++ b/native/capture/darwin/README.md
@@ -20,7 +20,8 @@ sh native/capture/darwin/build.sh /outside/repository/build
 ```
 
 `--geometry-self-test` checks content cropping, Retina scaling and rejection of
-invalid frame geometry without requiring a hardware encoder. `--self-test`
+invalid frame geometry, plus H.264 visible/coded-size admission, without requiring
+a hardware encoder. `--self-test`
 encodes successive landscape, portrait, ultrawide and small 420v buffers through
 one output worker, requiring the fitted dimensions and a constrained-baseline
 SPS/PPS/IDR after each size change. Neither needs Screen Recording permission.
diff --git a/native/capture/darwin/main.swift b/native/capture/darwin/main.swift
index 716fa1724..7ee5e60ce 100644
--- a/native/capture/darwin/main.swift
+++ b/native/capture/darwin/main.swift
@@ -17,6 +17,8 @@ private let bitrate = 3_000_000
 private let maxPayloadBytes = 4_194_304
 private let maxVideoDimension = 3840
 private let maxVideoPixels = 3840 * 2160
+private let maxCodedVideoDimension = 4096
+private let maxCodedVideoPixels = 36_864 * 16 * 16
 private let supportedH264Levels: Set<UInt8> = [
     0x1e, 0x1f, 0x20, 0x28, 0x29, 0x2a, 0x32, 0x33,
 ]
@@ -1168,6 +1170,22 @@ private func geometrySelfTest() throws {
     guard VideoImage(buffer, attachments: outside) == nil else {
         throw CaptureFailure(description: "out-of-bounds capture content was accepted")
     }
+    // Generated Constrained Baseline: 3856x2176 storage, 3840x2160 visible.
+    // Exercise CoreMedia's SPS interpretation without allocating a decoder.
+    let sps = Data([0x67, 0x42, 0xc0, 0x33, 0xd9, 0x00, 0x3c, 0x40, 0x44,
+                    0x78, 0x98, 0x9c, 0x04, 0x40, 0x00, 0x00, 0x03, 0x00,
+                    0x40, 0x00, 0x00, 0x0c, 0x23, 0xc6, 0x0c, 0x92])
+    let pps = Data([0x68, 0xcb, 0x83, 0xcb, 0x20])
+    let format = try h264InputFormat(sps: sps, pps: pps)
+    guard CMVideoFormatDescriptionGetCleanAperture(format, originIsAtTopLeft: true) ==
+        CGRect(x: 0, y: 0, width: 3840, height: 2160) else {
+        throw CaptureFailure(description: "H.264 visible aperture self-test failed")
+    }
+    let oversized = Data([0x67, 0x42, 0xc0, 0x33, 0xda, 0x00, 0xf0, 0x01,
+                          0xe1, 0xf8, 0x03, 0x49, 0x40])
+    guard (try? h264InputFormat(sps: oversized, pps: pps)) == nil else {
+        throw CaptureFailure(description: "H.264 crop concealed oversized storage")
+    }
 }
 
 private final class AudioCaptureOutput: NSObject, SCStreamOutput, SCStreamDelegate {
@@ -1625,6 +1643,39 @@ private func readInput(done: StopSignal, outputs: [OutputProfile] = [],
     }
 }
 
+private func h264InputFormat(sps: Data, pps: Data) throws -> CMVideoFormatDescription {
+    var format: CMFormatDescription?
+    let status = sps.withUnsafeBytes { first in
+        pps.withUnsafeBytes { second in
+            let pointers = [first.bindMemory(to: UInt8.self).baseAddress!,
+                            second.bindMemory(to: UInt8.self).baseAddress!]
+            let sizes = [sps.count, pps.count]
+            return CMVideoFormatDescriptionCreateFromH264ParameterSets(
+                allocator: kCFAllocatorDefault, parameterSetCount: 2,
+                parameterSetPointers: pointers, parameterSetSizes: sizes,
+                nalUnitHeaderLength: 4, formatDescriptionOut: &format)
+        }
+    }
+    try require(status, "decode-h264-format")
+    guard let format else { throw CaptureFailure(description: "missing input format") }
+    let dimensions = CMVideoFormatDescriptionGetDimensions(format)
+    let width = Int(dimensions.width), height = Int(dimensions.height)
+    guard width >= 2, width <= maxCodedVideoDimension, width % 2 == 0,
+          height >= 2, height <= maxCodedVideoDimension, height % 2 == 0,
+          width * height <= maxCodedVideoPixels else {
+        throw CaptureFailure(description: "decoded input storage exceeds its bound")
+    }
+    // Encoded dimensions include padding; the clean aperture owns visible size.
+    let area = CMVideoFormatDescriptionGetCleanAperture(format, originIsAtTopLeft: true)
+    let bounds = CGRect(x: 0, y: 0, width: width, height: height)
+    guard area.minX.isFinite, area.minY.isFinite, area.width.isFinite, area.height.isFinite,
+          area == area.integral, bounds.contains(area),
+          validVideoSize(Int(area.width), Int(area.height)) else {
+        throw CaptureFailure(description: "decoded input aperture exceeds its picture bound")
+    }
+    return format
+}
+
 private final class H264InputDecoder {
     private let encoders: EncoderGroup
     private let lock = NSLock()
@@ -1692,23 +1743,7 @@ private final class H264InputDecoder {
             guard recovery, !nextSPS.isEmpty, !nextPPS.isEmpty else {
                 throw CaptureFailure(description: "new H.264 input needs SPS, PPS and IDR")
             }
-            var nextFormat: CMFormatDescription?
-            let status = nextSPS.withUnsafeBytes { first in
-                nextPPS.withUnsafeBytes { second in
-                    let pointers = [first.bindMemory(to: UInt8.self).baseAddress!, second.bindMemory(to: UInt8.self).baseAddress!]
-                    let sizes = [nextSPS.count, nextPPS.count]
-                    return CMVideoFormatDescriptionCreateFromH264ParameterSets(
-                        allocator: kCFAllocatorDefault, parameterSetCount: 2,
-                        parameterSetPointers: pointers, parameterSetSizes: sizes,
-                        nalUnitHeaderLength: 4, formatDescriptionOut: &nextFormat)
-                }
-            }
-            try require(status, "decode-h264-format")
-            guard let nextFormat else { throw CaptureFailure(description: "missing input format") }
-            let dimensions = CMVideoFormatDescriptionGetDimensions(nextFormat)
-            guard validVideoSize(Int(dimensions.width), Int(dimensions.height)) else {
-                throw CaptureFailure(description: "decoded input exceeds its dimension bound")
-            }
+            let nextFormat = try h264InputFormat(sps: nextSPS, pps: nextPPS)
             if let session, !VTDecompressionSessionCanAcceptFormatDescription(session, formatDescription: nextFormat) {
                 VTDecompressionSessionInvalidate(session)
                 self.session = nil
diff --git a/native/capture/windows/h264_decoder.h b/native/capture/windows/h264_decoder.h
index af776bc95..76cced74e 100644
--- a/native/capture/windows/h264_decoder.h
+++ b/native/capture/windows/h264_decoder.h
@@ -63,6 +63,8 @@ class H264Decoder final {
     return windows::DecodedVideoColor(type.Get());
   }
 
+  RECT DisplayArea() const { return display_area_; }
+
   void Decode(const InputEnvelope& input, const Consumer& consume) {
     if (input.kind != 2 || input.data.empty() || input.data.size() > 4 * 1024 * 1024)
       throw std::runtime_error("Invalid H264 decoder input");
@@ -117,9 +119,31 @@ class H264Decoder final {
       if (subtype != MFVideoFormat_NV12) continue;
       UINT32 width = 0, height = 0;
       Check(MFGetAttributeSize(type.Get(), MF_MT_FRAME_SIZE, &width, &height), "output-size");
-      if (!ValidVideoSize(width, height)) {
-        throw std::runtime_error("H264 decoder output dimensions exceed the source bound");
+      if (!ValidCodedVideoSize(width, height)) {
+        throw std::runtime_error("H264 decoder output storage exceeds its bound");
+      }
+      // MF_MT_FRAME_SIZE includes codec padding. The display aperture owns
+      // visible pixels, independently of the bounded decoder allocation.
+      MFVideoArea area{};
+      UINT32 area_bytes = 0;
+      HRESULT aperture = type->GetBlob(MF_MT_MINIMUM_DISPLAY_APERTURE,
+          reinterpret_cast<UINT8*>(&area), sizeof(area), &area_bytes);
+      if (aperture == MF_E_ATTRIBUTENOTFOUND)
+        aperture = type->GetBlob(MF_MT_GEOMETRIC_APERTURE,
+            reinterpret_cast<UINT8*>(&area), sizeof(area), &area_bytes);
+      if (aperture == MF_E_ATTRIBUTENOTFOUND) {
+        area = {{0, 0}, {0, 0}, {static_cast<LONG>(width), static_cast<LONG>(height)}};
+      } else {
+        Check(aperture, "display-aperture");
+        if (area_bytes != sizeof(area)) throw std::runtime_error("H264 display aperture is incomplete");
       }
+      if (area.OffsetX.value < 0 || area.OffsetY.value < 0 ||
+          area.OffsetX.fract || area.OffsetY.fract ||
+          (area.OffsetX.value & 1) || (area.OffsetY.value & 1) ||
+          !ValidVideoSize(area.Area.cx, area.Area.cy) ||
+          area.OffsetX.value + area.Area.cx > static_cast<LONG>(width) ||
+          area.OffsetY.value + area.Area.cy > static_cast<LONG>(height))
+        throw std::runtime_error("H264 display aperture exceeds its picture bound");
       Check(decoder_->SetOutputType(0, type.Get(), 0), "set-output");
       UINT32 stride = 0;
       if (FAILED(type->GetUINT32(MF_MT_DEFAULT_STRIDE, &stride))) {
@@ -131,6 +155,8 @@ class H264Decoder final {
       width_ = width;
       height_ = height;
       stride_ = static_cast<LONG>(stride);
+      display_area_ = {area.OffsetX.value, area.OffsetY.value,
+          area.OffsetX.value + area.Area.cx, area.OffsetY.value + area.Area.cy};
       return;
     }
     throw std::runtime_error("H264 decoder has no NV12 output");
@@ -174,6 +200,7 @@ class H264Decoder final {
   UINT32 width_ = 0;
   UINT32 height_ = 0;
   LONG stride_ = 0;
+  RECT display_area_{};
   bool configured_ = false;
 };
 
diff --git a/native/capture/windows/main.cpp b/native/capture/windows/main.cpp
index 5ff8a09d1..9f1a5eae1 100644
--- a/native/capture/windows/main.cpp
+++ b/native/capture/windows/main.cpp
@@ -1662,28 +1662,38 @@ ComPtr<ID3D11Texture2D> UploadDecodedNV12(const DeviceContext& device,
 }
 
 ComPtr<ID3D11Texture2D> OwnDecodedTexture(const DeviceContext& device, IMFSample* sample,
-                                         UINT32 width, UINT32 height, LONG stride) {
-  ComPtr<IMFMediaBuffer> buffer;
-  Check(sample->GetBufferByIndex(0, &buffer), "decoded-buffer");
-  ComPtr<IMFDXGIBuffer> dxgi;
-  if (SUCCEEDED(buffer.As(&dxgi))) {
-    ComPtr<ID3D11Texture2D> original;
-    UINT subresource = 0;
-    Check(dxgi->GetResource(IID_PPV_ARGS(&original)), "decoded-dxgi-resource");
-    Check(dxgi->GetSubresourceIndex(&subresource), "decoded-dxgi-subresource");
+                                         UINT32 width, UINT32 height, LONG stride,
+                                         const RECT& display_area) {
+  // Copy the visible aperture while taking ownership of the decoder's storage.
+  // Downstream converters receive ordinary unpadded NV12, on either decoder path.
+  auto copy_visible = [&](ID3D11Texture2D* original, UINT subresource) {
     D3D11_TEXTURE2D_DESC description{};
     original->GetDesc(&description);
     if (description.Format != DXGI_FORMAT_NV12 || description.Width < width || description.Height < height ||
         !piik::capture::ValidCodedVideoSize(description.Width, description.Height))
       Fail("decoded-texture-size", "decoder texture exceeds source bounds");
+    description.Width = display_area.right - display_area.left;
+    description.Height = display_area.bottom - display_area.top;
     description.ArraySize = description.MipLevels = 1;
     description.Usage = D3D11_USAGE_DEFAULT;
     description.CPUAccessFlags = description.MiscFlags = 0;
     description.BindFlags = D3D11_BIND_SHADER_RESOURCE | D3D11_BIND_RENDER_TARGET;
     ComPtr<ID3D11Texture2D> owned;
     Check(device.device->CreateTexture2D(&description, nullptr, &owned), "decoded-owned-texture");
-    device.context->CopySubresourceRegion(owned.Get(), 0, 0, 0, 0, original.Get(), subresource, nullptr);
+    const D3D11_BOX source{static_cast<UINT>(display_area.left), static_cast<UINT>(display_area.top), 0,
+        static_cast<UINT>(display_area.right), static_cast<UINT>(display_area.bottom), 1};
+    device.context->CopySubresourceRegion(owned.Get(), 0, 0, 0, 0, original, subresource, &source);
     return owned;
+  };
+  ComPtr<IMFMediaBuffer> buffer;
+  Check(sample->GetBufferByIndex(0, &buffer), "decoded-buffer");
+  ComPtr<IMFDXGIBuffer> dxgi;
+  if (SUCCEEDED(buffer.As(&dxgi))) {
+    ComPtr<ID3D11Texture2D> original;
+    UINT subresource = 0;
+    Check(dxgi->GetResource(IID_PPV_ARGS(&original)), "decoded-dxgi-resource");
+    Check(dxgi->GetSubresourceIndex(&subresource), "decoded-dxgi-subresource");
+    return copy_visible(original.Get(), subresource);
   }
   const DWORD size = width * height * 3 / 2;
   std::vector<BYTE> pixels(size);
@@ -1707,7 +1717,11 @@ ComPtr<ID3D11Texture2D> OwnDecodedTexture(const DeviceContext& device, IMFSample
     Check(buffer->Unlock(), "decoded-memory-unlock");
     if (!valid) Fail("decoded-memory-size", "NV12 output buffer is incomplete");
   }
-  return UploadDecodedNV12(device, pixels.data(), width, height);
+  auto uploaded = UploadDecodedNV12(device, pixels.data(), width, height);
+  if (display_area.left == 0 && display_area.top == 0 &&
+      display_area.right == static_cast<LONG>(width) && display_area.bottom == static_cast<LONG>(height))
+    return uploaded;
+  return copy_visible(uploaded.Get(), 0);
 }
 
 void RunEncodedVideo(ProductArguments arguments) {
@@ -1778,7 +1792,9 @@ void RunEncodedVideo(ProductArguments arguments) {
             Check(sample->GetSampleTime(&timestamp), "decoded-timestamp");
             Check(sample->GetSampleDuration(&duration), "decoded-duration");
             if (timestamp < 0 || duration <= 0) Fail("decoded-timing", "decoder did not preserve source timing");
-            submit(OwnDecodedTexture(device, sample, width, height, stride), width, height,
+            const auto area = h264->DisplayArea();
+            submit(OwnDecodedTexture(device, sample, width, height, stride, area),
+                   area.right - area.left, area.bottom - area.top,
                    static_cast<UINT64>(timestamp), static_cast<UINT64>(duration), h264->ColorSpace());
           });
         } else {
diff --git a/native/capture/windows/output_worker.test.cpp b/native/capture/windows/output_worker.test.cpp
index bd5aeb170..2110b2ded 100644
--- a/native/capture/windows/output_worker.test.cpp
+++ b/native/capture/windows/output_worker.test.cpp
@@ -1,11 +1,14 @@
 // Exercise the production worker with a synthetic codec at its existing link
-// boundary. WARP supplies only the device-status API; no screen or audio is used.
+// boundary. WARP also checks decoded-surface copies; no screen or audio is used.
 #define wmain capture_main
 #include "main.cpp"
 #undef wmain
 
 #include <cassert>
+#include <filesystem>
+#include <fstream>
 #include <future>
+#include <iterator>
 
 namespace piik::capture::windows {
 class AdaptiveEncoder::Impl final {
@@ -309,6 +312,83 @@ void CheckSurfaceSample(ID3D11Device* device) {
   assert(time == 1'000'000 && duration == 333'333);
 }
 
+void CheckDecodedDisplayArea(ID3D11Device* device) {
+  Runtime runtime;
+  DeviceContext context;
+  context.device = device;
+  device->GetImmediateContext(&context.context);
+  auto check_red = [&](ID3D11Texture2D* texture) {
+    D3D11_TEXTURE2D_DESC description{};
+    texture->GetDesc(&description);
+    assert(description.Width == 3840 && description.Height == 2160 &&
+           description.Format == DXGI_FORMAT_NV12);
+    description.Usage = D3D11_USAGE_STAGING;
+    description.BindFlags = 0;
+    description.CPUAccessFlags = D3D11_CPU_ACCESS_READ;
+    ComPtr<ID3D11Texture2D> staging;
+    Check(device->CreateTexture2D(&description, nullptr, &staging), "fixture-readback");
+    context.context->CopyResource(staging.Get(), texture);
+    D3D11_MAPPED_SUBRESOURCE mapped{};
+    Check(context.context->Map(staging.Get(), 0, D3D11_MAP_READ, 0, &mapped), "fixture-map");
+    const auto* pixels = static_cast<const BYTE*>(mapped.pData);
+    for (UINT y : {0u, 1080u, 2159u}) {
+      for (UINT x : {0u, 1920u, 3839u}) {
+        const size_t uv = static_cast<size_t>(2160 + y / 2) * mapped.RowPitch + (x & ~1u);
+        if (pixels[static_cast<size_t>(y) * mapped.RowPitch + x] <= 60 ||
+            pixels[uv] >= 130 || pixels[uv + 1] <= 180)
+          std::cerr << "aperture pixel " << x << ',' << y << " YUV="
+                    << unsigned(pixels[static_cast<size_t>(y) * mapped.RowPitch + x]) << ','
+                    << unsigned(pixels[uv]) << ',' << unsigned(pixels[uv + 1]) << '\n';
+        assert(pixels[static_cast<size_t>(y) * mapped.RowPitch + x] > 60);
+        assert(pixels[uv] < 130 && pixels[uv + 1] > 180);
+      }
+    }
+    context.context->Unmap(staging.Get(), 0);
+  };
+
+  const auto path = std::filesystem::path(__FILE__).parent_path().parent_path().parent_path() /
+      "fixtures" / "h264-padding" / "aperture.h264";
+  std::ifstream file(path, std::ios::binary);
+  assert(file);
+  piik::capture::InputEnvelope input;
+  input.kind = 2;
+  input.recovery = true;
+  input.width = 3840;
+  input.height = 2160;
+  input.duration = 10'000'000 / 24;
+  input.data = std::vector<uint8_t>(std::istreambuf_iterator<char>(file), {});
+  unsigned decoded = 0;
+  piik::capture::H264Decoder decoder(nullptr);
+  for (unsigned index = 0; index < 4; ++index) {
+    input.timestamp = (index + 1) * input.duration;
+    decoder.Decode(input, [&](IMFSample* sample, UINT32 width, UINT32 height, LONG stride) {
+      const auto area = decoder.DisplayArea();
+      assert(width == 3856 && height == 2176 && area.left == 0 && area.top == 0 &&
+             area.right == 3840 && area.bottom == 2160);
+      check_red(OwnDecodedTexture(context, sample, width, height, stride, area).Get());
+      ++decoded;
+    });
+  }
+  assert(decoded > 0);
+
+  // Exercise the DXGI-buffer path with known NV12 padding as well.
+  constexpr UINT width = 3872, height = 2176;
+  std::vector<BYTE> pixels(width * height * 3 / 2);
+  for (UINT y = 0; y < height; ++y) {
+    for (UINT x = 0; x < width; ++x) {
+      pixels[y * width + x] = x >= 16 && x < 3856 && y >= 8 && y < 2168 ? 81 : 41;
+      if (y < height / 2) {
+        const bool red = x >= 16 && x < 3856 && y >= 4 && y < 1084;
+        pixels[(height + y) * width + x] = red ? (x % 2 ? 240 : 90) : (x % 2 ? 110 : 240);
+      }
+    }
+  }
+  auto texture = UploadDecodedNV12(context, pixels.data(), width, height);
+  auto sample = CreateSurfaceSample(texture.Get(), 1'000'000, 416'666);
+  check_red(OwnDecodedTexture(context, sample.Get(), width, height, width,
+                            RECT{16, 8, 3856, 2168}).Get());
+}
+
 int main() {
   VideoProfile profile{2560, 1440, 60, 12'000'000};
   ValidateVideoProfile(profile);
@@ -345,6 +425,7 @@ int main() {
   Check(D3D11CreateDevice(nullptr, D3D_DRIVER_TYPE_WARP, nullptr, 0, nullptr, 0,
                          D3D11_SDK_VERSION, &device, nullptr, nullptr), "fixture-warp");
   CheckSurfaceSample(device.Get());
+  CheckDecodedDisplayArea(device.Get());
   CheckAutoCadenceProbe(device.Get());
   CheckWorkerFailureGeneration(device.Get(), false);
   CheckWorkerFailureGeneration(device.Get(), true);
diff --git a/native/fixtures/h264-padding/README.md b/native/fixtures/h264-padding/README.md
new file mode 100644
index 000000000..7aa24fe31
--- /dev/null
+++ b/native/fixtures/h264-padding/README.md
@@ -0,0 +1,22 @@
+# H.264 display aperture fixture
+
+`aperture.h264` is one generated Constrained Baseline frame with 3856×2176
+encoded storage and a 3840×2160 visible aperture at (0, 0). The visible picture
+is red; the right/bottom padding is blue. It contains no screen recording or user data.
+
+The Windows output-worker test decodes it through Media Foundation and verifies
+the dimensions and NV12 pixels handed to downstream encoders. The macOS geometry
+self-test uses its SPS/PPS to check CoreMedia's format interpretation without
+allocating a hardware decoder. Both run through `npm run check:native` on their
+respective platforms.
+
+To regenerate with FFmpeg and libx264:
+
+```sh
+ffmpeg -f lavfi -i color=c=blue:s=3856x2176:r=24 \
+  -vf drawbox=x=0:y=0:w=3840:h=2160:color=red:t=fill \
+  -frames:v 1 -c:v libx264 -profile:v baseline -level:v 5.1 \
+  -preset medium -tune zerolatency -threads 2 \
+  -bsf:v h264_metadata=crop_right=16:crop_bottom=16 \
+  aperture.h264
+```
diff --git a/native/fixtures/h264-padding/aperture.h264 b/native/fixtures/h264-padding/aperture.h264
new file mode 100644
index 0000000000000000000000000000000000000000..e76960b616021b98923846fd1ff47ec6c723f3b9
GIT binary patch
literal 25534
zcmeI3y^GX97>7qaE!4(N#9}~;L%iK2yRPTq!0Gu7qLrP7+3f5kY`$(X>+M<{XdxmN
z7Ghx`+Su6$R*HrAfq#G=SXc=nC>Da9zBv@JnMwwZ`-LT$%sVp~o;>ecZ5U(g<_|w>
zEwh8OM@F~rOw2O2fzfH}t`}QxGK$7;F2CV)-L&!N&kOI5etPn8`NZQ}d*AWpU0=SA
zf=-)H@u<*>`_$Ae-<zh66AcP9PoF({e5%b4otvW(Jrz-4t|-T;>Kh(-UTZ4wf);hg
z#*{P7=HlXF<6_cNMJn?~q34_R>W$cBDUB&glN5P1!z0<1k?^=yebM4Q)lG|NAp99`
z#^W-V>9|tD8`1s9_kErz5vviehFxmy=Vdh(etiygPxuXwCeev!$w>9Wdc}H1sAWE{
zgx}#&tcy&BG}Y%ut29k2YE6%(dy%0nL<<?6drI~$6}b|Dzn7lamz4?2YLJvP^!EY_
zWmxq4l`>)~;3n2IqY?p6i((*Sx(WaGRcR8@UjB6We5Iovo$Hl{MM)-2y`dyGN~e-W
zQ-3!dYB>(0A}i&})`*qSGRbKz8mMJGrmtnDDrzmNWIi?}wFYWTVG->6(+smD7eSj>
zk;+vxG@|X*Ptvl+qg55tBpr!J_j%SOCIp+)jR;x|k1y2E7ha=7&9Yu-<tj&_bAUQ3
zqe{`{NlAd|WfFf{TQ1PMtKS4$BFWU%D-#d5U1RI-eS5}Eb*9;t&nI86spENfiQT(i
zvK`lNunoKSy*)o%Z9nsUwe6S?W7Do)8c2h*rKUj-=m9-kIRMfiZE?U7LY;PH4oHJE
z648|dAPv$M2P`4fX;<ceG)N;6T{!^KAZ>BL5<;DJWe!M#G!oI310W6376&XL)M;1d
zfHX)W5nVX|(jaYdz!E~8c4ZDogESJ+l>;CR(iR6SA=GJC=9nM#CkJdjo4h)E>f83a
zY)^A1o46k>v8RvjtgYkNB-=dslC692>H`brR^LYl!?$O!X-9bj(w6G|Uqc}MUvXM0
z1W1E4^l;?>NQ1P+0ZRyV+LbvV4bn(NR}O$QNLw7RgixnlnFG=wjYM?i07!$h#Q{qQ
zb=s9VAPv$;L{|=gG)P+<u!K;jU6}*YAdN(H<p4;7w8a5S2zA<(IUo(vNJLi-fHX*3
U9I%8|XPxf+^S|}M+Bz=$0-yM~@&Et;

literal 0
HcmV?d00001


From b97845baf40c837b81f852dc627093aedf7c5416 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 00:35:07 +0800
Subject: [PATCH 147/262] docs(guide): explain numeric media controls

---
 docs/guide/getting-started.md       | 7 +++++++
 docs/guide/getting-started.zh-CN.md | 6 ++++++
 2 files changed, 13 insertions(+)

diff --git a/docs/guide/getting-started.md b/docs/guide/getting-started.md
index 22c8f2665..4cf6837dc 100644
--- a/docs/guide/getting-started.md
+++ b/docs/guide/getting-started.md
@@ -149,6 +149,13 @@ sharing to allow that fallback. The project's online site uses P2P only.
 ## Picture and sound settings
 
 Open **Sharing settings** below the picture to adjust picture and audio quality.
+
+- Choose a picture preset, or enter width and height under **Resolution ceiling**.
+  Piik preserves the source's proportions within that ceiling. Selecting 4K sets
+  the frame-rate ceiling to at most 30 fps.
+- Choose an audio preset, or enter an **Audio bitrate limit** from 6 to 320 kbps.
+  Picture and sound still adapt to the source, device and available bandwidth.
+
 Piik remembers your applied settings for the next visit. Browser-only use remembers
 them for the current site; opening Piik through an updated App also keeps them
 when your public-invite address changes.
diff --git a/docs/guide/getting-started.zh-CN.md b/docs/guide/getting-started.zh-CN.md
index 4f6ae532b..629c3471b 100644
--- a/docs/guide/getting-started.zh-CN.md
+++ b/docs/guide/getting-started.zh-CN.md
@@ -132,6 +132,12 @@ Linux 原生采集还需要[系统组件](../../native/capture/linux/README.md)
 ## 画面与声音设置
 
 在画面下方打开 **分享设置**，调整画质和音频质量。
+
+- 可选画质预设，也可在 **分辨率上限** 中填写宽和高。画面在上限内保留来源比例；
+  选择 4K 时，帧率上限最高为 30 帧。
+- 音频保留三档预设，也可填写 6–320 kbps 的 **音频码率上限**。
+  实际画质和声音仍会根据来源、设备与可用带宽调整。
+
 Piik 会记住已应用的设置，供下次使用。仅用浏览器时，设置保存在当前站点；
 通过新版 App 打开时，更换公网邀请网址也能保留设置。
 

From c38c892955cde572887df3910c904d149ab36ffb Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 00:54:58 +0800
Subject: [PATCH 148/262] docs(release): explain major upgrade steps at
 download entry

---
 docs/guide/getting-started.md       | 16 ++++++++++++++++
 docs/guide/getting-started.zh-CN.md | 13 +++++++++++++
 site/index.html                     |  4 ++--
 3 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/docs/guide/getting-started.md b/docs/guide/getting-started.md
index 4cf6837dc..9f8d3d559 100644
--- a/docs/guide/getting-started.md
+++ b/docs/guide/getting-started.md
@@ -121,6 +121,22 @@ participants. This mode has no media-server fallback, and the temporary address
 has no uptime guarantee. All modes need a working UDP media path.
 The [App guide](../../cmd/piik-app/README.md#modes) explains the connection setup.
 
+### Upgrading
+
+**Piik 2.0 and 1.x cannot be used together.** The App and the site it connects to
+need the same major version. Read the release notes on
+[GitHub](https://github.com/TNTcraftHIM/Piik/releases/latest) or
+[Gitee](https://gitee.com/TNTcraftHIM/Piik/releases) before upgrading.
+
+- **Local room or Public invite:** stop sharing, close the old App and extract
+  the complete new package. Start the new App and send a fresh invitation.
+- **An existing site:** the administrator updates the Server first, following
+  the [update guide](../operations/service-management.md). Then update the Apps
+  connecting to that site and refresh all sharing and viewing pages.
+
+Restarting an App or Server interrupts active shares. This upgrade does not
+change the room database schema.
+
 ## Share from an existing site
 
 You need an existing HTTPS site running Piik Server, provided by a friend or
diff --git a/docs/guide/getting-started.zh-CN.md b/docs/guide/getting-started.zh-CN.md
index 629c3471b..82b0d44cc 100644
--- a/docs/guide/getting-started.zh-CN.md
+++ b/docs/guide/getting-started.zh-CN.md
@@ -108,6 +108,19 @@ Linux 原生采集还需要[系统组件](../../native/capture/linux/README.md)
 临时地址也不保证持续可用。所有模式都需要可用的 UDP 媒体路径。
 具体连接方式见 [App 指南](../../cmd/piik-app/README.zh-CN.md#运行模式)。
 
+### 版本升级
+
+**Piik 2.0 与 1.x 不能混用。** App 与连接的站点需要使用同一大版本。
+升级前，请先查看 [GitHub](https://github.com/TNTcraftHIM/Piik/releases/latest) 或
+[Gitee](https://gitee.com/TNTcraftHIM/Piik/releases) 上的版本说明。
+
+- **本地房间或公网邀请：** 停止分享并关闭旧 App，完整解压新版程序包，
+  启动后重新发送邀请链接。
+- **已有站点：** 管理员先按[更新指南](../operations/service-management.zh-CN.md)升级 Server，
+  然后更新连接该站点的 App，并刷新所有分享与观看页面。
+
+重启 App 或 Server 会中断正在进行的分享。本次升级不变更房间数据库结构。
+
 ## 使用已有站点分享
 
 需要先有一个运行 Piik Server 的 HTTPS 站点，可以使用朋友或管理员提供的地址。
diff --git a/site/index.html b/site/index.html
index ab0b6f20c..bcbf213ab 100644
--- a/site/index.html
+++ b/site/index.html
@@ -736,8 +736,8 @@ <h2 id="download-title"><span lang="en">Get Piik App.</span><span lang="zh-CN">
           </p>
         </div>
         <p class="release-note" id="download-status">
-          <span lang="en">Choose your system, then download and extract.</span>
-          <span lang="zh-CN">选择对应系统，下载后解压。</span>
+          <span lang="en">Choose your system, then download and extract.<br />For a major upgrade, <a href="./docs/getting-started.html?lang=en#upgrading">check compatibility before updating</a>.</span>
+          <span lang="zh-CN">选择对应系统，下载后解压。<br />跨大版本升级前，请先查看<a href="./docs/zh/getting-started.html#版本升级">兼容性说明</a>。</span>
         </p>
         <div class="download-cards">
           <article class="download-card" aria-labelledby="download-windows">

From fac7444e4708c14539b426a3a451f796a790f9bf Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 01:01:44 +0800
Subject: [PATCH 149/262] test(media): correct macOS clean-aperture coordinates

Core Video returns clean rectangles in lower-left coordinates, while aperture offsets move downward for positive values. Correct the synthetic crop expectation without changing capture behavior. Mac SDK execution remains pending.
---
 native/capture/darwin/main.swift | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/native/capture/darwin/main.swift b/native/capture/darwin/main.swift
index 7ee5e60ce..65f036c78 100644
--- a/native/capture/darwin/main.swift
+++ b/native/capture/darwin/main.swift
@@ -1145,10 +1145,12 @@ private func geometrySelfTest() throws {
         .contentRect: rect.dictionaryRepresentation,
         .scaleFactor: CGFloat(2), .contentScale: CGFloat(1),
     ]
+    // Core Video returns a lower-left origin; the surface crop starts 80 px
+    // from the top, so its lower edge is 720 - 80 - 600 = 40 px from the bottom.
     guard let image = VideoImage(buffer, attachments: attachments),
           try image.fitted(to: ceiling).width == 400,
           try image.fitted(to: ceiling).height == 600,
-          CVImageBufferGetCleanRect(buffer) == CGRect(x: 100, y: 80, width: 400, height: 600) else {
+          CVImageBufferGetCleanRect(buffer) == CGRect(x: 100, y: 40, width: 400, height: 600) else {
         throw CaptureFailure(description: "capture content geometry self-test failed")
     }
     var upscaled = attachments

From c93c84f9ef4ecce90a24a2bbe39cf65ab83392d5 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 01:19:43 +0800
Subject: [PATCH 150/262] docs(preview): clarify remaining candidate acceptance

---
 docs/status.md |  6 +++---
 docs/todo.md   | 18 +++++++++---------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/docs/status.md b/docs/status.md
index 5f550cea1..fe29483df 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -1,6 +1,6 @@
 # Current Status
 
-Last updated: 2026-10-10
+Last updated: 2026-10-11
 
 This is the compact execution/deployment index. Product modules own behavior,
 [verification status](./verification-status.md) owns unresolved physical limits,
@@ -71,8 +71,8 @@ Custom width/height controls apply combined size and frame-rate limits, admittin
 The [media assessment](./research/native-client-media.md#media-capability-extension-assessment)
 owns local codec, derived-output, SFU, Browser/Native fanout and live-control
 evidence. The macOS geometry implementation still needs SDK compilation and
-hardware verification; cross-browser/device and route-change acceptance, and
-additional codecs remain open.
+hardware verification; cross-browser/device and route-change acceptance remain
+open. Additional codecs are not part of this candidate.
 Magicsock adoption is no-go for this candidate: its App-to-App augmentation does
 not improve the core App-to-Browser use case. The
 [assessment](./research/nat-traversal.md#integration-cost-and-recovery-controls)
diff --git a/docs/todo.md b/docs/todo.md
index 59d5b6d57..601f8a052 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -1,6 +1,6 @@
 # Current TODO Ledger
 
-Last reviewed: 2026-10-10
+Last reviewed: 2026-10-11
 
 The current 2.0 preparation includes independent investigation across this
 ledger. Explicit owner holds remain in force; an investigation does not itself
@@ -58,8 +58,8 @@ Implementation needs a concrete useful result within the product model.
   separate UI presets, numeric requests, bounded implementation capabilities and
   actual output. Numeric audio and video controls are implemented; the assessment
   owns local capture, codec, derived-output, SFU and bounded mixed-route evidence.
-  Extend Browser interoperability and mixed-topology checks to limited receivers
-  and physical camera orientation behavior.
+  Remaining receiver acceptance needs physical limited decoders and camera
+  orientation behavior, beyond the bounded SDP-limit and mixed-route controls.
   Browser display capture, Browser relay and Browser-to-Native fanout now have
   bounded high-resolution evidence. macOS geometry SDK/hardware checks and
   physical 4K/game capture remain open. Preserve safety limits and
@@ -68,12 +68,12 @@ Implementation needs a concrete useful result within the product model.
   retain explicit receive-limit enforcement and the current 320 kbps sender
   ceiling. Physical listening, mobile and field-network acceptance remain open;
   research owns the bounded real-Opus impairment and video-recovery control.
-  New codecs need complete
-  encode/decode/forward support and a late-Viewer policy before inclusion;
-  selecting a codec cannot transcode an existing publication. Confirm live
-  changes, relay/SFU paths, older 2.x capability subsets and explicit 1.x
-  mismatch before accepting the replacement contract. The published 1.x enums
-  remain that major's baseline; the PR is not a compatible enum-only extension
+  Additional codecs are outside this candidate. Later inclusion needs complete
+  encode/decode/forward support and a late-Viewer policy;
+  selecting a codec cannot transcode an existing publication. Final package
+  acceptance must retain the verified live-change, relay/SFU and limited-receiver
+  behavior, and check explicit 1.x mismatch with packaged builds. The published
+  1.x enums remain that major's baseline; the PR is not a compatible enum-only extension
   of v1.9.2.
 - [ ] **2.0 candidate acceptance.** Finish the combined numeric-media UI,
   App/room lifecycle, ordinary Browser/Native routes and regression checks before

From 546e72c0dff2911b4fe7ae08f416bbbe39abaa63 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 09:52:01 +0800
Subject: [PATCH 151/262] fix(media): separate wire values from runtime
 admission

Preserve valid quality observations without letting rejected telemetry retire media control. Keep numeric requests and capability descriptions independent of local allocation limits, enforce admission before applying capture changes, and remove count-specific retry-progress negotiation.
---
 docs/research/native-client-media.md          | 26 ++++-
 docs/standards/engineering.md                 | 31 ++++--
 docs/standards/media-quality.md               | 15 ++-
 docs/standards/versioning.md                  |  6 ++
 docs/todo.md                                  | 22 ++++-
 internal/app/app.go                           |  2 +
 .../app/config/quality_preference_test.go     |  2 +-
 internal/app/loopback/server.go               |  2 +
 internal/app/nativecapture/protocol.go        |  3 +-
 internal/app/nativecapture/stream.go          |  6 +-
 internal/app/nativecontrol/session.go         |  6 ++
 internal/app/nativecontrol/session_test.go    | 14 +++
 internal/server/app/app_test.go               |  8 +-
 internal/server/app/routes.go                 | 11 +--
 internal/server/protocol/client.go            | 58 +++++------
 internal/server/protocol/contract_test.go     | 23 +----
 internal/server/protocol/sfu.go               |  4 +-
 internal/server/protocol/types.go             | 63 ++++++------
 internal/server/sfu/media.go                  |  4 +-
 internal/server/sfu/media_test.go             | 19 ++++
 internal/server/signal/server.go              | 84 ++++++++--------
 internal/server/signal/server_test.go         | 90 +++++++----------
 internal/server/signal/session.go             | 22 ++---
 src/client/App.tsx                            | 17 +---
 .../components/living/QualityPresets.tsx      |  9 +-
 src/client/lib/api.ts                         | 14 ---
 src/client/lib/quality-preference.ts          |  3 +-
 src/client/media/quality.ts                   | 26 ++++-
 src/client/media/sender-quality-evidence.ts   | 58 +++++------
 src/client/media/viewer-quality-evidence.ts   | 99 +++++--------------
 src/client/native/client.ts                   |  7 ++
 src/client/native/wire.ts                     | 40 ++++----
 src/client/pages/HostPage.tsx                 | 28 +++---
 src/client/pages/ViewerPage.tsx               |  5 +-
 src/shared/protocol.ts                        | 92 ++++++++---------
 src/shared/quality-evidence.ts                | 13 +++
 tests/client-state.test.ts                    | 29 ------
 tests/fixtures/wire-samples.json              | 88 ++++++++++++++++-
 tests/host-quality-ownership.test.ts          | 25 ++++-
 tests/native-client.test.ts                   | 47 +++++++++
 tests/protocol.test.ts                        | 54 ++++++----
 tests/quality-preference.test.ts              |  8 ++
 tests/quality.test.ts                         | 22 ++++-
 tests/sender-quality-evidence.test.ts         | 29 ++++++
 tests/viewer-quality-evidence.test.ts         | 17 +++-
 45 files changed, 730 insertions(+), 521 deletions(-)
 create mode 100644 src/shared/quality-evidence.ts

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 469907aab..04152e8d2 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -588,7 +588,7 @@ presets. A source ceiling must also yield a valid half-size output. Bitrate and
 output-count bounds remain unchanged. Candidate signaling and Native control now carry numeric
 width/height ceilings, with custom input beside the existing UI shortcuts.
 Descriptive wire bounds are independent of the current implementation maximum;
-App discovery advertises axis, pixel-count and macroblock-rate limits, and Native rejects unsupported
+App discovery advertises size, pixel-count, macroblock-rate, frame-rate and bitrate limits, and Native rejects unsupported
 size/rate combinations as operation failures without retiring the control
 session. Removing an enum is not permission to allocate arbitrary media resources.
 
@@ -706,7 +706,7 @@ ceilings without a fixed aspect ratio or rotation listener, following the Media
 Capture distinction below. Synthetic devices do not establish physical phone
 orientation behavior.
 
-The proposed boundary follows the
+The boundary follows the
 [Media Capture specification](https://www.w3.org/TR/mediacapture-streams/#constrainable-interface):
 requested constraints, supported capabilities and actual settings have different
 owners. Capability ranges cannot describe every combination of resolution and
@@ -714,7 +714,27 @@ frame rate; [WebRTC codec discovery](https://www.w3.org/TR/webrtc/#rtcrtpsender-
 is optimistic and reserves no hardware resources. An advertised capability is
 therefore not proof that a particular encoder configuration can start.
 
-| Meaning | Proposed Piik owner and representation |
+Wire representation follows the platform types for dimensions/bitrates and a
+positive finite frame rate; current capture admission remains narrower. This
+allows a reader to reject an unsupported operation without rejecting its room
+or control session. Fractional rates must not be silently truncated by Native's
+integer capture API. SFU metadata passes the same representation boundary and
+then its existing bounded admission before allocation. Capability descriptions
+may exceed local support, but cannot authorize larger local allocations.
+This separation also appears in
+[mediasoup RTP parameters and capabilities](https://mediasoup.org/documentation/v3/mediasoup/rtp-parameters-and-capabilities/).
+
+[WebRTC statistics](https://www.w3.org/TR/webrtc-stats/#dom-rtcicecandidatepairstats-availableoutgoingbitrate)
+describe estimated available capacity, not a configured send-rate ceiling;
+[Pion exposes it as a floating-point observation](https://github.com/pion/ice/blob/main/stats.go).
+Local in-memory Native control checks reproduced a 100 Mbps observation ceiling
+closing the entire connection. The corrected readers preserve high valid
+estimates, normalize invalid optional measurements and discard invalid quality
+samples without granting them control authority. Shared Go/TypeScript fixtures
+also cover sender, publication and receiver evidence. This establishes boundary
+behavior, not the cause of an unmatched field report or an improvement to ICE.
+
+| Meaning | Piik owner and representation |
 | --- | --- |
 | Quick presets | UI-local labels mapping to numeric picture/audio requests; adding a label does not extend the wire |
 | Host intent | One validated numeric size, frame-rate and bitrate request, distinct from measured output |
diff --git a/docs/standards/engineering.md b/docs/standards/engineering.md
index f59b0501f..e1152c193 100644
--- a/docs/standards/engineering.md
+++ b/docs/standards/engineering.md
@@ -79,14 +79,29 @@ the relevant existing fixture/check together. Do not create another handwritten
 field list in documentation, parallel DTO hierarchy or schema generator without
 a demonstrated reduction in ownership or drift.
 
-Keep UI presets, requested values, runtime capabilities and hard resource limits
-distinct. A current menu is not sufficient reason to freeze its values into every
-wire reader or platform adapter. Preserve meaningful authorization and resource
-bounds; prove that a producer's valid aggregate output fits its consumer, including
-serialization overhead. A per-item limit alone does not establish that contract.
-
-When extending a boundary, exercise a representative new value and an unchanged
-consumer before calling the design extensible. For media, include another source
+Keep UI presets, requested values, runtime capabilities, observations and hard
+resource limits distinct. Every bound needs an owner and a reason: wire/codec
+representation, accepted product policy or resource protection. A current menu
+or retry budget is not sufficient reason to freeze its values into a wire reader.
+Validate representation at the interface, then supported operations at their
+owner before allocating or changing live state. An unsupported setting should
+use the existing operation rejection, without retiring an otherwise valid session.
+
+A capability description may exceed the reader's implementation. Intersect it
+with local support and budgets; do not treat a stronger peer as absent or grant
+resources from its declaration alone. Measurements are observations, not resource
+requests: their range need not match a setting or estimated network budget.
+An unusable optional metric should become unavailable without discarding valid
+evidence or closing media control. Identity, generation, authority and required
+state consistency remain strict; never clamp a measurement into an invented fact.
+
+Preserve meaningful authorization and resource bounds; prove that a producer's
+valid aggregate output fits its consumer, including serialization overhead.
+A per-item limit alone does not establish that contract.
+
+When extending a boundary, exercise a representative new value, a larger peer
+capability and an unchanged consumer before calling the design extensible.
+Check both acceptance and the effect of rejection. For media, include another source
 orientation and distinguish encode, decode and forwarding support. Optional
 presentation additions need a bounded unsupported-value policy separate from
 authority violations, following [versioning](./versioning.md#extending-interfaces).
diff --git a/docs/standards/media-quality.md b/docs/standards/media-quality.md
index 8a2eba030..75ddae3c6 100644
--- a/docs/standards/media-quality.md
+++ b/docs/standards/media-quality.md
@@ -137,6 +137,12 @@ Width and height form one applied edit. A size change caps the requested frame
 rate in the same quality operation when the larger size requires a lower limit.
 Larger wire-valid requests do not
 authorize an adapter to exceed its local capture, codec or allocation limits.
+Numeric requests use representational bounds rather than the current control
+ranges. Current capture still admits integer 15..60 fps and 2..12 Mbps, further
+limited by picture size. App descriptions may advertise stronger capabilities;
+controls use their intersection with local support. An unsupported request is
+an operation failure, not malformed signaling. An unsupported saved preference
+does not seed capture or overwrite its stored value with a fallback.
 Frame rate, bitrate, and `maintain-resolution | balanced |
 maintain-framerate` retain their controls. Display video uses the standard
 `contentHint = "motion"` for game motion.
@@ -157,11 +163,18 @@ Level 5.1: 983,040 16x16 macroblocks per second, with at most 60 fps. This admit
 landscape/portrait 4K30 and existing 1440p60, not 4K60. Decoder alignment has a
 separate coded-storage bound; reference-picture storage is bounded before
 Native derivation. These are admission limits, not a device performance promise.
-App discovery reports axis, pixel-count and output-rate limits through the
+App discovery reports size, pixel-count, frame-rate and bitrate limits through the
 existing native health description. Controls use the intersection with local
 implementation limits; a remote claim cannot raise those limits. Whole-route
 and physical-device acceptance remain separate from available controls.
 
+Quality observations have independent numeric bounds. A valid capacity estimate
+above the requested send rate remains evidence; invalid optional measurements
+become unavailable. Invalid Native quality samples are discarded without closing
+media control. Required identity, generation and state evidence must still pass
+before a sample can influence route decisions. SFU encoding descriptions likewise
+do not grant resources: the SFU admits supported formats before allocating them.
+
 Framework-driven downscaling under bandwidth or device pressure is valid within
 the selected degradation preference. A low decoded resolution alone is not a
 defect and does not justify a new quality floor. Review avoidable disruption,
diff --git a/docs/standards/versioning.md b/docs/standards/versioning.md
index 5b86801b5..34650a258 100644
--- a/docs/standards/versioning.md
+++ b/docs/standards/versioning.md
@@ -81,6 +81,12 @@ execute unknown commands. A more tolerant reader does not update already-release
 readers: do not emit a new reaction to legacy pages merely because current pages
 can skip it. Verify both readers before calling a change additive.
 
+In the unpublished 2.0 contract, numeric media descriptions and retry progress
+are independent of current implementation limits and retry policy. Extending
+those policies does not require another count-specific capability flag.
+Representation acceptance still requires local operation/resource admission;
+it is not a promise that every same-major peer can produce a new media format.
+
 Native discovery distinguishes an incompatible Piik App from an absent App and
 reports protocol numbers to local diagnostics; the source picker offers update/
 refresh guidance and Browser operation. Do not reload, reinstall or interrupt
diff --git a/docs/todo.md b/docs/todo.md
index 601f8a052..bd4c8efa3 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -16,6 +16,21 @@ Git/PRs own completed history.
   Prepare one coherent candidate and stop before publication. Preserve the existing
   product model; evaluate held features against measurable benefit and total complexity
   before accepting a changed contract.
+- [ ] **Linux Portal target identity (#470).** Review of the
+  [contributor fix](https://github.com/TNTcraftHIM/Piik/pull/470) and upstream
+  PipeWire confirms that the current fallback passes a node ID as an object
+  serial. Integrate the fix with attribution, retain serial targeting when
+  available, and use the node-ID selector otherwise. Run the Linux native
+  checks and verify a Portal that omits `pipewire-serial`; this fix is not yet
+  in the candidate.
+- [ ] **Reconcile open PRs with the final candidate.**
+  [#462](https://github.com/TNTcraftHIM/Piik/pull/462)'s 256/320 kbps request and
+  [#469](https://github.com/TNTcraftHIM/Piik/pull/469)'s 4K request overlap the
+  numeric-media candidate; neither PR has been merged. The latter's 4K60 and
+  40 Mbps expansion needs separate evidence and is not accepted scope. Preserve
+  contributor credit and explain the disposition at integration. Rewrite
+  [#459](https://github.com/TNTcraftHIM/Piik/pull/459)'s earlier maintenance scope
+  and compatibility claims around the final 2.0 result before integration.
 - [ ] **Independent Gitee mirror recovery.** Implementation and local acceptance
   are complete. Integrate through the next owner-approved publishing merge and
   verify the separate workflow with its original CI artifacts. Mirror failure
@@ -56,7 +71,12 @@ Implementation needs a concrete useful result within the product model.
 - [ ] **Media parameters and capabilities for 2.0.** Follow the
   [media assessment](./research/native-client-media.md#media-capability-extension-assessment):
   separate UI presets, numeric requests, bounded implementation capabilities and
-  actual output. Numeric audio and video controls are implemented; the assessment
+  actual output. Numeric request, capability and observation boundaries are now
+  separate from implementation admission. Keep receiver, codec/alignment and
+  resource budgets intact; opening an output range still needs end-to-end evidence.
+  Assess higher audio output against packet-duration/size and receiver support;
+  removing the current 320 kbps sender guard alone is not sufficient. Numeric
+  audio and video controls are implemented; the assessment
   owns local capture, codec, derived-output, SFU and bounded mixed-route evidence.
   Remaining receiver acceptance needs physical limited decoders and camera
   orientation behavior, beyond the bounded SDP-limit and mixed-route controls.
diff --git a/internal/app/app.go b/internal/app/app.go
index 6966ecca4..e112ad100 100644
--- a/internal/app/app.go
+++ b/internal/app/app.go
@@ -633,6 +633,8 @@ func discoverNativeMedia(ctx context.Context, configuredPath string) nativeRunti
 			},
 			MaxVideoPixels:               nativecapture.MaxVideoPixels,
 			MaxVideoMacroblocksPerSecond: nativecapture.MaxVideoMacroblocksPerSecond,
+			MaxVideoFramerate:            nativecapture.MaxVideoFramerate,
+			MaxVideoBitrate:              nativecapture.MaxVideoBitrate,
 			MaxAudioBitrate:              nativeaudio.MaxSendBitrate,
 			ReceiverReuse:                true,
 			Video:                        summary.Video,
diff --git a/internal/app/config/quality_preference_test.go b/internal/app/config/quality_preference_test.go
index 71b00c366..bab757deb 100644
--- a/internal/app/config/quality_preference_test.go
+++ b/internal/app/config/quality_preference_test.go
@@ -38,7 +38,7 @@ func TestQualityPreferencePersistsWithoutChangingAppConfiguration(t *testing.T)
 		t.Fatal("preference changed strict App configuration")
 	}
 	invalid := quality
-	invalid.Resolution.Width = 8194
+	invalid.Resolution.Width = 0x1_0000_0000
 	if p.Save(invalid) == nil || *p.Read() != quality {
 		t.Fatal("invalid choice changed preference")
 	}
diff --git a/internal/app/loopback/server.go b/internal/app/loopback/server.go
index 7fa232116..0e56477c1 100644
--- a/internal/app/loopback/server.go
+++ b/internal/app/loopback/server.go
@@ -76,6 +76,8 @@ type NativeMediaCapabilities struct {
 	MaxVideoResolution           protocol.QualityResolution `json:"maxVideoResolution,omitzero"`
 	MaxVideoPixels               int                        `json:"maxVideoPixels,omitempty"`
 	MaxVideoMacroblocksPerSecond int                        `json:"maxVideoMacroblocksPerSecond,omitempty"`
+	MaxVideoFramerate            int                        `json:"maxVideoFramerate,omitempty"`
+	MaxVideoBitrate              int                        `json:"maxVideoBitrate,omitempty"`
 	MaxAudioBitrate              int                        `json:"maxAudioBitrate,omitempty"`
 	ReceiverReuse                bool                       `json:"receiverReuse,omitempty"`
 	Video                        bool                       `json:"video"`
diff --git a/internal/app/nativecapture/protocol.go b/internal/app/nativecapture/protocol.go
index e38dc0c53..b3cd65741 100644
--- a/internal/app/nativecapture/protocol.go
+++ b/internal/app/nativecapture/protocol.go
@@ -18,6 +18,7 @@ const (
 	MaxVideoDimension            = 3840
 	MaxVideoPixels               = 3840 * 2160
 	MaxVideoMacroblocksPerSecond = 983_040
+	MaxVideoFramerate            = 60
 	// Coded pictures may include alignment outside the visible crop. Keep this
 	// separate from visible dimensions and within H.264 Level 5.1 storage.
 	MaxCodedVideoDimension = 4096
@@ -34,7 +35,7 @@ func ValidVideoSize(width, height uint32) bool {
 // ValidVideoFormat keeps both current encoders within the shared receive
 // ceiling (H.264 Level 5.1), including non-preset shapes and frame rates.
 func ValidVideoFormat(width, height, framerate uint32) bool {
-	return ValidVideoSize(width, height) && framerate >= 1 && framerate <= 60 &&
+	return ValidVideoSize(width, height) && framerate >= 1 && framerate <= MaxVideoFramerate &&
 		uint64((width+15)/16)*uint64((height+15)/16)*uint64(framerate) <= MaxVideoMacroblocksPerSecond
 }
 
diff --git a/internal/app/nativecapture/stream.go b/internal/app/nativecapture/stream.go
index f8626c602..5490bccb6 100644
--- a/internal/app/nativecapture/stream.go
+++ b/internal/app/nativecapture/stream.go
@@ -24,7 +24,7 @@ const (
 	maxPreviewBytes     = 192 * 1024
 	maxOutputs          = 6
 	minOutputBitrate    = 1_000 // Codec rate APIs use whole kbps.
-	maxOutputBitrate    = 12_000_000
+	MaxVideoBitrate     = 12_000_000
 	maxSources          = 1024
 	maxSourceTitleBytes = 4096
 	// Leave room for the control envelope within loopback's 256 KiB message.
@@ -89,7 +89,7 @@ type OutputProfile struct {
 
 func (profile OutputProfile) Valid() bool {
 	return ValidVideoFormat(profile.Width, profile.Height, profile.Framerate) &&
-		profile.Bitrate >= minOutputBitrate && profile.Bitrate <= maxOutputBitrate
+		profile.Bitrate >= minOutputBitrate && profile.Bitrate <= MaxVideoBitrate
 }
 
 // ScreenShareOutputs follows LiveKit 2.22.1's screen-share simulcast construction,
@@ -112,7 +112,7 @@ func (profile VideoProfile) Valid() bool {
 	// belong to the UI, not the capture process's numeric resource boundary.
 	return ValidVideoFormat(profile.Width, profile.Height, profile.Framerate) && profile.Width >= 4 && profile.Height >= 4 &&
 		profile.Framerate >= 15 &&
-		profile.Bitrate >= 2_000_000 && profile.Bitrate <= 12_000_000 &&
+		profile.Bitrate >= 2_000_000 && profile.Bitrate <= MaxVideoBitrate &&
 		validVideoPreference(profile.Preference)
 }
 
diff --git a/internal/app/nativecontrol/session.go b/internal/app/nativecontrol/session.go
index ca1af8cf7..85d43bd0c 100644
--- a/internal/app/nativecontrol/session.go
+++ b/internal/app/nativecontrol/session.go
@@ -643,6 +643,12 @@ func (session *Session) startShare(
 }
 
 func nativeQualityProfile(settings qualitySettings) nativehost.QualityProfile {
+	// The wire can express more than this integer capture API. Never truncate a
+	// fractional rate or wrap a wider value into an apparently supported profile.
+	if settings.MaxFramerate < 1 || settings.MaxFramerate > 0xffff_ffff ||
+		settings.MaxFramerate != protocol.Num(uint32(settings.MaxFramerate)) {
+		return nativehost.QualityProfile{}
+	}
 	audioBitrate := int(settings.MaxAudioBitrate)
 	if audioBitrate == 0 {
 		audioBitrate = int(protocol.DefaultQualitySettings.MaxAudioBitrate)
diff --git a/internal/app/nativecontrol/session_test.go b/internal/app/nativecontrol/session_test.go
index 4e3f633a7..51868f6db 100644
--- a/internal/app/nativecontrol/session_test.go
+++ b/internal/app/nativecontrol/session_test.go
@@ -677,6 +677,12 @@ func TestQualitySettingsMapOnceIntoNativeMedia(t *testing.T) {
 	if !nativeQualityProfile(settings).Valid() {
 		t.Fatal("4K30 was rejected")
 	}
+	for _, fps := range []protocol.Num{30.5, 120, 0x1_0000_0000 + 30} {
+		settings.MaxFramerate = fps
+		if nativeQualityProfile(settings).Valid() {
+			t.Fatalf("unsupported fps %v was narrowed into a valid profile", fps)
+		}
+	}
 }
 
 func TestUpdateShareRequiresTheCurrentStrictProfile(t *testing.T) {
@@ -690,6 +696,14 @@ func TestUpdateShareRequiresTheCurrentStrictProfile(t *testing.T) {
 	assertOperationFailure(t, session, strings.Replace(valid,
 		`"resolution":{"width":1920,"height":1080}`,
 		`"resolution":{"width":7680,"height":4320}`, 1))
+	for _, replace := range [][2]string{
+		{`"width":1920`, `"width":32768`}, {`"width":1920`, `"width":1921`},
+		{`"maxFramerate":30`, `"maxFramerate":120`}, {`"maxFramerate":30`, `"maxFramerate":30.5`},
+		{`"maxFramerate":30`, `"maxFramerate":4294967326`}, {`"maxFramerate":30`, `"maxFramerate":1`},
+		{`"maxBitrate":5000000`, `"maxBitrate":40000000`}, {`"maxBitrate":5000000`, `"maxBitrate":1000`},
+	} {
+		assertOperationFailure(t, session, strings.Replace(valid, replace[0], replace[1], 1))
+	}
 	if _, err := session.Handle(t.Context(), []byte(`{"version":10,"id":"request_options","type":"capture-options"}`)); err != nil {
 		t.Fatalf("unsupported media setting retired control: %v", err)
 	}
diff --git a/internal/server/app/app_test.go b/internal/server/app/app_test.go
index e0b9347d3..8533421b0 100644
--- a/internal/server/app/app_test.go
+++ b/internal/server/app/app_test.go
@@ -366,7 +366,7 @@ func TestCapabilitiesReportServicesDisabledByDefault(t *testing.T) {
 	server := start(t, Options{Config: testConfig(t)})
 
 	server.do(http.MethodGet, "/api/capabilities").
-		expect(http.StatusOK, `{"connectionAttemptProgress4":true,"sfu":false,"natPrediction":false,"roomInteractions":true,"hostRoomSession":true}`)
+		expect(http.StatusOK, `{"sfu":false,"natPrediction":false,"roomInteractions":true,"hostRoomSession":true}`)
 
 }
 
@@ -376,7 +376,7 @@ func TestCapabilitiesReportSFUOnlyPolicy(t *testing.T) {
 	configuration.NATPredictionEnabled = true
 	server := start(t, Options{Config: configuration})
 	server.do(http.MethodGet, "/api/capabilities").
-		expect(http.StatusOK, `{"connectionAttemptProgress4":true,"sfu":true,"sfuOnly":true,"natPrediction":false,"roomInteractions":true,"hostRoomSession":true}`)
+		expect(http.StatusOK, `{"sfu":true,"sfuOnly":true,"natPrediction":false,"roomInteractions":true,"hostRoomSession":true}`)
 }
 
 func TestCapabilitiesReportOptionalNATPredictionWithoutExposingConfiguration(t *testing.T) {
@@ -387,7 +387,7 @@ func TestCapabilitiesReportOptionalNATPredictionWithoutExposingConfiguration(t *
 	server := start(t, Options{Config: configuration})
 
 	server.do(http.MethodGet, "/api/capabilities").
-		expect(http.StatusOK, `{"connectionAttemptProgress4":true,"sfu":false,"natPrediction":true,"roomInteractions":true,"hostRoomSession":true}`).
+		expect(http.StatusOK, `{"sfu":false,"natPrediction":true,"roomInteractions":true,"hostRoomSession":true}`).
 		expectHeader("Cache-Control", "no-store").
 		expectHeader("X-Content-Type-Options", "nosniff")
 
@@ -430,7 +430,7 @@ func TestSFUListenerFollowsApplicationCloseAndEnd(t *testing.T) {
 				t.Fatal("missing runtime owner")
 			}
 			server.do(http.MethodGet, "/api/capabilities").
-				expect(http.StatusOK, `{"connectionAttemptProgress4":true,"sfu":true,"natPrediction":false,"roomInteractions":true,"hostRoomSession":true}`)
+				expect(http.StatusOK, `{"sfu":true,"natPrediction":false,"roomInteractions":true,"hostRoomSession":true}`)
 
 			var err error
 			if ending {
diff --git a/internal/server/app/routes.go b/internal/server/app/routes.go
index 7a69e23fb..6d1655781 100644
--- a/internal/server/app/routes.go
+++ b/internal/server/app/routes.go
@@ -77,12 +77,11 @@ func (s *Server) route(
 			return
 		}
 		sendJSON(writer, http.StatusOK, protocol.RuntimeCapabilities{
-			ConnectionAttemptProgress4: true,
-			Sfu:                        s.config.SFU != nil,
-			SfuOnly:                    s.config.SFU != nil && s.config.SFU.Only,
-			NatPrediction:              s.config.NATPredictionEnabled && !(s.config.SFU != nil && s.config.SFU.Only),
-			RoomInteractions:           true,
-			HostRoomSession:            true,
+			Sfu:              s.config.SFU != nil,
+			SfuOnly:          s.config.SFU != nil && s.config.SFU.Only,
+			NatPrediction:    s.config.NATPredictionEnabled && !(s.config.SFU != nil && s.config.SFU.Only),
+			RoomInteractions: true,
+			HostRoomSession:  true,
 		})
 		return
 	}
diff --git a/internal/server/protocol/client.go b/internal/server/protocol/client.go
index ae318ab96..ba004829c 100644
--- a/internal/server/protocol/client.go
+++ b/internal/server/protocol/client.go
@@ -13,35 +13,33 @@ type ClientMessage interface {
 
 // AuthenticateHostMessage is the host member of authenticateMessageSchema.
 type AuthenticateHostMessage struct {
-	Type                       string           `json:"type"`
-	Protocol                   string           `json:"protocol"`
-	RoomID                     string           `json:"roomId"`
-	Role                       Role             `json:"role"`
-	Token                      string           `json:"token"`
-	ClientID                   string           `json:"clientId"`
-	ShareGeneration            string           `json:"shareGeneration,omitempty"`
-	SharingPaused              *bool            `json:"sharingPaused,omitempty"`
-	QualitySettings            *QualitySettings `json:"qualitySettings,omitempty"`
-	RoutePolicy                RoutePolicy      `json:"routePolicy"`
-	ViewerPresence             bool             `json:"viewerPresence,omitempty"`
-	ConnectionAttemptProgress4 bool             `json:"connectionAttemptProgress4,omitempty"`
-	DisplayName                *DisplayName     `json:"displayName,omitempty"`
-	RoomOnly                   bool             `json:"roomOnly,omitempty"`
-	RoomSession                bool             `json:"roomSession,omitempty"`
+	Type            string           `json:"type"`
+	Protocol        string           `json:"protocol"`
+	RoomID          string           `json:"roomId"`
+	Role            Role             `json:"role"`
+	Token           string           `json:"token"`
+	ClientID        string           `json:"clientId"`
+	ShareGeneration string           `json:"shareGeneration,omitempty"`
+	SharingPaused   *bool            `json:"sharingPaused,omitempty"`
+	QualitySettings *QualitySettings `json:"qualitySettings,omitempty"`
+	RoutePolicy     RoutePolicy      `json:"routePolicy"`
+	ViewerPresence  bool             `json:"viewerPresence,omitempty"`
+	DisplayName     *DisplayName     `json:"displayName,omitempty"`
+	RoomOnly        bool             `json:"roomOnly,omitempty"`
+	RoomSession     bool             `json:"roomSession,omitempty"`
 }
 
 // AuthenticateViewerMessage is the viewer member of authenticateMessageSchema.
 type AuthenticateViewerMessage struct {
-	Type                       string       `json:"type"`
-	Protocol                   string       `json:"protocol"`
-	RoomID                     string       `json:"roomId"`
-	Role                       Role         `json:"role"`
-	ClientID                   string       `json:"clientId"`
-	ViewerGrant                string       `json:"viewerGrant,omitempty"`
-	ViewerPassword             string       `json:"viewerPassword,omitempty"`
-	DisplayName                *DisplayName `json:"displayName,omitempty"`
-	ViewerPresence             bool         `json:"viewerPresence,omitempty"`
-	ConnectionAttemptProgress4 bool         `json:"connectionAttemptProgress4,omitempty"`
+	Type           string       `json:"type"`
+	Protocol       string       `json:"protocol"`
+	RoomID         string       `json:"roomId"`
+	Role           Role         `json:"role"`
+	ClientID       string       `json:"clientId"`
+	ViewerGrant    string       `json:"viewerGrant,omitempty"`
+	ViewerPassword string       `json:"viewerPassword,omitempty"`
+	DisplayName    *DisplayName `json:"displayName,omitempty"`
+	ViewerPresence bool         `json:"viewerPresence,omitempty"`
 }
 
 // SignalingChallengeMessage is { type: "signaling-challenge", sequence }.
@@ -301,7 +299,7 @@ func decodeAuthenticate(data []byte) (ClientMessage, error) {
 			return nil, err
 		}
 		if err := present.optional("shareGeneration", "roomOnly", "roomSession", "sharingPaused", "qualitySettings",
-			"routePolicy", "viewerPresence", "displayName", "connectionAttemptProgress4"); err != nil {
+			"routePolicy", "viewerPresence", "displayName"); err != nil {
 
 			return nil, err
 		}
@@ -332,9 +330,6 @@ func decodeAuthenticate(data []byte) (ClientMessage, error) {
 		if present.has("viewerPresence") && !message.ViewerPresence {
 			return nil, errors.New("viewerPresence must be true when present")
 		}
-		if present.has("connectionAttemptProgress4") && !message.ConnectionAttemptProgress4 {
-			return nil, errors.New("connectionAttemptProgress4 must be true when present")
-		}
 		if !present.has("routePolicy") {
 			message.RoutePolicy = DefaultRoutePolicy
 		}
@@ -349,7 +344,7 @@ func decodeAuthenticate(data []byte) (ClientMessage, error) {
 			return nil, err
 		}
 		if err := present.optional(
-			"viewerGrant", "viewerPassword", "displayName", "viewerPresence", "connectionAttemptProgress4"); err != nil {
+			"viewerGrant", "viewerPassword", "displayName", "viewerPresence"); err != nil {
 			return nil, err
 		}
 		if message.Protocol != SignalingProtocol {
@@ -370,9 +365,6 @@ func decodeAuthenticate(data []byte) (ClientMessage, error) {
 		if present.has("viewerPresence") && !message.ViewerPresence {
 			return nil, errors.New("viewerPresence must be true when present")
 		}
-		if present.has("connectionAttemptProgress4") && !message.ConnectionAttemptProgress4 {
-			return nil, errors.New("connectionAttemptProgress4 must be true when present")
-		}
 		return message, nil
 	}
 	return nil, fmt.Errorf("unknown authenticate role %q", role)
diff --git a/internal/server/protocol/contract_test.go b/internal/server/protocol/contract_test.go
index 3ebd15393..9f37b1be7 100644
--- a/internal/server/protocol/contract_test.go
+++ b/internal/server/protocol/contract_test.go
@@ -14,7 +14,6 @@ func TestRuntimeCapabilities(t *testing.T) {
 		want RuntimeCapabilities
 	}{
 		{`{}`, RuntimeCapabilities{}},
-		{`{"connectionAttemptProgress4":true}`, RuntimeCapabilities{ConnectionAttemptProgress4: true}},
 		{`{"sfu":true,"extra":{"enabled":true}}`, RuntimeCapabilities{Sfu: true}},
 		{`{"sfu":true,"sfuOnly":true}`, RuntimeCapabilities{Sfu: true, SfuOnly: true}},
 		{`{"natPrediction":true,"SFU":true}`, RuntimeCapabilities{NatPrediction: true}},
@@ -29,7 +28,6 @@ func TestRuntimeCapabilities(t *testing.T) {
 	for _, data := range []string{
 		`null`, `[]`, `true`, `{"sfu":null}`, `{"sfu":"true"}`, `{"sfuOnly":null}`, `{"sfuOnly":"true"}`,
 		`{"natPrediction":null}`, `{"natPrediction":1}`,
-		`{"connectionAttemptProgress4":null}`, `{"connectionAttemptProgress4":4}`,
 	} {
 		var got RuntimeCapabilities
 		if err := json.Unmarshal([]byte(data), &got); err == nil {
@@ -243,9 +241,9 @@ func TestAuthenticatedRoomRevision(t *testing.T) {
 		object(drop(authenticatedHost(), "routeAssignment")), false)
 	assertServerMessage(t, "absent media mode",
 		object(drop(authenticatedHost(), "mediaMode")), false)
-	assertServerMessage(t, "quality settings past the bitrate ceiling",
+	assertServerMessage(t, "quality settings past the numeric representation",
 		object(with(authenticatedHost(), member{"qualitySettings",
-			`{"resolution":{"width":1920,"height":1080},"maxFramerate":60,"maxBitrate":20000000,` +
+			`{"resolution":{"width":1920,"height":1080},"maxFramerate":60,"maxBitrate":4294967296,` +
 				`"degradationPreference":"maintain-resolution"}`})), false)
 }
 
@@ -499,7 +497,9 @@ func TestPreparedRouteCandidate(t *testing.T) {
 		{`{"current":1,"total":4}`, true},
 		{`{"current":4,"total":4}`, true},
 		{`{"current":5,"total":4}`, false},
-		{`{"current":1,"total":5}`, false},
+		{`{"current":1,"total":5}`, true},
+		{`{"current":1,"total":0}`, false},
+		{`{"current":1,"total":9007199254740992}`, false},
 		{`{"current":1.5,"total":3}`, false},
 	} {
 		assertServerMessage(t, "connectionAttempt "+sample.attempt,
@@ -690,19 +690,6 @@ func TestOptionalAndNullableAreExact(t *testing.T) {
 }
 
 // A host authenticate without routePolicy takes DEFAULT_ROUTE_POLICY.
-func TestAuthenticateConnectionProgressOptIn(t *testing.T) {
-	for _, role := range []string{"host", "viewer"} {
-		base := `"type":"authenticate","protocol":"` + SignalingProtocol + `","roomId":"1234","clientId":"client_12345678","role":"` + role + `"`
-		if role == "host" {
-			base += `,"token":"` + repeat("a", 43) + `"`
-		}
-		for _, value := range []string{"true", "false", "null", "4", `"true"`} {
-			assertClientMessage(t, role+value, []byte(`{`+base+`,"connectionAttemptProgress4":`+value+`}`), value == "true")
-		}
-		assertClientMessage(t, role+" baseline", []byte(`{`+base+`}`), true)
-	}
-}
-
 func TestAuthenticateAppliesTheRoutePolicyDefault(t *testing.T) {
 	message, err := DecodeClientMessage([]byte(
 		`{"type":"authenticate","protocol":"piik-v24","roomId":"1234","role":"host",` +
diff --git a/internal/server/protocol/sfu.go b/internal/server/protocol/sfu.go
index 5e4000474..f7691a11e 100644
--- a/internal/server/protocol/sfu.go
+++ b/internal/server/protocol/sfu.go
@@ -27,12 +27,12 @@ func (value *SfuMedia) UnmarshalJSON(data []byte) error {
 		return err
 	}
 	if !enumOf(value.Codec, "h264", "vp8") || len(value.Layers) < 1 || len(value.Layers) > 3 ||
-		!inRangeInt(value.AudioBitrate, 0, 510_000) || value.Audio && value.AudioBitrate == 0 {
+		!inRangeInt(value.AudioBitrate, 0, MaxAudioBitrate) || value.Audio && value.AudioBitrate == 0 {
 		return errors.New("invalid SFU media")
 	}
 	for index, layer := range value.Layers {
 		if len(layer.RID) > 16 || layer.RID == "" && len(value.Layers) != 1 ||
-			!inRangeInt(layer.Width, 1, 8192) || !inRangeInt(layer.Height, 1, 8192) || !inRangeInt(layer.Bitrate, 1, 100_000_000) {
+			!inRangeInt(layer.Width, 1, 0xffff_ffff) || !inRangeInt(layer.Height, 1, 0xffff_ffff) || !inRangeInt(layer.Bitrate, 1, 0xffff_ffff) {
 			return errors.New("invalid SFU layer")
 		}
 		for _, previous := range value.Layers[:index] {
diff --git a/internal/server/protocol/types.go b/internal/server/protocol/types.go
index f201cc158..88542246a 100644
--- a/internal/server/protocol/types.go
+++ b/internal/server/protocol/types.go
@@ -120,8 +120,7 @@ func (v *QualityResolution) UnmarshalJSON(data []byte) error {
 	if err := present.require("width", "height"); err != nil {
 		return err
 	}
-	if !inRangeInt(v.Width, 4, 8192) || v.Width%2 != 0 ||
-		!inRangeInt(v.Height, 4, 8192) || v.Height%2 != 0 {
+	if !inRangeInt(v.Width, 1, 0xffff_ffff) || !inRangeInt(v.Height, 1, 0xffff_ffff) {
 		return errors.New("resolution is out of range")
 	}
 	return nil
@@ -130,7 +129,7 @@ func (v *QualityResolution) UnmarshalJSON(data []byte) error {
 // QualitySettings mirrors qualitySettingsSchema.
 type QualitySettings struct {
 	Resolution            QualityResolution `json:"resolution"`
-	MaxFramerate          Int               `json:"maxFramerate"`
+	MaxFramerate          Num               `json:"maxFramerate"`
 	MaxBitrate            Int               `json:"maxBitrate"`
 	DegradationPreference string            `json:"degradationPreference"`
 	MaxAudioBitrate       Int               `json:"maxAudioBitrate,omitempty"`
@@ -151,10 +150,10 @@ func (v *QualitySettings) UnmarshalJSON(data []byte) error {
 	if err := present.optional("maxAudioBitrate"); err != nil {
 		return err
 	}
-	if !inRangeInt(v.MaxFramerate, 15, 60) {
+	if v.MaxFramerate <= 0 || !inRangeNum(v.MaxFramerate, 0, MaxSafeInteger) {
 		return errors.New("maxFramerate is out of range")
 	}
-	if !inRangeInt(v.MaxBitrate, 2_000_000, 12_000_000) {
+	if !inRangeInt(v.MaxBitrate, 1, 0xffff_ffff) {
 		return errors.New("maxBitrate is out of range")
 	}
 	if !enumOf(v.DegradationPreference, degradationPreferences...) {
@@ -186,12 +185,11 @@ func (v *RoutePolicy) UnmarshalJSON(data []byte) error {
 
 // RuntimeCapabilities mirrors runtimeCapabilitiesSchema.
 type RuntimeCapabilities struct {
-	ConnectionAttemptProgress4 bool `json:"connectionAttemptProgress4,omitempty"`
-	Sfu                        bool `json:"sfu"`
-	SfuOnly                    bool `json:"sfuOnly,omitempty"`
-	NatPrediction              bool `json:"natPrediction"`
-	RoomInteractions           bool `json:"roomInteractions,omitempty"`
-	HostRoomSession            bool `json:"hostRoomSession,omitempty"`
+	Sfu              bool `json:"sfu"`
+	SfuOnly          bool `json:"sfuOnly,omitempty"`
+	NatPrediction    bool `json:"natPrediction"`
+	RoomInteractions bool `json:"roomInteractions,omitempty"`
+	HostRoomSession  bool `json:"hostRoomSession,omitempty"`
 }
 
 // UnmarshalJSON implements json.Unmarshaler.
@@ -204,14 +202,13 @@ func (v *RuntimeCapabilities) UnmarshalJSON(data []byte) error {
 	if present == nil {
 		return errors.New("runtime capabilities must be an object")
 	}
-	if err := present.optional("sfu", "sfuOnly", "roomInteractions", "hostRoomSession", "natPrediction", "connectionAttemptProgress4"); err != nil {
+	if err := present.optional("sfu", "sfuOnly", "roomInteractions", "hostRoomSession", "natPrediction"); err != nil {
 
 		return err
 	}
 	for key, target := range map[string]*bool{
 		"sfu": &v.Sfu, "sfuOnly": &v.SfuOnly, "natPrediction": &v.NatPrediction,
-		"connectionAttemptProgress4": &v.ConnectionAttemptProgress4,
-		"roomInteractions":           &v.RoomInteractions, "hostRoomSession": &v.HostRoomSession,
+		"roomInteractions": &v.RoomInteractions, "hostRoomSession": &v.HostRoomSession,
 	} {
 		if value, ok := present[key]; ok {
 			if err := json.Unmarshal(value, target); err != nil {
@@ -510,8 +507,8 @@ func (v *ConnectionAttempt) UnmarshalJSON(data []byte) error {
 	if !inRangeInt(v.Current, 1, int64(v.Total)) {
 		return errors.New("connectionAttempt.current is out of range")
 	}
-	if v.Total != 3 && v.Total != 4 {
-		return errors.New("connectionAttempt.total must be 3 or 4")
+	if !inRangeInt(v.Total, 1, MaxSafeInteger) {
+		return errors.New("connectionAttempt.total is out of range")
 	}
 	return nil
 }
@@ -997,11 +994,11 @@ func (v *ViewerQualityEvidenceMetrics) UnmarshalJSON(data []byte) error {
 		value            *Int
 		minimum, maximum int64
 	}{
-		{v.Width, 1, 16_384}, {v.Height, 1, 16_384},
-		{v.PacketsReceivedDelta, 0, 1_000_000}, {v.PacketsLostDelta, 0, 1_000_000},
-		{v.FramesDecodedDelta, 0, 10_000}, {v.FramesDroppedDelta, 0, 10_000},
+		{v.Width, 1, MaxSafeInteger}, {v.Height, 1, MaxSafeInteger},
+		{v.PacketsReceivedDelta, 0, MaxSafeInteger}, {v.PacketsLostDelta, 0, MaxSafeInteger},
+		{v.FramesDecodedDelta, 0, MaxSafeInteger}, {v.FramesDroppedDelta, 0, MaxSafeInteger},
 		{v.FreezeCountDelta, 0, MaxSafeInteger}, {v.PauseCountDelta, 0, MaxSafeInteger},
-		{v.AudioConcealmentEventsDelta, 0, 10_000},
+		{v.AudioConcealmentEventsDelta, 0, MaxSafeInteger},
 	} {
 		if bound.value != nil && !inRangeInt(*bound.value, bound.minimum, bound.maximum) {
 			return errors.New("viewer quality evidence integer is out of range")
@@ -1011,15 +1008,15 @@ func (v *ViewerQualityEvidenceMetrics) UnmarshalJSON(data []byte) error {
 		value            *Num
 		minimum, maximum float64
 	}{
-		{v.FramesPerSecond, 0, 240}, {v.BitrateKbps, 0, 100_000},
-		{v.RttMs, 0, 60_000}, {v.JitterMs, 0, 60_000},
-		{v.DecodeMsPerFrame, 0, 60_000},
+		{v.FramesPerSecond, 0, MaxSafeInteger}, {v.BitrateKbps, 0, MaxSafeInteger},
+		{v.RttMs, 0, MaxSafeInteger}, {v.JitterMs, 0, MaxSafeInteger},
+		{v.DecodeMsPerFrame, 0, MaxSafeInteger},
 		{v.FreezeDurationMsDelta, 0, MaxSafeInteger},
 		{v.PauseDurationMsDelta, 0, MaxSafeInteger},
-		{v.AudioBitrateKbps, 0, 10_000}, {v.AudioPacketLossPercent, 0, 100},
-		{v.AudioJitterMs, 0, 60_000},
-		{v.AudioVideoPlayoutDeltaMs, -60_000, 60_000},
-		{v.VideoJitterBufferDelayMs, 0, 60_000}, {v.AudioJitterBufferDelayMs, 0, 60_000},
+		{v.AudioBitrateKbps, 0, MaxSafeInteger}, {v.AudioPacketLossPercent, 0, 100},
+		{v.AudioJitterMs, 0, MaxSafeInteger},
+		{v.AudioVideoPlayoutDeltaMs, -MaxSafeInteger, MaxSafeInteger},
+		{v.VideoJitterBufferDelayMs, 0, MaxSafeInteger}, {v.AudioJitterBufferDelayMs, 0, MaxSafeInteger},
 		{v.AudioConcealedSamplesPercent, 0, 100},
 	} {
 		if bound.value != nil && !inRangeNum(*bound.value, bound.minimum, bound.maximum) {
@@ -1103,11 +1100,11 @@ func (v *SenderQualityDiagnostics) UnmarshalJSON(data []byte) error {
 		value            *Num
 		minimum, maximum float64
 	}{
-		{v.FramesPerSecond, 0, 240}, {v.BitrateKbps, 0, 100_000},
-		{v.CaptureFramesPerSecond.Value, 0, 240},
-		{v.MediaSourceFramesPerSecond.Value, 0, 240},
-		{v.AvailableOutgoingKbps.Value, 0, 100_000},
-		{v.RttMs.Value, 0, 60_000}, {v.PacketLossPercent.Value, 0, 100},
+		{v.FramesPerSecond, 0, MaxSafeInteger}, {v.BitrateKbps, 0, MaxSafeInteger},
+		{v.CaptureFramesPerSecond.Value, 0, MaxSafeInteger},
+		{v.MediaSourceFramesPerSecond.Value, 0, MaxSafeInteger},
+		{v.AvailableOutgoingKbps.Value, 0, MaxSafeInteger},
+		{v.RttMs.Value, 0, MaxSafeInteger}, {v.PacketLossPercent.Value, 0, 100},
 	} {
 		if bound.value != nil && !inRangeNum(*bound.value, bound.minimum, bound.maximum) {
 			return errors.New("sender quality diagnostic number is out of range")
@@ -1117,7 +1114,7 @@ func (v *SenderQualityDiagnostics) UnmarshalJSON(data []byte) error {
 		value   *Int
 		maximum int64
 	}{
-		{v.Width.Value, 16_384}, {v.Height.Value, 16_384},
+		{v.Width.Value, MaxSafeInteger}, {v.Height.Value, MaxSafeInteger},
 		{v.VideoEncodingCount.Value, MaxSafeInteger},
 		{v.ActiveVideoEncodingCount.Value, MaxSafeInteger},
 	} {
diff --git a/internal/server/sfu/media.go b/internal/server/sfu/media.go
index 4c2be04f7..4c9a6155a 100644
--- a/internal/server/sfu/media.go
+++ b/internal/server/sfu/media.go
@@ -127,7 +127,9 @@ func validPublicationMedia(metadata PublicationMedia) bool {
 		return false
 	}
 	for index, format := range metadata.Formats {
-		if format.Width == 0 || format.Height == 0 || format.Bitrate == 0 ||
+		// These are this SFU's admission bounds, not the descriptive wire format.
+		if format.Width == 0 || format.Width > 8192 || format.Height == 0 || format.Height > 8192 ||
+			format.Bitrate == 0 || format.Bitrate > 100_000_000 ||
 			len(metadata.RIDs[index]) > 16 ||
 			(metadata.RIDs[index] == "" && len(metadata.RIDs) != 1) ||
 			slices.Contains(metadata.RIDs[:index], metadata.RIDs[index]) {
diff --git a/internal/server/sfu/media_test.go b/internal/server/sfu/media_test.go
index 19b78aa78..9fb61e05c 100644
--- a/internal/server/sfu/media_test.go
+++ b/internal/server/sfu/media_test.go
@@ -30,6 +30,25 @@ func TestMediaOnePublicationTwoSubscribersAndExactRetirement(t *testing.T) {
 	}
 }
 
+func TestUnsupportedPublicationDescriptionDoesNotAllocate(t *testing.T) {
+	service := NewMedia(MediaOptions{})
+	defer service.Close()
+	fence := ResourceFence{RoomID: "1234", ShareGeneration: "share_12345678", PublicationGeneration: "publication_12345678"}
+	for _, format := range []forwarding.LayerFormat{
+		{Width: 32768, Height: 32768, Bitrate: 5_000_000},
+		{Width: 1920, Height: 1080, Bitrate: 200_000_000},
+		{Width: 0xffff_ffff, Height: 0xffff_ffff, Bitrate: 0xffff_ffff},
+	} {
+		metadata := PublicationMedia{Codec: "vp8", RIDs: []string{""}, Formats: []forwarding.LayerFormat{format}}
+		if err := service.PreparePublication(fence, "publisher_12345678", metadata); err == nil {
+			t.Fatal("unsupported format was admitted")
+		}
+		if service.HasPublication(fence, "publisher_12345678") {
+			t.Fatal("unsupported format allocated a publication")
+		}
+	}
+}
+
 func TestMediaDemandBootstrapsWaitingSubscriberAndStopsAfterExactClose(t *testing.T) {
 	ctx, cancel := context.WithTimeout(t.Context(), 3*time.Second)
 	defer cancel()
diff --git a/internal/server/signal/server.go b/internal/server/signal/server.go
index ca0fc8c25..73a8a0403 100644
--- a/internal/server/signal/server.go
+++ b/internal/server/signal/server.go
@@ -699,51 +699,48 @@ func (s *Server) handleMessage(sess *session, encoded []byte) {
 // fields authenticate() and authenticationErrorCode() read. Empty strings
 // and nil pointers are absent keys.
 type authRequest struct {
-	role                       protocol.Role
-	roomID                     string
-	clientID                   string
-	token                      string
-	viewerGrant                string
-	viewerPassword             string
-	shareGeneration            string
-	sharingPaused              bool
-	qualitySettings            *protocol.QualitySettings
-	routePolicy                protocol.RoutePolicy
-	viewerPresence             bool
-	connectionAttemptProgress4 bool
-	displayName                *string
-	roomOnly                   bool
-	roomSession                bool
+	role            protocol.Role
+	roomID          string
+	clientID        string
+	token           string
+	viewerGrant     string
+	viewerPassword  string
+	shareGeneration string
+	sharingPaused   bool
+	qualitySettings *protocol.QualitySettings
+	routePolicy     protocol.RoutePolicy
+	viewerPresence  bool
+	displayName     *string
+	roomOnly        bool
+	roomSession     bool
 }
 
 func authRequestOf(message protocol.ClientMessage) (authRequest, bool) {
 	switch m := message.(type) {
 	case protocol.AuthenticateHostMessage:
 		return authRequest{
-			role:                       protocol.RoleHost,
-			roomID:                     m.RoomID,
-			clientID:                   m.ClientID,
-			token:                      m.Token,
-			shareGeneration:            m.ShareGeneration,
-			sharingPaused:              m.SharingPaused != nil && *m.SharingPaused,
-			qualitySettings:            m.QualitySettings,
-			routePolicy:                m.RoutePolicy,
-			viewerPresence:             m.ViewerPresence,
-			connectionAttemptProgress4: m.ConnectionAttemptProgress4,
-			displayName:                displayNameString(m.DisplayName),
-			roomOnly:                   m.RoomOnly,
-			roomSession:                m.RoomSession,
+			role:            protocol.RoleHost,
+			roomID:          m.RoomID,
+			clientID:        m.ClientID,
+			token:           m.Token,
+			shareGeneration: m.ShareGeneration,
+			sharingPaused:   m.SharingPaused != nil && *m.SharingPaused,
+			qualitySettings: m.QualitySettings,
+			routePolicy:     m.RoutePolicy,
+			viewerPresence:  m.ViewerPresence,
+			displayName:     displayNameString(m.DisplayName),
+			roomOnly:        m.RoomOnly,
+			roomSession:     m.RoomSession,
 		}, true
 	case protocol.AuthenticateViewerMessage:
 		return authRequest{
-			role:                       protocol.RoleViewer,
-			roomID:                     m.RoomID,
-			clientID:                   m.ClientID,
-			viewerGrant:                m.ViewerGrant,
-			viewerPassword:             m.ViewerPassword,
-			viewerPresence:             m.ViewerPresence,
-			connectionAttemptProgress4: m.ConnectionAttemptProgress4,
-			displayName:                displayNameString(m.DisplayName),
+			role:           protocol.RoleViewer,
+			roomID:         m.RoomID,
+			clientID:       m.ClientID,
+			viewerGrant:    m.ViewerGrant,
+			viewerPassword: m.ViewerPassword,
+			viewerPresence: m.ViewerPresence,
+			displayName:    displayNameString(m.DisplayName),
 		}, true
 	}
 	return authRequest{}, false
@@ -893,14 +890,13 @@ func (s *Server) completeAuthentication(sess *session, request authRequest, part
 	}
 	displayName := authenticatedDisplayName(request)
 	authenticated := &authenticatedSession{
-		roomID:                     roomID,
-		role:                       participant.Role,
-		peerID:                     participant.PeerID,
-		shareGeneration:            shareGeneration,
-		displayName:                displayName,
-		viewerPresence:             request.viewerPresence,
-		connectionAttemptProgress4: request.connectionAttemptProgress4,
-		roomSession:                request.roomSession,
+		roomID:          roomID,
+		role:            participant.Role,
+		peerID:          participant.PeerID,
+		shareGeneration: shareGeneration,
+		displayName:     displayName,
+		viewerPresence:  request.viewerPresence,
+		roomSession:     request.roomSession,
 	}
 	sess.authenticated = authenticated
 	if participant.Role == protocol.RoleViewer {
diff --git a/internal/server/signal/server_test.go b/internal/server/signal/server_test.go
index 972767b2d..388a8dc1d 100644
--- a/internal/server/signal/server_test.go
+++ b/internal/server/signal/server_test.go
@@ -1011,16 +1011,15 @@ func isMediaReady(entry presenceEntry) bool {
 // ---------------------------------------------------------------------------
 
 type presenceOptions struct {
-	connectionAttemptProgress4 bool
-	displayName                string
-	viewerPresence             bool
-	viewerPassword             string
-	codeOnly                   bool
-	sharingPaused              *bool
-	qualitySettings            map[string]any
-	routePolicy                *protocol.RoutePolicy
-	roomSession                bool
-	roomOnly                   bool
+	displayName     string
+	viewerPresence  bool
+	viewerPassword  string
+	codeOnly        bool
+	sharingPaused   *bool
+	qualitySettings map[string]any
+	routePolicy     *protocol.RoutePolicy
+	roomSession     bool
+	roomOnly        bool
 }
 
 // authenticate ports the authenticate() helper. relayCapacity -1 is the TS
@@ -1043,9 +1042,6 @@ func authenticate(
 		"role":     role,
 		"clientId": clientID,
 	}
-	if presence.connectionAttemptProgress4 {
-		message["connectionAttemptProgress4"] = true
-	}
 	if role == protocol.RoleHost {
 		message["token"] = rm.HostToken
 		if shareGeneration != "" {
@@ -1376,51 +1372,31 @@ func TestSignalDeliversOnlySelfHostedAuxiliaryNatStunEndpoints(t *testing.T) {
 // lifecycle and restart
 // ---------------------------------------------------------------------------
 
-func TestConnectionAttemptProgressIsNegotiatedForEachRecipient(t *testing.T) {
-	for _, hostSupport := range []bool{false, true} {
-		for _, viewerSupport := range []bool{false, true} {
-			t.Run(fmt.Sprintf("host=%t/viewer=%t", hostSupport, viewerSupport), func(t *testing.T) {
-				h := startHarness(t, harnessOptions{
-					natPredictionEnabled: true,
-					stunURLs:             []string{"stun:share.example.test:3478"},
-				})
-				host, viewer := openClient(t, h), openClient(t, h)
-				policy := protocol.RoutePolicy{PeerOnly: true, NatPrediction: true}
-				authenticate(t, host, h.room, protocol.RoleHost, "progress-host", 1, "progress_share_generation_12345678",
-					presenceOptions{routePolicy: &policy, connectionAttemptProgress4: hostSupport})
-				authenticate(t, viewer, h.room, protocol.RoleViewer, "progress-viewer", 0, "",
-					presenceOptions{connectionAttemptProgress4: viewerSupport})
-				for current := 1; current <= 4; current++ {
-					hostPrepare, viewerPrepare := nextPreparedRoute(t, host), nextPreparedRoute(t, viewer)
-					for _, recipient := range []struct {
-						update  routeUpdate
-						support bool
-					}{
-						{hostPrepare, hostSupport}, {viewerPrepare, viewerSupport},
-					} {
-						decoded, err := protocol.DecodeServerMessage(recipient.update.raw)
-						if err != nil {
-							t.Fatal(err)
-						}
-						progress := decoded.(protocol.RouteUpdatePrepareMessage).Candidate.ConnectionAttempt
-						if recipient.support {
-							if progress == nil || *progress != (protocol.ConnectionAttempt{Current: protocol.Int(current), Total: 4}) {
-								t.Fatalf("new reader progress = %+v", progress)
-							}
-						} else if progress != nil {
-							t.Fatalf("old reader received unsupported progress: %+v", progress)
-						}
-					}
-					if hostPrepare.Candidate.ConnectionID != viewerPrepare.Candidate.ConnectionID {
-						t.Fatal("reader capability changed the actual candidate")
-					}
-					viewer.sendJSON(map[string]any{
-						"type": "route-failed", "phase": "prepare",
-						"revision": viewerPrepare.Revision, "connectionId": viewerPrepare.Candidate.ConnectionID,
-					})
-				}
-			})
+func TestConnectionAttemptProgressMatchesBothRecipients(t *testing.T) {
+	h := startHarness(t, harnessOptions{natPredictionEnabled: true,
+		stunURLs: []string{"stun:share.example.test:3478"}})
+	host, viewer := openClient(t, h), openClient(t, h)
+	policy := protocol.RoutePolicy{PeerOnly: true, NatPrediction: true}
+	authenticate(t, host, h.room, protocol.RoleHost, "progress-host", 1, "progress_share_generation_12345678",
+		presenceOptions{routePolicy: &policy})
+	authenticate(t, viewer, h.room, protocol.RoleViewer, "progress-viewer", 0, "", presenceOptions{})
+	for current := 1; current <= 4; current++ {
+		hostPrepare, viewerPrepare := nextPreparedRoute(t, host), nextPreparedRoute(t, viewer)
+		for _, update := range []routeUpdate{hostPrepare, viewerPrepare} {
+			decoded, err := protocol.DecodeServerMessage(update.raw)
+			if err != nil {
+				t.Fatal(err)
+			}
+			progress := decoded.(protocol.RouteUpdatePrepareMessage).Candidate.ConnectionAttempt
+			if progress == nil || *progress != (protocol.ConnectionAttempt{Current: protocol.Int(current), Total: 4}) {
+				t.Fatalf("progress = %+v", progress)
+			}
+		}
+		if hostPrepare.Candidate.ConnectionID != viewerPrepare.Candidate.ConnectionID {
+			t.Fatal("recipients disagree on the candidate")
 		}
+		viewer.sendJSON(map[string]any{"type": "route-failed", "phase": "prepare",
+			"revision": viewerPrepare.Revision, "connectionId": viewerPrepare.Candidate.ConnectionID})
 	}
 }
 
diff --git a/internal/server/signal/session.go b/internal/server/signal/session.go
index ca4585ec9..1d9f2f011 100644
--- a/internal/server/signal/session.go
+++ b/internal/server/signal/session.go
@@ -16,14 +16,13 @@ import (
 // authentication replaced between dispatch and use. Empty shareGeneration
 // means no share; nil displayName means the participant has no display name.
 type authenticatedSession struct {
-	roomID                     string
-	role                       protocol.Role
-	peerID                     string
-	shareGeneration            string
-	displayName                *string
-	viewerPresence             bool
-	connectionAttemptProgress4 bool
-	roomSession                bool
+	roomID          string
+	role            protocol.Role
+	peerID          string
+	shareGeneration string
+	displayName     *string
+	viewerPresence  bool
+	roomSession     bool
 }
 
 // outbound is one queue item: a text frame or the close frame that ends the
@@ -260,13 +259,6 @@ func (s *Server) heartbeat() []*session {
 // send drops unless open, terminates above the buffer bound,
 // and otherwise queues the encoded message.
 func (s *Server) send(sess *session, message protocol.ServerMessage) {
-	// Progress is optional feedback, not route authority. Older pages reject
-	// totals above three; omit it for that recipient without changing the route.
-	if prepare, ok := message.(protocol.RouteUpdatePrepareMessage); ok &&
-		(sess.authenticated == nil || !sess.authenticated.connectionAttemptProgress4) {
-		prepare.Candidate.ConnectionAttempt = nil
-		message = prepare
-	}
 	encoded, err := protocol.EncodeServerMessage(message)
 	if err != nil {
 		// JSON.stringify of a server literal cannot fail; neither can this.
diff --git a/src/client/App.tsx b/src/client/App.tsx
index 254f64b82..4b7585145 100644
--- a/src/client/App.tsx
+++ b/src/client/App.tsx
@@ -11,7 +11,6 @@ import {
   ApiError,
   authenticateSiteAccess,
   getRuntimeCapabilities,
-  getOptionalRuntimeCapabilities,
   getSiteAccess,
   type SiteAccessStatus,
 } from "./lib/api";
@@ -202,20 +201,9 @@ function RouteLoader() {
   );
 }
 
-// Invitation and room-code entry share discovery without making an invitation
-// pass through site authentication. Resolve before mounting media: changing the
-// negotiated flag later would restart an already healthy Viewer session.
 function ViewerEntry({ route }: { route: ViewerRoute }) {
-  const [progressSupported, setProgressSupported] = useState<boolean | null>(null);
-  useEffect(() => {
-    let active = true;
-    void getOptionalRuntimeCapabilities().then(capabilities => {
-      if (active) setProgressSupported(capabilities?.connectionAttemptProgress4 === true);
-    });
-    return () => { active = false; };
-  }, []);
-  return progressSupported === null ? <RouteLoader /> : (
-    <ViewerPage {...route} connectionAttemptProgress4={progressSupported}
+  return (
+    <ViewerPage {...route}
       launchedByClient={clientLaunchBootstrap?.launchedByClient} />
   );
 }
@@ -403,7 +391,6 @@ function SiteAccessGate({
         sfuAvailable={capabilities?.sfu === true}
         sfuOnly={capabilities?.sfuOnly === true}
         natPredictionAvailable={capabilities?.natPrediction === true}
-        connectionAttemptProgress4={capabilities?.connectionAttemptProgress4 === true}
         onAuthorizationRequired={() =>
           setAccess({ kind: "required", error: t("gate.expired") })
         }
diff --git a/src/client/components/living/QualityPresets.tsx b/src/client/components/living/QualityPresets.tsx
index 289147fda..0d0302231 100644
--- a/src/client/components/living/QualityPresets.tsx
+++ b/src/client/components/living/QualityPresets.tsx
@@ -2,7 +2,8 @@ import { Fragment, useRef } from "react";
 import { MIN_AUDIO_BITRATE } from "../../../shared/protocol";
 import {
   QUALITY_PROFILES, QUALITY_PROFILE_KEYS, QUALITY_RESOLUTIONS, qualityResolutionEqual,
-  captureFramerateCeiling, VIDEO_CAPTURE_LIMITS, type VideoCaptureLimits, type QualityProfileId, type QualityResolution,
+  captureFramerateCeiling, supportsCaptureProfile, MIN_VIDEO_FRAMERATE,
+  VIDEO_CAPTURE_LIMITS, type VideoCaptureLimits, type QualityProfileId, type QualityResolution,
   SCREEN_AUDIO_BITRATES, type ScreenAudioPreset,
 } from "../../media/quality";
 import { useCopy, type CopyKey } from "../../ui/copy";
@@ -27,7 +28,7 @@ export function QualityPresets({ selected, limits = VIDEO_CAPTURE_LIMITS, disabl
         text={vis ? undefined : t("host.quality.title", { label: caption, mbps: (profile.maxBitrate / 1_000_000).toFixed(0) })}>
         <button type="button" className={`lr-tile${selected === id ? " is-selected" : ""}`}
           aria-pressed={selected === id} aria-label={caption}
-          disabled={disabled || profile.maxFramerate > captureFramerateCeiling(profile.resolution, limits)} onClick={() => onSelect(id)}>
+          disabled={disabled || !supportsCaptureProfile(profile, limits)} onClick={() => onSelect(id)}>
           <QualityTileGlyph resolution={`${profile.resolution.height}p`} framerate={profile.maxFramerate} />
           <small>{vis ? `${profile.resolution.height}·${profile.maxFramerate}` : caption}</small>
         </button>
@@ -56,7 +57,7 @@ export function ResolutionControl({ value, limits, disabled, onChange }: {
       return;
     }
     const next = { width: width.valueAsNumber, height: height.valueAsNumber };
-    if (captureFramerateCeiling(next, limits) < 15) {
+    if (captureFramerateCeiling(next, limits) < MIN_VIDEO_FRAMERATE) {
       reset(container);
       return;
     }
@@ -76,7 +77,7 @@ export function ResolutionControl({ value, limits, disabled, onChange }: {
     <div className="lr-row-group" role="group" aria-label={t("host.advanced.resolution")}>
       {Object.entries(QUALITY_RESOLUTIONS).map(([label, resolution]) => <Chip key={label}
         selected={qualityResolutionEqual(value, resolution)}
-        disabled={disabled || captureFramerateCeiling(resolution, limits) < 15}
+        disabled={disabled || captureFramerateCeiling(resolution, limits) < MIN_VIDEO_FRAMERATE}
         title={label} hint="hint-quality" onClick={() => {
           // Selecting even the current preset replaces an unsubmitted draft.
           reset(controls.current!);
diff --git a/src/client/lib/api.ts b/src/client/lib/api.ts
index 382ba1c67..1303dff99 100644
--- a/src/client/lib/api.ts
+++ b/src/client/lib/api.ts
@@ -99,20 +99,6 @@ export async function getRuntimeCapabilities(signal?: AbortSignal): Promise<Runt
   return parsed.data;
 }
 
-// Viewer progress is optional feedback: unavailable capability discovery must
-// not prevent viewing. Host policy discovery remains required.
-export async function getOptionalRuntimeCapabilities(): Promise<RuntimeCapabilities | null> {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), 2_000);
-  try {
-    return await getRuntimeCapabilities(controller.signal);
-  } catch {
-    return null;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
 export async function authenticateSiteAccess(
   password: string,
 ): Promise<SiteAccessStatus> {
diff --git a/src/client/lib/quality-preference.ts b/src/client/lib/quality-preference.ts
index a5b25e8c8..db4736f10 100644
--- a/src/client/lib/quality-preference.ts
+++ b/src/client/lib/quality-preference.ts
@@ -3,6 +3,7 @@ import {
   qualitySettingsSchema,
   type QualitySettings,
 } from "../../shared/protocol";
+import { supportsCaptureProfile } from "../media/quality";
 
 const STORAGE_KEY = "piik:quality-preference:v1";
 
@@ -10,7 +11,7 @@ export function readPreferredQuality(): QualitySettings {
   try {
     const stored = window.localStorage.getItem(STORAGE_KEY);
     const result = qualitySettingsSchema.safeParse(stored ? JSON.parse(stored) : null);
-    if (result.success) return result.data;
+    if (result.success && supportsCaptureProfile(result.data)) return result.data;
   } catch {
     // Storage may be unavailable; sharing still works with session settings.
   }
diff --git a/src/client/media/quality.ts b/src/client/media/quality.ts
index 6482c1840..779ac5722 100644
--- a/src/client/media/quality.ts
+++ b/src/client/media/quality.ts
@@ -2,6 +2,7 @@ import {
   DEFAULT_QUALITY_SETTINGS,
   MIN_AUDIO_BITRATE,
   MAX_AUDIO_BITRATE,
+  qualitySettingsSchema,
   type DegradationPreference,
   type QualityResolution,
   type QualitySettings,
@@ -22,10 +23,14 @@ export type {
 
 export type QualityProfile = QualitySettings;
 export const STARTUP_VIDEO_ENCODED_FRAMES = 5;
+export const MIN_VIDEO_FRAMERATE = 15;
+export const MIN_VIDEO_BITRATE = 2_000_000;
 export interface VideoCaptureLimits {
   maxVideoResolution: QualityResolution;
   maxVideoPixels: number;
   maxVideoMacroblocksPerSecond: number;
+  maxVideoFramerate: number;
+  maxVideoBitrate: number;
 }
 
 // Current output boundary, independent of descriptive wire bounds and UI presets.
@@ -34,6 +39,8 @@ export const VIDEO_CAPTURE_LIMITS: VideoCaptureLimits = {
   maxVideoResolution: { width: 3840, height: 3840 },
   maxVideoPixels: 3840 * 2160,
   maxVideoMacroblocksPerSecond: 983_040,
+  maxVideoFramerate: 60,
+  maxVideoBitrate: 12_000_000,
 };
 
 export function videoCaptureLimits(advertised?: Partial<VideoCaptureLimits>): VideoCaptureLimits {
@@ -46,6 +53,8 @@ export function videoCaptureLimits(advertised?: Partial<VideoCaptureLimits>): Vi
     maxVideoPixels: Math.min(local.maxVideoPixels, advertised?.maxVideoPixels ?? local.maxVideoPixels),
     maxVideoMacroblocksPerSecond: Math.min(local.maxVideoMacroblocksPerSecond,
       advertised?.maxVideoMacroblocksPerSecond ?? local.maxVideoMacroblocksPerSecond),
+    maxVideoFramerate: Math.min(local.maxVideoFramerate, advertised?.maxVideoFramerate ?? local.maxVideoFramerate),
+    maxVideoBitrate: Math.min(local.maxVideoBitrate, advertised?.maxVideoBitrate ?? local.maxVideoBitrate),
   };
 }
 
@@ -53,10 +62,23 @@ export function captureFramerateCeiling(size: QualityResolution, limits = VIDEO_
   if (![size.width, size.height].every(value => Number.isInteger(value) && value >= 4 && value % 2 === 0)
     || size.width > limits.maxVideoResolution.width || size.height > limits.maxVideoResolution.height
     || size.width * size.height > limits.maxVideoPixels) return 0;
-  return Math.min(60, Math.floor(limits.maxVideoMacroblocksPerSecond /
+  return Math.floor(Math.min(limits.maxVideoFramerate, limits.maxVideoMacroblocksPerSecond /
     (Math.ceil(size.width / 16) * Math.ceil(size.height / 16))));
 }
 
+export function supportsCaptureProfile(profile: QualityProfile, limits = VIDEO_CAPTURE_LIMITS,
+  maxAudioBitrate = MAX_SCREEN_AUDIO_BITRATE): boolean {
+  return qualitySettingsSchema.safeParse(profile).success &&
+    Number.isInteger(profile.maxFramerate) && profile.maxFramerate >= MIN_VIDEO_FRAMERATE &&
+    profile.maxFramerate <= captureFramerateCeiling(profile.resolution, limits) &&
+    profile.maxBitrate >= MIN_VIDEO_BITRATE && profile.maxBitrate <= limits.maxVideoBitrate &&
+    screenAudioBitrate(profile.maxAudioBitrate) <= maxAudioBitrate;
+}
+
+function requireCaptureProfile(profile: QualityProfile): void {
+  if (!supportsCaptureProfile(profile)) throw new Error("Capture quality is not supported by this implementation");
+}
+
 export const QUALITY_PROFILES = {
   "720p30": {
     resolution: { width: 1280, height: 720 },
@@ -211,6 +233,7 @@ export function qualitySettingsLabel(settings: QualitySettings): string {
 }
 
 function captureConstraints(profile: QualityProfile): MediaTrackConstraints {
+  requireCaptureProfile(profile);
   const resolution = profile.resolution;
   return {
     // A ceiling must not ask the Browser to fill both axes by cropping a source.
@@ -261,6 +284,7 @@ export type BrowserCaptureSource = "browser" | "camera";
 
 export async function captureBrowserSource(profile: QualityProfile, source: BrowserCaptureSource, deviceId = ""): Promise<MediaStream> {
   if (source !== "camera") return captureDisplay(profile);
+  requireCaptureProfile(profile);
   const stream = await navigator.mediaDevices.getUserMedia({ audio: false,
     video: cameraCaptureConstraints(profile.resolution, profile.maxFramerate, deviceId) });
   const track = stream.getVideoTracks()[0];
diff --git a/src/client/media/sender-quality-evidence.ts b/src/client/media/sender-quality-evidence.ts
index 688fff3bf..2a6b60ffc 100644
--- a/src/client/media/sender-quality-evidence.ts
+++ b/src/client/media/sender-quality-evidence.ts
@@ -5,6 +5,7 @@ import {
 } from "../../shared/protocol";
 import type { PeerSnapshot } from "../types";
 import type { ConnectionMetrics } from "../types";
+import { boundedNumber, boundedInteger } from "../../shared/quality-evidence";
 
 let senderEvidenceGeneration = 0;
 const connectionGenerations = new Map<string, number>();
@@ -50,8 +51,10 @@ function nativeQualityState(
   if (
     (metrics.nativeEdgeQualityState !== "healthy" &&
       metrics.nativeEdgeQualityState !== "degraded") ||
-    metrics.sampleWindowMs === null ||
-    metrics.sampleTimestampMs === null ||
+    metrics.sampleWindowMs === null || !Number.isFinite(metrics.sampleWindowMs) ||
+    metrics.sampleWindowMs < 1_000 || metrics.sampleWindowMs > 5_000 ||
+    boundedNumber(metrics.sampleTimestampMs) === null ||
+    boundedInteger(frames) === null ||
     frames === null ||
     frames <= 0
   ) {
@@ -64,6 +67,22 @@ function nativeQualityState(
   return metrics.nativeEdgeQualityState;
 }
 
+function senderDiagnostics(metrics: ConnectionMetrics, state: "unknown" | "healthy" | "degraded") {
+  return {
+    natTraversalPath: metrics.natTraversalPath,
+    reason: state === "unknown" ? null : metrics.qualityLimitationReason,
+    framesPerSecond: boundedNumber(metrics.framesPerSecond),
+    bitrateKbps: boundedNumber(metrics.bitrateKbps),
+    captureFramesPerSecond: boundedNumber(metrics.captureFramesPerSecond),
+    mediaSourceFramesPerSecond: boundedNumber(metrics.mediaSourceFramesPerSecond),
+    width: boundedInteger(metrics.frameWidth),
+    height: boundedInteger(metrics.frameHeight),
+    availableOutgoingKbps: boundedNumber(metrics.availableOutgoingKbps),
+    rttMs: boundedNumber(metrics.rttMs),
+    packetLossPercent: boundedNumber(metrics.packetLossPercent, 100),
+  };
+}
+
 export function senderQualityEvidenceFromSnapshot(
   snapshot: PeerSnapshot,
   routeRevision: number,
@@ -99,20 +118,7 @@ export function senderQualityEvidenceFromSnapshot(
     sampleTimestampMs,
     routeRevision,
     state,
-    diagnostics: {
-      natTraversalPath: snapshot.metrics.natTraversalPath,
-      reason:
-        state === "unknown" ? null : snapshot.metrics.qualityLimitationReason,
-      framesPerSecond: snapshot.metrics.framesPerSecond,
-      bitrateKbps: snapshot.metrics.bitrateKbps,
-      captureFramesPerSecond: snapshot.metrics.captureFramesPerSecond,
-      mediaSourceFramesPerSecond: snapshot.metrics.mediaSourceFramesPerSecond,
-      width: snapshot.metrics.frameWidth,
-      height: snapshot.metrics.frameHeight,
-      availableOutgoingKbps: snapshot.metrics.availableOutgoingKbps,
-      rttMs: snapshot.metrics.rttMs,
-      packetLossPercent: snapshot.metrics.packetLossPercent,
-    },
+    diagnostics: senderDiagnostics(snapshot.metrics, state),
   });
   if (!parsed.success) {
     return null;
@@ -121,7 +127,7 @@ export function senderQualityEvidenceFromSnapshot(
     if (!emitUnknownOnce(unknownConnections, snapshot.connectionId)) {
       return null;
     }
-    if (rawSampleTimestampMs !== null) {
+    if (rawSampleTimestampMs !== null && boundedNumber(rawSampleTimestampMs) !== null) {
       connectionSampleTimestamps.set(
         snapshot.connectionId,
         rawSampleTimestampMs,
@@ -163,19 +169,9 @@ export function sfuPublisherQualityEvidenceFromMetrics(
     state,
     sampleTimestampMs,
     diagnostics: {
-      natTraversalPath: metrics.natTraversalPath,
-      reason: state === "unknown" ? null : metrics.qualityLimitationReason,
-      framesPerSecond: metrics.framesPerSecond,
-      bitrateKbps: metrics.bitrateKbps,
-      captureFramesPerSecond: metrics.captureFramesPerSecond,
-      mediaSourceFramesPerSecond: metrics.mediaSourceFramesPerSecond,
-      width: metrics.frameWidth,
-      height: metrics.frameHeight,
-      videoEncodingCount: metrics.videoEncodingCount,
-      activeVideoEncodingCount: metrics.activeVideoEncodingCount,
-      availableOutgoingKbps: metrics.availableOutgoingKbps,
-      rttMs: metrics.rttMs,
-      packetLossPercent: metrics.packetLossPercent,
+      ...senderDiagnostics(metrics, state),
+      videoEncodingCount: boundedInteger(metrics.videoEncodingCount),
+      activeVideoEncodingCount: boundedInteger(metrics.activeVideoEncodingCount),
     },
   });
   if (!parsed.success) {
@@ -185,7 +181,7 @@ export function sfuPublisherQualityEvidenceFromMetrics(
     if (!emitUnknownOnce(unknownPublications, publicationGeneration)) {
       return null;
     }
-    if (rawSampleTimestampMs !== null) {
+    if (rawSampleTimestampMs !== null && boundedNumber(rawSampleTimestampMs) !== null) {
       publicationSampleTimestamps.set(
         publicationGeneration,
         rawSampleTimestampMs,
diff --git a/src/client/media/viewer-quality-evidence.ts b/src/client/media/viewer-quality-evidence.ts
index 0419dd735..d2e5b3241 100644
--- a/src/client/media/viewer-quality-evidence.ts
+++ b/src/client/media/viewer-quality-evidence.ts
@@ -11,6 +11,7 @@ import {
   type ViewerQualityEvidenceMetrics,
 } from "../../shared/protocol";
 import { packetLossPercentFromDeltas } from "../../shared/packet-loss";
+import { boundedNumber, boundedInteger, boundedSignedNumber } from "../../shared/quality-evidence";
 import {
   EMPTY_METRICS,
   type ConnectionMetrics,
@@ -41,29 +42,6 @@ type ViewerQualityEvidenceWindow = Pick<
   "windowMs" | "metrics"
 >;
 
-function boundedNumber(value: number | null, maximum: number): number | null {
-  return value !== null && Number.isFinite(value) && value >= 0 && value <= maximum
-    ? value
-    : null;
-}
-
-function boundedSignedNumber(
-  value: number | null,
-  absoluteMaximum: number,
-): number | null {
-  return value !== null &&
-    Number.isFinite(value) &&
-    Math.abs(value) <= absoluteMaximum
-    ? value
-    : null;
-}
-
-function boundedInteger(value: number | null, maximum: number): number | null {
-  return value !== null && Number.isInteger(value) && value >= 0 && value <= maximum
-    ? value
-    : null;
-}
-
 function boundedString(
   value: string | null,
   maximumLength: number,
@@ -87,8 +65,8 @@ export function qualityEvidenceWindowFromMetrics(
     return null;
   }
 
-  const boundedWidth = boundedInteger(metrics.frameWidth, 16_384);
-  const boundedHeight = boundedInteger(metrics.frameHeight, 16_384);
+  const boundedWidth = boundedInteger(metrics.frameWidth);
+  const boundedHeight = boundedInteger(metrics.frameHeight);
   const width = boundedWidth !== null && boundedWidth >= 1 ? boundedWidth : null;
   const height =
     boundedHeight !== null && boundedHeight >= 1 ? boundedHeight : null;
@@ -99,40 +77,19 @@ export function qualityEvidenceWindowFromMetrics(
   const candidate: ViewerQualityEvidenceMetrics = {
     natTraversalPath: metrics.natTraversalPath,
     ...dimensions,
-    framesPerSecond: boundedNumber(metrics.framesPerSecond, 240),
-    bitrateKbps: boundedNumber(metrics.bitrateKbps, 100_000),
-    packetsReceivedDelta: boundedInteger(
-      metrics.intervalPacketsReceived,
-      1_000_000,
-    ),
-    packetsLostDelta: boundedInteger(metrics.intervalPacketsLost, 1_000_000),
-    rttMs: boundedNumber(metrics.rttMs, 60_000),
-    jitterMs: boundedNumber(metrics.jitterMs, 60_000),
-    framesDecodedDelta: boundedInteger(
-      metrics.intervalFramesDecoded,
-      10_000,
-    ),
-    framesDroppedDelta: boundedInteger(
-      metrics.intervalFramesDropped,
-      10_000,
-    ),
-    decodeMsPerFrame: boundedNumber(metrics.intervalDecodeMs, 60_000),
-    freezeCountDelta: boundedInteger(
-      metrics.intervalFreezeCount,
-      Number.MAX_SAFE_INTEGER,
-    ),
-    freezeDurationMsDelta: boundedNumber(
-      metrics.intervalFreezeDurationMs,
-      Number.MAX_SAFE_INTEGER,
-    ),
-    pauseCountDelta: boundedInteger(
-      metrics.intervalPauseCount,
-      Number.MAX_SAFE_INTEGER,
-    ),
-    pauseDurationMsDelta: boundedNumber(
-      metrics.intervalPauseDurationMs,
-      Number.MAX_SAFE_INTEGER,
-    ),
+    framesPerSecond: boundedNumber(metrics.framesPerSecond),
+    bitrateKbps: boundedNumber(metrics.bitrateKbps),
+    packetsReceivedDelta: boundedInteger(metrics.intervalPacketsReceived),
+    packetsLostDelta: boundedInteger(metrics.intervalPacketsLost),
+    rttMs: boundedNumber(metrics.rttMs),
+    jitterMs: boundedNumber(metrics.jitterMs),
+    framesDecodedDelta: boundedInteger(metrics.intervalFramesDecoded),
+    framesDroppedDelta: boundedInteger(metrics.intervalFramesDropped),
+    decodeMsPerFrame: boundedNumber(metrics.intervalDecodeMs),
+    freezeCountDelta: boundedInteger(metrics.intervalFreezeCount),
+    freezeDurationMsDelta: boundedNumber(metrics.intervalFreezeDurationMs),
+    pauseCountDelta: boundedInteger(metrics.intervalPauseCount),
+    pauseDurationMsDelta: boundedNumber(metrics.intervalPauseDurationMs),
     codec: boundedString(
       metrics.codec,
       64,
@@ -148,32 +105,20 @@ export function qualityEvidenceWindowFromMetrics(
       128,
       /^[a-z0-9-]+=[a-z0-9]+(?:; [a-z0-9-]+=[a-z0-9]+)*$/,
     ),
-    audioBitrateKbps: boundedNumber(metrics.audioBitrateKbps, 10_000),
+    audioBitrateKbps: boundedNumber(metrics.audioBitrateKbps),
     audioPacketLossPercent: boundedNumber(
       metrics.audioPacketLossPercent,
       100,
     ),
-    audioJitterMs: boundedNumber(metrics.audioJitterMs, 60_000),
-    audioVideoPlayoutDeltaMs: boundedSignedNumber(
-      metrics.audioVideoPlayoutDeltaMs,
-      60_000,
-    ),
-    videoJitterBufferDelayMs: boundedNumber(
-      metrics.videoJitterBufferDelayMs,
-      60_000,
-    ),
-    audioJitterBufferDelayMs: boundedNumber(
-      metrics.audioJitterBufferDelayMs,
-      60_000,
-    ),
+    audioJitterMs: boundedNumber(metrics.audioJitterMs),
+    audioVideoPlayoutDeltaMs: boundedSignedNumber(metrics.audioVideoPlayoutDeltaMs),
+    videoJitterBufferDelayMs: boundedNumber(metrics.videoJitterBufferDelayMs),
+    audioJitterBufferDelayMs: boundedNumber(metrics.audioJitterBufferDelayMs),
     audioConcealedSamplesPercent: boundedNumber(
       metrics.audioConcealedSamplesPercent,
       100,
     ),
-    audioConcealmentEventsDelta: boundedInteger(
-      metrics.intervalAudioConcealmentEvents,
-      10_000,
-    ),
+    audioConcealmentEventsDelta: boundedInteger(metrics.intervalAudioConcealmentEvents),
     audioCodec: boundedString(
       metrics.audioCodec,
       64,
diff --git a/src/client/native/client.ts b/src/client/native/client.ts
index 81e04d8c5..00ccca279 100644
--- a/src/client/native/client.ts
+++ b/src/client/native/client.ts
@@ -756,6 +756,13 @@ export class NativeClient {
     }
     const event = nativeEventSchema.safeParse(value);
     if (!event.success) {
+      // A rejected observation has no control authority. Drop it without
+      // retiring healthy media; its identity/state must still pass to be used.
+      if (value && typeof value === "object" && "type" in value &&
+        (value.type === "edge-quality" || value.type === "publication-quality")) {
+        debugError("native", "quality-sample-invalid", event.error);
+        return;
+      }
       debugError("native", "protocol-failed", event.error, { stage: "event-invalid" });
       this.failConnection();
       return;
diff --git a/src/client/native/wire.ts b/src/client/native/wire.ts
index b91cb0c5d..be0c982d9 100644
--- a/src/client/native/wire.ts
+++ b/src/client/native/wire.ts
@@ -1,5 +1,6 @@
 import { z } from "zod";
-import { sfuMediaSchema, maxAudioBitrateSchema, qualityResolutionSchema } from "../../shared/protocol";
+import { sfuMediaSchema, positiveUint32Schema, qualityResolutionSchema,
+  nullableSafeEvidenceNumber, nullableSafeEvidenceInteger } from "../../shared/protocol";
 
 export const NATIVE_CLIENT_PROTOCOL = 10;
 export const NATIVE_CLIENT_PORT_START = 39_721;
@@ -33,10 +34,12 @@ export const nativeHealthSchema = nativeDiscoveryIdentitySchema.extend({
     .regex(/^[A-Za-z0-9_-]+$/),
   nativeMedia: z
     .object({
-      maxAudioBitrate: maxAudioBitrateSchema.optional(),
+      maxAudioBitrate: positiveUint32Schema.optional(),
       maxVideoResolution: qualityResolutionSchema.optional(),
-      maxVideoPixels: z.number().int().min(16).max(8192 * 8192).optional(),
+      maxVideoPixels: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional(),
       maxVideoMacroblocksPerSecond: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional(),
+      maxVideoFramerate: z.number().positive().max(Number.MAX_SAFE_INTEGER).optional(),
+      maxVideoBitrate: positiveUint32Schema.optional(),
       receiverReuse: z.boolean().default(false),
       video: z.boolean().default(false),
       processAudio: z.boolean().default(false),
@@ -270,25 +273,20 @@ export const nativeEventSchema = z.discriminatedUnion("type", [
       rtpStatsId: z.string().min(1).max(256),
       trackIdentifier: z.string().min(1).max(256),
       codec: nativeVideoCodecSchema,
-      videoEncodingCount: z.number().int().min(1).max(3),
-      activeVideoEncodingCount: z.number().int().min(0).max(3),
+      videoEncodingCount: nullableSafeEvidenceInteger.catch(null),
+      activeVideoEncodingCount: nullableSafeEvidenceInteger.catch(null),
       rid: z.string().max(16),
       intervalFramesSent: z
         .number()
         .int()
         .nonnegative()
         .max(Number.MAX_SAFE_INTEGER),
-      framesPerSecond: z.number().finite().nonnegative().max(240),
-      width: z.number().int().nonnegative().max(16_384),
-      height: z.number().int().nonnegative().max(16_384),
-      bitrateKbps: z.number().finite().nonnegative().max(100_000),
-      audioBitrateKbps: z.number().finite().nonnegative().max(1_000),
-      availableOutgoingKbps: z
-        .number()
-        .finite()
-        .nonnegative()
-        .max(100_000)
-        .nullable(),
+      framesPerSecond: nullableSafeEvidenceNumber.catch(null),
+      width: nullableSafeEvidenceInteger.catch(null),
+      height: nullableSafeEvidenceInteger.catch(null),
+      bitrateKbps: nullableSafeEvidenceNumber.catch(null),
+      audioBitrateKbps: nullableSafeEvidenceNumber.catch(null),
+      availableOutgoingKbps: nullableSafeEvidenceNumber.catch(null),
       state: z.enum(["unknown", "healthy", "degraded"]),
       reason: z.enum(["none", "bandwidth"]).nullable(),
     })
@@ -385,11 +383,11 @@ export const nativeEventSchema = z.discriminatedUnion("type", [
         .int()
         .nonnegative()
         .max(Number.MAX_SAFE_INTEGER),
-      framesPerSecond: z.number().finite().nonnegative().max(240),
-      bitrateKbps: z.number().finite().nonnegative().max(100_000),
-      availableOutgoingKbps: z.number().finite().nonnegative().max(100_000),
-      width: z.number().int().nonnegative().max(16_384),
-      height: z.number().int().nonnegative().max(16_384),
+      framesPerSecond: nullableSafeEvidenceNumber.catch(null),
+      bitrateKbps: nullableSafeEvidenceNumber.catch(null),
+      availableOutgoingKbps: nullableSafeEvidenceNumber.catch(null),
+      width: nullableSafeEvidenceInteger.catch(null),
+      height: nullableSafeEvidenceInteger.catch(null),
     })
     .strict()
     .superRefine((event, context) => {
diff --git a/src/client/pages/HostPage.tsx b/src/client/pages/HostPage.tsx
index a305eaccd..900d69580 100644
--- a/src/client/pages/HostPage.tsx
+++ b/src/client/pages/HostPage.tsx
@@ -129,6 +129,9 @@ import {
   DEGRADATION_PREFERENCE_KEYS,
   videoCaptureLimits,
   captureFramerateCeiling,
+  supportsCaptureProfile,
+  MIN_VIDEO_FRAMERATE,
+  MIN_VIDEO_BITRATE,
   qualityResolutionEqual,
   qualitySettingsEqual,
   qualitySettingsLabel,
@@ -342,7 +345,6 @@ interface HostPageProps {
   sfuAvailable?: boolean;
   sfuOnly?: boolean;
   natPredictionAvailable?: boolean;
-  connectionAttemptProgress4?: boolean;
   launchedByClient?: boolean;
   onAuthorizationRequired?: () => void;
 }
@@ -365,7 +367,6 @@ export function HostPage({
   sfuAvailable = false,
   sfuOnly = false,
   natPredictionAvailable = false,
-  connectionAttemptProgress4 = false,
   launchedByClient = false,
   onAuthorizationRequired,
 }: HostPageProps = {}) {
@@ -1631,7 +1632,7 @@ export function HostPage({
     pendingAppQualityPreferenceRef.current = null;
     if (pending) preference.save(pending);
     const saved = await preference.read();
-    if (!signal.aborted && saved && !qualityPreferenceEditedRef.current &&
+    if (!signal.aborted && saved && supportsCaptureProfile(saved) && !qualityPreferenceEditedRef.current &&
       qualitySettingsRef.current === initial && activeGenerationRef.current === null &&
       roomMutationRef.current === null) {
       commitQuality(saved);
@@ -1676,6 +1677,12 @@ export function HostPage({
   }
 
   async function changeQuality(nextProfile: QualitySettings): Promise<void> {
+    if (!supportsCaptureProfile(nextProfile, videoLimits, audioBitrateCeiling)) {
+      advancedQualityRef.current = qualitySettingsRef.current;
+      setAdvancedQuality(qualitySettingsRef.current);
+      setNoticeError(new Error("Capture quality is not supported by this implementation"), "quality");
+      return;
+    }
     qualityPreferenceEditedRef.current = true;
     advancedQualityRef.current = nextProfile;
     setAdvancedQuality(nextProfile);
@@ -2516,7 +2523,6 @@ export function HostPage({
         qualitySettings: qualitySettingsRef.current,
         routePolicy: routePolicyRef.current,
         viewerPresence: true,
-        ...(connectionAttemptProgress4 ? { connectionAttemptProgress4: true } : {}),
         displayName: initialDisplayName,
       },
       {
@@ -3590,7 +3596,7 @@ export function HostPage({
     ? nativeClientRef.current?.health.nativeMedia.maxAudioBitrate ?? MAX_SCREEN_AUDIO_BITRATE
     : MAX_SCREEN_AUDIO_BITRATE);
   const videoLimits = videoCaptureLimits(nativeActive ? nativeClientRef.current?.health.nativeMedia : undefined);
-  const framerateCeiling = Math.max(15, captureFramerateCeiling(advancedQuality.resolution, videoLimits));
+  const framerateCeiling = captureFramerateCeiling(advancedQuality.resolution, videoLimits);
 
   return (
     <div className="lr-app">
@@ -3856,11 +3862,11 @@ export function HostPage({
                     <span className="lr-slider">
                       <input
                         type="range"
-                        min={15}
-                        max={framerateCeiling}
+                        min={MIN_VIDEO_FRAMERATE}
+                        max={Math.max(MIN_VIDEO_FRAMERATE, framerateCeiling)}
                         step={1}
                         value={advancedQuality.maxFramerate}
-                        disabled={phase === "starting" || switchingSource}
+                        disabled={phase === "starting" || switchingSource || framerateCeiling < MIN_VIDEO_FRAMERATE}
                         aria-label={t("host.advanced.framerate")}
                         onChange={(event) =>
                           changeAdvancedQuality({
@@ -3883,11 +3889,11 @@ export function HostPage({
                     <span className="lr-slider">
                       <input
                         type="range"
-                        min={2000000}
-                        max={12000000}
+                        min={MIN_VIDEO_BITRATE}
+                        max={Math.max(MIN_VIDEO_BITRATE, videoLimits.maxVideoBitrate)}
                         step={500000}
                         value={advancedQuality.maxBitrate}
-                        disabled={phase === "starting" || switchingSource}
+                        disabled={phase === "starting" || switchingSource || videoLimits.maxVideoBitrate < MIN_VIDEO_BITRATE}
                         aria-label={t("host.advanced.bitrate")}
                         onChange={(event) =>
                           changeAdvancedQuality({
diff --git a/src/client/pages/ViewerPage.tsx b/src/client/pages/ViewerPage.tsx
index da1177c65..1339113da 100644
--- a/src/client/pages/ViewerPage.tsx
+++ b/src/client/pages/ViewerPage.tsx
@@ -130,7 +130,6 @@ interface ViewerPageProps {
   viewerGrant?: string;
   invalidGrant?: boolean;
   launchedByClient?: boolean;
-  connectionAttemptProgress4?: boolean;
 }
 
 type ViewerQualityEvidence = Extract<
@@ -170,7 +169,6 @@ export function ViewerPage({
   viewerGrant,
   invalidGrant = false,
   launchedByClient = false,
-  connectionAttemptProgress4 = false,
 }: ViewerPageProps) {
   const { lang, t, vis, titleFrames } = useCopy();
   const viewerClientId = useMemo(
@@ -576,7 +574,6 @@ export function ViewerPage({
           : {}),
         displayName: displayNameRef.current,
         viewerPresence: true,
-        ...(connectionAttemptProgress4 ? { connectionAttemptProgress4: true } : {}),
       },
       {
         onStatus: (status) => {
@@ -1844,7 +1841,7 @@ export function ViewerPage({
       viewerRelaySourceKey = null;
       releaseNativeClient();
     };
-  }, [roomId, viewerGrant, viewerPasswordAttempt, launchedByClient, connectionAttemptProgress4]);
+  }, [roomId, viewerGrant, viewerPasswordAttempt, launchedByClient]);
 
   useEffect(() => {
     const video = videoRef.current;
diff --git a/src/shared/protocol.ts b/src/shared/protocol.ts
index 0d5b374bd..b11e6dd2f 100644
--- a/src/shared/protocol.ts
+++ b/src/shared/protocol.ts
@@ -174,10 +174,12 @@ export const roleSchema = z.enum(["host", "viewer"]);
 export type Role = z.infer<typeof roleSchema>;
 
 // Describes a requested ceiling, not encoder availability or an allocation.
-// Match the existing media-description bound; adapters retain their own limits.
+// WebRTC uses unsigned-long dimensions/bitrates and a double frame rate.
+// Alignment, usable ranges and allocation budgets belong to the media adapter.
+export const positiveUint32Schema = z.number().int().positive().max(0xffff_ffff);
 export const qualityResolutionSchema = z.object({
-  width: z.number().int().min(4).max(8192).multipleOf(2),
-  height: z.number().int().min(4).max(8192).multipleOf(2),
+  width: positiveUint32Schema,
+  height: positiveUint32Schema,
 }).strict();
 export type QualityResolution = z.infer<typeof qualityResolutionSchema>;
 
@@ -197,8 +199,8 @@ export const maxAudioBitrateSchema = z.number().int().min(MIN_AUDIO_BITRATE).max
 export const qualitySettingsSchema = z
   .object({
     resolution: qualityResolutionSchema,
-    maxFramerate: z.number().int().min(15).max(60),
-    maxBitrate: z.number().int().min(2_000_000).max(12_000_000),
+    maxFramerate: z.number().positive().max(Number.MAX_SAFE_INTEGER),
+    maxBitrate: positiveUint32Schema,
     degradationPreference: degradationPreferenceSchema,
     maxAudioBitrate: maxAudioBitrateSchema.optional(),
   })
@@ -227,7 +229,6 @@ export const DEFAULT_ROUTE_POLICY = {
 } as const satisfies RoutePolicy;
 
 export const runtimeCapabilitiesSchema = z.object({
-  connectionAttemptProgress4: z.boolean().optional(),
   sfu: z.boolean().default(false),
   sfuOnly: z.boolean().optional(),
   natPrediction: z.boolean().default(false),
@@ -345,12 +346,12 @@ export const sfuMediaSchema = z.object({
   codec: z.enum(["h264", "vp8"]),
   layers: z.array(z.object({
     rid: z.string().max(16),
-    width: z.number().int().min(1).max(8192),
-    height: z.number().int().min(1).max(8192),
-    bitrate: z.number().int().min(1).max(100_000_000),
+    width: positiveUint32Schema,
+    height: positiveUint32Schema,
+    bitrate: positiveUint32Schema,
   }).strict()).min(1).max(3),
   audio: z.boolean(),
-  audioBitrate: z.number().int().min(0).max(510_000),
+  audioBitrate: z.number().int().min(0).max(MAX_AUDIO_BITRATE),
 }).strict().refine((media) =>
   (!media.audio || media.audioBitrate > 0) &&
   new Set(media.layers.map((layer) => layer.rid)).size === media.layers.length &&
@@ -385,8 +386,8 @@ export const preparedRouteCandidateSchema = z
     transport: z.enum(["direct", "sfu"]),
     qualityProbe: z.boolean(),
     connectionAttempt: z.object({
-      current: z.number().int().min(1).max(4),
-      total: z.union([z.literal(3), z.literal(4)]),
+      current: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+      total: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
     }).strict().refine(({ current, total }) => current <= total).optional(),
   })
   .strict();
@@ -602,17 +603,14 @@ const nullableEvidenceNumber = (maximum: number) =>
 const nullableSignedEvidenceNumber = (absoluteMaximum: number) =>
   z.number().finite().min(-absoluteMaximum).max(absoluteMaximum).nullable();
 
-const nullableEvidenceInteger = (maximum: number) =>
-  z.number().int().min(0).max(maximum).nullable();
-
-const nullableSafeEvidenceNumber = z
+export const nullableSafeEvidenceNumber = z
   .number()
   .finite()
   .min(0)
   .max(Number.MAX_SAFE_INTEGER)
   .nullable();
 
-const nullableSafeEvidenceInteger = z
+export const nullableSafeEvidenceInteger = z
   .number()
   .int()
   .min(0)
@@ -622,17 +620,17 @@ const nullableSafeEvidenceInteger = z
 export const viewerQualityEvidenceMetricsSchema = z
   .object({
     natTraversalPath: z.enum(NAT_TRAVERSAL_PATHS),
-    width: z.number().int().min(1).max(16_384).nullable(),
-    height: z.number().int().min(1).max(16_384).nullable(),
-    framesPerSecond: nullableEvidenceNumber(240),
-    bitrateKbps: nullableEvidenceNumber(100_000),
-    packetsReceivedDelta: nullableEvidenceInteger(1_000_000),
-    packetsLostDelta: nullableEvidenceInteger(1_000_000),
-    rttMs: nullableEvidenceNumber(60_000),
-    jitterMs: nullableEvidenceNumber(60_000),
-    framesDecodedDelta: nullableEvidenceInteger(10_000),
-    framesDroppedDelta: nullableEvidenceInteger(10_000),
-    decodeMsPerFrame: nullableEvidenceNumber(60_000),
+    width: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER).nullable(),
+    height: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER).nullable(),
+    framesPerSecond: nullableSafeEvidenceNumber,
+    bitrateKbps: nullableSafeEvidenceNumber,
+    packetsReceivedDelta: nullableSafeEvidenceInteger,
+    packetsLostDelta: nullableSafeEvidenceInteger,
+    rttMs: nullableSafeEvidenceNumber,
+    jitterMs: nullableSafeEvidenceNumber,
+    framesDecodedDelta: nullableSafeEvidenceInteger,
+    framesDroppedDelta: nullableSafeEvidenceInteger,
+    decodeMsPerFrame: nullableSafeEvidenceNumber,
     freezeCountDelta: nullableSafeEvidenceInteger,
     freezeDurationMsDelta: nullableSafeEvidenceNumber,
     pauseCountDelta: nullableSafeEvidenceInteger,
@@ -652,14 +650,14 @@ export const viewerQualityEvidenceMetricsSchema = z
       .max(128)
       .regex(/^[a-z0-9-]+=[a-z0-9]+(?:; [a-z0-9-]+=[a-z0-9]+)*$/)
       .nullable(),
-    audioBitrateKbps: nullableEvidenceNumber(10_000),
+    audioBitrateKbps: nullableSafeEvidenceNumber,
     audioPacketLossPercent: nullableEvidenceNumber(100),
-    audioJitterMs: nullableEvidenceNumber(60_000),
-    audioVideoPlayoutDeltaMs: nullableSignedEvidenceNumber(60_000),
-    videoJitterBufferDelayMs: nullableEvidenceNumber(60_000),
-    audioJitterBufferDelayMs: nullableEvidenceNumber(60_000),
+    audioJitterMs: nullableSafeEvidenceNumber,
+    audioVideoPlayoutDeltaMs: nullableSignedEvidenceNumber(Number.MAX_SAFE_INTEGER),
+    videoJitterBufferDelayMs: nullableSafeEvidenceNumber,
+    audioJitterBufferDelayMs: nullableSafeEvidenceNumber,
     audioConcealedSamplesPercent: nullableEvidenceNumber(100),
-    audioConcealmentEventsDelta: nullableEvidenceInteger(10_000),
+    audioConcealmentEventsDelta: nullableSafeEvidenceInteger,
     audioCodec: z
       .string()
       .max(64)
@@ -703,20 +701,16 @@ const senderQualityDiagnosticsSchema = z
   .object({
     natTraversalPath: z.enum(NAT_TRAVERSAL_PATHS),
     reason: z.enum(["none", "bandwidth", "cpu"]).nullable(),
-    framesPerSecond: nullableEvidenceNumber(240),
-    bitrateKbps: nullableEvidenceNumber(100_000),
-    captureFramesPerSecond: nullableEvidenceNumber(240).optional(),
-    mediaSourceFramesPerSecond: nullableEvidenceNumber(240).optional(),
-    width: nullableEvidenceInteger(16_384).optional(),
-    height: nullableEvidenceInteger(16_384).optional(),
-    videoEncodingCount: nullableEvidenceInteger(
-      Number.MAX_SAFE_INTEGER,
-    ).optional(),
-    activeVideoEncodingCount: nullableEvidenceInteger(
-      Number.MAX_SAFE_INTEGER,
-    ).optional(),
-    availableOutgoingKbps: nullableEvidenceNumber(100_000).optional(),
-    rttMs: nullableEvidenceNumber(60_000).optional(),
+    framesPerSecond: nullableSafeEvidenceNumber,
+    bitrateKbps: nullableSafeEvidenceNumber,
+    captureFramesPerSecond: nullableSafeEvidenceNumber.optional(),
+    mediaSourceFramesPerSecond: nullableSafeEvidenceNumber.optional(),
+    width: nullableSafeEvidenceInteger.optional(),
+    height: nullableSafeEvidenceInteger.optional(),
+    videoEncodingCount: nullableSafeEvidenceInteger.optional(),
+    activeVideoEncodingCount: nullableSafeEvidenceInteger.optional(),
+    availableOutgoingKbps: nullableSafeEvidenceNumber.optional(),
+    rttMs: nullableSafeEvidenceNumber.optional(),
     packetLossPercent: nullableEvidenceNumber(100).optional(),
   })
   .strict();
@@ -831,7 +825,6 @@ const authenticateMessageSchema = z.discriminatedUnion("role", [
       qualitySettings: qualitySettingsSchema.optional(),
       routePolicy: routePolicySchema.default(DEFAULT_ROUTE_POLICY),
       viewerPresence: z.literal(true).optional(),
-      connectionAttemptProgress4: z.literal(true).optional(),
       displayName: displayNameSchema.optional(),
     })
     .strict()
@@ -855,7 +848,6 @@ const authenticateMessageSchema = z.discriminatedUnion("role", [
       viewerPassword: viewerPasswordSchema.optional(),
       displayName: displayNameSchema.optional(),
       viewerPresence: z.literal(true).optional(),
-      connectionAttemptProgress4: z.literal(true).optional(),
     })
     .strict(),
 ]);
diff --git a/src/shared/quality-evidence.ts b/src/shared/quality-evidence.ts
new file mode 100644
index 000000000..bb7962e4a
--- /dev/null
+++ b/src/shared/quality-evidence.ts
@@ -0,0 +1,13 @@
+// Observations do not allocate media resources. Preserve representable values;
+// unavailable or invalid measurements stay null, never clamped into false facts.
+export function boundedNumber(value: number | null, maximum = Number.MAX_SAFE_INTEGER): number | null {
+  return value !== null && Number.isFinite(value) && value >= 0 && value <= maximum ? value : null;
+}
+
+export function boundedInteger(value: number | null, maximum = Number.MAX_SAFE_INTEGER): number | null {
+  return value !== null && Number.isSafeInteger(value) && value >= 0 && value <= maximum ? value : null;
+}
+
+export function boundedSignedNumber(value: number | null, maximum = Number.MAX_SAFE_INTEGER): number | null {
+  return value !== null && Number.isFinite(value) && Math.abs(value) <= maximum ? value : null;
+}
diff --git a/tests/client-state.test.ts b/tests/client-state.test.ts
index 7c9e2b1fa..0b05b1e9e 100644
--- a/tests/client-state.test.ts
+++ b/tests/client-state.test.ts
@@ -12,7 +12,6 @@ import {
   authenticateSiteAccess,
   createRoom,
   getSiteAccess,
-  getOptionalRuntimeCapabilities,
   replaceOwnedRoom,
   updateRoomAccess,
 } from "../src/client/lib/api.ts";
@@ -65,34 +64,6 @@ afterEach(() => {
   setCopy({ lang: "zh", vis: false });
 });
 
-describe("optional Viewer capability discovery", () => {
-  it("returns supported progress and tolerates an unavailable or malformed descriptor", async () => {
-    for (const [body, status, expected] of [
-      [{ connectionAttemptProgress4: true }, 200, true],
-      [{}, 200, undefined],
-      [{}, 503, undefined],
-      [{ connectionAttemptProgress4: 4 }, 200, undefined],
-    ] as const) {
-      vi.stubGlobal("fetch", vi.fn().mockResolvedValue(new Response(JSON.stringify(body), { status })));
-      expect((await getOptionalRuntimeCapabilities())?.connectionAttemptProgress4).toBe(expected);
-    }
-  });
-
-  it("abandons stalled discovery without preventing viewing", async () => {
-    vi.useFakeTimers();
-    let observed: AbortSignal | undefined;
-    vi.stubGlobal("fetch", vi.fn((_url: string, options: RequestInit) => new Promise((_resolve, reject) => {
-      observed = options.signal!;
-      observed.addEventListener("abort", () => reject(new DOMException("Aborted", "AbortError")));
-    })));
-    const discovery = getOptionalRuntimeCapabilities();
-    await vi.advanceTimersByTimeAsync(2_000);
-    await expect(discovery).resolves.toBeNull();
-    expect(observed?.aborted).toBe(true);
-    expect(vi.getTimerCount()).toBe(0);
-  });
-});
-
 function routeAuthenticated(
   shareGeneration: string | null = null,
   qualitySettings: QualitySettings = DEFAULT_QUALITY_SETTINGS,
diff --git a/tests/fixtures/wire-samples.json b/tests/fixtures/wire-samples.json
index 62ca26220..6ab72a219 100644
--- a/tests/fixtures/wire-samples.json
+++ b/tests/fixtures/wire-samples.json
@@ -299,7 +299,7 @@
       "name": "set-quality-settings-framerate-below-floor",
       "schema": "client",
       "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":14,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\"}}",
-      "valid": false
+      "valid": true
     },
     {
       "name": "set-quality-settings-fractional-bitrate",
@@ -1157,25 +1157,25 @@
       "name": "set-quality-settings-too-wide",
       "schema": "client",
       "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":8194,\"height\":1080},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":128000}}",
-      "valid": false
+      "valid": true
     },
     {
       "name": "set-quality-settings-too-tall",
       "schema": "client",
       "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":8194},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":128000}}",
-      "valid": false
+      "valid": true
     },
     {
       "name": "set-quality-settings-too-small",
       "schema": "client",
       "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":2,\"height\":1080},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":128000}}",
-      "valid": false
+      "valid": true
     },
     {
       "name": "set-quality-settings-odd-size",
       "schema": "client",
       "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1919,\"height\":1080},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":128000}}",
-      "valid": false
+      "valid": true
     },
     {
       "name": "set-quality-settings-fractional-size",
@@ -1200,6 +1200,84 @@
       "schema": "client",
       "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080,\"label\":\"1080p\"},\"maxFramerate\":30,\"maxBitrate\":5000000,\"degradationPreference\":\"balanced\",\"maxAudioBitrate\":128000}}",
       "valid": false
+    },
+    {
+      "name": "set-quality-settings-higher-rate",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":120,\"maxBitrate\":40000000,\"degradationPreference\":\"maintain-resolution\"}}",
+      "valid": true
+    },
+    {
+      "name": "set-quality-settings-fractional-framerate",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":29.97,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\"}}",
+      "valid": true
+    },
+    {
+      "name": "set-quality-settings-zero-framerate",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":0,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\"}}",
+      "valid": false
+    },
+    {
+      "name": "set-quality-settings-unrepresentable-bitrate",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":1920,\"height\":1080},\"maxFramerate\":60,\"maxBitrate\":4294967296,\"degradationPreference\":\"maintain-resolution\"}}",
+      "valid": false
+    },
+    {
+      "name": "set-quality-settings-unrepresentable-size",
+      "schema": "client",
+      "json": "{\"type\":\"set-quality-settings\",\"qualitySettings\":{\"resolution\":{\"width\":4294967296,\"height\":1080},\"maxFramerate\":60,\"maxBitrate\":8000000,\"degradationPreference\":\"maintain-resolution\"}}",
+      "valid": false
+    },
+    {
+      "name": "sender-quality-evidence-high-observations",
+      "schema": "client",
+      "json": "{\"type\":\"sender-quality-evidence\",\"childPeerId\":\"viewer_12345678\",\"connectionId\":\"connection_12345678\",\"rtpStatsId\":\"rtp-stats-1\",\"trackIdentifier\":\"track-1\",\"sampleTimestampMs\":2000,\"routeRevision\":3,\"state\":\"degraded\",\"diagnostics\":{\"natTraversalPath\":\"ordinary\",\"reason\":\"bandwidth\",\"framesPerSecond\":480,\"bitrateKbps\":200000,\"rttMs\":70000,\"width\":32768,\"height\":32768,\"availableOutgoingKbps\":1000000}}",
+      "valid": true
+    },
+    {
+      "name": "sender-quality-evidence-unrepresentable-observation",
+      "schema": "client",
+      "json": "{\"type\":\"sender-quality-evidence\",\"childPeerId\":\"viewer_12345678\",\"connectionId\":\"connection_12345678\",\"rtpStatsId\":\"rtp-stats-1\",\"trackIdentifier\":\"track-1\",\"sampleTimestampMs\":2000,\"routeRevision\":3,\"state\":\"degraded\",\"diagnostics\":{\"natTraversalPath\":\"ordinary\",\"reason\":\"bandwidth\",\"framesPerSecond\":480,\"bitrateKbps\":9007199254740992,\"rttMs\":70000,\"width\":32768,\"height\":32768,\"availableOutgoingKbps\":1000000}}",
+      "valid": false
+    },
+    {
+      "name": "sfu-publisher-quality-evidence-high-observations",
+      "schema": "client",
+      "json": "{\"type\":\"sfu-publisher-quality-evidence\",\"publicationGeneration\":\"publication_generation_12345678\",\"routeRevision\":4,\"state\":\"healthy\",\"sampleTimestampMs\":2000,\"diagnostics\":{\"natTraversalPath\":\"ordinary\",\"reason\":\"none\",\"framesPerSecond\":480,\"bitrateKbps\":200000,\"captureFramesPerSecond\":30,\"mediaSourceFramesPerSecond\":null,\"width\":32768,\"height\":32768,\"videoEncodingCount\":1,\"activeVideoEncodingCount\":1,\"availableOutgoingKbps\":1000000,\"rttMs\":70000,\"packetLossPercent\":0.1}}",
+      "valid": true
+    },
+    {
+      "name": "sfu-publisher-quality-evidence-unrepresentable-observation",
+      "schema": "client",
+      "json": "{\"type\":\"sfu-publisher-quality-evidence\",\"publicationGeneration\":\"publication_generation_12345678\",\"routeRevision\":4,\"state\":\"healthy\",\"sampleTimestampMs\":2000,\"diagnostics\":{\"natTraversalPath\":\"ordinary\",\"reason\":\"none\",\"framesPerSecond\":480,\"bitrateKbps\":9007199254740992,\"captureFramesPerSecond\":30,\"mediaSourceFramesPerSecond\":null,\"width\":32768,\"height\":32768,\"videoEncodingCount\":1,\"activeVideoEncodingCount\":1,\"availableOutgoingKbps\":1000000,\"rttMs\":70000,\"packetLossPercent\":0.1}}",
+      "valid": false
+    },
+    {
+      "name": "viewer-quality-evidence-high-observations",
+      "schema": "client",
+      "json": "{\"type\":\"viewer-quality-evidence\",\"guard\":{\"connectionId\":\"connection_12345678\",\"routeRevision\":0,\"presentationEpoch\":0},\"sequence\":0,\"windowMs\":2000,\"metrics\":{\"natTraversalPath\":\"ordinary\",\"width\":32768,\"height\":32768,\"framesPerSecond\":480,\"bitrateKbps\":200000,\"packetsReceivedDelta\":1500,\"packetsLostDelta\":2,\"rttMs\":70000,\"jitterMs\":3.5,\"framesDecodedDelta\":120,\"framesDroppedDelta\":1,\"decodeMsPerFrame\":2.4,\"freezeCountDelta\":0,\"freezeDurationMsDelta\":0,\"pauseCountDelta\":0,\"pauseDurationMsDelta\":0,\"codec\":\"video/H264\",\"codecProfile\":\"profile-level-id=42e01f\",\"codecParameters\":\"packetization-mode=1; level-asymmetry-allowed=1\",\"audioBitrateKbps\":20000,\"audioPacketLossPercent\":0.2,\"audioJitterMs\":2.5,\"audioVideoPlayoutDeltaMs\":-70000,\"videoJitterBufferDelayMs\":24,\"audioJitterBufferDelayMs\":18,\"audioConcealedSamplesPercent\":1,\"audioConcealmentEventsDelta\":3,\"audioCodec\":\"audio/opus\"}}",
+      "valid": true
+    },
+    {
+      "name": "viewer-quality-evidence-unrepresentable-observation",
+      "schema": "client",
+      "json": "{\"type\":\"viewer-quality-evidence\",\"guard\":{\"connectionId\":\"connection_12345678\",\"routeRevision\":0,\"presentationEpoch\":0},\"sequence\":0,\"windowMs\":2000,\"metrics\":{\"natTraversalPath\":\"ordinary\",\"width\":32768,\"height\":32768,\"framesPerSecond\":480,\"bitrateKbps\":9007199254740992,\"packetsReceivedDelta\":1500,\"packetsLostDelta\":2,\"rttMs\":70000,\"jitterMs\":3.5,\"framesDecodedDelta\":120,\"framesDroppedDelta\":1,\"decodeMsPerFrame\":2.4,\"freezeCountDelta\":0,\"freezeDurationMsDelta\":0,\"pauseCountDelta\":0,\"pauseDurationMsDelta\":0,\"codec\":\"video/H264\",\"codecProfile\":\"profile-level-id=42e01f\",\"codecParameters\":\"packetization-mode=1; level-asymmetry-allowed=1\",\"audioBitrateKbps\":20000,\"audioPacketLossPercent\":0.2,\"audioJitterMs\":2.5,\"audioVideoPlayoutDeltaMs\":-70000,\"videoJitterBufferDelayMs\":24,\"audioJitterBufferDelayMs\":18,\"audioConcealedSamplesPercent\":1,\"audioConcealmentEventsDelta\":3,\"audioCodec\":\"audio/opus\"}}",
+      "valid": false
+    },
+    {
+      "name": "sfu-numeric-description-above-implementation",
+      "schema": "client",
+      "json": "{\"type\":\"sfu-signal\",\"revision\":9,\"publicationGeneration\":\"publication_12345678\",\"connectionId\":\"connection_12345678\",\"kind\":\"description\",\"description\":{\"type\":\"offer\",\"sdp\":\"v=0\\\\r\\\\n\"},\"media\":{\"codec\":\"vp8\",\"layers\":[{\"rid\":\"\",\"width\":32768,\"height\":32768,\"bitrate\":200000000}],\"audio\":false,\"audioBitrate\":128000}}",
+      "valid": true
+    },
+    {
+      "name": "sfu-unrepresentable-description",
+      "schema": "client",
+      "json": "{\"type\":\"sfu-signal\",\"revision\":9,\"publicationGeneration\":\"publication_12345678\",\"connectionId\":\"connection_12345678\",\"kind\":\"description\",\"description\":{\"type\":\"offer\",\"sdp\":\"v=0\\\\r\\\\n\"},\"media\":{\"codec\":\"vp8\",\"layers\":[{\"rid\":\"\",\"width\":4294967296,\"height\":32768,\"bitrate\":200000000}],\"audio\":false,\"audioBitrate\":128000}}",
+      "valid": false
     }
   ],
   "serverMessages": [
diff --git a/tests/host-quality-ownership.test.ts b/tests/host-quality-ownership.test.ts
index b800a096a..cc8f92838 100644
--- a/tests/host-quality-ownership.test.ts
+++ b/tests/host-quality-ownership.test.ts
@@ -4,7 +4,7 @@ import ts from "typescript";
 import { describe, expect, it, vi } from "vitest";
 import {
   QUALITY_PROFILES, qualitySettingsEqual, qualitySettingsLabel, qualityResolutionEqual,
-  screenAudioBitrate, videoQualitySettingsEqual,
+  screenAudioBitrate, videoQualitySettingsEqual, supportsCaptureProfile, videoCaptureLimits, MAX_SCREEN_AUDIO_BITRATE,
   type QualitySettings,
 } from "../src/client/media/quality";
 import { NativeSenderPeer } from "../src/client/native/native-sender-peer";
@@ -109,6 +109,7 @@ function fixture(launchedByClient = true) {
     applyCaptureProfile: vi.fn(async (_stream: unknown, profile: QualitySettings) => { physical = profile; }),
     captureDetails: () => ({}),
     qualitySettingsEqual, qualityResolutionEqual, videoQualitySettingsEqual, screenAudioBitrate, qualitySettingsLabel,
+    supportsCaptureProfile, videoLimits: videoCaptureLimits(), audioBitrateCeiling: MAX_SCREEN_AUDIO_BITRATE,
     say: (key: string) => key, syncHostSfuQualityWarning: () => null,
     NativeSenderPeer, discardPreparedHostChild: vi.fn(), removePeer: vi.fn(), startPeer: vi.fn(async () => undefined),
     nativePreviewTailRef: ref(Promise.resolve()), setSwitchingSource: vi.fn(),
@@ -225,7 +226,6 @@ describe("Host room ownership", () => {
     current.generationRef.current = 1;
     Object.assign(current.context, {
       SignalingClient: Signal, hostRoomSessionAvailable: true, roomInteractionsAvailable: true,
-      connectionAttemptProgress4:true,
       visRef: ref(false), hostClientIdRef: ref(null), displayNameRef: ref("Host"),
       getStableClientId: () => "host-client", defaultHostDisplayName: () => "Host", readDisplayName: () => "Host",
       setDisplayName: vi.fn(), setDisplayNameDraft: vi.fn(), setDisplayNameError: vi.fn(),
@@ -426,6 +426,27 @@ describe("Host room-link copy feedback", () => {
 });
 
 describe("Host quality ownership", () => {
+  it("rejects unsupported settings without changing capture, room or saved intent", async () => {
+    const current = fixture();
+    await current.change({ ...original, maxFramerate: 120, maxBitrate: 40_000_000 });
+    expect(current.qualitySettingsRef.current).toEqual(original);
+    expect(current.applyCaptureProfile).not.toHaveBeenCalled();
+    expect(current.signalRef.current.setHostQualitySettings).not.toHaveBeenCalled();
+    expect(current.context.savePreferredQuality).not.toHaveBeenCalled();
+    expect(current.advancedQualityRef.current).toEqual(original);
+  });
+
+  it("ignores an unsupported App preference without erasing it", async () => {
+    const current = fixture();
+    current.activeGenerationRef.current = null;
+    const preference = { read: vi.fn(async () => ({ ...original, maxFramerate: 120 })), save: vi.fn() };
+    current.context.AppQualityPreference = { connect: vi.fn(async () => preference) };
+    await current.context.loadAppQualityPreference(new AbortController().signal);
+    expect(current.qualitySettingsRef.current).toEqual(original);
+    expect(preference.save).not.toHaveBeenCalled();
+    expect(current.NativeClient.connect).not.toHaveBeenCalled();
+  });
+
   it("restores App preferences without acquiring media or changing a room", async () => {
     const current = fixture();
     current.activeGenerationRef.current = null;
diff --git a/tests/native-client.test.ts b/tests/native-client.test.ts
index 180f776c5..35299606d 100644
--- a/tests/native-client.test.ts
+++ b/tests/native-client.test.ts
@@ -35,6 +35,10 @@ describe("native App private wire", () => {
     const nativeMedia = { ...health.nativeMedia, maxVideoResolution: { width: 3840, height: 3840 },
       maxVideoPixels: 3840 * 2160, maxVideoMacroblocksPerSecond: 983_040 };
     expect(nativeHealthSchema.parse({ ...health, nativeMedia }).nativeMedia).toMatchObject(nativeMedia);
+    const stronger = { ...nativeMedia, maxVideoResolution: { width: 32768, height: 32768 },
+      maxVideoPixels: 32768 ** 2, maxVideoFramerate: 120, maxVideoBitrate: 100_000_000,
+      maxAudioBitrate: 960_000 };
+    expect(nativeHealthSchema.parse({ ...health, nativeMedia: stronger }).nativeMedia).toMatchObject(stronger);
     expect(nativeHealthSchema.safeParse({ ...health, nativeMedia: { ...nativeMedia, maxVideoPixels: 0 } }).success).toBe(false);
     expect(nativeHealthSchema.safeParse({ ...health, nativeMedia: { ...nativeMedia, maxVideoMacroblocksPerSecond: -1 } }).success).toBe(false);
   });
@@ -808,4 +812,47 @@ describe("native App private wire", () => {
       }).success,
     ).toBe(true);
   });
+
+  it.each(["edge-quality", "publication-quality"] as const)("isolates %s observations from control lifetime", async (type) => {
+    class Socket extends EventTarget {
+      static readonly OPEN = 1;
+      static readonly CLOSING = 2;
+      static latest: Socket;
+      readyState = Socket.OPEN;
+      protocol = `piik-client-v10.${health.instanceToken}`;
+      close = vi.fn(() => { this.readyState = Socket.CLOSING; this.dispatchEvent(new Event("close")); });
+      constructor() { super(); Socket.latest = this; queueMicrotask(() => this.dispatchEvent(new Event("open"))); }
+      emit(value: unknown) { this.dispatchEvent(new MessageEvent("message", { data: JSON.stringify(value) })); }
+      send(payload: string) {
+        const request = JSON.parse(payload);
+        this.emit({ version: 10, id: request.id, type: request.type === "hello" ? "ready" : "pong" });
+      }
+    }
+    vi.stubGlobal("WebSocket", Socket);
+    vi.stubGlobal("window", { setTimeout, clearTimeout });
+    vi.stubGlobal("fetch", vi.fn(async () => Response.json(health)));
+    const client = (await NativeClient.connect())!;
+    const received = vi.fn();
+    client.onEvent(received);
+    const event = { version: 10, type, shareId: "share_123456", connectionId: "connection_123456",
+      sampleTimestampMs: 10_000, sampleWindowMs: 2_000, rtpStatsId: "rtp-1", trackIdentifier: "screen",
+      state: "healthy", reason: "none", framesPerSecond: 480, bitrateKbps: 120_000,
+      availableOutgoingKbps: 1_000_000, width: 1920, height: 1080,
+      ...(type === "edge-quality" ? { intervalFramesEncoded: 60 } : {
+        publicationGeneration: "publication_123456", codec: "vp8", videoEncodingCount: 2,
+        activeVideoEncodingCount: 2, rid: "h", intervalFramesSent: 60, audioBitrateKbps: 192,
+      }),
+    };
+    Socket.latest.emit(event);
+    expect(received).toHaveBeenLastCalledWith(event);
+    Socket.latest.emit({ ...event, framesPerSecond: -1, availableOutgoingKbps: "invalid" });
+    expect(received).toHaveBeenLastCalledWith({ ...event, framesPerSecond: null, availableOutgoingKbps: null });
+    // Invalid identity/state never becomes evidence, but cannot retire media.
+    Socket.latest.emit({ ...event, shareId: "bad", state: "degraded", reason: "none" });
+    expect(received).toHaveBeenCalledTimes(2);
+    await expect(client.ping()).resolves.toBeUndefined();
+    expect(Socket.latest.close).not.toHaveBeenCalled();
+    Socket.latest.emit({ version: 10, type: "edge-state", shareId: "bad" });
+    expect(Socket.latest.close).toHaveBeenCalledWith(1008, "invalid Client message");
+  });
 });
diff --git a/tests/protocol.test.ts b/tests/protocol.test.ts
index 3cbf4f307..516301079 100644
--- a/tests/protocol.test.ts
+++ b/tests/protocol.test.ts
@@ -51,17 +51,6 @@ const qualitySettings = {
 } as const;
 
 describe("runtime capabilities", () => {
-  it("keeps progress opt-in optional and strict for either signaling role", () => {
-    for (const role of ["host", "viewer"] as const) {
-      const identity = { type: "authenticate", protocol: SIGNALING_PROTOCOL, roomId,
-        clientId: "client_12345678", role, ...(role === "host" ? { token } : {}) };
-      expect(clientMessageSchema.safeParse(identity).success).toBe(true);
-      for (const connectionAttemptProgress4 of [true, false, null, 4, "true"]) {
-        expect(clientMessageSchema.safeParse({ ...identity, connectionAttemptProgress4 }).success)
-          .toBe(connectionAttemptProgress4 === true);
-      }
-    }
-  });
   it("defaults missing capabilities off and ignores unknown descriptors", () => {
     expect(runtimeCapabilitiesSchema.parse({})).toEqual({ sfu: false, natPrediction: false, roomInteractions: false, hostRoomSession: false });
     expect(runtimeCapabilitiesSchema.parse({ sfu: true, extra: { enabled: true } }))
@@ -70,8 +59,6 @@ describe("runtime capabilities", () => {
       .toEqual({ sfu: false, natPrediction: true, roomInteractions: false, hostRoomSession: false });
     expect(runtimeCapabilitiesSchema.parse({ sfu: true, natPrediction: true }))
       .toEqual({ sfu: true, natPrediction: true, roomInteractions: false, hostRoomSession: false });
-    expect(runtimeCapabilitiesSchema.parse({ connectionAttemptProgress4: true }))
-      .toEqual({ sfu: false, natPrediction: false, connectionAttemptProgress4: true, roomInteractions: false, hostRoomSession: false });
     expect(runtimeCapabilitiesSchema.parse({ sfu: true, sfuOnly: true }).sfuOnly).toBe(true);
 
   });
@@ -79,7 +66,7 @@ describe("runtime capabilities", () => {
   it("rejects malformed known capabilities and non-object responses", () => {
     for (const value of [null, [], true, { sfu: null }, { sfu: "true" },
       { natPrediction: null }, { natPrediction: 1 }, { sfuOnly: null }, { sfuOnly: "true" },
-      { connectionAttemptProgress4: null }, { connectionAttemptProgress4: 4 }]) {
+    ]) {
       expect(runtimeCapabilitiesSchema.safeParse(value).success).toBe(false);
     }
   });
@@ -138,6 +125,23 @@ const qualityEvidence = {
 } as const;
 
 describe("client signaling protocol", () => {
+  it("keeps full observations with wide numeric values within the message budget", () => {
+    for (const floating of [Number.MAX_SAFE_INTEGER, 1.2345678901234567e-100]) {
+      const metrics = Object.fromEntries(Object.entries(qualityEvidence.metrics).map(([key, value]) => [key,
+        typeof value !== "number" ? value : key.endsWith("Percent") ? 99.99999999999999 :
+          ["width", "height", "packetsReceivedDelta", "packetsLostDelta", "framesDecodedDelta",
+            "framesDroppedDelta", "freezeCountDelta", "pauseCountDelta", "audioConcealmentEventsDelta"].includes(key)
+            ? Number.MAX_SAFE_INTEGER : floating,
+      ]));
+      const message = { ...qualityEvidence, sequence: Number.MAX_SAFE_INTEGER,
+        guard: { connectionId: "a".repeat(128), routeRevision: MAX_MEDIA_ROUTE_REVISION,
+          presentationEpoch: Number.MAX_SAFE_INTEGER },
+        metrics: { ...metrics, audioCodec: `audio/${"a".repeat(32)}` } };
+      expect(clientMessageSchema.safeParse(message).success).toBe(true);
+      expect(Buffer.byteLength(JSON.stringify(message))).toBeLessThanOrEqual(MAX_VIEWER_QUALITY_EVIDENCE_BYTES);
+    }
+  });
+
   it("uses the current strict signaling generation", () => {
     expect(SIGNALING_PROTOCOL).toBe("piik-v24");
   });
@@ -752,7 +756,7 @@ describe("client signaling protocol", () => {
     ).toBe(false);
   });
 
-  it("accepts only strict, bounded quality settings", () => {
+  it("separates numeric requests from capture implementation limits", () => {
     expect(DEFAULT_QUALITY_SETTINGS).not.toHaveProperty("videoCodec");
     expect(
       clientMessageSchema.safeParse({
@@ -782,13 +786,23 @@ describe("client signaling protocol", () => {
         }).success,
       ).toBe(true);
     }
-    for (const invalid of [
-      { ...qualitySettings, resolution: "2160p" },
+    for (const next of [
+      { ...qualitySettings, resolution: { width: 16384, height: 8192 } },
+      { ...qualitySettings, resolution: { width: 1921, height: 1081 } },
       { ...qualitySettings, maxFramerate: 14 },
       { ...qualitySettings, maxFramerate: 61 },
       { ...qualitySettings, maxFramerate: 30.5 },
       { ...qualitySettings, maxBitrate: 1_999_999 },
       { ...qualitySettings, maxBitrate: 12_000_001 },
+    ]) expect(clientMessageSchema.safeParse({ type: "set-quality-settings", qualitySettings: next }).success).toBe(true);
+    for (const invalid of [
+      { ...qualitySettings, resolution: "2160p" },
+      { ...qualitySettings, resolution: { width: 0x1_0000_0000, height: 1080 } },
+      { ...qualitySettings, maxFramerate: 0 },
+      { ...qualitySettings, maxFramerate: Infinity },
+      { ...qualitySettings, maxFramerate: Number.MAX_SAFE_INTEGER + 1 },
+      { ...qualitySettings, maxBitrate: 0 },
+      { ...qualitySettings, maxBitrate: 0x1_0000_0000 },
       { ...qualitySettings, maxBitrate: 5_000_000.5 },
       { ...qualitySettings, degradationPreference: "automatic" },
       legacyCodecQualitySettings,
@@ -1543,7 +1557,7 @@ describe("server signaling protocol", () => {
     expect(
       serverMessageSchema.safeParse({
         ...peerAssisted,
-        qualitySettings: { ...qualitySettings, maxBitrate: 20_000_000 },
+        qualitySettings: { ...qualitySettings, maxBitrate: 0x1_0000_0000 },
       }).success,
     ).toBe(false);
     const missingMode = {
@@ -1575,7 +1589,7 @@ describe("server signaling protocol", () => {
       childPeerId: "child_12345678", connectionId: "connection_12345678",
       transport: "direct", qualityProbe: false,
     };
-    for (const total of [3, 4]) {
+    for (const total of [1, 3, 4, 5, 20]) {
       for (let current = 1; current <= total; current++) {
         expect(preparedRouteCandidateSchema.safeParse({
           ...candidate, connectionAttempt: { current, total },
@@ -1584,7 +1598,7 @@ describe("server signaling protocol", () => {
     }
     for (const connectionAttempt of [
       { current: 0, total: 3 }, { current: 4, total: 3 },
-      { current: 5, total: 4 }, { current: 1, total: 5 }, { current: 1.5, total: 3 },
+      { current: 5, total: 4 }, { current: 1, total: 0 }, { current: 1, total: Number.MAX_SAFE_INTEGER + 1 }, { current: 1.5, total: 3 },
     ]) {
       expect(preparedRouteCandidateSchema.safeParse({
         ...candidate, connectionAttempt,
diff --git a/tests/quality-preference.test.ts b/tests/quality-preference.test.ts
index bc3c51e3e..1181b3751 100644
--- a/tests/quality-preference.test.ts
+++ b/tests/quality-preference.test.ts
@@ -33,4 +33,12 @@ describe("sharing quality preference", () => {
     expect(readPreferredQuality()).toEqual(DEFAULT_QUALITY_SETTINGS);
     expect(() => savePreferredQuality(DEFAULT_QUALITY_SETTINGS)).not.toThrow();
   });
+
+  it("uses supported defaults without overwriting a preference from a stronger implementation", () => {
+    const stored = JSON.stringify({ ...DEFAULT_QUALITY_SETTINGS, maxFramerate: 120, maxBitrate: 40_000_000 });
+    const setItem = vi.fn();
+    vi.stubGlobal("window", { localStorage: { getItem: () => stored, setItem } });
+    expect(readPreferredQuality()).toEqual(DEFAULT_QUALITY_SETTINGS);
+    expect(setItem).not.toHaveBeenCalled();
+  });
 });
diff --git a/tests/quality.test.ts b/tests/quality.test.ts
index b08fb7dd5..29dd21bf6 100644
--- a/tests/quality.test.ts
+++ b/tests/quality.test.ts
@@ -7,6 +7,7 @@ import {
   captureDisplay,
   captureFramerateCeiling,
   videoCaptureLimits,
+  supportsCaptureProfile,
   configureScreenAudioSender,
   configureVideoSender,
   matchingQualityProfileId,
@@ -68,7 +69,26 @@ describe("realtime quality controls", () => {
     expect(captureFramerateCeiling(QUALITY_RESOLUTIONS["1080p"], limited)).toBe(30);
     expect(captureFramerateCeiling(QUALITY_RESOLUTIONS["720p"], limited)).toBe(60);
     expect(videoCaptureLimits({ maxVideoResolution: { width: 8192, height: 8192 },
-      maxVideoPixels: 8192 * 8192, maxVideoMacroblocksPerSecond: 9_000_000 })).toEqual(videoCaptureLimits());
+      maxVideoPixels: 8192 * 8192, maxVideoMacroblocksPerSecond: 9_000_000,
+      maxVideoFramerate: 120, maxVideoBitrate: 40_000_000 })).toEqual(videoCaptureLimits());
+    const slower = videoCaptureLimits({ maxVideoFramerate: 30, maxVideoBitrate: 5_000_000 });
+    expect(supportsCaptureProfile(QUALITY_PROFILES["1080p30"], slower)).toBe(true);
+    expect(supportsCaptureProfile(QUALITY_PROFILES["1080p60"], slower)).toBe(false);
+  });
+
+  it("rejects unsupported requests before changing capture or asking for permission", async () => {
+    const { stream, videoTrack } = createVideoStream();
+    const getDisplayMedia = vi.fn(async () => stream);
+    vi.stubGlobal("navigator", { mediaDevices: { getDisplayMedia } });
+    for (const change of [{ maxFramerate: 120 }, { maxFramerate: 30.5 }, { maxBitrate: 40_000_000 },
+      { resolution: { width: 32768, height: 32768 } }, { maxAudioBitrate: 510_000 }]) {
+      const requested = { ...QUALITY_PROFILES["1080p30"], ...change };
+      expect(supportsCaptureProfile(requested)).toBe(false);
+      await expect(captureDisplay(requested)).rejects.toThrow("not supported");
+      await expect(applyCaptureProfile(stream, requested)).rejects.toThrow("not supported");
+    }
+    expect(getDisplayMedia).not.toHaveBeenCalled();
+    expect(videoTrack.applyConstraints).not.toHaveBeenCalled();
   });
 
   it("keeps exactly three recommended profiles with 1080p30 as the default", () => {
diff --git a/tests/sender-quality-evidence.test.ts b/tests/sender-quality-evidence.test.ts
index 541f95fa8..73b86cc18 100644
--- a/tests/sender-quality-evidence.test.ts
+++ b/tests/sender-quality-evidence.test.ts
@@ -38,6 +38,35 @@ function report(
 }
 
 describe("native sender quality evidence", () => {
+  it.each(["direct", "publication"])("preserves %s observations independently of control evidence", (path) => {
+    invalidateSenderQualityEvidence();
+    const metrics = {
+      ...EMPTY_METRICS, sampleTimestampMs: 1_000, sampleWindowMs: 2_000,
+      rtpStatsId: "outbound-1", trackIdentifier: "track-1", intervalFramesEncoded: 960,
+      nativeEdgeQualityState: "healthy" as const, qualityLimitationReason: "none",
+      availableOutgoingKbps: 1_000_000, bitrateKbps: 120_000, framesPerSecond: 480,
+      rttMs: NaN, packetLossPercent: 101,
+    };
+    const emit = () => path === "direct"
+      ? senderQualityEvidenceFromSnapshot({
+        peerId: "viewer_12345678", connectionId: "connection_12345678",
+        connectionState: "connected", iceConnectionState: "connected", error: null, metrics,
+      }, 2)
+      : sfuPublisherQualityEvidenceFromMetrics(metrics, 2, "publication_12345678");
+    expect(emit()?.state).toBe("unknown");
+    metrics.sampleTimestampMs += 2_000;
+    expect(emit()).toMatchObject({ state: "healthy", diagnostics: {
+      availableOutgoingKbps: 1_000_000, bitrateKbps: 120_000, framesPerSecond: 480,
+      rttMs: null, packetLossPercent: null,
+    } });
+    metrics.sampleTimestampMs += 2_000;
+    metrics.intervalFramesEncoded = NaN;
+    expect(emit()?.state).toBe("unknown");
+    metrics.intervalFramesEncoded = 960;
+    metrics.sampleTimestampMs += 2_000;
+    expect(emit()?.state).toBe("healthy");
+  });
+
   it("uses actual Native publication sent frames without inventing encoder work", () => {
     invalidateSenderQualityEvidence();
     const metrics = {
diff --git a/tests/viewer-quality-evidence.test.ts b/tests/viewer-quality-evidence.test.ts
index b0706d75e..a3f4cbe5e 100644
--- a/tests/viewer-quality-evidence.test.ts
+++ b/tests/viewer-quality-evidence.test.ts
@@ -270,12 +270,12 @@ describe("viewer quality evidence", () => {
       natTraversalPath: "predicted",
       width: null,
       height: null,
-      bitrateKbps: null,
+      bitrateKbps: 200_000,
       packetsLostDelta: null,
-      rttMs: null,
-      audioBitrateKbps: null,
+      rttMs: 70_000,
+      audioBitrateKbps: 20_000,
       audioPacketLossPercent: null,
-      audioVideoPlayoutDeltaMs: null,
+      audioVideoPlayoutDeltaMs: -70_000,
       audioCodec: null,
       codecParameters: null,
     });
@@ -287,6 +287,15 @@ describe("viewer quality evidence", () => {
     expect(JSON.stringify(bounded)).not.toContain("useinbandfec=1");
     expect(JSON.stringify(bounded)).not.toContain("192.0.2.10");
     expect(JSON.stringify(bounded)).not.toContain("203.0.113.20");
+    expect(qualityEvidenceWindowFromMetrics(receiveMetrics({
+      framesPerSecond: Infinity,
+      bitrateKbps: Number.MAX_SAFE_INTEGER + 1,
+      audioVideoPlayoutDeltaMs: NaN,
+      intervalFramesDecoded: 1.5,
+    }))?.metrics).toMatchObject({
+      framesPerSecond: null, bitrateKbps: null,
+      audioVideoPlayoutDeltaMs: null, framesDecodedDelta: null,
+    });
   });
 
   it("baselines each presentation epoch and keeps rate limits across it", () => {

From be80b3a5c6f4bd0744a2c916a23d4a5b1321112d Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 10:33:00 +0800
Subject: [PATCH 152/262] feat(media): admit 4K60 with automatic H264 levels

---
 docs/research/browser-screen-audio-quality.md |  7 +++
 docs/research/native-client-media.md          | 48 +++++++++++++------
 docs/standards/media-quality.md               | 18 +++++--
 docs/status.md                                |  2 +-
 docs/todo.md                                  | 20 +++++---
 internal/app/mediaedge/engine.go              |  2 +-
 internal/app/mediaedge/receiver.go            | 14 +-----
 internal/app/mediaedge/receiver_test.go       |  5 +-
 internal/app/mediaedge/relay_input.go         |  2 +-
 internal/app/mediaedge/relay_input_test.go    |  4 ++
 internal/app/nativecapture/protocol.go        | 21 ++++++--
 internal/app/nativecapture/protocol_test.go   |  6 ++-
 internal/app/nativecontrol/session_test.go    |  6 +--
 internal/app/nativehost/session.go            | 15 +-----
 internal/app/nativehost/session_test.go       |  4 +-
 native/capture/darwin/main.swift              |  7 +--
 native/capture/linux/main.c                   |  4 +-
 native/capture/windows/adaptive_encoder.cpp   |  2 +-
 native/capture/windows/h264_encoder.cpp       | 21 ++++----
 native/capture/windows/h264_encoder.h         | 20 +-------
 native/capture/windows/main.cpp               |  6 +--
 native/capture/windows/output_worker.test.cpp | 26 ++++++----
 native/capture/windows/video_bounds.h         |  4 +-
 scripts/app-native-host-gate.ts               |  2 +-
 scripts/encoded-group-decode.mjs              |  2 +-
 src/client/media/quality.ts                   |  4 +-
 src/client/native/native-viewer-peer.ts       |  2 +-
 tests/native-viewer-peer.test.ts              |  3 +-
 tests/quality.test.ts                         | 29 +++++++++--
 29 files changed, 185 insertions(+), 121 deletions(-)

diff --git a/docs/research/browser-screen-audio-quality.md b/docs/research/browser-screen-audio-quality.md
index 23cefb767..59cefb5e4 100644
--- a/docs/research/browser-screen-audio-quality.md
+++ b/docs/research/browser-screen-audio-quality.md
@@ -62,6 +62,13 @@ preset contract. Candidate numeric requests and supported limits are owned by
 [media quality](../standards/media-quality.md#screen-audio); these measurements
 do not establish audible improvement or accept a public release.
 
+For scope review on 2026-10-11, [RFC 7587](https://www.rfc-editor.org/rfc/rfc7587.html#section-3.1.1)
+recommends 64..128 kbps for fullband stereo music with 20 ms frames, and
+[LiveKit's high-quality stereo preset](https://github.com/livekit/client-sdk-js/blob/main/src/room/track/options.ts)
+uses 128 kbps. These support retaining the current default; they are neither
+codec maxima nor proof of quality for every source. Higher custom settings
+remain subject to the measured packet and receiver bounds below.
+
 The existing Go Opus encoder accepted live 128/192/256/320/96/128 kbps changes
 without replacement. A 48 kHz stereo tone/noise input continued decoding into
 960 samples per channel; the existing deterministic tests also verify stereo
diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 04152e8d2..c68e01a7d 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -592,27 +592,48 @@ App discovery advertises size, pixel-count, macroblock-rate, frame-rate and bitr
 size/rate combinations as operation failures without retiring the control
 session. Removing an enum is not permission to allocate arbitrary media resources.
 
-The Windows H.264 UI gate switches from 1080p60 to the 4K ceiling with the
-30 fps limit, then applies a non-preset 960x600 ceiling during the live share.
-It observes fitted output without replacing the Viewer media object. The
-captured window is smaller than 4K, so this verifies settings/lifecycle, not
-physical 4K capture.
+The Windows H.264 UI gate switches from 1080p60 to the 4K ceiling, then applies
+a non-preset 960x600 ceiling during the live share. Its earlier 30 fps run
+observed fitted output without replacing the Viewer media object. The gate now
+expects the 60 fps control and needs rerunning. The captured window is smaller
+than 4K, so this verifies settings/lifecycle, not physical 4K capture.
 Preset changes, paused updates, source recovery/replacement and subsequent
 sharing still pass. Value-based comparison prevents an identical deserialized
 size from turning an audio-only edit into a video update. Numeric preference
 round-trips and malformed/unsupported requests have separate boundary checks.
 
-Native bounds now admit 3840x2160 and 2160x3840 at 30 fps. The per-axis limit and
+Native bounds admit 3840x2160 and 2160x3840 at 60 fps. The per-axis limit and
 pixel total remain independent; an arbitrary 3840-square picture is rejected.
-The output throughput ceiling uses H.264 Level 5.1's macroblock rate, including
+The output throughput ceiling uses H.264 Level 5.2's macroblock rate, including
 alignment for non-preset sizes. Coded padding and decoded reference buffers have
 their own pre-allocation bounds, following [H.264 Table A-1](https://www.itu.int/rec/T-REC-H.264)
 (also implemented in [FFmpeg's level table](https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/h264_levels.c)).
-The Windows decoder's advertised support remains
-[Level 5.1](https://learn.microsoft.com/en-us/windows/win32/medfound/h-264-video-decoder).
-An isolated Level 5.2 trial was rejected by this machine's hardware encoder at
-output-type setup; it did not reach the decoder. The candidate therefore keeps
-Level 5.1 and rejects 4K60 before allocating an encoder.
+Level 5.2 raises throughput without raising Level 5.1's coded-frame or
+reference-picture storage bounds.
+
+A 2026-10-11 control corrected the earlier 4K30 conclusion: explicitly forcing
+Level 5.2 failed this hardware encoder's output-type setup, but leaving the
+level unset encoded the same 4K60 inputs as Constrained Baseline Level 5.2.
+[Microsoft recommends automatic level selection](https://learn.microsoft.com/en-us/windows/win32/medfound/h-264-video-encoder).
+The production configuration follows that advice and validates actual SPS tools
+and level through 5.2, retaining stable SPS identity and recovery-unit checks.
+Local Media Foundation hardware/software decode delivered all 60 frames in both
+4K orientations, with a passing 1080p60 control. Chrome also decoded all 60
+production-encoder frames per orientation; production H.264 and VP8 workers
+passed a 4K-to-1080p-to-4K source sequence at the 60 fps setting. The normal
+Go/native encoded-input path also derived lower outputs from these inputs.
+This disproves a blanket 4K30
+restriction; the combined encode/decode fixture does not establish sustained
+60 fps on every device. Microsoft's older decoder documentation lists
+[Level 5.1](https://learn.microsoft.com/en-us/windows/win32/medfound/h-264-video-decoder),
+so local success is not a cross-device guarantee.
+
+A separate Chrome 152 canvas/PeerConnection control decoded 3840x2160 near
+60 fps with both H.264 and VP8. Its H.264 SDP advertised Level 3.1, consistent
+with [WebRTC's built-in capability list](https://webrtc.googlesource.com/src/+/refs/heads/main/modules/video_coding/codecs/h264/h264.cc).
+That static label alone does not establish a device's observed limit. Piik does
+not add an independent quality ladder or infer universal decoder support from
+codec matching; limited receivers and real routes still need acceptance.
 
 Decoder format checks must distinguish storage from visible content. On
 2026-10-11, the Windows decoder rejected a valid 3840x2160 picture stored in a
@@ -829,8 +850,7 @@ including narrow screens, both themes and visual mode.
 
 Start with numeric audio through the existing pipeline, then portrait/ultrawide
 geometry and 4K as a second concrete use case. A 4K path must review all platform
-capture/decoder bounds, encoded-frame limits and SFU admission; Windows H.264's
-current level ceiling does not cover 4K60. Admission and output must be tested
+capture/decoder bounds, encoded-frame limits and SFU admission. Admission and output must be tested
 at the actual profile, not inferred from a codec list. Check live changes,
 late/limited Viewers and relays, failure cleanup and resource rejection before
 freezing the 2.0 contract. Prefer a clear 1.x mismatch over a general legacy
diff --git a/docs/standards/media-quality.md b/docs/standards/media-quality.md
index 75ddae3c6..e04f7d490 100644
--- a/docs/standards/media-quality.md
+++ b/docs/standards/media-quality.md
@@ -139,7 +139,9 @@ Larger wire-valid requests do not
 authorize an adapter to exceed its local capture, codec or allocation limits.
 Numeric requests use representational bounds rather than the current control
 ranges. Current capture still admits integer 15..60 fps and 2..12 Mbps, further
-limited by picture size. App descriptions may advertise stronger capabilities;
+limited by picture size. These are current product controls, not universal codec
+limits or a minimum for framework-driven output. Codec and resource budgets
+apply separately. App descriptions may advertise stronger capabilities;
 controls use their intersection with local support. An unsupported request is
 an operation failure, not malformed signaling. An unsupported saved preference
 does not seed capture or overwrite its stored value with a fallback.
@@ -149,6 +151,8 @@ maintain-framerate` retain their controls. Display video uses the standard
 Native H264 retains Constrained Baseline. Capture validates the coding-tool subset under
 RFC 6184, including equivalent Constrained Baseline constraint bytes, and reports
 the actual SPS profile/level; one vendor's byte spelling is not the contract.
+The platform encoder selects its level from the requested format. Validate the
+actual supported level instead of forcing a calculated minimum into the encoder.
 Native ingress and relay accept only a negotiated profile/packetization compatible
 with their unchanged encoded downstream source. A codec name alone is not enough;
 same-source renegotiation must preserve that boundary before altering the live peer.
@@ -159,8 +163,8 @@ large input.
 
 The candidate Native adapters admit even visible dimensions up to 3840 per
 axis and 3840x2160 total pixels. Their shared output-rate bound follows H.264
-Level 5.1: 983,040 16x16 macroblocks per second, with at most 60 fps. This admits
-landscape/portrait 4K30 and existing 1440p60, not 4K60. Decoder alignment has a
+Level 5.2: 2,073,600 16x16 macroblocks per second, with at most 60 fps. This admits
+landscape/portrait 4K60 and existing 1440p60. Decoder alignment has a
 separate coded-storage bound; reference-picture storage is bounded before
 Native derivation. These are admission limits, not a device performance promise.
 App discovery reports size, pixel-count, frame-rate and bitrate limits through the
@@ -378,6 +382,14 @@ application-defined whole-room lowest-common-denominator target.
 
 ## Screen Audio
 
+The candidate supports mono and stereo Opus content through the existing audio
+track. Mono inputs remain valid; Browser and Native mixing use a stereo output.
+A stereo receive preference or two-channel declaration does not prove distinct
+source channels. [Fidelity evidence](../research/media-fidelity.md#stereo) owns
+decoded-channel checks. Surround delivery is outside the candidate; it needs
+capture, channel-layout, mixing, codec and playback support, not only a channel
+count setting.
+
 Display audio uses `contentHint = "music"`. The 2.0 candidate keeps 64/128/192 kbps
 shortcuts and the 128 kbps default, with a custom numeric ceiling in the same
 sound settings. Current Browser/native senders support 6..320 kbps; the numeric
diff --git a/docs/status.md b/docs/status.md
index fe29483df..a277813b8 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -67,7 +67,7 @@ capture v7 and SQLite schema 2
 remain unchanged. Matched candidate App/Web/Server builds are required;
 1.x participants are rejected by the existing compatibility checks.
 Custom width/height controls apply combined size and frame-rate limits, admitting
-4K30. Windows and Linux output preserve source shape within the selected ceiling.
+4K60. Windows and Linux output preserve source shape within the selected ceiling.
 The [media assessment](./research/native-client-media.md#media-capability-extension-assessment)
 owns local codec, derived-output, SFU, Browser/Native fanout and live-control
 evidence. The macOS geometry implementation still needs SDK compilation and
diff --git a/docs/todo.md b/docs/todo.md
index bd4c8efa3..385dc8cd4 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -26,8 +26,9 @@ Git/PRs own completed history.
 - [ ] **Reconcile open PRs with the final candidate.**
   [#462](https://github.com/TNTcraftHIM/Piik/pull/462)'s 256/320 kbps request and
   [#469](https://github.com/TNTcraftHIM/Piik/pull/469)'s 4K request overlap the
-  numeric-media candidate; neither PR has been merged. The latter's 4K60 and
-  40 Mbps expansion needs separate evidence and is not accepted scope. Preserve
+  numeric-media candidate; neither PR has been merged. 4K60 is included in
+  candidate admission and still needs route/device acceptance; 40 Mbps needs
+  separate evidence and is not accepted scope. Preserve
   contributor credit and explain the disposition at integration. Rewrite
   [#459](https://github.com/TNTcraftHIM/Piik/pull/459)'s earlier maintenance scope
   and compatibility claims around the final 2.0 result before integration.
@@ -74,21 +75,26 @@ Implementation needs a concrete useful result within the product model.
   actual output. Numeric request, capability and observation boundaries are now
   separate from implementation admission. Keep receiver, codec/alignment and
   resource budgets intact; opening an output range still needs end-to-end evidence.
-  Assess higher audio output against packet-duration/size and receiver support;
-  removing the current 320 kbps sender guard alone is not sufficient. Numeric
-  audio and video controls are implemented; the assessment
+  Retain the current audio sender ceiling and bounded video controls; extending
+  their operating range needs a concrete use case and end-to-end evidence.
+  Numeric audio and video controls are implemented; the assessment
   owns local capture, codec, derived-output, SFU and bounded mixed-route evidence.
   Remaining receiver acceptance needs physical limited decoders and camera
   orientation behavior, beyond the bounded SDP-limit and mixed-route controls.
   Browser display capture, Browser relay and Browser-to-Native fanout now have
   bounded high-resolution evidence. macOS geometry SDK/hardware checks and
-  physical 4K/game capture remain open. Preserve safety limits and
+  physical 4K/game capture remain open. Repeat live Native-to-Browser, derived
+  relay and SFU checks at 4K60; local codec and Browser loopback success does not
+  establish sustained full-route performance. Preserve safety limits and
   framework-owned adaptation. The
   [audio controls](./research/browser-screen-audio-quality.md#numeric-bitrate-assessment)
   retain explicit receive-limit enforcement and the current 320 kbps sender
   ceiling. Physical listening, mobile and field-network acceptance remain open;
   research owns the bounded real-Opus impairment and video-recovery control.
-  Additional codecs are outside this candidate. Later inclusion needs complete
+  Validate the existing mono/stereo and Windows HDR-to-SDR paths under the
+  [fidelity boundary](./research/media-fidelity.md); surround delivery and
+  end-to-end HDR are outside this candidate. Additional codecs are also outside
+  this candidate. Later inclusion needs complete
   encode/decode/forward support and a late-Viewer policy;
   selecting a codec cannot transcode an existing publication. Final package
   acceptance must retain the verified live-change, relay/SFU and limited-receiver
diff --git a/internal/app/mediaedge/engine.go b/internal/app/mediaedge/engine.go
index 351494c96..1e93d988f 100644
--- a/internal/app/mediaedge/engine.go
+++ b/internal/app/mediaedge/engine.go
@@ -18,7 +18,7 @@ import (
 
 // Use the browser-standard spelling of Constrained Baseline in SDP. Pion's
 // codec ordering prefers literal profile matches over equivalent constraint bits.
-const H264ProfileLevelID = "42e033"
+const H264ProfileLevelID = "42e034"
 
 var h264Capability = webrtc.RTPCodecCapability{
 	MimeType:    webrtc.MimeTypeH264,
diff --git a/internal/app/mediaedge/receiver.go b/internal/app/mediaedge/receiver.go
index e9d01a30b..300972876 100644
--- a/internal/app/mediaedge/receiver.go
+++ b/internal/app/mediaedge/receiver.go
@@ -10,7 +10,7 @@ import (
 	"sync"
 
 	"github.com/TNTcraftHIM/Piik/internal/app/nativeaudio"
-	"github.com/TNTcraftHIM/Piik/internal/media/encoded"
+	"github.com/TNTcraftHIM/Piik/internal/app/nativecapture"
 	"github.com/pion/rtcp"
 	"github.com/pion/sdp/v3"
 	"github.com/pion/webrtc/v4"
@@ -465,15 +465,5 @@ func forwardableH264(fmtp string) bool {
 			packetization = strings.TrimSpace(value)
 		}
 	}
-	level, valid := encoded.H264ConstrainedBaselineLevel(profile)
-	if !valid || packetization != "1" {
-		return false
-	}
-	// Receiving may include smaller Browser encodes than native capture presets.
-	switch level {
-	case 10, 11, 12, 13, 20, 21, 22, 30, 31, 32, 40, 41, 42, 50, 51:
-		return true
-	default:
-		return false
-	}
+	return packetization == "1" && nativecapture.SupportedH264ProfileLevelID(profile)
 }
diff --git a/internal/app/mediaedge/receiver_test.go b/internal/app/mediaedge/receiver_test.go
index 46e3c0a5d..e5bc82613 100644
--- a/internal/app/mediaedge/receiver_test.go
+++ b/internal/app/mediaedge/receiver_test.go
@@ -180,8 +180,9 @@ func TestReceiverNegotiatesForwardableH264(t *testing.T) {
 		{"missing-profile", []string{""}, ""},
 		{"equivalent-baseline", []string{"42c01f"}, "42c01f"},
 		{"small-browser-output", []string{"42e00b"}, "42e00b"},
-		{"level-ceiling", []string{"42e033"}, "42e033"},
-		{"over-ceiling", []string{"42e034"}, ""},
+		{"level-5.1", []string{"42e033"}, "42e033"},
+		{"level-ceiling", []string{"42e034"}, "42e034"},
+		{"over-ceiling", []string{"42e03c"}, ""},
 		{"invalid-level", []string{"42e035"}, ""},
 		{"invalid-constraints", []string{"42e11f"}, ""},
 		{"mode-zero", []string{"42e01f;packetization-mode=0"}, ""},
diff --git a/internal/app/mediaedge/relay_input.go b/internal/app/mediaedge/relay_input.go
index a1c98dfe5..b9959c723 100644
--- a/internal/app/mediaedge/relay_input.go
+++ b/internal/app/mediaedge/relay_input.go
@@ -159,7 +159,7 @@ func relayH264Size(nal []byte) (uint32, uint32, error) {
 		bufferedFrames = max(bufferedFrames, sps.VUI.BitstreamRestriction.MaxDecFrameBuffering,
 			sps.VUI.BitstreamRestriction.MaxNumReorderFrames)
 	}
-	// Level 5.1 also bounds the decoded-picture buffer. A per-frame size check
+	// Level 5.2 also bounds the decoded-picture buffer. A per-frame size check
 	// alone would let a larger picture multiply the old 16-reference allocation.
 	if bufferedFrames > 16 || width*height/256*uint64(bufferedFrames) > 184_320 {
 		return 0, 0, errors.New("native H264 input reference storage exceeds its bound")
diff --git a/internal/app/mediaedge/relay_input_test.go b/internal/app/mediaedge/relay_input_test.go
index f44f397ea..b77c65a2c 100644
--- a/internal/app/mediaedge/relay_input_test.go
+++ b/internal/app/mediaedge/relay_input_test.go
@@ -108,9 +108,13 @@ func TestRelayH264AllocationBounds(t *testing.T) {
 		{"portrait-within-bound", "6742c033da01100b5e5d", 1080, 1440},
 		{"4k", "6742c033da00f0010f90", 3840, 2160},
 		{"portrait-4k", "6742c033da008701e190", 2160, 3840},
+		{"level-5.2-4k", "6742c034da00f0010f90", 3840, 2160},
+		{"level-5.2-portrait-4k", "6742c034da008701e190", 2160, 3840},
 		{"padded-4k", "6742c033da00f00111f894", 3840, 2160},
 		{"4k-reference-buffer-limit", "6742c033f300780087c8", 3840, 2160},
 		{"4k-reference-buffer-overflow", "6742c033f380780087c8", 0, 0},
+		{"level-5.2-reference-buffer-overflow", "6742c034f380780087c8", 0, 0},
+		{"level-5.2-cropped-storage-overflow", "6742c034da00f001e1f8034940", 0, 0},
 		{"large-cropped-storage", "6742c033da00f001e1f8034940", 0, 0},
 		{"crop-overflow", "6742c033da0a37e000000300100000030004", 0, 0},
 		{"coded-size-overflow", "6742c033da000003000040000003000d90", 0, 0},
diff --git a/internal/app/nativecapture/protocol.go b/internal/app/nativecapture/protocol.go
index b3cd65741..1b44917d2 100644
--- a/internal/app/nativecapture/protocol.go
+++ b/internal/app/nativecapture/protocol.go
@@ -17,10 +17,10 @@ const (
 	maxControlBytes              = 64
 	MaxVideoDimension            = 3840
 	MaxVideoPixels               = 3840 * 2160
-	MaxVideoMacroblocksPerSecond = 983_040
+	MaxVideoMacroblocksPerSecond = 2_073_600
 	MaxVideoFramerate            = 60
 	// Coded pictures may include alignment outside the visible crop. Keep this
-	// separate from visible dimensions and within H.264 Level 5.1 storage.
+	// separate from visible dimensions and within H.264 Level 5.2 storage.
 	MaxCodedVideoDimension = 4096
 	MaxCodedVideoPixels    = 36_864 * 16 * 16
 )
@@ -33,7 +33,7 @@ func ValidVideoSize(width, height uint32) bool {
 }
 
 // ValidVideoFormat keeps both current encoders within the shared receive
-// ceiling (H.264 Level 5.1), including non-preset shapes and frame rates.
+// ceiling (H.264 Level 5.2), including non-preset shapes and frame rates.
 func ValidVideoFormat(width, height, framerate uint32) bool {
 	return ValidVideoSize(width, height) && framerate >= 1 && framerate <= MaxVideoFramerate &&
 		uint64((width+15)/16)*uint64((height+15)/16)*uint64(framerate) <= MaxVideoMacroblocksPerSecond
@@ -45,6 +45,21 @@ func ValidCodedVideoSize(width, height uint64) bool {
 		width*height <= MaxCodedVideoPixels
 }
 
+// SupportedH264ProfileLevelID bounds capture and receive to the same coding
+// tools. Automatic encoders may select a lower level for a smaller output.
+func SupportedH264ProfileLevelID(value string) bool {
+	level, valid := encoded.H264ConstrainedBaselineLevel(value)
+	if !valid {
+		return false
+	}
+	switch level {
+	case 10, 11, 12, 13, 20, 21, 22, 30, 31, 32, 40, 41, 42, 50, 51, 52:
+		return true
+	default:
+		return false
+	}
+}
+
 type FrameKind uint8
 
 const (
diff --git a/internal/app/nativecapture/protocol_test.go b/internal/app/nativecapture/protocol_test.go
index 8ef21f0be..1e7806a3d 100644
--- a/internal/app/nativecapture/protocol_test.go
+++ b/internal/app/nativecapture/protocol_test.go
@@ -294,6 +294,8 @@ func TestVideoProfileUsesTheProductBounds(t *testing.T) {
 		{Width: 720, Height: 1280, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
 		{Width: 3840, Height: 2160, Framerate: 30, Bitrate: 12_000_000, Preference: "balanced"},
 		{Width: 2160, Height: 3840, Framerate: 30, Bitrate: 12_000_000, Preference: "balanced"},
+		{Width: 3840, Height: 2160, Framerate: 60, Bitrate: 12_000_000, Preference: "balanced"},
+		{Width: 2160, Height: 3840, Framerate: 60, Bitrate: 12_000_000, Preference: "balanced"},
 		{Width: 3000, Height: 2764, Framerate: 30, Bitrate: 12_000_000, Preference: "balanced"},
 		{Width: 4, Height: 4, Framerate: 15, Bitrate: 2_000_000, Preference: "balanced"},
 	} {
@@ -316,8 +318,8 @@ func TestVideoProfileUsesTheProductBounds(t *testing.T) {
 		{Width: 2160, Height: 3842, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
 		{Width: 3840, Height: 2162, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
 		{Width: 3000, Height: 2766, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
-		{Width: 3840, Height: 2160, Framerate: 31, Bitrate: 3_000_000, Preference: "balanced"},
-		{Width: 2160, Height: 3840, Framerate: 60, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: 3840, Height: 2160, Framerate: 61, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: 2160, Height: 3840, Framerate: 120, Bitrate: 3_000_000, Preference: "balanced"},
 		{Width: ^uint32(0), Height: ^uint32(0), Framerate: ^uint32(0), Bitrate: 3_000_000, Preference: "balanced"},
 		{Width: 1920, Height: 1080, Framerate: 14, Bitrate: 5_000_000, Preference: "balanced"},
 		{Width: 1920, Height: 1080, Framerate: 30, Bitrate: 12_000_001, Preference: "balanced"},
diff --git a/internal/app/nativecontrol/session_test.go b/internal/app/nativecontrol/session_test.go
index 51868f6db..8cdc4969c 100644
--- a/internal/app/nativecontrol/session_test.go
+++ b/internal/app/nativecontrol/session_test.go
@@ -670,14 +670,14 @@ func TestQualitySettingsMapOnceIntoNativeMedia(t *testing.T) {
 		t.Fatalf("numeric size outside UI presets was not preserved: %+v", profile)
 	}
 	settings.Resolution = protocol.QualityResolution{Width: 3840, Height: 2160}
-	if nativeQualityProfile(settings).Valid() {
-		t.Fatal("unsupported 4K60 combination was accepted")
+	if !nativeQualityProfile(settings).Valid() {
+		t.Fatal("4K60 was rejected")
 	}
 	settings.MaxFramerate = 30
 	if !nativeQualityProfile(settings).Valid() {
 		t.Fatal("4K30 was rejected")
 	}
-	for _, fps := range []protocol.Num{30.5, 120, 0x1_0000_0000 + 30} {
+	for _, fps := range []protocol.Num{30.5, 61, 120, 0x1_0000_0000 + 30} {
 		settings.MaxFramerate = fps
 		if nativeQualityProfile(settings).Valid() {
 			t.Fatalf("unsupported fps %v was narrowed into a valid profile", fps)
diff --git a/internal/app/nativehost/session.go b/internal/app/nativehost/session.go
index 4868a3b2c..126238e3d 100644
--- a/internal/app/nativehost/session.go
+++ b/internal/app/nativehost/session.go
@@ -1226,7 +1226,7 @@ func decodeCaptureState(payload []byte) (CaptureState, error) {
 	}
 	original := state.Outputs[min(1, len(state.Outputs)-1)]
 	if state.State == "active" &&
-		((state.Codec == "h264" && !validH264ProfileLevelID(state.ProfileLevelID)) ||
+		((state.Codec == "h264" && !nativecapture.SupportedH264ProfileLevelID(state.ProfileLevelID)) ||
 			(state.Codec == "vp8" && state.ProfileLevelID != "") ||
 			state.Width != original.Width ||
 			state.Height != original.Height ||
@@ -1249,19 +1249,6 @@ func (state CaptureState) applyBackend(options *nativecapture.VideoOptions) {
 	}
 }
 
-func validH264ProfileLevelID(value string) bool {
-	level, valid := encoded.H264ConstrainedBaselineLevel(value)
-	if !valid {
-		return false
-	}
-	switch level {
-	case 30, 31, 32, 40, 41, 42, 50, 51:
-		return true
-	default:
-		return false
-	}
-}
-
 // Optional facts are emitted only to a page which opted into mixed audio.
 func (session *Session) SourceAudio() *bool {
 	if session.mixer == nil {
diff --git a/internal/app/nativehost/session_test.go b/internal/app/nativehost/session_test.go
index 9ba885783..5c7b6b7ae 100644
--- a/internal/app/nativehost/session_test.go
+++ b/internal/app/nativehost/session_test.go
@@ -430,14 +430,14 @@ func TestCaptureStateRejectsUnknownOrUnattributedState(t *testing.T) {
 }
 
 func TestCaptureStateValidatesH264ToolsRatherThanConstraintSpelling(t *testing.T) {
-	for _, profile := range []string{"42c01f", "42e01f", "42E033", "4d801f", "58c02a"} {
+	for _, profile := range []string{"42c01f", "42e01f", "42E033", "4d801f", "58c02a", "42c00a", "42c016", "42c034"} {
 		state, err := decodeCaptureState(captureStatePayload(t,
 			`{"state":"active","hardwareOnly":true,"codec":"h264","profileLevelId":"`+profile+`","width":1280,"height":720,"fps":30}`))
 		if err != nil || state.ProfileLevelID != profile {
 			t.Fatalf("equivalent Constrained Baseline %q was rejected or rewritten: %+v, %v", profile, state, err)
 		}
 	}
-	for _, profile := range []string{"42001f", "4d001f", "64001f", "42e11f", "42e01", "42e01fg", "42e0gg", "42e034", "42e035", "42e03c"} {
+	for _, profile := range []string{"42001f", "4d001f", "64001f", "42e11f", "42e01", "42e01fg", "42e0gg", "42e000", "42e035", "42e03c"} {
 		if _, err := decodeCaptureState(captureStatePayload(t,
 			`{"state":"active","hardwareOnly":true,"codec":"h264","profileLevelId":"`+profile+`","width":1280,"height":720,"fps":30}`)); err == nil {
 			t.Fatalf("incompatible profile/level %q was admitted", profile)
diff --git a/native/capture/darwin/main.swift b/native/capture/darwin/main.swift
index 65f036c78..33d5975d9 100644
--- a/native/capture/darwin/main.swift
+++ b/native/capture/darwin/main.swift
@@ -20,7 +20,8 @@ private let maxVideoPixels = 3840 * 2160
 private let maxCodedVideoDimension = 4096
 private let maxCodedVideoPixels = 36_864 * 16 * 16
 private let supportedH264Levels: Set<UInt8> = [
-    0x1e, 0x1f, 0x20, 0x28, 0x29, 0x2a, 0x32, 0x33,
+    0x0a, 0x0b, 0x0c, 0x0d, 0x14, 0x15, 0x16,
+    0x1e, 0x1f, 0x20, 0x28, 0x29, 0x2a, 0x32, 0x33, 0x34,
 ]
 
 private enum DegradationPreference: String {
@@ -1497,9 +1498,9 @@ private func validVideoSize(_ width: Int, _ height: Int) -> Bool {
 }
 
 private func validVideoFormat(_ width: Int, _ height: Int, _ fps: Int32) -> Bool {
-    // Match the shared H.264 Level 5.1 receive ceiling, including numeric sizes.
+    // Match the shared H.264 Level 5.2 receive ceiling, including numeric sizes.
     validVideoSize(width, height) && fps >= 1 && fps <= 60 &&
-        ((width + 15) / 16) * ((height + 15) / 16) * Int(fps) <= 983_040
+        ((width + 15) / 16) * ((height + 15) / 16) * Int(fps) <= 2_073_600
 }
 
 private func videoProfile(_ arguments: [String]) throws -> VideoProfile {
diff --git a/native/capture/linux/main.c b/native/capture/linux/main.c
index 575cc5443..f3e06da4b 100644
--- a/native/capture/linux/main.c
+++ b/native/capture/linux/main.c
@@ -379,9 +379,9 @@ static gboolean valid_video_size(guint width, guint height) {
 }
 
 static gboolean valid_video_format(guint width, guint height, guint fps) {
-  // Match the shared H.264 Level 5.1 receive ceiling, including numeric sizes.
+  // Match the shared H.264 Level 5.2 receive ceiling, including numeric sizes.
   return valid_video_size(width, height) && fps >= 1 && fps <= 60 &&
-         (guint64)((width + 15) / 16) * ((height + 15) / 16) * fps <= 983040;
+         (guint64)((width + 15) / 16) * ((height + 15) / 16) * fps <= 2073600;
 }
 
 static gboolean parse_outputs(int count, char **values, guint start, CaptureRun *run) {
diff --git a/native/capture/windows/adaptive_encoder.cpp b/native/capture/windows/adaptive_encoder.cpp
index 8c5a4edc0..5b2942be5 100644
--- a/native/capture/windows/adaptive_encoder.cpp
+++ b/native/capture/windows/adaptive_encoder.cpp
@@ -508,7 +508,7 @@ class AdaptiveEncoder::Impl final : public webrtc::VideoSourceInterface<webrtc::
 
   std::vector<webrtc::SdpVideoFormat> GetSupportedFormats() const override {
     if (kind_ == OutputKind::vp8) return {webrtc::SdpVideoFormat("VP8")};
-    return {webrtc::SdpVideoFormat("H264", {{"profile-level-id", ceiling_.profile_level_id()},
+    return {webrtc::SdpVideoFormat("H264", {{"profile-level-id", kH264ProfileLevelId},
         {"packetization-mode", "1"}, {"level-asymmetry-allowed", "1"}})};
   }
   std::unique_ptr<webrtc::VideoEncoder> Create(const webrtc::Environment& env,
diff --git a/native/capture/windows/h264_encoder.cpp b/native/capture/windows/h264_encoder.cpp
index f1cab0512..8b00e96e2 100644
--- a/native/capture/windows/h264_encoder.cpp
+++ b/native/capture/windows/h264_encoder.cpp
@@ -17,12 +17,19 @@ namespace {
 constexpr DWORD kMaxEncodedSampleBytes = 4 * 1024 * 1024;
 }
 
-bool VideoProfile::accepts_h264_profile_level_id(const std::string& value) const {
+bool SupportsH264ProfileLevelId(const std::string& value) {
   if (value.size() != 6) return false;
   UINT32 parsed = 0;
   const auto end = value.data() + value.size();
   const auto result = std::from_chars(value.data(), end, parsed, 16);
-  if (result.ec != std::errc{} || result.ptr != end || (parsed & 0xff) != h264_level()) return false;
+  if (result.ec != std::errc{} || result.ptr != end) return false;
+  switch (parsed & 0xff) {
+    case 10: case 11: case 12: case 13: case 20: case 21: case 22:
+    case 30: case 31: case 32: case 40: case 41: case 42: case 50: case 51: case 52:
+      break;
+    default:
+      return false;
+  }
   const auto idc = parsed >> 16;
   const auto constraints = (parsed >> 8) & 0xff;
   // RFC 6184 Table 5: these are the same Constrained Baseline tools, not
@@ -359,8 +366,8 @@ ComPtr<IMFMediaType> CreateOutputType(
         "output-type-interlace");
   Check(type->SetUINT32(MF_MT_MPEG2_PROFILE, eAVEncH264VProfile_Base),
         "output-type-profile");
-  Check(type->SetUINT32(MF_MT_MPEG2_LEVEL, profile.h264_level()),
-        "output-type-level");
+  // MF recommends automatic level selection. Forcing a valid level can still
+  // make hardware reject the type; validate the actual SPS instead.
   return type;
 }
 
@@ -412,8 +419,6 @@ void ValidateMediaTypes(
                  "output-type-bitrate");
   RequireTypeU32(output.Get(), MF_MT_MPEG2_PROFILE,
                  eAVEncH264VProfile_Base, "output-type-profile");
-  RequireTypeU32(output.Get(), MF_MT_MPEG2_LEVEL, profile.h264_level(),
-                 "output-type-level");
 
   UINT32 width = 0;
   UINT32 height = 0;
@@ -703,8 +708,8 @@ EncodedAccessUnit LiveEncoder::Encode(
       Fail("bitstream-annexb", "live output is not Annex-B H264");
     }
     if (nal.profile_level_id) {
-      if (!profile_.accepts_h264_profile_level_id(*nal.profile_level_id)) {
-        Fail("bitstream-profile", "hardware MFT changed the requested H.264 profile level");
+      if (!SupportsH264ProfileLevelId(*nal.profile_level_id)) {
+        Fail("bitstream-profile", "hardware MFT emitted unsupported H.264 coding tools or level");
       }
       if (profile_level_id_ && *profile_level_id_ != *nal.profile_level_id) {
         Fail("bitstream-profile-change", "hardware MFT changed SPS profile");
diff --git a/native/capture/windows/h264_encoder.h b/native/capture/windows/h264_encoder.h
index dd7ed10f8..f1ce69358 100644
--- a/native/capture/windows/h264_encoder.h
+++ b/native/capture/windows/h264_encoder.h
@@ -56,27 +56,11 @@ struct VideoProfile final {
     if (preference == DegradationPreference::framerate) return 0;
     return 50;
   }
-  UINT32 h264_level() const {
-    const UINT64 macroblocks =
-        ((static_cast<UINT64>(width) + 15) / 16) *
-        ((static_cast<UINT64>(height) + 15) / 16);
-    const UINT64 macroblocks_per_second = macroblocks * frame_rate;
-    if (macroblocks <= 3'600 && macroblocks_per_second <= 108'000) return 31;
-    if (macroblocks <= 8'192 && macroblocks_per_second <= 245'760) return 40;
-    if (macroblocks <= 8'704 && macroblocks_per_second <= 522'240) return 42;
-    if (macroblocks <= 22'080 && macroblocks_per_second <= 589'824) return 50;
-    return 51;
-  }
-  std::string profile_level_id() const {
-    std::ostringstream output;
-    output << "42c0" << std::hex << std::setfill('0') << std::setw(2)
-           << h264_level();
-    return output.str();
-  }
-  bool accepts_h264_profile_level_id(const std::string& value) const;
 };
 
 constexpr VideoProfile kDefaultVideoProfile{};
+inline constexpr char kH264ProfileLevelId[] = "42c034";
+bool SupportsH264ProfileLevelId(const std::string& value);
 
 struct Runtime final {
   Runtime() {
diff --git a/native/capture/windows/main.cpp b/native/capture/windows/main.cpp
index 9f1a5eae1..5183bd502 100644
--- a/native/capture/windows/main.cpp
+++ b/native/capture/windows/main.cpp
@@ -607,9 +607,9 @@ RunEvidence RunEncoder(const Adapter& adapter, const DeviceContext& device,
     Fail("codec-runtime-bitrate-effect",
          "live bitrate update did not lower and restore encoded output");
   }
-  if (!kDefaultVideoProfile.accepts_h264_profile_level_id(*observed_profile)) {
-    Fail("bitstream-pinned-fmtp",
-         "SPS profile-level-id differs from the native media contract");
+  if (!SupportsH264ProfileLevelId(*observed_profile)) {
+    Fail("bitstream-profile",
+         "SPS uses unsupported H.264 coding tools or level");
   }
   return evidence;
 }
diff --git a/native/capture/windows/output_worker.test.cpp b/native/capture/windows/output_worker.test.cpp
index 2110b2ded..1c8f62a16 100644
--- a/native/capture/windows/output_worker.test.cpp
+++ b/native/capture/windows/output_worker.test.cpp
@@ -151,11 +151,19 @@ void CheckWorkerDimensions(ID3D11Device* device, SIZE content, SIZE expected) {
 
 void CheckH264ProfileCompatibility() {
   const VideoProfile profile;
-  for (const auto* value : {"42c01f", "42e01f", "42E01F", "4d801f", "58c01f"})
-    assert(profile.accepts_h264_profile_level_id(value));
+  for (const auto* value : {"42c01f", "42e01f", "42E01F", "4d801f", "58c01f",
+                           "42c00a", "42c016", "42e01e", "42c02a", "42c033", "42c034"})
+    assert(SupportsH264ProfileLevelId(value));
   for (const auto* value : {"42001f", "4d001f", "64001f", "42e11f", "42e01", "42e01fg",
-                           "42e0gg", "42e034", "42e01e", " 42c01"})
-    assert(!profile.accepts_h264_profile_level_id(value));
+                           "42e0gg", "42e035", "42e03c", "42e000", " 42c01"})
+    assert(!SupportsH264ProfileLevelId(value));
+  Runtime runtime;
+  for (const auto size : {SIZE{1280, 720}, SIZE{3840, 2160}, SIZE{2160, 3840}}) {
+    const auto type = CreateOutputType(VideoProfile{
+        static_cast<UINT32>(size.cx), static_cast<UINT32>(size.cy), 60, 12'000'000});
+    UINT32 level = 0;
+    assert(type->GetUINT32(MF_MT_MPEG2_LEVEL, &level) == MF_E_ATTRIBUTENOTFOUND);
+  }
 
   HANDLE read = nullptr, write = nullptr;
   assert(CreatePipe(&read, &write, nullptr, 4096));
@@ -392,12 +400,9 @@ void CheckDecodedDisplayArea(ID3D11Device* device) {
 int main() {
   VideoProfile profile{2560, 1440, 60, 12'000'000};
   ValidateVideoProfile(profile);
-  assert(profile.h264_level() == 51 && profile.profile_level_id() == "42c033");
-  profile = VideoProfile{1920, 1080, 60, 8'000'000};
-  assert(profile.h264_level() == 42);
   for (const SIZE size : {SIZE{1920, 1200}, SIZE{720, 1280}, SIZE{4, 4},
                           SIZE{3840, 2160}, SIZE{2160, 3840}, SIZE{3000, 2764}}) {
-    ValidateVideoProfile(VideoProfile{static_cast<UINT32>(size.cx), static_cast<UINT32>(size.cy), 30, 3'000'000});
+    ValidateVideoProfile(VideoProfile{static_cast<UINT32>(size.cx), static_cast<UINT32>(size.cy), 60, 3'000'000});
   }
   for (const SIZE size : {SIZE{0, 720}, SIZE{2, 720}, SIZE{1280, 2}, SIZE{1279, 720},
                           SIZE{1280, 719}, SIZE{3842, 2160}, SIZE{2160, 3842},
@@ -410,8 +415,9 @@ int main() {
     }
   }
   assert(piik::capture::ValidVideoFormat(3840, 2160, 30));
-  assert(!piik::capture::ValidVideoFormat(3840, 2160, 31));
-  assert(!piik::capture::ValidVideoFormat(2160, 3840, 60));
+  assert(piik::capture::ValidVideoFormat(3840, 2160, 60));
+  assert(piik::capture::ValidVideoFormat(2160, 3840, 60));
+  assert(!piik::capture::ValidVideoFormat(3840, 2160, 61));
   assert(!piik::capture::ValidVideoFormat(UINT32_MAX, UINT32_MAX, UINT32_MAX));
   assert(piik::capture::ValidCodedVideoSize(3840, 2176));
   assert(piik::capture::ValidCodedVideoSize(2176, 3840));
diff --git a/native/capture/windows/video_bounds.h b/native/capture/windows/video_bounds.h
index 79fac850a..93648722e 100644
--- a/native/capture/windows/video_bounds.h
+++ b/native/capture/windows/video_bounds.h
@@ -6,7 +6,7 @@ namespace piik::capture {
 
 inline constexpr uint32_t kMaxVideoDimension = 3840;
 inline constexpr uint64_t kMaxVideoPixels = 3840 * 2160;
-// H.264 Level 5.1 coded storage, including padding outside the visible crop.
+// H.264 Level 5.2 coded storage, including padding outside the visible crop.
 inline constexpr uint32_t kMaxCodedVideoDimension = 4096;
 inline constexpr uint64_t kMaxCodedVideoPixels = 36'864 * 16 * 16;
 
@@ -18,7 +18,7 @@ inline bool ValidVideoSize(uint32_t width, uint32_t height) {
 
 inline bool ValidVideoFormat(uint32_t width, uint32_t height, uint32_t fps) {
   return ValidVideoSize(width, height) && fps >= 1 && fps <= 60 &&
-         static_cast<uint64_t>((width + 15) / 16) * ((height + 15) / 16) * fps <= 983'040;
+         static_cast<uint64_t>((width + 15) / 16) * ((height + 15) / 16) * fps <= 2'073'600;
 }
 
 inline bool ValidCodedVideoSize(uint32_t width, uint32_t height) {
diff --git a/scripts/app-native-host-gate.ts b/scripts/app-native-host-gate.ts
index c6c0f6d12..11abe0873 100644
--- a/scripts/app-native-host-gate.ts
+++ b/scripts/app-native-host-gate.ts
@@ -1037,7 +1037,7 @@ async function main(): Promise<void> {
         const fps = document.querySelector('.lr-slider input[type="range"]');
         const width = document.querySelector('.lr-video-size input[name="width"]');
         const height = document.querySelector('.lr-video-size input[name="height"]');
-        return fps?.max === '30' && fps.value === '30' && width?.value === '3840' && height?.value === '2160';
+        return fps?.max === '60' && fps.value === '60' && width?.value === '3840' && height?.value === '2160';
       })()`, deadline), Boolean, 10_000);
       stage = "native-4k-decode";
       result.fourKQualityChanged = await waitForValue(deadline => evaluate<boolean>(cdp!, viewer, `(() => {
diff --git a/scripts/encoded-group-decode.mjs b/scripts/encoded-group-decode.mjs
index 76cfcfa5b..68804635f 100644
--- a/scripts/encoded-group-decode.mjs
+++ b/scripts/encoded-group-decode.mjs
@@ -6,7 +6,7 @@ import { resolve } from "node:path";
 
 const customInput = process.env.PIIK_ENCODED_OUTPUT;
 const codec = process.env.PIIK_ENCODED_CODEC ?? "vp8";
-assert.ok(["vp8", "avc1.42c033"].includes(codec), "Expected VP8 or constrained-baseline H264");
+assert.ok(["vp8", "avc1.42c033", "avc1.42c034"].includes(codec), "Expected VP8 or constrained-baseline H264");
 const inputPath = customInput ? resolve(customInput) : new URL("../build/embedded-media/encoded-group.received.json", import.meta.url);
 const input = await readFile(inputPath);
 const streams = JSON.parse(input);
diff --git a/src/client/media/quality.ts b/src/client/media/quality.ts
index 779ac5722..2b87315e1 100644
--- a/src/client/media/quality.ts
+++ b/src/client/media/quality.ts
@@ -34,11 +34,11 @@ export interface VideoCaptureLimits {
 }
 
 // Current output boundary, independent of descriptive wire bounds and UI presets.
-// The common H.264 Level 5.1 path admits 4K30 and 1440p60 in either orientation.
+// H.264 Level 5.2 admits 4K60 in either orientation; actual output still adapts.
 export const VIDEO_CAPTURE_LIMITS: VideoCaptureLimits = {
   maxVideoResolution: { width: 3840, height: 3840 },
   maxVideoPixels: 3840 * 2160,
-  maxVideoMacroblocksPerSecond: 983_040,
+  maxVideoMacroblocksPerSecond: 2_073_600,
   maxVideoFramerate: 60,
   maxVideoBitrate: 12_000_000,
 };
diff --git a/src/client/native/native-viewer-peer.ts b/src/client/native/native-viewer-peer.ts
index aaea00220..2827efc79 100644
--- a/src/client/native/native-viewer-peer.ts
+++ b/src/client/native/native-viewer-peer.ts
@@ -831,5 +831,5 @@ function nativeH264Format(fmtp: string): boolean {
   return ((idc === 0x42 && (constraints & 0x4f) === 0x40) ||
     (idc === 0x4d && (constraints & 0x8f) === 0x80) ||
     (idc === 0x58 && (constraints & 0xcf) === 0xc0)) &&
-    [10, 11, 12, 13, 20, 21, 22, 30, 31, 32, 40, 41, 42, 50, 51].includes(level);
+    [10, 11, 12, 13, 20, 21, 22, 30, 31, 32, 40, 41, 42, 50, 51, 52].includes(level);
 }
diff --git a/tests/native-viewer-peer.test.ts b/tests/native-viewer-peer.test.ts
index d0d42eac7..62fd3b554 100644
--- a/tests/native-viewer-peer.test.ts
+++ b/tests/native-viewer-peer.test.ts
@@ -272,7 +272,8 @@ it("admits one active sending H264 or VP8 video section, not unrelated SDP codec
 it.each([
   ["42e01f", "1", true], ["42c01f", "1", true],
   ["4de01f", "1", true], ["58c01f", "1", true],
-  ["42e00b", "1", true], ["42e033", "1", true], ["42e034", "1", false],
+  ["42e00b", "1", true], ["42e033", "1", true], ["42e034", "1", true],
+  ["42e03c", "1", false],
   ["4d001f", "1", false], ["64001f", "1", false], ["42001f", "1", false],
   ["42e11f", "1", false], ["42e035", "1", false], ["42e03c", "1", false],
   ["42e01f=invalid", "1", false],
diff --git a/tests/quality.test.ts b/tests/quality.test.ts
index 29dd21bf6..d8e1aecba 100644
--- a/tests/quality.test.ts
+++ b/tests/quality.test.ts
@@ -54,11 +54,14 @@ afterEach(() => {
 
 describe("realtime quality controls", () => {
   it("bounds custom size, orientation and frame rate together before capture", () => {
-    expect(captureFramerateCeiling(QUALITY_RESOLUTIONS["4K"])).toBe(30);
-    expect(captureFramerateCeiling({ width: 2160, height: 3840 })).toBe(30);
+    expect(captureFramerateCeiling(QUALITY_RESOLUTIONS["4K"])).toBe(60);
+    expect(captureFramerateCeiling({ width: 2160, height: 3840 })).toBe(60);
     expect(captureFramerateCeiling(QUALITY_RESOLUTIONS["1440p"])).toBe(60);
     expect(captureFramerateCeiling({ width: 1440, height: 2560 })).toBe(60);
-    expect(captureFramerateCeiling({ width: 3840, height: 2100 })).toBe(31);
+    expect(captureFramerateCeiling({ width: 3840, height: 2100 })).toBe(60);
+    const level51 = videoCaptureLimits({ maxVideoMacroblocksPerSecond: 983_040 });
+    expect(captureFramerateCeiling(QUALITY_RESOLUTIONS["4K"], level51)).toBe(30);
+    expect(captureFramerateCeiling({ width: 2160, height: 3840 }, level51)).toBe(30);
     for (const size of [{ width: 3840, height: 3840 }, { width: 1921, height: 1080 },
       { width: 4.5, height: 4 }, { width: Infinity, height: 4 }, { width: 2, height: 4 }]) {
       expect(captureFramerateCeiling(size)).toBe(0);
@@ -91,6 +94,26 @@ describe("realtime quality controls", () => {
     expect(videoTrack.applyConstraints).not.toHaveBeenCalled();
   });
 
+  it("requests 4K60 in either orientation through the existing capture controls", async () => {
+    const { stream, videoTrack } = createVideoStream();
+    const getDisplayMedia = vi.fn(async () => stream);
+    vi.stubGlobal("navigator", { mediaDevices: { getDisplayMedia } });
+    for (const resolution of [QUALITY_RESOLUTIONS["4K"], { width: 2160, height: 3840 }]) {
+      const profile = { ...QUALITY_PROFILES["1080p60"], resolution };
+      expect(supportsCaptureProfile(profile)).toBe(true);
+      await captureDisplay(profile);
+      expect(getDisplayMedia).toHaveBeenLastCalledWith(expect.objectContaining({
+        video: expect.objectContaining({
+          width: expect.objectContaining({ max: resolution.width }),
+          height: expect.objectContaining({ max: resolution.height }),
+          frameRate: expect.objectContaining({ max: 60 }),
+        }),
+      }));
+      await applyCaptureProfile(stream, profile);
+      expect(videoTrack.applyConstraints).toHaveBeenCalled();
+    }
+  });
+
   it("keeps exactly three recommended profiles with 1080p30 as the default", () => {
     expect(Object.keys(QUALITY_PROFILES)).toEqual([
       "720p30",

From f7c607edc5a7266836a101748d806f91026dd7ba Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 12:18:36 +0800
Subject: [PATCH 153/262] docs(media): record operating range validation gaps

---
 docs/research/native-client-media.md | 22 ++++++++++++++++++++++
 docs/todo.md                         |  7 +++++--
 2 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index c68e01a7d..26be806fc 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -745,6 +745,28 @@ may exceed local support, but cannot authorize larger local allocations.
 This separation also appears in
 [mediasoup RTP parameters and capabilities](https://mediasoup.org/documentation/v3/mediasoup/rtp-parameters-and-capabilities/).
 
+The operating-range review on 2026-10-11 found that the current 15 fps / 2 Mbps
+source minimum and 12 Mbps maximum retain the earlier menu range; they are not
+codec limits. [LiveKit's screen-share presets](https://github.com/livekit/client-sdk-js/blob/main/src/room/track/options.ts)
+include 720p5 at 800 kbps. [YouTube's H.264 live-ingest guidance](https://support.google.com/youtube/answer/2853702?hl=en)
+recommends 50 Mbps for 4K60, but its ingest/re-encoding workload is not a Piik
+WebRTC operating policy. These references motivate testing both ends of the
+range, rather than inheriting the old controls or copying another service's cap.
+
+An offline Windows control used the production H.264 encoder and retained-surface
+decoder with synthetic frames. It requested 720p5 at 800 kbps, 720p15 at 1 Mbps,
+and 4K60 at 40 and 50 Mbps. Every case was rejected by product profile admission;
+the codec-only path encoded and decoded all 30 frames per case. This establishes
+local codec feasibility, not sustained bitrate/quality, complete-route support
+or a new accepted control range. The ignored control and output are in
+`build/candidate-review/four-k60/operating-range.cpp` and `operating-range.jsonl`.
+
+Before widening source controls, check the existing Browser SFU and Native
+lower-output construction together: both use a quarter bitrate with a 150 kbps
+floor. A lower source setting must not produce a derived output whose ceiling
+exceeds that source. Preserve frame-byte, allocation, output-count and receiver
+limits; do not replace the old menu ceiling with unbounded resource permission.
+
 [WebRTC statistics](https://www.w3.org/TR/webrtc-stats/#dom-rtcicecandidatepairstats-availableoutgoingbitrate)
 describe estimated available capacity, not a configured send-rate ceiling;
 [Pion exposes it as a floating-point observation](https://github.com/pion/ice/blob/main/stats.go).
diff --git a/docs/todo.md b/docs/todo.md
index 385dc8cd4..29e011f29 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -75,8 +75,11 @@ Implementation needs a concrete useful result within the product model.
   actual output. Numeric request, capability and observation boundaries are now
   separate from implementation admission. Keep receiver, codec/alignment and
   resource budgets intact; opening an output range still needs end-to-end evidence.
-  Retain the current audio sender ceiling and bounded video controls; extending
-  their operating range needs a concrete use case and end-to-end evidence.
+  Review the inherited video operating range: the 15 fps / 2 Mbps source minimum
+  prevents low-rate source requests, while 12 Mbps can constrain 4K60 motion quality.
+  The assessment now has local codec controls beyond both ends; widening the
+  controls still needs complete-route evidence and coherent lower-output limits.
+  Keep the audio sender ceiling backed by the existing packet-size evidence.
   Numeric audio and video controls are implemented; the assessment
   owns local capture, codec, derived-output, SFU and bounded mixed-route evidence.
   Remaining receiver acceptance needs physical limited decoders and camera

From 75e48d8c74b832d61d82188575339bf10518f4fa Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 13:53:57 +0800
Subject: [PATCH 154/262] feat(media): broaden bounded video controls

---
 docs/research/native-client-media.md          | 39 +++++---
 docs/standards/media-quality.md               |  9 +-
 docs/status.md                                |  4 +-
 docs/todo.md                                  | 13 +--
 internal/app/nativecapture/protocol_test.go   | 10 +-
 internal/app/nativecapture/stream.go          |  7 +-
 internal/app/nativecontrol/session_test.go    |  4 +-
 native/capture/darwin/main.swift              |  5 +-
 native/capture/linux/main.c                   |  6 +-
 native/capture/linux/main.test.c              | 13 ++-
 native/capture/windows/main.cpp               |  8 +-
 native/capture/windows/output_worker.test.cpp | 18 ++++
 .../components/living/QualityPresets.tsx      | 94 ++++++++++++++-----
 src/client/media/quality.ts                   |  6 +-
 src/client/pages/ControlsPreview.tsx          | 21 +++--
 src/client/pages/HostPage.tsx                 | 66 +------------
 src/client/sfu/publisher.ts                   |  5 +-
 src/client/styles.css                         | 15 ++-
 src/client/webrtc/video-codec-preflight.ts    |  5 +-
 tests/quality.test.ts                         | 19 +++-
 tests/sfu-client.test.ts                      | 17 ++++
 tests/video-codec-preflight.test.ts           | 10 ++
 22 files changed, 239 insertions(+), 155 deletions(-)

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 26be806fc..f37dc5e60 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -745,27 +745,36 @@ may exceed local support, but cannot authorize larger local allocations.
 This separation also appears in
 [mediasoup RTP parameters and capabilities](https://mediasoup.org/documentation/v3/mediasoup/rtp-parameters-and-capabilities/).
 
-The operating-range review on 2026-10-11 found that the current 15 fps / 2 Mbps
-source minimum and 12 Mbps maximum retain the earlier menu range; they are not
+The operating-range review found that the inherited 15 fps / 2 Mbps
+source minimum and 12 Mbps maximum retained the earlier menu range; they were not
 codec limits. [LiveKit's screen-share presets](https://github.com/livekit/client-sdk-js/blob/main/src/room/track/options.ts)
 include 720p5 at 800 kbps. [YouTube's H.264 live-ingest guidance](https://support.google.com/youtube/answer/2853702?hl=en)
 recommends 50 Mbps for 4K60, but its ingest/re-encoding workload is not a Piik
 WebRTC operating policy. These references motivate testing both ends of the
 range, rather than inheriting the old controls or copying another service's cap.
 
-An offline Windows control used the production H.264 encoder and retained-surface
-decoder with synthetic frames. It requested 720p5 at 800 kbps, 720p15 at 1 Mbps,
-and 4K60 at 40 and 50 Mbps. Every case was rejected by product profile admission;
-the codec-only path encoded and decoded all 30 frames per case. This establishes
-local codec feasibility, not sustained bitrate/quality, complete-route support
-or a new accepted control range. The ignored control and output are in
-`build/candidate-review/four-k60/operating-range.cpp` and `operating-range.jsonl`.
-
-Before widening source controls, check the existing Browser SFU and Native
-lower-output construction together: both use a quarter bitrate with a 150 kbps
-floor. A lower source setting must not produce a derived output whose ceiling
-exceeds that source. Preserve frame-byte, allocation, output-count and receiver
-limits; do not replace the old menu ceiling with unbounded resource permission.
+The candidate now admits 1..60 integer fps and 0.1..50 Mbps. Its lower-output
+construction caps the usual 150 kbps floor by the source ceiling, in both Browser
+SFU and Native. Browser and Native preflight require positive encoded progress;
+the old one-frame tolerance could otherwise pass zero output at 1 fps.
+An earlier raw H.264 encode/decode control established local feasibility beyond
+the old range. Production Windows output-worker checks now cover H.264/VP8 at
+720p1/100 kbps, 720p5/800 kbps and 4K60/50 Mbps, including source-size replacement.
+Native encoded input also produced the expected half-size output at the low and
+high bounds. Each derivation retained its existing input-format generation;
+source changes still retire and replan that optional output through its owner.
+Browser loopback with the real sender controls also delivered decoded progress
+at all three settings and after replacing the 1 fps source. The 1 fps H.264
+preflight passed; the 4K60 preflight selected VP8 on this machine even though
+explicit H.264 delivered frames. Admission is not a sustained-cadence guarantee.
+
+A uniform-noise 4K1/50 Mbps stress input reached the retained 4 MiB access-unit
+guard in both Native codecs; VP8 produced a 6,199,837-byte frame. The output was
+rejected rather than expanding allocation limits. Large bitrate/low-cadence
+requests are not permission for unbounded frames. These local controls establish
+useful operation and bounded failure, not sustained field quality or complete-route
+performance. Ignored controls and results are under
+`build/candidate-review/four-k60/` (`range-worker.cpp`, `range-browser.js`).
 
 [WebRTC statistics](https://www.w3.org/TR/webrtc-stats/#dom-rtcicecandidatepairstats-availableoutgoingbitrate)
 describe estimated available capacity, not a configured send-rate ceiling;
diff --git a/docs/standards/media-quality.md b/docs/standards/media-quality.md
index e04f7d490..4289aeffe 100644
--- a/docs/standards/media-quality.md
+++ b/docs/standards/media-quality.md
@@ -138,13 +138,18 @@ rate in the same quality operation when the larger size requires a lower limit.
 Larger wire-valid requests do not
 authorize an adapter to exceed its local capture, codec or allocation limits.
 Numeric requests use representational bounds rather than the current control
-ranges. Current capture still admits integer 15..60 fps and 2..12 Mbps, further
-limited by picture size. These are current product controls, not universal codec
+ranges. Candidate capture admits integer 1..60 fps and 0.1..50 Mbps, further
+limited by picture size. Advanced controls accept typed values alongside sliders;
+the three recommended profiles and default remain unchanged. These are useful
+product controls, not universal codec
 limits or a minimum for framework-driven output. Codec and resource budgets
 apply separately. App descriptions may advertise stronger capabilities;
 controls use their intersection with local support. An unsupported request is
 an operation failure, not malformed signaling. An unsupported saved preference
 does not seed capture or overwrite its stored value with a fallback.
+Derived outputs must stay within their source bitrate ceiling, including when
+that ceiling is below a usual lower-output floor. Codec preflight must observe
+real encoded progress; cadence tolerance alone cannot make zero output pass.
 Frame rate, bitrate, and `maintain-resolution | balanced |
 maintain-framerate` retain their controls. Display video uses the standard
 `contentHint = "motion"` for game motion.
diff --git a/docs/status.md b/docs/status.md
index a277813b8..a16f778ef 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -67,7 +67,9 @@ capture v7 and SQLite schema 2
 remain unchanged. Matched candidate App/Web/Server builds are required;
 1.x participants are rejected by the existing compatibility checks.
 Custom width/height controls apply combined size and frame-rate limits, admitting
-4K60. Windows and Linux output preserve source shape within the selected ceiling.
+4K60. Advanced video controls now span 1..60 fps and 0.1..50 Mbps while retaining
+the three recommended presets. Windows and Linux output preserve source shape
+within the selected ceiling.
 The [media assessment](./research/native-client-media.md#media-capability-extension-assessment)
 owns local codec, derived-output, SFU, Browser/Native fanout and live-control
 evidence. The macOS geometry implementation still needs SDK compilation and
diff --git a/docs/todo.md b/docs/todo.md
index 29e011f29..534fda8ad 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -27,8 +27,8 @@ Git/PRs own completed history.
   [#462](https://github.com/TNTcraftHIM/Piik/pull/462)'s 256/320 kbps request and
   [#469](https://github.com/TNTcraftHIM/Piik/pull/469)'s 4K request overlap the
   numeric-media candidate; neither PR has been merged. 4K60 is included in
-  candidate admission and still needs route/device acceptance; 40 Mbps needs
-  separate evidence and is not accepted scope. Preserve
+  candidate admission, alongside the tested wider video control range, and still
+  needs route/device acceptance. Preserve
   contributor credit and explain the disposition at integration. Rewrite
   [#459](https://github.com/TNTcraftHIM/Piik/pull/459)'s earlier maintenance scope
   and compatibility claims around the final 2.0 result before integration.
@@ -75,10 +75,11 @@ Implementation needs a concrete useful result within the product model.
   actual output. Numeric request, capability and observation boundaries are now
   separate from implementation admission. Keep receiver, codec/alignment and
   resource budgets intact; opening an output range still needs end-to-end evidence.
-  Review the inherited video operating range: the 15 fps / 2 Mbps source minimum
-  prevents low-rate source requests, while 12 Mbps can constrain 4K60 motion quality.
-  The assessment now has local codec controls beyond both ends; widening the
-  controls still needs complete-route evidence and coherent lower-output limits.
+  The inherited menu-only source range is replaced by 1..60 fps / 0.1..50 Mbps,
+  with coherent lower-output bounds and actual-progress preflight. Local
+  production-codec, source-change and Browser loopback checks pass; full-route
+  acceptance must include the low-rate settings as well as 4K60. The Linux native
+  build and range tests remain pending.
   Keep the audio sender ceiling backed by the existing packet-size evidence.
   Numeric audio and video controls are implemented; the assessment
   owns local capture, codec, derived-output, SFU and bounded mixed-route evidence.
diff --git a/internal/app/nativecapture/protocol_test.go b/internal/app/nativecapture/protocol_test.go
index 1e7806a3d..4774503ea 100644
--- a/internal/app/nativecapture/protocol_test.go
+++ b/internal/app/nativecapture/protocol_test.go
@@ -286,6 +286,9 @@ func TestCaptureTargetIdentityAndAudioScope(t *testing.T) {
 
 func TestVideoProfileUsesTheProductBounds(t *testing.T) {
 	for _, profile := range []VideoProfile{
+		{Width: 1280, Height: 720, Framerate: 1, Bitrate: 100_000, Preference: "balanced"},
+		{Width: 1280, Height: 720, Framerate: 5, Bitrate: 800_000, Preference: "balanced"},
+		{Width: 3840, Height: 2160, Framerate: 60, Bitrate: 50_000_000, Preference: "balanced"},
 		{Width: 854, Height: 480, Framerate: 15, Bitrate: 2_000_000, Preference: "maintain-resolution"},
 		{Width: 1280, Height: 720, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
 		{Width: 1920, Height: 1080, Framerate: 60, Bitrate: 8_000_000, Preference: "maintain-framerate"},
@@ -303,7 +306,7 @@ func TestVideoProfileUsesTheProductBounds(t *testing.T) {
 			t.Fatalf("valid profile rejected: %+v", profile)
 		}
 		for _, output := range ScreenShareOutputs(profile) {
-			if !output.Valid() {
+			if !output.Valid() || output.Bitrate > profile.Bitrate {
 				t.Fatalf("valid source profile produced an invalid output: %+v", output)
 			}
 		}
@@ -321,8 +324,9 @@ func TestVideoProfileUsesTheProductBounds(t *testing.T) {
 		{Width: 3840, Height: 2160, Framerate: 61, Bitrate: 3_000_000, Preference: "balanced"},
 		{Width: 2160, Height: 3840, Framerate: 120, Bitrate: 3_000_000, Preference: "balanced"},
 		{Width: ^uint32(0), Height: ^uint32(0), Framerate: ^uint32(0), Bitrate: 3_000_000, Preference: "balanced"},
-		{Width: 1920, Height: 1080, Framerate: 14, Bitrate: 5_000_000, Preference: "balanced"},
-		{Width: 1920, Height: 1080, Framerate: 30, Bitrate: 12_000_001, Preference: "balanced"},
+		{Width: 1920, Height: 1080, Framerate: 0, Bitrate: 5_000_000, Preference: "balanced"},
+		{Width: 1920, Height: 1080, Framerate: 30, Bitrate: 99_999, Preference: "balanced"},
+		{Width: 1920, Height: 1080, Framerate: 30, Bitrate: 50_000_001, Preference: "balanced"},
 		{Width: 1920, Height: 1080, Framerate: 30, Bitrate: 5_000_000, Preference: "unknown"},
 	} {
 		if profile.Valid() {
diff --git a/internal/app/nativecapture/stream.go b/internal/app/nativecapture/stream.go
index 5490bccb6..82d8962c9 100644
--- a/internal/app/nativecapture/stream.go
+++ b/internal/app/nativecapture/stream.go
@@ -24,7 +24,7 @@ const (
 	maxPreviewBytes     = 192 * 1024
 	maxOutputs          = 6
 	minOutputBitrate    = 1_000 // Codec rate APIs use whole kbps.
-	MaxVideoBitrate     = 12_000_000
+	MaxVideoBitrate     = 50_000_000
 	maxSources          = 1024
 	maxSourceTitleBytes = 4096
 	// Leave room for the control envelope within loopback's 256 KiB message.
@@ -98,7 +98,7 @@ func ScreenShareOutputs(profile VideoProfile) []OutputProfile {
 	return []OutputProfile{
 		{
 			Width: profile.Width / 4 * 2, Height: profile.Height / 4 * 2,
-			Framerate: profile.Framerate, Bitrate: max(150_000, profile.Bitrate/4),
+			Framerate: profile.Framerate, Bitrate: min(profile.Bitrate, max(150_000, profile.Bitrate/4)),
 		},
 		{
 			Width: profile.Width, Height: profile.Height,
@@ -111,8 +111,7 @@ func (profile VideoProfile) Valid() bool {
 	// The source ceiling must also yield a valid half-size output. Preset labels
 	// belong to the UI, not the capture process's numeric resource boundary.
 	return ValidVideoFormat(profile.Width, profile.Height, profile.Framerate) && profile.Width >= 4 && profile.Height >= 4 &&
-		profile.Framerate >= 15 &&
-		profile.Bitrate >= 2_000_000 && profile.Bitrate <= MaxVideoBitrate &&
+		profile.Bitrate >= 100_000 && profile.Bitrate <= MaxVideoBitrate &&
 		validVideoPreference(profile.Preference)
 }
 
diff --git a/internal/app/nativecontrol/session_test.go b/internal/app/nativecontrol/session_test.go
index 8cdc4969c..aebceff7a 100644
--- a/internal/app/nativecontrol/session_test.go
+++ b/internal/app/nativecontrol/session_test.go
@@ -699,8 +699,8 @@ func TestUpdateShareRequiresTheCurrentStrictProfile(t *testing.T) {
 	for _, replace := range [][2]string{
 		{`"width":1920`, `"width":32768`}, {`"width":1920`, `"width":1921`},
 		{`"maxFramerate":30`, `"maxFramerate":120`}, {`"maxFramerate":30`, `"maxFramerate":30.5`},
-		{`"maxFramerate":30`, `"maxFramerate":4294967326`}, {`"maxFramerate":30`, `"maxFramerate":1`},
-		{`"maxBitrate":5000000`, `"maxBitrate":40000000`}, {`"maxBitrate":5000000`, `"maxBitrate":1000`},
+		{`"maxFramerate":30`, `"maxFramerate":4294967326`}, {`"maxFramerate":30`, `"maxFramerate":0.5`},
+		{`"maxBitrate":5000000`, `"maxBitrate":50000001`}, {`"maxBitrate":5000000`, `"maxBitrate":1000`},
 	} {
 		assertOperationFailure(t, session, strings.Replace(valid, replace[0], replace[1], 1))
 	}
diff --git a/native/capture/darwin/main.swift b/native/capture/darwin/main.swift
index 33d5975d9..3bdc12036 100644
--- a/native/capture/darwin/main.swift
+++ b/native/capture/darwin/main.swift
@@ -1517,8 +1517,7 @@ private func videoProfile(_ arguments: [String]) throws -> VideoProfile {
         throw CaptureFailure(description: "invalid video profile arguments")
     }
     guard validVideoFormat(width, height, frameRate), width >= 4, height >= 4,
-          frameRate >= 15,
-          bitrate >= 2_000_000, bitrate <= 12_000_000 else {
+          bitrate >= 100_000, bitrate <= 50_000_000 else {
         throw CaptureFailure(description: "video profile is outside the product bounds")
     }
     return VideoProfile(
@@ -1546,7 +1545,7 @@ private func outputProfiles(_ arguments: [String], start: Int = 23,
               validVideoFormat(width, height, fps),
               width <= (source?.width ?? maxVideoDimension), height <= (source?.height ?? maxVideoDimension),
               fps <= (source?.frameRate ?? 60),
-              bitrate >= 1000, bitrate <= (source?.bitrate ?? 12_000_000) else {
+              bitrate >= 1000, bitrate <= (source?.bitrate ?? 50_000_000) else {
             throw CaptureFailure(description: "output profile is outside source bounds")
         }
         result.append(OutputProfile(width: width, height: height, fps: fps, bitrate: bitrate))
diff --git a/native/capture/linux/main.c b/native/capture/linux/main.c
index f3e06da4b..57cdb9ae1 100644
--- a/native/capture/linux/main.c
+++ b/native/capture/linux/main.c
@@ -402,7 +402,7 @@ static gboolean parse_outputs(int count, char **values, guint start, CaptureRun
         !parse_uint(values[offset + 1], 2, kMaxVideoDimension, &output->profile.width) ||
         !parse_uint(values[offset + 2], 2, kMaxVideoDimension, &output->profile.height) ||
         !parse_uint(values[offset + 3], 1, 60, &output->profile.frame_rate) ||
-        !parse_uint(values[offset + 4], 1000, 12000000, &output->profile.bit_rate) ||
+        !parse_uint(values[offset + 4], 1000, 50000000, &output->profile.bit_rate) ||
         !valid_video_format(output->profile.width, output->profile.height,
                             output->profile.frame_rate)) return FALSE;
   }
@@ -454,8 +454,8 @@ static gboolean parse_profile(int count, char **values, CaptureRun *run,
       !parse_uint(values[9], 0, 63, encoder_index) ||
       !parse_uint(values[11], 1, 16384, &profile->width) ||
       !parse_uint(values[13], 1, 16384, &profile->height) ||
-      !parse_uint(values[15], 15, 60, &profile->frame_rate) ||
-      !parse_uint(values[17], 2000000, 12000000, &profile->bit_rate)) {
+      !parse_uint(values[15], 1, 60, &profile->frame_rate) ||
+      !parse_uint(values[17], 100000, 50000000, &profile->bit_rate)) {
     return FALSE;
   }
   if (!valid_video_format(profile->width, profile->height, profile->frame_rate) ||
diff --git a/native/capture/linux/main.test.c b/native/capture/linux/main.test.c
index e2f3548ac..48c541c5a 100644
--- a/native/capture/linux/main.test.c
+++ b/native/capture/linux/main.test.c
@@ -31,7 +31,7 @@ static void fixture_encoder_class_init(FixtureEncoderClass *klass) {
   object_class->set_property = fixture_set_property;
   object_class->get_property = fixture_get_property;
   g_object_class_install_property(object_class, 1,
-      g_param_spec_uint("bitrate", "Bitrate", "Bitrate in bps", 1000, 12000000,
+      g_param_spec_uint("bitrate", "Bitrate", "Bitrate in bps", 1000, 50000000,
                         3000000, G_PARAM_READWRITE | GST_PARAM_MUTABLE_PLAYING));
 }
 
@@ -177,9 +177,18 @@ static void check_slot_profiles(void) {
   numeric[13] = numeric[25] = "2160";
   numeric[15] = numeric[26] = "60";
   run = (CaptureRun){0};
-  g_assert_false(parse_profile(G_N_ELEMENTS(numeric), numeric, &run, &encoder));
+  g_assert_true(parse_profile(G_N_ELEMENTS(numeric), numeric, &run, &encoder));
   numeric[15] = "30"; // Reject an excessive derived output independently.
   g_assert_false(parse_profile(G_N_ELEMENTS(numeric), numeric, &run, &encoder));
+  const struct { char *fps; char *bitrate; gboolean valid; } rates[] = {
+      {"1", "100000", TRUE}, {"5", "800000", TRUE}, {"60", "50000000", TRUE},
+      {"0", "100000", FALSE}, {"1", "99999", FALSE}, {"60", "50000001", FALSE}};
+  for (guint index = 0; index < G_N_ELEMENTS(rates); ++index) {
+    numeric[15] = numeric[26] = rates[index].fps;
+    numeric[17] = numeric[27] = rates[index].bitrate;
+    run = (CaptureRun){0};
+    g_assert_cmpint(parse_profile(G_N_ELEMENTS(numeric), numeric, &run, &encoder), ==, rates[index].valid);
+  }
   g_assert_false(valid_video_format(G_MAXUINT, G_MAXUINT, G_MAXUINT));
 }
 
diff --git a/native/capture/windows/main.cpp b/native/capture/windows/main.cpp
index 5183bd502..e834e6e02 100644
--- a/native/capture/windows/main.cpp
+++ b/native/capture/windows/main.cpp
@@ -967,8 +967,8 @@ DegradationPreference ParseDegradationPreference(const wchar_t* value) {
 
 void ValidateVideoProfile(const VideoProfile& profile) {
   if (!piik::capture::ValidVideoFormat(profile.width, profile.height, profile.frame_rate) ||
-      profile.width < 4 || profile.height < 4 || profile.frame_rate < 15 ||
-      profile.bit_rate < 2'000'000 || profile.bit_rate > 12'000'000) {
+      profile.width < 4 || profile.height < 4 ||
+      profile.bit_rate < 100'000 || profile.bit_rate > 50'000'000) {
     Fail("argument-profile", "video profile is outside the product bounds");
   }
 }
@@ -982,7 +982,7 @@ void ParseOutputProfiles(ProductArguments& arguments, int first, int count, wcha
     output.frame_rate = ParseIndex(values[index + 3], "argument-output-fps");
     output.bit_rate = ParseIndex(values[index + 4], "argument-output-bitrate");
     if (!piik::capture::ValidVideoFormat(output.width, output.height, output.frame_rate) ||
-        output.bit_rate < 1'000 || output.bit_rate > 12'000'000) {
+        output.bit_rate < 1'000 || output.bit_rate > 50'000'000) {
       Fail("argument-output", "output profile exceeds codec bounds");
     }
     if (arguments.mode == ProductArguments::Mode::video &&
@@ -1277,7 +1277,7 @@ bool SustainsEncodedCadence(const AdaptiveEncoder::Factory& create, ID3D11Device
     if (frame >= warmup_frames && EncoderClock::now() > due + interval * lag) return false;
     if (frame >= warmup_frames && output && !output->access_unit.bytes.empty()) ++delivered;
   }
-  return delivered + lag >= sample_frames;
+  return delivered > 0 && delivered + lag >= sample_frames;
 }
 
 struct VideoEncoderSelection final {
diff --git a/native/capture/windows/output_worker.test.cpp b/native/capture/windows/output_worker.test.cpp
index 1c8f62a16..b2e6e2e8c 100644
--- a/native/capture/windows/output_worker.test.cpp
+++ b/native/capture/windows/output_worker.test.cpp
@@ -268,6 +268,9 @@ void CheckAutoCadenceProbe(ID3D11Device* device) {
   assert(probe(std::chrono::milliseconds(220), false, deadline, true));
   // Sustained slow encoding still fails after warmup.
   assert(!probe(std::chrono::milliseconds(300), false, deadline));
+  profile.frame_rate = 1;
+  assert(!probe(std::chrono::milliseconds(0), true, deadline));
+  assert(probe(std::chrono::milliseconds(0), false, deadline));
   bool expired = false;
   try {
     probe(std::chrono::milliseconds(0), false, EncoderClock::time_point::min());
@@ -400,6 +403,21 @@ void CheckDecodedDisplayArea(ID3D11Device* device) {
 int main() {
   VideoProfile profile{2560, 1440, 60, 12'000'000};
   ValidateVideoProfile(profile);
+  for (const auto& requested : {VideoProfile{1280, 720, 1, 100'000},
+                               VideoProfile{1280, 720, 5, 800'000},
+                               VideoProfile{3840, 2160, 60, 50'000'000}}) {
+    ValidateVideoProfile(requested);
+  }
+  for (const auto& requested : {VideoProfile{1280, 720, 0, 100'000},
+                               VideoProfile{1280, 720, 1, 99'999},
+                               VideoProfile{3840, 2160, 60, 50'000'001}}) {
+    try {
+      ValidateVideoProfile(requested);
+      assert(false);
+    } catch (const GateFailure& error) {
+      assert(error.stage() == "argument-profile");
+    }
+  }
   for (const SIZE size : {SIZE{1920, 1200}, SIZE{720, 1280}, SIZE{4, 4},
                           SIZE{3840, 2160}, SIZE{2160, 3840}, SIZE{3000, 2764}}) {
     ValidateVideoProfile(VideoProfile{static_cast<UINT32>(size.cx), static_cast<UINT32>(size.cy), 60, 3'000'000});
diff --git a/src/client/components/living/QualityPresets.tsx b/src/client/components/living/QualityPresets.tsx
index 0d0302231..92679de4c 100644
--- a/src/client/components/living/QualityPresets.tsx
+++ b/src/client/components/living/QualityPresets.tsx
@@ -2,8 +2,8 @@ import { Fragment, useRef } from "react";
 import { MIN_AUDIO_BITRATE } from "../../../shared/protocol";
 import {
   QUALITY_PROFILES, QUALITY_PROFILE_KEYS, QUALITY_RESOLUTIONS, qualityResolutionEqual,
-  captureFramerateCeiling, supportsCaptureProfile, MIN_VIDEO_FRAMERATE,
-  VIDEO_CAPTURE_LIMITS, type VideoCaptureLimits, type QualityProfileId, type QualityResolution,
+  captureFramerateCeiling, supportsCaptureProfile, MIN_VIDEO_FRAMERATE, MIN_VIDEO_BITRATE,
+  VIDEO_CAPTURE_LIMITS, type VideoCaptureLimits, type QualityProfile, type QualityProfileId, type QualityResolution,
   SCREEN_AUDIO_BITRATES, type ScreenAudioPreset,
 } from "../../media/quality";
 import { useCopy, type CopyKey } from "../../ui/copy";
@@ -108,6 +108,72 @@ const AUDIO_QUALITY_CAPTIONS: Record<ScreenAudioPreset, CopyKey> = {
   "very-high": "host.advanced.audio.veryHigh",
 };
 
+function QualityNumberInput({ value, min, max, step, unit, name, label, disabled, onChange }: {
+  value: number;
+  min: number;
+  max: number;
+  step: number;
+  unit: string;
+  name: string;
+  label: string;
+  disabled: boolean;
+  onChange: (value: number) => void;
+}) {
+  return <label className="lr-input lr-quality-number">
+    <input type="number" inputMode={step < 1 ? "decimal" : "numeric"} name={name} key={value}
+      defaultValue={value} min={min} max={max} step={step} disabled={disabled} aria-label={label}
+      onBlur={event => {
+        const input = event.currentTarget;
+        if (!input.validity.valid || !Number.isFinite(input.valueAsNumber)) {
+          input.value = String(value);
+          return;
+        }
+        if (input.valueAsNumber !== value) onChange(input.valueAsNumber);
+      }}
+      onKeyDown={event => {
+        if (event.key !== "Enter" && event.key !== "Escape") return;
+        event.preventDefault();
+        event.stopPropagation();
+        if (event.key === "Escape") event.currentTarget.value = String(value);
+        event.currentTarget.blur();
+      }} />
+    <span>{unit}</span>
+  </label>;
+}
+
+export function VideoRateControls({ value, limits, disabled, onChange }: {
+  value: QualityProfile;
+  limits: VideoCaptureLimits;
+  disabled: boolean;
+  onChange: (value: Partial<Pick<QualityProfile, "maxFramerate" | "maxBitrate">>) => void;
+}) {
+  const { t, vis } = useCopy();
+  const fpsMax = captureFramerateCeiling(value.resolution, limits);
+  const controls = [
+    { name: "maxFramerate", label: "host.advanced.framerate", icon: "frames", hint: "hint-metric-fps",
+      value: value.maxFramerate, min: MIN_VIDEO_FRAMERATE, max: fpsMax, step: 1, unit: "fps",
+      change: (maxFramerate: number) => onChange({ maxFramerate }) },
+    { name: "maxBitrate", label: "host.advanced.bitrate", icon: "gauge", hint: "hint-metric-bitrate",
+      value: value.maxBitrate / 1_000_000, min: MIN_VIDEO_BITRATE / 1_000_000,
+      max: limits.maxVideoBitrate / 1_000_000, step: 0.1, unit: "Mbps",
+      change: (mbps: number) => onChange({ maxBitrate: Math.round(mbps * 1_000_000) }) },
+  ] as const;
+  return <div className="lr-sharing-limits">
+    {controls.map(control => <div className="lr-door-group" key={control.name}>
+      <span className="lr-door-glyph"><Glyph name={control.icon} size={19} /><Cap k={control.label} /></span>
+      <Tooltip kind={control.hint} text={vis ? undefined : t(control.label)} className="lr-slider-hint">
+        <span className="lr-quality-rate">
+          <input type="range" min={control.min} max={Math.max(control.min, control.max)} step={control.step}
+            value={control.value} disabled={disabled || control.max < control.min} aria-label={t(control.label)}
+            onChange={event => control.change(event.currentTarget.valueAsNumber)} />
+          <QualityNumberInput {...control} label={t(control.label)} disabled={disabled || control.max < control.min}
+            onChange={control.change} />
+        </span>
+      </Tooltip>
+    </div>)}
+  </div>;
+}
+
 export function AudioBitrateControl({ value, max, disabled, onChange }: {
   value: number;
   max: number;
@@ -130,27 +196,9 @@ export function AudioBitrateControl({ value, max, disabled, onChange }: {
     <Tooltip kind="hint-audio-quality" text={vis ? undefined : t("host.audio.bitrateHint", {
       min: String(MIN_AUDIO_BITRATE / 1_000), max: String(max / 1_000),
     })}>
-      <label className="lr-input lr-audio-bitrate">
-        <input type="number" inputMode="numeric" name="audioBitrate" key={value}
-          defaultValue={value / 1_000} min={MIN_AUDIO_BITRATE / 1_000} max={max / 1_000} step={1}
-          disabled={disabled} aria-label={t("host.advanced.audioBitrate")}
-          onBlur={event => {
-            const input = event.currentTarget;
-            if (!input.validity.valid || !Number.isFinite(input.valueAsNumber)) {
-              input.value = String(value / 1_000);
-              return;
-            }
-            if (input.valueAsNumber * 1_000 !== value) onChange(input.valueAsNumber * 1_000);
-          }}
-          onKeyDown={event => {
-            if (event.key !== "Enter" && event.key !== "Escape") return;
-            event.preventDefault();
-            event.stopPropagation();
-            if (event.key === "Escape") event.currentTarget.value = String(value / 1_000);
-            event.currentTarget.blur();
-          }} />
-        <span>kbps</span>
-      </label>
+      <QualityNumberInput value={value / 1_000} min={MIN_AUDIO_BITRATE / 1_000} max={max / 1_000} step={1}
+        name="audioBitrate" unit="kbps" label={t("host.advanced.audioBitrate")}
+        disabled={disabled} onChange={kbps => onChange(kbps * 1_000)} />
     </Tooltip>
   </div>;
 }
diff --git a/src/client/media/quality.ts b/src/client/media/quality.ts
index 2b87315e1..eff1c782c 100644
--- a/src/client/media/quality.ts
+++ b/src/client/media/quality.ts
@@ -23,8 +23,8 @@ export type {
 
 export type QualityProfile = QualitySettings;
 export const STARTUP_VIDEO_ENCODED_FRAMES = 5;
-export const MIN_VIDEO_FRAMERATE = 15;
-export const MIN_VIDEO_BITRATE = 2_000_000;
+export const MIN_VIDEO_FRAMERATE = 1;
+export const MIN_VIDEO_BITRATE = 100_000;
 export interface VideoCaptureLimits {
   maxVideoResolution: QualityResolution;
   maxVideoPixels: number;
@@ -40,7 +40,7 @@ export const VIDEO_CAPTURE_LIMITS: VideoCaptureLimits = {
   maxVideoPixels: 3840 * 2160,
   maxVideoMacroblocksPerSecond: 2_073_600,
   maxVideoFramerate: 60,
-  maxVideoBitrate: 12_000_000,
+  maxVideoBitrate: 50_000_000,
 };
 
 export function videoCaptureLimits(advertised?: Partial<VideoCaptureLimits>): VideoCaptureLimits {
diff --git a/src/client/pages/ControlsPreview.tsx b/src/client/pages/ControlsPreview.tsx
index 88380015d..a603c0286 100644
--- a/src/client/pages/ControlsPreview.tsx
+++ b/src/client/pages/ControlsPreview.tsx
@@ -19,9 +19,9 @@ import { LauncherForm, type AppMode } from "../components/living/LauncherForm";
 import { AppReleaseNotice } from "../components/living/AppReleaseNotice";
 import { useTheaterMode } from "../components/living/use-theater-mode";
 
-import { AudioBitrateControl, QualityPresets, ResolutionControl } from "../components/living/QualityPresets";
+import { AudioBitrateControl, QualityPresets, ResolutionControl, VideoRateControls } from "../components/living/QualityPresets";
 import { RoomCodeInput } from "../components/living/RoomCodeInput";
-import { MAX_SCREEN_AUDIO_BITRATE, VIDEO_CAPTURE_LIMITS, QUALITY_PROFILES, type QualityProfileId, type QualityResolution } from "../media/quality";
+import { MAX_SCREEN_AUDIO_BITRATE, VIDEO_CAPTURE_LIMITS, QUALITY_PROFILES, matchingQualityProfileId, type QualityProfile } from "../media/quality";
 import type { loadCameraPreviews } from "../media/camera-previews";
 import { Tooltip } from "../components/living/Tooltip";
 import { StatusIndicator } from "../components/living/StatusIndicator";
@@ -57,8 +57,7 @@ export function ControlsPreview() {
   const [voiceProcessing, setVoiceProcessing] = useState(true);
   const [microphoneDevice, setMicrophoneDevice] = useState("");
   const [sharingSettings, setSharingSettings] = useState(false);
-  const [resolution, setResolution] = useState<QualityResolution>(QUALITY_PROFILES["1080p30"].resolution);
-  const [audioBitrate, setAudioBitrate] = useState<number>(QUALITY_PROFILES["1080p30"].maxAudioBitrate);
+  const [quality, setQuality] = useState<QualityProfile>(QUALITY_PROFILES["1080p30"]);
   const [launchMode, setLaunchMode] = useState<AppMode>("link");
   const [majorUpdate, setMajorUpdate] = useState(true);
   const releaseVersion = majorUpdate ? "v2.0.0" : "v1.1.0";
@@ -66,7 +65,6 @@ export function ControlsPreview() {
   const [launchSite, setLaunchSite] = useState("");
   const [launchPassword, setLaunchPassword] = useState("");
   const [launchLan, setLaunchLan] = useState("192.0.2.10");
-  const [preset, setPreset] = useState<QualityProfileId | null>("1080p30");
   const [policy, setPolicy] = useState<"open" | "private">("open");
   const [roomPassword, setRoomPassword] = useState(false);
   const [includeCredential, setIncludeCredential] = useState(true);
@@ -119,9 +117,12 @@ export function ControlsPreview() {
           <Btn id="host-stop-share" icon="stop" tone="danger" title="host.stop" cap="host.stop" hint="hint-share-stop" onClick={notify} />
         </div>
         <SharingSettings id="preview-sharing-settings" open={sharingSettings}
-          presets={<QualityPresets selected={preset} onSelect={id => { setPreset(id); setResolution(QUALITY_PROFILES[id].resolution); }} />}
-          picture={<ResolutionControl value={resolution} limits={VIDEO_CAPTURE_LIMITS} disabled={false}
-            onChange={value => { setResolution(value); setPreset(null); }} />}
+          presets={<QualityPresets selected={matchingQualityProfileId(quality)}
+            onSelect={id => setQuality(current => ({ ...QUALITY_PROFILES[id], maxAudioBitrate: current.maxAudioBitrate }))} />}
+          picture={<><ResolutionControl value={quality.resolution} limits={VIDEO_CAPTURE_LIMITS} disabled={false}
+            onChange={resolution => setQuality(current => ({ ...current, resolution }))} />
+            <VideoRateControls value={quality} limits={VIDEO_CAPTURE_LIMITS} disabled={false}
+              onChange={change => setQuality(current => ({ ...current, ...change }))} /></>}
           audio={<><div className="lr-door-group lr-source-audio-settings">
             <SwitchItem checked={sound} onChange={setSound} label={t("host.sourcePicker.systemAudio")}
               hint={sound ? "hint-stop-audio" : "hint-share-audio"} />
@@ -129,8 +130,8 @@ export function ControlsPreview() {
           </div><HostMicrophoneSettings deviceId={microphoneDevice} onDevice={setMicrophoneDevice} loadDevices={previewMicrophones}
             native enabled={microphone} disabled={paused} volume={microphoneVolume} onVolume={setMicrophoneVolume}
             voiceProcessing={voiceProcessing} onVoiceProcessing={setVoiceProcessing} />
-            <AudioBitrateControl value={audioBitrate} max={MAX_SCREEN_AUDIO_BITRATE}
-              disabled={false} onChange={setAudioBitrate} /></>}
+            <AudioBitrateControl value={quality.maxAudioBitrate ?? QUALITY_PROFILES["1080p30"].maxAudioBitrate} max={MAX_SCREEN_AUDIO_BITRATE}
+              disabled={false} onChange={maxAudioBitrate => setQuality(current => ({ ...current, maxAudioBitrate }))} /></>}
         />
       </section>
       <section id="option-preview" className="cp-card">
diff --git a/src/client/pages/HostPage.tsx b/src/client/pages/HostPage.tsx
index 900d69580..d3f9d4152 100644
--- a/src/client/pages/HostPage.tsx
+++ b/src/client/pages/HostPage.tsx
@@ -52,7 +52,7 @@ import type { ComicKind } from "../components/living/Comic";
 import type { HintKind } from "../ui/visual-kinds";
 import type { ComicTone } from "../components/living/comic-presentation";
 import { Tooltip } from "../components/living/Tooltip";
-import { AudioBitrateControl, QualityPresets, ResolutionControl } from "../components/living/QualityPresets";
+import { AudioBitrateControl, QualityPresets, ResolutionControl, VideoRateControls } from "../components/living/QualityPresets";
 import { RoomCodeInput, RoomCodeError } from "../components/living/RoomCodeInput";
 import { MetricCell } from "../components/living/Metrics";
 import {
@@ -130,8 +130,6 @@ import {
   videoCaptureLimits,
   captureFramerateCeiling,
   supportsCaptureProfile,
-  MIN_VIDEO_FRAMERATE,
-  MIN_VIDEO_BITRATE,
   qualityResolutionEqual,
   qualitySettingsEqual,
   qualitySettingsLabel,
@@ -3596,7 +3594,6 @@ export function HostPage({
     ? nativeClientRef.current?.health.nativeMedia.maxAudioBitrate ?? MAX_SCREEN_AUDIO_BITRATE
     : MAX_SCREEN_AUDIO_BITRATE);
   const videoLimits = videoCaptureLimits(nativeActive ? nativeClientRef.current?.health.nativeMedia : undefined);
-  const framerateCeiling = captureFramerateCeiling(advancedQuality.resolution, videoLimits);
 
   return (
     <div className="lr-app">
@@ -3850,65 +3847,8 @@ export function HostPage({
                     maxFramerate: Math.min(advancedQualityRef.current.maxFramerate, captureFramerateCeiling(resolution, videoLimits)),
                   })} />
               </div>
-              <div className="lr-sharing-limits">
-                <div className="lr-door-group">
-                  <span
-                    className="lr-door-glyph"
-                  >
-                    <Glyph name="frames" size={19} />
-                    <Cap k="host.advanced.framerate" />
-                  </span>
-                  <Tooltip kind="hint-metric-fps" text={vis ? undefined : t("host.advanced.framerate")} className="lr-slider-hint">
-                    <span className="lr-slider">
-                      <input
-                        type="range"
-                        min={MIN_VIDEO_FRAMERATE}
-                        max={Math.max(MIN_VIDEO_FRAMERATE, framerateCeiling)}
-                        step={1}
-                        value={advancedQuality.maxFramerate}
-                        disabled={phase === "starting" || switchingSource || framerateCeiling < MIN_VIDEO_FRAMERATE}
-                        aria-label={t("host.advanced.framerate")}
-                        onChange={(event) =>
-                          changeAdvancedQuality({
-                            maxFramerate: Number(event.target.value),
-                          })
-                        }
-                      />
-                      <output>{advancedQuality.maxFramerate} fps</output>
-                    </span>
-                    </Tooltip>
-                </div>
-                <div className="lr-door-group">
-                  <span
-                    className="lr-door-glyph"
-                  >
-                    <Glyph name="gauge" size={19} />
-                    <Cap k="host.advanced.bitrate" />
-                  </span>
-                  <Tooltip kind="hint-metric-bitrate" text={vis ? undefined : t("host.advanced.bitrate")} className="lr-slider-hint">
-                    <span className="lr-slider">
-                      <input
-                        type="range"
-                        min={MIN_VIDEO_BITRATE}
-                        max={Math.max(MIN_VIDEO_BITRATE, videoLimits.maxVideoBitrate)}
-                        step={500000}
-                        value={advancedQuality.maxBitrate}
-                        disabled={phase === "starting" || switchingSource || videoLimits.maxVideoBitrate < MIN_VIDEO_BITRATE}
-                        aria-label={t("host.advanced.bitrate")}
-                        onChange={(event) =>
-                          changeAdvancedQuality({
-                            maxBitrate: Number(event.target.value),
-                          })
-                        }
-                      />
-                      <output>
-                        {(advancedQuality.maxBitrate / 1_000_000).toFixed(1)}{" "}
-                        Mbps
-                      </output>
-                    </span>
-                    </Tooltip>
-                </div>
-              </div>
+              <VideoRateControls value={advancedQuality} limits={videoLimits}
+                disabled={phase === "starting" || switchingSource} onChange={changeAdvancedQuality} />
               <div className="lr-door-group">
                 <span
                   className="lr-door-glyph"
diff --git a/src/client/sfu/publisher.ts b/src/client/sfu/publisher.ts
index 04b3893b2..b279bfd61 100644
--- a/src/client/sfu/publisher.ts
+++ b/src/client/sfu/publisher.ts
@@ -440,7 +440,8 @@ export class SfuPublisher {
     const height = settings?.height ?? ceiling.height;
     const scale = Math.max(1, width / ceiling.width, height / ceiling.height);
     // LiveKit 2.22.1 publishUtils: screen share uses half size, same FPS,
-    // and quarter bitrate with a 150 kbps floor. WebRTC budgets the entire PC.
+    // and quarter bitrate with a 150 kbps floor, bounded by the source ceiling.
+    // WebRTC budgets the entire PC.
     const high = {
       rid: this.layerCount === 2 ? "h" : "q",
       active: this.activeCount >= this.layerCount,
@@ -454,7 +455,7 @@ export class SfuPublisher {
             rid: "q",
             active: this.activeCount > 0,
             scaleResolutionDownBy: 2 * scale,
-            maxBitrate: Math.max(150_000, Math.floor(profile.maxBitrate / 4)),
+            maxBitrate: Math.min(profile.maxBitrate, Math.max(150_000, Math.floor(profile.maxBitrate / 4))),
             maxFramerate: profile.maxFramerate,
           },
           high,
diff --git a/src/client/styles.css b/src/client/styles.css
index 7fd85d532..44e00aa6b 100644
--- a/src/client/styles.css
+++ b/src/client/styles.css
@@ -1176,8 +1176,11 @@ html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #334
 .lr-input:focus-within { border-color: var(--action); outline: 3px solid var(--action); outline-offset: 2px; }
 .lr-input input { min-width: 0; flex: 1; height: 100%; border: 0; outline: 0; background: transparent; font: inherit; font-size: 16px; }
 .lr-input input[type="password"]:not(:placeholder-shown) { letter-spacing: .25em; }
-.lr-input.lr-audio-bitrate { width: 160px; max-width: 100%; font-family: var(--mono); }
-.lr-audio-bitrate span { color: var(--muted); font-size: 12px; }
+.lr-input.lr-quality-number { width: 160px; max-width: 100%; font-family: var(--mono); }
+.lr-quality-number span { color: var(--muted); font-size: 12px; }
+.lr-quality-rate { display: flex; align-items: center; gap: 10px; width: 100%; min-width: 0; }
+.lr-quality-rate > input { flex: 1; min-width: 0; width: 0; height: 32px; accent-color: var(--action); }
+.lr-quality-rate .lr-quality-number { flex: 0 0 132px; min-height: 40px; padding: 6px 10px; }
 .lr-input.lr-video-size { display: grid; grid-template-columns: minmax(0, 1fr) auto minmax(0, 1fr) auto; gap: 4px; padding-inline: 8px; width: 252px; max-width: 100%; font-family: var(--mono); }
 .lr-resolution-controls { display: flex; flex-direction: column; gap: 8px; min-width: 0; }
 .lr-video-size input { width: 100%; padding: 0; text-align: center; appearance: textfield; }
@@ -1835,7 +1838,7 @@ html[data-theme="dark"] .lr-switch::after { background: var(--ink); }
 .lr-sharing-section .lr-door-group { gap: 8px; }
 .lr-sharing-panel .lr-sharing-section .lr-door-glyph { color: var(--muted); }
 .lr-sharing-section .lr-door-glyph .lr-cap { white-space: normal; }
-.lr-sharing-limits { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 16px; }
+.lr-sharing-limits { display: grid; grid-template-columns: 1fr; gap: 16px; }
 .lr-sharing-panel .lr-slider { width: 100%; }
 .lr-sharing-panel .lr-slider output { min-width: 9ch; }
 .lr-sharing-section .lr-tiles { gap: 8px; }
@@ -1854,9 +1857,13 @@ html[data-theme="dark"] .lr-switch::after { background: var(--ink); }
 @container sharing-settings (max-width: 680px) {
   .lr-sharing-panel { padding: 16px; border-radius: 20px; }
   .lr-sharing-columns { grid-template-columns: 1fr; gap: 22px; }
-  .lr-sharing-limits { grid-template-columns: 1fr; }
   .lr-sharing-section + .lr-sharing-section { padding: 20px 0 0; border-inline-start: 0; border-top: 1px solid var(--wall-2); }
 }
+@container sharing-settings (max-width: 260px) {
+  .lr-quality-rate { flex-direction: column-reverse; align-items: stretch; gap: 2px; }
+  .lr-quality-rate > input { flex: auto; width: 100%; margin-inline: 0; }
+  .lr-quality-rate .lr-quality-number { flex: auto; width: 100%; }
+}
 .lr-host-share-controls {
   display: flex; flex-wrap: wrap; align-items: center; justify-content: center; gap: 4px;
   width: fit-content; max-width: 100%; margin: 12px auto 0; padding: 6px;
diff --git a/src/client/webrtc/video-codec-preflight.ts b/src/client/webrtc/video-codec-preflight.ts
index e7c892027..4c49741d0 100644
--- a/src/client/webrtc/video-codec-preflight.ts
+++ b/src/client/webrtc/video-codec-preflight.ts
@@ -235,6 +235,7 @@ export function h264ProbeSustainsTarget(
     const encoded = current.framesEncoded - baseline.framesEncoded;
     const source = current.sourceFrames - baseline.sourceFrames;
     return (
+      source > 0 && encoded > 0 &&
       source + frameLag >= expectedFrames &&
       encoded + frameLag >= expectedFrames &&
       encoded + frameLag >= source
@@ -242,12 +243,12 @@ export function h264ProbeSustainsTarget(
   }
   if (
     current.encodedFramesPerSecond === null ||
-    current.sourceFramesPerSecond === null ||
-    current.sourceFramesPerSecond <= 0
+    current.sourceFramesPerSecond === null
   ) {
     return null;
   }
   return (
+    current.sourceFramesPerSecond > 0 && current.encodedFramesPerSecond > 0 &&
     current.sourceFramesPerSecond + frameLag >= targetFrameRate &&
     current.encodedFramesPerSecond + frameLag >= targetFrameRate &&
     current.encodedFramesPerSecond + frameLag >=
diff --git a/tests/quality.test.ts b/tests/quality.test.ts
index d8e1aecba..c0b89a5e3 100644
--- a/tests/quality.test.ts
+++ b/tests/quality.test.ts
@@ -73,7 +73,7 @@ describe("realtime quality controls", () => {
     expect(captureFramerateCeiling(QUALITY_RESOLUTIONS["720p"], limited)).toBe(60);
     expect(videoCaptureLimits({ maxVideoResolution: { width: 8192, height: 8192 },
       maxVideoPixels: 8192 * 8192, maxVideoMacroblocksPerSecond: 9_000_000,
-      maxVideoFramerate: 120, maxVideoBitrate: 40_000_000 })).toEqual(videoCaptureLimits());
+      maxVideoFramerate: 120, maxVideoBitrate: 100_000_000 })).toEqual(videoCaptureLimits());
     const slower = videoCaptureLimits({ maxVideoFramerate: 30, maxVideoBitrate: 5_000_000 });
     expect(supportsCaptureProfile(QUALITY_PROFILES["1080p30"], slower)).toBe(true);
     expect(supportsCaptureProfile(QUALITY_PROFILES["1080p60"], slower)).toBe(false);
@@ -83,7 +83,8 @@ describe("realtime quality controls", () => {
     const { stream, videoTrack } = createVideoStream();
     const getDisplayMedia = vi.fn(async () => stream);
     vi.stubGlobal("navigator", { mediaDevices: { getDisplayMedia } });
-    for (const change of [{ maxFramerate: 120 }, { maxFramerate: 30.5 }, { maxBitrate: 40_000_000 },
+    for (const change of [{ maxFramerate: 120 }, { maxFramerate: 30.5 }, { maxFramerate: 0 },
+      { maxBitrate: 99_999 }, { maxBitrate: 50_000_001 },
       { resolution: { width: 32768, height: 32768 } }, { maxAudioBitrate: 510_000 }]) {
       const requested = { ...QUALITY_PROFILES["1080p30"], ...change };
       expect(supportsCaptureProfile(requested)).toBe(false);
@@ -94,12 +95,24 @@ describe("realtime quality controls", () => {
     expect(videoTrack.applyConstraints).not.toHaveBeenCalled();
   });
 
+  it("admits useful low-rate and high-rate requests without changing presets", async () => {
+    const { stream, videoTrack } = createVideoStream();
+    for (const [maxFramerate, maxBitrate] of [[1, 100_000], [5, 800_000], [60, 50_000_000]]) {
+      const profile = { ...QUALITY_PROFILES["1080p30"], maxFramerate, maxBitrate };
+      expect(supportsCaptureProfile(profile)).toBe(true);
+      await applyCaptureProfile(stream, profile);
+      expect(videoTrack.applyConstraints).toHaveBeenLastCalledWith(expect.objectContaining({
+        frameRate: { ideal: maxFramerate, max: maxFramerate },
+      }));
+    }
+  });
+
   it("requests 4K60 in either orientation through the existing capture controls", async () => {
     const { stream, videoTrack } = createVideoStream();
     const getDisplayMedia = vi.fn(async () => stream);
     vi.stubGlobal("navigator", { mediaDevices: { getDisplayMedia } });
     for (const resolution of [QUALITY_RESOLUTIONS["4K"], { width: 2160, height: 3840 }]) {
-      const profile = { ...QUALITY_PROFILES["1080p60"], resolution };
+      const profile = { ...QUALITY_PROFILES["1080p60"], resolution, maxBitrate: 50_000_000 };
       expect(supportsCaptureProfile(profile)).toBe(true);
       await captureDisplay(profile);
       expect(getDisplayMedia).toHaveBeenLastCalledWith(expect.objectContaining({
diff --git a/tests/sfu-client.test.ts b/tests/sfu-client.test.ts
index 8d3fffb35..7ef8e9199 100644
--- a/tests/sfu-client.test.ts
+++ b/tests/sfu-client.test.ts
@@ -244,6 +244,23 @@ function feedVideoStats(
 }
 
 describe("embedded SFU browser transport", () => {
+  it.each([100_000, 200_000, 50_000_000])("keeps every simulcast output within the %i bps source ceiling", async (maxBitrate) => {
+    const send = vi.fn(() => true);
+    const host = new SfuPublisher({ send, onDisconnected: vi.fn() });
+    cleanups.push(() => host.disconnect());
+    await host.connect(config);
+    expect(await host.activate(stream(new FakeTrack("video")),
+      { ...QUALITY_PROFILES["1080p30"], maxBitrate, maxFramerate: 5 }, "h264")).toBe(true);
+    const encodings = FakePc.instances[0]!.transceivers[0]!.sender.getParameters().encodings;
+    expect(encodings).toHaveLength(2);
+    expect(encodings[1]!.maxBitrate).toBe(maxBitrate);
+    for (const encoding of encodings) {
+      expect(encoding.maxBitrate).toBeGreaterThan(0);
+      expect(encoding.maxBitrate).toBeLessThanOrEqual(maxBitrate);
+      expect(encoding.maxFramerate).toBe(5);
+    }
+  });
+
   it("uses capture dimensions for simulcast before a generated sender has its first frame", async () => {
     class Generator extends FakeTrack {
       writable = new WritableStream<VideoFrame>();
diff --git a/tests/video-codec-preflight.test.ts b/tests/video-codec-preflight.test.ts
index 17dbfe305..0b3c75e8a 100644
--- a/tests/video-codec-preflight.test.ts
+++ b/tests/video-codec-preflight.test.ts
@@ -59,6 +59,16 @@ describe("H264 sender preflight", () => {
     expect(h264ProbeSustainsTarget(baseline, current, 30)).toBe(false);
   });
 
+  it("requires real progress even when one frame is within the cadence tolerance", () => {
+    for (const [source, encoded, expected] of [[0, 0, false], [1, 0, false], [0, 1, false], [1, 1, true]] as const) {
+      expect(h264ProbeSustainsTarget(sample(), sample({ timestamp: 2_000,
+        sourceFrames: 10 + source, framesEncoded: 10 + encoded }), 1)).toBe(expected);
+      expect(h264ProbeSustainsTarget(sample(), sample({ timestamp: 2_000,
+        sourceFrames: null, framesEncoded: null,
+        sourceFramesPerSecond: source, encodedFramesPerSecond: encoded }), 1)).toBe(expected);
+    }
+  });
+
   it("waits for enough source progress before deciding", () => {
     const baseline = sample();
     const current = sample({

From 06c6960c8ff6d9261bdcd46c0a423aef5acdd2c0 Mon Sep 17 00:00:00 2001
From: AkazaAkalin <478080766@qq.com>
Date: Sat, 10 Oct 2026 19:43:19 +0800
Subject: [PATCH 155/262] fix(linux): select PipeWire node IDs with the path
 property

(cherry picked from commit b10068cd44f7362ae1877f6010c63c74c196dc9c)
---
 docs/todo.md                     | 13 ++++++-------
 native/capture/linux/main.c      | 19 +++++++++++++++----
 native/capture/linux/main.test.c | 13 +++++++++++++
 native/capture/linux/portal.c    |  3 ---
 4 files changed, 34 insertions(+), 14 deletions(-)

diff --git a/docs/todo.md b/docs/todo.md
index 534fda8ad..2aab2404d 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -16,13 +16,12 @@ Git/PRs own completed history.
   Prepare one coherent candidate and stop before publication. Preserve the existing
   product model; evaluate held features against measurable benefit and total complexity
   before accepting a changed contract.
-- [ ] **Linux Portal target identity (#470).** Review of the
-  [contributor fix](https://github.com/TNTcraftHIM/Piik/pull/470) and upstream
-  PipeWire confirms that the current fallback passes a node ID as an object
-  serial. Integrate the fix with attribution, retain serial targeting when
-  available, and use the node-ID selector otherwise. Run the Linux native
-  checks and verify a Portal that omits `pipewire-serial`; this fix is not yet
-  in the candidate.
+- [ ] **Linux Portal target identity acceptance (#470).** The
+  [contributor fix](https://github.com/TNTcraftHIM/Piik/pull/470) is integrated
+  with authorship retained: serial and node-ID targeting remain distinct.
+  Run the candidate's Linux native checks and verify a Portal that omits
+  `pipewire-serial`. Upstream source review confirms the property distinction;
+  contributor device evidence does not replace candidate acceptance.
 - [ ] **Reconcile open PRs with the final candidate.**
   [#462](https://github.com/TNTcraftHIM/Piik/pull/462)'s 256/320 kbps request and
   [#469](https://github.com/TNTcraftHIM/Piik/pull/469)'s 4K request overlap the
diff --git a/native/capture/linux/main.c b/native/capture/linux/main.c
index 57cdb9ae1..01a4fe500 100644
--- a/native/capture/linux/main.c
+++ b/native/capture/linux/main.c
@@ -1136,6 +1136,13 @@ static void append_video_scale(GString *pipeline, const VideoProfile *profile) {
   g_string_append(pipeline, "pixel-aspect-ratio=1/1 ! ");
 }
 
+static char *pipewire_target(const PiikPortalCapture *portal) {
+  // target-object accepts a name or object serial; path accepts a node ID.
+  return portal->target_object != NULL
+      ? g_strdup_printf("target-object=%s", portal->target_object)
+      : g_strdup_printf("path=%u", portal->node_id);
+}
+
 static int capture_video(int count, char **values) {
   CaptureRun run = {.last_input_timestamp = GST_CLOCK_TIME_NONE};
   gboolean encoded = count > 1 && strcmp(values[1], "--encoded-video") == 0;
@@ -1168,10 +1175,14 @@ static int capture_video(int count, char **values) {
         "max-buffers=1 max-bytes=1048576 max-time=0 "
         "caps=video/x-h264,stream-format=byte-stream,alignment=au ! "
         "h264parse ! decodebin ! video/x-raw ! tee name=frames ");
-  } else g_string_append_printf(pipeline_text,
-      "pipewiresrc name=source fd=%d target-object=%s do-timestamp=true ! "
-      "videorate drop-only=true ! video/x-raw,framerate=%u/1 ! tee name=frames ",
-      portal.pipewire_fd, portal.target_object, run.profile.frame_rate);
+  } else {
+    char *target = pipewire_target(&portal);
+    g_string_append_printf(pipeline_text,
+        "pipewiresrc name=source fd=%d %s do-timestamp=true ! "
+        "videorate drop-only=true ! video/x-raw,framerate=%u/1 ! tee name=frames ",
+        portal.pipewire_fd, target, run.profile.frame_rate);
+    g_free(target);
+  }
   for (guint index = 0; index < run.output_count; ++index) {
     const VideoProfile *profile = &run.outputs[index].profile;
     g_string_append_printf(pipeline_text,
diff --git a/native/capture/linux/main.test.c b/native/capture/linux/main.test.c
index 48c541c5a..8ea905433 100644
--- a/native/capture/linux/main.test.c
+++ b/native/capture/linux/main.test.c
@@ -548,8 +548,21 @@ static void check_output_failure_isolation(gboolean post_error) {
   g_mutex_clear(&run->lock);
 }
 
+static void check_pipewire_target_identity(void) {
+  PiikPortalCapture portal = {.node_id = 42};
+  char *target = pipewire_target(&portal);
+  g_assert_cmpstr(target, ==, "path=42");
+  g_free(target);
+
+  portal.target_object = "9001";
+  target = pipewire_target(&portal);
+  g_assert_cmpstr(target, ==, "target-object=9001");
+  g_free(target);
+}
+
 int main(int argc, char **argv) {
   gst_init(&argc, &argv);
+  check_pipewire_target_identity();
   check_encoder_admission_and_control();
   check_bus_error_retains_primary_cause();
   check_slot_profiles();
diff --git a/native/capture/linux/portal.c b/native/capture/linux/portal.c
index 586e8cd8f..4defa3bf4 100644
--- a/native/capture/linux/portal.c
+++ b/native/capture/linux/portal.c
@@ -125,9 +125,6 @@ gboolean piik_portal_capture_open(const char *restore_token,
     piik_portal_capture_close(capture);
     return FALSE;
   }
-  if (capture->target_object == NULL) {
-    capture->target_object = g_strdup_printf("%u", capture->node_id);
-  }
   capture->restore_token = xdp_session_get_restore_token(capture->session);
   return TRUE;
 }

From 22137ef82930e954013db6886dacb546e4487de4 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 14:02:08 +0800
Subject: [PATCH 156/262] docs(media): record low-rate sender acceptance

---
 docs/research/native-client-media.md | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index f37dc5e60..d14b39ec6 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -764,7 +764,10 @@ Native encoded input also produced the expected half-size output at the low and
 high bounds. Each derivation retained its existing input-format generation;
 source changes still retire and replan that optional output through its owner.
 Browser loopback with the real sender controls also delivered decoded progress
-at all three settings and after replacing the 1 fps source. The 1 fps H.264
+at all three settings and after replacing the 1 fps source. At 1 fps / 100 kbps,
+the production Browser HostPeer also delivered to two local receivers through
+ordinary senders and the shared encoding pool, for both H.264 and VP8. This
+bounded check does not cover room routing or physical-network recovery. The 1 fps H.264
 preflight passed; the 4K60 preflight selected VP8 on this machine even though
 explicit H.264 delivered frames. Admission is not a sustained-cadence guarantee.
 
@@ -774,7 +777,8 @@ rejected rather than expanding allocation limits. Large bitrate/low-cadence
 requests are not permission for unbounded frames. These local controls establish
 useful operation and bounded failure, not sustained field quality or complete-route
 performance. Ignored controls and results are under
-`build/candidate-review/four-k60/` (`range-worker.cpp`, `range-browser.js`).
+`build/candidate-review/four-k60/` (`range-worker.cpp`, `range-browser.js`,
+`low-rate-pool.js`).
 
 [WebRTC statistics](https://www.w3.org/TR/webrtc-stats/#dom-rtcicecandidatepairstats-availableoutgoingbitrate)
 describe estimated available capacity, not a configured send-rate ceiling;

From a7a47ce44d7f329b2bdb357305ec6fa3f0507439 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 14:18:44 +0800
Subject: [PATCH 157/262] docs(media): replace stale capture contract details

---
 docs/research/node-local-media-design.md | 42 +++++++++---------------
 1 file changed, 15 insertions(+), 27 deletions(-)

diff --git a/docs/research/node-local-media-design.md b/docs/research/node-local-media-design.md
index 1ccecb116..79aa47218 100644
--- a/docs/research/node-local-media-design.md
+++ b/docs/research/node-local-media-design.md
@@ -492,33 +492,21 @@ selectable only through real codec output and the normal library allocation.
 Configured ceilings are conservative and do not replace bandwidth probing;
 no cache of historical layer rates or additional polling owner is introduced.
 
-### Capture Contract For The Next Implementation
-
-Use the existing LiveKit 2.22.1 screen-share construction as the initial output
-set: original plus half-size at the same FPS, quarter bitrate with its 150 kbps
-floor. Align derived NV12 dimensions down to even values. The group supports up
-to three outputs, but this step does not invent a third product preset.
-
-The private capture command/probe contract advances to v5. Video arguments retain
-the source profile and append one `--output WIDTH HEIGHT FPS BITRATE` per output,
-ordered low to high. All current producers/readers change together, without v4
-fallback. Output profiles are codec bounds, not user preset choices.
-
-SMED v2 has a 32-byte big-endian header: magic[0:4], version[4], kind[5], flags[6],
-layer[7], timestamp100ns[8:16], duration100ns[16:24], width[24:26], height[26:28],
-payload length[28:32]. Video carries its output dimensions. PCM/status dimensions
-and layer are zero. Kind 5 is a zero-payload input-frame begin with dimensions/
-layer/flags zero and a valid source timestamp/duration; it precedes all outputs
-for that input even when the active prefix is zero. Kind 6 reports an unavailable
-output layer with a bounded UTF-8 diagnostic, zero timing/dimensions/flags.
-
-Both pipe directions use this envelope. Kind 7 carries one bounded ASCII control
-command (at most 64 bytes), with all other header fields zero: `Q`, `K layer`
-(`-1` means all outputs), `A activeCount`, `B layer bitrate`. Reuse the existing
-command grammar instead of mixing a line reader with binary video on stdin. Keyframe
-requests consumed at encode start are restored on failure; requests arriving
-during encoding must not be erased when an older keyframe completes. Control
-wakeup is I/O work, not another media-quality scheduler.
+### Capture Boundary
+
+Output construction follows the [media-quality owner](../standards/media-quality.md):
+original plus a half-size output at the same FPS, with lower bitrate bounded by
+the source ceiling. Derived NV12 dimensions round down to even values. The
+group's bounded output slots do not add product presets.
+
+The current [capture reader](../../internal/app/nativecapture/protocol.go) owns
+frame layout, kind-specific validation and allocation limits; [status](../status.md)
+owns the matched bundle's protocol versions. Both pipe directions use that framed
+boundary. Input-frame events precede per-output results, including when no output
+is active; a lower-output failure remains distinct from loss of the source.
+Keyframe requests consumed at encode start are restored on failure; requests
+arriving during encoding must survive an older keyframe completing. Control wakeup
+is I/O work, not another media-quality scheduler.
 
 Every slot owns its encoder/converter. Windows must retain one safe copy of the
 WGC input surface shared by slot workers, not reuse a returned frame-pool texture.

From 4f508d3f5f820a1c5a9a0c15cc9ab9229da8767d Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 14:23:00 +0800
Subject: [PATCH 158/262] docs(guide): align custom quality instructions with
 candidate limits

---
 docs/guide/getting-started.md       | 10 +++++++---
 docs/guide/getting-started.zh-CN.md |  6 ++++--
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/docs/guide/getting-started.md b/docs/guide/getting-started.md
index 9f8d3d559..f6d2e6265 100644
--- a/docs/guide/getting-started.md
+++ b/docs/guide/getting-started.md
@@ -167,10 +167,14 @@ sharing to allow that fallback. The project's online site uses P2P only.
 Open **Sharing settings** below the picture to adjust picture and audio quality.
 
 - Choose a picture preset, or enter width and height under **Resolution ceiling**.
-  Piik preserves the source's proportions within that ceiling. Selecting 4K sets
-  the frame-rate ceiling to at most 30 fps.
+  Piik preserves the source's proportions within that ceiling. 4K supports a
+  frame-rate ceiling of up to 60 fps.
+- Use the sliders or enter a **Frame rate ceiling** from 1 to 60 fps and a
+  **Video bitrate ceiling** from 0.1 to 50 Mbps.
 - Choose an audio preset, or enter an **Audio bitrate limit** from 6 to 320 kbps.
-  Picture and sound still adapt to the source, device and available bandwidth.
+
+The controls reflect the current device's supported limits. Picture and sound
+still adapt to the source, device and available bandwidth.
 
 Piik remembers your applied settings for the next visit. Browser-only use remembers
 them for the current site; opening Piik through an updated App also keeps them
diff --git a/docs/guide/getting-started.zh-CN.md b/docs/guide/getting-started.zh-CN.md
index 82b0d44cc..b26064059 100644
--- a/docs/guide/getting-started.zh-CN.md
+++ b/docs/guide/getting-started.zh-CN.md
@@ -147,9 +147,11 @@ Linux 原生采集还需要[系统组件](../../native/capture/linux/README.md)
 在画面下方打开 **分享设置**，调整画质和音频质量。
 
 - 可选画质预设，也可在 **分辨率上限** 中填写宽和高。画面在上限内保留来源比例；
-  选择 4K 时，帧率上限最高为 30 帧。
+  4K 可搭配最高 60 帧的帧率上限。
+- 可拖动滑块，也可直接填写 1–60 帧的 **帧率上限** 和 0.1–50 Mbps 的 **视频码率上限**。
 - 音频保留三档预设，也可填写 6–320 kbps 的 **音频码率上限**。
-  实际画质和声音仍会根据来源、设备与可用带宽调整。
+
+控件会按当前设备能力限制可选范围。实际画质和声音仍会根据来源、设备与可用带宽调整。
 
 Piik 会记住已应用的设置，供下次使用。仅用浏览器时，设置保存在当前站点；
 通过新版 App 打开时，更换公网邀请网址也能保留设置。

From 462c7d798a834bd9e8a82f258a23c81a74ff3aec Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 16:42:33 +0800
Subject: [PATCH 159/262] test(media): verify live rate limits across native
 and SFU routes

---
 docs/research/native-client-media.md | 19 +++++++++++++++-
 docs/todo.md                         |  9 ++++----
 scripts/app-native-host-gate.ts      | 34 +++++++++++++++++++++++++---
 scripts/embedded-sfu-gate.ts         | 13 +++++++++++
 scripts/embedded-sfu-page.ts         | 13 ++++++++---
 5 files changed, 76 insertions(+), 12 deletions(-)

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index d14b39ec6..9bb42a0ff 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -680,7 +680,7 @@ These local checks do not establish 4K60, physical 4K/game
 capture, sustained device performance, all Browser decoders or all route changes.
 
 The existing SFU gate accepts `PIIK_EMBEDDED_SFU_VIDEO_SIZE=WIDTHxHEIGHT` for a
-bounded 30 fps source; its default 720p15 control remains unchanged. Run
+bounded 60 fps / 50 Mbps source; its default 720p15 control remains unchanged. Run
 `npm run gate:embedded-sfu` with `PIIK_EMBEDDED_SFU_GATE=true`,
 `PIIK_EMBEDDED_SFU_CODEC=h264` and `CHROME_PATH`; add
 `PIIK_EMBEDDED_SFU_DISPLAY=true` for actual tab capture. Synthetic 2160x3840 and
@@ -771,6 +771,23 @@ bounded check does not cover room routing or physical-network recovery. The 1 fp
 preflight passed; the 4K60 preflight selected VP8 on this machine even though
 explicit H.264 delivered frames. Admission is not a sustained-cadence guarantee.
 
+The Windows Native Host gate now exercises the actual numeric UI at 1 fps /
+100 kbps and 60 fps / 50 Mbps with both codecs. Fresh decoded frames retain the
+same Viewer stream through those changes, 4K/custom ceilings, pause, source
+replacement and Viewer recovery. Its generated window is smaller than 4K;
+this establishes ceiling application and continuity, not physical 4K capture.
+The Browser H.264 and VP8 SFU controls use actual 3840x2160 synthetic input at
+60 fps, decode high and lower outputs, retain the connection across both rate
+bounds and audio updates, and recover subscriptions after reload. Positive
+output does not establish sustained 60 fps on arbitrary devices or networks.
+
+The current Linux candidate also passes C11 compilation with warnings as errors
+and the headless GStreamer regressions, including low/high rate admission,
+source geometry, retirement and distinct Portal node-ID/serial targeting.
+This uses GStreamer 1.28.3 and libportal 0.9.1 on an isolated Alpine runner;
+its probe correctly reports no capture without a desktop session. Actual
+Portal capture and platform packaging remain separate checks.
+
 A uniform-noise 4K1/50 Mbps stress input reached the retained 4 MiB access-unit
 guard in both Native codecs; VP8 produced a 6,199,837-byte frame. The output was
 rejected rather than expanding allocation limits. Large bitrate/low-cadence
diff --git a/docs/todo.md b/docs/todo.md
index 2aab2404d..b7f401235 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -19,9 +19,9 @@ Git/PRs own completed history.
 - [ ] **Linux Portal target identity acceptance (#470).** The
   [contributor fix](https://github.com/TNTcraftHIM/Piik/pull/470) is integrated
   with authorship retained: serial and node-ID targeting remain distinct.
-  Run the candidate's Linux native checks and verify a Portal that omits
-  `pipewire-serial`. Upstream source review confirms the property distinction;
-  contributor device evidence does not replace candidate acceptance.
+  Candidate compilation and headless targeting checks pass. Verify an actual
+  Portal that omits `pipewire-serial`; the headless check does not exercise
+  desktop capture.
 - [ ] **Reconcile open PRs with the final candidate.**
   [#462](https://github.com/TNTcraftHIM/Piik/pull/462)'s 256/320 kbps request and
   [#469](https://github.com/TNTcraftHIM/Piik/pull/469)'s 4K request overlap the
@@ -77,8 +77,7 @@ Implementation needs a concrete useful result within the product model.
   The inherited menu-only source range is replaced by 1..60 fps / 0.1..50 Mbps,
   with coherent lower-output bounds and actual-progress preflight. Local
   production-codec, source-change and Browser loopback checks pass; full-route
-  acceptance must include the low-rate settings as well as 4K60. The Linux native
-  build and range tests remain pending.
+  acceptance must include the low-rate settings as well as 4K60.
   Keep the audio sender ceiling backed by the existing packet-size evidence.
   Numeric audio and video controls are implemented; the assessment
   owns local capture, codec, derived-output, SFU and bounded mixed-route evidence.
diff --git a/scripts/app-native-host-gate.ts b/scripts/app-native-host-gate.ts
index 11abe0873..7c64376e8 100644
--- a/scripts/app-native-host-gate.ts
+++ b/scripts/app-native-host-gate.ts
@@ -84,6 +84,7 @@ interface GateResult {
   liveQualityChanged: boolean;
   fourKQualityChanged: boolean;
   customQualityChanged: boolean;
+  rateQualityChanges: number;
   pausedQualityChanged: boolean;
   backgroundProfileRecovery: boolean | null;
   sourceWindowRecovery: boolean | null;
@@ -636,6 +637,7 @@ async function main(): Promise<void> {
     liveQualityChanged: false,
     fourKQualityChanged: false,
     customQualityChanged: false,
+    rateQualityChanges: 0,
     pausedQualityChanged: false,
     backgroundProfileRecovery: mode === "local" && sourceKind === "window" ? false : null,
     sourceWindowRecovery: mode === "local" && sourceKind === "window" ? false : null,
@@ -986,7 +988,7 @@ async function main(): Promise<void> {
         `(() => {
           const resolution = document.querySelector('button.lr-chip[aria-label="1440p"]');
           const preference = document.querySelector('button[name="degradationPreference"][value="maintain-framerate"]');
-          const sliders = [...document.querySelectorAll('.lr-slider input[type="range"]')];
+          const sliders = [...document.querySelectorAll('.lr-quality-rate input[type="range"]')];
           return Boolean(
             resolution && preference && !resolution.disabled && !preference.disabled &&
             sliders.length === 2 && sliders.every((slider) => !slider.disabled)
@@ -1025,7 +1027,7 @@ async function main(): Promise<void> {
       stage = "native-4k-preset";
       await clickHostControl(cdp, host, `document.querySelectorAll('button.lr-tile')[2]`);
       await waitForValue(deadline => evaluate<boolean>(cdp!, host,
-        `document.querySelector('.lr-slider input[type="range"]')?.value === '60' &&
+        `document.querySelector('input[name="maxFramerate"]')?.value === '60' &&
           document.querySelector('.lr-sharing-panel')?.getAttribute('aria-busy') === 'false'`,
         deadline), Boolean, 20_000);
       stage = "native-4k-controls";
@@ -1034,7 +1036,7 @@ async function main(): Promise<void> {
       await evaluate<void>(cdp, host,
         `document.querySelector('button.lr-chip[aria-label="4K"]')?.click()`, Date.now() + 5_000);
       await waitForValue(deadline => evaluate<boolean>(cdp!, host, `(() => {
-        const fps = document.querySelector('.lr-slider input[type="range"]');
+        const fps = document.querySelector('input[name="maxFramerate"]');
         const width = document.querySelector('.lr-video-size input[name="width"]');
         const height = document.querySelector('.lr-video-size input[name="height"]');
         return fps?.max === '60' && fps.value === '60' && width?.value === '3840' && height?.value === '2160';
@@ -1064,6 +1066,31 @@ async function main(): Promise<void> {
             video.getVideoPlaybackQuality().totalVideoFrames >= ${framesBeforeCustom + 10});
         })()`, deadline), Boolean, 20_000);
       await assertVideoCodec(cdp, viewer, actualCodec);
+      stage = "native-rate-range";
+      for (const [fps, mbps] of [[1, 0.1], [60, 50]]) {
+        for (const [name, value] of [["maxFramerate", fps], ["maxBitrate", mbps]] as const) {
+          await evaluate<void>(cdp, host, `(() => {
+            const input = document.querySelector('input[name="${name}"]');
+            if (!input || input.disabled) throw new Error('Rate control is unavailable');
+            input.focus(); input.value = '${value}';
+            if (!input.validity.valid) throw new Error('Rate control rejected the candidate range');
+            input.blur();
+          })()`, Date.now() + 5_000);
+          await waitForValue(deadline => evaluate<boolean>(cdp!, host,
+            `document.querySelector('input[name="${name}"]')?.value === '${value}' &&
+              document.querySelector('.lr-sharing-panel')?.getAttribute('aria-busy') === 'false'`,
+            deadline), Boolean, 20_000);
+        }
+        const before = await evaluate<number>(cdp, viewer,
+          `document.querySelector('video')?.getVideoPlaybackQuality().totalVideoFrames ?? 0`, Date.now() + 5_000);
+        await waitForValue(deadline => evaluate<boolean>(cdp!, viewer, `(() => {
+          const video = document.querySelector('video');
+          return Boolean(video && video.srcObject === window.__piikGateMedia &&
+            video.getVideoPlaybackQuality().totalVideoFrames >= ${before + 3});
+        })()`, deadline), Boolean, 20_000);
+        await assertVideoCodec(cdp, viewer, actualCodec);
+        result.rateQualityChanges += 1;
+      }
       const framesBeforePreference = await evaluate<number>(
         cdp,
         viewer,
@@ -1521,6 +1548,7 @@ async function main(): Promise<void> {
           result.viewerHeight > 0 && result.viewerHeight <= 1440 && result.codecPreserved
         : result.viewerConnected && result.viewerFrames >= 30 &&
         result.qualityControlsEnabled && result.liveQualityChanged && result.fourKQualityChanged && result.customQualityChanged &&
+        result.rateQualityChanges === 2 &&
         result.backgroundProfileRecovery !== false &&
         result.sourceWindowRecovery !== false &&
         result.livePresetChanges === 2 &&
diff --git a/scripts/embedded-sfu-gate.ts b/scripts/embedded-sfu-gate.ts
index 8e5c4feca..b1cb668b8 100644
--- a/scripts/embedded-sfu-gate.ts
+++ b/scripts/embedded-sfu-gate.ts
@@ -104,6 +104,7 @@ async function main(): Promise<void> {
     low: null as { frames: number; width: number; height: number } | null,
     audioEnergy: { high: 0, low: 0, recovered: 0 },
     audioUpdates: [] as Array<{ bitrate: number; frames: number; connectionRetained: boolean; energy: number }>,
+    videoRateUpdates: [] as Array<{ fps: number; bitrate: number; frames: number; connectionRetained: boolean }>,
     audioDiagnostics: null as unknown,
     secondRoom: twoRooms ? { connected: false, framesAfterFirstStopped: 0, audioBefore: 0, audioAfter: 0, stopped: false } : null,
     host: null as Snapshot | null, viewer: null as Snapshot | null,
@@ -297,6 +298,17 @@ async function main(): Promise<void> {
       if (!retained || energy <= previousEnergy) throw new Error("Audio update interrupted the current media connection");
       previousEnergy = energy;
     }
+    result.stage = "numeric-video-rate-update";
+    const videoRates = [[1, 100_000], requestedSize ? [60, 50_000_000] : [15, 2_000_000]];
+    for (const [fps, bitrate] of videoRates) {
+      if (!await call<boolean>(host, `gate.setVideoRates(${fps}, ${bitrate})`)) throw new Error("Numeric video rate update failed");
+      const frames = await call<{ frames: number }>(viewer,
+        `gate.waitForFrames(${result.high!.width}, ${result.high!.height}, 3)`);
+      const after = await call<Snapshot>(viewer, "gate.snapshot()");
+      const retained = after.connectionId === audioConnection && after.committed;
+      result.videoRateUpdates.push({ fps, bitrate, frames: frames.frames, connectionRetained: retained });
+      if (!retained) throw new Error("Video rate update replaced the current media connection");
+    }
     if (displayArm) {
       result.stage = "display-background";
       if (result.host!.capture?.displaySurface !== "browser" || result.host!.visibility !== "hidden") {
@@ -413,6 +425,7 @@ async function main(): Promise<void> {
     (nativeArm || result.stereoSeparationDb?.every(db => db > 20) === true) &&
     result.viewer.audioKbps > 0 && result.audioEnergy.high > 0 && result.audioEnergy.low > result.audioEnergy.high &&
     result.high !== null && result.low !== null && result.audioEnergy.recovered > 0 &&
+    result.videoRateUpdates.length === 2 && result.videoRateUpdates.every(update => update.connectionRetained) &&
     result.publicationRetired && result.subscriptionRecovered && result.pageReloadRecovered && result.cleanup && result.nativeShareStopped &&
     (!displayArm || result.displayLifecycle?.hiddenFrames === 150 && result.displayLifecycle.lowLayerDecoded &&
       result.displayLifecycle.resumed && result.displayLifecycle.replaced) &&
diff --git a/scripts/embedded-sfu-page.ts b/scripts/embedded-sfu-page.ts
index 577878715..123cdeb56 100644
--- a/scripts/embedded-sfu-page.ts
+++ b/scripts/embedded-sfu-page.ts
@@ -199,7 +199,7 @@ async function connect(room: CreateRoomResponse, host: boolean): Promise<void> {
 
 export async function startHost(nativeSource?: { title: string; port: number }, selectedCodec: "vp8" | "h264" = "vp8", display = false, size?: QualitySettings["resolution"]): Promise<CreateRoomResponse> {
   codec = selectedCodec;
-  profile = size ? { ...high, resolution: size, maxFramerate: 30, maxBitrate: 8_000_000 } : high;
+  profile = size ? { ...high, resolution: size, maxFramerate: 60, maxBitrate: 50_000_000 } : high;
   const response = await fetch("/api/rooms", {
     method: "POST", headers: { "Content-Type": "application/json" },
     body: JSON.stringify({ codeEntryPolicy: "private" }),
@@ -342,8 +342,7 @@ export async function audioEnergy(): Promise<number> {
   return await probe();
 }
 
-export async function setAudioBitrate(maxAudioBitrate: number): Promise<boolean> {
-  const next = { ...profile, maxAudioBitrate };
+async function applyProfile(next: QualitySettings): Promise<boolean> {
   if (native) await native.updateShare(shareGeneration, next);
   if (!await hostRoute!.updateProfile(next)) return false;
   profile = next;
@@ -351,6 +350,14 @@ export async function setAudioBitrate(maxAudioBitrate: number): Promise<boolean>
   return true;
 }
 
+export async function setAudioBitrate(maxAudioBitrate: number): Promise<boolean> {
+  return await applyProfile({ ...profile, maxAudioBitrate });
+}
+
+export async function setVideoRates(maxFramerate: number, maxBitrate: number): Promise<boolean> {
+  return await applyProfile({ ...profile, maxFramerate, maxBitrate });
+}
+
 export async function waitForFrames(width: number, height: number, minimumFrames = 15, withinCeiling = false, tolerance = 0) {
   if (!video) throw new Error("Viewer video is unavailable");
   const target = video;

From f7556923fadb9b5f6ba46a9b0e8a7f57071622fd Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 16:46:50 +0800
Subject: [PATCH 160/262] fix(app): retain STUN discovery redundancy without
 NAT prediction

---
 docs/adr/0009-optional-nat-prediction.md      | 12 +++---
 .../adr/0010-cross-platform-client-runtime.md |  5 ++-
 docs/guide/troubleshooting.md                 |  6 +++
 docs/guide/troubleshooting.zh-CN.md           |  5 +++
 docs/research/nat-traversal.md                | 37 +++++++++++++-----
 docs/todo.md                                  |  2 +
 internal/app/app.go                           | 14 ++++---
 internal/app/app_test.go                      |  4 +-
 .../app/mediaedge/candidate_gathering_test.go | 39 +++++++++++++++++++
 tests/nat-prediction.test.ts                  | 10 +++++
 10 files changed, 110 insertions(+), 24 deletions(-)

diff --git a/docs/adr/0009-optional-nat-prediction.md b/docs/adr/0009-optional-nat-prediction.md
index 28d9ad34a..81b61f75a 100644
--- a/docs/adr/0009-optional-nat-prediction.md
+++ b/docs/adr/0009-optional-nat-prediction.md
@@ -25,9 +25,10 @@ connection acquisition reuses the route controller's existing opportunity ledger
    switch defaults on, remains Host-controllable, locks while sharing, and is not
    persisted beyond that share generation.
 2. An enabled Site derives ports 3479 and 3480 from its first ordinary STUN
-   authority on UDP 3478. Public-link App mode instead supplies one ordinary
-   public STUN destination and two fixed public survey destinations; pure LAN
-   mode supplies none. The same share switch and ICE configuration cover every
+   authority on UDP 3478. Public-link App mode supplies three ordinary public
+   STUN destinations, reusing the same set for its prediction survey; disabling
+   prediction retains ordinary discovery redundancy. Pure LAN mode supplies
+   none. The same share switch and ICE configuration cover every
    Browser or Native P2P edge. SFU PeerConnections remain unchanged.
 3. For one ICE gathering generation, the adapter observes only UDP `srflx`
    candidates belonging to the exact three-destination survey set. Browser
@@ -84,8 +85,9 @@ Negative:
 
 - the Browser may still reject synthetic candidates or the NAT may not have a
   matching mapping;
-- enabled P2P connections perform two extra STUN transactions and
-  may add connectivity checks for up to eight adjacent UDP ports;
+- Hosted prediction adds two survey destinations; public-link Apps reuse their
+  ordinary destinations. Prediction may add connectivity checks for up to eight
+  adjacent UDP ports;
 - two endpoint-dependent NATs remain sensitive to candidate scheduling and
   intervening mappings, so room-wide coverage is not a success guarantee; and
 - enabled acquisition can occupy up to four ordinary operation windows when
diff --git a/docs/adr/0010-cross-platform-client-runtime.md b/docs/adr/0010-cross-platform-client-runtime.md
index 1f113fcc8..0a5b17974 100644
--- a/docs/adr/0010-cross-platform-client-runtime.md
+++ b/docs/adr/0010-cross-platform-client-runtime.md
@@ -141,8 +141,9 @@ topologies and makes a saved Site unavailable while another room source runs.
 10. Local mode is one explicit server composition: static current assets,
     memory-only rooms, peer-assisted media, no SQLite or SFU, and localhost plus
     current LAN IPv4 origins. It uses no public discovery by default. Public-link
-    mode adds its temporary HTTPS origin, one ordinary public STUN destination,
-    and two bounded public survey destinations. Site mode consumes that Site's
+    mode adds its temporary HTTPS origin and the bounded public STUN discovery
+    and survey configuration in [ADR-0009](0009-optional-nat-prediction.md).
+    Site mode consumes that Site's
     configured STUN survey. Both feed the same connection-local prediction
     adapter; Native additionally owns its UDP socket and best-effort port mapping.
 11. One App configuration owns the optional Site origin and an optional,
diff --git a/docs/guide/troubleshooting.md b/docs/guide/troubleshooting.md
index 350551cfe..3ee5e3f02 100644
--- a/docs/guide/troubleshooting.md
+++ b/docs/guide/troubleshooting.md
@@ -259,6 +259,12 @@ Routers and providers differ in how they map addresses and admit incoming traffi
 some combinations make direct connections difficult. Firewalls and browser
 policies can also block media. The message alone does not identify the cause.
 
+STUN helps discover an address for direct connections; it does not relay the
+picture. An unreachable STUN service can therefore leave chat working while
+media fails. On self-hosted sites, administrators should check that `STUN_URLS`
+points to reachable UDP services; an HTTP reverse proxy does not forward STUN.
+Compare the diagnostic reports from both peers before assigning the cause.
+
 Try these in order, stopping when the picture arrives:
 
 1. **Retry the viewing page.** Choose **Reconnect** if it is available. If it is
diff --git a/docs/guide/troubleshooting.zh-CN.md b/docs/guide/troubleshooting.zh-CN.md
index 7b499f6ea..fa2db54f3 100644
--- a/docs/guide/troubleshooting.zh-CN.md
+++ b/docs/guide/troubleshooting.zh-CN.md
@@ -217,6 +217,11 @@ NAT（网络地址转换）让多台设备共用一个上网地址。不同路
 外部数据进入的规则不同，有些组合会让设备难以直连。防火墙和浏览器策略也可能阻止媒体连接，
 仅凭这条提示还不能确定具体原因。
 
+STUN 帮助设备发现用于直连的地址，不负责转发画面。STUN 服务不可达时，
+也可能出现聊天正常、媒体连不上的情况。自部署管理员应检查 `STUN_URLS`
+是否指向可达的 UDP 服务；HTTP 反向代理不能转发 STUN。
+请结合双方同一次尝试的诊断报告判断原因。
+
 可以依次尝试，画面恢复后就不必继续：
 
 1. **重新尝试观看连接。** 如果 **重新连接** 可用，先点击；按钮不可用或没有效果时，
diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index b6d53fc49..76f64d622 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1,6 +1,6 @@
 # Browser And Native NAT Traversal
 
-Last reviewed: 2026-10-10
+Last reviewed: 2026-10-11
 
 This document owns evidence for improving direct ICE without adding a
 new relay or a custom transport. The current product contract remains standard
@@ -15,10 +15,9 @@ WebRTC ICE with STUN discovery and bounded SFU fallback.
 - A STUN operator observes the client's source address, source port, request
   time and protocol metadata. It never receives the DTLS-SRTP media path. An
   external STUN endpoint is therefore a metadata dependency, not a media relay.
-- The current `STUN_URLS` wire already accepts a bounded list. Adding an
-  auxiliary STUN destination needs no client compatibility surface, but it has
-  no product value until a valid Browser observation or prediction consumer
-  exists.
+- The current `STUN_URLS` wire already accepts a bounded list. Independent
+  ordinary endpoints can preserve discovery when one destination is unreachable;
+  additional observations alone do not establish better hole punching.
 
 On 2026-08-31, Chrome 151 on Windows gathered a host plus IPv4 srflx candidate
 through the self-hosted STUN endpoint and independently through Cloudflare's
@@ -27,6 +26,25 @@ configured, Chromium emitted one deduplicated srflx candidate. No raw address or
 port was retained. This proves endpoint reachability and candidate
 deduplication; it does not classify the NAT or prove another direct path.
 
+### Public-Link Discovery Redundancy
+
+A v1.9.2 report describes working chat but failed media, with only MiWiFi STUN
+responding on the reporter's network. It supplies neither paired ICE traces nor
+the share's prediction setting. The code confirms a narrower configuration gap:
+disabling prediction also removed both fallback discovery destinations, leaving
+Cloudflare alone. The candidate keeps all three existing destinations in ordinary
+ICE and reuses that set for prediction. It adds no provider, polling, URL ranking,
+fallback transport or new configuration surface; Local LAN remains unchanged.
+
+On 2026-10-11, local Chromium gathered a server-reflexive candidate from each
+destination independently and from the combined list. Some `701` error events
+coexisted with valid candidates, so an error event alone cannot establish complete
+discovery failure. Native regression checks confirm a healthy destination returns
+without waiting for silent UDP or unresolved DNS, and cancellation retires the
+survey. These controls do not reproduce the reporter's network or establish its
+final connection cause. The [WebRTC event specification](https://www.w3.org/TR/webrtc/#rtcicecandidateerrorevent)
+owns error semantics; compare the attempt's gathered and selected candidates too.
+
 ### SFU Behind Server NAT
 
 An isolated Linux kernel-NAT control on 2026-10-09 places the current Server
@@ -88,10 +106,11 @@ supports an opt-in mechanism, not a default or a participant-wide classifier.
 
 ## Current Decision
 
-An ordinary STUN endpoint remains the discovery service. A Site may enable
-same-host STUN-only listeners on 3479 and 3480. Public-link App mode supplies
-one ordinary public endpoint plus two public survey destinations; pure LAN mode
-supplies none. Available authorities expose the same per-share Host switch,
+Ordinary STUN remains the discovery service. A Site may enable same-host
+STUN-only listeners on 3479 and 3480. Public-link App mode supplies three ordinary
+public destinations and reuses them for prediction, so disabling prediction
+does not remove discovery redundancy; pure LAN mode supplies none.
+Available authorities expose the same per-share Host switch,
 which defaults on and remains locked while sharing.
 
 The accepted adapter is deliberately connection-local and additive. It waits for a
diff --git a/docs/todo.md b/docs/todo.md
index b7f401235..3180f055b 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -155,6 +155,8 @@ of a reporter's cause; research owns the completed experiments and their limits.
 - [ ] **No available media route.** Compare the same endpoints/networks before
   assigning a regression since v1.4. Obtain paired Host/Viewer/App reports and
   distinguish route allocation, ICE, first-frame admission and route rejection.
+  Retest the public-invitation STUN report with ordinary discovery redundancy;
+  its endpoint timeout results lack paired ICE traces and the prediction setting.
   [#443](https://github.com/TNTcraftHIM/Piik/issues/443) lacks a connected Native
   edge and its paired Viewer/App transport report;
   [#448](https://github.com/TNTcraftHIM/Piik/issues/448) only reaches route allocation.
diff --git a/internal/app/app.go b/internal/app/app.go
index e112ad100..a9bd6859a 100644
--- a/internal/app/app.go
+++ b/internal/app/app.go
@@ -33,10 +33,10 @@ import (
 )
 
 const (
-	DefaultLocalPort            = 8787
-	publicSTUNURL               = "stun:stun.cloudflare.com:3478"
-	publicNATPredictionSTUNURLA = "stun:stun.miwifi.com:3478"
-	publicNATPredictionSTUNURLB = "stun:stun.chat.bilibili.com:3478"
+	DefaultLocalPort       = 8787
+	publicSTUNURL          = "stun:stun.cloudflare.com:3478"
+	publicFallbackSTUNURLA = "stun:stun.miwifi.com:3478"
+	publicFallbackSTUNURLB = "stun:stun.chat.bilibili.com:3478"
 	// localShutdownTimeout bounds the ordered Local stop. The packaged smoke
 	// allows 10 s between the stop request and the exit, so it stays well
 	// inside that budget.
@@ -653,12 +653,14 @@ func discoverNativeMedia(ctx context.Context, configuredPath string) nativeRunti
 // has a public path, so only --link configures public STUN and the bounded NAT
 // prediction survey. Native edges receive ICE configuration from that authority;
 // serverconfig.Local deliberately does not inherit Hosted environment settings.
+// All three destinations also serve ordinary discovery: disabling prediction
+// must not make public-link ICE depend on a single STUN operator.
 func localSTUNURLs(link bool) (stunURLs []string, natPredictionSTUNURLs []string) {
 	if !link {
 		return nil, nil
 	}
-	return []string{publicSTUNURL},
-		[]string{publicNATPredictionSTUNURLA, publicNATPredictionSTUNURLB}
+	return []string{publicSTUNURL, publicFallbackSTUNURLA, publicFallbackSTUNURLB},
+		[]string{publicFallbackSTUNURLA, publicFallbackSTUNURLB}
 }
 
 // endLocalServer is step 1 of the ADR-0010 item 12 unwind: every room ends,
diff --git a/internal/app/app_test.go b/internal/app/app_test.go
index 885abf1a4..88f90a8ec 100644
--- a/internal/app/app_test.go
+++ b/internal/app/app_test.go
@@ -712,9 +712,9 @@ func TestLocalServerOwnsItsSTUNConfiguration(t *testing.T) {
 		{name: "local"},
 		{
 			name: "link", link: true,
-			stunURLs: []string{publicSTUNURL},
+			stunURLs: []string{publicSTUNURL, publicFallbackSTUNURLA, publicFallbackSTUNURLB},
 			natPredictionSTUNURLs: []string{
-				publicNATPredictionSTUNURLA, publicNATPredictionSTUNURLB,
+				publicFallbackSTUNURLA, publicFallbackSTUNURLB,
 			},
 		},
 	} {
diff --git a/internal/app/mediaedge/candidate_gathering_test.go b/internal/app/mediaedge/candidate_gathering_test.go
index 694fd2a0d..2c8a132a8 100644
--- a/internal/app/mediaedge/candidate_gathering_test.go
+++ b/internal/app/mediaedge/candidate_gathering_test.go
@@ -169,3 +169,42 @@ func TestSurveyReturnsWhenEveryDestinationAlreadyFailed(t *testing.T) {
 		t.Fatalf("completed failure retained its survey timer: %v", elapsed)
 	}
 }
+
+func TestSurveyHealthySTUNDoesNotWaitForSilentDestination(t *testing.T) {
+	engine, err := NewEngine(EngineOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = engine.Close() })
+	socket := testICESocket(t, engine)
+	silent, err := net.ListenUDP("udp4", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = silent.Close() })
+	servers := []webrtc.ICEServer{{URLs: []string{
+		"stun:" + silent.LocalAddr().String(), localSurveyServer(t),
+	}}}
+	observations := make(chan mappedAddress, 1)
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		socket.surveySTUN(ctx, servers, func(mapped mappedAddress) { observations <- mapped })
+	}()
+	select {
+	case mapped := <-observations:
+		if mapped.port != socket.localPort {
+			t.Fatal("fallback STUN did not observe the media socket")
+		}
+	case <-time.After(time.Second):
+		t.Fatal("healthy fallback waited for the silent STUN destination")
+	}
+	cancel()
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("retired survey kept waiting for the silent destination")
+	}
+}
diff --git a/tests/nat-prediction.test.ts b/tests/nat-prediction.test.ts
index 84db6e3ac..bd9587c41 100644
--- a/tests/nat-prediction.test.ts
+++ b/tests/nat-prediction.test.ts
@@ -149,6 +149,16 @@ describe("NAT prediction ICE adapter", () => {
     expect(natPredictionSurveyUrls(servers)).toEqual(new Set());
   });
 
+  it("retains ordinary fallback discovery independently of prediction", () => {
+    const urls = ["stun:primary.test:3478", "stun:fallback-a.test:3478", "stun:fallback-b.test:3478"];
+    const servers = [{ urls }];
+    const auxiliary = urls.slice(1);
+    for (const enabled of [false, true]) {
+      expect(iceServersWithNatPrediction(servers, enabled, auxiliary)).toEqual(servers);
+    }
+    expect(natPredictionSurveyUrls(servers, auxiliary)).toEqual(new Set(urls));
+  });
+
   it.each([
     ["stun:Share.TEST", "stun:share.test:3478"],
     ["STUN:Share.TEST:03478", "stun:share.test:3478"],

From 09fd1c29f1cbca3c3f745371b36bb5eef889fe4c Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 16:59:04 +0800
Subject: [PATCH 161/262] test(media): isolate candidate diagnostic logging

---
 internal/app/mediaedge/edge.go            | 6 +++---
 internal/app/mediaedge/edge_debug_test.go | 6 ++----
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/internal/app/mediaedge/edge.go b/internal/app/mediaedge/edge.go
index 9caf9617d..38bfa51b9 100644
--- a/internal/app/mediaedge/edge.go
+++ b/internal/app/mediaedge/edge.go
@@ -432,7 +432,7 @@ func (edge *Edge) Close() error {
 	edge.pendingCandidates = nil
 	edge.mu.Unlock()
 	if edge.local && slog.Default().Enabled(edge.engine.ctx, slog.LevelDebug) {
-		logLocalMediaCandidateCounts(edge.connection.GetStats())
+		logLocalMediaCandidateCounts(slog.Default(), edge.connection.GetStats())
 	}
 	err := edge.transport.Close()
 	edge.socket.close()
@@ -444,7 +444,7 @@ func (edge *Edge) Close() error {
 	return err
 }
 
-func logLocalMediaCandidateCounts(report webrtc.StatsReport) {
+func logLocalMediaCandidateCounts(logger *slog.Logger, report webrtc.StatsReport) {
 	for _, direction := range []webrtc.StatsType{webrtc.StatsTypeLocalCandidate, webrtc.StatsTypeRemoteCandidate} {
 		for _, kind := range []webrtc.ICECandidateType{webrtc.ICECandidateTypeHost, webrtc.ICECandidateTypeSrflx, webrtc.ICECandidateTypePrflx, webrtc.ICECandidateTypeRelay} {
 			udp, tcp := 0, 0
@@ -460,7 +460,7 @@ func logLocalMediaCandidateCounts(report webrtc.StatsReport) {
 					tcp++
 				}
 			}
-			slog.Debug("piik-client", "event", "media-candidate-counts", "local", true,
+			logger.Debug("piik-client", "event", "media-candidate-counts", "local", true,
 				"direction", string(direction), "type", kind.String(), "udp", udp, "tcp", tcp)
 		}
 	}
diff --git a/internal/app/mediaedge/edge_debug_test.go b/internal/app/mediaedge/edge_debug_test.go
index 419fc5c14..c8930f283 100644
--- a/internal/app/mediaedge/edge_debug_test.go
+++ b/internal/app/mediaedge/edge_debug_test.go
@@ -12,10 +12,8 @@ import (
 
 func TestLocalMediaCandidateCountsExcludePrivateFields(t *testing.T) {
 	var output bytes.Buffer
-	previous := slog.Default()
-	slog.SetDefault(slog.New(slog.NewJSONHandler(&output, &slog.HandlerOptions{Level: slog.LevelDebug})))
-	defer slog.SetDefault(previous)
-	logLocalMediaCandidateCounts(webrtc.StatsReport{
+	logger := slog.New(slog.NewJSONHandler(&output, &slog.HandlerOptions{Level: slog.LevelDebug}))
+	logLocalMediaCandidateCounts(logger, webrtc.StatsReport{
 		"private-local": webrtc.ICECandidateStats{
 			ID: "private-local", Type: webrtc.StatsTypeLocalCandidate,
 			CandidateType: webrtc.ICECandidateTypeHost, Protocol: "udp",

From 1dbfa207c3bb4fb20de59692d7454d67a574ae00 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 17:15:41 +0800
Subject: [PATCH 162/262] test(capture): align macOS admission checks with
 input ownership

Keep raw SPS and reference-storage validation at the shared Go input boundary. Check CoreMedia's visible format without assuming it preserves uncropped SPS dimensions, and retain both compiler output streams on packaging failures.
---
 docs/research/nat-traversal.md       |  4 +++-
 docs/research/native-client-media.md | 20 +++++++++++++++-----
 docs/todo.md                         | 16 ++++++++--------
 native/capture/darwin/README.md      |  6 ++++--
 native/capture/darwin/main.swift     | 17 ++++++++++++-----
 scripts/assemble-app.mjs             |  2 +-
 scripts/check-go.mjs                 |  2 +-
 scripts/package-app-candidate.mjs    |  2 +-
 8 files changed, 45 insertions(+), 24 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 76f64d622..23d2e6b4f 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -39,7 +39,9 @@ fallback transport or new configuration surface; Local LAN remains unchanged.
 On 2026-10-11, local Chromium gathered a server-reflexive candidate from each
 destination independently and from the combined list. Some `701` error events
 coexisted with valid candidates, so an error event alone cannot establish complete
-discovery failure. Native regression checks confirm a healthy destination returns
+discovery failure. The pinned Pion STUN client also received and decoded
+`XOR-MAPPED-ADDRESS` from each destination; the fallback is not Browser-only.
+Native regression checks confirm a healthy destination returns
 without waiting for silent UDP or unresolved DNS, and cancellation retires the
 survey. These controls do not reproduce the reporter's network or establish its
 final connection cause. The [WebRTC event specification](https://www.w3.org/TR/webrtc/#rtcicecandidateerrorevent)
diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 9bb42a0ff..9b9fdefa1 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -1,6 +1,6 @@
 # Native App Media Evidence
 
-- Reviewed: 2026-10-06
+- Reviewed: 2026-10-11
 - Scope: platform capture, shared encoded sources, Pion transport and Browser
   decode; current behavior belongs to [media quality](../standards/media-quality.md)
 - Status: Windows physical native Host and Viewer gates passed; current macOS
@@ -776,10 +776,20 @@ The Windows Native Host gate now exercises the actual numeric UI at 1 fps /
 same Viewer stream through those changes, 4K/custom ceilings, pause, source
 replacement and Viewer recovery. Its generated window is smaller than 4K;
 this establishes ceiling application and continuity, not physical 4K capture.
-The Browser H.264 and VP8 SFU controls use actual 3840x2160 synthetic input at
-60 fps, decode high and lower outputs, retain the connection across both rate
-bounds and audio updates, and recover subscriptions after reload. Positive
-output does not establish sustained 60 fps on arbitrary devices or networks.
+The Browser H.264 and VP8 SFU controls request 60 fps from actual 3840x2160
+synthetic input, decode high and lower outputs, retain the connection across
+both rate bounds and audio updates, and recover subscriptions after reload.
+Native WGC-to-SFU controls also pass both codecs and rate changes with the same
+connection; their source is smaller than 4K. Positive output does not establish
+sustained 60 fps on arbitrary devices or networks.
+
+A 3840x2160/60 Browser-to-Native fanout control failed the existing 30 fps
+performance threshold: its source produced about 32..33 fps and the two Viewers
+about 27 fps. A separate functional continuation retained that negative result
+and passed live quality changes, pause/resume, source-audio replacement and
+App-exit recovery. That run measured about 41 and 37 fps at the Viewers, still
+below the requested 60 fps. The controls establish continuity on this machine,
+not sustained 4K60 cadence; they do not justify custom quality floors or resets.
 
 The current Linux candidate also passes C11 compilation with warnings as errors
 and the headless GStreamer regressions, including low/high rate admission,
diff --git a/docs/todo.md b/docs/todo.md
index 3180f055b..3a0cc64a9 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -27,7 +27,7 @@ Git/PRs own completed history.
   [#469](https://github.com/TNTcraftHIM/Piik/pull/469)'s 4K request overlap the
   numeric-media candidate; neither PR has been merged. 4K60 is included in
   candidate admission, alongside the tested wider video control range, and still
-  needs route/device acceptance. Preserve
+  needs physical device/network acceptance. Preserve
   contributor credit and explain the disposition at integration. Rewrite
   [#459](https://github.com/TNTcraftHIM/Piik/pull/459)'s earlier maintenance scope
   and compatibility claims around the final 2.0 result before integration.
@@ -76,18 +76,18 @@ Implementation needs a concrete useful result within the product model.
   resource budgets intact; opening an output range still needs end-to-end evidence.
   The inherited menu-only source range is replaced by 1..60 fps / 0.1..50 Mbps,
   with coherent lower-output bounds and actual-progress preflight. Local
-  production-codec, source-change and Browser loopback checks pass; full-route
-  acceptance must include the low-rate settings as well as 4K60.
+  production-codec, source-change, Browser loopback, Native Host and SFU checks
+  cover both rate bounds. Preserve these checks in final package acceptance.
   Keep the audio sender ceiling backed by the existing packet-size evidence.
   Numeric audio and video controls are implemented; the assessment
   owns local capture, codec, derived-output, SFU and bounded mixed-route evidence.
   Remaining receiver acceptance needs physical limited decoders and camera
   orientation behavior, beyond the bounded SDP-limit and mixed-route controls.
-  Browser display capture, Browser relay and Browser-to-Native fanout now have
-  bounded high-resolution evidence. macOS geometry SDK/hardware checks and
-  physical 4K/game capture remain open. Repeat live Native-to-Browser, derived
-  relay and SFU checks at 4K60; local codec and Browser loopback success does not
-  establish sustained full-route performance. Preserve safety limits and
+  Browser display capture, Browser relay, Browser-to-Native fanout and SFU have
+  bounded high-resolution continuity evidence. macOS geometry SDK/hardware
+  checks and physical 4K/game capture remain open. The fanout controls did not
+  establish sustained 60 fps; retain that performance limit when arranging
+  device/network acceptance. Preserve safety limits and
   framework-owned adaptation. The
   [audio controls](./research/browser-screen-audio-quality.md#numeric-bitrate-assessment)
   retain explicit receive-limit enforcement and the current 320 kbps sender
diff --git a/native/capture/darwin/README.md b/native/capture/darwin/README.md
index a2cf08487..a72a03dce 100644
--- a/native/capture/darwin/README.md
+++ b/native/capture/darwin/README.md
@@ -20,8 +20,10 @@ sh native/capture/darwin/build.sh /outside/repository/build
 ```
 
 `--geometry-self-test` checks content cropping, Retina scaling and rejection of
-invalid frame geometry, plus H.264 visible/coded-size admission, without requiring
-a hardware encoder. `--self-test`
+invalid frame geometry, plus H.264 format/aperture admission, without requiring
+a hardware encoder. Go validates every raw SPS's coded size and reference budget
+before sending encoded input to the helper; CoreMedia can normalize SPS cropping
+in its format description. `--self-test`
 encodes successive landscape, portrait, ultrawide and small 420v buffers through
 one output worker, requiring the fitted dimensions and a constrained-baseline
 SPS/PPS/IDR after each size change. Neither needs Screen Recording permission.
diff --git a/native/capture/darwin/main.swift b/native/capture/darwin/main.swift
index 3bdc12036..8e7899a86 100644
--- a/native/capture/darwin/main.swift
+++ b/native/capture/darwin/main.swift
@@ -1184,10 +1184,15 @@ private func geometrySelfTest() throws {
         CGRect(x: 0, y: 0, width: 3840, height: 2160) else {
         throw CaptureFailure(description: "H.264 visible aperture self-test failed")
     }
-    let oversized = Data([0x67, 0x42, 0xc0, 0x33, 0xda, 0x00, 0xf0, 0x01,
-                          0xe1, 0xf8, 0x03, 0x49, 0x40])
+    // Uncropped 4096x2160 exceeds the visible-picture budget. Raw SPS storage
+    // and reference counts are validated by Go before reaching this process;
+    // CoreMedia can fold SPS cropping into its reported format dimensions.
+    let oversized = Data([0x67, 0x42, 0xc0, 0x33, 0xdc, 0x01, 0x00, 0x01,
+                          0x0f, 0xb0, 0x16, 0xa0, 0x20, 0x20, 0x28, 0x00,
+                          0x00, 0x03, 0x00, 0x08, 0x00, 0x00, 0x03, 0x00,
+                          0x14, 0x78, 0xc1, 0x9c])
     guard (try? h264InputFormat(sps: oversized, pps: pps)) == nil else {
-        throw CaptureFailure(description: "H.264 crop concealed oversized storage")
+        throw CaptureFailure(description: "H.264 oversized visible picture was accepted")
     }
 }
 
@@ -1660,14 +1665,16 @@ private func h264InputFormat(sps: Data, pps: Data) throws -> CMVideoFormatDescri
     }
     try require(status, "decode-h264-format")
     guard let format else { throw CaptureFailure(description: "missing input format") }
+    // Go owns raw SPS storage/reference admission. CoreMedia may report a
+    // crop-normalized format; check that description and its aperture here.
     let dimensions = CMVideoFormatDescriptionGetDimensions(format)
     let width = Int(dimensions.width), height = Int(dimensions.height)
     guard width >= 2, width <= maxCodedVideoDimension, width % 2 == 0,
           height >= 2, height <= maxCodedVideoDimension, height % 2 == 0,
           width * height <= maxCodedVideoPixels else {
-        throw CaptureFailure(description: "decoded input storage exceeds its bound")
+        throw CaptureFailure(description: "decoded input format dimensions exceed their bound")
     }
-    // Encoded dimensions include padding; the clean aperture owns visible size.
+    // The clean aperture owns visible size when the format retains padding.
     let area = CMVideoFormatDescriptionGetCleanAperture(format, originIsAtTopLeft: true)
     let bounds = CGRect(x: 0, y: 0, width: width, height: height)
     guard area.minX.isFinite, area.minY.isFinite, area.width.isFinite, area.height.isFinite,
diff --git a/scripts/assemble-app.mjs b/scripts/assemble-app.mjs
index d7f337cc3..c42cc2707 100644
--- a/scripts/assemble-app.mjs
+++ b/scripts/assemble-app.mjs
@@ -40,7 +40,7 @@ function run(command, args, cwd, environment = process.env) {
   });
   if (result.error) throw result.error;
   if (result.status !== 0) {
-    fail(`${command} failed: ${(result.stderr || result.stdout).trim()}`);
+    fail(`${command} failed: ${[result.stdout, result.stderr].filter(Boolean).join("\n").trim()}`);
   }
   return result.stdout.trim();
 }
diff --git a/scripts/check-go.mjs b/scripts/check-go.mjs
index b84d1b65b..efcccaf25 100644
--- a/scripts/check-go.mjs
+++ b/scripts/check-go.mjs
@@ -38,7 +38,7 @@ function run(command, args, options = {}) {
   if (result.error) throw result.error;
   if (result.status !== 0) {
     const detail = options.capture
-      ? (result.stderr || result.stdout).trim()
+      ? [result.stdout, result.stderr].filter(Boolean).join("\n").trim()
       : "";
     throw new Error(`${basename(command)} failed${detail ? `: ${detail}` : ""}`);
   }
diff --git a/scripts/package-app-candidate.mjs b/scripts/package-app-candidate.mjs
index ac8affc01..605ad1d8e 100644
--- a/scripts/package-app-candidate.mjs
+++ b/scripts/package-app-candidate.mjs
@@ -36,7 +36,7 @@ function run(command, args, cwd) {
   });
   if (result.error) throw result.error;
   if (result.status !== 0) {
-    fail(`${basename(command)} failed: ${(result.stderr || result.stdout).trim()}`);
+    fail(`${basename(command)} failed: ${[result.stdout, result.stderr].filter(Boolean).join("\n").trim()}`);
   }
   if (result.stderr) process.stderr.write(result.stderr);
   return result.stdout.trim();

From 8207606b7a98cdbb80d9b99e98c423e432fb5a18 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 17:31:14 +0800
Subject: [PATCH 163/262] fix(build): retain newer Windows compiler runtime
 when linking

---
 native/capture/windows/README.md      |  5 ++++-
 native/capture/windows/build.ps1      | 14 +++++++++++++-
 native/capture/windows/get-webrtc.ps1 |  1 +
 3 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/native/capture/windows/README.md b/native/capture/windows/README.md
index 51f7dd64e..76aac48f0 100644
--- a/native/capture/windows/README.md
+++ b/native/capture/windows/README.md
@@ -83,7 +83,10 @@ the old fixed one-frame VBV override is removed so later bitrate increases are
 not trapped by the original buffer limit.
 
 The build caches the pinned WebRTC SDK and matching official MSVC linker/runtime
-libraries under `build/encoder-pool`. The SDK supplies libvpx, replacing the
+libraries under `build/encoder-pool`. A newer installed MSVC keeps its own linker
+and runtime; older installations use that pinned minimum, following
+[Microsoft's binary compatibility rule](https://learn.microsoft.com/en-us/cpp/porting/binary-compat-2015-2017).
+The SDK supplies libvpx, replacing the
 separate source build. Only statically linked code and required notices enter
 the package, not the SDK/toolchain or another runtime service.
 
diff --git a/native/capture/windows/build.ps1 b/native/capture/windows/build.ps1
index 2a39a4098..a79838539 100644
--- a/native/capture/windows/build.ps1
+++ b/native/capture/windows/build.ps1
@@ -36,7 +36,19 @@ $includeFlags = @('', 'third_party\abseil-cpp', 'third_party\boringssl\src\inclu
 }
 $compileFlags = '/nologo /c /std:c++20 /EHsc /GR /O2 /W4 /WX /MT /D_ITERATOR_DEBUG_LEVEL=0 /DUNICODE /D_UNICODE /DWIN32_LEAN_AND_MEAN /D_WIN32_WINNT=0x0A00 /DNTDDI_VERSION=0x0A00000A /external:W0 ' + ($includeFlags -join ' ')
 $systemLibraries = 'ole32.lib mmdevapi.lib runtimeobject.lib user32.lib gdi32.lib dwmapi.lib shell32.lib mfplat.lib mf.lib mfuuid.lib d3d11.lib d2d1.lib dxgi.lib dxguid.lib evr.lib oleaut32.lib windowsapp.lib winmm.lib ws2_32.lib strmiids.lib crypt32.lib dmoguids.lib iphlpapi.lib msdmo.lib secur32.lib wmcodecdspuuid.lib'
-$linkCommand = '"{0}" /nologo /libpath:"{1}"' -f $webrtc.Linker,$webrtc.RuntimeLibraries
+# The linker and CRT must be at least as new as every input's toolchain.
+# Keep the pinned WebRTC minimum for older local installations, but do not
+# override a newer compiler's runtime on current Visual Studio/CI images.
+$toolsEnvironment = & cmd.exe /d /s /c ('call "{0}" -arch=x64 -host_arch=x64 >nul && set VCToolsInstallDir' -f $developerCommand)
+if ($LASTEXITCODE -ne 0) { throw 'Could not resolve the Visual Studio C++ toolchain.' }
+$installedTools = ($toolsEnvironment | Where-Object { $_.StartsWith('VCToolsInstallDir=') }) -replace '^VCToolsInstallDir=', ''
+if ([string]::IsNullOrWhiteSpace($installedTools)) { throw 'Visual Studio did not select a C++ toolchain.' }
+$installedVersion = [version](Split-Path -Leaf $installedTools.TrimEnd('\'))
+$linkCommand = if ($installedVersion -ge $webrtc.ToolchainVersion) {
+    'link.exe /nologo'
+} else {
+    '"{0}" /nologo /libpath:"{1}"' -f $webrtc.Linker,$webrtc.RuntimeLibraries
+}
 
 function Invoke-CaptureBuild([string]$command) {
     & cmd.exe /d /s /c ('call "{0}" -arch=x64 -host_arch=x64 >nul && {1}' -f $developerCommand,$command) | Out-Host
diff --git a/native/capture/windows/get-webrtc.ps1 b/native/capture/windows/get-webrtc.ps1
index b8958a4c5..b3de932a1 100644
--- a/native/capture/windows/get-webrtc.ps1
+++ b/native/capture/windows/get-webrtc.ps1
@@ -56,6 +56,7 @@ if ($sdkNoticeHash -ne $notice.sha256 -or
 }
 $msvcPath = Join-Path $toolchainPath $pins.msvc.directory
 return @{
+    ToolchainVersion = [version](Split-Path -Leaf $msvcPath)
     Include = Join-Path $sdkPath 'include'
     Library = Join-Path $sdkPath 'lib\webrtc.lib'
     RuntimeLibraries = Join-Path $msvcPath 'lib\x64'

From 2b8d9fe99e9d42d8de1a3d9d31a5548f63e16029 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 18:27:59 +0800
Subject: [PATCH 164/262] feat(app): connect approved sites while the App stays
 ready

---
 README.md                                     |   4 +-
 README.zh-CN.md                               |   2 +-
 cmd/piik-app/README.md                        |  25 ++-
 cmd/piik-app/README.zh-CN.md                  |  18 +-
 .../adr/0010-cross-platform-client-runtime.md |  38 ++--
 docs/guide/getting-started.md                 |  20 +-
 docs/guide/getting-started.zh-CN.md           |  16 +-
 docs/guide/troubleshooting.md                 |  10 +-
 docs/guide/troubleshooting.zh-CN.md           |   8 +-
 docs/project-memory.md                        |  13 +-
 .../research/cross-platform-client-runtime.md |   7 +-
 docs/research/native-client-media.md          |  17 +-
 docs/standards/configuration.md               |  32 +--
 docs/standards/presentation-lifecycle.md      |  12 +-
 docs/standards/routing-transport.md           |   3 +-
 docs/status.md                                |   7 +-
 docs/todo.md                                  |  15 +-
 internal/app/app.go                           | 197 +++++++++++-------
 internal/app/app_test.go                      |  41 ++--
 internal/app/console.go                       |   2 +-
 internal/app/launcher/preference.go           |   2 +-
 internal/app/launcher/preference_test.go      |   2 -
 internal/app/launcher/server.go               | 134 +++++++++---
 internal/app/launcher/server_test.go          |  46 ++--
 internal/app/launcher/site_access_test.go     | 133 ++++++++++++
 .../app/loopback/quality_preference_test.go   |   2 +-
 internal/app/loopback/server.go               | 166 ++++++++++++---
 internal/app/loopback/site_access_test.go     | 150 +++++++++++++
 site/film/ui/main.tsx                         |   2 +-
 site/index.html                               |  34 ++-
 src/client/App.tsx                            |  16 +-
 .../components/living/AppConnectionButton.tsx |  73 +++++++
 src/client/components/living/Header.tsx       |   2 +
 src/client/components/living/LauncherForm.tsx |  88 ++++----
 src/client/lib/session.ts                     |  26 +++
 src/client/locales/en.ts                      |  26 ++-
 src/client/locales/zh.ts                      |  26 ++-
 src/client/native/client.ts                   |  35 +++-
 src/client/native/wire.ts                     |   5 +
 src/client/pages/AppLauncherPage.tsx          | 154 ++++++++++++--
 src/client/pages/ControlsPreview.tsx          |   4 +-
 src/client/pages/ViewerPage.tsx               |   8 +-
 src/client/styles.css                         |  33 ++-
 tests/client-launch-presentation.test.ts      |  22 ++
 tests/native-client.test.ts                   |  41 +++-
 tests/viewer-native-client-ownership.test.ts  |   2 +-
 46 files changed, 1318 insertions(+), 401 deletions(-)
 create mode 100644 internal/app/launcher/site_access_test.go
 create mode 100644 internal/app/loopback/site_access_test.go
 create mode 100644 src/client/components/living/AppConnectionButton.tsx

diff --git a/README.md b/README.md
index 3ab75c0af..57939608d 100644
--- a/README.md
+++ b/README.md
@@ -71,8 +71,8 @@ device and adjust your voice volume.
 
 Piik follows your system language: Chinese or English, with English as the fallback.
 Use **中 / EN / ✦** in the header to switch language or try the visual mode.
-The App offers a local room, a temporary public link, or a connection to your own
-site. Keep the App running while sharing through it.
+The App can create a local room or temporary public invitation, and stays
+available to supply capture for an approved site. Keep it running while sharing.
 
 Download a ZIP beginning with **`piik-app`**. The filename also identifies the platform:
 
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 8398ca907..781b3e714 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -66,7 +66,7 @@ Piik 是一个免费开源的私密屏幕共享工具，适合游戏直播、一
 
 Piik 默认跟随系统语言，中文系统显示简体中文，其他语言显示英文。
 顶部的 **中 / EN / ✦** 可切换中英文或体验纯视觉模式。
-Piik App 提供本地房间、临时公网邀请和连接已有站点三种模式，分享期间需保持 App 运行。
+Piik App 可创建本地房间或临时公网邀请，也能在后台为已授权站点提供采集能力。分享期间需保持 App 运行。
 
 下载以 **`piik-app`** 开头的 ZIP 压缩包，再按文件名中的平台标识选择：
 
diff --git a/cmd/piik-app/README.md b/cmd/piik-app/README.md
index 8b54e39e7..72a4bec6c 100644
--- a/cmd/piik-app/README.md
+++ b/cmd/piik-app/README.md
@@ -24,12 +24,11 @@ publication are separate steps in [deployment](../../docs/deployment.md).
 
 ## Modes
 
-- With no mode argument, the App opens a small launcher in the system
-  Browser. It selects Local, a temporary public HTTPS invitation, or a saved
-  Site, then enters the normal Host page.
-- The launcher remembers the last mode confirmed with **Open Piik** and the saved
-  Site address. Without a saved mode, it selects Site when an address is saved,
-  otherwise Public invite; it waits for confirmation before starting.
+- With no mode argument, the App opens its launcher and waits for use by an
+  approved Site. Choose **Local room** or **Public invite** to start a room
+  service on this device and enter the normal Host page.
+- The launcher remembers the last mode confirmed with **Open Piik**. Without a
+  saved Local/Public choice, it selects Public invite and waits for confirmation.
   The mode preference is stored beside the settings in `client.json.mode`;
   [App configuration](../../docs/standards/configuration.md#piik-app-configuration)
   covers saved preferences and custom paths.
@@ -49,14 +48,18 @@ media-server forwarding (SFU) or TURN relay fallback. The
 
 For Local invitations, the App automatically selects a sole active address or
 sole private IPv4. If several addresses remain possible, choose an interface
-and IP in the launcher. Public invite and Site mode need no LAN selection.
+and IP in the launcher. Public invite and use through a Site need no LAN selection.
 When bypassing the launcher with `--local`, use `--lan-address <address>` to
 resolve an ambiguous choice. The selected address is checked again at startup;
 it affects Local invitation links, while ICE selects media paths independently.
 
-Site mode uses the configured Site's rooms and any enabled SFU fallback.
-An App-opened Site remembers native activation, so later pages there may reuse
-the running App. Browser capture remains available without the App; see the
+To use a Piik Site, keep the App running and click **App** at the top of the Site.
+Confirm its address on the local approval page. The App remembers one approved
+Site, which the launcher can open or revoke. Approving another replaces it and
+ends the previous Site's App connections; Local rooms remain independent.
+The browser remembers activation, so later visits reuse the running App with
+that Site's rooms and any enabled SFU fallback. Browser capture remains available
+without the App; see the
 [entry workflow](../../docs/standards/presentation-lifecycle.md#product-surface).
 
 The Host page offers Browser and Camera capture alongside available native
@@ -111,7 +114,7 @@ For codec-specific failures, see [Windows H264 troubleshooting](../../docs/guide
 
 ### Diagnostics
 
-Enable **Debug launch** in the mode selector before opening Piik, reproduce the
+Enable **Debug launch** in the launcher before starting a room or connecting a Site, reproduce the
 problem, then press `D` in the interactive terminal to export a local ZIP.
 Use `--debug` for failures before the selector opens. Exporting does not stop
 the share or upload the archive. For Browser diagnostics, click the **Debug**
diff --git a/cmd/piik-app/README.zh-CN.md b/cmd/piik-app/README.zh-CN.md
index 707768d50..f92de74b9 100644
--- a/cmd/piik-app/README.zh-CN.md
+++ b/cmd/piik-app/README.zh-CN.md
@@ -21,10 +21,10 @@ Apple 芯片或 Intel Mac，以及 macOS 13 或更新版本。构建程序包与
 
 ## 运行模式
 
-- 不传模式参数时，App 在系统浏览器中打开启动页。选择本地房间、临时公网 HTTPS 邀请
-  或已保存的站点后，进入通常的房主页面。
-- 启动页会记住上次点击 **进入 Piik** 确认的模式，以及保存的站点地址。
-  没有已保存的模式时，有站点地址就默认选中站点，否则选中公网邀请；确认后才启动。
+- 不传模式参数时，App 打开启动页，等待已授权站点使用。选择 **本地房间** 或
+  **公网邀请**，可在这台设备上启动房间服务，进入通常的房主页面。
+- 启动页会记住上次点击 **进入 Piik** 确认的模式。
+  没有已保存的本地/公网选择时，默认选中公网邀请；确认后才启动。
   模式偏好保存在配置旁的 `client.json.mode` 中；保存项与自定义路径见
   [App 配置](../../docs/standards/configuration.md#piik-app-configuration)。
 - `--site`、`--local` 和 `--link` 用于在 CI 或开发时直接选择模式。
@@ -39,12 +39,14 @@ Apple 芯片或 Intel Mac，以及 macOS 13 或更新版本。构建程序包与
 [路由参考](../../docs/standards/routing-transport.md)。
 
 本地邀请会自动选择唯一的活动地址或唯一的私有 IPv4 地址。仍有多个可能地址时，
-请在启动页选择网卡和 IP。公网邀请和站点模式无需选择局域网地址。
+请在启动页选择网卡和 IP。公网邀请和搭配站点使用时无需选择局域网地址。
 通过 `--local` 跳过启动页时，可用 `--lan-address <address>` 指定地址来解决多地址歧义。
 App 会在启动时再次检查所选地址；它只影响本地邀请链接，媒体路径仍由 ICE 独立选择。
 
-站点模式使用所配置站点的房间，以及该站点已启用的 SFU 兜底。
-通过 App 打开的站点会记住原生功能的启用选择，之后打开该站点的页面可继续使用正在运行的 App。
+使用 Piik 站点时，保持 App 运行，点击站点顶部的 **App**，在本机确认页核对网址并允许使用。
+App 记住一个已授权站点，可在启动页打开或取消授权。允许另一个站点会替换旧站点，
+结束旧站点的 App 连接；本地房间不受影响。同一浏览器记住启用选择，
+之后访问站点即可继续使用 App，同时使用该站点的房间和已启用的 SFU 兜底。
 没有 App 时仍可使用浏览器采集，详见[进入流程](../../docs/standards/presentation-lifecycle.md#product-surface)。
 
 房主页面提供浏览器、摄像头采集，以及可用的原生窗口或屏幕，请明确选择来源。
@@ -87,7 +89,7 @@ App 在独立 Windows 控制台中启动时，启动或运行错误会保留在
 
 ### 诊断
 
-在启动页开启 **诊断启动**，进入 Piik 并复现问题，再在交互终端按 `D` 导出本地 ZIP。
+在启动房间或连接站点前，先在启动页开启 **诊断启动**，复现问题后在交互终端按 `D` 导出本地 ZIP。
 启动页出现前就失败时，使用 `--debug`。导出不会停止分享或上传文件。
 浏览器诊断通过主题按钮后的 **诊断** 芯片图标开启：确认重新加载后，使用 **网页报告** 下载。
 调查浏览器与 App 配合的问题时，请提供同一次复现的两份报告。
diff --git a/docs/adr/0010-cross-platform-client-runtime.md b/docs/adr/0010-cross-platform-client-runtime.md
index 0a5b17974..810af173d 100644
--- a/docs/adr/0010-cross-platform-client-runtime.md
+++ b/docs/adr/0010-cross-platform-client-runtime.md
@@ -46,7 +46,7 @@ topologies and makes a saved Site unavailable while another room source runs.
    public process identity, not authentication. The listener accepts the current
    Local Host origin and the one user-saved Site origin. Origin and Host
    validation plus the Browser's local-network permission own this boundary.
-4. Loopback v9 starts with a strict `hello` handshake. Up to two participant
+4. Native control starts with a strict `hello` handshake. Up to two participant
    control sessions may coexist; each retains its own share and media lifetime.
    This bounds concurrent Native work, not the shared server's room count.
    Ending one control session cannot end another; App exit waits for all
@@ -69,11 +69,15 @@ topologies and makes a saved Site unavailable while another room source runs.
    wrapper or UI.
 6. The system Browser remains the UI. Browser extensions, userscripts, Electron,
    Tauri, and resident services need new evidence before they can replace this
-   smaller boundary. An App-opened Site stores a non-secret opt-in at that
-   exact Browser origin, so later manually opened pages may discover the running
-   App. Pages without that opt-in do not probe localhost or request local-
-   network permission. Clearing Site data simply requires opening it from the
-   App again.
+   smaller boundary. An App-opened or explicitly connected Site stores a
+   non-secret opt-in at that exact Browser origin, so later pages may discover
+   the running App. Without this opt-in, only the user's App connection action
+   starts discovery. Its public loopback discovery returns process identity and
+   a local approval URL, never native capability, source or preference data.
+   The App-owned approval page displays the exact requesting origin and requires
+   confirmation before saving it. It rejects cross-origin mutations and framing;
+   the Site cannot approve itself. A popup message requests an authorized health
+   recheck, not authorization. Clearing Site data requires connecting again.
 7. A self-contained Local deployment serves reachable LAN peers without a
    central Piik service. Its explicit `--link` mode starts one accountless
    Cloudflare Quick Tunnel for the same HTTP/WebSocket surface. The App
@@ -130,12 +134,12 @@ topologies and makes a saved Site unavailable while another room source runs.
    extra threshold, timer, score, route operation, or representation ladder is
    added. Only a consumed App-launch marker travels in the URL fragment.
    Exact target identity travels over loopback.
-9. The App uses the system Browser as its only UI. On every launch, the current
-   lightweight control center offers Local, public link, and Site. The Site value
-   is stored in App configuration and remains one click on later launches;
-   selecting Local or public link does not disable background RPC access for the
-   saved Site. Command-line mode
-   selectors remain automation inputs rather than the normal interface. An
+9. The App uses the system Browser as its only UI. It remains available to the
+   saved Site before a room mode is chosen. Its persistent launcher offers Local
+   and public link, shows the approved Site and allows revocation. Starting a
+   Local/public room does not disable that Site's native access or approval UI;
+   neither visiting the launcher nor approving a Site creates a room. Command-line
+   entry selectors remain automation inputs rather than the normal interface. An
    embedded shell requires a reproduced product failure and one comparative
    decision.
 10. Local mode is one explicit server composition: static current assets,
@@ -143,7 +147,7 @@ topologies and makes a saved Site unavailable while another room source runs.
     current LAN IPv4 origins. It uses no public discovery by default. Public-link
     mode adds its temporary HTTPS origin and the bounded public STUN discovery
     and survey configuration in [ADR-0009](0009-optional-nat-prediction.md).
-    Site mode consumes that Site's
+    A participant on an approved Site consumes that Site's
     configured STUN survey. Both feed the same connection-local prediction
     adapter; Native additionally owns its UDP socket and best-effort port mapping.
 11. One App configuration owns the optional Site origin and an optional,
@@ -152,7 +156,12 @@ topologies and makes a saved Site unavailable while another room source runs.
     App bootstraps a selected page through a fragment consumed before
     authentication; the page retains only the non-secret App opt-in at its
     origin. Friends use the existing room invitation grant. No App-specific
-    room authorization system is added.
+    room authorization system is added. Site replacement/revocation uses this
+    same configuration owner, immediately denies new control requests from the
+    old origin and cancels its existing sessions. Retirement is bounded and does
+    not wait for unrelated Local sessions. Cleanup failure never restores the
+    revoked permission; concurrent approval pages must review a changed Site
+    before replacing it.
 12. Local authority shutdown first ends every in-memory room through the current
     `room-closed` path, then closes signaling and HTTP. The App cancels the
     server context, calls that end-then-close sequence under one bounded
@@ -231,6 +240,7 @@ architectural claim.
 - [Cloudflare Tunnel WebSocket support](https://developers.cloudflare.com/cloudflare-one/faq/cloudflare-tunnels-faq/)
 - [RFC 6455 WebSocket Origin model](https://www.rfc-editor.org/rfc/rfc6455.html)
 - [Chrome Local Network Access](https://developer.chrome.com/blog/local-network-access)
+- [Browser popup message origin/source checks](https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage#security_concerns)
 - [Discord local RPC](https://docs.discord.com/developers/topics/rpc)
 - [OBS WebSocket protocol](https://github.com/obsproject/obs-websocket/blob/master/docs/generated/protocol.md)
 - [LocalSend protocol](https://github.com/localsend/protocol/blob/main/README.md)
diff --git a/docs/guide/getting-started.md b/docs/guide/getting-started.md
index f6d2e6265..97006eb74 100644
--- a/docs/guide/getting-started.md
+++ b/docs/guide/getting-started.md
@@ -100,20 +100,20 @@ See the [App guide](../../cmd/piik-app/README.md) for package and runtime detail
 | --- | --- | --- |
 | **Local room** | Friends are on the same local network. | If several entries appear under **Local invitation address**, choose the interface and IP on your friends' network. Your computer must be reachable from theirs. A local site passphrase is optional. |
 | **Public invite** | Friends are elsewhere and you want a temporary invitation. | Needs Internet access. The public address lasts for this App run. |
-| **Connect to Site** | Your group already has a Piik site. | Enter its address; the App adds capture capabilities to the site's sharing page. |
 
 For Local room and Public invite, expand **Site passphrase** to set an optional
 access passphrase.
 
-For **Connect to Site**, enter a domain such as `demo.piik.tv` or paste the full
-site address, then choose **Open Piik**. HTTPS is added when omitted; for an HTTP
-site, include `http://`. Enter the site's passphrase on the page that opens if asked.
-After opening the site through the App once, the same browser remembers that
-entry. Keep the App running with that site configured and you can visit the
-address directly. **Start sharing** opens the selector; choose **Apps / Windows**
-or **Screens** for App capture. Allow local-network access if the browser asks.
-In another browser, in a private window, or after clearing site data, enter through
-the App again. For a different site, update the address in the App first.
+**Already have a Piik site?** Keep the App running, open the site and click
+**App** at the top. Check the address on the local confirmation page, then choose
+**Allow access**. Enter any site passphrase on the site itself. Allow local-network
+access if the browser asks. No room mode needs to be selected in the launcher.
+
+The same browser remembers this connection. On later visits, **Start sharing**
+offers **Apps / Windows** and **Screens** from the running App. In another browser,
+in a private window or after clearing site data, connect again. The launcher
+shows the approved site and lets you revoke it. Approving a different site
+replaces the previous one and ends that site's App connections.
 
 **A page that opens does not guarantee a video connection.** Public invite gives
 your room a temporary web address; picture and sound still travel between
diff --git a/docs/guide/getting-started.zh-CN.md b/docs/guide/getting-started.zh-CN.md
index b26064059..540ce8e81 100644
--- a/docs/guide/getting-started.zh-CN.md
+++ b/docs/guide/getting-started.zh-CN.md
@@ -91,17 +91,17 @@ Linux 原生采集还需要[系统组件](../../native/capture/linux/README.md)
 | --- | --- | --- |
 | **本地房间** | 朋友和你在同一个局域网。 | 出现多个「局域网邀请地址」时，选择与朋友同一网络的网卡和 IP。对方需要能连接到你的电脑，可以设置本地站点口令。 |
 | **公网邀请** | 朋友在别处，想临时发个邀请。 | 需要互联网连接；公网地址只在本次 App 运行期间有效。 |
-| **连接站点** | 你们已经有一个 Piik 站点。 | 输入站点地址，在原有分享页面使用 App 的采集能力。 |
 
 本地房间和公网邀请可展开 **站点口令** 设置可选的访问口令。
 
-使用 **连接站点** 时，输入域名（例如 `demo.piik.tv`）或粘贴完整网址，然后点击 **进入 Piik**。
-省略前缀时自动使用 HTTPS；HTTP 站点请填写 `http://`。
-如果站点要求访问口令，在打开的站点页面输入。通过 App 打开过一次后，同一浏览器会记住这个入口。
-保持 App 运行并使用该站点配置，之后就能直接访问网址。点击 **开始分享**，
-在选择器里选 **程序 / 窗口** 或 **屏幕**，即可使用 App 采集。
-浏览器询问本地网络权限时，请允许访问。换浏览器、使用无痕窗口或清除站点数据后，
-需要重新从 App 进入一次；换用其他站点时，先在 App 中更新地址。
+**已经有 Piik 站点？** 保持 App 运行，打开站点，点击顶部的 **App**。
+在本机确认页核对网址，点击 **允许使用**。如果站点要求口令，在站点页面输入。
+浏览器询问本地网络权限时，请允许访问。启动页无需选择房间模式。
+
+同一浏览器会记住这次连接。之后直接访问站点，点击 **开始分享**，
+选择 **程序 / 窗口** 或 **屏幕**，即可使用正在运行的 App。
+换浏览器、使用无痕窗口或清除站点数据后，重新连接即可。
+启动页显示已授权的站点，也可以取消授权；允许新站点会替换旧站点，并结束旧站点的 App 连接。
 
 **网页能打开，不代表视频一定能连通。** 公网邀请为房间提供临时网页地址，
 画面和声音仍靠参与者之间的连接传输。此模式没有媒体服务器兜底，
diff --git a/docs/guide/troubleshooting.md b/docs/guide/troubleshooting.md
index 3ee5e3f02..958201ccd 100644
--- a/docs/guide/troubleshooting.md
+++ b/docs/guide/troubleshooting.md
@@ -43,7 +43,7 @@ checks, a copyable failure summary and browser diagnostics. The summary contains
 the Web version, message and error code, without invitation links or source names.
 
 - **App disconnected or request timed out:** check that the App is running and
-  responding, open this site from the App, then refresh. Allow local network
+  responding, then click **App** at the top of the site to connect. Allow local network
   access if the browser asks. A timeout alone does not establish a graphics fault.
 - **App could not start the selected source:** try an ordinary window or screen,
   then compare with the **Browser** source picker. On Windows, try **Auto** or
@@ -83,9 +83,9 @@ See [Server deployment](../operations/self-hosting.md) for the configuration.
 
 ## App windows or screens are missing
 
-Keep Piik App running on the computer where you are sharing. Open the current
-site from the App; for a hosted site, use the App's **Site** mode with that
-site's address. If the browser asks for local-network access, allow it, then
+Keep Piik App running on the computer where you are sharing. Click **App** at
+the top of the site, then confirm its address on the local approval page.
+If the browser asks for local-network access, allow it, then
 refresh the source list. If access was previously blocked, review this site's
 browser permissions first.
 
@@ -93,7 +93,7 @@ The source picker distinguishes these outcomes:
 
 | Message | Next step |
 | --- | --- |
-| Cannot connect to Piik App | Confirm the App is running and opened this site. Close unused Piik tabs using the App, then refresh the list; up to two pages can use the App's native capture or viewing at once. |
+| Cannot connect to Piik App | Confirm the App is running and this site is approved. Close unused Piik tabs using the App, then refresh the list; up to two pages can use the App's native capture or viewing at once. |
 | Piik App and this page are incompatible | Update Piik App and reload the page. |
 | Piik App capture is currently unavailable | Check the App diagnostics for capture or encoder availability. Review your encoding setting or use browser capture. |
 | Could not read the screen and window list | Refresh to retry. If it keeps failing, export both the App and browser Debug reports. |
diff --git a/docs/guide/troubleshooting.zh-CN.md b/docs/guide/troubleshooting.zh-CN.md
index fa2db54f3..cef7570bf 100644
--- a/docs/guide/troubleshooting.zh-CN.md
+++ b/docs/guide/troubleshooting.zh-CN.md
@@ -41,7 +41,7 @@
 电视下方的错误图标说明当前失败；点击可打开排查面板，查看建议、复制失败信息，
 或开启网页诊断。复制内容包含网页版本、提示和错误编号，不包含邀请链接或来源名称。
 
-- **App 连接断开或请求超时**：确认 App 仍在运行且可以响应，从 App 打开当前站点后刷新。
+- **App 连接断开或请求超时**：确认 App 仍在运行且可以响应，点击站点顶部的 **App** 完成连接。
   浏览器询问本地网络权限时允许访问。超时只说明请求未及时完成，不能据此认定显卡故障。
 - **App 未能启动所选来源**：先换一个普通窗口或屏幕；再对照「浏览器」选源。
   Windows 上可试「自动」或 VP8，后续按[显卡排查](#windows-上-h264-分享失败)操作。
@@ -72,15 +72,15 @@
 
 ## App 找不到窗口或屏幕
 
-在分享画面的这台电脑上保持 Piik App 运行，并从 App 打开当前站点。
-使用已部署的站点时，在 App 的 **站点** 模式中填写该站点地址。
+在分享画面的这台电脑上保持 Piik App 运行，点击站点顶部的 **App**，
+在本机确认页核对网址并允许使用。
 浏览器询问本地网络权限时允许访问，再刷新来源列表；如果之前拒绝过，先检查当前站点的浏览器权限。
 
 选源器会区分以下情况：
 
 | 提示 | 处理方法 |
 | --- | --- |
-| 未能连接 Piik App | 确认 App 正在运行，且通过 App 打开了当前站点。关闭其他正在使用 App 的闲置 Piik 标签页后刷新列表；最多两个页面可以同时使用 App 的原生采集或收看功能。 |
+| 未能连接 Piik App | 确认 App 正在运行，且当前站点已获得授权。关闭其他正在使用 App 的闲置 Piik 标签页后刷新列表；最多两个页面可以同时使用 App 的原生采集或收看功能。 |
 | Piik App 与当前页面不兼容 | 更新 Piik App 并刷新页面。 |
 | Piik App 采集功能当前不可用 | 查看 App 诊断信息中的采集和编码能力，检查编码设置，或使用浏览器采集。 |
 | 未能读取 App 的窗口和屏幕列表 | 刷新重试；若持续失败，请导出同一次尝试的 App 和网页诊断报告。 |
diff --git a/docs/project-memory.md b/docs/project-memory.md
index 4ca8d2b6a..577a65887 100644
--- a/docs/project-memory.md
+++ b/docs/project-memory.md
@@ -1,6 +1,6 @@
 # Project Memory
 
-Last updated: 2026-10-09
+Last updated: 2026-10-11
 
 Piik is private, low-latency screen sharing for one Host and up to 20
 authenticated friends. The current product surface is Web Host, Web Viewer, and
@@ -9,11 +9,12 @@ mobile Browsers can also host. It is not a
 public broadcast service. Hosted and App run one shared Go core
 ([ADR-0012](./adr/0012-shared-go-backend-core.md)); Node and Vite build the
 Browser UI and are not a runtime. Source includes a cross-platform App that
-runs that same core in a self-contained Local deployment or opens one configured
-Site through the system Browser. Its single Go process presents Local, temporary
-public-link, and saved-Site choices on every launch, starts one process-level
-loopback capability service, owns the Local room authority in-process when
-selected, and owns the explicit native media path chosen in the same Web UI.
+runs that same core in a self-contained Local deployment or supplies native
+capability to one approved Site through the system Browser. Its single Go
+process starts the loopback capability service before room selection. The
+persistent launcher offers Local and temporary public-link choices and manages
+the Site's explicit local approval. Site use can remain on standby without a
+Local room service; native media still belongs to the participant's Web UI.
 Room source and media implementation are independent: a topology may mix
 Browser and Native peers without changing participant, signaling, capacity, or
 route identity. Local is LAN-first; explicit one-link mode exposes that same
diff --git a/docs/research/cross-platform-client-runtime.md b/docs/research/cross-platform-client-runtime.md
index 125dc0a74..58aa94661 100644
--- a/docs/research/cross-platform-client-runtime.md
+++ b/docs/research/cross-platform-client-runtime.md
@@ -53,9 +53,10 @@ The App and Hosted Piik run the same server core, so the local package is
 one executable carrying the built Browser assets plus the optional capture and
 tunnel sidecars; [the App README](../../cmd/piik-app/README.md) owns
 that layout. In Local mode the App runs the server in its own process with
-explicit local configuration. In Site mode it starts no server, and the system
-Browser opens the saved Site while the same process remains its loopback
-native-media owner. The system Browser remains the UI.
+explicit local configuration. While waiting for an approved Site it starts no
+room server; the same process remains the Site's loopback native-media owner.
+The persistent launcher owns local approval and room startup independently.
+The system Browser remains the UI.
 
 Official Go process APIs require every started child to be waited and provide a
 bounded `WaitDelay` for cancellation and stuck I/O. That guidance now covers the
diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 9b9fdefa1..d32fd84c4 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -3,8 +3,8 @@
 - Reviewed: 2026-10-11
 - Scope: platform capture, shared encoded sources, Pion transport and Browser
   decode; current behavior belongs to [media quality](../standards/media-quality.md)
-- Status: Windows physical native Host and Viewer gates passed; current macOS
-  changes await SDK compilation, and macOS/Linux physical media gates remain open
+- Status: Windows physical native Host and Viewer gates passed; both macOS
+  architectures compile and pass packaged startup; macOS/Linux physical media gates remain open
 
 ## Windows Audio Exclusion
 
@@ -558,11 +558,12 @@ replaces only its compression session when the fitted size changes. The frame
 envelope carries actual dimensions; declared output limits and room/route
 identity remain unchanged. Encoded-input derivation uses the same worker.
 
-This implementation has not yet been compiled with the macOS SDK or executed on
-macOS. The existing native check now includes content-geometry validation and
-extends hardware self-testing across successive source shapes. Run those checks
-on Apple silicon and Intel, then verify real window resizing, Retina transitions,
-cropped image fidelity and quiet-source recovery before accepting this boundary.
+The candidate passes macOS SDK compilation and packaged startup on Apple silicon
+and Intel in [CI run 38128668158](https://github.com/TNTcraftHIM/Piik/actions/runs/38128668158).
+The native check includes content-geometry validation and successive-shape
+hardware self-tests when an encoder is available. Runner checks do not replace
+real window resizing, Retina transitions, cropped image fidelity or quiet-source
+recovery on a physical Mac.
 
 Local synthetic-input controls exercised that production worker through four
 successive source sizes: 1080x1920, 3440x1440, 640x480 and 1920x1080. Under the
@@ -645,7 +646,7 @@ coded storage. Windows copies the aperture while retaining the decoder surface,
 so downstream outputs receive the visible picture. The native regression checks
 right/bottom H.264 padding with real software decoding, visible edge pixels, and
 an offset NV12 aperture through the DXGI-buffer path. Oversized coded/reference
-storage remains rejected; the macOS SDK boundary above still applies.
+storage remains rejected; the physical macOS boundary above still applies.
 
 An additional nonzero left/top SPS crop exposed a local Media Foundation software
 decoder limit: its raw output omitted right/bottom picture pixels before Piik's
diff --git a/docs/standards/configuration.md b/docs/standards/configuration.md
index 23afca7a2..5f657105f 100644
--- a/docs/standards/configuration.md
+++ b/docs/standards/configuration.md
@@ -108,30 +108,32 @@ schema field. The user settings are:
 
 | Setting | Contract |
 | --- | --- |
-| `site` | Saved Piik Site origin. The launcher or `--site` updates it. |
+| `site` | One approved Piik Site origin. Local confirmation or explicit `--site` updates it; the launcher can revoke it. |
 | `localAccessPassword` | Empty by default. Optional password for the App's Local room authority, with the same exact-match behavior as `SITE_ACCESS_PASSWORD`. It is separate from a hosted site's password. |
 
-Site input in the launcher and `--site` defaults to HTTPS when the scheme is
-omitted; explicit HTTP or HTTPS is preserved. The App saves the normalized origin
-and still rejects credentials, room paths, queries and fragments. It does not
-probe protocols or downgrade a failed HTTPS connection to HTTP.
+The Site's App button requests local confirmation for the page's exact origin.
+The `--site` automation input defaults to HTTPS when the scheme is omitted;
+explicit HTTP or HTTPS is preserved. Both save the normalized origin and reject
+credentials, room paths, queries and fragments. The App does not probe protocols
+or downgrade a failed HTTPS connection to HTTP.
 
 The launcher remembers the last mode confirmed with the launch button. This
 optional preference lives beside the configuration as `client.json.mode` (or
 `<custom-config-path>.mode`); removing it restores the initial selection without
-changing saved settings. Older App versions ignore this file. Without a valid
-preference, a saved Site is selected when present; otherwise the public
+changing saved settings. Without a valid Local/Public preference, the public
 invitation link is selected. Choosing a mode does not start it until confirmed.
 Local mode remains available for the same network.
 Selecting Local or Public Link, including through the CLI, preserves the saved
-Site and its allowed App origin; only an explicit Site edit replaces it.
+Site and its allowed App origin; only local approval/revocation or `--site`
+changes it. The Site can use native capabilities while the App waits in its
+launcher; it does not need a Local room service.
 For Local mode, the launcher selects a sole active address or sole private IPv4
 address automatically. With several choices it shows interface names and IPs;
 an ambiguous choice must be selected before launch. `--lan-address` preselects
 an active address. Selection applies to this launch and is revalidated at startup.
 It sets the local invitation origin; HTTP still listens on the existing wildcard
-listener and ICE remains free to use available media interfaces. Public Link and
-Site mode require no local address selection.
+listener and ICE remains free to use available media interfaces. Public Link
+and use through an approved Site require no local address selection.
 
 Command-line options select entry and local runtime behavior:
 
@@ -165,10 +167,12 @@ Diagnostics are local and opt-in. Enable them **before** reproducing the problem
 | Browser Host/Viewer | Click the **Debug** chip icon after the theme control and confirm the reload, or add `?debug=1` before any invitation fragment | The same control becomes a download arrow for the web report |
 | Hosted Server | Start with `--debug`, `PIIK_DEBUG=server` or `PIIK_DEBUG=route` | On Unix, `kill -USR1 <pid>`; also exported at orderly shutdown |
 
-App **Debug launch** enables App and Browser collection for that run before
-starting the selected mode. It records Native capability results and subsequent
-capture, connection and local-server activity. Use `--debug` for failures before
-the mode selector opens. This choice does not change the saved App configuration.
+App **Debug launch** starts App collection immediately, including while waiting
+for a Site. Pages subsequently opened from the launcher also collect Browser
+logs; already-open Site pages use their own Debug control. It records Native
+capability results and subsequent capture, connection and local-server activity.
+Use `--debug` for failures before the launcher opens. This choice does not change
+the saved App configuration.
 When bypassing the mode selector, `--debug` and `PIIK_DEBUG=client` enable backend
 collection; enable the Browser control separately for browser-side diagnosis.
 
diff --git a/docs/standards/presentation-lifecycle.md b/docs/standards/presentation-lifecycle.md
index ab386115d..72a86bd9b 100644
--- a/docs/standards/presentation-lifecycle.md
+++ b/docs/standards/presentation-lifecycle.md
@@ -34,10 +34,14 @@ is absent, provided the room service and their admitted sessions remain availabl
 [Rooms and access](./rooms-access.md#room-interactions) owns interaction authority
 and retention; [status](../status.md#accepted-interaction-phase) owns release readiness.
 
-Piik App opens this same application in the system Browser. Its small
-startup surface selects Local, temporary public invitation, or a configured
-Site before entering the Host workspace. Viewer links opened at that activated
-origin may use the same running App without changing the Viewer UI. Starting a share offers the
+Piik App opens this same application in the system Browser. Its startup surface
+offers Local and temporary public invitation; the running App is already
+available to its approved Site before either mode starts. A Site's explicit App
+action discovers the local approval page, where the user confirms its exact
+origin. The launcher shows and revokes that approval. Activating a page supplies
+native capability without restarting its room or healthy media session.
+Viewer links opened at that activated origin may use the same running App
+without changing the Viewer UI. Starting a share offers the
 Browser picker and any exact App-owned native windows. It never chooses a
 window automatically. A reproduced Browser-window, capture, or background
 failure is required before introducing an embedded Web runtime.
diff --git a/docs/standards/routing-transport.md b/docs/standards/routing-transport.md
index 1044a7af3..87dccb742 100644
--- a/docs/standards/routing-transport.md
+++ b/docs/standards/routing-transport.md
@@ -272,7 +272,8 @@ design. All-UDP-blocked networks currently end in bounded failure.
 App Local mode runs this graph without SFU, NAT prediction, or default STUN.
 One-link mode tunnels only HTTP/WebSocket control and adds public STUN to the
 same Browser/Native P2P edges. Reachable peers form one mixed relay tree; an
-unreachable path adds no route type or score. Site mode uses Site transport.
+unreachable path adds no route type or score. App-enabled Site pages use that
+Site's transport configuration.
 
 A Native Host reserves one loopback edge for Browser preview; it consumes no
 route-copy capacity or gateway mapping. Direct children and the admitted Native
diff --git a/docs/status.md b/docs/status.md
index a16f778ef..35d2a0bd3 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -72,8 +72,8 @@ the three recommended presets. Windows and Linux output preserve source shape
 within the selected ceiling.
 The [media assessment](./research/native-client-media.md#media-capability-extension-assessment)
 owns local codec, derived-output, SFU, Browser/Native fanout and live-control
-evidence. The macOS geometry implementation still needs SDK compilation and
-hardware verification; cross-browser/device and route-change acceptance remain
+evidence. Both macOS architectures pass SDK compilation and packaged startup;
+physical geometry verification, cross-device and route-change acceptance remain
 open. Additional codecs are not part of this candidate.
 Magicsock adoption is no-go for this candidate: its App-to-App augmentation does
 not improve the core App-to-Browser use case. The
@@ -81,6 +81,9 @@ not improve the core App-to-Browser use case. The
 owns the retained experiment and product decision. Its package is retired;
 independent ordinary ICE and media repairs remain in the candidate.
 Publication remains subject to final acceptance.
+The candidate App now waits for approved Sites independently of Local/public
+room startup. Its two-choice launcher retains one exact Site approval and
+revocation, using the existing loopback and native-session owners.
 Immutable release artifacts own delivery completion; [TODO](./todo.md#now) owns
 remaining work.
 
diff --git a/docs/todo.md b/docs/todo.md
index 3a0cc64a9..17b90c791 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -84,8 +84,9 @@ Implementation needs a concrete useful result within the product model.
   Remaining receiver acceptance needs physical limited decoders and camera
   orientation behavior, beyond the bounded SDP-limit and mixed-route controls.
   Browser display capture, Browser relay, Browser-to-Native fanout and SFU have
-  bounded high-resolution continuity evidence. macOS geometry SDK/hardware
-  checks and physical 4K/game capture remain open. The fanout controls did not
+  bounded high-resolution continuity evidence. macOS geometry hardware
+  checks and physical 4K/game capture remain open; both macOS package targets
+  now pass SDK compilation and startup. The fanout controls did not
   establish sustained 60 fps; retain that performance limit when arranging
   device/network acceptance. Preserve safety limits and
   framework-owned adaptation. The
@@ -115,11 +116,11 @@ Implementation needs a concrete useful result within the product model.
   existing device selector. Keep it outside this candidate until a concrete
   use case justifies that boundary and physical latency/echo/background checks.
   This proposal does not reopen room voice.
-- [ ] **Passive App attachment: design hold.** Site mode authorizes one selected
-  origin and supplies native media without starting a local room server. A
-  passive replacement needs an accepted site-consent/discovery flow; it must not
-  admit arbitrary sites or add another runtime owner. Keep Site mode until that
-  decision; removal of the Demo prefill does not authorize changing site trust.
+- [ ] **Passive App attachment acceptance.** The two-choice launcher and explicit
+  local Site approval replace the third mode, using the existing native runtime.
+  Include first connection, saved approval, replacement/revocation and Local
+  coexistence in final packaged acceptance. Browser permission and cross-platform
+  checks must not be inferred from the local development preview.
 
 ## Awaiting Device Or Reporter Evidence
 
diff --git a/internal/app/app.go b/internal/app/app.go
index a9bd6859a..8cac1855c 100644
--- a/internal/app/app.go
+++ b/internal/app/app.go
@@ -13,6 +13,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 	"syscall"
 	"time"
 
@@ -77,9 +78,12 @@ func Run(ctx context.Context, options Options) (returnedErr error) {
 	options.Debug = options.Debug || debugEnabled(os.Getenv("PIIK_DEBUG"))
 	options.console = newConsole(cancel, options.DisableBrowser)
 	var recorder *diagnostics.Recorder
+	var diagnosticsMu sync.Mutex
 	var restoreLogger func()
 	defer func() {
 		cancel()
+		diagnosticsMu.Lock()
+		defer diagnosticsMu.Unlock()
 		returnedErr = finishRun(options.console, recorder, restoreLogger, returnedErr)
 	}()
 	enableDiagnostics := func() error {
@@ -181,19 +185,24 @@ func Run(ctx context.Context, options Options) (returnedErr error) {
 			return err
 		}
 	}
-	if !explicitMode(options) {
-		return runLauncher(ctx, options, configPath, config, control, func(selected *Options, config appconfig.Config) error {
-			if selected.Debug {
-				if err := enableDiagnostics(); err != nil {
-					return err
-				}
-				selected.logger = recorder.Logger()
+	return runLauncher(ctx, options, configPath, config, control, func(selected *Options, config appconfig.Config) error {
+		diagnosticsMu.Lock()
+		defer diagnosticsMu.Unlock()
+		if ctx.Err() != nil {
+			return ctx.Err()
+		}
+		if selected.Debug {
+			if err := enableDiagnostics(); err != nil {
+				return err
 			}
-			recordContext(*selected, config)
-			return nil
-		})
-	}
-	return runConfigured(ctx, options, config, control)
+		}
+		if recorder != nil {
+			selected.Debug = true
+			selected.logger = recorder.Logger()
+		}
+		recordContext(*selected, config)
+		return nil
+	})
 }
 
 func finishRun(console *console, recorder *diagnostics.Recorder, restoreLogger func(), err error) error {
@@ -218,18 +227,6 @@ func explicitMode(options Options) bool {
 	return options.SiteSet || options.Local || options.Link || options.DisableBrowser
 }
 
-func runConfigured(
-	ctx context.Context,
-	options Options,
-	config appconfig.Config,
-	control *loopback.Server,
-) error {
-	if config.Site != "" && !options.Local && !options.Link {
-		return runSite(config.Site, options, control)
-	}
-	return runLocal(ctx, options, config, control)
-}
-
 func runLauncher(
 	ctx context.Context,
 	options Options,
@@ -238,10 +235,29 @@ func runLauncher(
 	control *loopback.Server,
 	configureDiagnostics func(*Options, appconfig.Config) error,
 ) (returnedErr error) {
+	automatic := explicitMode(options)
+	initialOptions := options
+	initialConfig := config
 	mode, err := launcher.LoadMode(configPath)
 	if err != nil {
 		slog.Debug("Could not restore the last launcher mode", diagnostics.Error(err))
 	}
+	// Site approval and room startup mutate separate fields of one config.
+	// Serialize persistence and publish only the complete successfully saved value.
+	var configMu sync.Mutex
+	launcherOrigin := ""
+	updateConfig := func(change func(*appconfig.Config)) (appconfig.Config, error) {
+		configMu.Lock()
+		defer configMu.Unlock()
+		next := config
+		change(&next)
+		if err := appconfig.Save(configPath, next); err != nil {
+			return config, err
+		}
+		config = next
+		err := control.SetAllowedOrigins(append(allowedOrigins(config.Site, initialOptions.Port), launcherOrigin))
+		return config, err
+	}
 	launch, err := launcher.Start(
 		ctx,
 		webassets.FS(),
@@ -250,69 +266,112 @@ func runLauncher(
 			Site:        config.Site, Version: buildVersion(), Revision: BuildRevision,
 			LocalAccessPassword: config.LocalAccessPassword,
 			Debug:               options.Debug, LANAddress: options.LANAddress,
+			ChangeSite: func(site string) (string, error) {
+				current, err := updateConfig(func(next *appconfig.Config) { next.Site = site })
+				return current.Site, err
+			},
+			EnableDebug: func() error {
+				configMu.Lock()
+				defer configMu.Unlock()
+				selected := initialOptions
+				selected.Debug = true
+				return configureDiagnostics(&selected, config)
+			},
 		},
 	)
 	if err != nil {
 		return err
 	}
-	defer launch.Close()
+	defer func() { returnedErr = errors.Join(returnedErr, launch.Close()) }()
+	control.SetConnectURL(launch.URL())
+	defer control.SetConnectURL("")
 	launchAddress, err := url.Parse(launch.URL())
 	if err != nil {
 		return err
 	}
-	control.SetAllowedOrigins(append(
-		allowedOrigins(config.Site, options.Port),
-		launchAddress.Scheme+"://"+launchAddress.Host,
-	))
-	options.console.show(consoleView{state: "setup", entry: launch.URL()})
-	options.console.openBrowser(launch.URL())
+	configMu.Lock()
+	launcherOrigin = launchAddress.Scheme + "://" + launchAddress.Host
+	err = control.SetAllowedOrigins(append(allowedOrigins(config.Site, options.Port), launcherOrigin))
+	configMu.Unlock()
+	if err != nil {
+		return err
+	}
+	if !automatic {
+		options.console.show(consoleView{state: "setup", entry: launch.URL()})
+		options.console.openBrowser(launch.URL())
+	} else if initialConfig.Site != "" && !options.Local && !options.Link {
+		// --site is still an explicit approval shortcut. It supplies native
+		// capabilities immediately; the launcher can start a Local room later.
+		openSite(initialConfig.Site, options)
+	}
 
 	var selection launcher.Selection
-	select {
-	case selection = <-launch.Selection():
-	case <-ctx.Done():
-		return nil
-	case err = <-launch.Done():
-		if err != nil {
-			return fmt.Errorf("Piik App launcher stopped unexpectedly: %w", err)
+	if automatic && (options.Local || options.Link || initialConfig.Site == "") {
+		selection = launcher.Selection{Mode: launcher.ModeLocal, LocalAccessPassword: initialConfig.LocalAccessPassword}
+		if options.Link {
+			selection.Mode = launcher.ModeLink
 		}
-		return nil
+		launch.Begin()
+	} else {
+		select {
+		case selection = <-launch.Selection():
+		case <-ctx.Done():
+			return nil
+		case err = <-control.Done():
+			return err
+		case err = <-launch.Done():
+			if err != nil {
+				return fmt.Errorf("Piik App launcher stopped unexpectedly: %w", err)
+			}
+			return nil
+		}
+	}
+	if selection.Language != "" {
+		options.console.setLanguage(selection.Language)
 	}
-	options.console.setLanguage(selection.Language)
 	if err := launcher.SaveMode(configPath, selection.Mode); err != nil {
 		slog.Debug("Could not save the launcher mode", diagnostics.Error(err))
 	}
-	if selection.Mode == launcher.ModeSite {
-		config.Site = selection.Site
-	} else {
-		config.LocalAccessPassword = selection.LocalAccessPassword
-	}
 	options.Local = selection.Mode == launcher.ModeLocal
 	options.Link = selection.Mode == launcher.ModeLink
 	options.Debug = options.Debug || selection.Debug
 	if selection.LANAddress != nil {
 		options.LANAddress = *selection.LANAddress
 	}
-	if err = configureDiagnostics(&options, config); err != nil {
+	selectedConfig, err := updateConfig(func(next *appconfig.Config) {
+		next.LocalAccessPassword = selection.LocalAccessPassword
+	})
+	if err != nil {
+		err = fmt.Errorf("Piik App configuration could not be saved: %w", err)
 		launch.SetResult("", err)
-		<-launch.Handled()
+		if !automatic {
+			<-launch.Handled()
+		}
 		return err
 	}
-	if err = appconfig.Save(configPath, config); err != nil {
-		err = fmt.Errorf("Piik App configuration could not be saved: %w", err)
+	if err = configureDiagnostics(&options, selectedConfig); err != nil {
 		launch.SetResult("", err)
-		<-launch.Handled()
+		if !automatic {
+			<-launch.Handled()
+		}
 		return err
 	}
-	control.SetAllowedOrigins(allowedOrigins(config.Site, options.Port))
-	options.DisableBrowser = true
+	if !automatic {
+		options.DisableBrowser = true
+	}
 	ready := make(chan string, 1)
-	options.Ready = func(target string) { ready <- target }
+	onReady := options.Ready
+	options.Ready = func(target string) {
+		if onReady != nil {
+			onReady(target)
+		}
+		ready <- target
+	}
 	runtimeContext, cancelRuntime := context.WithCancel(ctx)
 	runtimeDone := make(chan struct{})
 	var runtimeErr error
 	go func() {
-		runtimeErr = runConfigured(runtimeContext, options, config, control)
+		runtimeErr = runLocal(runtimeContext, options, selectedConfig, control)
 		close(runtimeDone)
 	}()
 	defer func() {
@@ -326,24 +385,20 @@ func runLauncher(
 		launch.SetResult(target, nil)
 	case <-runtimeDone:
 		launch.SetResult("", runtimeErr)
-		<-launch.Handled()
+		if !automatic {
+			<-launch.Handled()
+		}
 		return nil
 	case <-ctx.Done():
 		launch.SetResult("", ctx.Err())
 		return nil
 	}
 
-	select {
-	case <-launch.Handled():
-		_ = launch.Close()
-	case <-runtimeDone:
-		return nil
-	case <-ctx.Done():
-		return nil
-	}
 	select {
 	case <-runtimeDone:
 		return nil
+	case err = <-launch.Done():
+		return err
 	case <-ctx.Done():
 		return nil
 	}
@@ -401,11 +456,7 @@ func openDiagnostics(directory string) (*diagnostics.Recorder, error) {
 	return diagnostics.Open(filepath.Join(cache, "Piik", "logs"), "client", BuildRevision)
 }
 
-// runSite opens the configured Piik Site in the Browser and waits for the
-// loopback server, which is the only thing this mode owns. It takes no context:
-// cancellation reaches it through control.Done().
-func runSite(site string, options Options, control *loopback.Server) error {
-	var err error
+func openSite(site string, options Options) {
 	slog.Debug("piik-client", "event", "mode", "mode", "site")
 	targetURL := launchURL(site)
 	view := consoleView{mode: "site", state: "ready", entry: targetURL}
@@ -415,14 +466,11 @@ func runSite(site string, options Options, control *loopback.Server) error {
 	}
 	if !options.DisableBrowser {
 		options.console.openBrowser(targetURL)
-	} else if options.Ready != nil {
+	}
+	if options.Ready != nil {
 		options.Ready(targetURL)
 	}
 	slog.Debug("piik-client", "event", "site-ready")
-	if err = <-control.Done(); err != nil {
-		return fmt.Errorf("Piik App native control stopped unexpectedly: %w", err)
-	}
-	return nil
 }
 
 func runLocal(ctx context.Context, options Options, config appconfig.Config,
@@ -533,7 +581,8 @@ func runLocal(ctx context.Context, options Options, config appconfig.Config,
 	options.console.show(view)
 	if !options.DisableBrowser {
 		options.console.openBrowser(launchURL)
-	} else if options.Ready != nil {
+	}
+	if options.Ready != nil {
 		options.Ready(launchURL)
 	}
 	var tunnelDone <-chan struct{}
diff --git a/internal/app/app_test.go b/internal/app/app_test.go
index 88f90a8ec..2477c849a 100644
--- a/internal/app/app_test.go
+++ b/internal/app/app_test.go
@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"log"
 	"log/slog"
 	"net"
@@ -22,7 +23,6 @@ import (
 	tea "charm.land/bubbletea/v2"
 	appconfig "github.com/TNTcraftHIM/Piik/internal/app/config"
 	"github.com/TNTcraftHIM/Piik/internal/app/lan"
-	"github.com/TNTcraftHIM/Piik/internal/app/launcher"
 	"github.com/TNTcraftHIM/Piik/internal/app/loopback"
 	serverconfig "github.com/TNTcraftHIM/Piik/internal/server/config"
 )
@@ -226,7 +226,7 @@ func TestLauncherRetainsItsRuntimeFailureDuringCancellation(t *testing.T) {
 			go func() {
 				defer close(requestDone)
 				client := &http.Client{Timeout: 3 * time.Second}
-				response, err := client.Post(strings.TrimSuffix(target, "/client")+"/api/client-launcher/launch",
+				response, err := postLocalLauncher(client, strings.TrimSuffix(target, "/client")+"/api/client-launcher/launch",
 					"application/json", strings.NewReader(`{"mode":"link","language":"en"}`))
 				if err != nil {
 					if !cancelBeforeFailure {
@@ -304,7 +304,9 @@ func TestHungBrowserHandoffDoesNotBlockLauncherOrSiteExit(t *testing.T) {
 			done := make(chan error, 1)
 			go func() {
 				if mode == "site" {
-					done <- runSite("https://share.example", options, control)
+					options.SiteSet = true
+					config.Site = "https://share.example"
+					done <- runLauncher(ctx, options, configPath, config, control, func(*Options, appconfig.Config) error { return nil })
 				} else {
 					done <- runLauncher(ctx, options, configPath, config, control, func(*Options, appconfig.Config) error { return nil })
 				}
@@ -369,7 +371,9 @@ func TestBrowserOpenFailureKeepsTheAppAvailable(t *testing.T) {
 			done := make(chan error, 1)
 			go func() {
 				if mode == "site" {
-					done <- runSite("https://share.example", options, control)
+					options.SiteSet = true
+					config.Site = "https://share.example"
+					done <- runLauncher(ctx, options, configPath, config, control, func(*Options, appconfig.Config) error { return nil })
 				} else {
 					done <- runLauncher(ctx, options, configPath, config, control,
 						func(*Options, appconfig.Config) error { return nil })
@@ -404,20 +408,22 @@ func TestBrowserOpenFailureKeepsTheAppAvailable(t *testing.T) {
 			if mode == "launcher" {
 				client := &http.Client{Timeout: 3 * time.Second}
 				origin := strings.TrimSuffix(view.entry, "/client")
-				response, err := client.Post(origin+"/api/client-launcher/launch", "application/json",
-					strings.NewReader(`{"mode":"site","language":"en","site":"https://share.example"}`))
+
+				response, err := postLocalLauncher(client, origin+"/api/client-launcher/site", "application/json",
+					strings.NewReader(`{"site":"https://share.example","expectedSite":""}`))
 				if err != nil {
 					t.Fatal(err)
 				}
 				defer response.Body.Close()
-				var result struct{ Target string }
-				if json.NewDecoder(response.Body).Decode(&result) != nil || response.StatusCode != http.StatusOK ||
-					result.Target != launchURL("https://share.example") {
-					t.Fatalf("manual launch failed: status=%d, target=%q", response.StatusCode, result.Target)
+				var result struct{ Site string }
+				if json.NewDecoder(response.Body).Decode(&result) != nil || response.StatusCode != http.StatusOK || result.Site != "https://share.example" {
+					t.Fatalf("manual approval failed: status=%d, site=%q", response.StatusCode, result.Site)
 				}
-				if saved, err := launcher.LoadMode(configPath); err != nil || saved != launcher.ModeSite {
-					t.Fatalf("manual selection was not saved: %q, %v", saved, err)
+				saved, err := appconfig.LoadOrCreate(configPath)
+				if err != nil || saved.Site != result.Site {
+					t.Fatalf("approval was not saved: %v", err)
 				}
+
 			}
 		})
 	}
@@ -743,3 +749,14 @@ func TestLocalServerOwnsItsSTUNConfiguration(t *testing.T) {
 		})
 	}
 }
+
+func postLocalLauncher(client *http.Client, target, contentType string, body io.Reader) (*http.Response, error) {
+	req, err := http.NewRequest(http.MethodPost, target, body)
+	if err != nil {
+		return nil, err
+	}
+	address, _ := url.Parse(target)
+	req.Header.Set("Origin", address.Scheme+"://"+address.Host)
+	req.Header.Set("Content-Type", contentType)
+	return client.Do(req)
+}
diff --git a/internal/app/console.go b/internal/app/console.go
index 0a4bb04da..bc3998a5f 100644
--- a/internal/app/console.go
+++ b/internal/app/console.go
@@ -87,7 +87,7 @@ var consoleCopy = map[string][3]string{
 	"local":        {"Local network", "局域网", "□"},
 	"link":         {"Public link", "公网链接", "↗"},
 	"site":         {"Piik Site", "Piik 站点", "@"},
-	"setup":        {"Choose a mode in the browser", "在浏览器中选择模式", "?"},
+	"setup":        {"App is ready", "App 已就绪", "?"},
 	"starting":     {"Starting", "正在启动", "…"},
 	"ready":        {"Ready", "已就绪", "✓"},
 	"stopping":     {"Stopping", "正在退出", "→"},
diff --git a/internal/app/launcher/preference.go b/internal/app/launcher/preference.go
index facb77351..cf28634e8 100644
--- a/internal/app/launcher/preference.go
+++ b/internal/app/launcher/preference.go
@@ -31,5 +31,5 @@ func SaveMode(configPath string, mode Mode) error {
 }
 
 func validMode(mode Mode) bool {
-	return mode == ModeLocal || mode == ModeLink || mode == ModeSite
+	return mode == ModeLocal || mode == ModeLink
 }
diff --git a/internal/app/launcher/preference_test.go b/internal/app/launcher/preference_test.go
index b478395b7..60d4ff305 100644
--- a/internal/app/launcher/preference_test.go
+++ b/internal/app/launcher/preference_test.go
@@ -27,10 +27,8 @@ func TestSavedModeSurvivesRelaunchWithoutChangingLegacyConfig(t *testing.T) {
 		site   string
 		want   Mode
 	}{
-		{ModeSite, config.Site, ModeSite},
 		{ModeLocal, config.Site, ModeLocal},
 		{ModeLink, config.Site, ModeLink},
-		{ModeSite, "", ModeLink},
 	} {
 		if err := SaveMode(path, test.chosen); err != nil {
 			t.Fatal(err)
diff --git a/internal/app/launcher/server.go b/internal/app/launcher/server.go
index a63b0de45..9763bb26f 100644
--- a/internal/app/launcher/server.go
+++ b/internal/app/launcher/server.go
@@ -8,6 +8,7 @@ import (
 	"io"
 	"io/fs"
 	"log/slog"
+	"mime"
 	"net"
 	"net/http"
 	"net/url"
@@ -34,13 +35,11 @@ type Mode string
 const (
 	ModeLocal Mode = "local"
 	ModeLink  Mode = "link"
-	ModeSite  Mode = "site"
 )
 
 type Selection struct {
 	Mode                Mode    `json:"mode"`
 	Language            string  `json:"language"`
-	Site                string  `json:"site,omitempty"`
 	LocalAccessPassword string  `json:"localAccessPassword"`
 	Debug               bool    `json:"debug,omitempty"`
 	LANAddress          *string `json:"lanAddress,omitempty"`
@@ -54,6 +53,8 @@ type Options struct {
 	LocalAccessPassword string
 	Debug               bool
 	LANAddress          string
+	ChangeSite          func(string) (string, error)
+	EnableDebug         func() error
 }
 
 var listLANAddresses = lan.List
@@ -72,6 +73,8 @@ type Server struct {
 	revision            string
 	debug               bool
 	lanAddress          string
+	changeSite          func(string) (string, error)
+	enableDebug         func() error
 	selection           chan Selection
 	resultReady         chan struct{}
 	handled             chan struct{}
@@ -123,6 +126,8 @@ func Start(parent context.Context, assets fs.FS, options Options) (*Server, erro
 		revision:            strings.TrimSpace(options.Revision),
 		debug:               options.Debug,
 		lanAddress:          options.LANAddress,
+		changeSite:          options.ChangeSite,
+		enableDebug:         options.EnableDebug,
 		selection:           make(chan Selection, 1),
 		resultReady:         make(chan struct{}),
 		handled:             make(chan struct{}),
@@ -159,6 +164,16 @@ func (server *Server) Done() <-chan error {
 	return server.done
 }
 
+func (server *Server) Begin() bool {
+	server.mu.Lock()
+	defer server.mu.Unlock()
+	if server.selected {
+		return false
+	}
+	server.selected = true
+	return true
+}
+
 func (server *Server) SetResult(target string, resultErr error) {
 	server.resultOnce.Do(func() {
 		if resultErr == nil && !validTarget(target) {
@@ -196,11 +211,18 @@ func (server *Server) ServeHTTP(response http.ResponseWriter, request *http.Requ
 		return
 	}
 	response.Header().Set("X-Content-Type-Options", "nosniff")
+	response.Header().Set("Content-Security-Policy", "frame-ancestors 'none'")
+	response.Header().Set("X-Frame-Options", "DENY")
+	response.Header().Set("Referrer-Policy", "no-referrer")
 	switch request.URL.Path {
 	case "/api/client-launcher":
 		server.handleState(response, request)
 	case "/api/client-launcher/launch":
 		server.handleLaunch(response, request)
+	case "/api/client-launcher/site":
+		server.handleSite(response, request)
+	case "/api/client-launcher/debug":
+		server.handleDebug(response, request)
 	case "/client", "/client/":
 		if request.Method != http.MethodGet && request.Method != http.MethodHead {
 			response.Header().Set("Allow", "GET, HEAD")
@@ -232,24 +254,97 @@ func (server *Server) handleState(response http.ResponseWriter, request *http.Re
 		values = append(values, address.Address)
 	}
 	selected, _ := lan.Select(values, server.lanAddress)
-	writeJSON(response, http.StatusOK, map[string]any{
+	server.mu.Lock()
+	state := map[string]any{
 		"site":                server.site,
 		"localAccessPassword": server.localAccessPassword,
 		"version":             server.version,
 		"revision":            server.revision,
 		"packageTarget":       runtime.GOOS + "-" + runtime.GOARCH,
 		"debug":               server.debug,
+		"target":              server.target,
+		"starting":            server.selected && !server.resultSet,
+		"detail":              errorDetail(server.resultErr),
 		"lan":                 map[string]any{"addresses": addresses, "selected": selected},
 		"defaultMode": func() Mode {
-			if validMode(server.defaultMode) && (server.defaultMode != ModeSite || server.site != "") {
+			if server.defaultMode == ModeLocal || server.defaultMode == ModeLink {
 				return server.defaultMode
 			}
-			if server.site != "" {
-				return ModeSite
-			}
 			return ModeLink
 		}(),
-	})
+	}
+	server.mu.Unlock()
+	writeJSON(response, http.StatusOK, state)
+}
+
+func (server *Server) handleSite(response http.ResponseWriter, request *http.Request) {
+	if request.Method != http.MethodPost {
+		response.Header().Set("Allow", http.MethodPost)
+		http.Error(response, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	request.Body = http.MaxBytesReader(response, request.Body, maxRequestBytes)
+	var change struct {
+		Site         string `json:"site"`
+		ExpectedSite string `json:"expectedSite"`
+	}
+	decoder := json.NewDecoder(request.Body)
+	decoder.DisallowUnknownFields()
+	if decoder.Decode(&change) != nil || decoder.Decode(&struct{}{}) != io.EOF {
+		http.Error(response, "invalid site request", http.StatusBadRequest)
+		return
+	}
+	site, err := appconfig.NormalizeSite(change.Site)
+	if err != nil {
+		http.Error(response, "invalid site origin", http.StatusBadRequest)
+		return
+	}
+	server.mu.Lock()
+	if server.site != change.ExpectedSite {
+		current := server.site
+		server.mu.Unlock()
+		writeJSON(response, http.StatusConflict, map[string]string{"site": current})
+		return
+	}
+	if server.changeSite == nil {
+		server.mu.Unlock()
+		http.Error(response, "site approval is unavailable", http.StatusServiceUnavailable)
+		return
+	}
+	current, err := server.changeSite(site)
+	// Revocation can succeed while media cleanup times out. Reflect the actual
+	// saved permission even on error; a stale confirmation must not restore it.
+	server.site = current
+	server.mu.Unlock()
+	if err != nil {
+		writeJSON(response, http.StatusServiceUnavailable, map[string]string{"site": current, "detail": errorDetail(err)})
+		return
+	}
+	writeJSON(response, http.StatusOK, map[string]string{"site": current})
+}
+
+func (server *Server) handleDebug(response http.ResponseWriter, request *http.Request) {
+	if request.Method != http.MethodPost {
+		response.Header().Set("Allow", http.MethodPost)
+		http.Error(response, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	server.mu.Lock()
+	if !server.debug {
+		if server.selected || server.enableDebug == nil {
+			server.mu.Unlock()
+			http.Error(response, "enable diagnostics before starting a local room", http.StatusConflict)
+			return
+		}
+		if err := server.enableDebug(); err != nil {
+			server.mu.Unlock()
+			writeJSON(response, http.StatusServiceUnavailable, map[string]string{"detail": errorDetail(err)})
+			return
+		}
+		server.debug = true
+	}
+	server.mu.Unlock()
+	writeJSON(response, http.StatusOK, map[string]bool{"debug": true})
 }
 
 func (server *Server) handleLaunch(response http.ResponseWriter, request *http.Request) {
@@ -266,16 +361,12 @@ func (server *Server) handleLaunch(response http.ResponseWriter, request *http.R
 		})
 		return
 	}
-	server.mu.Lock()
-	if server.selected {
-		server.mu.Unlock()
+	if !server.Begin() {
 		writeJSON(response, http.StatusConflict, map[string]string{
 			"error": "launch already requested", "detail": "Close and reopen Piik before starting again.",
 		})
 		return
 	}
-	server.selected = true
-	server.mu.Unlock()
 
 	select {
 	case server.selection <- selection:
@@ -339,6 +430,10 @@ func (server *Server) requestAllowed(request *http.Request) bool {
 		return false
 	}
 	origin := strings.TrimSpace(request.Header.Get("Origin"))
+	if request.Method == http.MethodPost {
+		mediaType, _, err := mime.ParseMediaType(request.Header.Get("Content-Type"))
+		return err == nil && mediaType == "application/json" && sameOrigin(origin, "http://"+request.Host)
+	}
 	return origin == "" || sameOrigin(origin, "http://"+request.Host)
 }
 
@@ -373,19 +468,6 @@ func decodeSelection(reader io.Reader) (Selection, error) {
 	}
 	switch selection.Mode {
 	case ModeLocal, ModeLink:
-		if strings.TrimSpace(selection.Site) != "" {
-			return Selection{}, errors.New("local launch cannot include a Site")
-		}
-		selection.Site = ""
-	case ModeSite:
-		if selection.LocalAccessPassword != "" {
-			return Selection{}, errors.New("Site launch cannot include a local access password")
-		}
-		normalized, err := appconfig.NormalizeSite(selection.Site)
-		if err != nil || normalized == "" {
-			return Selection{}, errors.New("Site launch requires an HTTP or HTTPS origin")
-		}
-		selection.Site = normalized
 	default:
 		return Selection{}, errors.New("unknown launch mode")
 	}
diff --git a/internal/app/launcher/server_test.go b/internal/app/launcher/server_test.go
index 5ceeb5c75..0f7b657e4 100644
--- a/internal/app/launcher/server_test.go
+++ b/internal/app/launcher/server_test.go
@@ -4,8 +4,10 @@ import (
 	"bytes"
 	"encoding/json"
 	"errors"
+	"io"
 	"io/fs"
 	"net/http"
+	"net/url"
 	"runtime"
 	"strings"
 	"testing"
@@ -40,7 +42,7 @@ func TestLauncherServesStateAndCompletesOneSelection(t *testing.T) {
 		Debug               *bool  `json:"debug"`
 	}
 	if response.StatusCode != http.StatusOK || json.NewDecoder(response.Body).Decode(&state) != nil ||
-		state.Site != "https://share.example" || state.DefaultMode != ModeSite ||
+		state.Site != "https://share.example" || state.DefaultMode != ModeLink ||
 		state.Version != "development" || state.Revision != "" || state.LocalAccessPassword != "" || state.Debug == nil || *state.Debug {
 		t.Fatalf("launcher state = %d, %+v", response.StatusCode, state)
 	}
@@ -48,7 +50,7 @@ func TestLauncherServesStateAndCompletesOneSelection(t *testing.T) {
 	result := make(chan *http.Response, 1)
 	requestErr := make(chan error, 1)
 	go func() {
-		response, err := http.Post(
+		response, err := localPost(
 			origin+"/api/client-launcher/launch",
 			"application/json",
 			bytes.NewBufferString(`{"mode":"link","language":"vis","debug":true}`),
@@ -148,7 +150,7 @@ func TestLauncherLANChoicesUseCurrentAddressesAndTheExplicitPreference(t *testin
 				}
 			}
 			if err := json.NewDecoder(response.Body).Decode(&state); err != nil || response.StatusCode != http.StatusOK ||
-				state.DefaultMode != ModeSite || state.LAN == nil || state.LAN.Addresses == nil ||
+				state.DefaultMode != ModeLink || state.LAN == nil || state.LAN.Addresses == nil ||
 				state.LAN.Selected != test.selected || len(state.LAN.Addresses) != len(test.addresses) {
 				t.Fatalf("LAN choices = %+v, status %d, %v", state, response.StatusCode, err)
 			}
@@ -164,7 +166,7 @@ func TestLauncherLANChoicesUseCurrentAddressesAndTheExplicitPreference(t *testin
 func TestLauncherPassesTheChosenLANAddressToTheApp(t *testing.T) {
 	server := startFixture(t, "")
 	server.SetResult("http://localhost:8787/#piik-client=1", nil)
-	response, err := http.Post(strings.TrimSuffix(server.URL(), "/client")+"/api/client-launcher/launch",
+	response, err := localPost(strings.TrimSuffix(server.URL(), "/client")+"/api/client-launcher/launch",
 		"application/json", strings.NewReader(`{"mode":"local","language":"en","lanAddress":"192.168.1.4"}`))
 	if err != nil {
 		t.Fatal(err)
@@ -206,7 +208,7 @@ func TestLauncherPreservesAnOptionalLocalPassword(t *testing.T) {
 				t.Fatal(err)
 			}
 			go func() {
-				response, err := http.Post(
+				response, err := localPost(
 					origin+"/api/client-launcher/launch",
 					"application/json",
 					bytes.NewReader(payload),
@@ -251,25 +253,6 @@ func TestLauncherRequiresTheEmbeddedBrowserBuild(t *testing.T) {
 	}
 }
 
-func TestLauncherNormalizesSiteSelection(t *testing.T) {
-	for input, want := range map[string]string{
-		" Share.Example:443/ ":     "https://share.example",
-		"https://Share.Example/":   "https://share.example",
-		"http://192.168.1.4:8787/": "http://192.168.1.4:8787",
-	} {
-		t.Run(input, func(t *testing.T) {
-			payload, err := json.Marshal(Selection{Mode: ModeSite, Language: "en", Site: input})
-			if err != nil {
-				t.Fatal(err)
-			}
-			selection, err := decodeSelection(bytes.NewReader(payload))
-			if err != nil || selection.Site != want {
-				t.Fatalf("site selection = %+v, %v; want %q", selection, err, want)
-			}
-		})
-	}
-}
-
 func TestLauncherRejectsInvalidSelections(t *testing.T) {
 	for name, payload := range map[string]string{
 		"unknown":          `{"mode":"other","language":"en"}`,
@@ -294,7 +277,7 @@ func TestLauncherRejectsInvalidSelections(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			server := startFixture(t, "")
 			origin := strings.TrimSuffix(server.URL(), "/client")
-			response, err := http.Post(
+			response, err := localPost(
 				origin+"/api/client-launcher/launch",
 				"application/json",
 				bytes.NewBufferString(payload),
@@ -331,7 +314,7 @@ func TestLauncherReportsSafeBoundedFailureDetails(t *testing.T) {
 	}
 	_ = response.Body.Close()
 	server.SetResult("", errors.New("public tunnel failed: token=private-secret "+strings.Repeat("network unavailable ", 200)))
-	response, err = http.Post(origin+"/api/client-launcher/launch", "application/json",
+	response, err = localPost(origin+"/api/client-launcher/launch", "application/json",
 		strings.NewReader(`{"mode":"link","language":"en"}`))
 	if err != nil {
 		t.Fatal(err)
@@ -411,3 +394,14 @@ func startFixtureWithBuildAndPassword(
 	t.Cleanup(func() { _ = server.Close() })
 	return server
 }
+
+func localPost(target, contentType string, body io.Reader) (*http.Response, error) {
+	req, err := http.NewRequest(http.MethodPost, target, body)
+	if err != nil {
+		return nil, err
+	}
+	address, _ := url.Parse(target)
+	req.Header.Set("Origin", address.Scheme+"://"+address.Host)
+	req.Header.Set("Content-Type", contentType)
+	return (&http.Client{Timeout: 3 * time.Second}).Do(req)
+}
diff --git a/internal/app/launcher/site_access_test.go b/internal/app/launcher/site_access_test.go
new file mode 100644
index 000000000..e8d95d837
--- /dev/null
+++ b/internal/app/launcher/site_access_test.go
@@ -0,0 +1,133 @@
+package launcher
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+func TestSiteApprovalIsLocalExplicitAndDoesNotStartARoom(t *testing.T) {
+	current := ""
+	debugCalls := 0
+	server, err := Start(t.Context(), appAssets(), Options{
+		ChangeSite:  func(site string) (string, error) { current = site; return current, nil },
+		EnableDebug: func() error { debugCalls++; return nil },
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = server.Close() })
+	origin := strings.TrimSuffix(server.URL(), "/client")
+	for _, path := range []string{"site", "launch", "debug"} {
+		for _, test := range []struct{ origin, contentType string }{
+			{"", "application/json"}, {"null", "application/json"}, {"https://other.example", "application/json"},
+			{origin, "text/plain"}, {origin, "application/x-www-form-urlencoded"},
+		} {
+			request, _ := http.NewRequest("POST", origin+"/api/client-launcher/"+path, strings.NewReader(`{"site":"https://other.example","expectedSite":""}`))
+			request.Header.Set("Origin", test.origin)
+			request.Header.Set("Content-Type", test.contentType)
+			response, err := http.DefaultClient.Do(request)
+			if err != nil {
+				t.Fatal(err)
+			}
+			response.Body.Close()
+			if response.StatusCode != 404 {
+				t.Fatalf("mutation admitted nonlocal or form request: %s %+v", path, test)
+			}
+		}
+	}
+	if current != "" || debugCalls != 0 {
+		t.Fatal("unapproved request had side effects")
+	}
+	for range 2 {
+		response, err := localPost(origin+"/api/client-launcher/debug", "application/json", strings.NewReader(`{}`))
+		if err != nil {
+			t.Fatal(err)
+		}
+		response.Body.Close()
+		if response.StatusCode != 200 {
+			t.Fatal("standby diagnostics could not start")
+		}
+	}
+	if debugCalls != 1 {
+		t.Fatalf("diagnostic owner started %d times", debugCalls)
+	}
+	for _, test := range []struct {
+		site, expected, want string
+		status               int
+	}{
+		{"https://Share.Example:443/", "", "https://share.example", 200},
+		{"https://other.example", "", "https://share.example", 409},
+		{"", "https://share.example", "", 200},
+	} {
+		body := fmt.Sprintf(`{"site":%q,"expectedSite":%q}`, test.site, test.expected)
+		response, err := localPost(origin+"/api/client-launcher/site", "application/json", strings.NewReader(body))
+		if err != nil {
+			t.Fatal(err)
+		}
+		var result struct{ Site string }
+		err = json.NewDecoder(response.Body).Decode(&result)
+		response.Body.Close()
+		if err != nil || response.StatusCode != test.status || result.Site != test.want || current != test.want {
+			t.Fatalf("approval result: status %d, %+v, saved %q, %v", response.StatusCode, result, current, err)
+		}
+	}
+	select {
+	case <-server.Selection():
+		t.Fatal("site approval created Local room authority")
+	default:
+	}
+	response, err := http.Get(server.URL())
+	if err != nil {
+		t.Fatal(err)
+	}
+	response.Body.Close()
+	if response.Header.Get("X-Frame-Options") != "DENY" || response.Header.Get("Content-Security-Policy") != "frame-ancestors 'none'" {
+		t.Fatal("approval page can be framed")
+	}
+}
+
+func TestSiteApprovalFailureReflectsTheActualPermission(t *testing.T) {
+	for _, applied := range []bool{false, true} {
+		t.Run(fmt.Sprint(applied), func(t *testing.T) {
+			server, err := Start(t.Context(), appAssets(), Options{Site: "https://old.example", ChangeSite: func(site string) (string, error) {
+				if applied {
+					return site, errors.New("retirement still pending")
+				}
+				return "https://old.example", errors.New("save failed")
+			}})
+			if err != nil {
+				t.Fatal(err)
+			}
+			t.Cleanup(func() { _ = server.Close() })
+			origin := strings.TrimSuffix(server.URL(), "/client")
+			response, err := localPost(origin+"/api/client-launcher/site", "application/json", strings.NewReader(`{"site":"https://new.example","expectedSite":"https://old.example"}`))
+			if err != nil {
+				t.Fatal(err)
+			}
+			var failure struct{ Site, Detail string }
+			err = json.NewDecoder(response.Body).Decode(&failure)
+			response.Body.Close()
+			want := "https://old.example"
+			if applied {
+				want = "https://new.example"
+			}
+			if err != nil || response.StatusCode != 503 || failure.Site != want || failure.Detail == "" {
+				t.Fatal("error hid actual permission")
+			}
+			response, err = http.Get(origin + "/api/client-launcher")
+			if err != nil {
+				t.Fatal(err)
+			}
+			var state struct{ Site string }
+			err = json.NewDecoder(response.Body).Decode(&state)
+			response.Body.Close()
+			if err != nil || state.Site != want {
+				t.Fatal("launcher disagrees with persisted permission")
+			}
+		})
+	}
+}
diff --git a/internal/app/loopback/quality_preference_test.go b/internal/app/loopback/quality_preference_test.go
index c5d167243..4e59b95e3 100644
--- a/internal/app/loopback/quality_preference_test.go
+++ b/internal/app/loopback/quality_preference_test.go
@@ -72,7 +72,7 @@ func TestQualityPreferenceRequiresCurrentOriginAndInstanceWithoutClaimingControl
 	}
 	server.mu.Lock()
 	defer server.mu.Unlock()
-	if server.claimed != 0 {
+	if len(server.connections) != 0 {
 		t.Fatal("preference claimed media control")
 	}
 }
diff --git a/internal/app/loopback/server.go b/internal/app/loopback/server.go
index 0e56477c1..a31db0dfc 100644
--- a/internal/app/loopback/server.go
+++ b/internal/app/loopback/server.go
@@ -101,17 +101,27 @@ type Server struct {
 	newControl        func() ControlSession
 	presentation      func(string)
 	qualityPreference *appconfig.QualityPreference
+	connectURL        string
 	done              chan error
 
 	mu          sync.Mutex
-	connections map[*websocket.Conn]struct{}
-	claimed     int
+	connections map[*controlConnection]struct{}
 	closed      bool
 	controls    sync.WaitGroup
 	closeOnce   sync.Once
 	closeErr    error
 }
 
+// Claims start before the WebSocket upgrade so revocation also retires a
+// pending handshake, even if that same origin is approved again later.
+type controlConnection struct {
+	origin string
+	ctx    context.Context
+	cancel context.CancelFunc
+	socket *websocket.Conn
+	done   chan struct{}
+}
+
 func Start(parent context.Context, options Options) (*Server, error) {
 	if parent == nil {
 		parent = context.Background()
@@ -146,7 +156,7 @@ func Start(parent context.Context, options Options) (*Server, error) {
 		presentation:      options.Presentation,
 		qualityPreference: options.QualityPreference,
 		done:              make(chan error, 1),
-		connections:       make(map[*websocket.Conn]struct{}),
+		connections:       make(map[*controlConnection]struct{}),
 	}
 	server.httpServer = &http.Server{
 		Handler:           server,
@@ -169,9 +179,40 @@ func (server *Server) Done() <-chan error {
 	return server.done
 }
 
-func (server *Server) SetAllowedOrigins(origins []string) {
+func (server *Server) SetAllowedOrigins(origins []string) error {
 	server.mu.Lock()
 	server.allowedOrigins = normalizedOrigins(origins)
+	var retired []*controlConnection
+	for connection := range server.connections {
+		if connection.ctx.Err() != nil || !server.originAllowedLocked(connection.origin) {
+			connection.cancel()
+			retired = append(retired, connection)
+		}
+	}
+	server.mu.Unlock()
+	ctx, cancel := context.WithTimeout(server.ctx, shutdownTimeout)
+	defer cancel()
+	for _, connection := range retired {
+		// A cancelled claim cannot attach a socket after leaving the lock.
+		if connection.socket != nil {
+			_ = connection.socket.CloseNow()
+		}
+	}
+	for _, connection := range retired {
+		select {
+		case <-connection.done:
+		case <-ctx.Done():
+			// Permission already changed. Never restore a revoked origin because
+			// one of its media resources is slow to close.
+			return errors.New("App is still releasing the previous site's media; try again shortly")
+		}
+	}
+	return nil
+}
+
+func (server *Server) SetConnectURL(value string) {
+	server.mu.Lock()
+	server.connectURL = value
 	server.mu.Unlock()
 }
 
@@ -181,7 +222,10 @@ func (server *Server) Close() error {
 		server.closed = true
 		connections := make([]*websocket.Conn, 0, len(server.connections))
 		for connection := range server.connections {
-			connections = append(connections, connection)
+			connection.cancel()
+			if connection.socket != nil {
+				connections = append(connections, connection.socket)
+			}
 		}
 		server.mu.Unlock()
 		server.cancel()
@@ -218,6 +262,10 @@ func (server *Server) serve() {
 }
 
 func (server *Server) ServeHTTP(response http.ResponseWriter, request *http.Request) {
+	if request.URL.Path == "/connect-discovery" {
+		server.handleConnectDiscovery(response, request)
+		return
+	}
 	if !server.requestAllowed(response, request) {
 		return
 	}
@@ -235,6 +283,48 @@ func (server *Server) ServeHTTP(response http.ResponseWriter, request *http.Requ
 	}
 }
 
+// Discovery is the only cross-origin endpoint available before local approval.
+// It exposes process identity and its local approval page, never capabilities,
+// source lists, settings, or control access. A GET has no side effects.
+func (server *Server) handleConnectDiscovery(response http.ResponseWriter, request *http.Request) {
+	if !server.hostAllowed(request.Host) {
+		http.NotFound(response, request)
+		return
+	}
+	origin := request.Header.Get("Origin")
+	normalized, err := appconfig.NormalizeSite(origin)
+	if err != nil || origin == "" || normalized != origin {
+		http.Error(response, "forbidden", http.StatusForbidden)
+		return
+	}
+	response.Header().Set("Access-Control-Allow-Origin", origin)
+	response.Header().Add("Vary", "Origin")
+	response.Header().Set("Cache-Control", "no-store")
+	if request.Method == http.MethodOptions {
+		response.Header().Set("Access-Control-Allow-Methods", http.MethodGet)
+		allowPrivateNetwork(response, request)
+		response.WriteHeader(http.StatusNoContent)
+		return
+	}
+	if request.Method != http.MethodGet {
+		response.Header().Set("Allow", "GET, OPTIONS")
+		http.Error(response, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	server.mu.Lock()
+	connectURL := server.connectURL
+	server.mu.Unlock()
+	if connectURL == "" {
+		http.NotFound(response, request)
+		return
+	}
+	writeJSON(response, http.StatusOK, map[string]any{
+		"protocol": ProtocolVersion, "service": ServiceName,
+		"port": server.endpoint.Port, "instanceToken": server.endpoint.InstanceToken,
+		"connectURL": connectURL,
+	})
+}
+
 func (server *Server) handlePresentation(response http.ResponseWriter, request *http.Request) {
 	if request.Method == http.MethodOptions {
 		response.Header().Set("Access-Control-Allow-Methods", http.MethodPost)
@@ -300,15 +390,16 @@ func (server *Server) handleControl(response http.ResponseWriter, request *http.
 		http.Error(response, "method not allowed", http.StatusMethodNotAllowed)
 		return
 	}
-	if !server.claimConnection() {
+	claim := server.claimConnection(request.Header.Get("Origin"))
+	if claim == nil {
 		http.Error(response, "native control capacity is occupied", http.StatusConflict)
 		return
 	}
 	var connection *websocket.Conn
-	defer func() { server.releaseConnection(connection) }()
+	defer server.releaseConnection(claim)
 	expectedSubprotocol := ControlSubprotocol + "." + server.endpoint.InstanceToken
 	var err error
-	connection, err = websocket.Accept(response, request, &websocket.AcceptOptions{
+	connection, err = websocket.Accept(response, request.WithContext(claim.ctx), &websocket.AcceptOptions{
 		Subprotocols:   []string{expectedSubprotocol},
 		OriginPatterns: server.originPatterns(),
 	})
@@ -320,12 +411,12 @@ func (server *Server) handleControl(response http.ResponseWriter, request *http.
 		closeControl(connection, "unsupported control protocol")
 		return
 	}
-	if !server.setConnection(connection) {
+	if !server.setConnection(claim, connection) {
 		return
 	}
 	connection.SetReadLimit(MaxControlMessageBytes)
 
-	helloContext, cancelHello := context.WithTimeout(server.ctx, helloTimeout)
+	helloContext, cancelHello := context.WithTimeout(claim.ctx, helloTimeout)
 	messageType, payload, err := connection.Read(helloContext)
 	cancelHello()
 	if err != nil || messageType != websocket.MessageText {
@@ -357,13 +448,12 @@ func (server *Server) handleControl(response http.ResponseWriter, request *http.
 		}
 		return connection.Write(ctx, websocket.MessageText, encoded)
 	}
-	if err = write(server.ctx, controlMessage{
+	if err = write(claim.ctx, controlMessage{
 		Version: ProtocolVersion, ID: message.ID, Type: "ready",
 	}); err != nil {
 		return
 	}
-	controlContext, cancelControl := context.WithCancel(server.ctx)
-	defer cancelControl()
+	controlContext, cancelControl := claim.ctx, claim.cancel
 	var extension ControlSession
 	if server.newControl != nil {
 		extension = server.newControl()
@@ -403,12 +493,18 @@ func (server *Server) handleControl(response http.ResponseWriter, request *http.
 		}
 	}()
 	for {
+		if controlContext.Err() != nil {
+			return
+		}
 		select {
 		case <-controlContext.Done():
 			return
 		case payload = <-reads:
 			messageType = websocket.MessageText
 		}
+		if controlContext.Err() != nil {
+			return
+		}
 		message, err = decodeEnvelope(payload)
 		if err != nil {
 			closeControl(connection, "invalid control message")
@@ -490,6 +586,20 @@ func (server *Server) allowedOrigin(origin string) bool {
 	return false
 }
 
+// Caller holds mu. Empty Origin is reserved for per-user native tooling;
+// browsers always send it when opening a cross-origin control connection.
+func (server *Server) originAllowedLocked(origin string) bool {
+	if origin == "" || server.localOrigin(origin) {
+		return true
+	}
+	for _, allowed := range server.allowedOrigins {
+		if sameOrigin(origin, allowed) {
+			return true
+		}
+	}
+	return false
+}
+
 func (server *Server) hostAllowed(host string) bool {
 	if host == server.endpoint.Host {
 		return true
@@ -498,40 +608,40 @@ func (server *Server) hostAllowed(host string) bool {
 }
 
 func (server *Server) localOrigin(origin string) bool {
-	parsed, err := url.Parse(origin)
-	return err == nil && parsed.Scheme == "http" &&
-		parsed.Port() == strconv.Itoa(server.endpoint.Port) &&
-		(strings.EqualFold(parsed.Hostname(), "localhost") ||
-			strings.EqualFold(parsed.Hostname(), "127.0.0.1"))
+	port := strconv.Itoa(server.endpoint.Port)
+	return sameOrigin(origin, "http://127.0.0.1:"+port) || sameOrigin(origin, "http://localhost:"+port)
 }
 
-func (server *Server) claimConnection() bool {
+func (server *Server) claimConnection(origin string) *controlConnection {
 	server.mu.Lock()
 	defer server.mu.Unlock()
-	if server.closed || server.claimed >= maxControlSessions {
-		return false
+	if server.closed || len(server.connections) >= maxControlSessions || !server.originAllowedLocked(origin) {
+		return nil
 	}
-	server.claimed++
+	ctx, cancel := context.WithCancel(server.ctx)
+	claim := &controlConnection{origin: origin, ctx: ctx, cancel: cancel, done: make(chan struct{})}
+	server.connections[claim] = struct{}{}
 	server.controls.Add(1)
-	return true
+	return claim
 }
 
-func (server *Server) setConnection(connection *websocket.Conn) bool {
+func (server *Server) setConnection(claim *controlConnection, connection *websocket.Conn) bool {
 	server.mu.Lock()
 	defer server.mu.Unlock()
-	if server.closed {
+	if server.closed || claim.ctx.Err() != nil {
 		return false
 	}
-	server.connections[connection] = struct{}{}
+	claim.socket = connection
 	return true
 }
 
-func (server *Server) releaseConnection(connection *websocket.Conn) {
+func (server *Server) releaseConnection(connection *controlConnection) {
+	connection.cancel()
 	server.mu.Lock()
 	delete(server.connections, connection)
-	server.claimed--
 	server.mu.Unlock()
 	server.controls.Done()
+	close(connection.done)
 }
 
 func listenInRange(bindAddress string, start, end int) (net.Listener, error) {
diff --git a/internal/app/loopback/site_access_test.go b/internal/app/loopback/site_access_test.go
new file mode 100644
index 000000000..3496896e4
--- /dev/null
+++ b/internal/app/loopback/site_access_test.go
@@ -0,0 +1,150 @@
+package loopback
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"testing"
+	"time"
+)
+
+func TestConnectDiscoveryDoesNotGrantNativeAccess(t *testing.T) {
+	server := startTestServer(t, "")
+	server.SetConnectURL("http://127.0.0.1:18990/client")
+	endpoint := server.Endpoint()
+	for _, test := range []struct {
+		method, path, origin string
+		status               int
+	}{
+		{"GET", "/connect-discovery", testOrigin, 200},
+		{"OPTIONS", "/connect-discovery", testOrigin, 204},
+		{"POST", "/connect-discovery", testOrigin, 405},
+		{"GET", "/connect-discovery", "null", 403},
+		{"GET", "/connect-discovery", "", 403},
+		{"GET", "/connect-discovery", testOrigin + "/path", 403},
+		{"GET", "/health", testOrigin, 403},
+		{"GET", "/control", testOrigin, 403},
+		{"GET", "/quality-preference", testOrigin, 403},
+	} {
+		request, _ := http.NewRequest(test.method, endpoint.URL+test.path, nil)
+		request.Header.Set("Origin", test.origin)
+		request.Header.Set("Access-Control-Request-Private-Network", "true")
+		response, err := http.DefaultClient.Do(request)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if response.StatusCode != test.status {
+			t.Fatalf("%+v: status %d", test, response.StatusCode)
+		}
+		if test.status == 200 {
+			var body map[string]any
+			if err := json.NewDecoder(response.Body).Decode(&body); err != nil {
+				t.Fatal(err)
+			}
+			if len(body) != 5 || body["connectURL"] != "http://127.0.0.1:18990/client" ||
+				body["instanceToken"] != endpoint.InstanceToken || body["service"] != ServiceName {
+				t.Fatalf("discovery exposed more than process identity and approval address: %v", body)
+			}
+		}
+		response.Body.Close()
+	}
+}
+
+type retiringControl struct {
+	*testControlSession
+	finish <-chan struct{}
+}
+
+func (session *retiringControl) Close() error {
+	_ = session.testControlSession.Close()
+	<-session.finish
+	return nil
+}
+
+func TestSiteChangeWaitsForMediaRetirementWithoutStoppingLocalSession(t *testing.T) {
+	finish := make(chan struct{})
+	defer close(finish)
+	created := make(chan *testControlSession, 2)
+	server := startTestServerWithOptions(t, Options{AllowedOrigins: []string{testOrigin}, NewControl: func() ControlSession {
+		session := &testControlSession{events: make(chan any), closed: make(chan struct{})}
+		created <- session
+		return &retiringControl{session, finish}
+	}})
+	endpoint := server.Endpoint()
+	old := dialControl(t, endpoint, endpoint.InstanceToken, testOrigin)
+	defer old.CloseNow()
+	writeControl(t, old, requestJSON("old_hello", "hello"))
+	var ready controlMessage
+	readControl(t, old, &ready)
+	oldSession := <-created
+	local := dialControl(t, endpoint, endpoint.InstanceToken, endpoint.URL)
+	defer local.CloseNow()
+	writeControl(t, local, requestJSON("local_hello", "hello"))
+	readControl(t, local, &ready)
+	localSession := <-created
+
+	done := make(chan error, 1)
+	go func() { done <- server.SetAllowedOrigins([]string{"https://next.example"}) }()
+	select {
+	case <-oldSession.closed:
+	case <-time.After(time.Second):
+		t.Fatal("revoked session did not start retirement")
+	}
+	select {
+	case err := <-done:
+		t.Fatalf("permission reported ready before cleanup: %v", err)
+	default:
+	}
+	select {
+	case <-localSession.closed:
+		t.Fatal("unrelated Local session was closed")
+	default:
+	}
+	writeControl(t, local, requestJSON("local_ping", "ping"))
+	readControl(t, local, &ready)
+	if ready.Type != "pong" {
+		t.Fatal("Local session was interrupted")
+	}
+	// A stuck media owner must not hang consent forever or restore old permission.
+	select {
+	case err := <-done:
+		if err == nil {
+			t.Fatal("stuck cleanup was reported as successful")
+		}
+	case <-time.After(3 * time.Second):
+		t.Fatal("permission retirement was unbounded")
+	}
+	response := doHealthRequest(t, endpoint, endpoint.Host, testOrigin)
+	response.Body.Close()
+	if response.StatusCode != 403 {
+		t.Fatal("timeout restored the revoked origin")
+	}
+}
+
+func TestPendingHandshakeCannotSurviveOriginReplacement(t *testing.T) {
+	server := startTestServer(t, testOrigin)
+	claim := server.claimConnection(testOrigin)
+	if claim == nil {
+		t.Fatal("initial claim failed")
+	}
+	defer server.releaseConnection(claim)
+	done := make(chan error, 1)
+	go func() { done <- server.SetAllowedOrigins(nil) }()
+	select {
+	case <-claim.ctx.Done():
+	case <-time.After(time.Second):
+		t.Fatal("pending upgrade was not cancelled")
+	}
+	// Regrant the same origin before its old handshake returns.
+	server.mu.Lock()
+	server.allowedOrigins = []string{testOrigin}
+	server.mu.Unlock()
+	if server.setConnection(claim, nil) {
+		t.Fatal("old generation regained permission")
+	}
+	// Cancellation of the App also bounds an already pending permission change.
+	server.cancel()
+	if err := <-done; err == nil || claim.ctx.Err() != context.Canceled {
+		t.Fatal("cancelled change reported ready")
+	}
+}
diff --git a/site/film/ui/main.tsx b/site/film/ui/main.tsx
index 6db1c6b6e..a4108cea1 100644
--- a/site/film/ui/main.tsx
+++ b/site/film/ui/main.tsx
@@ -208,7 +208,7 @@ function Screen({ shot }: { shot: Shot }) {
             mode={shot}
             onModeChange={noop}
             site=""
-            onSiteChange={noop}
+            onRemoveSite={noop}
             localAccessPassword=""
             onLocalAccessPasswordChange={noop}
             onSubmit={(event) => event.preventDefault()}
diff --git a/site/index.html b/site/index.html
index bcbf213ab..ec020b336 100644
--- a/site/index.html
+++ b/site/index.html
@@ -398,8 +398,8 @@ <h3><span lang="en">About this online site</span><span lang="zh-CN">在线版说
                   <p>
                     <span lang="en"
                       >The launcher opens in your system browser. Public invite creates a temporary Internet address
-                      for friends outside your network. If you are on the same network or already have a site, see the mode descriptions.</span
-                    ><span lang="zh-CN">启动页会在系统浏览器里打开。「公网邀请」会生成临时公网地址，方便不在同一网络的朋友加入。如果朋友和你在同一局域网，或你们已有站点，可查看模式说明。</span>
+                      for friends outside your network. Choose Local room for the same network; to use an existing site, see guide 03.</span
+                    ><span lang="zh-CN">启动页会在系统浏览器里打开。「公网邀请」会生成临时公网地址，方便不在同一网络的朋友加入。同一局域网可选「本地房间」；搭配已有站点使用见教程 03。</span>
                   </p>
                 </li>
                 <li>
@@ -451,14 +451,11 @@ <h3><span lang="en">Which mode should I use?</span><span lang="zh-CN">模式怎
                       ><span lang="zh-CN">朋友在外地、和你不在同一网络时，用临时公网邀请加入。分享期间保持 App 运行，退出后房间和邀请失效。</span>
                     </dd>
                   </div>
-                  <div>
-                    <dt><span lang="en">Connect to Site</span><span lang="zh-CN">连接站点</span></dt>
-                    <dd>
-                      <span lang="en">Connect the App to a Piik site run by you or a friend. You can also use <a href="https://demo.piik.tv">demo.piik.tv</a>. <a href="#guide-web">See guide 03 below.</a></span
-                      ><span lang="zh-CN">把 App 连接到自己或朋友部署的 Piik 站点，也可以用 <a href="https://demo.piik.tv">demo.piik.tv</a>。<a href="#guide-web">具体操作见教程 03。</a></span>
-                    </dd>
-                  </div>
                 </dl>
+                <p>
+                  <span lang="en">Already have a Piik site? Keep the App running and <a href="#guide-web">connect from the site</a>.</span>
+                  <span lang="zh-CN">已有 Piik 站点？保持 App 运行，<a href="#guide-web">从站点连接即可</a>。</span>
+                </p>
                 <p>
                   <span lang="en"
                     >Public invite relies on P2P media connections, without a media-server fallback. Some networks may
@@ -516,21 +513,20 @@ <h3><span lang="en">Which mode should I use?</span><span lang="zh-CN">模式怎
                   >
                   <p>
                     <span lang="en"
-                      >Open Piik App and choose <strong>Connect to Site</strong>. Enter the address,
-                      add the site passphrase if required, then select <strong>Open Piik</strong>.
-                      The sharing page opens in your browser.</span
+                      >Keep Piik App running and open the site in your browser. Click <strong>App</strong> at the top,
+                      check the address on the local confirmation page, then choose <strong>Allow access</strong>.
+                      Enter any site passphrase on the site itself.</span
                     ><span lang="zh-CN"
-                      >打开 Piik App，选择<strong>连接站点</strong>，填入地址；如果站点有访问口令，也一并填写，
-                      再点击<strong>进入 Piik</strong>。浏览器会打开这个站点的分享页面。</span
+                      >保持 Piik App 运行，在浏览器打开站点，点击顶部的 <strong>App</strong>。
+                      在本机确认页核对网址，点击<strong>允许使用</strong>。如果站点要求口令，在站点页面输入。</span
                     >
                   </p>
                   <p>
-                    <span lang="en">After opening this site through the App once, you can keep the App running
-                      with that site configured and visit the address directly in the same browser.
-                      The page reconnects to the App when you choose what to share.
+                    <span lang="en">The same browser remembers this connection. On later visits, keep the App running;
+                      the page reconnects when you choose what to share.
                       Allow local-network access if your browser asks.</span>
-                    <span lang="zh-CN">通过 App 打开过一次后，保持 App 运行并使用该站点配置，
-                      之后就能在同一浏览器中直接访问网址，选择分享来源时会自动连接 App。
+                    <span lang="zh-CN">同一浏览器会记住这次连接。之后保持 App 运行，直接访问站点，
+                      选择分享来源时会自动连接 App。
                       浏览器询问本地网络权限时，请允许访问。</span>
                   </p>
                 </li>
diff --git a/src/client/App.tsx b/src/client/App.tsx
index 4b7585145..75a622665 100644
--- a/src/client/App.tsx
+++ b/src/client/App.tsx
@@ -4,6 +4,7 @@ import {
   lazy,
   useEffect,
   useState,
+  useSyncExternalStore,
   type FormEvent,
   type ReactNode,
 } from "react";
@@ -20,6 +21,8 @@ import {
   readViewerRoute,
   watchViewerInvites,
   takeClientLaunchBootstrap,
+  watchClientActivation,
+  isClientActivated,
   type ViewerRoute,
 } from "./lib/session";
 import { AppHeader } from "./components/living/Header";
@@ -99,16 +102,17 @@ function readableError(error: unknown, t: (key: "gate.connectFailed") => string)
 
 export function App() {
   const { lang, vis } = useCopy();
+  const launchedByClient = useSyncExternalStore(watchClientActivation, isClientActivated);
   useEffect(installBrowserDebug, []);
   useEffect(() => {
-    if (appRoute.kind !== "client" && !clientLaunchBootstrap?.launchedByClient) return;
+    if (appRoute.kind !== "client" && !launchedByClient) return;
     const controller = new AbortController();
     void import("./native/client")
       .then(({ notifyNativePresentation }) =>
         notifyNativePresentation(consoleLanguage(lang, vis), controller.signal))
       .catch(() => undefined);
     return () => controller.abort();
-  }, [lang, vis]);
+  }, [lang, vis, launchedByClient]);
 
   return (
     <RouteBoundary>
@@ -193,7 +197,7 @@ function AppRoute() {
 function RouteLoader() {
   return (
     <div className="lr-app">
-      <AppHeader />
+      <AppHeader homeHref={appRoute.kind === "client" ? "/client" : undefined} />
       <main className="lr-join">
         <LoadingStatus label="common.loading" />
       </main>
@@ -202,9 +206,10 @@ function RouteLoader() {
 }
 
 function ViewerEntry({ route }: { route: ViewerRoute }) {
+  const launchedByClient = useSyncExternalStore(watchClientActivation, isClientActivated);
   return (
     <ViewerPage {...route}
-      launchedByClient={clientLaunchBootstrap?.launchedByClient} />
+      launchedByClient={launchedByClient} />
   );
 }
 
@@ -266,6 +271,7 @@ function SiteAccessGate({
   viewerRoute?: ViewerRoute;
 }) {
   const { t, vis } = useCopy();
+  const launchedByClient = useSyncExternalStore(watchClientActivation, isClientActivated);
   const [access, setAccess] = useState<AccessState>({ kind: "checking" });
   const [capabilities, setCapabilities] =
     useState<RuntimeCapabilities | null>(null);
@@ -387,7 +393,7 @@ function SiteAccessGate({
       <HostPage
         roomInteractionsAvailable={capabilities?.roomInteractions === true}
         hostRoomSessionAvailable={capabilities?.hostRoomSession === true}
-        launchedByClient={clientLaunchBootstrap?.launchedByClient}
+        launchedByClient={launchedByClient}
         sfuAvailable={capabilities?.sfu === true}
         sfuOnly={capabilities?.sfuOnly === true}
         natPredictionAvailable={capabilities?.natPrediction === true}
diff --git a/src/client/components/living/AppConnectionButton.tsx b/src/client/components/living/AppConnectionButton.tsx
new file mode 100644
index 000000000..6c60d63c1
--- /dev/null
+++ b/src/client/components/living/AppConnectionButton.tsx
@@ -0,0 +1,73 @@
+import { useEffect, useRef, useState } from "react";
+import { activateClient } from "../../lib/session";
+import { useCopy } from "../../ui/copy";
+import { Glyph } from "../../ui/icons";
+import { Tooltip } from "./Tooltip";
+
+export function AppConnectionButton() {
+  const { t, vis } = useCopy();
+  const [state, setState] = useState<"idle" | "busy" | "unavailable" | "incompatible">("idle");
+  const pending = useRef<{ controller: AbortController; popup: Window | null } | null>(null);
+  useEffect(() => () => { pending.current?.controller.abort(); pending.current?.popup?.close(); }, []);
+
+  async function connect(): Promise<void> {
+    if (pending.current) return;
+    // Reserve the window during the click, before local-network discovery waits.
+    const attempt = { controller: new AbortController(), popup: window.open("about:blank", "_blank") };
+    if (!attempt.popup) { setState("unavailable"); return; }
+    pending.current = attempt;
+    setState("busy");
+    const signal = attempt.controller.signal;
+    let native: typeof import("../../native/client") | undefined;
+    let approving = false;
+    const onMessage = async (event: MessageEvent) => {
+      if (approving || event.source !== attempt.popup || !approvalOrigin || event.origin !== approvalOrigin ||
+          event.data?.type !== "piik-app-approved" || event.data.site !== window.location.origin) return;
+      approving = true;
+      // The approval message only asks us to recheck the App-owned permission.
+      const health = await native?.discoverNativeHealth({ signal }).catch(() => null);
+      if (health && !signal.aborted) activateClient();
+      finish(health ? "idle" : "unavailable");
+    };
+    let approvalOrigin = "";
+    const finish = (result: typeof state) => {
+      window.removeEventListener("message", onMessage);
+      window.removeEventListener("focus", onFocus);
+      attempt.controller.abort();
+      if (pending.current === attempt) { pending.current = null; setState(result); }
+    };
+    const onFocus = () => {
+      if (attempt.popup?.closed && !approving) finish("idle");
+    };
+    window.addEventListener("message", onMessage);
+    window.addEventListener("focus", onFocus);
+    signal.addEventListener("abort", () => {
+      window.removeEventListener("message", onMessage);
+      window.removeEventListener("focus", onFocus);
+    }, { once: true });
+    try {
+      native = await import("../../native/client");
+      if (signal.aborted) return;
+      const url = await native.discoverNativeConnect(signal);
+      if (signal.aborted) return;
+      if (!url) { attempt.popup.close(); finish("unavailable"); return; }
+      approvalOrigin = new URL(url).origin;
+      attempt.popup.location.replace(url);
+    } catch (error) {
+      attempt.popup.close();
+      if (!signal.aborted) finish(native && error instanceof native.NativeCompatibilityError ? "incompatible" : "unavailable");
+    }
+  }
+
+  const label = t(state === "incompatible" ? "native.incompatible" :
+    state === "unavailable" ? "client.connect.unavailable" : "client.connect.action");
+  return <Tooltip kind="hint-client-site"
+    text={vis ? undefined : label} place="below" align="end">
+    <button type="button" className="lr-btn" aria-label={label} aria-busy={state === "busy" || undefined}
+      onClick={() => void connect()} disabled={state === "busy"}>
+      <Glyph name={state === "busy" ? "loader" : state === "unavailable" || state === "incompatible" ? "alert" : "window"}
+        size={16} className={state === "busy" ? "lr-spin" : undefined} />
+      {vis ? null : <span className="lr-cap">App</span>}
+    </button>
+  </Tooltip>;
+}
diff --git a/src/client/components/living/Header.tsx b/src/client/components/living/Header.tsx
index 288dadef8..db91d9c7e 100644
--- a/src/client/components/living/Header.tsx
+++ b/src/client/components/living/Header.tsx
@@ -8,6 +8,7 @@ import { useCopy } from "../../ui/copy";
 import { LanguageControl } from "./LanguageControl";
 import { useTheme } from "../../ui/theme";
 import { Glyph } from "../../ui/icons";
+import { AppConnectionButton } from "./AppConnectionButton";
 
 export type LedState = "live" | "busy" | "warn" | "bad" | "off";
 
@@ -139,6 +140,7 @@ export function AppHeader({
       </a>
       <span className="lr-top-right">
         {led}
+        {homeHref !== "/client" && <AppConnectionButton />}
         <HeaderControls diagnosticControl={diagnosticControl} />
       </span>
     </header>
diff --git a/src/client/components/living/LauncherForm.tsx b/src/client/components/living/LauncherForm.tsx
index 3df0388e5..0a6b7abec 100644
--- a/src/client/components/living/LauncherForm.tsx
+++ b/src/client/components/living/LauncherForm.tsx
@@ -1,4 +1,4 @@
-import { useId, type FormEvent, type ReactNode } from "react";
+import { useId, type FormEvent, type MouseEvent, type ReactNode } from "react";
 import { BrandMark } from "./BrandMark";
 import { Tooltip } from "./Tooltip";
 import { WelcomeLine } from "./WelcomeLine";
@@ -6,7 +6,7 @@ import { Btn, Pill } from "./primitives";
 import type { HintKind } from "./hints";
 import { Glyph, type GlyphName } from "../../ui/icons";
 import { useCopy, type CopyKey } from "../../ui/copy";
-export type AppMode = "local" | "link" | "site";
+export type AppMode = "local" | "link";
 
 const MODES: Array<{
   mode: AppMode;
@@ -15,13 +15,6 @@ const MODES: Array<{
   hint: CopyKey;
   comic: HintKind;
 }> = [
-  {
-    mode: "local",
-    icon: "users",
-    label: "client.launch.local",
-    hint: "client.launch.localHint",
-    comic: "hint-client-local",
-  },
   {
     mode: "link",
     icon: "globe",
@@ -30,11 +23,11 @@ const MODES: Array<{
     comic: "hint-client-link",
   },
   {
-    mode: "site",
-    icon: "server",
-    label: "client.launch.site",
-    hint: "client.launch.siteHint",
-    comic: "hint-client-site",
+    mode: "local",
+    icon: "users",
+    label: "client.launch.local",
+    hint: "client.launch.localHint",
+    comic: "hint-client-local",
   },
 ];
 
@@ -43,7 +36,11 @@ export function LauncherForm({
   mode,
   onModeChange,
   site,
-  onSiteChange,
+  onRemoveSite,
+  siteBusy,
+  siteError,
+  target,
+  onOpen,
   localAccessPassword,
   onLocalAccessPasswordChange,
   lan,
@@ -54,7 +51,11 @@ export function LauncherForm({
   mode: AppMode;
   onModeChange: (mode: AppMode) => void;
   site: string;
-  onSiteChange: (site: string) => void;
+  onRemoveSite: () => void;
+  siteBusy?: boolean;
+  siteError?: string;
+  target?: string;
+  onOpen?: (event: MouseEvent<HTMLAnchorElement>) => void;
   localAccessPassword: string;
   onLocalAccessPasswordChange: (password: string) => void;
   lan?: {
@@ -87,14 +88,33 @@ export function LauncherForm({
   );
   return (
     <form className="lr-client-launch-panel" onSubmit={onSubmit}>
-      <BrandMark size={68} motion="once" />
-      <WelcomeLine />
-      <h1 className={vis ? "visually-hidden" : "lr-client-launch-title"}>
-        {t("client.launch.title")}
-      </h1>
+      <header className="lr-client-launch-heading">
+        <BrandMark size={64} motion="once" />
+        <div>
+          <h1 className="lr-client-launch-title">Piik<span className="lr-client-brand-dot">.</span> <small>App</small></h1>
+          <WelcomeLine />
+        </div>
+      </header>
 
       {children}
 
+      <section className="lr-client-standby" aria-label={t("client.connect.standby")}>
+        <span className="lr-client-standby-icon" aria-hidden="true"><Glyph name="window" size={24} /></span>
+        <div className="lr-client-standby-copy">
+          <strong className={vis ? "visually-hidden" : undefined}>{t("client.connect.standby")}</strong>
+          <p className={vis ? "visually-hidden" : undefined}>{t("client.connect.standbyHint")}</p>
+          {site && <div className="lr-client-approved-site">
+            <a href={`${site}/#piik-client=1`} target="_blank" rel="noopener noreferrer" onClick={onOpen}>{site}<span aria-hidden="true"> ↗</span></a>
+            <Btn icon="x" title="client.connect.remove" hint="hint-client-site" disabled={siteBusy} onClick={onRemoveSite} />
+          </div>}
+          {siteError && <p role="alert">{siteError}</p>}
+        </div>
+      </section>
+
+      {target ? <a className="lr-btn lr-client-resume" href={target} onClick={onOpen} aria-label={t("client.launch.go")}>
+        <Glyph name="arrowRight" size={20} />{vis ? null : t("client.launch.go")}
+      </a> : <>
+      <p className={vis ? "visually-hidden" : "lr-client-launch-section"}>{t("client.launch.room")}</p>
       <div
         className="lr-client-modes"
         role="radiogroup"
@@ -163,27 +183,6 @@ export function LauncherForm({
         </fieldset>
       ) : null}
 
-      {mode === "site" ? (
-        <label className="lr-input lr-client-site">
-          <Glyph name="link" size={18} />
-          {/* The App normalizes bare domains; type="url" would block submission first. */}
-          <input
-            type="text"
-            value={site}
-            autoCapitalize="none"
-            autoCorrect="off"
-            spellCheck={false}
-            inputMode="url"
-            placeholder="piik.example.com"
-            aria-label={t("client.launch.siteAddress")}
-            onChange={(event) => {
-              onSiteChange(event.target.value);
-            }}
-          />
-        </label>
-      ) : null}
-
-      {mode !== "site" ? (
         <details className="lr-client-access-options">
           <summary>
             <Glyph name="key" size={17} />
@@ -199,7 +198,6 @@ export function LauncherForm({
             {t("client.launch.localAccessHint")}
           </p>
         </details>
-      ) : null}
 
       <Btn
         icon="arrowRight"
@@ -208,9 +206,9 @@ export function LauncherForm({
         tone="primary"
         type="submit"
         hint={MODES.find((choice) => choice.mode === mode)?.comic}
-        disabled={(mode === "site" && !site.trim()) ||
-          (mode === "local" && lan !== undefined && !lan.selected)}
+        disabled={mode === "local" && lan !== undefined && !lan.selected}
       />
+      </>}
       <div className="lr-client-about">
         {version && <p className="lr-client-version">
           <span className={vis ? "visually-hidden" : undefined}>{t("client.launch.version", { version })}</span>
diff --git a/src/client/lib/session.ts b/src/client/lib/session.ts
index e19b27cac..9eebed425 100644
--- a/src/client/lib/session.ts
+++ b/src/client/lib/session.ts
@@ -12,6 +12,31 @@ import { withBrowserDebug } from "./debug";
 
 const CLIENT_ID_PATTERN = /^[A-Za-z0-9_-]{8,128}$/;
 const CLIENT_LAUNCH_STORAGE_KEY = "piik:client-launch:v1";
+const CLIENT_ACTIVATION_EVENT = "piik-client-activation";
+let clientActivatedInPage = false;
+
+export function isClientActivated(): boolean {
+  try { return clientActivatedInPage || window.localStorage.getItem(CLIENT_LAUNCH_STORAGE_KEY) === "1"; }
+  catch { return clientActivatedInPage; }
+}
+
+export function activateClient(): void {
+  clientActivatedInPage = true;
+  try { window.localStorage.setItem(CLIENT_LAUNCH_STORAGE_KEY, "1"); } catch { /* Optional persistence. */ }
+  window.dispatchEvent(new Event(CLIENT_ACTIVATION_EVENT));
+}
+
+export function watchClientActivation(changed: () => void): () => void {
+  const onStorage = (event: StorageEvent) => {
+    if (event.key === CLIENT_LAUNCH_STORAGE_KEY || event.key === null) changed();
+  };
+  window.addEventListener(CLIENT_ACTIVATION_EVENT, changed);
+  window.addEventListener("storage", onStorage);
+  return () => {
+    window.removeEventListener(CLIENT_ACTIVATION_EVENT, changed);
+    window.removeEventListener("storage", onStorage);
+  };
+}
 const HOST_ROOM_STORAGE_KEY = "piik:host-room:v1";
 const HOST_ROOM_PREFERENCE_STORAGE_KEY = "piik:host-room-preference:v1";
 const hostRoomStorageSchema = createRoomResponseSchema.pick({
@@ -139,6 +164,7 @@ export function takeClientLaunchBootstrap(): ClientLaunchBootstrap {
   const present = keys.some((key) => params.has(key)) || query.has("piik-preferences");
   const accessValue = params.get("client-access");
   const launchedFromFragment = params.get("piik-client") === "1";
+  if (launchedFromFragment) clientActivatedInPage = true;
   const lang = params.get("piik-lang");
   const mode = params.get("piik-mode");
   const theme = params.get("piik-theme");
diff --git a/src/client/locales/en.ts b/src/client/locales/en.ts
index 161c5fb86..758cc9e07 100644
--- a/src/client/locales/en.ts
+++ b/src/client/locales/en.ts
@@ -61,9 +61,22 @@ export const en: Record<CopyKey, string> = {
   "client.launch.localHint": "Use on the same local network",
   "client.launch.link": "Public invite",
   "client.launch.linkHint": "Create one temporary public invitation link",
-  "client.launch.site": "Connect to Site",
-  "client.launch.siteHint": "Use an existing Piik Site",
-  "client.launch.siteAddress": "Piik Site address",
+  "client.launch.room": "Create a room on this device",
+  "client.connect.action": "Connect Piik App",
+  "client.connect.standby": "App is ready",
+  "client.connect.standbyHint": "Open a Piik Site and click App at the top to connect.",
+  "client.connect.remove": "Revoke this Site's App access",
+  "client.connect.approveTitle": "Allow this Site to use Piik App?",
+  "client.connect.approveHint": "This Site will be able to use this device's screens, windows and microphone. Check that you trust this address.",
+  "client.connect.approve": "Allow access",
+  "client.connect.replace": "This replaces {site} and disconnects its App sessions.",
+  "client.connect.approved": "This Site can now use App",
+  "client.connect.return": "You can close this page and return to your Site.",
+  "client.connect.close": "Close page",
+  "client.connect.changed": "The approved Site changed. Check it before trying again.",
+  "client.connect.saveFailed": "Could not finish the connection change. Please try again.",
+  "client.connect.invalid": "Invalid Site address",
+  "client.connect.unavailable": "Could not connect to App. Keep Piik App running and allow popups and local-network access in your browser.",
   "client.launch.lanAddress": "Local invitation address",
   "client.launch.lanHint": "Choose an address on the same network as your friends.",
   "client.launch.lanUnavailable": "No local network address is available. Connect to a network and refresh this page.",
@@ -76,7 +89,8 @@ export const en: Record<CopyKey, string> = {
   "client.launch.error": "Piik could not start",
   "client.launch.reopen": "Check the error above and the terminal, then reopen Piik. Use Debug launch to record logs.",
   "client.launch.debug": "Debug launch",
-  "client.launch.debugHint": "Record App and browser diagnostics for this launch. Press D in the terminal to export App logs.",
+  "client.launch.debugHint": "Record App diagnostics and logs in pages opened from here. Press D in the terminal to export App logs.",
+  "client.launch.debugFailed": "Could not start diagnostics. Please try again.",
   "client.launch.loadFailed": "Could not read launcher settings; reload to retry",
   "client.update.available": "A newer Piik release is available",
   "client.update.major": "New major Piik release",
@@ -218,7 +232,7 @@ export const en: Record<CopyKey, string> = {
   "host.sourcePicker.showCaptureBorder": "Show capture border",
   "host.sourcePicker.showCaptureBorderHint": "Turn off to hide the border when Windows allows it. Other captures may keep it visible.",
   "host.sourcePicker.empty": "No sources available; refresh the list",
-  "host.sourcePicker.unavailable": "Cannot connect to Piik App. Open this site from the App, refresh the list, and allow local-network access if asked.",
+  "host.sourcePicker.unavailable": "Cannot connect to Piik App. Keep the App running, click App at the top of this page to connect, then refresh the list.",
   "host.sourcePicker.unsupported": "App capture is unavailable; check the App diagnostics.",
   "host.sourcePicker.failed": "Could not load sources; refresh to retry.",
   "native.incompatible": "App and page versions are incompatible; update the App and reload.",
@@ -238,7 +252,7 @@ export const en: Record<CopyKey, string> = {
   "shareHelp.report": "If it still fails, enable diagnostics, try again and save reports from that attempt. Include the failure message, Piik version and what you were doing.",
   "shareHelp.appDebug": "For App logs, enable Debug launch on the mode selection page, reproduce the problem, then press D in the terminal to export. The button below records browser diagnostics only.",
   "shareHelp.site": "Check the site address and your access. For a self-hosted site, check PUBLIC_BASE_URL, ALLOWED_ORIGINS and the reverse proxy configuration; see the guide for steps.",
-  "shareHelp.appConnection": "Check that the App is running and responding. Open this site from the App, refresh the page and allow local network access if your browser asks.",
+  "shareHelp.appConnection": "Keep the App running and click App at the top of this page to connect. Allow local-network access if your browser asks.",
   "shareHelp.mediaConnection": "Check that the browser permits WebRTC and local network access, then refresh and try again. You can also compare with another browser.",
   "shareHelp.permission": "Return to this page, click Share and select a source again. Allow screen recording when your system or browser asks.",
   "shareHelp.camera": "Check camera permission and the device connection. Close applications using the camera exclusively, then select it again.",
diff --git a/src/client/locales/zh.ts b/src/client/locales/zh.ts
index 2e6e02930..067fda009 100644
--- a/src/client/locales/zh.ts
+++ b/src/client/locales/zh.ts
@@ -61,9 +61,22 @@ export const zh = {
   "client.launch.localHint": "同一局域网内使用",
   "client.launch.link": "公网邀请",
   "client.launch.linkHint": "生成一个临时公网邀请链接",
-  "client.launch.site": "连接站点",
-  "client.launch.siteHint": "使用已有的 Piik 站点",
-  "client.launch.siteAddress": "Piik 站点地址",
+  "client.launch.room": "在这台设备上创建房间",
+  "client.connect.action": "连接 Piik App",
+  "client.connect.standby": "App 已就绪",
+  "client.connect.standbyHint": "打开 Piik 站点，点击顶部的 App 即可连接。",
+  "client.connect.remove": "取消此站点的 App 授权",
+  "client.connect.approveTitle": "允许此站点使用 Piik App？",
+  "client.connect.approveHint": "此站点将可以使用本机的屏幕、窗口和麦克风。请确认你信任这个网址。",
+  "client.connect.approve": "允许使用",
+  "client.connect.replace": "将替换 {site}，并断开它的 App 连接。",
+  "client.connect.approved": "已允许此站点使用 App",
+  "client.connect.return": "可以关闭此页面，返回原站点继续。",
+  "client.connect.close": "关闭此页",
+  "client.connect.changed": "授权站点已改变，请核对当前站点后重试。",
+  "client.connect.saveFailed": "未能完成连接更改，请重试。",
+  "client.connect.invalid": "站点网址无效",
+  "client.connect.unavailable": "未能连接 App。请保持 Piik App 运行，并允许浏览器打开新窗口和访问本地网络。",
   "client.launch.lanAddress": "局域网邀请地址",
   "client.launch.lanHint": "选择与朋友处于同一网络的地址。",
   "client.launch.lanUnavailable": "没有可用的局域网地址，请连接网络后刷新页面",
@@ -76,7 +89,8 @@ export const zh = {
   "client.launch.error": "Piik 启动失败",
   "client.launch.reopen": "查看上方原因和终端详情，重新打开 Piik 后重试。可开启「诊断启动」记录日志。",
   "client.launch.debug": "诊断启动",
-  "client.launch.debugHint": "本次启动记录 App 和网页诊断。App 日志可在终端按 D 导出。",
+  "client.launch.debugHint": "开启 App 诊断，从此页进入的网页也会记录日志。App 日志可在终端按 D 导出。",
+  "client.launch.debugFailed": "未能开启诊断，请重试。",
   "client.launch.loadFailed": "无法读取启动设置，请刷新页面重试",
   "client.update.available": "发现新的 Piik 版本",
   "client.update.major": "发现新的 Piik 大版本",
@@ -218,7 +232,7 @@ export const zh = {
   "host.sourcePicker.showCaptureBorder": "显示采集边框",
   "host.sourcePicker.showCaptureBorderHint": "关闭后尝试隐藏黄框；Windows 或其他采集程序可能仍要求显示。",
   "host.sourcePicker.empty": "暂无可用来源，请刷新列表",
-  "host.sourcePicker.unavailable": "未连接 Piik App。请从 App 打开本站后刷新列表，并允许浏览器的本地网络访问。",
+  "host.sourcePicker.unavailable": "未连接 Piik App。请保持 App 运行，点击页面顶部的 App 完成连接，再刷新列表。",
   "host.sourcePicker.unsupported": "App 采集暂不可用，请查看 App 诊断信息。",
   "host.sourcePicker.failed": "无法读取来源列表，请刷新重试。",
   "native.incompatible": "App 与页面不兼容，请更新 App 并刷新页面。",
@@ -238,7 +252,7 @@ export const zh = {
   "shareHelp.report": "仍然失败时，开启诊断后再试一次，并保存同一次尝试的报告。请附上失败提示、Piik 版本和当时的操作。",
   "shareHelp.appDebug": "App 日志需从模式选择页开启「诊断启动」，重现后在终端按 D 导出。下方按钮只记录网页诊断。",
   "shareHelp.site": "确认当前站点地址和访问权限。自部署站点请核对 PUBLIC_BASE_URL、ALLOWED_ORIGINS 与反向代理配置，具体步骤见排查文档。",
-  "shareHelp.appConnection": "确认 App 仍在运行且没有卡住，从 App 打开当前站点后刷新页面；浏览器询问本地网络权限时，请允许访问。",
+  "shareHelp.appConnection": "确认 App 仍在运行，点击页面顶部的 App 完成连接；浏览器询问本地网络权限时，请允许访问。",
   "shareHelp.mediaConnection": "检查浏览器是否允许 WebRTC 和本地网络访问，再刷新页面重试；也可换一个浏览器对照。",
   "shareHelp.permission": "回到当前页面，重新点击分享并选择来源；若系统或浏览器询问录屏权限，请允许访问。",
   "shareHelp.camera": "检查摄像头权限，确认设备已连接且未被其他程序独占，再重新选择摄像头。",
diff --git a/src/client/native/client.ts b/src/client/native/client.ts
index 00ccca279..7deaf2836 100644
--- a/src/client/native/client.ts
+++ b/src/client/native/client.ts
@@ -18,6 +18,7 @@ import {
   nativeAckResponseSchema,
   nativeEventSchema,
   nativeDiscoveryIdentitySchema,
+  nativeConnectSchema,
   nativeHealthSchema,
   NATIVE_CLIENT_PORT_END,
   NATIVE_CLIENT_PORT_START,
@@ -46,6 +47,7 @@ const REQUEST_TIMEOUT_MS = 8_000;
 
 interface NativeDiscoveryOptions {
   waitForPermission?: boolean;
+  signal?: AbortSignal;
 }
 
 async function ungrantedLocalPermission(): Promise<PermissionState | null> {
@@ -111,8 +113,31 @@ export class NativeRequestError extends Error {
 }
 
 export async function discoverNativeHealth(
-  { waitForPermission = true }: NativeDiscoveryOptions = {},
+  options: NativeDiscoveryOptions = {},
 ): Promise<NativeHealth | null> {
+  const health = await discoverNative("health", body => nativeHealthSchema.parse(body), options);
+  if (health) debugEvent("native", "discovered", { capabilities: health.nativeMedia });
+  return health;
+}
+
+/** A local approval address is not permission to use native media. */
+export async function discoverNativeConnect(signal?: AbortSignal): Promise<string | null> {
+  return discoverNative("connect-discovery", body => {
+    const { connectURL } = nativeConnectSchema.parse(body);
+    const url = new URL(connectURL);
+    if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || !url.port ||
+        url.username || url.password || url.pathname !== "/client" || url.search || url.hash) {
+      throw new Error("Invalid local App approval address");
+    }
+    url.searchParams.set("site", window.location.origin);
+    return url.toString();
+  }, { signal });
+}
+
+async function discoverNative<T>(
+  path: "health" | "connect-discovery", read: (body: unknown) => T,
+  { waitForPermission = true, signal }: NativeDiscoveryOptions,
+): Promise<T | null> {
   if (!waitForPermission) {
     const permission = await ungrantedLocalPermission();
     if (permission) {
@@ -129,9 +154,9 @@ export async function discoverNativeHealth(
       length: NATIVE_CLIENT_PORT_END - NATIVE_CLIENT_PORT_START + 1,
     }, async (_, index) => {
       const port = NATIVE_CLIENT_PORT_START + index;
-      const response = await fetch(`http://127.0.0.1:${port}/health`, {
+      const response = await fetch(`http://127.0.0.1:${port}/${path}`, {
         cache: "no-store",
-        signal: controller.signal,
+        signal: signal ? AbortSignal.any([signal, controller.signal]) : controller.signal,
         targetAddressSpace: "loopback",
       } as RequestInit);
       if (!response.ok) throw new Error("Piik App discovery was not accepted");
@@ -143,9 +168,7 @@ export async function discoverNativeHealth(
       if (identity.data.protocol !== NATIVE_CLIENT_PROTOCOL) {
         throw new NativeCompatibilityError(identity.data.protocol);
       }
-      const health = nativeHealthSchema.parse(body);
-      debugEvent("native", "discovered", { capabilities: health.nativeMedia });
-      return health;
+      return read(body);
     }));
   } catch (error) {
     const incompatible = error instanceof AggregateError
diff --git a/src/client/native/wire.ts b/src/client/native/wire.ts
index be0c982d9..07b97a07b 100644
--- a/src/client/native/wire.ts
+++ b/src/client/native/wire.ts
@@ -55,6 +55,11 @@ export const nativeHealthSchema = nativeDiscoveryIdentitySchema.extend({
 });
 export type NativeHealth = z.infer<typeof nativeHealthSchema>;
 
+export const nativeConnectSchema = nativeDiscoveryIdentitySchema.extend({
+  protocol: z.literal(NATIVE_CLIENT_PROTOCOL),
+  connectURL: z.string().url().max(256),
+});
+
 const nativeWindowTargetSchema = z
   .object({
     kind: z.literal("window"),
diff --git a/src/client/pages/AppLauncherPage.tsx b/src/client/pages/AppLauncherPage.tsx
index e47ebb4ab..948275d14 100644
--- a/src/client/pages/AppLauncherPage.tsx
+++ b/src/client/pages/AppLauncherPage.tsx
@@ -2,6 +2,7 @@ import { useEffect, useState, type FormEvent } from "react";
 import { z } from "zod";
 
 import { BrandMark } from "../components/living/BrandMark";
+import { HintComic } from "../components/living/hints";
 import { LoadingStatus } from "../components/living/WaitingStatus";
 import { AppReleaseNotice } from "../components/living/AppReleaseNotice";
 import { AppHeader } from "../components/living/Header";
@@ -11,7 +12,6 @@ import { hasCopyPreference, useCopy } from "../ui/copy";
 import { consoleLanguage } from "../locales";
 import { currentThemePreference } from "../ui/theme";
 import { clientLaunchURL, type ClientLaunchPresentation } from "../lib/session";
-import { browserDebugEnabled } from "../lib/debug";
 import {
   checkReleaseUpdate,
   type ReleaseUpdateNotice,
@@ -20,7 +20,10 @@ import {
 const launcherStateSchema = z.object({
   site: z.string(),
   localAccessPassword: z.string(),
-  defaultMode: z.enum(["local", "link", "site"]),
+  defaultMode: z.enum(["local", "link"]),
+  target: z.string().optional(),
+  starting: z.boolean().optional(),
+  detail: z.string().optional(),
   revision: z.string(),
   version: z.string().default("development"),
   packageTarget: z.string().optional(),
@@ -43,27 +46,57 @@ export function AppLauncherPage() {
   const [error, setError] = useState<{ kind: "load" | "launch"; detail?: string } | null>(null);
   const [appDebug, setAppDebug] = useState<boolean | undefined>();
   const [debug, setDebug] = useState(false);
+  const [debugBusy, setDebugBusy] = useState(false);
+  const [debugError, setDebugError] = useState(false);
+  const [reload, setReload] = useState(0);
   const [lan, setLan] = useState<z.infer<typeof launcherStateSchema>["lan"]>();
   const [update, setUpdate] = useState<ReleaseUpdateNotice | null>(null);
   const [version, setVersion] = useState<string>();
+  const [target, setTarget] = useState<string>();
+  const [siteBusy, setSiteBusy] = useState(false);
+  const [siteError, setSiteError] = useState<string>();
+  const [approved, setApproved] = useState(false);
+  const requestedSite = new URLSearchParams(window.location.search).get("site");
+  const approvalCurrent = approved && site === requestedSite;
+  const validSite = requestedSite && (() => {
+    try {
+      const url = new URL(requestedSite);
+      return ["http:", "https:"].includes(url.protocol) && url.origin === requestedSite;
+    } catch { return false; }
+  })();
 
   useEffect(() => {
     let current = true;
-    void fetch("/api/client-launcher", { cache: "no-store" })
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    let checkedRelease = false;
+    let reading = false;
+    const readState = (restoreSettings = false) => {
+      if (reading || !current) return;
+      reading = true;
+      clearTimeout(timer);
+      void fetch("/api/client-launcher", { cache: "no-store" })
       .then(async (response) => {
         if (!response.ok) throw new Error();
         return launcherStateSchema.parse(await response.json());
       })
       .then((state) => {
         if (!current) return;
-        setMode(state.defaultMode);
+        if (restoreSettings) {
+          setMode(state.defaultMode);
+          setLocalAccessPassword(state.localAccessPassword);
+          setLan(state.lan);
+        }
         setVersion(state.version);
+        setTarget(state.target);
+        setStarting(state.starting === true);
         setSite(state.site);
-        setLocalAccessPassword(state.localAccessPassword);
         setAppDebug(state.debug);
-        setDebug(state.debug === true || browserDebugEnabled);
-        setLan(state.lan);
+        setDebug(state.debug === true);
+        if (state.detail) setError({ kind: "launch", detail: state.detail });
         setLoading(false);
+        if (state.starting) timer = setTimeout(() => void readState(), 750);
+        if (checkedRelease) return;
+        checkedRelease = true;
         void checkReleaseUpdate({
           version: state.version,
           revision: state.revision,
@@ -76,19 +109,36 @@ export function AppLauncherPage() {
       .catch(() => {
         if (!current) return;
         setError({ kind: "load" });
+        setStarting(false);
         setLoading(false);
-      });
+      }).finally(() => { reading = false; });
+    };
+    void readState(true);
+    const refresh = () => { void readState(); };
+    window.addEventListener("focus", refresh);
     return () => {
       current = false;
+      clearTimeout(timer);
+      window.removeEventListener("focus", refresh);
     };
-  }, []);
+  }, [reload]);
 
-  async function launch(event: FormEvent<HTMLFormElement>): Promise<void> {
-    event.preventDefault();
-    if (starting || (mode === "site" && !site.trim()) ||
-      (mode === "local" && lan !== undefined && !lan.selected)) return;
-    setStarting(true);
-    setError(null);
+  async function enableDebug(): Promise<void> {
+    if (debugBusy) return;
+    setDebugBusy(true);
+    setDebugError(false);
+    try {
+      const response = await fetch("/api/client-launcher/debug", {
+        method: "POST", headers: { "Content-Type": "application/json" }, body: "{}",
+      });
+      if (!response.ok) throw new Error();
+      setAppDebug(true);
+      setDebug(true);
+    } catch { setDebugError(true); }
+    finally { setDebugBusy(false); }
+  }
+
+  function launchURL(target: string): string {
     const theme = currentThemePreference();
     const presentation: ClientLaunchPresentation = {
       lang, vis, theme,
@@ -97,6 +147,15 @@ export function AppLauncherPage() {
         ...(theme !== null ? ["theme" as const] : []),
       ],
     };
+    return clientLaunchURL(target, presentation, debug);
+  }
+
+  async function launch(event: FormEvent<HTMLFormElement>): Promise<void> {
+    event.preventDefault();
+    if (starting ||
+      (mode === "local" && lan !== undefined && !lan.selected)) return;
+    setStarting(true);
+    setError(null);
     try {
       const response = await fetch("/api/client-launcher/launch", {
         method: "POST",
@@ -106,9 +165,14 @@ export function AppLauncherPage() {
           language: consoleLanguage(lang, vis),
           ...(appDebug !== undefined && debug ? { debug: true } : {}),
           ...(mode === "local" && lan ? { lanAddress: lan.selected } : {}),
-          ...(mode === "site" ? { site } : { localAccessPassword }),
+          localAccessPassword,
         }),
       });
+      if (response.status === 409) {
+        setLoading(true);
+        setReload(value => value + 1);
+        return;
+      }
       if (!response.ok) {
         const failure = launcherErrorSchema.safeParse(await response.json().catch(() => null));
         setError({ kind: "launch", detail: failure.success ? failure.data.detail : undefined });
@@ -116,23 +180,50 @@ export function AppLauncherPage() {
         return;
       }
       const result = launcherResultSchema.parse(await response.json());
-      window.location.replace(clientLaunchURL(result.target, presentation, debug));
+      window.location.replace(launchURL(result.target));
     } catch {
       setError({ kind: "launch" });
       setStarting(false);
     }
   }
 
+  async function changeSite(nextSite: string): Promise<void> {
+    if (siteBusy) return;
+    setSiteBusy(true);
+    setSiteError(undefined);
+    try {
+      const response = await fetch("/api/client-launcher/site", {
+        method: "POST", headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ site: nextSite, expectedSite: site }),
+      });
+      const result = z.object({ site: z.string() }).safeParse(await response.json().catch(() => null));
+      if (result.success) setSite(result.data.site);
+      if (response.status === 409 && result.success) {
+        setSiteError(t("client.connect.changed"));
+        return;
+      }
+      if (!response.ok || !result.success) throw new Error("App approval failed");
+      setSite(result.data.site);
+      if (requestedSite && result.data.site === requestedSite) {
+        setApproved(true);
+        window.opener?.postMessage({ type: "piik-app-approved", site: requestedSite }, requestedSite);
+      }
+    } catch {
+      setSiteError(t("client.connect.saveFailed"));
+    } finally { setSiteBusy(false); }
+  }
+
   return (
     <div className="lr-app">
       <AppHeader homeHref="/client" diagnosticControl={appDebug === undefined ? null : (
         <Btn icon="cpu" title="client.launch.debugHint" cap="client.launch.debug"
           pressed={debug} tone={debug ? "on" : undefined} hint="debug-start"
-          disabled={appDebug || loading || starting || error !== null}
-          onClick={() => setDebug((value) => !value)} />
+          disabled={appDebug || debugBusy || loading || starting || !!target || error !== null}
+          onClick={() => void enableDebug()} />
       )} />
       <main className="lr-client-launch">
-        {loading || starting ? (
+        {debugError && <Pill icon="alert" tone="bad" comic="warning" alert label={t("client.launch.debugFailed")} />}
+        {loading || (starting && !requestedSite) ? (
           <LoadingStatus label={starting ? "client.launch.starting" : "common.loading"} />
         ) : error ? (
           <div className="lr-client-launch-panel">
@@ -155,6 +246,23 @@ export function AppLauncherPage() {
               onClick={() => window.location.reload()}
             />}
           </div>
+        ) : requestedSite ? (
+          <section className="lr-client-approval">
+            <BrandMark size={68} motion="once" />
+            {vis && <HintComic kind="hint-client-site" />}
+            <h1 className={vis ? "visually-hidden" : undefined}>{t(approvalCurrent ? "client.connect.approved" : "client.connect.approveTitle")}</h1>
+            <div className="lr-client-approval-origin">{requestedSite}</div>
+            <p className={vis ? "visually-hidden" : undefined}>{t(approvalCurrent ? "client.connect.return" : "client.connect.approveHint")}</p>
+            {!approvalCurrent && site && site !== requestedSite && <p>{t("client.connect.replace", { site })}</p>}
+            {!validSite && <Pill icon="alert" tone="bad" label={t("client.connect.invalid")} comic="signal-failed" />}
+            {siteError && <p role="alert">{siteError}</p>}
+            <div className="lr-client-approval-actions">
+              <Btn icon="x" title={approvalCurrent ? "client.connect.close" : "common.cancel"} cap={approvalCurrent ? "client.connect.close" : "common.cancel"}
+                onClick={() => window.close()} />
+              {!approvalCurrent && <Btn icon="check" title="client.connect.approve" cap="client.connect.approve" tone="primary"
+                hint="hint-client-site" disabled={!validSite || siteBusy} onClick={() => void changeSite(requestedSite)} />}
+            </div>
+          </section>
         ) : (
           <LauncherForm
             version={version}
@@ -162,7 +270,11 @@ export function AppLauncherPage() {
             site={site}
             localAccessPassword={localAccessPassword}
             onModeChange={setMode}
-            onSiteChange={setSite}
+            onRemoveSite={() => void changeSite("")}
+            siteBusy={siteBusy}
+            siteError={siteError}
+            target={target}
+            onOpen={(event) => { event.currentTarget.href = launchURL(event.currentTarget.href); }}
             onLocalAccessPasswordChange={setLocalAccessPassword}
             lan={lan && { ...lan, onChange: (selected) => setLan({ ...lan, selected }) }}
             onSubmit={launch}
diff --git a/src/client/pages/ControlsPreview.tsx b/src/client/pages/ControlsPreview.tsx
index a603c0286..1d624a3ed 100644
--- a/src/client/pages/ControlsPreview.tsx
+++ b/src/client/pages/ControlsPreview.tsx
@@ -250,8 +250,8 @@ export function ControlsPreview() {
         </button>
       </div>
       <div className="lr-client-launch">
-        <LauncherForm version="v1.0.0" mode={launchMode} onModeChange={setLaunchMode}
-          site={launchSite} onSiteChange={setLaunchSite}
+        <LauncherForm version="2.0 preview" mode={launchMode} onModeChange={setLaunchMode}
+          site={launchSite} onRemoveSite={() => setLaunchSite("")}
           lan={{ selected: launchLan, onChange: setLaunchLan, addresses: [
             { address: "192.0.2.10", name: "Wi-Fi" },
             { address: "192.0.2.20", name: "vEthernet (Example Virtual Network Adapter with a Long Name)" },
diff --git a/src/client/pages/ViewerPage.tsx b/src/client/pages/ViewerPage.tsx
index 1339113da..34f04aab0 100644
--- a/src/client/pages/ViewerPage.tsx
+++ b/src/client/pages/ViewerPage.tsx
@@ -171,6 +171,8 @@ export function ViewerPage({
   launchedByClient = false,
 }: ViewerPageProps) {
   const { lang, t, vis, titleFrames } = useCopy();
+  const clientActivationRef = useRef(launchedByClient);
+  clientActivationRef.current = launchedByClient;
   const viewerClientId = useMemo(
     () => getStableClientId("viewer", roomId),
     [roomId],
@@ -489,7 +491,7 @@ export function ViewerPage({
     };
 
     const acquireNativeClient = async (): Promise<NativeClient | null> => {
-      if (!active || !launchedByClient || !nativeViewerAvailable) return null;
+      if (!active || !clientActivationRef.current || !nativeViewerAvailable) return null;
       if (!nativeClientPromise) {
         const connecting: Promise<NativeClient | null> = NativeClient.connect({ waitForPermission: false }).catch(() => null).then((client) => {
           if (!client || !active || nativeClientPromise !== connecting) {
@@ -514,7 +516,7 @@ export function ViewerPage({
       events: ViewerPeerEvents,
       options: ViewerPeerOptions,
     ): ViewerMediaPeer {
-      if (!launchedByClient) {
+      if (!clientActivationRef.current) {
         return new ViewerPeer(iceConfig, events, options);
       }
       return new NativeCapableViewerPeer(
@@ -1841,7 +1843,7 @@ export function ViewerPage({
       viewerRelaySourceKey = null;
       releaseNativeClient();
     };
-  }, [roomId, viewerGrant, viewerPasswordAttempt, launchedByClient]);
+  }, [roomId, viewerGrant, viewerPasswordAttempt]);
 
   useEffect(() => {
     const video = videoRef.current;
diff --git a/src/client/styles.css b/src/client/styles.css
index 44e00aa6b..48fff12a2 100644
--- a/src/client/styles.css
+++ b/src/client/styles.css
@@ -1500,16 +1500,38 @@ html[data-theme="dark"] .lr-door-glyph { color: #7d92a8; }
 .lr-client-launch {
   flex: 1;
   display: grid;
+  grid-template-columns: minmax(0, 1fr);
   place-items: center;
   padding: 24px 16px 72px;
 }
 .lr-client-launch-panel {
   display: grid;
-  width: min(720px, 100%);
+  grid-template-columns: minmax(0, 1fr);
+  min-width: 0;
+  width: min(620px, 100%);
   justify-items: center;
   gap: 20px;
 }
-.lr-client-launch-title { font-size: 24px; text-align: center; }
+.lr-client-launch-heading { display: flex; align-items: center; gap: 18px; margin-bottom: 8px; width: min(380px, 100%); }
+.lr-client-launch-heading > div { min-width: 0; }
+.lr-client-launch-title { font-size: 36px; line-height: 1.1; letter-spacing: -.04em; }
+.lr-client-launch-title small { margin-left: 6px; color: var(--muted); font-size: 15px; letter-spacing: 0; font-weight: 650; }
+.lr-client-brand-dot { color: #e77d38; }
+.lr-client-launch-heading .lr-welcome { text-align: left; margin-top: 8px; }
+.lr-client-standby { display: flex; align-items: flex-start; gap: 14px; width: 100%; padding: 18px 20px; border: 1px solid color-mix(in srgb, var(--ink) 20%, transparent); border-radius: 22px; background: var(--paper); }
+.lr-client-standby-icon { display: grid; flex: 0 0 44px; height: 44px; place-items: center; border-radius: 14px; background: var(--control-hover); color: var(--ink); }
+.lr-client-standby-copy { display: grid; flex: 1; gap: 6px; min-width: 0; }
+.lr-client-standby strong { font-size: 14px; }
+.lr-client-standby p { margin: 0; color: var(--muted); font-size: 12px; line-height: 1.65; }
+.lr-client-approved-site { display: flex; align-items: center; gap: 8px; margin-top: 4px; }
+.lr-client-approved-site a { min-width: 0; overflow-wrap: anywhere; color: var(--ink); font: 12px/1.6 var(--mono); text-underline-offset: 3px; }
+.lr-client-approved-site .lr-btn { min-width: 32px; width: 32px; height: 32px; padding: 0; }
+.lr-client-launch-section { justify-self: start; margin: 5px 0 -8px; font-size: 13px; font-weight: 700; color: var(--muted); }
+.lr-client-approval { display: grid; width: min(460px, 100%); justify-items: center; gap: 18px; text-align: center; }
+.lr-client-approval h1 { font-size: 22px; line-height: 1.4; }
+.lr-client-approval p { margin: 0; font-size: 13px; line-height: 1.7; color: var(--muted); }
+.lr-client-approval-origin { width: 100%; padding: 18px; border: 2px solid var(--ink); border-radius: 18px; background: var(--paper); font: 15px/1.6 var(--mono); overflow-wrap: anywhere; }
+.lr-client-approval-actions { display: flex; justify-content: center; flex-wrap: wrap; gap: 12px; }
 .lr-client-about { display: grid; gap: 4px; max-width: 100%; color: var(--muted); font-size: 12px; text-align: center; overflow-wrap: anywhere; }
 .lr-client-project-links { display: flex; justify-content: center; flex-wrap: wrap; gap: 0 20px; }
 .lr-client-project-links a { display: inline-flex; align-items: center; gap: 4px; min-height: 36px; color: inherit; text-underline-offset: 3px; }
@@ -1534,7 +1556,7 @@ html[data-theme="dark"] .lr-door-glyph { color: #7d92a8; }
 .lr-client-modes {
   display: grid;
   width: 100%;
-  grid-template-columns: repeat(3, minmax(0, 1fr));
+  grid-template-columns: repeat(2, minmax(0, 1fr));
   gap: 10px;
 }
 .lr-client-modes > .lr-comic-tip-wrap {
@@ -1544,11 +1566,11 @@ html[data-theme="dark"] .lr-door-glyph { color: #7d92a8; }
 .lr-client-modes > .lr-comic-tip-wrap > .lr-client-mode { width: 100%; }
 .lr-client-mode {
   min-width: 0;
-  min-height: 112px;
+  min-height: 128px;
   place-items: center;
   align-content: center;
   gap: 10px;
-  padding: 14px;
+  padding: 18px;
   text-align: center;
 }
 .lr-client-mode > span {
@@ -1558,7 +1580,6 @@ html[data-theme="dark"] .lr-door-glyph { color: #7d92a8; }
 }
 .lr-client-mode strong { font-size: 14px; }
 .lr-client-mode small { font-size: 11px; opacity: .7; }
-.lr-client-site { width: min(460px, 100%); }
 .lr-client-access {
   width: min(460px, 100%);
 }
diff --git a/tests/client-launch-presentation.test.ts b/tests/client-launch-presentation.test.ts
index 7969f7136..5aa39c3bd 100644
--- a/tests/client-launch-presentation.test.ts
+++ b/tests/client-launch-presentation.test.ts
@@ -38,6 +38,28 @@ function browser(saved: string[] = [], blocked = false) {
 }
 
 describe("App presentation handoff authority", () => {
+  it.each([false, true])("activates the current page after approval, including blocked storage: %s", async (blocked) => {
+    const env = browser([], blocked);
+    const events = new EventTarget();
+    Object.assign(env.page, {
+      addEventListener: events.addEventListener.bind(events),
+      removeEventListener: events.removeEventListener.bind(events),
+      dispatchEvent: events.dispatchEvent.bind(events),
+    });
+    const { isClientActivated, activateClient, watchClientActivation } = await import("../src/client/lib/session");
+    const changed = vi.fn();
+    const release = watchClientActivation(changed);
+    expect(isClientActivated()).toBe(false);
+    activateClient();
+    expect(isClientActivated()).toBe(true);
+    expect(changed).toHaveBeenCalledOnce();
+    expect(env.page.location.href).toBe("https://site.example/");
+    expect(env.values.get("piik:client-launch:v1")).toBe(blocked ? undefined : "1");
+    release();
+    activateClient();
+    expect(changed).toHaveBeenCalledOnce();
+  });
+
   it.each([
     { name: "old launcher preserves saved choices", saved: ["zh", "vis", "dark"], fields: "", selection: "zh:true", theme: "dark", result: ["zh", "vis", "dark"] },
     { name: "old launcher supplies only temporary first-use defaults", saved: [], fields: "", selection: "en:false", theme: "light", result: [null, null, null] },
diff --git a/tests/native-client.test.ts b/tests/native-client.test.ts
index 35299606d..2818b9069 100644
--- a/tests/native-client.test.ts
+++ b/tests/native-client.test.ts
@@ -1,6 +1,6 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 
-import { discoverNativeHealth, NativeClient, NativeCompatibilityError, notifyNativePresentation } from "../src/client/native/client";
+import { discoverNativeConnect, discoverNativeHealth, NativeClient, NativeCompatibilityError, notifyNativePresentation } from "../src/client/native/client";
 import { DEFAULT_QUALITY_SETTINGS } from "../src/shared/protocol";
 
 import {
@@ -31,6 +31,45 @@ describe("native App private wire", () => {
     nativeMedia: { video: true, hardwareH264: true },
   };
 
+  it("discovers only a local approval page without opening native control", async () => {
+    vi.stubGlobal("window", { setTimeout, clearTimeout, location: new URL("https://piik.example/r/9527") });
+    const socket = vi.fn();
+    vi.stubGlobal("WebSocket", socket);
+    const fetcher = vi.fn(async (url: string) => url === `http://127.0.0.1:${health.port}/connect-discovery`
+      ? new Response(JSON.stringify({ ...health, connectURL: "http://127.0.0.1:54321/client" }))
+      : new Response(null, { status: 404 }));
+    vi.stubGlobal("fetch", fetcher);
+    await expect(discoverNativeConnect()).resolves.toBe("http://127.0.0.1:54321/client?site=https%3A%2F%2Fpiik.example");
+    expect(fetcher.mock.calls.every(([url]) => url.endsWith("/connect-discovery"))).toBe(true);
+    expect(socket).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    "https://untrusted.example/client", "http://localhost:54321/client", "http://127.0.0.1:54321/other",
+    "http://user@127.0.0.1:54321/client", "http://127.0.0.1:54321/client?site=https://other.example",
+  ])("rejects an unsafe App approval address: %s", async (connectURL) => {
+    vi.stubGlobal("window", { setTimeout, clearTimeout, location: new URL("https://piik.example/") });
+    vi.stubGlobal("fetch", vi.fn(async (url: string) => url === `http://127.0.0.1:${health.port}/connect-discovery`
+      ? new Response(JSON.stringify({ ...health, connectURL })) : new Response(null, { status: 404 })));
+    await expect(discoverNativeConnect()).resolves.toBeNull();
+  });
+
+  it("cancels the whole approval scan with its caller", async () => {
+    vi.stubGlobal("window", { setTimeout, clearTimeout, location: new URL("https://piik.example/") });
+    const signals: AbortSignal[] = [];
+    vi.stubGlobal("fetch", vi.fn((_url: string, init: RequestInit) => new Promise((_resolve, reject) => {
+      const signal = init.signal!;
+      signals.push(signal);
+      signal.addEventListener("abort", () => reject(signal.reason), { once: true });
+    })));
+    const controller = new AbortController();
+    const result = discoverNativeConnect(controller.signal);
+    controller.abort();
+    await expect(result).resolves.toBeNull();
+    expect(signals).toHaveLength(NATIVE_CLIENT_PORT_END - NATIVE_CLIENT_PORT_START + 1);
+    expect(signals.every(signal => signal.aborted)).toBe(true);
+  });
+
   it("reads numeric video capability descriptions and rejects malformed limits", () => {
     const nativeMedia = { ...health.nativeMedia, maxVideoResolution: { width: 3840, height: 3840 },
       maxVideoPixels: 3840 * 2160, maxVideoMacroblocksPerSecond: 983_040 };
diff --git a/tests/viewer-native-client-ownership.test.ts b/tests/viewer-native-client-ownership.test.ts
index d16e5c7c2..22a75b5b9 100644
--- a/tests/viewer-native-client-ownership.test.ts
+++ b/tests/viewer-native-client-ownership.test.ts
@@ -44,7 +44,7 @@ function control() {
 function fixture(launchedByClient = true) {
   const connect = vi.fn(async (): Promise<ReturnType<typeof control> | null> => null);
   const context = createContext({
-    launchedByClient, NativeClient: { connect },
+    clientActivationRef: { current: launchedByClient }, NativeClient: { connect },
     messageAuthority: { invalidate: vi.fn() }, setAssignedRoute: vi.fn(),
     clearViewerSfuRoute: vi.fn(), clearPeerState: vi.fn(), clearParticipantPresence: vi.fn(),
     dispatchPresentation: vi.fn(),

From 036802201af2bc9f25a85f87cf7d3af513a3e216 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 19:27:54 +0800
Subject: [PATCH 165/262] feat(app): streamline site connection and launcher
 settings

---
 docs/guide/getting-started.md                 |  7 ++-
 docs/guide/getting-started.zh-CN.md           |  5 ++-
 docs/standards/presentation-lifecycle.md      |  5 +++
 .../components/living/AppConnectionButton.tsx | 24 ++++++----
 .../components/living/CaptureSourcePicker.tsx | 10 +++++
 src/client/components/living/Header.tsx       |  4 +-
 src/client/components/living/LauncherForm.tsx | 45 ++++++++++---------
 src/client/locales/en.ts                      |  6 ++-
 src/client/locales/zh.ts                      |  6 ++-
 src/client/pages/AppLauncherPage.tsx          | 13 +++---
 src/client/pages/HostPage.tsx                 |  7 ++-
 src/client/styles.css                         | 17 +++----
 tests/host-quality-ownership.test.ts          | 20 ++++++++-
 13 files changed, 112 insertions(+), 57 deletions(-)

diff --git a/docs/guide/getting-started.md b/docs/guide/getting-started.md
index 97006eb74..f948ed11e 100644
--- a/docs/guide/getting-started.md
+++ b/docs/guide/getting-started.md
@@ -98,7 +98,7 @@ See the [App guide](../../cmd/piik-app/README.md) for package and runtime detail
 
 | Mode | When to choose it | What to keep in mind |
 | --- | --- | --- |
-| **Local room** | Friends are on the same local network. | If several entries appear under **Local invitation address**, choose the interface and IP on your friends' network. Your computer must be reachable from theirs. A local site passphrase is optional. |
+| **Local room** | Friends are on the same local network. | With multiple interfaces, expand **Local invitation address** and select the interface and IP on your friends' network. Your computer must be reachable from theirs. A local site passphrase is optional. |
 | **Public invite** | Friends are elsewhere and you want a temporary invitation. | Needs Internet access. The public address lasts for this App run. |
 
 For Local room and Public invite, expand **Site passphrase** to set an optional
@@ -108,10 +108,13 @@ access passphrase.
 **App** at the top. Check the address on the local confirmation page, then choose
 **Allow access**. Enter any site passphrase on the site itself. Allow local-network
 access if the browser asks. No room mode needs to be selected in the launcher.
+You can also choose **Connect Piik App** inside the **Start sharing** source
+selector; its list updates as soon as the connection completes.
 
 The same browser remembers this connection. On later visits, **Start sharing**
 offers **Apps / Windows** and **Screens** from the running App. In another browser,
-in a private window or after clearing site data, connect again. The launcher
+in a private window or after clearing site data, connect again. The same exact
+site already approved by App needs no repeat confirmation. The launcher
 shows the approved site and lets you revoke it. Approving a different site
 replaces the previous one and ends that site's App connections.
 
diff --git a/docs/guide/getting-started.zh-CN.md b/docs/guide/getting-started.zh-CN.md
index 540ce8e81..1d77ed917 100644
--- a/docs/guide/getting-started.zh-CN.md
+++ b/docs/guide/getting-started.zh-CN.md
@@ -89,7 +89,7 @@ Linux 原生采集还需要[系统组件](../../native/capture/linux/README.md)
 
 | 模式 | 什么时候用 | 需要知道 |
 | --- | --- | --- |
-| **本地房间** | 朋友和你在同一个局域网。 | 出现多个「局域网邀请地址」时，选择与朋友同一网络的网卡和 IP。对方需要能连接到你的电脑，可以设置本地站点口令。 |
+| **本地房间** | 朋友和你在同一个局域网。 | 多网卡时展开「局域网邀请地址」，选择与朋友同一网络的网卡和 IP。对方需要能连接到你的电脑，可以设置本地站点口令。 |
 | **公网邀请** | 朋友在别处，想临时发个邀请。 | 需要互联网连接；公网地址只在本次 App 运行期间有效。 |
 
 本地房间和公网邀请可展开 **站点口令** 设置可选的访问口令。
@@ -97,10 +97,11 @@ Linux 原生采集还需要[系统组件](../../native/capture/linux/README.md)
 **已经有 Piik 站点？** 保持 App 运行，打开站点，点击顶部的 **App**。
 在本机确认页核对网址，点击 **允许使用**。如果站点要求口令，在站点页面输入。
 浏览器询问本地网络权限时，请允许访问。启动页无需选择房间模式。
+也可以在 **开始分享** 的选源窗口里点击 **连接 Piik App**，连接后列表会直接显示 App 来源。
 
 同一浏览器会记住这次连接。之后直接访问站点，点击 **开始分享**，
 选择 **程序 / 窗口** 或 **屏幕**，即可使用正在运行的 App。
-换浏览器、使用无痕窗口或清除站点数据后，重新连接即可。
+换浏览器、使用无痕窗口或清除站点数据后，重新连接即可；App 已允许的同一站点无需再次确认。
 启动页显示已授权的站点，也可以取消授权；允许新站点会替换旧站点，并结束旧站点的 App 连接。
 
 **网页能打开，不代表视频一定能连通。** 公网邀请为房间提供临时网页地址，
diff --git a/docs/standards/presentation-lifecycle.md b/docs/standards/presentation-lifecycle.md
index 72a86bd9b..3b56e312b 100644
--- a/docs/standards/presentation-lifecycle.md
+++ b/docs/standards/presentation-lifecycle.md
@@ -40,6 +40,11 @@ available to its approved Site before either mode starts. A Site's explicit App
 action discovers the local approval page, where the user confirms its exact
 origin. The launcher shows and revokes that approval. Activating a page supplies
 native capability without restarting its room or healthy media session.
+The source selector exposes that same connection action before sharing; a
+successful connection refreshes its current list. An already approved exact
+origin needs no repeat confirmation, but the page still verifies authorized App
+health. Closing the selector cancels its pending connection action. Existing
+Browser shares retain their capture implementation until sharing ends.
 Viewer links opened at that activated origin may use the same running App
 without changing the Viewer UI. Starting a share offers the
 Browser picker and any exact App-owned native windows. It never chooses a
diff --git a/src/client/components/living/AppConnectionButton.tsx b/src/client/components/living/AppConnectionButton.tsx
index 6c60d63c1..c46705d39 100644
--- a/src/client/components/living/AppConnectionButton.tsx
+++ b/src/client/components/living/AppConnectionButton.tsx
@@ -4,7 +4,10 @@ import { useCopy } from "../../ui/copy";
 import { Glyph } from "../../ui/icons";
 import { Tooltip } from "./Tooltip";
 
-export function AppConnectionButton() {
+export function AppConnectionButton({ sourcePicker = false, onConnected }: {
+  sourcePicker?: boolean;
+  onConnected?: () => void;
+} = {}) {
   const { t, vis } = useCopy();
   const [state, setState] = useState<"idle" | "busy" | "unavailable" | "incompatible">("idle");
   const pending = useRef<{ controller: AbortController; popup: Window | null } | null>(null);
@@ -26,14 +29,19 @@ export function AppConnectionButton() {
       approving = true;
       // The approval message only asks us to recheck the App-owned permission.
       const health = await native?.discoverNativeHealth({ signal }).catch(() => null);
-      if (health && !signal.aborted) activateClient();
+      if (signal.aborted) return;
       finish(health ? "idle" : "unavailable");
+      if (health) {
+        activateClient();
+        onConnected?.();
+      }
     };
     let approvalOrigin = "";
     const finish = (result: typeof state) => {
       window.removeEventListener("message", onMessage);
       window.removeEventListener("focus", onFocus);
       attempt.controller.abort();
+      attempt.popup?.close();
       if (pending.current === attempt) { pending.current = null; setState(result); }
     };
     const onFocus = () => {
@@ -50,24 +58,24 @@ export function AppConnectionButton() {
       if (signal.aborted) return;
       const url = await native.discoverNativeConnect(signal);
       if (signal.aborted) return;
-      if (!url) { attempt.popup.close(); finish("unavailable"); return; }
+      if (!url) { finish("unavailable"); return; }
       approvalOrigin = new URL(url).origin;
       attempt.popup.location.replace(url);
     } catch (error) {
-      attempt.popup.close();
       if (!signal.aborted) finish(native && error instanceof native.NativeCompatibilityError ? "incompatible" : "unavailable");
     }
   }
 
   const label = t(state === "incompatible" ? "native.incompatible" :
-    state === "unavailable" ? "client.connect.unavailable" : "client.connect.action");
+    state === "unavailable" ? "client.connect.unavailable" : sourcePicker ? "client.connect.captureHint" : "client.connect.action");
   return <Tooltip kind="hint-client-site"
-    text={vis ? undefined : label} place="below" align="end">
-    <button type="button" className="lr-btn" aria-label={label} aria-busy={state === "busy" || undefined}
+    text={vis ? undefined : label} place={sourcePicker ? "above" : "below"} align={sourcePicker ? "center" : "end"}>
+    <button type="button" className={sourcePicker ? "lr-source-picker-refresh lr-source-app-connect" : "lr-btn"}
+      aria-label={sourcePicker ? t("client.connect.action") : label} aria-busy={state === "busy" || undefined}
       onClick={() => void connect()} disabled={state === "busy"}>
       <Glyph name={state === "busy" ? "loader" : state === "unavailable" || state === "incompatible" ? "alert" : "window"}
         size={16} className={state === "busy" ? "lr-spin" : undefined} />
-      {vis ? null : <span className="lr-cap">App</span>}
+      {vis ? null : <span className="lr-cap">{sourcePicker ? t("client.connect.action") : "App"}</span>}
     </button>
   </Tooltip>;
 }
diff --git a/src/client/components/living/CaptureSourcePicker.tsx b/src/client/components/living/CaptureSourcePicker.tsx
index ff29a7a77..7cbb748b6 100644
--- a/src/client/components/living/CaptureSourcePicker.tsx
+++ b/src/client/components/living/CaptureSourcePicker.tsx
@@ -10,6 +10,7 @@ import { Pill } from "./primitives";
 import { CameraSources, useCameraSources } from "./CameraSources";
 import { CaptureSourceCard } from "./CaptureSourceCard";
 import { AudioExclusionSelect } from "./AudioExclusionSelect";
+import { AppConnectionButton } from "./AppConnectionButton";
 import type { loadCameraPreviews } from "../../media/camera-previews";
 
 const SOURCE_TABS = ["browser", "camera", "window", "display"] as const;
@@ -45,6 +46,7 @@ export function CaptureSourcePicker({
   onPreview,
   onRefresh,
   onCancel,
+  onAppConnected,
   browserAvailable = true,
   cameraAvailable = !!onCamera,
   initialTab = "window",
@@ -70,6 +72,7 @@ export function CaptureSourcePicker({
   ) => Promise<string | null>;
   onRefresh: () => void;
   onCancel: () => void;
+  onAppConnected?: () => void;
   browserAvailable?: boolean;
   cameraAvailable?: boolean;
   initialTab?: SourceTab;
@@ -324,6 +327,13 @@ export function CaptureSourcePicker({
           </div>
           </>}
 
+          {onAppConnected && (nativeSources.kind === "browser" || nativeSources.kind === "unavailable") && (
+            <div className="lr-source-app-connection">
+              <AppConnectionButton sourcePicker onConnected={onAppConnected} />
+              {vis ? null : <small>{t("client.connect.captureHint")}</small>}
+            </div>
+          )}
+
           {nativeTab &&
           nativeSources.kind === "ready" &&
           (supportsCaptureBorder || sources.length > 0) ? (
diff --git a/src/client/components/living/Header.tsx b/src/client/components/living/Header.tsx
index db91d9c7e..67ff246f5 100644
--- a/src/client/components/living/Header.tsx
+++ b/src/client/components/living/Header.tsx
@@ -123,10 +123,12 @@ export function AppHeader({
   led,
   homeHref = "/",
   diagnosticControl,
+  showAppConnection = true,
 }: {
   led?: React.ReactNode;
   homeHref?: string;
   diagnosticControl?: React.ReactNode;
+  showAppConnection?: boolean;
 }) {
   const { t } = useCopy();
   return (
@@ -140,7 +142,7 @@ export function AppHeader({
       </a>
       <span className="lr-top-right">
         {led}
-        {homeHref !== "/client" && <AppConnectionButton />}
+        {homeHref !== "/client" && showAppConnection && <AppConnectionButton />}
         <HeaderControls diagnosticControl={diagnosticControl} />
       </span>
     </header>
diff --git a/src/client/components/living/LauncherForm.tsx b/src/client/components/living/LauncherForm.tsx
index 0a6b7abec..0265d19c5 100644
--- a/src/client/components/living/LauncherForm.tsx
+++ b/src/client/components/living/LauncherForm.tsx
@@ -163,26 +163,7 @@ export function LauncherForm({
         })}
       </div>
 
-      {mode === "local" && lan && (lan.addresses.length !== 1 || !lan.selected) ? (
-        <fieldset className="lr-client-lan">
-          <legend className={vis ? "visually-hidden" : undefined}>{t("client.launch.lanAddress")}</legend>
-          {lan.addresses.length === 0 ? (
-            <Pill icon="wifiOff" tone="warn" comic="signal-offline" label={t("client.launch.lanUnavailable")} />
-          ) : <>
-            {vis ? null : <p className="lr-client-lan-hint">{t("client.launch.lanHint")}</p>}
-            <div className="lr-client-lan-options">
-              {lan.addresses.map(({ address, name }) => (
-                <label key={address} className={`lr-btn lr-client-lan-option${lan.selected === address ? " is-on" : ""}`}>
-                  <input type="radio" name="lan-address" value={address}
-                    checked={lan.selected === address} onChange={() => lan.onChange(address)} />
-                  <span><strong>{name}</strong><small>{address}</small></span>
-                </label>
-              ))}
-            </div>
-          </>}
-        </fieldset>
-      ) : null}
-
+      <div className="lr-client-room-settings">
         <details className="lr-client-access-options">
           <summary>
             <Glyph name="key" size={17} />
@@ -198,6 +179,28 @@ export function LauncherForm({
             {t("client.launch.localAccessHint")}
           </p>
         </details>
+        {mode === "local" && lan && (lan.addresses.length !== 1 || !lan.selected) ? (
+          <details className="lr-client-access-options" open={!lan.selected || undefined}>
+            <summary>
+              <Glyph name="users" size={17} />
+              <span className={vis ? "visually-hidden" : undefined}>{t("client.launch.lanAddress")}</span>
+              <Glyph name="chevron" size={15} />
+            </summary>
+            {lan.addresses.length === 0 ? (
+              <Pill icon="wifiOff" tone="warn" comic="signal-offline" label={t("client.launch.lanUnavailable")} />
+            ) : <div className="lr-capture-device lr-client-lan">
+              <select value={lan.selected} aria-label={t("client.launch.lanAddress")}
+                aria-describedby={`${accessHintId}-lan`} onChange={event => lan.onChange(event.target.value)}>
+                <option value="" disabled>{t("client.launch.chooseAddress")}</option>
+                {lan.addresses.map(({ address, name }) => (
+                  <option key={address} value={address}>{address} · {name}</option>
+                ))}
+              </select>
+              <small id={`${accessHintId}-lan`} className={vis ? "visually-hidden" : undefined}>{t("client.launch.lanHint")}</small>
+            </div>}
+          </details>
+        ) : null}
+      </div>
 
       <Btn
         icon="arrowRight"
@@ -216,7 +219,7 @@ export function LauncherForm({
         </p>}
         <p>
           <span className={vis ? "visually-hidden" : undefined}>{t("client.launch.credit")}</span>
-          {vis && <span aria-hidden="true">MIT · TNTcraft</span>}
+          {vis && <span aria-hidden="true">TNTcraft & contributors</span>}
         </p>
         <div className="lr-client-project-links">
           <a href="https://piik.tv/" target="_blank" rel="noopener noreferrer" aria-label={t("client.launch.website")}>
diff --git a/src/client/locales/en.ts b/src/client/locales/en.ts
index 758cc9e07..8009cf3fa 100644
--- a/src/client/locales/en.ts
+++ b/src/client/locales/en.ts
@@ -56,13 +56,14 @@ export const en: Record<CopyKey, string> = {
   "client.launch.version": "Installed version {version}",
   "client.launch.credit": "Free and open source · TNTcraft & contributors",
   "client.launch.website": "Official website",
-  "client.launch.source": "Source on GitHub",
+  "client.launch.source": "GitHub",
   "client.launch.local": "Local room",
   "client.launch.localHint": "Use on the same local network",
   "client.launch.link": "Public invite",
   "client.launch.linkHint": "Create one temporary public invitation link",
   "client.launch.room": "Create a room on this device",
   "client.connect.action": "Connect Piik App",
+  "client.connect.captureHint": "Choose windows or screens with App.",
   "client.connect.standby": "App is ready",
   "client.connect.standbyHint": "Open a Piik Site and click App at the top to connect.",
   "client.connect.remove": "Revoke this Site's App access",
@@ -78,6 +79,7 @@ export const en: Record<CopyKey, string> = {
   "client.connect.invalid": "Invalid Site address",
   "client.connect.unavailable": "Could not connect to App. Keep Piik App running and allow popups and local-network access in your browser.",
   "client.launch.lanAddress": "Local invitation address",
+  "client.launch.chooseAddress": "Choose an address",
   "client.launch.lanHint": "Choose an address on the same network as your friends.",
   "client.launch.lanUnavailable": "No local network address is available. Connect to a network and refresh this page.",
   "client.launch.localAccess": "Site passphrase (optional)",
@@ -232,7 +234,7 @@ export const en: Record<CopyKey, string> = {
   "host.sourcePicker.showCaptureBorder": "Show capture border",
   "host.sourcePicker.showCaptureBorderHint": "Turn off to hide the border when Windows allows it. Other captures may keep it visible.",
   "host.sourcePicker.empty": "No sources available; refresh the list",
-  "host.sourcePicker.unavailable": "Cannot connect to Piik App. Keep the App running, click App at the top of this page to connect, then refresh the list.",
+  "host.sourcePicker.unavailable": "Cannot connect to Piik App. Keep the App running, then choose Connect Piik App.",
   "host.sourcePicker.unsupported": "App capture is unavailable; check the App diagnostics.",
   "host.sourcePicker.failed": "Could not load sources; refresh to retry.",
   "native.incompatible": "App and page versions are incompatible; update the App and reload.",
diff --git a/src/client/locales/zh.ts b/src/client/locales/zh.ts
index 067fda009..38a92aa4f 100644
--- a/src/client/locales/zh.ts
+++ b/src/client/locales/zh.ts
@@ -56,13 +56,14 @@ export const zh = {
   "client.launch.version": "当前版本 {version}",
   "client.launch.credit": "免费开源 · TNTcraft 与贡献者",
   "client.launch.website": "官方网站",
-  "client.launch.source": "GitHub 源码",
+  "client.launch.source": "GitHub",
   "client.launch.local": "本地房间",
   "client.launch.localHint": "同一局域网内使用",
   "client.launch.link": "公网邀请",
   "client.launch.linkHint": "生成一个临时公网邀请链接",
   "client.launch.room": "在这台设备上创建房间",
   "client.connect.action": "连接 Piik App",
+  "client.connect.captureHint": "使用 App 选择窗口或屏幕。",
   "client.connect.standby": "App 已就绪",
   "client.connect.standbyHint": "打开 Piik 站点，点击顶部的 App 即可连接。",
   "client.connect.remove": "取消此站点的 App 授权",
@@ -78,6 +79,7 @@ export const zh = {
   "client.connect.invalid": "站点网址无效",
   "client.connect.unavailable": "未能连接 App。请保持 Piik App 运行，并允许浏览器打开新窗口和访问本地网络。",
   "client.launch.lanAddress": "局域网邀请地址",
+  "client.launch.chooseAddress": "选择地址",
   "client.launch.lanHint": "选择与朋友处于同一网络的地址。",
   "client.launch.lanUnavailable": "没有可用的局域网地址，请连接网络后刷新页面",
   "client.launch.localAccess": "站点口令（可选）",
@@ -232,7 +234,7 @@ export const zh = {
   "host.sourcePicker.showCaptureBorder": "显示采集边框",
   "host.sourcePicker.showCaptureBorderHint": "关闭后尝试隐藏黄框；Windows 或其他采集程序可能仍要求显示。",
   "host.sourcePicker.empty": "暂无可用来源，请刷新列表",
-  "host.sourcePicker.unavailable": "未连接 Piik App。请保持 App 运行，点击页面顶部的 App 完成连接，再刷新列表。",
+  "host.sourcePicker.unavailable": "未连接 Piik App。请保持 App 运行，点击「连接 Piik App」。",
   "host.sourcePicker.unsupported": "App 采集暂不可用，请查看 App 诊断信息。",
   "host.sourcePicker.failed": "无法读取来源列表，请刷新重试。",
   "native.incompatible": "App 与页面不兼容，请更新 App 并刷新页面。",
diff --git a/src/client/pages/AppLauncherPage.tsx b/src/client/pages/AppLauncherPage.tsx
index 948275d14..a3cefeb35 100644
--- a/src/client/pages/AppLauncherPage.tsx
+++ b/src/client/pages/AppLauncherPage.tsx
@@ -55,15 +55,20 @@ export function AppLauncherPage() {
   const [target, setTarget] = useState<string>();
   const [siteBusy, setSiteBusy] = useState(false);
   const [siteError, setSiteError] = useState<string>();
-  const [approved, setApproved] = useState(false);
   const requestedSite = new URLSearchParams(window.location.search).get("site");
-  const approvalCurrent = approved && site === requestedSite;
   const validSite = requestedSite && (() => {
     try {
       const url = new URL(requestedSite);
       return ["http:", "https:"].includes(url.protocol) && url.origin === requestedSite;
     } catch { return false; }
   })();
+  const approvalCurrent = validSite && site === requestedSite;
+
+  useEffect(() => {
+    // The App's saved exact origin owns permission, including repeat connections.
+    // The requesting page still verifies authorized health before using App.
+    if (approvalCurrent) window.opener?.postMessage({ type: "piik-app-approved", site: requestedSite }, requestedSite);
+  }, [approvalCurrent, requestedSite]);
 
   useEffect(() => {
     let current = true;
@@ -204,10 +209,6 @@ export function AppLauncherPage() {
       }
       if (!response.ok || !result.success) throw new Error("App approval failed");
       setSite(result.data.site);
-      if (requestedSite && result.data.site === requestedSite) {
-        setApproved(true);
-        window.opener?.postMessage({ type: "piik-app-approved", site: requestedSite }, requestedSite);
-      }
     } catch {
       setSiteError(t("client.connect.saveFailed"));
     } finally { setSiteBusy(false); }
diff --git a/src/client/pages/HostPage.tsx b/src/client/pages/HostPage.tsx
index d3f9d4152..c7f1978a0 100644
--- a/src/client/pages/HostPage.tsx
+++ b/src/client/pages/HostPage.tsx
@@ -103,6 +103,7 @@ import { deriveHostStatus, deriveParticipantStatus, type HostPhase } from "../ui
 import {
   clearHostRoom,
   getStableClientId,
+  isClientActivated,
   type HostRoomIdentity,
   type HostRoomState,
   mergeAuthenticatedHostRoom,
@@ -1406,7 +1407,7 @@ export function HostPage({
     const request = {};
     nativeSourceRequestRef.current = request;
     nativeSourcePathRef.current = null;
-    if (!launchedByClient || (phase === "live" && !nativeModeRef.current)) {
+    if (!isClientActivated() || (phase === "live" && !nativeModeRef.current)) {
       setNativeSources({ kind: "browser" });
       return;
     }
@@ -3598,6 +3599,7 @@ export function HostPage({
   return (
     <div className="lr-app">
       <AppHeader
+        showAppConnection={!sourcePickerOpen}
         led={
           <LedStrip
             state={hostStatus.connection.tone}
@@ -3646,6 +3648,9 @@ export function HostPage({
                 onPreview={loadNativeSourcePreview}
                 onRefresh={openCaptureSourcePicker}
                 onCancel={closeCaptureSourcePicker}
+                onAppConnected={phase !== "live" ? () => {
+                  if (nativeSourceRequestRef.current) void openCaptureSourcePicker();
+                } : undefined}
                 browserAvailable={!nativeActive && !!navigator.mediaDevices?.getDisplayMedia}
                 cameraAvailable={!nativeActive && !!navigator.mediaDevices?.getUserMedia}
                 selectionDisabled={roomMutating || switchingSource || changingQuality}
diff --git a/src/client/styles.css b/src/client/styles.css
index 48fff12a2..5600dd34a 100644
--- a/src/client/styles.css
+++ b/src/client/styles.css
@@ -544,6 +544,9 @@ body.lr-theater-open .lr-top { visibility: hidden; }
   scrollbar-gutter: stable;
 }
 .lr-source-picker-body > [role="status"] { text-align: center; }
+.lr-source-app-connection { display: grid; justify-items: center; gap: 6px; margin-top: 12px; }
+.lr-source-app-connection small { color: #9aa8bb; font-size: 12px; text-align: center; }
+.lr-source-app-connect { display: flex; gap: 8px; width: auto; padding: 0 12px; margin: 0; }
 .lr-source-picker-list {
   display: grid;
   grid-template-columns: repeat(auto-fit, minmax(min(100%, 240px), 1fr));
@@ -1586,17 +1589,9 @@ html[data-theme="dark"] .lr-door-glyph { color: #7d92a8; }
 .lr-client-access input {
   min-width: 0;
 }
-.lr-client-lan { width: min(460px, 100%); min-width: 0; margin: 0; padding: 0; border: 0; }
-.lr-client-lan legend { padding: 0; font-size: 14px; font-weight: 750; }
-.lr-client-lan-hint { margin: 5px 0 10px; color: var(--muted); font-size: 12px; }
-.lr-client-lan-options { display: grid; gap: 8px; max-height: 192px; overflow-y: auto; padding: 3px; }
-.lr-client-lan-option { width: 100%; min-width: 0; height: auto; min-height: 52px; grid-template-columns: auto minmax(0, 1fr); justify-content: stretch; white-space: normal; border-radius: var(--control-radius); cursor: pointer; }
-.lr-client-lan-option input { flex: 0 0 auto; width: 18px; height: 18px; margin: 0; accent-color: var(--action); }
-.lr-client-lan-option span { display: grid; min-width: 0; gap: 3px; text-align: left; }
-.lr-client-lan-option strong { font-size: 13px; overflow-wrap: anywhere; }
-.lr-client-lan-option small { font: 12px var(--mono); }
-.lr-client-lan-option:has(:focus-visible) { outline: 3px solid var(--action); outline-offset: 1px; }
-.lr-client-access-options { width: min(460px, 100%); min-width: 0; }
+.lr-client-room-settings { display: grid; width: min(460px, 100%); grid-template-columns: repeat(auto-fit, minmax(min(100%, 210px), 1fr)); align-items: start; gap: 12px; }
+.lr-client-room-settings .lr-client-lan { padding: 8px 0 0; }
+.lr-client-access-options { width: 100%; min-width: 0; }
 .lr-client-access-options > summary {
   display: flex; align-items: center; justify-content: center; gap: 8px;
   width: fit-content; max-width: 100%; min-height: 40px; margin: 0 auto; padding: 8px 12px;
diff --git a/tests/host-quality-ownership.test.ts b/tests/host-quality-ownership.test.ts
index cc8f92838..f925485b9 100644
--- a/tests/host-quality-ownership.test.ts
+++ b/tests/host-quality-ownership.test.ts
@@ -71,7 +71,7 @@ function fixture(launchedByClient = true) {
   const route = { updateProfile: vi.fn(async () => true), resyncAuthoritative: vi.fn(async (): Promise<void> => undefined) };
   const state = {
     debugError, debugEvent, debugOperation, NativeCompatibilityError, NativeRequestError, NativeMediaBridgeError, isCapturePermissionFailure, hostFailureCode, DOMException,
-    launchedByClient, hostRoomSessionAvailable: false,
+    launchedByClient, isClientActivated: vi.fn(() => launchedByClient), hostRoomSessionAvailable: false,
     NativeClient: { connect: vi.fn(async (): Promise<typeof client | null> => null) },
     nativeClientConnectRef: ref<Promise<typeof client | null> | null>(null),
     ownNativeClient: vi.fn(), setJoiningRoom: vi.fn(), startSharing: vi.fn(), openCaptureSourcePicker: vi.fn(),
@@ -941,6 +941,24 @@ describe("Host quality ownership", () => {
     expect(current.openCaptureSourcePicker).toHaveBeenCalledTimes(2);
   });
 
+  it("refreshes a waiting picker after App approval without changing a live Browser share", async () => {
+    const current = fixture(false);
+    current.context.phase = "idle";
+    await current.openPicker();
+    expect(current.setNativeSources).toHaveBeenLastCalledWith({ kind: "browser" });
+    expect(current.client.sources).not.toHaveBeenCalled();
+
+    current.isClientActivated.mockReturnValue(true);
+    await current.openPicker();
+    expect(current.setNativeSources).toHaveBeenLastCalledWith(expect.objectContaining({ kind: "ready" }));
+    expect(current.client.sources).toHaveBeenCalledOnce();
+
+    current.context.phase = "live";
+    await current.openPicker();
+    expect(current.setNativeSources).toHaveBeenLastCalledWith({ kind: "browser" });
+    expect(current.client.sources).toHaveBeenCalledOnce();
+  });
+
   it("shows App incompatibility in the picker and clears it on a successful refresh", async () => {
     const current = fixture();
     current.context.phase = "idle";

From b5d710f3757674686b5c408953d26f048150c2e9 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 19:28:11 +0800
Subject: [PATCH 166/262] fix(ice): preserve STUN destination provenance for
 native prediction

---
 docs/research/nat-traversal.md                | 22 ++++++-
 internal/app/mediaedge/candidate_gathering.go |  4 +-
 .../app/mediaedge/candidate_gathering_test.go | 62 +++++++++++++++++++
 internal/app/mediaedge/ice_socket.go          |  7 ++-
 src/client/native/native-sender-edge.ts       |  2 +-
 src/client/native/native-viewer-peer.ts       | 17 ++---
 src/client/webrtc/nat-prediction.ts           | 12 +++-
 tests/nat-prediction.test.ts                  | 14 ++++-
 tests/native-sender-edge.test.ts              | 24 ++++++-
 tests/native-viewer-peer.test.ts              | 46 ++++++++++++++
 10 files changed, 190 insertions(+), 20 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 23d2e6b4f..45f023607 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -43,10 +43,30 @@ discovery failure. The pinned Pion STUN client also received and decoded
 `XOR-MAPPED-ADDRESS` from each destination; the fallback is not Browser-only.
 Native regression checks confirm a healthy destination returns
 without waiting for silent UDP or unresolved DNS, and cancellation retires the
-survey. These controls do not reproduce the reporter's network or establish its
+survey. A Browser control with two failing DNS destinations still exposes the
+healthy MiWiFi result after 55 ms. A bound, deliberately silent UDP fixture
+beside a healthy fixture exposes the latter's synthetic srflx result after 4 ms,
+while gathering remains incomplete at 15 seconds. Closed-port controls did not
+produce the same result; a closed port is not a silent-drop fixture. The
+[upstream candidate path](https://webrtc.googlesource.com/src/+/refs/heads/main/p2p/base/stun_port.cc)
+emits successful mappings separately from gathering completion. These controls
+do not reproduce the reporter's network or establish its
 final connection cause. The [WebRTC event specification](https://www.w3.org/TR/webrtc/#rtcicecandidateerrorevent)
 owns error semantics; compare the attempt's gathered and selected candidates too.
 
+The follow-up also found a separate Native provenance gap on Sites with extra
+ordinary STUN destinations. All `nsN` results were eligible for prediction,
+while Browser observations were restricted to the configured three-URL survey.
+Native candidate markers now identify their requested destination, independent
+of response order. Both Native adapters filter prediction evidence against the
+same survey set and still forward every ordinary candidate. The Viewer retains
+the offer's actual destination list with its candidate batch, so a later config
+update cannot reinterpret an in-flight response. Controlled tests cover
+out-of-order results, an unrelated fourth destination, repeated mappings and
+stalled DNS.
+This does not identify the public-invitation report's cause, whose configured
+set already contains exactly three destinations.
+
 ### SFU Behind Server NAT
 
 An isolated Linux kernel-NAT control on 2026-10-09 places the current Server
diff --git a/internal/app/mediaedge/candidate_gathering.go b/internal/app/mediaedge/candidate_gathering.go
index ef94a6fc6..fbce646db 100644
--- a/internal/app/mediaedge/candidate_gathering.go
+++ b/internal/app/mediaedge/candidate_gathering.go
@@ -117,7 +117,6 @@ func (gathering *localCandidateGathering) start() {
 					}
 				})
 			}()
-			index := 0
 			var observed []mappedAddress
 			for survey != nil || mapping != nil {
 				select {
@@ -135,11 +134,10 @@ func (gathering *localCandidateGathering) start() {
 						survey = nil
 						continue
 					}
-					index++
 					mid := "0"
 					line := uint16(0)
 					gathering.emitCandidate(&webrtc.ICECandidateInit{
-						Candidate: "candidate:ns" + strconv.Itoa(index) +
+						Candidate: "candidate:ns" + strconv.Itoa(mapped.serverIndex) +
 							" 1 udp " + strconv.Itoa(surveyCandidatePriority) + " " +
 							mapped.address + " " +
 							strconv.Itoa(mapped.port) + " typ srflx raddr 0.0.0.0 rport " +
diff --git a/internal/app/mediaedge/candidate_gathering_test.go b/internal/app/mediaedge/candidate_gathering_test.go
index 2c8a132a8..cb484af6f 100644
--- a/internal/app/mediaedge/candidate_gathering_test.go
+++ b/internal/app/mediaedge/candidate_gathering_test.go
@@ -4,10 +4,12 @@ import (
 	"context"
 	"net"
 	"strings"
+	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/TNTcraftHIM/Piik/internal/diagnostics"
+	"github.com/pion/stun/v4"
 	"github.com/pion/turn/v5"
 	"github.com/pion/webrtc/v4"
 )
@@ -135,6 +137,9 @@ func TestSurveyHealthySTUNDoesNotWaitForSlowDNS(t *testing.T) {
 		if mapped.port != socket.localPort {
 			t.Fatal("STUN did not use the shared media socket")
 		}
+		if mapped.serverIndex != 2 {
+			t.Fatal("failed DNS shifted the responding destination's identity")
+		}
 	case <-time.After(time.Second):
 		t.Fatal("healthy STUN waited for the broken DNS target")
 	}
@@ -148,6 +153,63 @@ func TestSurveyHealthySTUNDoesNotWaitForSlowDNS(t *testing.T) {
 	}
 }
 
+func TestSurveyCandidateIdentitySurvivesResponseOrder(t *testing.T) {
+	engine, err := NewEngine(EngineOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = engine.Close() })
+	socket := testICESocket(t, engine)
+	var releaseSlow atomic.Bool
+	slow := bindingServer(t, func(request *stun.Message, sender *net.UDPAddr, listener *net.UDPConn) {
+		if releaseSlow.Load() {
+			answerBinding(request, sender, listener, 40000)
+		}
+	})
+	fast := bindingServer(t, func(request *stun.Message, sender *net.UDPAddr, listener *net.UDPConn) {
+		answerBinding(request, sender, listener, 40003)
+	})
+	candidates := make(chan *webrtc.ICECandidateInit, 4)
+	gathering := newLocalCandidateGathering(socket, []webrtc.ICEServer{{URLs: []string{
+		"turn:unused.invalid:3478", "stun:" + slow.String(), "stun:" + fast.String(),
+	}}}, nil, func(candidate *webrtc.ICECandidateInit) { candidates <- candidate })
+	t.Cleanup(gathering.close)
+	gathering.start()
+	for _, want := range []struct{ foundation, port string }{{"candidate:ns2", "40003"}, {"candidate:ns1", "40000"}} {
+		select {
+		case candidate := <-candidates:
+			if candidate == nil {
+				t.Fatal("survey ended before both destinations responded")
+			}
+			fields := strings.Fields(candidate.Candidate)
+			if fields[0] != want.foundation || fields[5] != want.port {
+				t.Fatalf("candidate lost its destination: %s; want %+v", candidate.Candidate, want)
+			}
+			releaseSlow.Store(true)
+		case <-time.After(2 * time.Second):
+			t.Fatal("STUN response did not arrive")
+		}
+	}
+}
+
+func TestSurveyDuplicateMappingRemainsOneOrdinaryCandidate(t *testing.T) {
+	engine, err := NewEngine(EngineOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = engine.Close() })
+	socket := testICESocket(t, engine)
+	servers := []webrtc.ICEServer{{URLs: []string{localSurveyServer(t), localSurveyServer(t)}}}
+	var observations []mappedAddress
+	socket.surveySTUN(t.Context(), servers, func(mapped mappedAddress) {
+		observations = append(observations, mapped)
+	})
+	if len(observations) != 1 || observations[0].port != socket.localPort ||
+		(observations[0].serverIndex != 1 && observations[0].serverIndex != 2) {
+		t.Fatalf("duplicate destination mappings became independent evidence: %+v", observations)
+	}
+}
+
 func TestSurveyReturnsWhenEveryDestinationAlreadyFailed(t *testing.T) {
 	probe, err := net.ListenUDP("udp6", &net.UDPAddr{IP: net.IPv6loopback})
 	if err != nil {
diff --git a/internal/app/mediaedge/ice_socket.go b/internal/app/mediaedge/ice_socket.go
index 5c5ff9798..3730dbe98 100644
--- a/internal/app/mediaedge/ice_socket.go
+++ b/internal/app/mediaedge/ice_socket.go
@@ -101,6 +101,8 @@ func (socket *iceSocket) close() {
 type mappedAddress struct {
 	address string
 	port    int
+	// One-based position in the requested STUN list, independent of response order.
+	serverIndex int
 }
 
 func (socket *iceSocket) surveySTUN(
@@ -114,8 +116,11 @@ func (socket *iceSocket) surveySTUN(
 	resolver := net.DefaultResolver
 	results := make(chan mappedAddress)
 	var pending sync.WaitGroup
+	index := 0
 	for _, server := range servers {
 		for _, rawURL := range server.URLs {
+			index++
+			serverIndex := index
 			uri, err := stun.ParseURI(rawURL)
 			if err != nil || uri.Scheme != stun.SchemeTypeSTUN ||
 				uri.Proto != stun.ProtoTypeUDP || uri.Port < 1 || uri.Port > 65_535 {
@@ -144,7 +149,7 @@ func (socket *iceSocket) surveySTUN(
 					"localPort", socket.localPort, "mappedAddress", diagnostics.ID(mapped.IP.String()), "mappedPort", mapped.Port,
 					"durationMs", time.Since(started).Milliseconds())
 				select {
-				case results <- mappedAddress{address: mapped.IP.String(), port: mapped.Port}:
+				case results <- mappedAddress{address: mapped.IP.String(), port: mapped.Port, serverIndex: serverIndex}:
 				case <-surveyContext.Done():
 				}
 			}()
diff --git a/src/client/native/native-sender-edge.ts b/src/client/native/native-sender-edge.ts
index fccc72ebe..580527911 100644
--- a/src/client/native/native-sender-edge.ts
+++ b/src/client/native/native-sender-edge.ts
@@ -158,7 +158,7 @@ export class NativeSenderEdge {
         if (event.candidate) {
           this.localIceCandidates.add(
             event.candidate,
-            isNativeNatSurveyCandidate(event.candidate),
+            isNativeNatSurveyCandidate(event.candidate, this.iceConfig.iceServers, this.iceConfig.natPredictionStunUrls),
           );
         } else {
           this.localIceCandidates.complete();
diff --git a/src/client/native/native-viewer-peer.ts b/src/client/native/native-viewer-peer.ts
index 2827efc79..7ef98690d 100644
--- a/src/client/native/native-viewer-peer.ts
+++ b/src/client/native/native-viewer-peer.ts
@@ -196,7 +196,7 @@ class NativeViewerPeer implements ViewerMediaPeer {
   private parentPeerId: string | null = null;
   private connectionId: string | null = null;
   private bridge: NativeMediaBridge | null = null;
-  private localCandidates: NatPredictionCandidateBatch | null = null;
+  private localCandidates: { batch: NatPredictionCandidateBatch; iceConfig: IceConfig } | null = null;
   private unsubscribe: (() => void) | null = null;
   private unsubscribeClose: (() => void) | null = null;
   private snapshot: PeerSnapshot | null = null;
@@ -336,7 +336,7 @@ class NativeViewerPeer implements ViewerMediaPeer {
     this.disposed = true;
     this.clearTimers();
     this.disposeBridge();
-    this.localCandidates?.discard();
+    this.localCandidates?.batch.discard();
     this.localCandidates = null;
     this.unsubscribe?.();
     this.unsubscribe = null;
@@ -366,7 +366,7 @@ class NativeViewerPeer implements ViewerMediaPeer {
     if (identityChanged) {
       const previous = this.connectionId;
       this.disposeBridge();
-      this.localCandidates?.discard();
+      this.localCandidates?.batch.discard();
       if (previous) {
         await this.client.closeReceiver(this.sessionId, previous).catch(
           () => undefined,
@@ -377,7 +377,7 @@ class NativeViewerPeer implements ViewerMediaPeer {
     } else if (!retainSource) {
       this.disposeBridge();
     }
-    this.localCandidates?.discard();
+    this.localCandidates?.batch.discard();
     if (!retainSource) {
       this.state = "connecting";
       this.failureNotified = false;
@@ -427,7 +427,7 @@ class NativeViewerPeer implements ViewerMediaPeer {
     const candidates = predictionEnabled
       ? new NatPredictionCandidateBatch(sendCandidate)
       : null;
-    this.localCandidates = candidates;
+    this.localCandidates = candidates ? { batch: candidates, iceConfig: nativeIceConfig } : null;
     this.emit();
     const pending = { bridge: retainSource ? this.bridge : null, bridgeFailed: false };
     this.pendingOffer = pending;
@@ -531,12 +531,13 @@ class NativeViewerPeer implements ViewerMediaPeer {
     }
     if (event.type === "edge-candidate") {
       if (this.localCandidates) {
+        const { batch, iceConfig } = this.localCandidates;
         if (event.candidate) {
-          this.localCandidates.add(
+          batch.add(
             event.candidate,
-            isNativeNatSurveyCandidate(event.candidate),
+            isNativeNatSurveyCandidate(event.candidate, iceConfig.iceServers, iceConfig.natPredictionStunUrls),
           );
-        } else this.localCandidates.complete();
+        } else batch.complete();
       } else if (this.parentPeerId && this.connectionId) {
         this.events.sendSignal(this.parentPeerId, {
           kind: "candidate",
diff --git a/src/client/webrtc/nat-prediction.ts b/src/client/webrtc/nat-prediction.ts
index 9cfc83ea6..4df872efd 100644
--- a/src/client/webrtc/nat-prediction.ts
+++ b/src/client/webrtc/nat-prediction.ts
@@ -10,8 +10,18 @@ type ConcreteSignalCandidate = NonNullable<SignalCandidate>;
 
 export function isNativeNatSurveyCandidate(
   candidate: SignalCandidate,
+  iceServers: readonly RTCIceServer[] | undefined,
+  auxiliaryStunUrls: readonly string[] = [],
 ): boolean {
-  return candidate !== null && /^candidate:ns\d+\s/i.test(candidate.candidate);
+  const index = candidate && /^candidate:ns([1-9]\d*)\s/i.exec(candidate.candidate)?.[1];
+  if (!index) return false;
+  // App identifies the requested destination, never its response order. Extra
+  // ordinary STUN servers remain useful candidates but are not survey evidence.
+  const urls = iceServersWithNatPrediction(iceServers, true, auxiliaryStunUrls)
+    .flatMap(urlsOf).filter(url => /^stun:/i.test(url));
+  const url = urls[Number(index) - 1];
+  const normalized = url ? normalizedStunUrl(url) : null;
+  return normalized !== null && natPredictionSurveyUrls(iceServers, auxiliaryStunUrls).has(normalized);
 }
 
 const BASE_STUN_PORT = 3478;
diff --git a/tests/nat-prediction.test.ts b/tests/nat-prediction.test.ts
index bd9587c41..bc27bc27c 100644
--- a/tests/nat-prediction.test.ts
+++ b/tests/nat-prediction.test.ts
@@ -45,6 +45,10 @@ function rtcCandidate(port: number): RTCIceCandidate {
 
 describe("NAT prediction ICE adapter", () => {
   it("uses only explicit Native survey candidates as prediction evidence", () => {
+    const iceConfig = {
+      iceServers: [{ urls: ["stun:share.example.test:3478", "stun:other.example.test:3478"] }],
+      natPredictionStunUrls: ["stun:share.example.test:3479", "stun:share.example.test:3480"],
+    };
     const survey = candidate(40_000);
     if (survey) {
       survey.candidate = survey.candidate.replace(
@@ -53,9 +57,13 @@ describe("NAT prediction ICE adapter", () => {
       );
     }
 
-    expect(isNativeNatSurveyCandidate(survey)).toBe(true);
-    expect(isNativeNatSurveyCandidate(candidate(40_000))).toBe(false);
-    expect(isNativeNatSurveyCandidate(hostCandidate())).toBe(false);
+    const eligible = (value: SignalCandidate) => isNativeNatSurveyCandidate(value, iceConfig.iceServers, iceConfig.natPredictionStunUrls);
+    expect(eligible(survey)).toBe(true);
+    for (const [index, expected] of [[2, false], [3, true], [4, true], [5, false], [0, false]] as const) {
+      expect(eligible({ candidate: `candidate:ns${index} 1 udp 1 203.0.113.7 40000 typ srflx` })).toBe(expected);
+    }
+    expect(eligible(candidate(40_000))).toBe(false);
+    expect(eligible(hostCandidate())).toBe(false);
   });
 
   it("keeps unexpected ordinary-candidate failures visible", async () => {
diff --git a/tests/native-sender-edge.test.ts b/tests/native-sender-edge.test.ts
index 4abe7b015..218844124 100644
--- a/tests/native-sender-edge.test.ts
+++ b/tests/native-sender-edge.test.ts
@@ -7,7 +7,7 @@ import {
 } from "../src/client/native/native-sender-edge";
 import type { NativeClientEvent } from "../src/client/native/wire";
 
-function fixture(natPrediction = false) {
+function fixture(natPrediction = false, extraStun = false) {
   let listener: ((event: NativeClientEvent) => void) | null = null;
   const prepareEdge = vi.fn<NativeEdgeControl["prepareEdge"]>(async () => ({
     type: "offer",
@@ -37,7 +37,7 @@ function fixture(natPrediction = false) {
     "share_1234567",
     natPrediction
       ? {
-          iceServers: [{ urls: "stun:share.example.test:3478" }],
+          iceServers: [{ urls: ["stun:share.example.test:3478", ...(extraStun ? ["stun:other.example.test:3478"] : [])] }],
           natPredictionStunUrls: [
             "stun:share.example.test:3479",
             "stun:share.example.test:3480",
@@ -170,4 +170,24 @@ describe("native sender edge adapter", () => {
     expect(candidates.filter((candidate) => /^candidate:s[pm]\d+ /.test(candidate)))
       .toHaveLength(8);
   });
+
+  it("forwards extra STUN candidates without mistaking them for prediction evidence", async () => {
+    const current = fixture(true, true);
+    expect(await current.edge.start()).toBe(true);
+    const emit = (index: number, port: number) => current.emit({
+      version: 10, type: "edge-candidate", shareId: "share_1234567", connectionId: "edge_12345678",
+      candidate: { candidate: `candidate:ns${index} 1 udp 1 203.0.113.7 ${port} typ srflx` },
+    });
+    const candidates = () => current.sent.flatMap(payload => payload.kind === "candidate" && payload.candidate
+      ? [payload.candidate.candidate] : []);
+    // Deliberately receive out of list order, with three seemingly sequential ports.
+    emit(3, 40_006);
+    emit(2, 40_003);
+    emit(1, 40_000);
+    expect(candidates()).toHaveLength(3);
+    emit(4, 40_012);
+    expect(candidates().filter(value => /^candidate:ns/.test(value))).toHaveLength(4);
+    expect(candidates().filter(value => /^candidate:s[pm]/.test(value))).toHaveLength(8);
+    current.edge.dispose();
+  });
 });
diff --git a/tests/native-viewer-peer.test.ts b/tests/native-viewer-peer.test.ts
index 62fd3b554..4643467f6 100644
--- a/tests/native-viewer-peer.test.ts
+++ b/tests/native-viewer-peer.test.ts
@@ -16,6 +16,52 @@ afterEach(() => {
   vi.unstubAllGlobals();
 });
 
+it("uses the offer's STUN destinations for prediction while the next ICE config changes", async () => {
+  vi.useFakeTimers();
+  vi.stubGlobal("window", globalThis);
+  vi.stubGlobal("MediaStream", class { getTracks() { return []; } });
+  vi.stubGlobal("RTCPeerConnection", class { close() {} });
+  vi.spyOn(NativeMediaBridge.prototype, "start").mockResolvedValue({} as MediaStream);
+  let onEvent!: (event: NativeClientEvent) => void;
+  const client = {
+    receiveOffer: vi.fn(async () => ({ answer: { type: "answer", sdp: "v=0\r\n" }, audio: false, codec: "vp8" })),
+    onEvent: (handler: typeof onEvent) => { onEvent = handler; return () => {}; },
+    onClose: () => () => {},
+    closeReceiver: vi.fn(async () => {}), closeEdge: vi.fn(async () => {}),
+  } as unknown as NativeClient;
+  const original = {
+    iceServers: [{ urls: ["stun:site.example:3478", "stun:other.example:3478"] }],
+    natPredictionStunUrls: ["stun:site.example:3479", "stun:site.example:3480"],
+  };
+  const sent: SignalPayload[] = [];
+  const peer = new NativeCapableViewerPeer(original, {
+    sendSignal: (_parent, payload) => { sent.push(payload); return true; },
+    sendRestartRequest: () => true, onStream: () => {}, onUpdate: () => {},
+  }, { natPredictionEnabled: true }, async () => client, () => {}, "session", 2);
+  const emit = (index: number, port: number) => onEvent({
+    version: 10, type: "edge-candidate", shareId: "session", connectionId: "current",
+    candidate: { candidate: `candidate:ns${index} 1 udp 1 203.0.113.7 ${port} typ srflx` },
+  });
+  const candidates = () => sent.flatMap(payload => payload.kind === "candidate" ? [payload.candidate] : []);
+  try {
+    await peer.acceptSignal("parent", {
+      kind: "description", connectionId: "current",
+      description: { type: "offer", sdp: "v=0\r\nm=video 9 UDP/TLS/RTP/SAVPF 96\r\na=sendonly\r\na=rtpmap:96 VP8/90000\r\n" },
+    });
+    peer.updateIceConfig({
+      ...original, iceServers: [{ urls: ["stun:other.example:3478", "stun:site.example:3478"] }],
+    });
+    emit(3, 40006);
+    emit(2, 40003); // Ordinary extra destination must not complete a predicted sequence.
+    emit(1, 40000);
+    expect(candidates()).toHaveLength(3);
+    emit(4, 40012);
+    expect(candidates()).toHaveLength(12); // Four ordinary candidates plus the bounded eight predictions.
+  } finally {
+    peer.dispose();
+  }
+});
+
 it("retires queued candidates when disposed during their delivery", async () => {
   vi.stubGlobal("window", globalThis);
   vi.stubGlobal("MediaStream", class { getTracks() { return []; } });

From a38679c3d05a7b07687d80ec7d5b79e7443c7f2b Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 19:28:29 +0800
Subject: [PATCH 167/262] test(media): isolate recovery capacity from host UDP
 buffering

---
 internal/app/mediaedge/relay_input_test.go | 34 +++++++++++++++++++++-
 1 file changed, 33 insertions(+), 1 deletion(-)

diff --git a/internal/app/mediaedge/relay_input_test.go b/internal/app/mediaedge/relay_input_test.go
index b77c65a2c..f7a792fdf 100644
--- a/internal/app/mediaedge/relay_input_test.go
+++ b/internal/app/mediaedge/relay_input_test.go
@@ -10,8 +10,12 @@ import (
 	"github.com/TNTcraftHIM/Piik/internal/app/nativecapture"
 	"github.com/TNTcraftHIM/Piik/internal/media/encoded"
 	"github.com/livekit/livekit-server/pkg/sfu"
+	"github.com/pion/ice/v4"
+	"github.com/pion/interceptor"
+	"github.com/pion/logging"
 	"github.com/pion/rtp"
 	"github.com/pion/rtp/codecs"
+	"github.com/pion/transport/v5/vnet"
 	"github.com/pion/webrtc/v4"
 )
 
@@ -178,9 +182,27 @@ func TestLargeRecoveryUsesTheDefaultPacketWindow(t *testing.T) {
 	if len(packets) <= 500 || len(packets) > encoded.MaxPacketWindow {
 		t.Fatal("fixture does not exercise the packet window boundary")
 	}
+	// Isolate packet-window capacity from host UDP receive-buffer overflow.
+	// The production sender, SRTP transport and frame assembler still run here.
+	router, err := vnet.NewRouter(&vnet.RouterConfig{CIDR: "10.0.0.0/24",
+		QueueSize: encoded.MaxPacketWindow, LoggerFactory: logging.NewDefaultLoggerFactory()})
+	check(err)
+	sendNet, err := vnet.NewNet(&vnet.NetConfig{StaticIPs: []string{"10.0.0.1"}})
+	check(err)
+	receiveNet, err := vnet.NewNet(&vnet.NetConfig{StaticIPs: []string{"10.0.0.2"}})
+	check(err)
+	check(router.AddNet(sendNet))
+	check(router.AddNet(receiveNet))
+	check(router.Start())
+	defer router.Stop()
 	engine, err := NewEngine(EngineOptions{BindAddress: "127.0.0.1:0", IncludeLoopback: true, InitialBitrate: 12_000_000})
 	check(err)
 	defer engine.Close()
+	engine.listenPacket = sendNet.ListenPacket
+	engine.bindAddress = "10.0.0.1:0"
+	engine.settings.SetNet(sendNet)
+	engine.settings.SetNetworkTypes([]webrtc.NetworkType{webrtc.NetworkTypeUDP4})
+	engine.settings.SetICEMulticastDNSMode(ice.MulticastDNSModeDisabled)
 	source, err := engine.NewSource("h264", 1, 1, nil)
 	check(err)
 	defer source.Close()
@@ -189,7 +211,17 @@ func TestLargeRecoveryUsesTheDefaultPacketWindow(t *testing.T) {
 	edge, err := engine.NewEdge(source, EdgeOptions{ConnectionID: "large-recovery"})
 	check(err)
 	defer edge.Close()
-	receiver := newReceiver(t)
+	media := &webrtc.MediaEngine{}
+	check(media.RegisterDefaultCodecs())
+	registry := &interceptor.Registry{}
+	check(webrtc.RegisterDefaultInterceptors(media, registry))
+	settings := webrtc.SettingEngine{}
+	settings.SetNet(receiveNet)
+	settings.SetNetworkTypes([]webrtc.NetworkType{webrtc.NetworkTypeUDP4})
+	settings.SetICEMulticastDNSMode(ice.MulticastDNSModeDisabled)
+	receiver, err := webrtc.NewAPI(webrtc.WithMediaEngine(media), webrtc.WithInterceptorRegistry(registry),
+		webrtc.WithSettingEngine(settings)).NewPeerConnection(webrtc.Configuration{})
+	check(err)
 	defer receiver.Close()
 	var complete atomic.Bool
 	receiver.OnTrack(func(track *webrtc.TrackRemote, _ *webrtc.RTPReceiver) {

From 26827dbd755f7345a6c1456ed9b23a063f211292 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 19:42:42 +0800
Subject: [PATCH 168/262] fix(app): restore launcher settings after a failed
 initial read

---
 src/client/pages/AppLauncherPage.tsx |  11 +--
 tests/app-launcher-recovery.test.ts  | 101 +++++++++++++++++++++++++++
 2 files changed, 108 insertions(+), 4 deletions(-)
 create mode 100644 tests/app-launcher-recovery.test.ts

diff --git a/src/client/pages/AppLauncherPage.tsx b/src/client/pages/AppLauncherPage.tsx
index a3cefeb35..2e757fdde 100644
--- a/src/client/pages/AppLauncherPage.tsx
+++ b/src/client/pages/AppLauncherPage.tsx
@@ -74,8 +74,9 @@ export function AppLauncherPage() {
     let current = true;
     let timer: ReturnType<typeof setTimeout> | undefined;
     let checkedRelease = false;
+    let restoredSettings = false;
     let reading = false;
-    const readState = (restoreSettings = false) => {
+    const readState = () => {
       if (reading || !current) return;
       reading = true;
       clearTimeout(timer);
@@ -86,10 +87,11 @@ export function AppLauncherPage() {
       })
       .then((state) => {
         if (!current) return;
-        if (restoreSettings) {
+        if (!restoredSettings) {
           setMode(state.defaultMode);
           setLocalAccessPassword(state.localAccessPassword);
           setLan(state.lan);
+          restoredSettings = true;
         }
         setVersion(state.version);
         setTarget(state.target);
@@ -97,7 +99,8 @@ export function AppLauncherPage() {
         setSite(state.site);
         setAppDebug(state.debug);
         setDebug(state.debug === true);
-        if (state.detail) setError({ kind: "launch", detail: state.detail });
+        setError(previous => state.detail ? { kind: "launch", detail: state.detail }
+          : previous?.kind === "load" ? null : previous);
         setLoading(false);
         if (state.starting) timer = setTimeout(() => void readState(), 750);
         if (checkedRelease) return;
@@ -118,7 +121,7 @@ export function AppLauncherPage() {
         setLoading(false);
       }).finally(() => { reading = false; });
     };
-    void readState(true);
+    void readState();
     const refresh = () => { void readState(); };
     window.addEventListener("focus", refresh);
     return () => {
diff --git a/tests/app-launcher-recovery.test.ts b/tests/app-launcher-recovery.test.ts
new file mode 100644
index 000000000..10cbd855c
--- /dev/null
+++ b/tests/app-launcher-recovery.test.ts
@@ -0,0 +1,101 @@
+import { readFileSync } from "node:fs";
+import { runInNewContext } from "node:vm";
+import ts from "typescript";
+import { describe, expect, it, vi } from "vitest";
+import { z } from "zod";
+
+// Run the page's actual state-read effect, including cleanup, without a DOM.
+const source = ts.createSourceFile("AppLauncherPage.tsx", readFileSync(
+  new URL("../src/client/pages/AppLauncherPage.tsx", import.meta.url), "utf8",
+), ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
+let schema: string | undefined;
+let effect: string | undefined;
+function collect(node: ts.Node): void {
+  if (ts.isVariableDeclaration(node) && node.name.getText(source) === "launcherStateSchema") {
+    schema = `const ${node.getText(source)};`;
+  }
+  if (ts.isCallExpression(node) && node.expression.getText(source) === "useEffect"
+    && node.arguments[1]?.getText(source) === "[reload]") {
+    effect = node.arguments[0]!.getText(source);
+  }
+  ts.forEachChild(node, collect);
+}
+collect(source);
+if (!schema || !effect) throw new Error("Missing App launcher state-read owner");
+const executable = ts.transpileModule(`${schema}\n(${effect})();`, {
+  compilerOptions: { target: ts.ScriptTarget.ES2022 },
+}).outputText;
+const settle = () => new Promise<void>(resolve => setImmediate(resolve));
+const saved = {
+  site: "https://site.example", localAccessPassword: "saved password", defaultMode: "local",
+  revision: "test", version: "development", debug: false,
+  lan: { addresses: [{ address: "192.0.2.1", name: "LAN" }], selected: "192.0.2.1" },
+};
+const response = (state: typeof saved & { detail?: string } = saved) => ({ ok: true, json: async () => state });
+
+function mount(fetch: ReturnType<typeof vi.fn>) {
+  const state: Record<string, unknown> = {};
+  const setters = Object.fromEntries([
+    "Mode", "LocalAccessPassword", "Lan", "Version", "Target", "Starting", "Site",
+    "AppDebug", "Debug", "Error", "Loading", "Update",
+  ].map(name => [`set${name}`, vi.fn((value: unknown) => {
+    state[name] = typeof value === "function" ? value(state[name]) : value;
+  })]));
+  const window = new EventTarget();
+  const checkReleaseUpdate = vi.fn(async () => null);
+  const cleanup = runInNewContext(executable, {
+    ...setters, z, fetch, window, checkReleaseUpdate, setTimeout, clearTimeout,
+  }) as () => void;
+  return { state, setters, cleanup, checkReleaseUpdate, focus: () => window.dispatchEvent(new Event("focus")) };
+}
+
+describe("App launcher state recovery", () => {
+  it("restores saved choices after a failed first read, then preserves unsaved edits on focus", async () => {
+    const fetch = vi.fn(async () => response()).mockRejectedValueOnce(new Error("unavailable"));
+    const page = mount(fetch);
+    await settle();
+    expect(page.state.Error).toEqual({ kind: "load" });
+    page.focus();
+    await settle();
+    expect(page.state).toMatchObject({
+      Error: null, Loading: false, Site: saved.site, Mode: "local",
+      LocalAccessPassword: saved.localAccessPassword, Lan: saved.lan,
+    });
+    Object.assign(page.state, { Mode: "link", LocalAccessPassword: "edited", Lan: { selected: "192.0.2.2" } });
+    page.focus();
+    await settle();
+    expect(page.state).toMatchObject({ Mode: "link", LocalAccessPassword: "edited", Lan: { selected: "192.0.2.2" } });
+    expect(fetch).toHaveBeenCalledTimes(3);
+    expect(page.checkReleaseUpdate).toHaveBeenCalledOnce();
+    page.cleanup();
+  });
+
+  it("preserves launch errors on successful reads and accepts the App's current failure detail", async () => {
+    const fetch = vi.fn(async () => response());
+    const page = mount(fetch);
+    await settle();
+    page.state.Error = { kind: "launch", detail: "launch request failed" };
+    page.focus();
+    await settle();
+    expect(page.state.Error).toEqual({ kind: "launch", detail: "launch request failed" });
+    fetch.mockResolvedValueOnce(response({ ...saved, detail: "App runtime failed" }));
+    page.focus();
+    await settle();
+    expect(page.state.Error).toEqual({ kind: "launch", detail: "App runtime failed" });
+    page.cleanup();
+  });
+
+  it("ignores an in-flight response and future focus after retirement", async () => {
+    let complete!: (value: ReturnType<typeof response>) => void;
+    const fetch = vi.fn(() => new Promise<ReturnType<typeof response>>(resolve => { complete = resolve; }));
+    const page = mount(fetch);
+    page.cleanup();
+    complete(response());
+    await settle();
+    page.focus();
+    expect(fetch).toHaveBeenCalledOnce();
+    expect(page.state).toEqual({});
+    expect(page.checkReleaseUpdate).not.toHaveBeenCalled();
+    for (const setter of Object.values(page.setters)) expect(setter).not.toHaveBeenCalled();
+  });
+});

From 9dc8e9aea66146f54c7a9c7e9e714df73c6c0e60 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Sun, 11 Oct 2026 19:54:09 +0800
Subject: [PATCH 169/262] fix(site): align App guidance and film with passive
 connection

---
 cmd/piik-app/README.md              |  2 +-
 cmd/piik-app/README.zh-CN.md        |  2 +-
 docs/guide/troubleshooting.md       |  5 +++--
 docs/guide/troubleshooting.zh-CN.md |  3 ++-
 scripts/check-website-film.js       | 13 ++++++++-----
 site/film/README.md                 |  8 +++++++-
 site/film/ui/main.tsx               |  8 +++-----
 7 files changed, 25 insertions(+), 16 deletions(-)

diff --git a/cmd/piik-app/README.md b/cmd/piik-app/README.md
index 72a4bec6c..2e4e8f874 100644
--- a/cmd/piik-app/README.md
+++ b/cmd/piik-app/README.md
@@ -146,7 +146,7 @@ go build -o build/dev/piik-app.exe ./cmd/piik-app
 ./build/dev/piik-app.exe
 ```
 
-These commands build the App only. Choose **Local room** or a configured Site
+These commands build the App only. Choose **Local room** or open a Piik Site
 for Browser capture. Native capture and **Public invite** need their helpers;
 use `--capture-process` / `--tunnel-process` to select built helpers, or follow
 [packaging](#packaging) for a complete bundle.
diff --git a/cmd/piik-app/README.zh-CN.md b/cmd/piik-app/README.zh-CN.md
index f92de74b9..894159263 100644
--- a/cmd/piik-app/README.zh-CN.md
+++ b/cmd/piik-app/README.zh-CN.md
@@ -118,7 +118,7 @@ go build -o build/dev/piik-app.exe ./cmd/piik-app
 ./build/dev/piik-app.exe
 ```
 
-这些命令只构建 App。体验浏览器采集时，选择 **本地房间** 或配置好的站点。
+这些命令只构建 App。体验浏览器采集时，选择 **本地房间**，或直接打开 Piik 站点。
 原生采集和 **公网邀请** 需要各自的辅助程序，可用 `--capture-process` / `--tunnel-process`
 指定已构建的程序，或按[打包](#打包)步骤生成完整程序包。
 
diff --git a/docs/guide/troubleshooting.md b/docs/guide/troubleshooting.md
index 958201ccd..ce5234029 100644
--- a/docs/guide/troubleshooting.md
+++ b/docs/guide/troubleshooting.md
@@ -341,8 +341,9 @@ same invitation works there, focus on the original network's restrictions.
 For regular use, consider **self-hosting a Piik site with SFU media forwarding**.
 This gives viewers a server path when direct connections fail. Follow the
 [deployment guide](../operations/self-hosting.md#optional-media-fallback), including
-its public-address and UDP-port requirements. The Host can then open that site
-through the App's **Site** mode and send invitations from the new site.
+its public-address and UDP-port requirements. Keep Piik App running, open the new
+site in your browser and select **App** at the top to approve its local access.
+Send invitations generated by that site.
 
 The public demo and App Public invite mode remain P2P-only. SFU also requires
 usable UDP: when the network blocks UDP entirely, use another network or ask the
diff --git a/docs/guide/troubleshooting.zh-CN.md b/docs/guide/troubleshooting.zh-CN.md
index cef7570bf..7b5464511 100644
--- a/docs/guide/troubleshooting.zh-CN.md
+++ b/docs/guide/troubleshooting.zh-CN.md
@@ -279,7 +279,8 @@ Piik 通过 WebRTC 传输画面和声音。禁用 WebRTC 或禁止未经代理
 
 经常需要使用的话，建议考虑 **自建 Piik 站点并启用 SFU 媒体转发**，让直连失败时有服务器路线。
 按[部署指南](../operations/self-hosting.zh-CN.md#可选启用媒体兜底)配置公网地址并放行所需 UDP 端口。
-房主随后可通过 App 的 **站点** 模式打开新站点，并发送该站点生成的邀请链接。
+保持 Piik App 运行，用浏览器打开新站点，点击顶部的 **App** 完成本机授权，
+再发送该站点生成的邀请链接。
 
 公开 Demo 和 App 的公网邀请模式只有 P2P。SFU 同样需要 UDP 可用；如果网络完全禁止 UDP，
 仍需换网络或联系管理员放行，单独搭建服务器不能解除这类限制。
diff --git a/scripts/check-website-film.js b/scripts/check-website-film.js
index 91fdc1af8..a083f8fc3 100644
--- a/scripts/check-website-film.js
+++ b/scripts/check-website-film.js
@@ -1,4 +1,4 @@
-// Run in a freshly opened local /film/ page using agent-browser eval --stdin.
+// Bundle this check, then run it in a fresh local /film/ page with agent-browser.
 // This exercises the real document/module; it does not mock its scene renderer.
 // First click #language with agent-browser to grant native audio user activation.
 (async () => {
@@ -63,7 +63,7 @@
     seek(time);
     assert(scene().includes(`scene-${name}`), `The product sequence must show ${name}`);
   }
-  const {BEAT,BAR,DOWNLOAD_AT,DURATION} = await import('./score.js');
+  const {BEAT,BAR,DOWNLOAD_AT,DURATION} = await import('../site/film/score.js');
   for (const [bar, feature] of [[19.5, 'free'], [20.5, 'p2p'], [21.5, 'encode'], [23, 'devices']]) {
     seek(bar * BAR);
     const visible = [...el('scene-features').children].filter(node => node.style.display !== 'none');
@@ -315,6 +315,9 @@
       await at('website',0,lang);
       const downloadedAgain = await at('website',4.5*BEAT,lang);
       assert(Math.hypot(downloadedAgain.x-downloaded.x, downloadedAgain.y-downloaded.y)<.01, 'The website scroll and click must survive reverse seeking');
+      await at('launch',0,lang);
+      assert(doc.querySelector('[role="radio"][aria-checked="true"]').getAttribute('aria-label') ===
+        (lang === 'en' ? 'Public invite' : '公网邀请'), 'The launcher must start with Public invite selected');
       await at('launch',5*BEAT,lang);
       assert(doc.querySelector('.lr-room') && !doc.querySelector('.lr-room-chip'), 'Opening Piik must show the ready page before a room has been created');
       await at('share',3*BEAT,lang);
@@ -338,12 +341,12 @@
         'The viewer wide shot must include current playback, room interactions and the room code');
       for (const [scene,beat,selector] of [
         ['desktop',2.5,'#desktop-app'],
-        ['launch',1.5,'[role="radio"]'], ['launch',4,'button[type="submit"]'],
+        ['launch',1.5,'[role="radio"][aria-checked="true"]'], ['launch',4,'button[type="submit"]'],
         ['share',1.5,'.lr-entry-action button'], ['share',4,'.lr-source-option'],
         ['invite',1.5,'.lr-invite-url'], ['invite',4,'#chat-draft'], ['invite',6,'#chat-send'],
       ]) {
         const p = await at(scene,beat*BEAT,lang);
-        const element = doc.querySelectorAll(selector)[selector==='[role="radio"]'?1:0];
+        const element = doc.querySelector(selector);
         const target = selector==='.lr-invite-url' ? element.closest('.lr-row').querySelector('button') : element;
         const b = target.getBoundingClientRect();
         assert(p.visible && p.x>=b.left && p.x<=b.right && p.y>=b.top && p.y<=b.bottom, 'Clicks must land on visible controls');
@@ -385,7 +388,7 @@
   document.body.append(hero);
   try {
     await loaded;
-    const {HERO_KINDS,HERO_CUT,heroFrame} = await import('../assets/activities.js');
+    const {HERO_KINDS,HERO_CUT,heroFrame} = await import('../site/assets/activities.js');
     const doc = hero.contentDocument, win = hero.contentWindow;
     assert(!doc.getElementById('montage-cheer'), 'The homepage and README hero must omit the film reaction caption');
     const animations = doc.getAnimations();
diff --git a/site/film/README.md b/site/film/README.md
index e8c78440e..73606d9cb 100644
--- a/site/film/README.md
+++ b/site/film/README.md
@@ -116,10 +116,16 @@ ffmpeg -i Funkorama.mp3 -vn -t 76.039604 \
 
 ## Focused check
 
+Bundle the check's source helpers locally; production serves hashed assets:
+
+```sh
+npx esbuild scripts/check-website-film.js --bundle --format=esm --minify --outfile=build/check-website-film.js
+```
+
 Open a fresh local film page in a named `agent-browser` session and run
 `agent-browser --session <session> click '#language'` to grant the user gesture
 required by native audio. Then evaluate
-[`scripts/check-website-film.js`](../../scripts/check-website-film.js) using
+the resulting `build/check-website-film.js` using
 `agent-browser --session <session> eval --stdin`. The browser check covers lazy
 audio, playback/seek/replay, language links, obsolete play promises, native media
 pause, audio failure/ending, bilingual headline bounds, unobscured scenario
diff --git a/site/film/ui/main.tsx b/site/film/ui/main.tsx
index a4108cea1..52abd1713 100644
--- a/site/film/ui/main.tsx
+++ b/site/film/ui/main.tsx
@@ -47,7 +47,7 @@ import { point } from "./cursor";
 import "../../../src/client/styles.css";
 import "./ui.css";
 
-type Shot = "desktop" | "local" | "link" | "idle" | "picker" | "host" | "copied" | "chat" | "draft" | "sent" | "viewer";
+type Shot = "desktop" | "link" | "idle" | "picker" | "host" | "copied" | "chat" | "draft" | "sent" | "viewer";
 const noop = () => {};
 const roomId = "9527";
 const inviteUrl = `https://invite.piik.example/r/${roomId}`;
@@ -179,7 +179,7 @@ function Screen({ shot }: { shot: Shot }) {
       <div className="desktop-taskbar"><img src="../../assets/favicon.svg" width="34" height="34" alt="" /></div>
     </main>
   );
-  const launcher = shot === "local" || shot === "link";
+  const launcher = shot === "link";
   const chat = shot === "chat" || shot === "draft" || shot === "sent";
   const live = shot === "host" || shot === "copied" || shot === "viewer" || chat;
   const hostStatus = deriveHostStatus({
@@ -436,8 +436,6 @@ window.addEventListener("message", (event) => {
       : data.scene === "launch"
       ? t >= cues.launch + BEAT / 2
         ? "idle"
-        : t < cues.mode + BEAT / 4
-        ? "local"
         : "link"
       : data.scene === "share"
         ? t < cues.share + BEAT / 4
@@ -513,7 +511,7 @@ function paint(data: Frame) {
     document.getElementById("desktop-app")!.style.transform = `scale(${1 - .04 * press})`;
   }
   if (data.scene === "launch") {
-    const mode = center(document.querySelectorAll<HTMLElement>('[role="radio"]')[1]);
+    const mode = center(document.querySelector<HTMLElement>('[role="radio"][aria-checked="true"]'));
     target = mode;
     clickAt = cues.mode;
     hideAt = cues.launch + BEAT / 2;

From a6a5f15d19db10b6921f21866fc91acb5ba00009 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Mon, 12 Oct 2026 00:42:20 +0800
Subject: [PATCH 170/262] fix(ui): align App entry controls with shared
 interaction feedback

---
 .../components/living/AppConnectionButton.tsx |   4 +-
 src/client/components/living/LauncherForm.tsx |   8 +-
 src/client/styles.css                         |  15 +-
 src/client/ui/icons.tsx                       |   2 +-
 tests/app-connection-button.test.ts           | 148 ++++++++++++++++++
 5 files changed, 162 insertions(+), 15 deletions(-)
 create mode 100644 tests/app-connection-button.test.ts

diff --git a/src/client/components/living/AppConnectionButton.tsx b/src/client/components/living/AppConnectionButton.tsx
index c46705d39..7ab0d3aa5 100644
--- a/src/client/components/living/AppConnectionButton.tsx
+++ b/src/client/components/living/AppConnectionButton.tsx
@@ -68,9 +68,9 @@ export function AppConnectionButton({ sourcePicker = false, onConnected }: {
 
   const label = t(state === "incompatible" ? "native.incompatible" :
     state === "unavailable" ? "client.connect.unavailable" : sourcePicker ? "client.connect.captureHint" : "client.connect.action");
-  return <Tooltip kind="hint-client-site"
+  return <Tooltip kind={state === "unavailable" ? "signal-failed" : state === "incompatible" ? "warning" : "hint-client-site"}
     text={vis ? undefined : label} place={sourcePicker ? "above" : "below"} align={sourcePicker ? "center" : "end"}>
-    <button type="button" className={sourcePicker ? "lr-source-picker-refresh lr-source-app-connect" : "lr-btn"}
+    <button type="button" className={sourcePicker ? "lr-source-picker-refresh lr-source-app-connect" : "lr-btn lr-app-connect"}
       aria-label={sourcePicker ? t("client.connect.action") : label} aria-busy={state === "busy" || undefined}
       onClick={() => void connect()} disabled={state === "busy"}>
       <Glyph name={state === "busy" ? "loader" : state === "unavailable" || state === "incompatible" ? "alert" : "window"}
diff --git a/src/client/components/living/LauncherForm.tsx b/src/client/components/living/LauncherForm.tsx
index 0265d19c5..9a3204b1c 100644
--- a/src/client/components/living/LauncherForm.tsx
+++ b/src/client/components/living/LauncherForm.tsx
@@ -111,8 +111,8 @@ export function LauncherForm({
         </div>
       </section>
 
-      {target ? <a className="lr-btn lr-client-resume" href={target} onClick={onOpen} aria-label={t("client.launch.go")}>
-        <Glyph name="arrowRight" size={20} />{vis ? null : t("client.launch.go")}
+      {target ? <a className="lr-btn is-primary" href={target} onClick={onOpen} aria-label={t("client.launch.go")}>
+        <Glyph name="arrowRight" size={19} />{vis ? null : <span className="lr-cap">{t("client.launch.go")}</span>}
       </a> : <>
       <p className={vis ? "visually-hidden" : "lr-client-launch-section"}>{t("client.launch.room")}</p>
       <div
@@ -165,7 +165,7 @@ export function LauncherForm({
 
       <div className="lr-client-room-settings">
         <details className="lr-client-access-options">
-          <summary>
+          <summary className="lr-btn">
             <Glyph name="key" size={17} />
             <span className={vis ? "visually-hidden" : undefined}>{t("client.launch.accessSettings")}</span>
             {localAccessPassword && <span className="lr-client-access-set">
@@ -181,7 +181,7 @@ export function LauncherForm({
         </details>
         {mode === "local" && lan && (lan.addresses.length !== 1 || !lan.selected) ? (
           <details className="lr-client-access-options" open={!lan.selected || undefined}>
-            <summary>
+            <summary className="lr-btn">
               <Glyph name="users" size={17} />
               <span className={vis ? "visually-hidden" : undefined}>{t("client.launch.lanAddress")}</span>
               <Glyph name="chevron" size={15} />
diff --git a/src/client/styles.css b/src/client/styles.css
index 5600dd34a..30c391d2c 100644
--- a/src/client/styles.css
+++ b/src/client/styles.css
@@ -546,7 +546,7 @@ body.lr-theater-open .lr-top { visibility: hidden; }
 .lr-source-picker-body > [role="status"] { text-align: center; }
 .lr-source-app-connection { display: grid; justify-items: center; gap: 6px; margin-top: 12px; }
 .lr-source-app-connection small { color: #9aa8bb; font-size: 12px; text-align: center; }
-.lr-source-app-connect { display: flex; gap: 8px; width: auto; padding: 0 12px; margin: 0; }
+.lr-source-app-connect { display: flex; gap: 8px; width: auto; padding: 0 12px; margin: 0; border-radius: 999px; }
 .lr-source-picker-list {
   display: grid;
   grid-template-columns: repeat(auto-fit, minmax(min(100%, 240px), 1fr));
@@ -996,6 +996,7 @@ html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #334
   background: var(--paper);
   color: var(--ink);
   white-space: nowrap;
+  text-decoration: none;
   box-shadow: var(--control-shadow);
   transition: transform 260ms var(--spring), background-color 140ms ease, border-color 140ms ease;
 }
@@ -1008,6 +1009,7 @@ html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #334
 .lr-btn.is-danger:is(:hover, :focus-visible):not(:disabled):not([aria-disabled="true"]) { background: color-mix(in srgb, var(--danger) 10%, var(--paper)); }
 .lr-btn.is-on { border-color: var(--ink); background: var(--ink); color: var(--paper); }
 .lr-btn .lr-cap { margin-left: 2px; font-size: 12.5px; font-weight: 600; }
+.lr-app-connect { min-width: 40px; height: 40px; }
 .lr-cap { font-size: 12.5px; font-weight: 600; color: inherit; white-space: nowrap; }
 
 /* Sharing and local playback have distinct owners, but one control grammar. */
@@ -1594,14 +1596,11 @@ html[data-theme="dark"] .lr-door-glyph { color: #7d92a8; }
 .lr-client-access-options { width: 100%; min-width: 0; }
 .lr-client-access-options > summary {
   display: flex; align-items: center; justify-content: center; gap: 8px;
-  width: fit-content; max-width: 100%; min-height: 40px; margin: 0 auto; padding: 8px 12px;
-  border-radius: 12px; color: var(--muted); font-size: 12px; font-weight: 600; cursor: pointer;
-  list-style: none; transition: background-color 140ms ease, color 140ms ease;
+  width: fit-content; max-width: 100%; height: auto; min-height: 40px; margin: 0 auto; padding: 8px 12px;
+  font-size: 12.5px; font-weight: 600; cursor: pointer; list-style: none;
 }
 .lr-client-access-options > summary::-webkit-details-marker { display: none; }
-.lr-client-access-options > summary:is(:hover, :focus-visible) { background: var(--control-hover); color: var(--ink); }
-.lr-client-access-options > summary:focus-visible { outline: 3px solid var(--action); outline-offset: 2px; }
-.lr-client-access-options > summary > svg:last-child { transition: transform 160ms ease; }
+.lr-client-access-options > summary > svg:last-child { transition: transform 180ms var(--spring); }
 .lr-client-access-options[open] > summary > svg:last-child { transform: rotate(180deg); }
 .lr-client-access-set { display: inline-flex; align-items: center; gap: 4px; color: var(--ink); }
 .lr-client-access-options .lr-client-access { width: 100%; margin-top: 8px; }
@@ -2212,7 +2211,7 @@ html[data-theme="dark"] .lr-tiles .lr-tile:not(.is-selected) small { color: #8ba
    each stroke. Reduced motion and ordinary controls use the unanimated SVG. */
 @media (prefers-reduced-motion: no-preference) {
   .lr-glyph-draw:not(.lr-spin),
-  button:is(.lr-btn.is-primary, .lr-tv-big, .lr-join-go, .lr-tv-overlay):not(:disabled):not([aria-disabled="true"]):is(:hover, :focus-visible) .lr-glyph:not(.lr-glyph-draw):not(.lr-spin) {
+  :is(button, a):is(.lr-btn.is-primary, .lr-tv-big, .lr-join-go, .lr-tv-overlay):not(:disabled):not([aria-disabled="true"]):is(:hover, :focus-visible) .lr-glyph:not(.lr-glyph-draw):not(.lr-spin) {
     & > :is(path, circle, rect, line) {
       stroke-dasharray: 1;
       stroke-dashoffset: 1;
diff --git a/src/client/ui/icons.tsx b/src/client/ui/icons.tsx
index b53e30a6d..3376ea8ad 100644
--- a/src/client/ui/icons.tsx
+++ b/src/client/ui/icons.tsx
@@ -121,7 +121,7 @@ export function Glyph({
 
   useEffect(() => {
     const graphic = graphicRef.current;
-    if (!draw || !graphic?.closest("button:is(.lr-btn.is-primary, .lr-tv-big, .lr-join-go, .lr-tv-overlay)")) return;
+    if (!draw || !graphic?.closest(":is(button, a):is(.lr-btn.is-primary, .lr-tv-big, .lr-join-go, .lr-tv-overlay)")) return;
     return bindSvgReplayOnPointerEnter(graphic);
   }, [draw]);
 
diff --git a/tests/app-connection-button.test.ts b/tests/app-connection-button.test.ts
new file mode 100644
index 000000000..941625f18
--- /dev/null
+++ b/tests/app-connection-button.test.ts
@@ -0,0 +1,148 @@
+import { readFileSync } from "node:fs";
+import { runInNewContext } from "node:vm";
+import ts from "typescript";
+import { describe, expect, it, vi } from "vitest";
+
+// Exercise the button's actual operation and unmount effect without a Browser.
+// Discovery has separate transport tests; this covers who may activate a page.
+const source = ts.createSourceFile("AppConnectionButton.tsx", readFileSync(
+  new URL("../src/client/components/living/AppConnectionButton.tsx", import.meta.url), "utf8",
+), ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
+let connect: string | undefined;
+let effect: string | undefined;
+function collect(node: ts.Node): void {
+  if (ts.isFunctionDeclaration(node) && node.name?.text === "connect") connect = node.getText(source);
+  if (ts.isCallExpression(node) && node.expression.getText(source) === "useEffect") {
+    effect = node.arguments[0]!.getText(source);
+  }
+  ts.forEachChild(node, collect);
+}
+collect(source);
+if (!connect || !effect) throw new Error("Missing App connection operation or cleanup");
+const executable = ts.transpileModule(`${connect}\n({ connect, cleanup: (${effect})() });`, {
+  compilerOptions: { target: ts.ScriptTarget.ES2022, module: ts.ModuleKind.CommonJS },
+}).outputText;
+const settle = () => new Promise<void>(resolve => setImmediate(resolve));
+const site = "https://site.example";
+const approval = `http://127.0.0.1:39721/client?site=${encodeURIComponent(site)}`;
+
+function mount() {
+  const popup = { closed: false, close: vi.fn(() => { popup.closed = true; }), location: { replace: vi.fn() } };
+  const window = Object.assign(new EventTarget(), { open: vi.fn(() => popup), location: { origin: site } });
+  const native = {
+    discoverNativeConnect: vi.fn(async (_signal: AbortSignal) => approval),
+    discoverNativeHealth: vi.fn(async (_options: { signal: AbortSignal }): Promise<object | null> => ({})),
+    NativeCompatibilityError: class extends Error {},
+  };
+  const pending = { current: null as { controller: AbortController } | null };
+  const setState = vi.fn();
+  const activateClient = vi.fn();
+  const onConnected = vi.fn();
+  const operation = runInNewContext(executable, {
+    window, pending, setState, activateClient, onConnected, AbortController, URL,
+    require: (path: string) => {
+      if (path !== "../../native/client") throw new Error(`Unexpected dependency: ${path}`);
+      return native;
+    },
+  }) as { connect: () => Promise<void>; cleanup: () => void };
+  function message(overrides: Record<string, unknown> = {}) {
+    window.dispatchEvent(Object.assign(new Event("message"), {
+      source: popup, origin: new URL(approval).origin, data: { type: "piik-app-approved", site }, ...overrides,
+    }));
+  }
+  return { ...operation, popup, window, native, pending, setState, activateClient, onConnected, message };
+}
+
+describe("App connection approval", () => {
+  it("requires the exact window, origin and site, then verifies App health once", async () => {
+    const page = mount();
+    let complete!: (health: object) => void;
+    page.native.discoverNativeHealth.mockImplementation(() => new Promise(resolve => { complete = resolve; }));
+    await page.connect();
+    await page.connect();
+    expect(page.window.open).toHaveBeenCalledOnce();
+    expect(page.popup.location.replace).toHaveBeenCalledWith(approval);
+    for (const invalid of [
+      { source: {} }, { origin: "http://127.0.0.1:39722" },
+      { data: { type: "piik-app-approved", site: "https://another.example" } },
+      { data: { type: "other", site } }, { data: null },
+    ]) page.message(invalid);
+    expect(page.native.discoverNativeHealth).not.toHaveBeenCalled();
+    page.message();
+    page.message();
+    expect(page.native.discoverNativeHealth).toHaveBeenCalledOnce();
+    expect(page.activateClient).not.toHaveBeenCalled();
+    complete({});
+    await settle();
+    expect(page.activateClient).toHaveBeenCalledOnce();
+    expect(page.onConnected).toHaveBeenCalledOnce();
+    expect(page.popup.closed).toBe(true);
+    expect(page.pending.current).toBeNull();
+    expect(page.native.discoverNativeConnect.mock.calls[0]![0].aborted).toBe(true);
+    page.message();
+    expect(page.native.discoverNativeHealth).toHaveBeenCalledOnce();
+  });
+
+  it.each(["absent", "failed"])("does not activate from an approval message when health is %s", async result => {
+    const page = mount();
+    if (result === "absent") page.native.discoverNativeHealth.mockResolvedValue(null);
+    else page.native.discoverNativeHealth.mockRejectedValue(new Error("network unavailable"));
+    await page.connect();
+    page.message();
+    await settle();
+    expect(page.activateClient).not.toHaveBeenCalled();
+    expect(page.onConnected).not.toHaveBeenCalled();
+    expect(page.setState).toHaveBeenLastCalledWith("unavailable");
+    expect(page.popup.closed).toBe(true);
+    expect(page.pending.current).toBeNull();
+    await page.connect();
+    expect(page.window.open).toHaveBeenCalledTimes(2);
+    page.cleanup();
+  });
+
+  it("ignores a late healthy response after unmount and closes the popup", async () => {
+    const page = mount();
+    let complete!: (health: object) => void;
+    page.native.discoverNativeHealth.mockImplementation(() => new Promise(resolve => { complete = resolve; }));
+    await page.connect();
+    page.message();
+    page.cleanup();
+    complete({});
+    await settle();
+    page.message();
+    expect(page.native.discoverNativeHealth).toHaveBeenCalledOnce();
+    expect(page.activateClient).not.toHaveBeenCalled();
+    expect(page.onConnected).not.toHaveBeenCalled();
+    expect(page.popup.closed).toBe(true);
+    expect(page.native.discoverNativeHealth.mock.calls[0]![0].signal.aborted).toBe(true);
+    expect(page.setState).toHaveBeenLastCalledWith("busy");
+  });
+
+  it("never navigates the popup when discovery completes after unmount", async () => {
+    const page = mount();
+    let complete!: (url: string) => void;
+    page.native.discoverNativeConnect.mockImplementation(() => new Promise(resolve => { complete = resolve; }));
+    const connecting = page.connect();
+    await settle();
+    page.cleanup();
+    complete(approval);
+    await connecting;
+    expect(page.popup.location.replace).not.toHaveBeenCalled();
+    expect(page.popup.closed).toBe(true);
+    expect(page.activateClient).not.toHaveBeenCalled();
+  });
+
+  it("releases a closed approval window on focus and permits retry", async () => {
+    const page = mount();
+    await page.connect();
+    page.popup.closed = true;
+    page.window.dispatchEvent(new Event("focus"));
+    expect(page.pending.current).toBeNull();
+    expect(page.setState).toHaveBeenLastCalledWith("idle");
+    page.message();
+    expect(page.native.discoverNativeHealth).not.toHaveBeenCalled();
+    await page.connect();
+    expect(page.window.open).toHaveBeenCalledTimes(2);
+    page.cleanup();
+  });
+});

From dc4939ad4536cc888baffda0a3711e02be992093 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Mon, 12 Oct 2026 01:04:32 +0800
Subject: [PATCH 171/262] fix(host): retire native selection with room
 authority

---
 src/client/pages/HostPage.tsx        |  68 +++++---------
 tests/host-quality-ownership.test.ts | 133 +++++++++++++++++++++++++--
 2 files changed, 152 insertions(+), 49 deletions(-)

diff --git a/src/client/pages/HostPage.tsx b/src/client/pages/HostPage.tsx
index c7f1978a0..903df0d34 100644
--- a/src/client/pages/HostPage.tsx
+++ b/src/client/pages/HostPage.tsx
@@ -900,6 +900,7 @@ export function HostPage({
   }
 
   function disposeResources(notifyServer: boolean, keepRoomSession = false): void {
+    closeCaptureSourcePicker();
     sourceSwitchRef.current = null;
     qualityChangeRef.current = null;
     pendingQualityChangeRef.current = null;
@@ -1023,7 +1024,6 @@ export function HostPage({
     }
     activeGenerationRef.current = null;
     generationRef.current += 1;
-    closeCaptureSourcePicker();
     const currentRoom = roomRef.current;
     if (notifyServer && currentRoom) {
       writePreferredRoom(currentRoom.roomId);
@@ -1033,6 +1033,21 @@ export function HostPage({
     setPhase("ended");
   }
 
+  function endRoomSession(
+    message: StatusNoticeMessage,
+    comic: ComicKind,
+    tone: ComicTone = "bad",
+    idlePhase: "error" | "ended" = "error",
+  ): void {
+    if (activeGenerationRef.current !== null) {
+      endSharing(message, false, comic, tone, false);
+    } else {
+      disposeResources(false);
+      setStatusNotice(message, comic, tone);
+      setPhase(idlePhase);
+    }
+  }
+
   async function replaceCurrentRoom(): Promise<void> {
     const activeRoom = roomRef.current;
     if (!activeRoom || roomMutationRef.current || phase === "starting") {
@@ -1120,9 +1135,7 @@ export function HostPage({
           }
         }
         if (forgetRoom(activeRoom)) {
-          // endSharing already stated the recovery path; the raw room error
-          // would only overwrite it with the same 404 in server wording.
-          endSharing({ key: "host.roomInvalid" }, false, "room-not-found", "bad", false);
+          endRoomSession({ key: "host.roomInvalid" }, "room-not-found");
           return;
         }
       }
@@ -2532,24 +2545,12 @@ export function HostPage({
         },
         onTerminated: (reason) => {
           if (signalRef.current !== signal || !isCurrentRoomAuthority(activeRoom)) return;
-          if (activeGenerationRef.current !== null) {
-            endSharing({ key: hostTerminationKey(reason) }, false, "signal-failed", "bad", false);
-          } else {
-            disposeResources(false);
-            setStatusNotice({ key: hostTerminationKey(reason) }, "signal-failed", "bad");
-            setPhase("error");
-          }
+          endRoomSession({ key: hostTerminationKey(reason) }, "signal-failed");
           if (reason === "SESSION_REPLACED") forgetRoom(activeRoom, true);
         },
         onAccessRequired: () => {
           if (signalRef.current !== signal || !isCurrentRoomAuthority(activeRoom)) return;
-          if (activeGenerationRef.current !== null) {
-            endSharing({ key: "gate.expired" }, false, "access-denied", "bad", false);
-          } else {
-            disposeResources(false);
-            setStatusNotice({ key: "gate.expired" }, "access-denied", "bad");
-            setPhase("error");
-          }
+          endRoomSession({ key: "gate.expired" }, "access-denied");
           onAuthorizationRequired?.();
         },
         onMessage: (message) => {
@@ -2573,8 +2574,7 @@ export function HostPage({
               // Capture may still be awaiting permission. Its ready path owns
               // creation/publication; room recovery must not start it early.
               if (!localShareActive) {
-                setStatusNotice({ key: "host.roomInvalid" }, "room-not-found", "bad");
-                setPhase("error");
+                endRoomSession({ key: "host.roomInvalid" }, "room-not-found");
               }
               return;
             }
@@ -2586,35 +2586,16 @@ export function HostPage({
           }
           if (message.type === "error" && message.code === "INVALID_TOKEN") {
             forgetRoom(activeRoom);
-            if (localShareActive) {
-              endSharing({ key: "host.roomInvalid" }, false, "room-not-found", "bad", false);
-            } else {
-              disposeResources(false);
-              forgetRoom(activeRoom);
-              setStatusNotice({ key: "host.roomInvalid" }, "room-not-found", "bad");
-              setPhase("error");
-            }
+            endRoomSession({ key: "host.roomInvalid" }, "room-not-found");
             return;
           }
           if (message.type === "room-closed") {
             if (!forgetRoom(activeRoom)) return;
-            if (localShareActive) {
-              endSharing({ key: "host.roomClosed" }, false, "room-closed", "off", false);
-            } else {
-              disposeResources(false);
-              setStatusNotice({ key: "host.roomClosed" }, "room-closed", "off");
-              setPhase("ended");
-            }
+            endRoomSession({ key: "host.roomClosed" }, "room-closed", "off", "ended");
             return;
           }
           if (message.type === "error" && message.code === "HOST_ALREADY_CONNECTED") {
-            if (localShareActive) {
-              endSharing(hostServerErrorNotice(message.code), false, "signal-failed", "bad", false);
-            } else {
-              disposeResources(false);
-              setStatusNotice(hostServerErrorNotice(message.code), "signal-failed", "bad");
-              setPhase("error");
-            }
+            endRoomSession(hostServerErrorNotice(message.code), "signal-failed");
             return;
           }
           const reauthenticated =
@@ -3285,7 +3266,8 @@ export function HostPage({
       onAuthorizationRequired?.();
     }
     if (error instanceof ApiError && error.status === 404) {
-      forgetRoom(activeRoom);
+      if (forgetRoom(activeRoom)) endRoomSession({ key: "host.roomInvalid" }, "room-not-found");
+      return;
     }
     if (!isCurrentRoomAuthority(activeRoom) && roomRef.current !== null) {
       return;
diff --git a/tests/host-quality-ownership.test.ts b/tests/host-quality-ownership.test.ts
index f925485b9..986ec250c 100644
--- a/tests/host-quality-ownership.test.ts
+++ b/tests/host-quality-ownership.test.ts
@@ -13,6 +13,7 @@ import { nativeCaptureTargetKey } from "../src/client/native/capture-selection";
 import { NativeMediaBridgeError } from "../src/client/native/media-bridge";
 import { reconcileBoundedMediaChildren } from "../src/client/webrtc/media-assignment";
 import { debugError, debugEvent, debugOperation } from "../src/client/lib/debug";
+import { ApiError } from "../src/client/lib/api";
 import { hostActionErrorNotice, hostFailureCode, isCapturePermissionFailure } from "../src/client/pages/host-page-notices";
 
 // Exercise the actual page owners without mounting capture hardware or a Browser.
@@ -25,7 +26,8 @@ const owners = new Set(["changeQuality", "commitQuality", "rememberQuality", "lo
   "ownNativeClient", "discardNativeClient", "releaseUnusedNativeClient", "closeCaptureSourcePicker",
   "openCaptureSourcePicker", "startBrowserShareFromPicker", "startNativeShareFromPicker",
   "startSharing", "connectRoomSignal", "createReplacementRoom", "beginRoomMutation", "finishRoomMutation", "setCaptureError", "changeMicrophone", "toggleSharingPause",
-  "startPeer", "reconcileHostChildren", "setNotice", "setNoticeKey", "setStatusNotice", "setNoticeError", "setNoticeErrorKey", "endSharing", "hostTerminationKey", "copyRoomLink", "isCurrentRoomAuthority"]);
+  "startPeer", "reconcileHostChildren", "setNotice", "setNoticeKey", "setStatusNotice", "setNoticeError", "setNoticeErrorKey", "endSharing", "disposeResources", "hostTerminationKey", "copyRoomLink", "isCurrentRoomAuthority",
+  "handleRoomAccessFailure", "replaceCurrentRoom", "forgetRoom", "endRoomSession"]);
 
 const functions: string[] = [];
 function collect(node: ts.Node): void {
@@ -87,7 +89,7 @@ function fixture(launchedByClient = true) {
     setCopiedRoomLink: vi.fn(), setPhase: vi.fn(), roomInitializationRef: ref(Promise.resolve()), roomRef: ref(null),
 
     createRoom: vi.fn(async () => { throw new Error("must not create an empty room"); }),
-    readPreferredRoomId: () => null, disposeResources: vi.fn(), ApiError: class extends Error {},
+    readPreferredRoomId: () => null, disposeResources: vi.fn(), ApiError,
     NativeMediaBridge: vi.fn(function (_shareId: string, _client: unknown, _onFailed: () => void) { return bridge; }), manualVideoCodecPreference: vi.fn(),
     phase: "live", qualitySettingsRef: ref<QualitySettings>(original), advancedQualityRef: ref<QualitySettings>(original),
     qualityChangeRef: ref<object | null>(null), pendingQualityChangeRef: ref<QualitySettings | null>(null),
@@ -130,14 +132,16 @@ function fixture(launchedByClient = true) {
   const start = context.startSharing;
   const startChild = context.startPeer;
   const openPicker = context.openCaptureSourcePicker;
+  const dispose = context.disposeResources as (notifyServer: boolean, keepRoomSession?: boolean) => void;
   const writeNoticeError = context.setNoticeError;
   state.setNoticeError.mockImplementation(writeNoticeError);
   context.setNoticeError = state.setNoticeError;
   context.startSharing = state.startSharing;
   context.startPeer = state.startPeer;
   context.openCaptureSourcePicker = state.openCaptureSourcePicker;
+  context.disposeResources = state.disposeResources;
   return { ...state, peer, client, route, track, bridge, physical: () => physical,
-    context, startChild, openPicker: openPicker as () => Promise<void>,
+    context, startChild, dispose, openPicker: openPicker as () => Promise<void>,
     closePicker: context.closeCaptureSourcePicker as () => void,
     releaseUnused: context.releaseUnusedNativeClient as () => void,
     disposeNative: context.disposeNativeShare as (expectedShare?: string) => void,
@@ -155,6 +159,22 @@ function fixture(launchedByClient = true) {
   };
 }
 
+function useRealResourceDisposal(current: ReturnType<typeof fixture>): void {
+  current.peersRef.current.clear();
+  Object.assign(current.hostSfuRouteRef, { current: null });
+  Object.assign(current.context, {
+    codecProbeAbortRef: ref(null), VP8_ONLY_VIDEO_CODEC: { primary: "vp8" },
+    setResolvedVideoCodec: vi.fn(), setHostSfuQualityWarning: vi.fn(),
+    setInteractionSession: vi.fn(), browserVideoPoolRef: ref(null),
+    setMicrophonePending: vi.fn(), retiringStreamRef: ref(null), iceConfigRef: ref(null),
+    setStream: vi.fn(), setPeerSnapshots: vi.fn(), setParticipantPresence: vi.fn(),
+    viewerQualityEvidenceStore: { clear: vi.fn(), getSnapshot: () => new Map() },
+    cancelViewerQualityEvidenceRender: vi.fn(), setViewerQualityEvidence: vi.fn(),
+    setSignalStatus: vi.fn(), sharingPausedRef: ref(false), setSharingPaused: vi.fn(),
+  });
+  current.disposeResources.mockImplementation(current.dispose);
+}
+
 describe("Camera replacement ownership", () => {
   it("keeps a screen Stop authoritative while a camera picker is pending", async () => {
     const current = fixture();
@@ -211,6 +231,7 @@ describe("Host room ownership", () => {
     class Signal {
       interactions = {};
       stop = vi.fn();
+      stopSharing = vi.fn();
       constructor(public identity: { roomId: string; token: string; roomOnly?: true; shareGeneration?: string },
         public events: {
           onMessage(message: unknown): void;
@@ -220,7 +241,7 @@ describe("Host room ownership", () => {
       ownsHostRoom(roomId: string, token: string) { return this.identity.roomId === roomId && this.identity.token === token; }
       wantsHostPublication(generation: string) { return this.identity.shareGeneration === generation && this.identity.roomOnly !== true; }
     }
-    const forgetRoom = vi.fn(() => { Object.assign(current.roomRef, { current: null }); return true; });
+    const forgetRoom = vi.fn(current.context.forgetRoom);
     Object.assign(current.roomRef, { current: room });
     Object.assign(current.signalRef, { current: null });
     current.generationRef.current = 1;
@@ -230,7 +251,7 @@ describe("Host room ownership", () => {
       getStableClientId: () => "host-client", defaultHostDisplayName: () => "Host", readDisplayName: () => "Host",
       setDisplayName: vi.fn(), setDisplayNameDraft: vi.fn(), setDisplayNameError: vi.fn(),
       setInteractionSession: vi.fn(), setSignalStatus: vi.fn(), forgetRoom,
-      onAuthorizationRequired: vi.fn(),
+      onAuthorizationRequired: vi.fn(), clearHostRoom: vi.fn(), writePreferredRoom: vi.fn(),
       hostServerErrorNotice: (code: string) => code,
     });
     return { ...current, room, signals, forgetRoom, connect: (value = room) => current.context.connectRoomSignal(value) as Signal };
@@ -270,6 +291,105 @@ describe("Host room ownership", () => {
     });
   });
 
+  it.each(["INVALID_TOKEN", "HOST_ALREADY_CONNECTED", "room-closed", "terminated", "access-required"])(
+    "retires idle native selection and its late results on %s", async event => {
+      for (const stage of ["ready", "discovery", "enumeration"]) {
+        const current = roomFixture();
+        useRealResourceDisposal(current);
+        current.context.phase = "idle";
+        current.activeGenerationRef.current = null;
+        current.shareGenerationRef.current = null;
+        current.nativeShareGenerationRef.current = null;
+        const discovery = deferred<typeof current.client>();
+        const enumeration = deferred<never[]>();
+        if (stage === "discovery") {
+          current.nativeClientRef.current = null;
+          current.NativeClient.connect.mockReturnValueOnce(discovery.promise);
+        } else if (stage === "enumeration") current.client.sources.mockReturnValueOnce(enumeration.promise);
+        const signal = current.connect();
+        const selecting = current.openPicker();
+        if (stage === "ready") await selecting;
+        else await vi.waitFor(() => expect(stage === "discovery"
+          ? current.NativeClient.connect : current.client.sources).toHaveBeenCalledOnce());
+        expect(current.nativeSourceRequestRef.current).not.toBeNull();
+
+        if (event === "terminated") signal.events.onTerminated("SIGNAL_TERMINATED");
+        else if (event === "access-required") signal.events.onAccessRequired();
+        else signal.events.onMessage(event === "room-closed" ? { type: event } : { type: "error", code: event });
+        expect(current.nativeSourceRequestRef.current).toBeNull();
+        expect(current.nativeSourcePathRef.current).toBeNull();
+        expect(current.nativeClientConnectRef.current).toBeNull();
+        discovery.resolve(current.client);
+        enumeration.resolve([]);
+        await selecting;
+        expect(current.nativeClientRef.current).toBeNull();
+        expect(current.client.close).toHaveBeenCalledOnce();
+        expect(current.setNativeSources).toHaveBeenLastCalledWith(null);
+        expect(current.createRoom).not.toHaveBeenCalled();
+        if (stage === "discovery") expect(current.client.sources).not.toHaveBeenCalled();
+      }
+    },
+  );
+
+  it.each([false, true])("retires a room rejected by an access update (sharing=%s)", async sharing => {
+    const current = roomFixture();
+    useRealResourceDisposal(current);
+    current.context.phase = sharing ? "live" : "idle";
+    current.nativeModeRef.current = sharing;
+    if (!sharing) {
+      current.activeGenerationRef.current = null;
+      current.shareGenerationRef.current = null;
+      current.nativeShareGenerationRef.current = null;
+      current.streamRef.current = null;
+    }
+    const signal = current.connect();
+    await current.openPicker();
+    current.context.handleRoomAccessFailure(new ApiError("Room not found", 404), current.room);
+    expect(current.roomRef.current).toBeNull();
+    expect(current.signalRef.current).toBeNull();
+    expect(signal.stop).toHaveBeenCalledOnce();
+    expect(current.activeGenerationRef.current).toBeNull();
+    expect(current.track.stop).toHaveBeenCalledTimes(sharing ? 1 : 0);
+    expect(current.client.close).toHaveBeenCalledOnce();
+    expect(current.setNativeSources).toHaveBeenLastCalledWith(null);
+    expect(current.setNoticeValue).toHaveBeenLastCalledWith(expect.objectContaining({
+      key: "host.roomInvalid", target: "television", comic: "room-not-found", tone: "bad",
+    }));
+  });
+
+  it("retires the room session when a replacement fails after capture was stopped", async () => {
+    const current = roomFixture();
+    useRealResourceDisposal(current);
+    const response = deferred<never>();
+    current.context.replaceOwnedRoom = vi.fn(() => response.promise);
+    const signal = current.connect();
+    const replacing = current.context.replaceCurrentRoom();
+    current.context.endSharing({ key: "host.stopNotice" });
+    expect(signal.stop).not.toHaveBeenCalled();
+    expect(current.signalRef.current).toBe(signal);
+    response.reject(new ApiError("Room not found", 404));
+    await replacing;
+    expect(current.roomRef.current).toBeNull();
+    expect(current.signalRef.current).toBeNull();
+    expect(signal.stop).toHaveBeenCalledOnce();
+    expect(current.createRoom).not.toHaveBeenCalled();
+    expect(current.roomMutationRef.current).toBeNull();
+  });
+
+  it("ignores an old room's failed access update after another room owns the session", () => {
+    const current = roomFixture();
+    useRealResourceDisposal(current);
+    const replacement = { ...current.room, hostToken: "replacement-token" };
+    Object.assign(current.roomRef, { current: replacement });
+    const signal = current.connect(replacement);
+    current.context.handleRoomAccessFailure(new ApiError("Room not found", 404), current.room);
+    expect(current.roomRef.current).toBe(replacement);
+    expect(current.signalRef.current).toBe(signal);
+    expect(signal.stop).not.toHaveBeenCalled();
+    expect(current.client.close).not.toHaveBeenCalled();
+    expect(current.setNoticeValue).not.toHaveBeenCalled();
+  });
+
   it.each(["INVALID_TOKEN", "HOST_ALREADY_CONNECTED", "room-closed", "terminated", "access-required"])(
     "keeps %s in the same status surface with and without a source", event => {
       const outcomes: unknown[] = [];
@@ -643,7 +763,8 @@ describe("Host quality ownership", () => {
     current.nativeModeRef.current = true;
     await current.openPicker();
     expect(current.nativeSourceRequestRef.current).not.toBeNull();
-    current.disposeResources.mockImplementation(() => current.disposeNative());
+    useRealResourceDisposal(current);
+    Object.assign(current.signalRef, { current: null });
     current.context.endSharing({ key: "host.notice.stopped" });
     expect(current.nativeSourceRequestRef.current).toBeNull();
     expect(current.nativeSourcePathRef.current).toBeNull();

From 7f40cec61b70530ad506c12f5489625af0857281 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Mon, 12 Oct 2026 01:09:03 +0800
Subject: [PATCH 172/262] fix(ci): keep candidate builds independent of release
 history

---
 .github/workflows/repository-hygiene.yml |  2 +-
 docs/standards/versioning.md             | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/repository-hygiene.yml b/.github/workflows/repository-hygiene.yml
index 708e5c47c..1831958e5 100644
--- a/.github/workflows/repository-hygiene.yml
+++ b/.github/workflows/repository-hygiene.yml
@@ -75,7 +75,7 @@ jobs:
           ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && vars.PIIK_RELEASES_ENABLED == 'true' && 'plan' || 'build' }}
           --github-output
       - name: Preview release notes
-        if: steps.release.outputs.publish == 'true' || inputs.candidate_version != ''
+        if: steps.release.outputs.publish == 'true'
         run: node scripts/release-notes.mjs "$PIIK_RELEASE_VERSION" "$GITHUB_SHA" --github-summary
         env:
           PIIK_RELEASE_VERSION: ${{ steps.release.outputs.version }}
diff --git a/docs/standards/versioning.md b/docs/standards/versioning.md
index 34650a258..42ae5e1e5 100644
--- a/docs/standards/versioning.md
+++ b/docs/standards/versioning.md
@@ -237,11 +237,11 @@ first-parent commits since the previous stable tag. Standalone website and
 documentation phases need no product release notes. The first release uses
 only its launch commit's product introduction; private development history is
 not a launch changelog. Missing, empty, duplicate or visibly encoding-damaged
-sections fail validation before packaging/publication. GitHub Actions shows the generated text in its
-run summary. A manual candidate with an explicit version also previews it, so
-prepare its commit text before dispatching a release rehearsal. A manual
-candidate with no product changes may still be built; its summary reports that
-there are no product release notes, and publication remains disabled.
+sections fail PR and publishing validation. GitHub Actions shows the generated
+release text in its publishing run summary. Manual candidates validate and build
+the requested revision without requiring release copy in branch checkpoints;
+their version labels artifacts and never enables publication. The PR body remains
+the review surface until integration preserves it in the squash commit.
 
 Supply multiline PR/release copy through a UTF-8 file and read back the stored
 body before integration. A terminal preview alone does not prove that Chinese

From 69211f9c4297aad4a1678ce2626c07e883e01f02 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Mon, 12 Oct 2026 01:24:07 +0800
Subject: [PATCH 173/262] docs: focus candidate ledger on remaining acceptance

---
 docs/todo.md | 79 +++++++++++++++++-----------------------------------
 1 file changed, 26 insertions(+), 53 deletions(-)

diff --git a/docs/todo.md b/docs/todo.md
index 17b90c791..116d23dc7 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -1,6 +1,6 @@
 # Current TODO Ledger
 
-Last reviewed: 2026-10-11
+Last reviewed: 2026-10-12
 
 The current 2.0 preparation includes independent investigation across this
 ledger. Explicit owner holds remain in force; an investigation does not itself
@@ -13,9 +13,10 @@ Git/PRs own completed history.
 - [ ] **2.0 candidate preparation and acceptance.** The owner reopened investigation,
   useful improvements and outstanding acceptance on 2026-10-07, and on 2026-10-09
   chose to hold the maintenance changes for 2.0 rather than publish them separately.
-  Prepare one coherent candidate and stop before publication. Preserve the existing
-  product model; evaluate held features against measurable benefit and total complexity
-  before accepting a changed contract.
+  Complete final packaged lifecycle and device/network acceptance, then present
+  the frozen candidate and its bilingual release notes for owner review before
+  publication. Retain explicit 1.x mismatch checks. The retired Magicsock package
+  is not the current candidate; preserve the existing product model and held scope.
 - [ ] **Linux Portal target identity acceptance (#470).** The
   [contributor fix](https://github.com/TNTcraftHIM/Piik/pull/470) is integrated
   with authorship retained: serial and node-ID targeting remain distinct.
@@ -27,10 +28,10 @@ Git/PRs own completed history.
   [#469](https://github.com/TNTcraftHIM/Piik/pull/469)'s 4K request overlap the
   numeric-media candidate; neither PR has been merged. 4K60 is included in
   candidate admission, alongside the tested wider video control range, and still
-  needs physical device/network acceptance. Preserve
-  contributor credit and explain the disposition at integration. Rewrite
-  [#459](https://github.com/TNTcraftHIM/Piik/pull/459)'s earlier maintenance scope
-  and compatibility claims around the final 2.0 result before integration.
+  needs physical device/network acceptance. Preserve contributor credit and
+  explain the disposition at integration. Keep
+  [#459](https://github.com/TNTcraftHIM/Piik/pull/459)'s candidate scope and
+  bilingual upgrade instructions aligned with the accepted result.
 - [ ] **Independent Gitee mirror recovery.** Implementation and local acceptance
   are complete. Integrate through the next owner-approved publishing merge and
   verify the separate workflow with its original CI artifacts. Mirror failure
@@ -68,46 +69,19 @@ Existing negative results narrow the next experiment; they do not freeze the
 whole candidate or require another version-number decision before other work.
 Implementation needs a concrete useful result within the product model.
 
-- [ ] **Media parameters and capabilities for 2.0.** Follow the
-  [media assessment](./research/native-client-media.md#media-capability-extension-assessment):
-  separate UI presets, numeric requests, bounded implementation capabilities and
-  actual output. Numeric request, capability and observation boundaries are now
-  separate from implementation admission. Keep receiver, codec/alignment and
-  resource budgets intact; opening an output range still needs end-to-end evidence.
-  The inherited menu-only source range is replaced by 1..60 fps / 0.1..50 Mbps,
-  with coherent lower-output bounds and actual-progress preflight. Local
-  production-codec, source-change, Browser loopback, Native Host and SFU checks
-  cover both rate bounds. Preserve these checks in final package acceptance.
-  Keep the audio sender ceiling backed by the existing packet-size evidence.
-  Numeric audio and video controls are implemented; the assessment
-  owns local capture, codec, derived-output, SFU and bounded mixed-route evidence.
-  Remaining receiver acceptance needs physical limited decoders and camera
-  orientation behavior, beyond the bounded SDP-limit and mixed-route controls.
-  Browser display capture, Browser relay, Browser-to-Native fanout and SFU have
-  bounded high-resolution continuity evidence. macOS geometry hardware
-  checks and physical 4K/game capture remain open; both macOS package targets
-  now pass SDK compilation and startup. The fanout controls did not
-  establish sustained 60 fps; retain that performance limit when arranging
-  device/network acceptance. Preserve safety limits and
-  framework-owned adaptation. The
-  [audio controls](./research/browser-screen-audio-quality.md#numeric-bitrate-assessment)
-  retain explicit receive-limit enforcement and the current 320 kbps sender
-  ceiling. Physical listening, mobile and field-network acceptance remain open;
-  research owns the bounded real-Opus impairment and video-recovery control.
-  Validate the existing mono/stereo and Windows HDR-to-SDR paths under the
-  [fidelity boundary](./research/media-fidelity.md); surround delivery and
-  end-to-end HDR are outside this candidate. Additional codecs are also outside
-  this candidate. Later inclusion needs complete
-  encode/decode/forward support and a late-Viewer policy;
-  selecting a codec cannot transcode an existing publication. Final package
-  acceptance must retain the verified live-change, relay/SFU and limited-receiver
-  behavior, and check explicit 1.x mismatch with packaged builds. The published
-  1.x enums remain that major's baseline; the PR is not a compatible enum-only extension
-  of v1.9.2.
-- [ ] **2.0 candidate acceptance.** Finish the combined numeric-media UI,
-  App/room lifecycle, ordinary Browser/Native routes and regression checks before
-  asking the owner to arrange external testing. Keep each test build frozen and
-  identifiable; the retired Magicsock package is not the current candidate.
+- [ ] **Numeric-media device acceptance.** The implemented candidate and bounded
+  local evidence are owned by the
+  [media assessment](./research/native-client-media.md#media-capability-extension-assessment).
+  Retain live changes, source replacement, relay/SFU, limited-receiver and
+  low/high-rate controls in final package acceptance. Remaining physical checks
+  include limited decoders, camera orientation, macOS geometry and 4K/game capture;
+  local fanout controls do not establish sustained physical 4K60. Complete physical
+  listening, mobile and field-network checks for the
+  [audio controls](./research/browser-screen-audio-quality.md#numeric-bitrate-assessment),
+  preserving their packet and receive limits. Validate existing mono/stereo and
+  Windows HDR-to-SDR under the [fidelity boundary](./research/media-fidelity.md).
+  Additional codecs, surround delivery and end-to-end HDR remain outside this
+  candidate; product boundaries belong to the media-quality owner.
 - [ ] **Managed Demo hosting.** The [provider assessment](./operations/website.md#managed-hosting-assessment)
   identifies UDP/storage requirements but establishes no cost saving. Keep the
   existing P2P-only Demo until a provider and operating boundary are accepted.
@@ -116,11 +90,10 @@ Implementation needs a concrete useful result within the product model.
   existing device selector. Keep it outside this candidate until a concrete
   use case justifies that boundary and physical latency/echo/background checks.
   This proposal does not reopen room voice.
-- [ ] **Passive App attachment acceptance.** The two-choice launcher and explicit
-  local Site approval replace the third mode, using the existing native runtime.
-  Include first connection, saved approval, replacement/revocation and Local
-  coexistence in final packaged acceptance. Browser permission and cross-platform
-  checks must not be inferred from the local development preview.
+- [ ] **Passive App attachment acceptance.** Preserve the verified first
+  connection, saved approval, replacement/revocation and Local coexistence in
+  final packaged acceptance. Check Browser permission and cross-platform behavior;
+  local approval controls do not establish those physical-device outcomes.
 
 ## Awaiting Device Or Reporter Evidence
 

From ac970ce1cfc9ab6d82e0a60840a2d2ec42d719ff Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Mon, 12 Oct 2026 02:44:08 +0800
Subject: [PATCH 174/262] fix(ui): apply quality choices without committing
 superseded drafts

---
 .../components/living/QualityPresets.tsx      | 86 +++++++++++--------
 src/client/components/living/primitives.tsx   |  9 +-
 tests/control-activation.test.ts              | 41 +++++++++
 tests/quality-controls.test.ts                | 81 +++++++++++++++++
 4 files changed, 176 insertions(+), 41 deletions(-)
 create mode 100644 tests/control-activation.test.ts
 create mode 100644 tests/quality-controls.test.ts

diff --git a/src/client/components/living/QualityPresets.tsx b/src/client/components/living/QualityPresets.tsx
index 92679de4c..ea1cdc1b2 100644
--- a/src/client/components/living/QualityPresets.tsx
+++ b/src/client/components/living/QualityPresets.tsx
@@ -1,4 +1,4 @@
-import { Fragment, useRef } from "react";
+import { Fragment, useRef, type ReactNode } from "react";
 import { MIN_AUDIO_BITRATE } from "../../../shared/protocol";
 import {
   QUALITY_PROFILES, QUALITY_PROFILE_KEYS, QUALITY_RESOLUTIONS, qualityResolutionEqual,
@@ -108,7 +108,7 @@ const AUDIO_QUALITY_CAPTIONS: Record<ScreenAudioPreset, CopyKey> = {
   "very-high": "host.advanced.audio.veryHigh",
 };
 
-function QualityNumberInput({ value, min, max, step, unit, name, label, disabled, onChange }: {
+function QualityNumberControl({ value, min, max, step, unit, name, label, disabled, onChange, className, children }: {
   value: number;
   min: number;
   max: number;
@@ -118,27 +118,34 @@ function QualityNumberInput({ value, min, max, step, unit, name, label, disabled
   label: string;
   disabled: boolean;
   onChange: (value: number) => void;
+  className: string;
+  children: (input: ReactNode, select: (value: number) => void) => ReactNode;
 }) {
-  return <label className="lr-input lr-quality-number">
-    <input type="number" inputMode={step < 1 ? "decimal" : "numeric"} name={name} key={value}
+  const input = useRef<HTMLInputElement>(null);
+  const reset = () => { input.current!.value = String(value); };
+  const select = (next: number) => {
+    // A preset or slider replaces the draft, including a choice of the current value.
+    reset();
+    if (next !== value) onChange(next);
+  };
+  const number = <label className="lr-input lr-quality-number">
+    <input ref={input} type="number" inputMode={step < 1 ? "decimal" : "numeric"} name={name} key={value}
       defaultValue={value} min={min} max={max} step={step} disabled={disabled} aria-label={label}
-      onBlur={event => {
-        const input = event.currentTarget;
-        if (!input.validity.valid || !Number.isFinite(input.valueAsNumber)) {
-          input.value = String(value);
-          return;
-        }
-        if (input.valueAsNumber !== value) onChange(input.valueAsNumber);
-      }}
       onKeyDown={event => {
         if (event.key !== "Enter" && event.key !== "Escape") return;
         event.preventDefault();
         event.stopPropagation();
-        if (event.key === "Escape") event.currentTarget.value = String(value);
+        if (event.key === "Escape") reset();
         event.currentTarget.blur();
       }} />
     <span>{unit}</span>
   </label>;
+  return <div className={className} onBlur={event => {
+    if (event.currentTarget.contains(event.relatedTarget)) return;
+    const field = input.current!;
+    if (!field.validity.valid || !Number.isFinite(field.valueAsNumber)) reset();
+    else if (field.valueAsNumber !== value) onChange(field.valueAsNumber);
+  }}>{children(number, select)}</div>;
 }
 
 export function VideoRateControls({ value, limits, disabled, onChange }: {
@@ -162,13 +169,16 @@ export function VideoRateControls({ value, limits, disabled, onChange }: {
     {controls.map(control => <div className="lr-door-group" key={control.name}>
       <span className="lr-door-glyph"><Glyph name={control.icon} size={19} /><Cap k={control.label} /></span>
       <Tooltip kind={control.hint} text={vis ? undefined : t(control.label)} className="lr-slider-hint">
-        <span className="lr-quality-rate">
-          <input type="range" min={control.min} max={Math.max(control.min, control.max)} step={control.step}
-            value={control.value} disabled={disabled || control.max < control.min} aria-label={t(control.label)}
-            onChange={event => control.change(event.currentTarget.valueAsNumber)} />
-          <QualityNumberInput {...control} label={t(control.label)} disabled={disabled || control.max < control.min}
-            onChange={control.change} />
-        </span>
+        <QualityNumberControl {...control} className="lr-quality-rate" label={t(control.label)}
+          disabled={disabled || control.max < control.min} onChange={control.change}>
+          {(input, select) => <>
+            <input type="range" min={control.min} max={Math.max(control.min, control.max)} step={control.step}
+              value={control.value} disabled={disabled || control.max < control.min} aria-label={t(control.label)}
+              onChange={event => select(event.currentTarget.valueAsNumber)}
+              onClick={event => select(event.currentTarget.valueAsNumber)} />
+            {input}
+          </>}
+        </QualityNumberControl>
       </Tooltip>
     </div>)}
   </div>;
@@ -183,22 +193,24 @@ export function AudioBitrateControl({ value, max, disabled, onChange }: {
   const { t, vis } = useCopy();
   return <div className="lr-door-group">
     <span className="lr-door-glyph"><Glyph name="speaker" size={19} /><Cap k="host.advanced.audio" /></span>
-    <div className="lr-row-group" role="group" aria-label={t("host.advanced.audio")}>
-      {(Object.keys(SCREEN_AUDIO_BITRATES) as ScreenAudioPreset[]).map(preset => {
-        const bitrate = SCREEN_AUDIO_BITRATES[preset];
-        return <Chip key={preset} selected={value === bitrate} disabled={disabled || bitrate > max}
-          title={t("host.audio.title", { label: t(AUDIO_QUALITY_CAPTIONS[preset]), kbps: String(bitrate / 1_000) })}
-          hint="hint-audio-quality" onClick={() => onChange(bitrate)}>
-          <Cap k={AUDIO_QUALITY_CAPTIONS[preset]} /><small className="lr-audio-rate">{bitrate / 1_000}</small>
-        </Chip>;
-      })}
-    </div>
-    <Tooltip kind="hint-audio-quality" text={vis ? undefined : t("host.audio.bitrateHint", {
-      min: String(MIN_AUDIO_BITRATE / 1_000), max: String(max / 1_000),
-    })}>
-      <QualityNumberInput value={value / 1_000} min={MIN_AUDIO_BITRATE / 1_000} max={max / 1_000} step={1}
-        name="audioBitrate" unit="kbps" label={t("host.advanced.audioBitrate")}
-        disabled={disabled} onChange={kbps => onChange(kbps * 1_000)} />
-    </Tooltip>
+    <QualityNumberControl value={value / 1_000} min={MIN_AUDIO_BITRATE / 1_000} max={max / 1_000} step={1}
+      name="audioBitrate" unit="kbps" label={t("host.advanced.audioBitrate")} className="lr-door-group"
+      disabled={disabled} onChange={kbps => onChange(kbps * 1_000)}>
+      {(input, select) => <>
+        <div className="lr-row-group" role="group" aria-label={t("host.advanced.audio")}>
+          {(Object.keys(SCREEN_AUDIO_BITRATES) as ScreenAudioPreset[]).map(preset => {
+            const bitrate = SCREEN_AUDIO_BITRATES[preset];
+            return <Chip key={preset} selected={value === bitrate} disabled={disabled || bitrate > max}
+              title={t("host.audio.title", { label: t(AUDIO_QUALITY_CAPTIONS[preset]), kbps: String(bitrate / 1_000) })}
+              hint="hint-audio-quality" onClick={() => select(bitrate / 1_000)}>
+              <Cap k={AUDIO_QUALITY_CAPTIONS[preset]} /><small className="lr-audio-rate">{bitrate / 1_000}</small>
+            </Chip>;
+          })}
+        </div>
+        <Tooltip kind="hint-audio-quality" text={vis ? undefined : t("host.audio.bitrateHint", {
+          min: String(MIN_AUDIO_BITRATE / 1_000), max: String(max / 1_000),
+        })}>{input}</Tooltip>
+      </>}
+    </QualityNumberControl>
   </div>;
 }
diff --git a/src/client/components/living/primitives.tsx b/src/client/components/living/primitives.tsx
index 153bb5bca..cc22843f0 100644
--- a/src/client/components/living/primitives.tsx
+++ b/src/client/components/living/primitives.tsx
@@ -24,7 +24,8 @@ function blockSoftDisabledClick(event: MouseEvent<HTMLButtonElement>): void {
 
 // Pointer activations blur the trigger so the comic is not pinned open by
 // focus after the action completes; keyboard clicks (detail 0) keep focus,
-// so the panel persists for genuine keyboard use.
+// so the panel persists for genuine keyboard use. Run the action first:
+// leaving an enclosing field group may otherwise commit a superseded draft.
 function blurAfterPointerClick(event: MouseEvent<HTMLButtonElement>): void {
   if (event.detail !== 0) event.currentTarget.blur();
 }
@@ -100,8 +101,8 @@ export function Btn({
           ? blockSoftDisabledClick
           : wrapped
             ? (event) => {
-                blurAfterPointerClick(event);
                 onClick?.();
+                blurAfterPointerClick(event);
               }
             : onClick
       }
@@ -162,8 +163,8 @@ export function Chip({
           ? blockSoftDisabledClick
           : wrapped
             ? (event) => {
-                blurAfterPointerClick(event);
                 onClick?.();
+                blurAfterPointerClick(event);
               }
             : onClick
       }
@@ -283,8 +284,8 @@ export function SwitchItem({
           softDisabled
             ? blockSoftDisabledClick
             : (event) => {
-                if (wrapped) blurAfterPointerClick(event);
                 onChange(!checked);
+                if (wrapped) blurAfterPointerClick(event);
               }
         }
       />
diff --git a/tests/control-activation.test.ts b/tests/control-activation.test.ts
new file mode 100644
index 000000000..bafbf716e
--- /dev/null
+++ b/tests/control-activation.test.ts
@@ -0,0 +1,41 @@
+import { Children, isValidElement, type ComponentProps, type MouseEvent, type ReactNode } from "react";
+import { describe, expect, it, vi } from "vitest";
+import { Btn, Chip, SwitchItem } from "../src/client/components/living/primitives";
+
+vi.mock("../src/client/ui/copy", () => ({
+  useCopy: () => ({ vis: false, t: (key: string) => key }),
+}));
+
+function button(node: ReactNode): ComponentProps<"button"> | undefined {
+  if (!isValidElement<{ children?: ReactNode }>(node)) return;
+  if (node.type === "button") return node.props;
+  return Children.toArray(node.props.children).map(button).find(Boolean);
+}
+
+const controls = {
+  button: (activate: () => void) => Btn({ icon: "play", title: "playback.play", hint: "hint-quality", onClick: activate }),
+  chip: (activate: () => void) => Chip({ selected: false, title: "720p", hint: "hint-quality", onClick: activate, children: "720p" }),
+  switch: (activate: () => void) => SwitchItem({ checked: false, label: "Setting", hint: "hint-quality", onChange: activate }),
+};
+
+describe("Hinted control activation", () => {
+  it.each(Object.entries(controls))("%s applies the chosen action before focus-leave commits a draft", (_name, render) => {
+    const changes: string[] = [];
+    let pendingDraft = true;
+    const control = button(render(() => { pendingDraft = false; changes.push("chosen action"); }))!;
+    const blur = vi.fn(() => { if (pendingDraft) changes.push("unconfirmed draft"); });
+
+    control.onClick!({ detail: 1, currentTarget: { blur } } as unknown as MouseEvent<HTMLButtonElement>);
+
+    expect(changes).toEqual(["chosen action"]);
+    expect(blur).toHaveBeenCalledOnce();
+  });
+
+  it.each(Object.entries(controls))("%s keeps keyboard focus when activated", (_name, render) => {
+    const activate = vi.fn();
+    const blur = vi.fn();
+    button(render(activate))!.onClick!({ detail: 0, currentTarget: { blur } } as unknown as MouseEvent<HTMLButtonElement>);
+    expect(activate).toHaveBeenCalledOnce();
+    expect(blur).not.toHaveBeenCalled();
+  });
+});
diff --git a/tests/quality-controls.test.ts b/tests/quality-controls.test.ts
new file mode 100644
index 000000000..5c6ff349d
--- /dev/null
+++ b/tests/quality-controls.test.ts
@@ -0,0 +1,81 @@
+import { readFileSync } from "node:fs";
+import { runInNewContext } from "node:vm";
+import * as jsxRuntime from "react/jsx-runtime";
+import ts from "typescript";
+import { describe, expect, it, vi } from "vitest";
+
+// Exercise the private draft owner without adding a DOM runtime to unit tests.
+// Real pointer/focus ordering is also checked in the existing Browser preview.
+const source = ts.createSourceFile("QualityPresets.tsx", readFileSync(
+  new URL("../src/client/components/living/QualityPresets.tsx", import.meta.url), "utf8",
+), ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
+const owner = source.statements.find(node => ts.isFunctionDeclaration(node) && node.name?.text === "QualityNumberControl");
+if (!owner) throw new Error("Missing numeric quality draft owner");
+const executable = ts.transpileModule(`${owner.getText(source)}\nQualityNumberControl;`, {
+  fileName: "QualityPresets.tsx",
+  compilerOptions: { target: ts.ScriptTarget.ES2022, module: ts.ModuleKind.CommonJS, jsx: ts.JsxEmit.ReactJSX },
+}).outputText;
+
+function editor() {
+  const input = { value: "128", validity: { valid: true },
+    get valueAsNumber() { return this.value === "" ? NaN : Number(this.value); } };
+  const inside = {};
+  const container = { contains: (node: unknown) => node === inside };
+  const onChange = vi.fn();
+  const render = runInNewContext(executable, {
+    exports: {}, require: () => jsxRuntime, useRef: () => ({ current: input }), Number,
+  });
+  let choose!: (next: number) => void;
+  let key!: (event: unknown) => void;
+  const result = render({ value: 128, min: 6, max: 320, step: 1, unit: "kbps", name: "audioBitrate",
+    label: "Audio bitrate", disabled: false, onChange, className: "lr-door-group",
+    children: (number: { props: { children: { props: { onKeyDown: typeof key } }[] } }, select: typeof choose) => {
+      choose = select;
+      key = number.props.children[0]!.props.onKeyDown;
+      return number;
+    },
+  });
+  const blur = (relatedTarget: unknown = null) => result.props.onBlur({ currentTarget: container, relatedTarget });
+  const press = (value: string) => key({ key: value, currentTarget: { blur: () => blur() },
+    preventDefault() {}, stopPropagation() {} });
+  return { input, inside, onChange, choose, blur, press };
+}
+
+describe("Numeric quality editing group", () => {
+  it("preserves a draft through group navigation or cancelled selection, then commits on leaving", () => {
+    const current = editor();
+    current.input.value = "256";
+    current.blur(current.inside);
+    expect(current.onChange).not.toHaveBeenCalled();
+    expect(current.input.value).toBe("256");
+    current.blur();
+    expect(current.onChange.mock.calls).toEqual([[256]]);
+  });
+
+  it.each([64, 128])("a choice of %s replaces the draft before a subsequent blur", next => {
+    const current = editor();
+    current.input.value = "256";
+    current.blur(current.inside);
+    current.choose(next);
+    current.blur();
+    expect(current.input.value).toBe("128");
+    expect(current.onChange.mock.calls).toEqual(next === 128 ? [] : [[next]]);
+  });
+
+  it.each(["Enter", "Escape"])("handles %s through the same group boundary", key => {
+    const current = editor();
+    current.input.value = "256";
+    current.press(key);
+    expect(current.onChange.mock.calls).toEqual(key === "Enter" ? [[256]] : []);
+    if (key === "Escape") expect(current.input.value).toBe("128");
+  });
+
+  it.each(["", "321"])("restores an empty or invalid draft (%s) without applying it", value => {
+    const current = editor();
+    current.input.value = value;
+    current.input.validity.valid = value === "";
+    current.blur();
+    expect(current.input.value).toBe("128");
+    expect(current.onChange).not.toHaveBeenCalled();
+  });
+});

From 25b3b9f4f369e57079e787db6880d5495c146cbb Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Mon, 12 Oct 2026 02:44:17 +0800
Subject: [PATCH 175/262] docs: separate remaining candidate checks from
 deferred evidence

---
 docs/operations/github.md | 17 ++++---
 docs/todo.md              | 97 +++++++++++++++++----------------------
 2 files changed, 51 insertions(+), 63 deletions(-)

diff --git a/docs/operations/github.md b/docs/operations/github.md
index bd28b8682..a2eecdb9b 100644
--- a/docs/operations/github.md
+++ b/docs/operations/github.md
@@ -40,16 +40,19 @@ validate release notes without packaging or publication; manual `app_checks`
 dispatch remains available for candidates.
 Writing a new version back to main is unnecessary and prohibited.
 
-For a complete publisher rehearsal, dispatch with `app_checks: true` and an
+For a complete package rehearsal, dispatch with `app_checks: true` and an
 explicit `candidate_version` such as `v1.0.0`. This builds genuine Server and
 native App artifacts under one revision and version without tagging or
 publishing. Prepare its [release-note section](../standards/versioning.md#release-notes)
-and inspect the generated preview in the run summary. For a local preview, run
-`node scripts/release-notes.mjs v1.0.0 FULL_SOURCE_SHA` from the checkout with
-full history and tags. Download that run's artifacts and pass their directory, version and
-full revision to `scripts/publish-release.mjs --dry-run` (put the flag after
-the three positional arguments). An omitted candidate version keeps the usual
-development/exact-tag identity.
+in the candidate PR and review that rendered body; branch checkpoints need no
+release copy. The publishing run generates the final notes from accepted squash
+commits. To preview that aggregate locally after integration, run
+`node scripts/release-notes.mjs VERSION FULL_SOURCE_SHA` from the checkout with
+full history and tags. Download the candidate run's artifacts and pass their
+directory, version and full revision to `scripts/publish-release.mjs --dry-run`
+(put the flag after the three positional arguments). This validates package
+identity and checksums without publishing or aggregating branch commit messages.
+An omitted candidate version keeps the usual development/exact-tag identity.
 
 Enable GitHub's built-in release immutability for formal publication where
 available. Upload all assets to the draft before publishing. A failed upload can
diff --git a/docs/todo.md b/docs/todo.md
index 116d23dc7..f8300db52 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -13,29 +13,24 @@ Git/PRs own completed history.
 - [ ] **2.0 candidate preparation and acceptance.** The owner reopened investigation,
   useful improvements and outstanding acceptance on 2026-10-07, and on 2026-10-09
   chose to hold the maintenance changes for 2.0 rather than publish them separately.
-  Complete final packaged lifecycle and device/network acceptance, then present
-  the frozen candidate and its bilingual release notes for owner review before
-  publication. Retain explicit 1.x mismatch checks. The retired Magicsock package
-  is not the current candidate; preserve the existing product model and held scope.
-- [ ] **Linux Portal target identity acceptance (#470).** The
-  [contributor fix](https://github.com/TNTcraftHIM/Piik/pull/470) is integrated
-  with authorship retained: serial and node-ID targeting remain distinct.
-  Candidate compilation and headless targeting checks pass. Verify an actual
-  Portal that omits `pipewire-serial`; the headless check does not exercise
-  desktop capture.
+  Complete the remaining packaged Windows App/Browser lifecycle acceptance,
+  then present the frozen candidate and its bilingual release notes for owner
+  review before publication. Retain explicit 1.x mismatch checks. Broader device
+  coverage below does not override the owner's platform deferrals or require a
+  statistical NAT campaign. The retired Magicsock package is not the current
+  candidate; preserve the existing product model and held scope.
 - [ ] **Reconcile open PRs with the final candidate.**
   [#462](https://github.com/TNTcraftHIM/Piik/pull/462)'s 256/320 kbps request and
   [#469](https://github.com/TNTcraftHIM/Piik/pull/469)'s 4K request overlap the
-  numeric-media candidate; neither PR has been merged. 4K60 is included in
-  candidate admission, alongside the tested wider video control range, and still
-  needs physical device/network acceptance. Preserve contributor credit and
-  explain the disposition at integration. Keep
+  numeric-media candidate; neither PR has been merged. Preserve contributor
+  credit, the physical-evidence limits below, and explain the disposition at integration. Keep
   [#459](https://github.com/TNTcraftHIM/Piik/pull/459)'s candidate scope and
   bilingual upgrade instructions aligned with the accepted result.
-- [ ] **Independent Gitee mirror recovery.** Implementation and local acceptance
-  are complete. Integrate through the next owner-approved publishing merge and
-  verify the separate workflow with its original CI artifacts. Mirror failure
-  must remain visible without blocking product CI or Website delivery.
+- [ ] **Gitee mirror workflow activation.** The production verifier passes with
+  the original published CI artifacts, GitHub digests and anonymous Gitee downloads.
+  After the owner-approved merge, check Actions event dispatch, cross-run artifact
+  access and secret injection. Keep mirror failure visible without blocking
+  product CI or Website delivery; do not rebuild an existing release for recovery.
 
 ## Held By Owner
 
@@ -62,44 +57,17 @@ Git/PRs own completed history.
 - [ ] **Windows ARM64 App.** Deferred by the owner on 2026-10-03. Keep Windows
   App packages and website downloads x64-only until this work is reopened.
 
-## Feature Assessments
-
-Assess these proposals against the owner's benefit/complexity condition.
-Existing negative results narrow the next experiment; they do not freeze the
-whole candidate or require another version-number decision before other work.
-Implementation needs a concrete useful result within the product model.
-
-- [ ] **Numeric-media device acceptance.** The implemented candidate and bounded
-  local evidence are owned by the
-  [media assessment](./research/native-client-media.md#media-capability-extension-assessment).
-  Retain live changes, source replacement, relay/SFU, limited-receiver and
-  low/high-rate controls in final package acceptance. Remaining physical checks
-  include limited decoders, camera orientation, macOS geometry and 4K/game capture;
-  local fanout controls do not establish sustained physical 4K60. Complete physical
-  listening, mobile and field-network checks for the
-  [audio controls](./research/browser-screen-audio-quality.md#numeric-bitrate-assessment),
-  preserving their packet and receive limits. Validate existing mono/stereo and
-  Windows HDR-to-SDR under the [fidelity boundary](./research/media-fidelity.md).
-  Additional codecs, surround delivery and end-to-end HDR remain outside this
-  candidate; product boundaries belong to the media-quality owner.
-- [ ] **Managed Demo hosting.** The [provider assessment](./operations/website.md#managed-hosting-assessment)
-  identifies UDP/storage requirements but establishes no cost saving. Keep the
-  existing P2P-only Demo until a provider and operating boundary are accepted.
-- [ ] **Phone as a Host microphone.** The [input assessment](./research/camera-and-microphone.md#phone-microphone-assessment)
-  identifies pairing/revocation and native decoded-input ownership beyond the
-  existing device selector. Keep it outside this candidate until a concrete
-  use case justifies that boundary and physical latency/echo/background checks.
-  This proposal does not reopen room voice.
-- [ ] **Passive App attachment acceptance.** Preserve the verified first
-  connection, saved approval, replacement/revocation and Local coexistence in
-  final packaged acceptance. Check Browser permission and cross-platform behavior;
-  local approval controls do not establish those physical-device outcomes.
-
 ## Awaiting Device Or Reporter Evidence
 
-These reports remain unmatched. A local repair or successful test is not proof
-of a reporter's cause; research owns the completed experiments and their limits.
+These physical checks or reporter diagnoses remain unverified. A local repair or
+successful test is not proof of a reporter's cause; research owns the completed
+experiments and their limits.
 
+- [ ] **Linux Portal target identity acceptance (#470).** The
+  [contributor fix](https://github.com/TNTcraftHIM/Piik/pull/470) is integrated
+  with authorship retained. Compilation and headless serial/node-ID targeting
+  checks pass. Verify an actual Portal that omits `pipewire-serial` when physical
+  Linux capture acceptance resumes; headless checks do not exercise desktop capture.
 - [ ] **Windows 11 capture border remains visible.** The new report does not
   identify the affected version, capture path or Windows build. The reviewed
   picker/start/source-change paths preserve the border preference; no additional
@@ -111,9 +79,19 @@ of a reporter's cause; research owns the completed experiments and their limits.
 - [ ] **Physical device and network acceptance.** Complete the remaining
   [device checks](./verification-status.md#device-evidence-boundary) and
   [network/endurance matrix](./verification-status.md#remaining-device-and-network-acceptance),
-  preserving platform deferrals and serial physical checks. Include macOS/Linux
-  capture, HDR/mixed displays, audio exclusion across real process trees and
-  playback devices, and mobile keyboard/theater/participant controls. The
+  preserving platform deferrals and serial physical checks. The implemented
+  [numeric-media candidate](./research/native-client-media.md#media-capability-extension-assessment)
+  still needs physical limited-decoder, camera-orientation, macOS geometry and
+  sustained 4K/game evidence. Check live changes and source replacement through
+  relay/SFU, and listen across the
+  [audio control range](./research/browser-screen-audio-quality.md#numeric-bitrate-assessment).
+  Include existing mono/stereo and Windows HDR-to-SDR under the
+  [fidelity boundary](./research/media-fidelity.md), audio exclusion across real
+  process trees/playback devices, and mobile keyboard/theater/participant controls.
+  Passive App attachment still needs cross-device Browser-permission checks;
+  retain first/saved approval, replacement/revocation and Local coexistence.
+  These are evidence limits for implemented features, not new feature proposals.
+  Additional codecs, surround delivery and end-to-end HDR remain outside the candidate. The
   [camera and microphone assessment](./research/camera-and-microphone.md)
   additionally owns levels, echo, device replacement/native mixing, OBS input
   A/V synchronization and phone camera permission/orientation/background limits.
@@ -258,3 +236,10 @@ restore reverse feedback. Keep standard ICE recovery while that boundary remains
     The [capture assessment](./research/camera-and-microphone.md) records raw-frame
     output and the WHIP boundary; virtual camera alone is not a second encode.
     Do not add an RTMP/WHIP listener without an accepted publication owner.
+9. **Managed Demo hosting.** The [provider assessment](./operations/website.md#managed-hosting-assessment)
+    identifies UDP/storage requirements but establishes no cost saving. Keep the
+    existing P2P-only Demo; reopen for an accepted provider and operating boundary.
+10. **Phone as a Host microphone.** The [input assessment](./research/camera-and-microphone.md#phone-microphone-assessment)
+    identifies pairing/revocation and native decoded-input ownership beyond the
+    device selector. Reopen for a concrete use case that justifies this boundary
+    and physical latency/echo/background checks. This does not reopen room voice.

From b721fb47abfad9ef883e3d35d07746454f2a6b88 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Mon, 12 Oct 2026 02:52:53 +0800
Subject: [PATCH 176/262] fix(ui): keep quality preset values readable in
 narrow layouts

---
 src/client/components/living/QualityPresets.tsx | 2 +-
 src/client/locales/en.ts                        | 6 +++---
 src/client/locales/zh.ts                        | 6 +++---
 src/client/styles.css                           | 2 +-
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/client/components/living/QualityPresets.tsx b/src/client/components/living/QualityPresets.tsx
index ea1cdc1b2..6eedf09d1 100644
--- a/src/client/components/living/QualityPresets.tsx
+++ b/src/client/components/living/QualityPresets.tsx
@@ -30,7 +30,7 @@ export function QualityPresets({ selected, limits = VIDEO_CAPTURE_LIMITS, disabl
           aria-pressed={selected === id} aria-label={caption}
           disabled={disabled || !supportsCaptureProfile(profile, limits)} onClick={() => onSelect(id)}>
           <QualityTileGlyph resolution={`${profile.resolution.height}p`} framerate={profile.maxFramerate} />
-          <small>{vis ? `${profile.resolution.height}·${profile.maxFramerate}` : caption}</small>
+          <small>{vis ? `${profile.resolution.height} ${profile.maxFramerate}` : caption}</small>
         </button>
       </Tooltip>;
     })}
diff --git a/src/client/locales/en.ts b/src/client/locales/en.ts
index 8009cf3fa..143675c3c 100644
--- a/src/client/locales/en.ts
+++ b/src/client/locales/en.ts
@@ -354,9 +354,9 @@ export const en: Record<CopyKey, string> = {
   "host.viewerOverview": "All viewer connections",
 
   "host.quality": "Video preset",
-  "host.quality.720p30": "720p\u00a0· 30\u00a0fps",
-  "host.quality.1080p30": "1080p\u00a0· 30\u00a0fps",
-  "host.quality.1080p60": "1080p\u00a0· 60\u00a0fps",
+  "host.quality.720p30": "720p 30\u00a0fps",
+  "host.quality.1080p30": "1080p 30\u00a0fps",
+  "host.quality.1080p60": "1080p 60\u00a0fps",
   "host.advanced": "Sharing settings",
   "host.settings.button": "Settings",
 
diff --git a/src/client/locales/zh.ts b/src/client/locales/zh.ts
index 38a92aa4f..1721e6aa5 100644
--- a/src/client/locales/zh.ts
+++ b/src/client/locales/zh.ts
@@ -354,9 +354,9 @@ export const zh = {
   "host.viewerOverview": "全员连接数据",
 
   "host.quality": "视频预设",
-  "host.quality.720p30": "720p\u00a0· 30\u00a0帧",
-  "host.quality.1080p30": "1080p\u00a0· 30\u00a0帧",
-  "host.quality.1080p60": "1080p\u00a0· 60\u00a0帧",
+  "host.quality.720p30": "720p 30\u00a0帧",
+  "host.quality.1080p30": "1080p 30\u00a0帧",
+  "host.quality.1080p60": "1080p 60\u00a0帧",
   "host.advanced": "分享设置",
   "host.settings.button": "设置",
 
diff --git a/src/client/styles.css b/src/client/styles.css
index 30c391d2c..5c4b76559 100644
--- a/src/client/styles.css
+++ b/src/client/styles.css
@@ -1162,7 +1162,7 @@ html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #334
 .lr-tile:is(:hover, :focus-visible):not(:disabled):not([aria-disabled="true"]):not(.is-selected) { background: var(--wall-2); transform: translateY(-2px); }
 .lr-tile:active:not(:disabled):not([aria-disabled="true"]) { transform: translateY(2px) scale(.97); box-shadow: none; }
 .lr-tile.is-selected { background: var(--ink); color: var(--paper); animation: lr-pop .2s var(--spring); }
-.lr-tiles .lr-tile small { max-width: 100%; font-family: var(--mono); font-size: 11px; letter-spacing: .02em; color: #5d7086; text-wrap: balance; overflow-wrap: anywhere; }
+.lr-tiles .lr-tile small { max-width: 100%; font-family: var(--mono); font-size: 11px; letter-spacing: .02em; color: #5d7086; text-wrap: balance; overflow-wrap: normal; }
 .lr-tiles .lr-tile.is-selected small { color: var(--paper); opacity: .75; }
 
 /* text inputs */

From 0fca145beb06b072d76c6c38e5db7aeca26d0a1e Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Mon, 12 Oct 2026 04:49:53 +0800
Subject: [PATCH 177/262] docs: acknowledge community proposals and capture fix

---
 README.md       | 8 ++++++++
 README.zh-CN.md | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/README.md b/README.md
index 57939608d..13f6103c0 100644
--- a/README.md
+++ b/README.md
@@ -116,6 +116,14 @@ See [ways to contribute](./CONTRIBUTING.md#ways-to-help) or
 [help translate Piik](./docs/guide/translating.md). Use the
 [repository layout](./docs/standards/engineering.md#repository-layout) to find your way around.
 
+## Special thanks
+
+- [@fovepig](https://github.com/fovepig) for proposing higher audio bitrates in [#462](https://github.com/TNTcraftHIM/Piik/pull/462).
+- [@ddddd-ren](https://github.com/ddddd-ren) for proposing 4K sharing in [#469](https://github.com/TNTcraftHIM/Piik/pull/469).
+- [@AkazaAkali](https://github.com/AkazaAkali) for the Linux PipeWire capture fix in [#470](https://github.com/TNTcraftHIM/Piik/pull/470).
+
+Thanks to everyone who reports issues, tests Piik, improves its translations and docs, or contributes code.
+
 ## License
 
 Piik-owned code is [MIT licensed](./LICENSE). Dependencies retain their own
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 781b3e714..bdcebbe74 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -108,6 +108,14 @@ Piik Server 是一个内置网页界面的独立程序。
 [翻译教程](./docs/guide/translating.zh-CN.md)开始，也可以从
 [项目目录说明](./docs/standards/engineering.md#repository-layout)了解代码结构。
 
+## 特别感谢
+
+- [@fovepig](https://github.com/fovepig)：在 [#462](https://github.com/TNTcraftHIM/Piik/pull/462) 提出更高音频码率的方案。
+- [@ddddd-ren](https://github.com/ddddd-ren)：在 [#469](https://github.com/TNTcraftHIM/Piik/pull/469) 提出 4K 分享的方案。
+- [@AkazaAkali](https://github.com/AkazaAkali)：在 [#470](https://github.com/TNTcraftHIM/Piik/pull/470) 提供 Linux PipeWire 采集修复。
+
+也感谢所有反馈问题、参与测试、改进翻译与文档，以及贡献代码的朋友。
+
 ## 许可
 
 Piik 自有代码采用 [MIT 许可](./LICENSE)，依赖保留各自的[许可与声明](./licenses/README.md)。

From de8d56b76b77431337222d3b2fd2fa8135da1aa4 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Mon, 12 Oct 2026 10:29:17 +0800
Subject: [PATCH 178/262] docs: retain contributor credit through commit
 attribution

---
 README.md       | 8 --------
 README.zh-CN.md | 8 --------
 docs/todo.md    | 6 ++++--
 3 files changed, 4 insertions(+), 18 deletions(-)

diff --git a/README.md b/README.md
index 13f6103c0..57939608d 100644
--- a/README.md
+++ b/README.md
@@ -116,14 +116,6 @@ See [ways to contribute](./CONTRIBUTING.md#ways-to-help) or
 [help translate Piik](./docs/guide/translating.md). Use the
 [repository layout](./docs/standards/engineering.md#repository-layout) to find your way around.
 
-## Special thanks
-
-- [@fovepig](https://github.com/fovepig) for proposing higher audio bitrates in [#462](https://github.com/TNTcraftHIM/Piik/pull/462).
-- [@ddddd-ren](https://github.com/ddddd-ren) for proposing 4K sharing in [#469](https://github.com/TNTcraftHIM/Piik/pull/469).
-- [@AkazaAkali](https://github.com/AkazaAkali) for the Linux PipeWire capture fix in [#470](https://github.com/TNTcraftHIM/Piik/pull/470).
-
-Thanks to everyone who reports issues, tests Piik, improves its translations and docs, or contributes code.
-
 ## License
 
 Piik-owned code is [MIT licensed](./LICENSE). Dependencies retain their own
diff --git a/README.zh-CN.md b/README.zh-CN.md
index bdcebbe74..781b3e714 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -108,14 +108,6 @@ Piik Server 是一个内置网页界面的独立程序。
 [翻译教程](./docs/guide/translating.zh-CN.md)开始，也可以从
 [项目目录说明](./docs/standards/engineering.md#repository-layout)了解代码结构。
 
-## 特别感谢
-
-- [@fovepig](https://github.com/fovepig)：在 [#462](https://github.com/TNTcraftHIM/Piik/pull/462) 提出更高音频码率的方案。
-- [@ddddd-ren](https://github.com/ddddd-ren)：在 [#469](https://github.com/TNTcraftHIM/Piik/pull/469) 提出 4K 分享的方案。
-- [@AkazaAkali](https://github.com/AkazaAkali)：在 [#470](https://github.com/TNTcraftHIM/Piik/pull/470) 提供 Linux PipeWire 采集修复。
-
-也感谢所有反馈问题、参与测试、改进翻译与文档，以及贡献代码的朋友。
-
 ## 许可
 
 Piik 自有代码采用 [MIT 许可](./LICENSE)，依赖保留各自的[许可与声明](./licenses/README.md)。
diff --git a/docs/todo.md b/docs/todo.md
index f8300db52..a446047ac 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -22,8 +22,10 @@ Git/PRs own completed history.
 - [ ] **Reconcile open PRs with the final candidate.**
   [#462](https://github.com/TNTcraftHIM/Piik/pull/462)'s 256/320 kbps request and
   [#469](https://github.com/TNTcraftHIM/Piik/pull/469)'s 4K request overlap the
-  numeric-media candidate; neither PR has been merged. Preserve contributor
-  credit, the physical-evidence limits below, and explain the disposition at integration. Keep
+  numeric-media candidate; neither PR has been merged. Credit their authors and
+  #470's author in the final squash's `Co-authored-by` trailers, and verify GitHub
+  attribution after integration. Preserve the physical-evidence limits below
+  and explain the disposition at integration. Keep
   [#459](https://github.com/TNTcraftHIM/Piik/pull/459)'s candidate scope and
   bilingual upgrade instructions aligned with the accepted result.
 - [ ] **Gitee mirror workflow activation.** The production verifier passes with

From 08e13a51414238b422034d5cacc85ac5d61cfb98 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Mon, 12 Oct 2026 11:38:48 +0800
Subject: [PATCH 179/262] docs: reassess Magicsock with optional background App
 transport

---
 docs/research/nat-traversal.md | 20 ++++++++++++++------
 docs/status.md                 | 10 ++++++----
 docs/todo.md                   | 16 +++++++++-------
 3 files changed, 29 insertions(+), 17 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 45f023607..e64b8430b 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -489,12 +489,20 @@ recovery loop or a Browser fork to enable this option.
 
 ### Integration Cost And Recovery Controls
 
-**Current decision: no-go for the 2.0 candidate.** This composition requires
-Native App transport at both ends of the enhanced edge. An App Host with a plain
-Browser Viewer still uses ordinary WebRTC; mixed relaying does not enhance that
-Browser edge. The owner stopped integration and field-package work. Reopen only
-for a concrete Browser-compatible benefit or an explicitly accepted App-only
-scope. The controls established no additional reachable NAT class.
+**Current candidate excludes Magicsock; product integration remains held.**
+This composition requires Native App transport at both ends of the enhanced
+edge. Those participants can still use the existing Browser UI and local media
+bridge; Native transport does not require a separate desktop interface. A
+Browser-only endpoint continues to use ordinary WebRTC.
+
+The background-App proposal is an optional transport helper for the same Web
+workflow. The existing standby and saved Site approval can reduce repeated
+setup, but do not remove first-use authorization, Browser local-network
+permissions, or the integration costs below. Reassess adoption against that
+optional-helper scope, preserving ordinary ICE when the helper is absent or
+unavailable. The controls established no additional reachable NAT class;
+background availability alone is not reachability evidence or acceptance of
+DERP media fallback. Field packaging remains held pending the adoption decision.
 
 The isolated experiment remains at `d67f0d6d` on
 `spike/magicsock-assessment`, outside Piik's production dependency graph.
diff --git a/docs/status.md b/docs/status.md
index 35d2a0bd3..9b37a3de1 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -1,6 +1,6 @@
 # Current Status
 
-Last updated: 2026-10-11
+Last updated: 2026-10-12
 
 This is the compact execution/deployment index. Product modules own behavior,
 [verification status](./verification-status.md) owns unresolved physical limits,
@@ -75,10 +75,12 @@ owns local codec, derived-output, SFU, Browser/Native fanout and live-control
 evidence. Both macOS architectures pass SDK compilation and packaged startup;
 physical geometry verification, cross-device and route-change acceptance remain
 open. Additional codecs are not part of this candidate.
-Magicsock adoption is no-go for this candidate: its App-to-App augmentation does
-not improve the core App-to-Browser use case. The
+Magicsock remains outside the candidate. Its optional background-App scope is
+under reassessment: participants can retain the Web UI, but enhanced edges need
+Native transport at both ends. Easier activation does not establish a reachability
+gain or resolve its integration costs. The
 [assessment](./research/nat-traversal.md#integration-cost-and-recovery-controls)
-owns the retained experiment and product decision. Its package is retired;
+owns the retained experiment and adoption boundary. Its package is retired;
 independent ordinary ICE and media repairs remain in the candidate.
 Publication remains subject to final acceptance.
 The candidate App now waits for approved Sites independently of Local/public
diff --git a/docs/todo.md b/docs/todo.md
index a446047ac..a997df0b4 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -36,14 +36,16 @@ Git/PRs own completed history.
 
 ## Held By Owner
 
-- [ ] **Magicsock adoption: no-go for this candidate.** Its direct-path
-  augmentation requires App transport at both ends and does not improve the
-  core App-to-Browser edge. Stop product integration, combined packaging and
-  Magicsock field-test recruitment. Retain isolated evidence in Git; preserve
-  independently verified ordinary ICE/media repairs. The
+- [ ] **Magicsock adoption: reassess optional background App assistance.**
+  The owner clarified that App standby is intended to support Magicsock while
+  keeping the Web UI. Separate interface choice from transport ownership:
+  enhanced edges still need App transport at both ends; Browser-only endpoints
+  retain ordinary ICE. Product integration, combined packaging and field-test
+  recruitment remain held pending the adoption decision. Retain isolated
+  evidence and independent ordinary ICE/media repairs. The
   [assessment](./research/nat-traversal.md#integration-cost-and-recovery-controls)
-  owns the rationale. Reopen only for a concrete Browser-compatible benefit
-  with acceptable complexity, or a newly accepted App-only product scope.
+  owns measured benefit, datagram/discovery/authorization costs and relay policy;
+  easier activation alone does not resolve those boundaries.
 
 - [ ] **Browser-internal encoder work.** Paused by the owner on 2026-10-01.
   [Comparisons and Chromium traces](./research/browser-local-encoding-pool.md#sustained-h264-recovery)

From 9a6e74cfdfe4576c7bd407bfad80bc7ee1e66a83 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Mon, 12 Oct 2026 12:40:45 +0800
Subject: [PATCH 180/262] fix: preserve STUN survey destination observations

---
 docs/research/nat-traversal.md                | 13 +++-
 docs/todo.md                                  | 21 +++---
 .../app/mediaedge/candidate_gathering_test.go | 68 +++++++++++++++----
 internal/app/mediaedge/ice_socket.go          |  9 +--
 tests/nat-prediction.test.ts                  | 23 +++++++
 5 files changed, 99 insertions(+), 35 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index e64b8430b..743a1e093 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -1,6 +1,6 @@
 # Browser And Native NAT Traversal
 
-Last reviewed: 2026-10-11
+Last reviewed: 2026-10-12
 
 This document owns evidence for improving direct ICE without adding a
 new relay or a custom transport. The current product contract remains standard
@@ -64,6 +64,12 @@ the offer's actual destination list with its candidate batch, so a later config
 update cannot reinterpret an in-flight response. Controlled tests cover
 out-of-order results, an unrelated fourth destination, repeated mappings and
 stalled DNS.
+The Native collector must also retain each destination's observation until that
+eligibility filter. Deduplicating mapped endpoints first let a faster ordinary
+destination hide an equal survey response. The corrected collector preserves
+both identities; the existing predictor still deduplicates eligible mappings,
+so repeated equal mappings cannot establish a three-point pattern. ICE retains
+ownership of actual remote endpoint connectivity.
 This does not identify the public-invitation report's cause, whose configured
 set already contains exactly three destinations.
 
@@ -489,7 +495,7 @@ recovery loop or a Browser fork to enable this option.
 
 ### Integration Cost And Recovery Controls
 
-**Current candidate excludes Magicsock; product integration remains held.**
+**Current candidate excludes Magicsock; optional-helper experiments are reopened.**
 This composition requires Native App transport at both ends of the enhanced
 edge. Those participants can still use the existing Browser UI and local media
 bridge; Native transport does not require a separate desktop interface. A
@@ -502,7 +508,8 @@ permissions, or the integration costs below. Reassess adoption against that
 optional-helper scope, preserving ordinary ICE when the helper is absent or
 unavailable. The controls established no additional reachable NAT class;
 background availability alone is not reachability evidence or acceptance of
-DERP media fallback. Field packaging remains held pending the adoption decision.
+DERP media fallback. Add it to the release candidate only after a matched benefit
+and the integration boundaries below are established.
 
 The isolated experiment remains at `d67f0d6d` on
 `spike/magicsock-assessment`, outside Piik's production dependency graph.
diff --git a/docs/todo.md b/docs/todo.md
index a997df0b4..bfd448497 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -18,7 +18,7 @@ Git/PRs own completed history.
   review before publication. Retain explicit 1.x mismatch checks. Broader device
   coverage below does not override the owner's platform deferrals or require a
   statistical NAT campaign. The retired Magicsock package is not the current
-  candidate; preserve the existing product model and held scope.
+  candidate; preserve the existing product model during the reopened experiments.
 - [ ] **Reconcile open PRs with the final candidate.**
   [#462](https://github.com/TNTcraftHIM/Piik/pull/462)'s 256/320 kbps request and
   [#469](https://github.com/TNTcraftHIM/Piik/pull/469)'s 4K request overlap the
@@ -34,19 +34,20 @@ Git/PRs own completed history.
   access and secret injection. Keep mirror failure visible without blocking
   product CI or Website delivery; do not rebuild an existing release for recovery.
 
-## Held By Owner
-
-- [ ] **Magicsock adoption: reassess optional background App assistance.**
-  The owner clarified that App standby is intended to support Magicsock while
-  keeping the Web UI. Separate interface choice from transport ownership:
-  enhanced edges still need App transport at both ends; Browser-only endpoints
-  retain ordinary ICE. Product integration, combined packaging and field-test
-  recruitment remain held pending the adoption decision. Retain isolated
-  evidence and independent ordinary ICE/media repairs. The
+- [ ] **NAT best effort and optional background App assistance.**
+  The owner authorized renewed Magicsock/alternative experiments with one-time
+  Site approval and subsequent reuse. Keep the Web UI and distinguish it from
+  transport ownership: enhanced edges need App transport at both ends;
+  Browser-only endpoints retain ordinary ICE. Verify the STUN fallback report
+  and correct confirmed discovery/recovery gaps independently. Compare current
+  transports on matched networks before adding a helper to the release candidate.
+  Retain isolated evidence; the
   [assessment](./research/nat-traversal.md#integration-cost-and-recovery-controls)
   owns measured benefit, datagram/discovery/authorization costs and relay policy;
   easier activation alone does not resolve those boundaries.
 
+## Held By Owner
+
 - [ ] **Browser-internal encoder work.** Paused by the owner on 2026-10-01.
   [Comparisons and Chromium traces](./research/browser-local-encoding-pool.md#sustained-h264-recovery)
   own the evidence for synchronous H264 initialization, native adaptation and
diff --git a/internal/app/mediaedge/candidate_gathering_test.go b/internal/app/mediaedge/candidate_gathering_test.go
index cb484af6f..f7a2d9ac2 100644
--- a/internal/app/mediaedge/candidate_gathering_test.go
+++ b/internal/app/mediaedge/candidate_gathering_test.go
@@ -3,6 +3,7 @@ package mediaedge
 import (
 	"context"
 	"net"
+	"strconv"
 	"strings"
 	"sync/atomic"
 	"testing"
@@ -192,21 +193,58 @@ func TestSurveyCandidateIdentitySurvivesResponseOrder(t *testing.T) {
 	}
 }
 
-func TestSurveyDuplicateMappingRemainsOneOrdinaryCandidate(t *testing.T) {
-	engine, err := NewEngine(EngineOptions{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = engine.Close() })
-	socket := testICESocket(t, engine)
-	servers := []webrtc.ICEServer{{URLs: []string{localSurveyServer(t), localSurveyServer(t)}}}
-	var observations []mappedAddress
-	socket.surveySTUN(t.Context(), servers, func(mapped mappedAddress) {
-		observations = append(observations, mapped)
-	})
-	if len(observations) != 1 || observations[0].port != socket.localPort ||
-		(observations[0].serverIndex != 1 && observations[0].serverIndex != 2) {
-		t.Fatalf("duplicate destination mappings became independent evidence: %+v", observations)
+func TestSurveyPreservesDestinationsWithDuplicateMapping(t *testing.T) {
+	for _, test := range []struct {
+		name  string
+		ports [4]int
+	}{{"predictable-survey", [4]int{40000, 40000, 40003, 40006}}, {"one-mapping", [4]int{40000, 40000, 40000, 40000}}} {
+		t.Run(test.name, func(t *testing.T) {
+			engine, err := NewEngine(EngineOptions{})
+			if err != nil {
+				t.Fatal(err)
+			}
+			t.Cleanup(func() { _ = engine.Close() })
+			socket := testICESocket(t, engine)
+			var releaseSurvey atomic.Bool
+			var urls []string
+			want := make(map[string]string)
+			for index, port := range test.ports {
+				listener := bindingServer(t, func(request *stun.Message, sender *net.UDPAddr, listener *net.UDPConn) {
+					// ns2 is an extra ordinary destination. Its response arrives
+					// before the survey group ns1/ns3/ns4, sharing ns1's mapping.
+					if index == 1 || releaseSurvey.Load() {
+						answerBinding(request, sender, listener, port)
+					}
+				})
+				urls = append(urls, "stun:"+listener.String())
+				want["candidate:ns"+strconv.Itoa(index+1)] = strconv.Itoa(port)
+			}
+			candidates := make(chan *webrtc.ICECandidateInit, 5)
+			gathering := newLocalCandidateGathering(socket, []webrtc.ICEServer{{URLs: urls}}, nil,
+				func(candidate *webrtc.ICECandidateInit) { candidates <- candidate })
+			t.Cleanup(gathering.close)
+			gathering.start()
+			gathering.addPion(nil)
+			for {
+				select {
+				case candidate := <-candidates:
+					if candidate == nil {
+						if len(want) != 0 {
+							t.Fatalf("mapping deduplication lost destination observations: %v", want)
+						}
+						return
+					}
+					fields := strings.Fields(candidate.Candidate)
+					if want[fields[0]] != fields[5] || (!releaseSurvey.Load() && fields[0] != "candidate:ns2") {
+						t.Fatalf("unexpected destination observation: %s", candidate.Candidate)
+					}
+					delete(want, fields[0])
+					releaseSurvey.Store(true)
+				case <-time.After(2 * time.Second):
+					t.Fatal("survey did not complete")
+				}
+			}
+		})
 	}
 }
 
diff --git a/internal/app/mediaedge/ice_socket.go b/internal/app/mediaedge/ice_socket.go
index 3730dbe98..c95055785 100644
--- a/internal/app/mediaedge/ice_socket.go
+++ b/internal/app/mediaedge/ice_socket.go
@@ -6,7 +6,6 @@ import (
 	"log/slog"
 	"net"
 	"net/netip"
-	"strconv"
 	"sync"
 	"time"
 
@@ -159,18 +158,14 @@ func (socket *iceSocket) surveySTUN(
 		pending.Wait()
 		close(results)
 	}()
-	seen := map[string]struct{}{}
 	for {
 		select {
 		case value, ok := <-results:
 			if !ok {
 				return
 			}
-			key := value.address + ":" + strconv.Itoa(value.port)
-			if _, found := seen[key]; found {
-				continue
-			}
-			seen[key] = struct{}{}
+			// The consumer selects survey destinations before deduplicating
+			// mappings. An ordinary response must not hide a survey observation.
 			emit(value)
 		case <-surveyContext.Done():
 			return
diff --git a/tests/nat-prediction.test.ts b/tests/nat-prediction.test.ts
index bc27bc27c..ba8bab54f 100644
--- a/tests/nat-prediction.test.ts
+++ b/tests/nat-prediction.test.ts
@@ -66,6 +66,29 @@ describe("NAT prediction ICE adapter", () => {
     expect(eligible(hostCandidate())).toBe(false);
   });
 
+  it.each([
+    { surveyPorts: [40_000, 40_003, 40_006], predictions: MAX_NAT_PREDICTION_CANDIDATES },
+    { surveyPorts: [40_000, 40_000, 40_000], predictions: 0 },
+  ])("retains survey identity before mapping deduplication: $surveyPorts", ({ surveyPorts, predictions }) => {
+    const iceServers = [{ urls: ["stun:share.example.test:3478", "stun:other.example.test:3478"] }];
+    const auxiliary = ["stun:share.example.test:3479", "stun:share.example.test:3480"];
+    const send = vi.fn<(candidate: SignalCandidate) => void>();
+    const batch = new NatPredictionCandidateBatch(send);
+    // A faster ordinary destination shares the first survey mapping. All
+    // destinations reach ICE, but only the actual survey can prove a pattern.
+    const observations = [[2, 40_000], [1, surveyPorts[0]], [3, surveyPorts[1]], [4, surveyPorts[2]]];
+    for (const [index, port] of observations) {
+      const observation = candidate(port!)!;
+      observation.candidate = observation.candidate.replace("candidate:base", `candidate:ns${index}`);
+      batch.add(observation, isNativeNatSurveyCandidate(observation, iceServers, auxiliary));
+    }
+    batch.complete();
+    const emitted = send.mock.calls.map(([value]) => value);
+    expect(emitted.filter(value => /^candidate:ns/.test(value?.candidate ?? ""))).toHaveLength(4);
+    expect(emitted.filter(value => /^candidate:s[pm]/.test(value?.candidate ?? ""))).toHaveLength(predictions);
+    expect(emitted.at(-1)).toBeNull();
+  });
+
   it("keeps unexpected ordinary-candidate failures visible", async () => {
     const error = new Error("candidate rejected");
     const connection = {

From 848554e9dad72460796e2c3232a7a5fa31ddd705 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Mon, 12 Oct 2026 13:06:17 +0800
Subject: [PATCH 181/262] docs: record candidate acceptance and transport
 comparison

---
 docs/research/nat-traversal.md | 38 ++++++++++++++++++++++++++++++----
 docs/status.md                 | 14 ++++++++-----
 docs/todo.md                   | 29 +++++++++++---------------
 3 files changed, 55 insertions(+), 26 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 743a1e093..b286ebebf 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -495,7 +495,7 @@ recovery loop or a Browser fork to enable this option.
 
 ### Integration Cost And Recovery Controls
 
-**Current candidate excludes Magicsock; optional-helper experiments are reopened.**
+**Current candidate excludes Magicsock; optional-helper adoption needs a matched gain.**
 This composition requires Native App transport at both ends of the enhanced
 edge. Those participants can still use the existing Browser UI and local media
 bridge; Native transport does not require a separate desktop interface. A
@@ -511,13 +511,43 @@ background availability alone is not reachability evidence or acceptance of
 DERP media fallback. Add it to the release candidate only after a matched benefit
 and the integration boundaries below are established.
 
-The isolated experiment remains at `d67f0d6d` on
+The isolated experiment remains at `cc6f9d0d` on
 `spike/magicsock-assessment`, outside Piik's production dependency graph.
-`git show d67f0d6d:scripts/tailcat-probe/README.md` retrieves its commands,
-fixture boundaries and opt-in dependency patches. The complete experimental
+The `scripts/magicsock-probe/README.md` and `scripts/tailcat-probe/README.md`
+files at that commit own rerun commands, fixture boundaries and opt-in
+dependency patches. The complete earlier experimental
 observations remain in `git show 82e3f253:docs/research/nat-traversal.md`.
 Its internal package is retired, not a current 2.0 test deliverable.
 
+#### Current Stable Direct-Transport Control
+
+On October 12, 2026, the isolated raw-Bind module was refreshed to
+[Tailscale v1.104.1](https://github.com/tailscale/tailscale/releases/tag/v1.104.1)
+and the candidate's Pion WebRTC v4.2.23 / ICE v4.4.7. The seven virtual-router
+pairs, with relay disabled, produced the same results with four- and
+twenty-second direct observation windows. Both stacks had the
+same result in both stacks: cone/cone, restricted/restricted and cone/hard in
+either direction connected; restricted/hard in either direction and hard/hard
+did not. These are stock-stack mechanism controls, not Piik's complete gateway
+mapping/prediction composition or physical success-rate measurements.
+
+Warmed Magicsock carried ICE/DTLS and audio/video SRTP, including two observed
+address changes without new SDP. But losing the first discovery packet in each
+direction during cold startup exhausted inner ICE after about 1.7 seconds;
+three repeats confirmed the failure. Stock Pion under the equivalent initial
+discovery loss connected in about 0.6 seconds. Extending only the fixture's ICE
+check budget let the nested composition connect after about 5.3 seconds. This
+identifies a composition cost, not an accepted timeout increase or universal
+claim that Magicsock is slower.
+
+Raw Bind also consumed bare inner STUN, requiring a test-only packet prefix.
+After peer removal it could still deliver UDP without peer identity; raw
+reception is not authentication. A product adapter would need supported
+framing and existing room/cryptographic authorization, not just another socket.
+The refreshed full probe suite and longer-window matrix passed, including
+controls that expect connection failure. They do not establish a new reason
+to include Magicsock in this candidate.
+
 #### Reachability And Cost
 
 The October 5-10, 2026 controls used
diff --git a/docs/status.md b/docs/status.md
index 9b37a3de1..6e7dbdd2c 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -75,14 +75,18 @@ owns local codec, derived-output, SFU, Browser/Native fanout and live-control
 evidence. Both macOS architectures pass SDK compilation and packaged startup;
 physical geometry verification, cross-device and route-change acceptance remain
 open. Additional codecs are not part of this candidate.
-Magicsock remains outside the candidate. Its optional background-App scope is
-under reassessment: participants can retain the Web UI, but enhanced edges need
-Native transport at both ends. Easier activation does not establish a reachability
-gain or resolve its integration costs. The
+Magicsock remains outside the candidate. Refreshed stable-version controls found
+no additional direct reachability and retained discovery/inner-ICE timing costs.
+Participants can retain the Web UI, but enhanced edges need Native transport at
+both ends. Easier activation does not establish a reachability gain or resolve
+its integration costs. The
 [assessment](./research/nat-traversal.md#integration-cost-and-recovery-controls)
 owns the retained experiment and adoption boundary. Its package is retired;
 independent ordinary ICE and media repairs remain in the candidate.
-Publication remains subject to final acceptance.
+The original candidate packages pass their identity/checksum checks; Windows
+Local startup/retirement, saved Site approval/revocation and explicit 1.x
+rejection have packaged acceptance evidence. Publication remains subject to
+the owner's final acceptance.
 The candidate App now waits for approved Sites independently of Local/public
 room startup. Its two-choice launcher retains one exact Site approval and
 revocation, using the existing loopback and native-session owners.
diff --git a/docs/todo.md b/docs/todo.md
index bfd448497..cb13b234a 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -13,12 +13,13 @@ Git/PRs own completed history.
 - [ ] **2.0 candidate preparation and acceptance.** The owner reopened investigation,
   useful improvements and outstanding acceptance on 2026-10-07, and on 2026-10-09
   chose to hold the maintenance changes for 2.0 rather than publish them separately.
-  Complete the remaining packaged Windows App/Browser lifecycle acceptance,
-  then present the frozen candidate and its bilingual release notes for owner
-  review before publication. Retain explicit 1.x mismatch checks. Broader device
-  coverage below does not override the owner's platform deferrals or require a
+  Present the frozen candidate and its bilingual release notes for owner review
+  before publication. Packaged Windows Local startup/retirement, saved Site
+  approval/revocation and both directions of 1.x compatibility rejection have
+  passed. Broader device coverage below does not override the owner's platform
+  deferrals or require a
   statistical NAT campaign. The retired Magicsock package is not the current
-  candidate; preserve the existing product model during the reopened experiments.
+  candidate; preserve the existing product model in independent transport experiments.
 - [ ] **Reconcile open PRs with the final candidate.**
   [#462](https://github.com/TNTcraftHIM/Piik/pull/462)'s 256/320 kbps request and
   [#469](https://github.com/TNTcraftHIM/Piik/pull/469)'s 4K request overlap the
@@ -34,18 +35,6 @@ Git/PRs own completed history.
   access and secret injection. Keep mirror failure visible without blocking
   product CI or Website delivery; do not rebuild an existing release for recovery.
 
-- [ ] **NAT best effort and optional background App assistance.**
-  The owner authorized renewed Magicsock/alternative experiments with one-time
-  Site approval and subsequent reuse. Keep the Web UI and distinguish it from
-  transport ownership: enhanced edges need App transport at both ends;
-  Browser-only endpoints retain ordinary ICE. Verify the STUN fallback report
-  and correct confirmed discovery/recovery gaps independently. Compare current
-  transports on matched networks before adding a helper to the release candidate.
-  Retain isolated evidence; the
-  [assessment](./research/nat-traversal.md#integration-cost-and-recovery-controls)
-  owns measured benefit, datagram/discovery/authorization costs and relay policy;
-  easier activation alone does not resolve those boundaries.
-
 ## Held By Owner
 
 - [ ] **Browser-internal encoder work.** Paused by the owner on 2026-10-01.
@@ -196,6 +185,12 @@ to connection generations without raw endpoints. Verify survey responses and
 P2P/SFU handoffs, including background direct attempts behind working SFU media.
 The [iroh/Tailscale comparison](./research/nat-traversal.md#iroh-and-tailscale-comparison)
 records the isolated Go media/migration experiment and Browser/relay limits.
+The reopened optional background-App assessment includes current stable
+Magicsock/Pion controls; no additional direct reachability was established.
+Keep Magicsock outside the candidate. A future matched difficult-network
+comparison may reopen adoption, subject to the recorded discovery, datagram,
+authorization and relay-policy boundaries. Saved Site approval alone is not
+evidence for a transport benefit.
 Prioritize one-App-to-Browser and Browser-to-Browser controls using existing
 ICE, IPv6 and gateway mapping, with changing interfaces, lost mappings and
 asymmetric network restrictions. The

From 2d57c76dd9bab3505f0c649b29ce5d1ade171f93 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Mon, 12 Oct 2026 13:07:06 +0800
Subject: [PATCH 182/262] docs: clarify the direct transport comparison

---
 docs/research/nat-traversal.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index b286ebebf..083fc7de9 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -525,10 +525,10 @@ On October 12, 2026, the isolated raw-Bind module was refreshed to
 [Tailscale v1.104.1](https://github.com/tailscale/tailscale/releases/tag/v1.104.1)
 and the candidate's Pion WebRTC v4.2.23 / ICE v4.4.7. The seven virtual-router
 pairs, with relay disabled, produced the same results with four- and
-twenty-second direct observation windows. Both stacks had the
-same result in both stacks: cone/cone, restricted/restricted and cone/hard in
-either direction connected; restricted/hard in either direction and hard/hard
-did not. These are stock-stack mechanism controls, not Piik's complete gateway
+twenty-second direct observation windows. In both stacks, cone/cone,
+restricted/restricted and cone/hard in either direction connected;
+restricted/hard in either direction and hard/hard did not. These are
+stock-stack mechanism controls, not Piik's complete gateway
 mapping/prediction composition or physical success-rate measurements.
 
 Warmed Magicsock carried ICE/DTLS and audio/video SRTP, including two observed

From 2fa87c21958a8c2fa950ee1084b7c25e4f0a4f57 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Mon, 12 Oct 2026 15:57:35 +0800
Subject: [PATCH 183/262] docs: scope coordinated native hole-punching trials

---
 docs/research/nat-traversal.md | 40 ++++++++++++++++++++++++++++++++++
 docs/todo.md                   | 10 +++++++++
 2 files changed, 50 insertions(+)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 083fc7de9..000de6a92 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -386,6 +386,46 @@ No new transport or universal success-rate claim is accepted by this review.
 The [retired Go experiment](#integration-cost-and-recovery-controls) establishes
 reuse feasibility and its cost, not a Browser-compatible reachability gain.
 
+### Coordinated Native Punching Assessment
+
+The October 12, 2026 scope includes optional Native transport at both ends when
+it provides a measured gain. Background App availability makes this usable;
+ordinary Browser peers must retain their existing connection path.
+
+The current adapter already predicts on both ends of an eligible edge, but each
+end independently supplies at most eight adjacent candidates from one media
+socket. It does not coordinate probing order or open a pool of local sockets.
+Completing the ordinary-ICE and Magicsock controls therefore does not establish
+the limit of coordinated Native hole punching.
+
+Mature implementations provide a concrete comparison:
+
+- [frp's strategy table](https://github.com/fatedier/frp/blob/2542d11a6201c0f2bbe3b1d93031fc1e83201056/pkg/nathole/analysis.go)
+  separates predictable-port, role/timing and probabilistic strategies. One
+  strategy pairs 256 local listeners with 1,000 remote port guesses. Those are
+  upstream operating budgets, not accepted Piik defaults or a success guarantee.
+- [EasyTier's Native implementation](https://github.com/EasyTier/EasyTier/blob/1649ec00135e12103e05bf543e0ed313d7e190f8/easytier-core/src/connectivity/hole_punch/udp/client.rs)
+  uses socket arrays and coordinated peer requests, with separate predictable
+  and random-port paths. Its implementation is evidence that these are real
+  mechanisms, not evidence that replacing Piik's media stack improves coverage.
+
+The next comparison should isolate ordered bilateral prediction from bounded
+multi-socket probing, against both stock ICE and Piik's existing predictor.
+Keep the same NAT/filtering, deadline, loss and relay policy; include both peer
+directions, unrelated mapping traffic, random allocation and blocked UDP.
+Measure authenticated bidirectional media, time to first picture and resource
+cost. A contacted socket alone is not a successful WebRTC connection.
+
+A future adapter should feed the existing connection's ICE owner, preserving
+ordinary candidate timing, instead of adding another media tunnel or route
+controller. Socket adoption through supported Pion APIs is an open integration
+question. Scope any extra work to the authorized peer and connection generation,
+bound sockets/packets/time, and retire losers on success, cancellation or
+revocation. Mapping observations must not become persistent NAT labels or skip
+ordinary paths. Random-port overlap assumptions do not establish a solution for
+two independently random endpoint-dependent NATs or a network that blocks UDP.
+No new product transport, probing budget or success-rate claim is accepted here.
+
 ### Browser-Compatible Follow-Up
 
 The product target remains App-to-Browser and Browser-to-Browser sharing without
diff --git a/docs/todo.md b/docs/todo.md
index cb13b234a..6580f84fc 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -176,6 +176,16 @@ experiments and their limits.
 
 ## Next: P2P Connection And Feedback Evidence
 
+- [ ] **Coordinated Native prediction and bounded multi-socket comparison.**
+  Evaluate the optional two-App scope against stock ICE and Piik's current
+  single-socket predictor, following the
+  [assessment](./research/nat-traversal.md#coordinated-native-punching-assessment).
+  Separate predictable-port coordination from probabilistic port overlap;
+  compare equal time/resource budgets and verify authenticated media, cancellation
+  and ordinary-path independence. Reuse mature mechanisms where supported;
+  do not adopt a new tunnel or assume another project's success rate. Current
+  Magicsock controls do not close this separate question.
+
 For the transport assessment, measure connection success, time to first picture and
 failure causes on representative networks, especially App and P2P-only sites.
 Use existing Debug provenance and selected-path events under the

From 9d7973d41ebfbde5923a5d4d2ff36e3b4ee2f614 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Mon, 12 Oct 2026 16:35:56 +0800
Subject: [PATCH 184/262] docs: record coordinated native punching evidence and
 limits

---
 docs/research/nat-traversal.md | 44 ++++++++++++++++++++++++++++------
 docs/todo.md                   | 18 +++++++-------
 2 files changed, 47 insertions(+), 15 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 000de6a92..10b3ba8af 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -409,17 +409,47 @@ Mature implementations provide a concrete comparison:
   and random-port paths. Its implementation is evidence that these are real
   mechanisms, not evidence that replacing Piik's media stack improves coverage.
 
-The next comparison should isolate ordered bilateral prediction from bounded
-multi-socket probing, against both stock ICE and Piik's existing predictor.
-Keep the same NAT/filtering, deadline, loss and relay policy; include both peer
-directions, unrelated mapping traffic, random allocation and blocked UDP.
-Measure authenticated bidirectional media, time to first picture and resource
-cost. A contacted socket alone is not a successful WebRTC connection.
+An isolated Go prototype now compares ordinary ICE, the current eight-candidate
+prediction policy, an ordered first tuple, a coordinated eight-socket pool and
+ordinary ICE over eight preallocated sockets. The pool authenticates generation-
+specific STUN transactions, closes its losing sockets and passes its actual
+winning socket to stock Pion WebRTC. Success requires bidirectional SRTP payload
+delivery and reverse RTCP feedback. All strategies share a four-second overall
+deadline; no relay, OS socket or external network is used in these controls.
+The retained implementation is commit `807c7390` on
+`spike/magicsock-assessment`, under `scripts/magicsock-probe/native_punch.go`
+and its tests; it is not part of the product module.
+
+In Pion's sequential endpoint-dependent NAT fixture, coordinated first sends
+connect the otherwise timing-sensitive bilateral tuple. Three unrelated mappings
+after observation defeat that simple first-tuple guess; the pool still connects.
+The current candidate policy can also occasionally win through favorable check
+scheduling. This is evidence for more deliberate coordination, not a newly proven
+unreachable NAT class or a public success-rate claim. Merely preallocating sockets
+does not establish the same benefit. Six unrelated mappings and blocked peer UDP
+defeat this pool's bounded prediction.
+
+The pool uses eight sockets, at most 64 requests plus 64 authenticated replies,
+one predicted remote endpoint, approximately 200 ms of overlapping sends and a
+500 ms cleanup deadline. Cancellation, allocation failure, wrong-generation
+credentials, first-packet loss and winner adoption have explicit controls.
+100 ms of peer-start skew succeeds in the fixture; 350 ms exceeds its overlap
+and fails cleanly. These are experimental budgets, not product defaults.
+
+The policy comparator follows the current TS emission order, but surveys run
+sequentially before ICE; production surveys run concurrently while candidates
+trickle. The payload is synthetic RTP, not a decoded picture. Random allocation,
+real signaling delay, first-picture latency, Browser interoperation and actual
+Piik operation retirement still need acceptance before product adoption.
 
 A future adapter should feed the existing connection's ICE owner, preserving
 ordinary candidate timing, instead of adding another media tunnel or route
 controller. Socket adoption through supported Pion APIs is an open integration
-question. Scope any extra work to the authorized peer and connection generation,
+question: Pion's WebRTC API does not expose ICE's `AddVirtualCandidate`, and
+`MultiUDPMux` starts ordinary checks on its preallocated sockets without providing
+coordinated ordering or loser removal. Delaying ordinary ICE to reproduce the
+fixture's barrier is not an accepted integration. Scope any extra work to the
+authorized peer and connection generation,
 bound sockets/packets/time, and retire losers on success, cancellation or
 revocation. Mapping observations must not become persistent NAT labels or skip
 ordinary paths. Random-port overlap assumptions do not establish a solution for
diff --git a/docs/todo.md b/docs/todo.md
index 6580f84fc..023cca3ec 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -176,15 +176,17 @@ experiments and their limits.
 
 ## Next: P2P Connection And Feedback Evidence
 
-- [ ] **Coordinated Native prediction and bounded multi-socket comparison.**
-  Evaluate the optional two-App scope against stock ICE and Piik's current
-  single-socket predictor, following the
+- [ ] **Coordinated Native socket adoption without delaying ordinary ICE.**
+  The isolated eight-socket Go experiment now carries bidirectional authenticated
+  SRTP and feedback under bounded sequential-NAT interference. Complete the
+  optional two-App integration assessment against Piik's actual trickle timing,
+  following the
   [assessment](./research/nat-traversal.md#coordinated-native-punching-assessment).
-  Separate predictable-port coordination from probabilistic port overlap;
-  compare equal time/resource budgets and verify authenticated media, cancellation
-  and ordinary-path independence. Reuse mature mechanisms where supported;
-  do not adopt a new tunnel or assume another project's success rate. Current
-  Magicsock controls do not close this separate question.
+  Pion's WebRTC API has no late-socket adoption surface; do not replace that
+  boundary with a second route/retry owner or stall ordinary Browser peers.
+  Verify real signaling skew, decoded media, generation retirement and field
+  benefit before admission. Random-port overlap remains separate and unproven;
+  keep this prototype outside the candidate while integration is unresolved.
 
 For the transport assessment, measure connection success, time to first picture and
 failure causes on representative networks, especially App and P2P-only sites.

From 45f36976f67b7a31c405b1719fe754bc5ebad845 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Mon, 12 Oct 2026 17:31:19 +0800
Subject: [PATCH 185/262] feat(app): coordinate bounded native UDP connection
 retries

---
 docs/adr/0009-optional-nat-prediction.md     |  19 +-
 docs/research/nat-traversal.md               |  35 ++-
 docs/standards/routing-transport.md          |   5 +
 docs/status.md                               |   5 +
 docs/todo.md                                 |  17 +-
 internal/app/mediaedge/edge.go               |  17 +-
 internal/app/mediaedge/engine.go             |   2 +
 internal/app/mediaedge/ice_socket.go         |  21 ++
 internal/app/mediaedge/punch.go              | 278 +++++++++++++++++++
 internal/app/mediaedge/punch_fixture_test.go |  92 ++++++
 internal/app/mediaedge/punch_sockets.go      | 129 +++++++++
 internal/app/mediaedge/punch_test.go         | 273 ++++++++++++++++++
 internal/app/mediaedge/receiver.go           |  20 +-
 internal/app/mediaedge/source.go             |   1 +
 internal/app/nativecontrol/punch.go          | 109 ++++++++
 internal/app/nativecontrol/session.go        |  10 +-
 internal/app/nativecontrol/wire.go           |   2 +
 internal/app/nativehost/punch.go             |  24 ++
 internal/app/nativehost/session.go           |   8 +-
 internal/app/nativeviewer/punch.go           |  31 +++
 internal/app/nativeviewer/session.go         |  26 +-
 internal/app/nativeviewer/session_test.go    |  14 +-
 internal/server/protocol/punch.go            |  65 +++++
 internal/server/protocol/punch_test.go       |  47 ++++
 internal/server/protocol/types.go            |  36 ++-
 internal/server/signal/punch_test.go         |  66 +++++
 internal/server/signal/router.go             |  29 +-
 internal/server/signal/server.go             |   6 +
 src/client/native/client.ts                  |  27 +-
 src/client/native/media-ingress.ts           |   1 +
 src/client/native/native-punch.ts            | 151 ++++++++++
 src/client/native/native-sender-edge.ts      |  24 +-
 src/client/native/native-sender-peer.ts      |   2 +
 src/client/native/native-viewer-peer.ts      |  65 ++++-
 src/client/native/wire.ts                    |  10 +-
 src/client/pages/HostPage.tsx                |   3 +-
 src/client/pages/ViewerPage.tsx              |   1 +
 src/client/webrtc/host-peer.ts               |   2 +-
 src/client/webrtc/viewer-peer.ts             |   6 +
 src/shared/protocol.ts                       |  17 ++
 tests/native-punch.test.ts                   | 106 +++++++
 tests/native-sender-edge.test.ts             |  22 +-
 tests/native-sender-peer.test.ts             |   6 +
 tests/native-viewer-peer.test.ts             |  46 +++
 44 files changed, 1810 insertions(+), 66 deletions(-)
 create mode 100644 internal/app/mediaedge/punch.go
 create mode 100644 internal/app/mediaedge/punch_fixture_test.go
 create mode 100644 internal/app/mediaedge/punch_sockets.go
 create mode 100644 internal/app/mediaedge/punch_test.go
 create mode 100644 internal/app/nativecontrol/punch.go
 create mode 100644 internal/app/nativehost/punch.go
 create mode 100644 internal/app/nativeviewer/punch.go
 create mode 100644 internal/server/protocol/punch.go
 create mode 100644 internal/server/protocol/punch_test.go
 create mode 100644 internal/server/signal/punch_test.go
 create mode 100644 src/client/native/native-punch.ts
 create mode 100644 tests/native-punch.test.ts

diff --git a/docs/adr/0009-optional-nat-prediction.md b/docs/adr/0009-optional-nat-prediction.md
index 81b61f75a..98d87920f 100644
--- a/docs/adr/0009-optional-nat-prediction.md
+++ b/docs/adr/0009-optional-nat-prediction.md
@@ -67,6 +67,21 @@ connection acquisition reuses the route controller's existing opportunity ledger
    recovery follows the normal route-failed path. A prepared candidate remains owned by the route
    operation and is reported failed to that operation instead of starting a
    separate ICE-restart loop.
+6. In the 2.0 candidate, a server-issued retry (never the first attempt) may
+   prepare an authenticated Native socket at both ends before creating its one
+   PeerConnection. It reuses the current peer/session/connection authorization
+   and the same share switch; Browser peers decline immediately. Each Engine
+   permits one preparation: an ordered three-destination observation, then at
+   most eight temporary sockets aimed at one bounded sequential-port estimate,
+   with at most 64 requests and 64 authenticated replies. The observation socket
+   closes before those sockets open. The page waits at most 3.5 seconds; the App
+   expires unconsumed work after five seconds. Mutual success and the existing
+   SDP offer commit one proved socket and peer tuple to Pion. Other sockets and
+   workers retire before reuse. Missing observations or unsuccessful preparation
+   resume ordinary ICE within that same route operation; a lost commit fails
+   only that operation. No route deadline, copy capacity or media protocol is
+   replaced. This is a bounded Native extension, not a Magicsock tunnel or a
+   mechanism for random-port NATs or blocked UDP.
 
 ## Consequences
 
@@ -74,8 +89,8 @@ Positive:
 
 - Sites with their own listeners and self-contained public-link Apps can use
   the same bounded mechanism while pure Browser/LAN operation stays unchanged;
-- normal ICE remains immediately available, so an unavailable auxiliary STUN
-  listener or unsuccessful prediction cannot delay direct or SFU fallback;
+- the first ordinary ICE attempt remains immediately available; optional Native
+  preparation occupies only part of an existing retry's unchanged deadline;
 - prediction is bounded to one connection generation and one small candidate
   set; and
 - selected-foundation attribution can validate actual field benefit without
diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 10b3ba8af..709a1d67e 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -392,7 +392,7 @@ The October 12, 2026 scope includes optional Native transport at both ends when
 it provides a measured gain. Background App availability makes this usable;
 ordinary Browser peers must retain their existing connection path.
 
-The current adapter already predicts on both ends of an eligible edge, but each
+The ordinary adapter already predicts on both ends of an eligible edge, but each
 end independently supplies at most eight adjacent candidates from one media
 socket. It does not coordinate probing order or open a pool of local sockets.
 Completing the ordinary-ICE and Magicsock controls therefore does not establish
@@ -442,19 +442,26 @@ trickle. The payload is synthetic RTP, not a decoded picture. Random allocation,
 real signaling delay, first-picture latency, Browser interoperation and actual
 Piik operation retirement still need acceptance before product adoption.
 
-A future adapter should feed the existing connection's ICE owner, preserving
-ordinary candidate timing, instead of adding another media tunnel or route
-controller. Socket adoption through supported Pion APIs is an open integration
-question: Pion's WebRTC API does not expose ICE's `AddVirtualCandidate`, and
-`MultiUDPMux` starts ordinary checks on its preallocated sockets without providing
-coordinated ordering or loser removal. Delaying ordinary ICE to reproduce the
-fixture's barrier is not an accepted integration. Scope any extra work to the
-authorized peer and connection generation,
-bound sockets/packets/time, and retire losers on success, cancellation or
-revocation. Mapping observations must not become persistent NAT labels or skip
-ordinary paths. Random-port overlap assumptions do not establish a solution for
-two independently random endpoint-dependent NATs or a network that blocks UDP.
-No new product transport, probing budget or success-rate claim is accepted here.
+The 2.0 candidate now adopts the winning socket before constructing Pion, only
+on an existing server-issued retry. Pion's WebRTC API does not expose ICE's
+`AddVirtualCandidate`; this avoids a private late-socket API, a second route
+owner and a delay to the first ordinary attempt. Browser peers decline this
+Native preparation and continue ordinary ICE. The authorized phases and resource
+bounds are owned by [ADR-0009](../adr/0009-optional-nat-prediction.md).
+
+The production Engine's virtual-network regression carries VP8 SRTP into its
+actual Receiver and returns SRTCP key-frame feedback after socket transfer,
+including 250 ms of peer-start skew. It retains the proved remote tuple rather
+than replacing it with a later, destination-dependent STUN mapping. Other
+controls cover early/late cancellation, source/Engine retirement, premature
+commit, resource limits, stale signaling and Browser decline. These establish
+bounded composition, not a physical difficult-network success-rate improvement.
+The candidate's send window is 800 ms within a 1.1-second hard bound; the earlier
+isolated experiment's shorter window is not its product timing.
+
+Real signaling, decoded-picture acceptance and cross-device checks remain part
+of candidate acceptance. Random-port overlap assumptions do not establish a
+solution for two independently random endpoint-dependent NATs or blocked UDP.
 
 ### Browser-Compatible Follow-Up
 
diff --git a/docs/standards/routing-transport.md b/docs/standards/routing-transport.md
index 87dccb742..7e6b50c4f 100644
--- a/docs/standards/routing-transport.md
+++ b/docs/standards/routing-transport.md
@@ -54,6 +54,11 @@ share generation:
   attempts show retry 1/3, 2/3 and 3/3 on pages supporting that progress format.
   Retries use the same serial controller and normal operation deadlines;
   waiting Viewers and untried parents receive their opportunities first.
+  A retry may use bounded two-App socket preparation under ADR-0009 before its
+  one Pion connection. The first attempt and Browser-only transport stay ordinary;
+  failed optional preparation cannot disable the App for the session. Socket
+  ownership transfers only after mutual success; cancellation joins workers
+  before freeing their slot.
   It is not a participant capability, route score, or SFU preference. Candidate
   generation and selected-pair diagnostics retain only
   `ordinary | predicted | unknown` provenance.
diff --git a/docs/status.md b/docs/status.md
index 6e7dbdd2c..af46db64a 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -83,6 +83,11 @@ its integration costs. The
 [assessment](./research/nat-traversal.md#integration-cost-and-recovery-controls)
 owns the retained experiment and adoption boundary. Its package is retired;
 independent ordinary ICE and media repairs remain in the candidate.
+An independent bounded Native UDP preparation now augments existing retries
+under ADR-0009. Production Engine checks cover socket adoption, video and reverse
+feedback in a sequential-NAT fixture. It is awaiting complete candidate
+acceptance and the owner's field beta; it does not establish a public success
+rate or remove Browser-only operation.
 The original candidate packages pass their identity/checksum checks; Windows
 Local startup/retirement, saved Site approval/revocation and explicit 1.x
 rejection have packaged acceptance evidence. Publication remains subject to
diff --git a/docs/todo.md b/docs/todo.md
index 023cca3ec..d6de7927d 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -176,17 +176,16 @@ experiments and their limits.
 
 ## Next: P2P Connection And Feedback Evidence
 
-- [ ] **Coordinated Native socket adoption without delaying ordinary ICE.**
-  The isolated eight-socket Go experiment now carries bidirectional authenticated
-  SRTP and feedback under bounded sequential-NAT interference. Complete the
-  optional two-App integration assessment against Piik's actual trickle timing,
+- [ ] **Coordinated Native retry acceptance.**
+  The optional two-App preparation is integrated into the existing retry owner;
+  production Engine virtual-network checks carry media and reverse feedback.
+  Complete candidate signaling, decoded-picture and retirement acceptance,
   following the
   [assessment](./research/nat-traversal.md#coordinated-native-punching-assessment).
-  Pion's WebRTC API has no late-socket adoption surface; do not replace that
-  boundary with a second route/retry owner or stall ordinary Browser peers.
-  Verify real signaling skew, decoded media, generation retirement and field
-  benefit before admission. Random-port overlap remains separate and unproven;
-  keep this prototype outside the candidate while integration is unresolved.
+  Preserve the first ordinary attempt, immediate Browser decline and fixed
+  operation deadlines. The owner will arrange a small difficult-network beta
+  after packaging; compare the same peers with the share's enhancement switch
+  enabled/disabled. Random-port overlap remains separate and unproven.
 
 For the transport assessment, measure connection success, time to first picture and
 failure causes on representative networks, especially App and P2P-only sites.
diff --git a/internal/app/mediaedge/edge.go b/internal/app/mediaedge/edge.go
index 38bfa51b9..657c452b8 100644
--- a/internal/app/mediaedge/edge.go
+++ b/internal/app/mediaedge/edge.go
@@ -29,6 +29,7 @@ type EdgeOptions struct {
 	ICEServers   []webrtc.ICEServer
 	Audio        *AudioSource
 	Local        bool
+	Punched      bool
 	Events       EdgeEvents
 }
 
@@ -74,7 +75,18 @@ func (engine *Engine) NewEdge(source *Source, options EdgeOptions) (_ *Edge, err
 			return nil, err
 		}
 	}
-	socket, err := engine.newICESocket(options.ICEServers, !options.Local)
+	var socket *iceSocket
+	if options.Punched && !options.Local {
+		connection := engine.TakePunchedSocket(options.ConnectionID, source)
+		if connection == nil {
+			err = errors.New("prepared connection is unavailable")
+		} else {
+			socket, err = engine.adoptICESocket(connection, options.ICEServers, true)
+		}
+	} else {
+		engine.ClosePunch(options.ConnectionID)
+		socket, err = engine.newICESocket(options.ICEServers, !options.Local)
+	}
 	if err != nil {
 		source.releaseReservation(options.Local)
 		if options.Audio != nil {
@@ -313,6 +325,9 @@ func (edge *Edge) SetAnswer(answer webrtc.SessionDescription, offerID string) er
 	if err := edge.connection.SetRemoteDescription(answer); err != nil {
 		return err
 	}
+	if err := edge.socket.addPunchedPeer(edge.connection); err != nil {
+		return err
+	}
 	edge.mu.Lock()
 	edge.remoteDescriptionSet = true
 	pending := edge.pendingCandidates
diff --git a/internal/app/mediaedge/engine.go b/internal/app/mediaedge/engine.go
index 1e93d988f..b71d3cfd8 100644
--- a/internal/app/mediaedge/engine.go
+++ b/internal/app/mediaedge/engine.go
@@ -67,6 +67,7 @@ type Engine struct {
 	publications map[*Publication]struct{}
 	sockets      map[*iceSocket]struct{}
 	closed       bool
+	punch        *PunchPreparation
 }
 
 func NewEngine(options EngineOptions) (*Engine, error) {
@@ -229,6 +230,7 @@ func (engine *Engine) Close() error {
 		sockets = append(sockets, socket)
 	}
 	engine.mu.Unlock()
+	engine.ClosePunch("")
 	closeEdges(edges)
 	for _, publication := range publications {
 		_ = publication.Close()
diff --git a/internal/app/mediaedge/ice_socket.go b/internal/app/mediaedge/ice_socket.go
index c95055785..c117a2051 100644
--- a/internal/app/mediaedge/ice_socket.go
+++ b/internal/app/mediaedge/ice_socket.go
@@ -3,6 +3,7 @@ package mediaedge
 import (
 	"context"
 	"errors"
+	"fmt"
 	"log/slog"
 	"net"
 	"net/netip"
@@ -32,6 +33,7 @@ type iceSocket struct {
 	ctx         context.Context
 	cancel      context.CancelFunc
 	closeOnce   sync.Once
+	punchedPeer *net.UDPAddr
 }
 
 func (engine *Engine) newICESocket(servers []webrtc.ICEServer, mapping bool) (*iceSocket, error) {
@@ -41,6 +43,12 @@ func (engine *Engine) newICESocket(servers []webrtc.ICEServer, mapping bool) (*i
 	if err != nil {
 		return nil, errors.New("native media UDP socket is unavailable")
 	}
+	return engine.adoptICESocket(connection, servers, mapping)
+}
+
+// Adoption happens before the one PeerConnection is constructed. Discovery and
+// media then keep this exact socket, including any authenticated punched tuple.
+func (engine *Engine) adoptICESocket(connection net.PacketConn, servers []webrtc.ICEServer, mapping bool) (*iceSocket, error) {
 	ctx, cancel := context.WithCancel(engine.ctx)
 	socket := &iceSocket{
 		engine: engine, ctx: ctx, cancel: cancel,
@@ -49,6 +57,9 @@ func (engine *Engine) newICESocket(servers []webrtc.ICEServer, mapping bool) (*i
 			Logger: diagnostics.PionLoggerFactory().NewLogger("piik-ice"), UDPConn: connection,
 		}),
 	}
+	if prepared, ok := connection.(*PunchedSocket); ok {
+		socket.punchedPeer = prepared.remote
+	}
 	if engine.portMapping && mapping && len(stunServers(servers)) > 0 {
 		socket.portMapping = portmapping.Start(socket.localPort)
 	}
@@ -79,6 +90,16 @@ func (socket *iceSocket) newPeerConnection() (*webrtc.PeerConnection, error) {
 	).NewPeerConnection(webrtc.Configuration{})
 }
 
+func (socket *iceSocket) addPunchedPeer(connection *webrtc.PeerConnection) error {
+	if socket.punchedPeer == nil {
+		return nil
+	}
+	mid := "0"
+	return connection.AddICECandidate(webrtc.ICECandidateInit{SDPMid: &mid,
+		Candidate: fmt.Sprintf("candidate:sp0 1 udp 1694498815 %s %d typ srflx", socket.punchedPeer.IP, socket.punchedPeer.Port),
+	})
+}
+
 func (socket *iceSocket) close() {
 	if socket == nil {
 		return
diff --git a/internal/app/mediaedge/punch.go b/internal/app/mediaedge/punch.go
new file mode 100644
index 000000000..b6f961152
--- /dev/null
+++ b/internal/app/mediaedge/punch.go
@@ -0,0 +1,278 @@
+package mediaedge
+
+import (
+	"context"
+	"encoding/hex"
+	"errors"
+	"net"
+	"net/netip"
+	"sync"
+	"time"
+
+	"github.com/pion/stun/v4"
+	"github.com/pion/webrtc/v4"
+)
+
+// PunchPrediction is a transient sequential mapping observation, not a NAT
+// classification. Only an authenticated peer in the current route may supply it.
+type PunchPrediction struct {
+	Address string `json:"address"`
+	Port    int    `json:"port"`
+	Step    int    `json:"step"`
+}
+
+func (prediction PunchPrediction) Target() (*net.UDPAddr, error) {
+	address, err := netip.ParseAddr(prediction.Address)
+	if err != nil || !address.Is4() || !address.IsGlobalUnicast() || address.IsPrivate() ||
+		address.IsLinkLocalUnicast() || prediction.Step < 1 || prediction.Step > 16 ||
+		prediction.Port < 1024 || prediction.Port > 65535 {
+		return nil, errors.New("unsupported peer mapping observation")
+	}
+	port := prediction.Port + 4*prediction.Step
+	if port > 65535 {
+		return nil, errors.New("unsupported peer mapping observation")
+	}
+	return net.UDPAddrFromAddrPort(netip.AddrPortFrom(address, uint16(port))), nil
+}
+
+// One optional preparation per Engine, within an existing acquisition retry.
+// It owns no media source/copy, persists no address, and expires even if SDP never
+// follows. Cancellation and socket transfer share this owner; there is no retry loop.
+type PunchPreparation struct {
+	engine       *Engine
+	connectionID string
+	source       *Source
+	servers      []webrtc.ICEServer
+	secret       []byte
+	ctx          context.Context
+	cancel       context.CancelFunc
+	mu           sync.Mutex
+	workMu       sync.Mutex
+	stage        string
+	socket       *PunchedSocket
+}
+
+// Keep the proved peer tuple with the socket. A later STUN observation on a
+// destination-dependent NAT describes a different mapping, not this path.
+type PunchedSocket struct {
+	net.PacketConn
+	remote *net.UDPAddr
+}
+
+func (engine *Engine) BeginPunch(connectionID string, source *Source, servers []webrtc.ICEServer, secret string) (*PunchPreparation, error) {
+	key, err := hex.DecodeString(secret)
+	if err != nil || len(key) != 32 || connectionID == "" || len(connectionID) > 256 {
+		return nil, errors.New("invalid connection preparation")
+	}
+	if source != nil {
+		source.mu.Lock()
+		defer source.mu.Unlock()
+		if source.engine != engine || source.closed {
+			return nil, errors.New("media source is unavailable")
+		}
+	}
+	engine.mu.Lock()
+	defer engine.mu.Unlock()
+	if engine.closed || engine.punch != nil {
+		return nil, errors.New("connection preparation is unavailable")
+	}
+	ctx, cancel := context.WithTimeout(engine.ctx, 5*time.Second)
+	preparation := &PunchPreparation{
+		engine: engine, connectionID: connectionID, source: source, servers: servers,
+		secret: key, ctx: ctx, cancel: cancel, stage: "new",
+	}
+	engine.punch = preparation
+	context.AfterFunc(ctx, func() {
+		preparation.close()
+		engine.mu.Lock()
+		if engine.punch == preparation {
+			engine.punch = nil
+		}
+		engine.mu.Unlock()
+	})
+	return preparation, nil
+}
+
+// Prepare observes three destinations in order before any peer checks on this
+// disposable socket. The ordinary initial ICE attempt never enters this path.
+func (preparation *PunchPreparation) Prepare() (*PunchPrediction, error) {
+	if !preparation.workMu.TryLock() {
+		return nil, errors.New("connection preparation is busy")
+	}
+	defer preparation.workMu.Unlock()
+	if !preparation.transition("new", "survey") {
+		return nil, errors.New("connection preparation was retired")
+	}
+	ctx, cancel := context.WithTimeout(preparation.ctx, 1500*time.Millisecond)
+	defer cancel()
+	socket, err := preparation.engine.newICESocket(nil, false)
+	if err != nil {
+		return nil, err
+	}
+	defer socket.close()
+	var observations []*stun.XORMappedAddress
+	seen := make(map[string]bool)
+	for _, server := range preparation.servers {
+		for _, raw := range server.URLs {
+			uri, parseErr := stun.ParseURI(raw)
+			if parseErr != nil || uri.Scheme != stun.SchemeTypeSTUN || uri.Proto != stun.ProtoTypeUDP {
+				continue
+			}
+			addresses, resolveErr := net.DefaultResolver.LookupNetIP(ctx, "ip4", uri.Host)
+			if resolveErr != nil || len(addresses) == 0 {
+				return nil, errors.New("connection preparation discovery unavailable")
+			}
+			address := net.UDPAddrFromAddrPort(netip.AddrPortFrom(addresses[0], uint16(uri.Port)))
+			if seen[address.String()] {
+				continue
+			}
+			seen[address.String()] = true
+			mapped, mappingErr := socket.querySTUN(ctx, address)
+			if mappingErr != nil {
+				return nil, mappingErr
+			}
+			observations = append(observations, mapped)
+			if len(observations) == 3 {
+				first, second, third := observations[0], observations[1], observations[2]
+				prediction := PunchPrediction{Address: third.IP.String(), Port: third.Port, Step: third.Port - second.Port}
+				_, valid := prediction.Target()
+				if valid != nil || !first.IP.Equal(second.IP) || !second.IP.Equal(third.IP) || second.Port-first.Port != prediction.Step {
+					return nil, errors.New("no sequential mapping observation")
+				}
+				if !preparation.transition("survey", "ready") {
+					return nil, errors.New("connection preparation was retired")
+				}
+				return &prediction, nil
+			}
+		}
+	}
+	return nil, errors.New("three distinct discovery destinations are required")
+}
+
+func (preparation *PunchPreparation) Run(remote PunchPrediction) bool {
+	if !preparation.workMu.TryLock() {
+		return false
+	}
+	defer preparation.workMu.Unlock()
+	target, err := remote.Target()
+	if err != nil || !preparation.transition("ready", "running") {
+		return false
+	}
+	winner, err := punchSocketArray(preparation.ctx, func() (net.PacketConn, error) {
+		return preparation.engine.listenPacket("udp", preparation.engine.bindAddress)
+	}, target, preparation.secret)
+	preparation.mu.Lock()
+	defer preparation.mu.Unlock()
+	if err != nil || preparation.ctx.Err() != nil || preparation.stage != "running" {
+		if winner != nil {
+			_ = winner.Close()
+		}
+		return false
+	}
+	preparation.socket = &PunchedSocket{PacketConn: winner, remote: target}
+	preparation.stage = "complete"
+	return true
+}
+
+func (preparation *PunchPreparation) transition(from, to string) bool {
+	preparation.mu.Lock()
+	defer preparation.mu.Unlock()
+	if preparation.ctx.Err() != nil || preparation.stage != from {
+		return false
+	}
+	preparation.stage = to
+	return true
+}
+
+func (preparation *PunchPreparation) close() {
+	preparation.cancel()
+	preparation.mu.Lock()
+	preparation.stage = "closed"
+	if preparation.socket != nil {
+		_ = preparation.socket.Close()
+		preparation.socket = nil
+	}
+	preparation.mu.Unlock()
+	preparation.workMu.Lock()
+	preparation.workMu.Unlock()
+}
+
+func (engine *Engine) Punch(connectionID string) *PunchPreparation {
+	engine.mu.Lock()
+	defer engine.mu.Unlock()
+	preparation := engine.punch
+	if preparation != nil && preparation.connectionID == connectionID {
+		return preparation
+	}
+	return nil
+}
+
+// TakePunchedSocket transfers ownership once, after both endpoints report a
+// successful preparation. The caller must adopt it or close it on every exit.
+func (engine *Engine) TakePunchedSocket(connectionID string, source *Source) *PunchedSocket {
+	engine.mu.Lock()
+	preparation := engine.punch
+	if preparation == nil || preparation.connectionID != connectionID || preparation.source != source {
+		engine.mu.Unlock()
+		return nil
+	}
+	engine.mu.Unlock()
+	// A premature commit must not free the slot while its workers still own
+	// sockets. Run publishes its result only after its finite work has ended.
+	if !preparation.workMu.TryLock() {
+		return nil
+	}
+	preparation.mu.Lock()
+	if preparation.stage != "complete" || preparation.ctx.Err() != nil {
+		preparation.mu.Unlock()
+		preparation.workMu.Unlock()
+		return nil
+	}
+	connection := preparation.socket
+	preparation.socket = nil
+	preparation.stage = "closed"
+	preparation.mu.Unlock()
+	preparation.workMu.Unlock()
+	preparation.close()
+	engine.mu.Lock()
+	if engine.punch == preparation {
+		engine.punch = nil
+	}
+	engine.mu.Unlock()
+	return connection
+}
+
+// An empty identity is Engine retirement. Source retirement uses the same slot.
+func (engine *Engine) ClosePunch(connectionID string) {
+	engine.mu.Lock()
+	preparation := engine.punch
+	if preparation != nil && connectionID != "" && preparation.connectionID != connectionID {
+		preparation = nil
+	}
+	engine.mu.Unlock()
+	if preparation != nil {
+		preparation.close()
+		engine.mu.Lock()
+		if engine.punch == preparation {
+			engine.punch = nil
+		}
+		engine.mu.Unlock()
+	}
+}
+
+func (engine *Engine) closeSourcePunch(source *Source) {
+	engine.mu.Lock()
+	preparation := engine.punch
+	if preparation != nil && preparation.source != source {
+		preparation = nil
+	}
+	engine.mu.Unlock()
+	if preparation != nil {
+		preparation.close()
+		engine.mu.Lock()
+		if engine.punch == preparation {
+			engine.punch = nil
+		}
+		engine.mu.Unlock()
+	}
+}
diff --git a/internal/app/mediaedge/punch_fixture_test.go b/internal/app/mediaedge/punch_fixture_test.go
new file mode 100644
index 000000000..47f64ee3f
--- /dev/null
+++ b/internal/app/mediaedge/punch_fixture_test.go
@@ -0,0 +1,92 @@
+package mediaedge
+
+import (
+	"bytes"
+	"github.com/pion/logging"
+	"github.com/pion/stun/v4"
+	"github.com/pion/transport/v5/vnet"
+	"net"
+	"testing"
+)
+
+// In-memory TEST-NET addresses only. No public host or OS socket is contacted.
+const punchSTUNIP = "198.51.100.254"
+
+type punchLab struct {
+	wan     *vnet.Router
+	nets    [2]*vnet.Net
+	private [2]string
+	public  [2]string
+}
+
+func newPunchLab(t *testing.T, left, right vnet.NATType) *punchLab {
+	t.Helper()
+	logger := logging.NewDefaultLoggerFactory()
+	logger.DefaultLogLevel = logging.LogLevelError
+	wan, err := vnet.NewRouter(&vnet.RouterConfig{CIDR: "0.0.0.0/0", LoggerFactory: logger})
+	if err != nil {
+		t.Fatal(err)
+	}
+	network := &punchLab{wan: wan, private: [2]string{"10.11.0.2", "10.12.0.2"}, public: [2]string{"198.51.100.1", "198.51.100.2"}}
+	for i, kind := range []vnet.NATType{left, right} {
+		lan, err := vnet.NewRouter(&vnet.RouterConfig{CIDR: network.private[i] + "/24", StaticIPs: []string{network.public[i]}, NATType: &kind, LoggerFactory: logger})
+		if err != nil {
+			t.Fatal(err)
+		}
+		endpoint, err := vnet.NewNet(&vnet.NetConfig{StaticIPs: []string{network.private[i]}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := lan.AddNet(endpoint); err != nil {
+			t.Fatal(err)
+		}
+		if err := wan.AddRouter(lan); err != nil {
+			t.Fatal(err)
+		}
+		network.nets[i] = endpoint
+	}
+	serverNet, err := vnet.NewNet(&vnet.NetConfig{StaticIPs: []string{punchSTUNIP}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := wan.AddNet(serverNet); err != nil {
+		t.Fatal(err)
+	}
+	if err := wan.Start(); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = wan.Stop() })
+	for _, port := range []string{"3478", "3479", "3480"} {
+		startPunchSTUN(t, serverNet, port)
+	}
+	return network
+}
+
+func startPunchSTUN(t *testing.T, serverNet *vnet.Net, port string) {
+	t.Helper()
+	server, err := serverNet.ListenPacket("udp4", punchSTUNIP+":"+port)
+	if err != nil {
+		t.Fatal(err)
+	}
+	stopped := make(chan struct{})
+	t.Cleanup(func() { _ = server.Close(); <-stopped })
+	go func() {
+		defer close(stopped)
+		buffer := make([]byte, 2048)
+		for {
+			n, addr, err := server.ReadFrom(buffer)
+			if err != nil {
+				return
+			}
+			message := &stun.Message{Raw: bytes.Clone(buffer[:n])}
+			if message.Decode() != nil || message.Type != stun.BindingRequest {
+				continue
+			}
+			source := addr.(*net.UDPAddr)
+			reply, err := stun.Build(stun.BindingSuccess, stun.NewTransactionIDSetter(message.TransactionID), &stun.XORMappedAddress{IP: source.IP, Port: source.Port})
+			if err == nil {
+				_, _ = server.WriteTo(reply.Raw, addr)
+			}
+		}
+	}()
+}
diff --git a/internal/app/mediaedge/punch_sockets.go b/internal/app/mediaedge/punch_sockets.go
new file mode 100644
index 000000000..d3d331d5e
--- /dev/null
+++ b/internal/app/mediaedge/punch_sockets.go
@@ -0,0 +1,129 @@
+package mediaedge
+
+import (
+	"context"
+	"encoding/hex"
+	"errors"
+	"net"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/pion/stun/v4"
+)
+
+// A bounded, authenticated preflight on eight fresh sockets. All readers stop
+// before the single winner transfers to the existing Pion connection owner.
+func punchSocketArray(ctx context.Context, listen func() (net.PacketConn, error), remote *net.UDPAddr, secret []byte) (net.PacketConn, error) {
+	if remote == nil || remote.IP.To4() == nil || remote.Port < 1 || remote.Port > 65535 || len(secret) != 32 {
+		return nil, errors.New("invalid peer or generation secret")
+	}
+	ctx, cancel := context.WithTimeout(ctx, 1100*time.Millisecond)
+	defer cancel()
+	var sockets []net.PacketConn
+	winner := -1
+	defer func() {
+		for i, connection := range sockets {
+			if i != winner {
+				_ = connection.Close()
+			}
+		}
+	}()
+	for range 8 {
+		if err := ctx.Err(); err != nil {
+			return nil, err
+		}
+		connection, err := listen()
+		if err != nil {
+			return nil, err
+		}
+		sockets = append(sockets, connection)
+		deadline, _ := ctx.Deadline()
+		if err := connection.SetDeadline(deadline); err != nil {
+			return nil, err
+		}
+	}
+	integrity := stun.NewShortTermIntegrity(hex.EncodeToString(secret))
+	deadlineDone := make(chan struct{})
+	stopDeadline := context.AfterFunc(ctx, func() {
+		defer close(deadlineDone)
+		for _, connection := range sockets {
+			_ = connection.SetDeadline(time.Now())
+		}
+	})
+	requests := make([]*stun.Message, len(sockets))
+	ready := make(chan int, len(sockets))
+	var readers sync.WaitGroup
+	var responses atomic.Int32
+	for i, connection := range sockets {
+		requests[i] = stun.MustBuild(stun.TransactionID, stun.BindingRequest, integrity, stun.Fingerprint)
+		readers.Add(1)
+		go func() {
+			defer readers.Done()
+			buffer := make([]byte, 1024)
+			for {
+				n, addr, err := connection.ReadFrom(buffer)
+				if err != nil {
+					return
+				}
+				message := &stun.Message{Raw: buffer[:n]}
+				if addr.String() != remote.String() || message.Decode() != nil || integrity.Check(message) != nil {
+					continue
+				}
+				switch message.Type {
+				case stun.BindingRequest:
+					if responses.Add(1) > 64 {
+						continue
+					}
+					reply := stun.MustBuild(stun.BindingSuccess, stun.NewTransactionIDSetter(message.TransactionID),
+						&stun.XORMappedAddress{IP: remote.IP, Port: remote.Port}, integrity, stun.Fingerprint)
+					_, _ = connection.WriteTo(reply.Raw, remote)
+				case stun.BindingSuccess:
+					if message.TransactionID == requests[i].TransactionID {
+						select {
+						case ready <- i:
+						default:
+						}
+					}
+				}
+			}
+		}()
+	}
+	// Keep servicing authenticated peer requests until the finite send window
+	// ends, including after a local response arrives. One peer finishing first
+	// must not strand its partner before socket adoption.
+	for round := 0; round < 8 && ctx.Err() == nil; round++ {
+		for i, connection := range sockets {
+			if ctx.Err() != nil {
+				break
+			}
+			_, _ = connection.WriteTo(requests[i].Raw, remote)
+		}
+		select {
+		case <-ctx.Done():
+		case <-time.After(100 * time.Millisecond):
+		}
+	}
+	for _, connection := range sockets {
+		_ = connection.SetReadDeadline(time.Now())
+	}
+	readers.Wait()
+	// A cancellation callback must finish before ownership or deadline reset.
+	// Otherwise it can poison the socket after Pion has already adopted it.
+	if !stopDeadline() {
+		<-deadlineDone
+	}
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
+	select {
+	case winner = <-ready:
+		if err := sockets[winner].SetDeadline(time.Time{}); err != nil {
+			winner = -1
+			return nil, err
+		}
+		return sockets[winner], nil
+	default:
+		return nil, errors.New("bounded socket array found no authenticated tuple")
+	}
+}
diff --git a/internal/app/mediaedge/punch_test.go b/internal/app/mediaedge/punch_test.go
new file mode 100644
index 000000000..abf169bf5
--- /dev/null
+++ b/internal/app/mediaedge/punch_test.go
@@ -0,0 +1,273 @@
+package mediaedge
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"math"
+	"net"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/livekit/livekit-server/pkg/sfu"
+	"github.com/pion/ice/v4"
+	"github.com/pion/transport/v5/vnet"
+	"github.com/pion/webrtc/v4"
+)
+
+var sequentialPunchNAT = vnet.NATType{MappingBehavior: vnet.EndpointAddrPortDependent, FilteringBehavior: vnet.EndpointAddrPortDependent}
+
+func punchEngine(t *testing.T, network *punchLab, side int) *Engine {
+	t.Helper()
+	engine, err := NewEngine(EngineOptions{BindAddress: network.private[side] + ":0"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	engine.listenPacket = func(_, address string) (net.PacketConn, error) {
+		return network.nets[side].ListenPacket("udp4", address)
+	}
+	engine.settings.SetNet(network.nets[side])
+	engine.settings.SetNetworkTypes([]webrtc.NetworkType{webrtc.NetworkTypeUDP4})
+	engine.settings.SetICEMulticastDNSMode(ice.MulticastDNSModeDisabled)
+	t.Cleanup(func() { _ = engine.Close() })
+	return engine
+}
+
+func preparePunch(t *testing.T, engine *Engine, source *Source, id, secret string) (*PunchPreparation, *PunchPrediction) {
+	t.Helper()
+	preparation, err := engine.BeginPunch(id, source, []webrtc.ICEServer{{URLs: []string{
+		"stun:" + punchSTUNIP + ":3478", "stun:" + punchSTUNIP + ":3479", "stun:" + punchSTUNIP + ":3480",
+	}}}, secret)
+	if err != nil {
+		t.Fatal(err)
+	}
+	prediction, err := preparation.Prepare()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return preparation, prediction
+}
+
+func TestPunchAdoptsProvedTupleIntoMediaAndFeedback(t *testing.T) {
+	for _, skew := range []time.Duration{0, 250 * time.Millisecond} {
+		t.Run(skew.String(), func(t *testing.T) {
+			network := newPunchLab(t, sequentialPunchNAT, sequentialPunchNAT)
+			engines := [2]*Engine{punchEngine(t, network, 0), punchEngine(t, network, 1)}
+			keyFrames := make(chan struct{}, 8)
+			source, err := engines[0].NewSource("vp8", 1, 1, func([]int) {
+				select {
+				case keyFrames <- struct{}{}:
+				default:
+				}
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+			t.Cleanup(func() { _ = source.Close() })
+			left, leftPrediction := preparePunch(t, engines[0], source, "connection", strings.Repeat("42", 32))
+			right, rightPrediction := preparePunch(t, engines[1], nil, "connection", strings.Repeat("42", 32))
+			results := make(chan bool, 2)
+			go func() { results <- left.Run(*rightPrediction) }()
+			time.Sleep(skew)
+			go func() { results <- right.Run(*leftPrediction) }()
+			for range 2 {
+				if !<-results {
+					t.Fatal("authenticated preparation failed")
+				}
+			}
+			// No fresh STUN mapping can replace the endpoint that proved this path.
+			socket := engines[1].TakePunchedSocket("connection", nil)
+			if socket == nil {
+				t.Fatal("missing inbound winner")
+			}
+			t.Cleanup(func() { _ = socket.Close() })
+			edge, err := engines[0].NewEdge(source, EdgeOptions{ConnectionID: "connection", Punched: true})
+			if err != nil {
+				t.Fatal(err)
+			}
+			t.Cleanup(func() { _ = edge.Close() })
+			offer, err := edge.CreateOffer()
+			if err != nil {
+				t.Fatal(err)
+			}
+			receiver, answer, err := engines[1].NewReceiver(ReceiverOptions{Offer: offer, EdgeCapacity: 1, PunchedSocket: socket})
+			if err != nil {
+				t.Fatal(err)
+			}
+			t.Cleanup(func() { _ = receiver.Close() })
+			if err := edge.SetAnswer(answer, ""); err != nil {
+				t.Fatal(err)
+			}
+			waitConnected(t, edge.connection, "adopted Native edge")
+			waitConnected(t, receiver.connection, "adopted Native receiver")
+			deadline := time.Now().Add(3 * time.Second)
+			timestamp := time.Second
+			for {
+				if err := writeSourceFrame(source, sfu.VP8KeyFrame8x8, timestamp, time.Second/30); err != nil {
+					t.Fatal(err)
+				}
+				timestamp += time.Second / 30
+				receiver.mu.Lock()
+				received := receiver.videoSSRC != 0
+				receiver.mu.Unlock()
+				if received {
+					break
+				}
+				if time.Now().After(deadline) {
+					t.Fatal("adopted socket carried no SRTP video")
+				}
+				time.Sleep(20 * time.Millisecond)
+			}
+			for _, buffer := range source.media.GetAllBuffers() {
+				if buffer != nil {
+					buffer.SetPLIThrottle(0)
+				}
+			}
+			for len(keyFrames) > 0 {
+				<-keyFrames
+			}
+			receiver.RequestKeyFrame()
+			waitSignal(t, keyFrames, "reverse SRTCP feedback")
+			if engines[0].Punch("connection") != nil || engines[1].Punch("connection") != nil {
+				t.Fatal("adoption retained a preparation owner")
+			}
+		})
+	}
+}
+
+func TestPunchRetirementJoinsBeforeSlotReuse(t *testing.T) {
+	for _, retire := range []string{"connection", "source", "engine", "context"} {
+		t.Run(retire, func(t *testing.T) {
+			network := newPunchLab(t, sequentialPunchNAT, sequentialPunchNAT)
+			engine := punchEngine(t, network, 0)
+			source, err := engine.NewSource("vp8", 1, 1, nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+			t.Cleanup(func() { _ = source.Close() })
+			preparation, _ := preparePunch(t, engine, source, "current", strings.Repeat("42", 32))
+			// A worker held at an allocation boundary cannot be overtaken by a
+			// premature commit or a replacement connection.
+			entered, release := make(chan struct{}), make(chan struct{})
+			var once sync.Once
+			engine.listenPacket = func(_, _ string) (net.PacketConn, error) {
+				once.Do(func() { close(entered); <-release })
+				return nil, errors.New("retired fixture")
+			}
+			done := make(chan struct{})
+			go func() { preparation.Run(PunchPrediction{Address: network.public[1], Port: 5000, Step: 1}); close(done) }()
+			<-entered
+			if engine.TakePunchedSocket("current", source) != nil || engine.Punch("current") != preparation {
+				t.Fatal("premature commit released the worker's slot")
+			}
+			closed := make(chan struct{})
+			go func() {
+				switch retire {
+				case "connection":
+					engine.ClosePunch("current")
+				case "source":
+					_ = source.Close()
+				case "engine":
+					_ = engine.Close()
+				case "context":
+					preparation.cancel()
+					preparation.close()
+				}
+				close(closed)
+			}()
+			select {
+			case <-closed:
+				t.Fatal("retirement returned before joining its worker")
+			case <-time.After(10 * time.Millisecond):
+			}
+			if _, err := engine.BeginPunch("replacement", nil, nil, strings.Repeat("24", 32)); err == nil {
+				t.Fatal("replacement overtook retiring worker")
+			}
+			close(release)
+			waitSignal(t, done, "preparation worker retirement")
+			waitSignal(t, closed, "preparation owner retirement")
+		})
+	}
+}
+
+type countedPunchConn struct {
+	net.PacketConn
+	closed     atomic.Bool
+	writes     atomic.Int32
+	firstWrite func()
+}
+
+func (c *countedPunchConn) Close() error { c.closed.Store(true); return c.PacketConn.Close() }
+func (c *countedPunchConn) WriteTo(p []byte, a net.Addr) (int, error) {
+	c.writes.Add(1)
+	if c.firstWrite != nil {
+		c.firstWrite()
+	}
+	return c.PacketConn.WriteTo(p, a)
+}
+
+func TestPunchSocketResourcesAreBoundedOnFailure(t *testing.T) {
+	for _, scenario := range []string{"cancel-before", "cancel-during", "timeout", "allocation-failure", "invalid-secret"} {
+		t.Run(scenario, func(t *testing.T) {
+			network := newPunchLab(t, sequentialPunchNAT, sequentialPunchNAT)
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+			if scenario == "cancel-before" {
+				cancel()
+			}
+			var connections []*countedPunchConn
+			listen := func() (net.PacketConn, error) {
+				if scenario == "allocation-failure" && len(connections) == 3 {
+					return nil, errors.New("fixture allocation failure")
+				}
+				conn, err := network.nets[0].ListenPacket("udp4", network.private[0]+":0")
+				if err != nil {
+					return nil, err
+				}
+				counted := &countedPunchConn{PacketConn: conn}
+				if scenario == "cancel-during" {
+					counted.firstWrite = cancel
+				}
+				connections = append(connections, counted)
+				return counted, nil
+			}
+			secret := bytes.Repeat([]byte{42}, 32)
+			if scenario == "invalid-secret" {
+				secret = nil
+			}
+			winner, err := punchSocketArray(ctx, listen, &net.UDPAddr{IP: net.ParseIP(network.public[1]), Port: 50000}, secret)
+			if err == nil || winner != nil {
+				t.Fatal("failed preparation transferred a socket")
+			}
+			var writes int32
+			for _, conn := range connections {
+				if !conn.closed.Load() {
+					t.Error("preparation leaked a socket")
+				}
+				writes += conn.writes.Load()
+			}
+			if len(connections) > 8 || writes > 64 {
+				t.Fatalf("resource bound exceeded: sockets=%d writes=%d", len(connections), writes)
+			}
+			if (scenario == "invalid-secret" || scenario == "cancel-before") && len(connections) != 0 {
+				t.Fatal("invalid attempt allocated sockets")
+			}
+		})
+	}
+}
+
+func TestPunchPredictionRejectsUnsafeDestinationsAndOverflow(t *testing.T) {
+	for _, prediction := range []PunchPrediction{
+		{Address: "127.0.0.1", Port: 5000, Step: 1}, {Address: "10.0.0.1", Port: 5000, Step: 1},
+		{Address: "224.0.0.1", Port: 5000, Step: 1}, {Address: "::1", Port: 5000, Step: 1},
+		{Address: "198.51.100.1", Port: math.MaxInt, Step: 1}, {Address: "198.51.100.1", Port: 65534, Step: 1},
+		{Address: "198.51.100.1", Port: 1000, Step: 1}, {Address: "198.51.100.1", Port: 5000, Step: 17},
+	} {
+		if _, err := prediction.Target(); err == nil {
+			t.Fatalf("accepted unsafe prediction: %+v", prediction)
+		}
+	}
+}
diff --git a/internal/app/mediaedge/receiver.go b/internal/app/mediaedge/receiver.go
index 300972876..996a9cc99 100644
--- a/internal/app/mediaedge/receiver.go
+++ b/internal/app/mediaedge/receiver.go
@@ -28,6 +28,8 @@ type ReceiverOptions struct {
 	EdgeCapacity int
 	Events       ReceiverEvents
 	Relay        *RelayOptions
+	// A consumed preparation transfers ownership even if offer validation fails.
+	PunchedSocket *PunchedSocket
 }
 
 // Receiver owns one inbound WebRTC connection and exposes its encoded media as
@@ -51,6 +53,13 @@ type Receiver struct {
 }
 
 func (engine *Engine) NewReceiver(options ReceiverOptions) (_ *Receiver, _ webrtc.SessionDescription, err error) {
+	if options.PunchedSocket != nil {
+		defer func() {
+			if err != nil {
+				_ = options.PunchedSocket.Close()
+			}
+		}()
+	}
 	if options.Offer.Type != webrtc.SDPTypeOffer || options.Offer.SDP == "" {
 		return nil, webrtc.SessionDescription{}, errors.New("native media receiver input is invalid")
 	}
@@ -59,7 +68,12 @@ func (engine *Engine) NewReceiver(options ReceiverOptions) (_ *Receiver, _ webrt
 		return nil, webrtc.SessionDescription{}, err
 	}
 	var prepareMapping func() int
-	socket, err := engine.newICESocket(options.ICEServers, true)
+	var socket *iceSocket
+	if options.PunchedSocket != nil {
+		socket, err = engine.adoptICESocket(options.PunchedSocket, options.ICEServers, true)
+	} else {
+		socket, err = engine.newICESocket(options.ICEServers, true)
+	}
 	if err != nil {
 		return nil, webrtc.SessionDescription{}, err
 	}
@@ -79,6 +93,10 @@ func (engine *Engine) NewReceiver(options ReceiverOptions) (_ *Receiver, _ webrt
 		_ = connection.Close()
 		return nil, webrtc.SessionDescription{}, err
 	}
+	if err = socket.addPunchedPeer(connection); err != nil {
+		_ = connection.Close()
+		return nil, webrtc.SessionDescription{}, err
+	}
 	videoCodec, err := selectReceiverVideoCodec(connection)
 	if err != nil {
 		_ = connection.Close()
diff --git a/internal/app/mediaedge/source.go b/internal/app/mediaedge/source.go
index 77a781fae..e23ebdbcd 100644
--- a/internal/app/mediaedge/source.go
+++ b/internal/app/mediaedge/source.go
@@ -695,6 +695,7 @@ func (source *Source) Close() error {
 	}
 	source.mu.Unlock()
 	// Close transports before waiting on their possible writes into this group.
+	source.engine.closeSourcePunch(source)
 	closeEdges(edges)
 	for _, publication := range publications {
 		_ = publication.Close()
diff --git a/internal/app/nativecontrol/punch.go b/internal/app/nativecontrol/punch.go
new file mode 100644
index 000000000..86f5db005
--- /dev/null
+++ b/internal/app/nativecontrol/punch.go
@@ -0,0 +1,109 @@
+package nativecontrol
+
+import (
+	"encoding/hex"
+	"errors"
+
+	"github.com/TNTcraftHIM/Piik/internal/app/mediaedge"
+)
+
+type preparePunchRequest struct {
+	requestEnvelope
+	ShareID            string      `json:"shareId"`
+	ConnectionID       string      `json:"connectionId"`
+	SourceConnectionID string      `json:"sourceConnectionId,omitempty"`
+	EdgeCapacity       int         `json:"edgeCapacity"`
+	ICEServers         []iceServer `json:"iceServers"`
+	Secret             string      `json:"secret"`
+}
+
+type runPunchRequest struct {
+	requestEnvelope
+	ShareID      string                    `json:"shareId"`
+	ConnectionID string                    `json:"connectionId"`
+	Prediction   mediaedge.PunchPrediction `json:"prediction"`
+}
+
+type punchPreparedResponse struct {
+	responseEnvelope
+	Prediction *mediaedge.PunchPrediction `json:"prediction"`
+}
+
+type punchCompleteResponse struct {
+	responseEnvelope
+	Connected bool `json:"connected"`
+}
+
+func (session *Session) handlePunch(envelope requestEnvelope, payload []byte, complete func(any, error)) (any, error) {
+	switch envelope.Type {
+	case "prepare-punch":
+		var request preparePunchRequest
+		if err := decodeStrict(payload, &request); err != nil || !validIdentities(request.ShareID, request.ConnectionID) ||
+			(request.SourceConnectionID != "" && !validIdentities(request.SourceConnectionID)) ||
+			request.EdgeCapacity < 1 || request.EdgeCapacity > maxEdgeCapacity {
+			return nil, protocolViolation("native connection preparation is invalid")
+		}
+		key, err := hex.DecodeString(request.Secret)
+		if err != nil || len(key) != 32 {
+			return nil, protocolViolation("native connection preparation key is invalid")
+		}
+		servers, err := pionICEServers(request.ICEServers)
+		if err != nil {
+			return nil, err
+		}
+		var preparation *mediaedge.PunchPreparation
+		if host := session.current(request.ShareID); host != nil && request.SourceConnectionID == "" {
+			preparation, err = host.BeginPunch(request.ConnectionID, servers, request.Secret)
+		} else {
+			viewer, viewerErr := session.ensureViewer(request.ShareID, request.EdgeCapacity)
+			if viewerErr != nil {
+				return nil, viewerErr
+			}
+			preparation, err = viewer.BeginPunch(request.ConnectionID, request.SourceConnectionID, servers, request.Secret)
+		}
+		if err != nil {
+			return nil, err
+		}
+		// Reserve before launching work, so a subsequent close cannot be undone
+		// by a late worker. This is independent of the capture mutation slot.
+		go func() {
+			prediction, err := preparation.Prepare()
+			result := punchPreparedResponse{response(envelope, "punch-prepared"), prediction}
+			complete(result, err)
+			session.emit(result)
+		}()
+		return nil, nil
+	case "run-punch":
+		var request runPunchRequest
+		if err := decodeStrict(payload, &request); err != nil || !validIdentities(request.ShareID, request.ConnectionID) {
+			return nil, protocolViolation("native connection probe is invalid")
+		}
+		if _, err := request.Prediction.Target(); err != nil {
+			return nil, err
+		}
+		media := session.currentMedia(request.ShareID)
+		if media == nil {
+			return nil, errors.New("native media session does not exist")
+		}
+		preparation := media.Punch(request.ConnectionID)
+		if preparation == nil {
+			return nil, errors.New("connection preparation was retired")
+		}
+		go func() {
+			result := punchCompleteResponse{response(envelope, "punch-complete"), preparation.Run(request.Prediction)}
+			complete(result, nil)
+			session.emit(result)
+		}()
+		return nil, nil
+	case "close-punch":
+		var request closeEdgeRequest
+		if err := decodeStrict(payload, &request); err != nil || !validIdentities(request.ShareID, request.ConnectionID) {
+			return nil, protocolViolation("native connection retirement is invalid")
+		}
+		if media := session.currentMedia(request.ShareID); media != nil {
+			media.ClosePunch(request.ConnectionID)
+		}
+		return response(envelope, "punch-closed"), nil
+	}
+	return nil, protocolViolation("unknown connection preparation request")
+}
diff --git a/internal/app/nativecontrol/session.go b/internal/app/nativecontrol/session.go
index 85d43bd0c..6d2fae807 100644
--- a/internal/app/nativecontrol/session.go
+++ b/internal/app/nativecontrol/session.go
@@ -60,6 +60,8 @@ type outboundMediaSession interface {
 	SetAnswer(string, webrtc.SessionDescription, string) error
 	AddCandidate(string, *webrtc.ICECandidateInit) error
 	CloseEdge(string)
+	Punch(string) *mediaedge.PunchPreparation
+	ClosePunch(string)
 }
 
 func New(
@@ -109,6 +111,10 @@ func (session *Session) Handle(ctx context.Context, payload []byte) (result any,
 		}
 	}()
 	switch envelope.Type {
+	case "prepare-punch", "run-punch", "close-punch":
+		result, returnedErr = session.handlePunch(envelope, payload, complete)
+		asynchronous = result == nil && returnedErr == nil
+		return result, returnedErr
 	case "prepare-publication", "publication-media", "publication-answer", "publication-candidate", "publication-layers", "close-publication":
 		return session.handlePublication(envelope, payload)
 	case "capture-options":
@@ -675,13 +681,14 @@ func (session *Session) prepareEdge(
 	}
 	var offer webrtc.SessionDescription
 	if host := session.current(request.ShareID); host != nil && request.SourceConnectionID == "" {
-		offer, err = host.PrepareEdge(request.ConnectionID, servers)
+		offer, err = host.PrepareEdge(request.ConnectionID, servers, request.Punched)
 	} else if viewer := session.currentViewer(request.ShareID); viewer != nil &&
 		identityPattern.MatchString(request.SourceConnectionID) {
 		offer, err = viewer.PrepareEdge(
 			request.SourceConnectionID,
 			request.ConnectionID,
 			servers,
+			request.Punched,
 		)
 	} else {
 		return nil, errors.New("native media source does not exist")
@@ -743,6 +750,7 @@ func (session *Session) receiveOffer(
 		webrtc.SessionDescription{Type: webrtc.SDPTypeOffer, SDP: request.SDP},
 		servers,
 		request.ReuseReceiver,
+		request.Punched,
 	)
 	if err != nil {
 		return nil, err
diff --git a/internal/app/nativecontrol/wire.go b/internal/app/nativecontrol/wire.go
index 96da3830f..6efd759f7 100644
--- a/internal/app/nativecontrol/wire.go
+++ b/internal/app/nativecontrol/wire.go
@@ -116,6 +116,7 @@ type prepareEdgeRequest struct {
 	ConnectionID       string      `json:"connectionId"`
 	SourceConnectionID string      `json:"sourceConnectionId,omitempty"`
 	ICEServers         []iceServer `json:"iceServers"`
+	Punched            bool        `json:"punched,omitempty"`
 }
 
 type prepareLocalEdgeRequest struct {
@@ -138,6 +139,7 @@ type receiveOfferRequest struct {
 	ICEServers    []iceServer `json:"iceServers"`
 	SDP           string      `json:"sdp"`
 	ReuseReceiver bool        `json:"reuseReceiver,omitempty"`
+	Punched       bool        `json:"punched,omitempty"`
 }
 
 type receiveCandidateRequest struct {
diff --git a/internal/app/nativehost/punch.go b/internal/app/nativehost/punch.go
new file mode 100644
index 000000000..2bb04ff15
--- /dev/null
+++ b/internal/app/nativehost/punch.go
@@ -0,0 +1,24 @@
+package nativehost
+
+import (
+	"errors"
+
+	"github.com/TNTcraftHIM/Piik/internal/app/mediaedge"
+	"github.com/pion/webrtc/v4"
+)
+
+func (session *Session) BeginPunch(connectionID string, servers []webrtc.ICEServer, secret string) (*mediaedge.PunchPreparation, error) {
+	session.mu.Lock()
+	defer session.mu.Unlock()
+	source := session.source
+	if session.closed || source == nil || session.edges[connectionID] != nil {
+		return nil, errors.New("native share is unavailable")
+	}
+	return session.engine.BeginPunch(connectionID, source, servers, secret)
+}
+
+func (session *Session) Punch(connectionID string) *mediaedge.PunchPreparation {
+	return session.engine.Punch(connectionID)
+}
+
+func (session *Session) ClosePunch(connectionID string) { session.engine.ClosePunch(connectionID) }
diff --git a/internal/app/nativehost/session.go b/internal/app/nativehost/session.go
index 126238e3d..60694a36c 100644
--- a/internal/app/nativehost/session.go
+++ b/internal/app/nativehost/session.go
@@ -234,8 +234,9 @@ func (session *Session) HasAudio() bool {
 func (session *Session) PrepareEdge(
 	connectionID string,
 	iceServers []webrtc.ICEServer,
+	punched bool,
 ) (webrtc.SessionDescription, error) {
-	return session.prepareEdge(connectionID, iceServers, "")
+	return session.prepareEdge(connectionID, iceServers, "", punched)
 }
 
 func (session *Session) PrepareLocalEdge(
@@ -249,13 +250,14 @@ func (session *Session) PrepareLocalEdge(
 		}
 		return edge.CreateLocalOffer(session.ctx, offerID, true)
 	}
-	return session.prepareEdge(connectionID, nil, offerID)
+	return session.prepareEdge(connectionID, nil, offerID, false)
 }
 
 func (session *Session) prepareEdge(
 	connectionID string,
 	iceServers []webrtc.ICEServer,
 	localOfferID string,
+	punched bool,
 ) (webrtc.SessionDescription, error) {
 	session.mu.Lock()
 	if session.closed || session.edges[connectionID] != nil {
@@ -268,6 +270,7 @@ func (session *Session) prepareEdge(
 		ICEServers:   iceServers,
 		Audio:        session.audioSource,
 		Local:        localOfferID != "",
+		Punched:      punched,
 		Events: mediaedge.EdgeEvents{
 			LocalCandidate: func(candidate *webrtc.ICECandidateInit) {
 				session.emit(Event{
@@ -649,6 +652,7 @@ func (session *Session) disableCaptureLayer(stream *nativecapture.Stream, layer
 }
 
 func (session *Session) CloseEdge(connectionID string) {
+	session.engine.ClosePunch(connectionID)
 	session.mu.Lock()
 	edge := session.edges[connectionID]
 	delete(session.edges, connectionID)
diff --git a/internal/app/nativeviewer/punch.go b/internal/app/nativeviewer/punch.go
new file mode 100644
index 000000000..0777540d8
--- /dev/null
+++ b/internal/app/nativeviewer/punch.go
@@ -0,0 +1,31 @@
+package nativeviewer
+
+import (
+	"errors"
+
+	"github.com/TNTcraftHIM/Piik/internal/app/mediaedge"
+	"github.com/pion/webrtc/v4"
+)
+
+func (session *Session) BeginPunch(connectionID, sourceConnectionID string, servers []webrtc.ICEServer, secret string) (*mediaedge.PunchPreparation, error) {
+	session.mu.Lock()
+	defer session.mu.Unlock()
+	if _, exists := session.edges[connectionID]; session.closed || exists || session.receivers[connectionID] != nil {
+		return nil, errors.New("native connection is unavailable for preparation")
+	}
+	var source *mediaedge.Source
+	if sourceConnectionID != "" {
+		receiver := session.receivers[sourceConnectionID]
+		if receiver == nil {
+			return nil, errors.New("native Viewer source is unavailable")
+		}
+		source = receiver.Source()
+	}
+	return session.engine.BeginPunch(connectionID, source, servers, secret)
+}
+
+func (session *Session) Punch(connectionID string) *mediaedge.PunchPreparation {
+	return session.engine.Punch(connectionID)
+}
+
+func (session *Session) ClosePunch(connectionID string) { session.engine.ClosePunch(connectionID) }
diff --git a/internal/app/nativeviewer/session.go b/internal/app/nativeviewer/session.go
index 4ee448813..53a9a803e 100644
--- a/internal/app/nativeviewer/session.go
+++ b/internal/app/nativeviewer/session.go
@@ -120,6 +120,7 @@ func (session *Session) AcceptOffer(
 	offer webrtc.SessionDescription,
 	iceServers []webrtc.ICEServer,
 	reuse bool,
+	punched bool,
 ) (OfferResult, error) {
 	if connectionID == "" || len(connectionID) > 256 {
 		return OfferResult{}, errors.New("native Viewer receiver identity is invalid")
@@ -144,12 +145,20 @@ func (session *Session) AcceptOffer(
 			return OfferResult{Answer: answer, Audio: receiver.HasAudio(), Codec: receiver.Codec(), Reused: true}, nil
 		}
 	}
+	var punchedSocket *mediaedge.PunchedSocket
+	if punched {
+		punchedSocket = session.engine.TakePunchedSocket(connectionID, nil)
+		if punchedSocket == nil {
+			return OfferResult{}, errors.New("prepared connection is unavailable")
+		}
+	}
 	session.CloseReceiver(connectionID)
 	receiver, answer, err := session.engine.NewReceiver(mediaedge.ReceiverOptions{
-		Offer:        offer,
-		ICEServers:   iceServers,
-		EdgeCapacity: session.edgeCapacity,
-		Relay:        session.relay,
+		Offer:         offer,
+		ICEServers:    iceServers,
+		EdgeCapacity:  session.edgeCapacity,
+		Relay:         session.relay,
+		PunchedSocket: punchedSocket,
 		Events: mediaedge.ReceiverEvents{
 			LocalCandidate: func(candidate *webrtc.ICECandidateInit, current func() bool) {
 				session.emit(Event{
@@ -224,15 +233,16 @@ func (session *Session) PrepareLocalEdge(
 		}
 		return current.edge.CreateLocalOffer(session.ctx, offerID, true)
 	}
-	return session.prepareEdge(sourceConnectionID, connectionID, nil, offerID)
+	return session.prepareEdge(sourceConnectionID, connectionID, nil, offerID, false)
 }
 
 func (session *Session) PrepareEdge(
 	sourceConnectionID string,
 	connectionID string,
 	iceServers []webrtc.ICEServer,
+	punched bool,
 ) (webrtc.SessionDescription, error) {
-	return session.prepareEdge(sourceConnectionID, connectionID, iceServers, "")
+	return session.prepareEdge(sourceConnectionID, connectionID, iceServers, "", punched)
 }
 
 func (session *Session) prepareEdge(
@@ -240,6 +250,7 @@ func (session *Session) prepareEdge(
 	connectionID string,
 	iceServers []webrtc.ICEServer,
 	localOfferID string,
+	punched bool,
 ) (webrtc.SessionDescription, error) {
 	local := localOfferID != ""
 	receiver := session.receiver(sourceConnectionID)
@@ -261,6 +272,7 @@ func (session *Session) prepareEdge(
 		ICEServers:   iceServers,
 		Audio:        receiver.AudioSource(),
 		Local:        local,
+		Punched:      punched,
 		Events: mediaedge.EdgeEvents{
 			LocalCandidate: func(candidate *webrtc.ICECandidateInit) {
 				session.emit(Event{
@@ -329,6 +341,7 @@ func (session *Session) AddCandidate(connectionID string, candidate *webrtc.ICEC
 }
 
 func (session *Session) CloseReceiver(connectionID string) {
+	session.engine.ClosePunch(connectionID)
 	session.mu.Lock()
 	receiver := session.receivers[connectionID]
 	delete(session.receivers, connectionID)
@@ -349,6 +362,7 @@ func (session *Session) CloseReceiver(connectionID string) {
 }
 
 func (session *Session) CloseEdge(connectionID string) {
+	session.engine.ClosePunch(connectionID)
 	session.mu.Lock()
 	edge := session.edges[connectionID].edge
 	delete(session.edges, connectionID)
diff --git a/internal/app/nativeviewer/session_test.go b/internal/app/nativeviewer/session_test.go
index 3ce6837c9..af666bf4d 100644
--- a/internal/app/nativeviewer/session_test.go
+++ b/internal/app/nativeviewer/session_test.go
@@ -39,7 +39,7 @@ func TestOfferReuseKeepsSourceAndChildOwnership(t *testing.T) {
 		t.Cleanup(func() { _ = session.Close() })
 		for _, audio := range []bool{false, true, false} {
 			input := offer(audio)
-			result, err := session.AcceptOffer("upstream", input, nil, reuse)
+			result, err := session.AcceptOffer("upstream", input, nil, reuse, false)
 			if err != nil || result.Reused || result.Audio != audio {
 				t.Fatalf("new media shape: %+v, %v", result, err)
 			}
@@ -51,7 +51,7 @@ func TestOfferReuseKeepsSourceAndChildOwnership(t *testing.T) {
 				t.Fatal(err)
 			}
 			child := session.edge("local-playback")
-			result, err = session.AcceptOffer("upstream", input, nil, reuse)
+			result, err = session.AcceptOffer("upstream", input, nil, reuse, false)
 			if err != nil || result.Reused != reuse {
 				t.Fatalf("repeat offer: %+v, %v", result, err)
 			}
@@ -106,31 +106,31 @@ func TestReceiverCapacityPreservesCurrentAndPreparedSources(t *testing.T) {
 	}
 	t.Cleanup(func() { _ = session.Close() })
 	for _, id := range []string{"active", "candidate"} {
-		if _, err = session.AcceptOffer(id, offer, nil, false); err != nil {
+		if _, err = session.AcceptOffer(id, offer, nil, false, false); err != nil {
 			t.Fatal(err)
 		}
 	}
 	active, candidate := session.receiver("active"), session.receiver("candidate")
-	if _, err = session.AcceptOffer("excess", offer, nil, false); err == nil {
+	if _, err = session.AcceptOffer("excess", offer, nil, false, false); err == nil {
 		t.Fatal("a third receiver bypassed the active/candidate bound")
 	}
 	if session.receiver("active") != active || session.receiver("candidate") != candidate || session.receiver("excess") != nil {
 		t.Fatal("capacity rejection changed an existing receiver")
 	}
-	if result, err := session.AcceptOffer("active", offer, nil, true); err != nil || !result.Reused {
+	if result, err := session.AcceptOffer("active", offer, nil, true, false); err != nil || !result.Reused {
 		t.Fatalf("existing receiver could not renegotiate at capacity: %v", err)
 	}
 	if _, err = session.PrepareLocalEdge("active", "local-preview", "preview-offer", false); err != nil {
 		t.Fatalf("capacity rejection stopped local playback preparation: %v", err)
 	}
-	if _, err = session.AcceptOffer("candidate", offer, nil, false); err != nil {
+	if _, err = session.AcceptOffer("candidate", offer, nil, false, false); err != nil {
 		t.Fatalf("existing receiver could not be replaced at capacity: %v", err)
 	}
 	if session.receiver("active") != active || session.receiver("candidate") == candidate || session.edge("local-preview") == nil {
 		t.Fatal("receiver replacement changed the active source or its playback")
 	}
 	session.CloseReceiver("candidate")
-	if _, err = session.AcceptOffer("replacement", offer, nil, false); err != nil {
+	if _, err = session.AcceptOffer("replacement", offer, nil, false, false); err != nil {
 		t.Fatalf("retired receiver did not release its slot: %v", err)
 	}
 }
diff --git a/internal/server/protocol/punch.go b/internal/server/protocol/punch.go
new file mode 100644
index 000000000..c7b5e9730
--- /dev/null
+++ b/internal/server/protocol/punch.go
@@ -0,0 +1,65 @@
+package protocol
+
+import (
+	"encoding/hex"
+	"errors"
+	"net/netip"
+)
+
+type PunchPrediction struct {
+	Address string `json:"address"`
+	Port    int    `json:"port"`
+	Step    int    `json:"step"`
+}
+
+func (v *PunchPrediction) UnmarshalJSON(data []byte) error {
+	*v = PunchPrediction{}
+	type raw PunchPrediction
+	present, err := decodeObject(data, (*raw)(v))
+	if err != nil {
+		return err
+	}
+	if err = present.require("address", "port", "step"); err != nil {
+		return err
+	}
+	address, err := netip.ParseAddr(v.Address)
+	if err != nil || !address.Is4() || v.Port < 1024 || v.Port > 65535 || v.Step < 1 || v.Step > 16 || v.Port+4*v.Step > 65535 {
+		return errors.New("invalid mapping observation")
+	}
+	return nil
+}
+
+type PunchSignal struct {
+	Phase      string           `json:"phase"`
+	Secret     string           `json:"secret,omitempty"`
+	Prediction *PunchPrediction `json:"prediction,omitempty"`
+	Connected  *bool            `json:"connected,omitempty"`
+}
+
+func (v *PunchSignal) UnmarshalJSON(data []byte) error {
+	*v = PunchSignal{}
+	type raw PunchSignal
+	present, err := decodeObject(data, (*raw)(v))
+	if err != nil {
+		return err
+	}
+	if err = present.require("phase"); err != nil {
+		return err
+	}
+	valid := false
+	switch v.Phase {
+	case "prepare":
+		key, keyErr := hex.DecodeString(v.Secret)
+		valid = len(present) == 2 && keyErr == nil && len(key) == 32 && v.Secret == hex.EncodeToString(key)
+	case "ready":
+		valid = len(present) == 1 || (len(present) == 2 && v.Prediction != nil)
+	case "start":
+		valid = len(present) == 2 && v.Prediction != nil
+	case "complete":
+		valid = len(present) == 2 && v.Connected != nil
+	}
+	if !valid {
+		return errors.New("invalid connection preparation phase")
+	}
+	return nil
+}
diff --git a/internal/server/protocol/punch_test.go b/internal/server/protocol/punch_test.go
new file mode 100644
index 000000000..046b6fc01
--- /dev/null
+++ b/internal/server/protocol/punch_test.go
@@ -0,0 +1,47 @@
+package protocol
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+func TestPunchSignalStrictBoundedRoundTrip(t *testing.T) {
+	prediction := `{"address":"198.51.100.1","port":40000,"step":1}`
+	for _, body := range []string{
+		`{"phase":"prepare","secret":"` + strings.Repeat("42", 32) + `"}`,
+		`{"phase":"ready"}`, `{"phase":"ready","prediction":` + prediction + `}`,
+		`{"phase":"start","prediction":` + prediction + `}`,
+		`{"phase":"complete","connected":false}`, `{"phase":"complete","connected":true}`,
+	} {
+		raw := `{"kind":"punch","connectionId":"connection_123456","punch":` + body + `}`
+		var payload SignalPayload
+		if err := json.Unmarshal([]byte(raw), &payload); err != nil {
+			t.Fatalf("%s: %v", body, err)
+		}
+		encoded, err := json.Marshal(payload)
+		if err != nil || string(encoded) != raw {
+			t.Fatalf("round trip %s: %s, %v", raw, encoded, err)
+		}
+	}
+	for _, body := range []string{
+		`{"phase":"prepare","secret":"bad"}`, `{"phase":"prepare","secret":null}`,
+		`{"phase":"ready","prediction":null}`, `{"phase":"ready","connected":true}`,
+		`{"phase":"start"}`, `{"phase":"complete"}`, `{"phase":"complete","connected":null}`,
+		`{"phase":"ready","prediction":` + prediction + `,"secret":"unused"}`,
+		`{"phase":"start","prediction":{"address":"::1","port":40000,"step":1}}`,
+		`{"phase":"start","prediction":{"address":"198.51.100.1","port":65535,"step":1}}`,
+		`{"phase":"start","prediction":{"address":"198.51.100.1","port":40000,"step":17}}`,
+	} {
+		var payload PunchSignal
+		if err := json.Unmarshal([]byte(body), &payload); err == nil {
+			t.Fatalf("accepted %s", body)
+		}
+	}
+	// A decoder reused by a caller must not inherit a previous phase's fields.
+	var phase PunchSignal
+	_ = json.Unmarshal([]byte(`{"phase":"start","prediction":`+prediction+`}`), &phase)
+	if err := json.Unmarshal([]byte(`{"phase":"ready"}`), &phase); err != nil || phase.Prediction != nil {
+		t.Fatal("reused decoder retained a stale endpoint")
+	}
+}
diff --git a/internal/server/protocol/types.go b/internal/server/protocol/types.go
index 88542246a..7efde368b 100644
--- a/internal/server/protocol/types.go
+++ b/internal/server/protocol/types.go
@@ -414,16 +414,26 @@ type SignalPayload struct {
 	ConnectionID string
 	Description  *SessionDescription
 	Candidate    *IceCandidate
+	Punch        *PunchSignal
+	Punched      bool
 }
 
 // MarshalJSON implements json.Marshaler.
 func (v SignalPayload) MarshalJSON() ([]byte, error) {
+	if v.Kind == "punch" {
+		return marshalJSON(struct {
+			Kind         string       `json:"kind"`
+			ConnectionID string       `json:"connectionId"`
+			Punch        *PunchSignal `json:"punch"`
+		}{v.Kind, v.ConnectionID, v.Punch})
+	}
 	if v.Kind == "description" {
 		return marshalJSON(struct {
 			Kind         string              `json:"kind"`
 			ConnectionID string              `json:"connectionId"`
 			Description  *SessionDescription `json:"description"`
-		}{v.Kind, v.ConnectionID, v.Description})
+			Punched      bool                `json:"punched,omitempty"`
+		}{v.Kind, v.ConnectionID, v.Description, v.Punched})
 	}
 	return marshalJSON(struct {
 		Kind         string        `json:"kind"`
@@ -440,11 +450,30 @@ func (v *SignalPayload) UnmarshalJSON(data []byte) error {
 		return err
 	}
 	switch kind {
+	case "punch":
+		var body struct {
+			Kind         string       `json:"kind"`
+			ConnectionID string       `json:"connectionId"`
+			Punch        *PunchSignal `json:"punch"`
+		}
+		present, err := decodeObject(data, &body)
+		if err != nil {
+			return err
+		}
+		if err = present.require("kind", "connectionId", "punch"); err != nil {
+			return err
+		}
+		if !ValidOpaqueID(body.ConnectionID) || body.Punch == nil {
+			return errors.New("invalid connection preparation signal")
+		}
+		*v = SignalPayload{Kind: kind, ConnectionID: body.ConnectionID, Punch: body.Punch}
+		return nil
 	case "description":
 		var body struct {
 			Kind         string              `json:"kind"`
 			ConnectionID string              `json:"connectionId"`
 			Description  *SessionDescription `json:"description"`
+			Punched      bool                `json:"punched,omitempty"`
 		}
 		present, err := decodeObject(data, &body)
 		if err != nil {
@@ -456,7 +485,10 @@ func (v *SignalPayload) UnmarshalJSON(data []byte) error {
 		if !ValidOpaqueID(body.ConnectionID) {
 			return errors.New("connectionId is not an opaque id")
 		}
-		*v = SignalPayload{Kind: kind, ConnectionID: body.ConnectionID, Description: body.Description}
+		if _, exists := present["punched"]; exists && !body.Punched {
+			return errors.New("punched must be true when present")
+		}
+		*v = SignalPayload{Kind: kind, ConnectionID: body.ConnectionID, Description: body.Description, Punched: body.Punched}
 		return nil
 	case "candidate":
 		var body struct {
diff --git a/internal/server/signal/punch_test.go b/internal/server/signal/punch_test.go
new file mode 100644
index 000000000..806bd4072
--- /dev/null
+++ b/internal/server/signal/punch_test.go
@@ -0,0 +1,66 @@
+package signal
+
+import (
+	"testing"
+
+	"github.com/TNTcraftHIM/Piik/internal/server/protocol"
+)
+
+func TestPunchAuthorizationBelongsOnlyToCurrentPeerRetry(t *testing.T) {
+	h := newRouterHarness(t, routerHarnessOptions{capacity: 2})
+	created := h.createRoom()
+	host := h.connectHost(created, &protocol.RoutePolicy{PeerOnly: true, NatPrediction: true}, "", "")
+	viewer := h.connectViewer(created, "punch-viewer")
+	h.locked(func() { h.doComplete(host); h.doComplete(viewer) })
+	for attempt := 1; attempt <= 2; attempt++ {
+		prepared := h.waitPreparedMatching(viewer.sessionID, "peer retry", func(message protocol.RouteUpdatePrepareMessage) bool {
+			return message.Candidate.ConnectionAttempt != nil && int(message.Candidate.ConnectionAttempt.Current) == attempt
+		})
+		h.locked(func() {
+			base := peerSignalInput{roomID: created.RoomID, sourcePeerID: host.peerID, sourceSessionID: host.sessionID,
+				targetPeerID: viewer.peerID, targetSessionID: viewer.sessionID, connectionID: prepared.Candidate.ConnectionID}
+			for _, phase := range []string{"prepare", "start", "ready", "complete", "offer"} {
+				input := base
+				input.signalKind, input.punchPhase = "punch", phase
+				if phase == "ready" || phase == "complete" {
+					input.sourcePeerID, input.targetPeerID = input.targetPeerID, input.sourcePeerID
+					input.sourceSessionID, input.targetSessionID = input.targetSessionID, input.sourceSessionID
+				}
+				if phase == "offer" {
+					input.signalKind, input.punchPhase, input.descriptionType, input.punched = "description", "", "offer", true
+				}
+				want := signalAuthorizationDenied
+				if attempt > 1 {
+					want = signalAuthorizationProbe
+				}
+				if got := h.router.peerSignalAuthorization(input); got != want {
+					t.Fatalf("attempt %d %s: got %d want %d", attempt, phase, got, want)
+				}
+				stale := input
+				stale.connectionID = "retired_connection"
+				if h.router.peerSignalAuthorization(stale) != signalAuthorizationDenied {
+					t.Fatal("stale generation authorized")
+				}
+				stale = input
+				stale.sourceSessionID = "retired_session"
+				if h.router.peerSignalAuthorization(stale) != signalAuthorizationDenied {
+					t.Fatal("stale session authorized")
+				}
+				input.sourcePeerID, input.targetPeerID = input.targetPeerID, input.sourcePeerID
+				input.sourceSessionID, input.targetSessionID = input.targetSessionID, input.sourceSessionID
+				if h.router.peerSignalAuthorization(input) != signalAuthorizationDenied {
+					t.Fatalf("wrong phase direction authorized: %s", phase)
+				}
+			}
+			if attempt == 1 {
+				h.doFailed(viewer, routeFailedMessage(int64(prepared.Revision), "prepare", prepared.Candidate.ConnectionID))
+			} else {
+				h.doReady(viewer, int64(prepared.Revision))
+				base.signalKind, base.punchPhase = "punch", "prepare"
+				if h.router.peerSignalAuthorization(base) != signalAuthorizationDenied {
+					t.Fatal("committed edge authorized another preparation")
+				}
+			}
+		})
+	}
+}
diff --git a/internal/server/signal/router.go b/internal/server/signal/router.go
index a0951e2b8..391ae525d 100644
--- a/internal/server/signal/router.go
+++ b/internal/server/signal/router.go
@@ -125,6 +125,8 @@ type peerSignalInput struct {
 	connectionID    string
 	signalKind      string
 	descriptionType string
+	punchPhase      string
+	punched         bool
 }
 
 // peerSignalDebugInput supplies signal provenance; optional fields are empty.
@@ -564,6 +566,9 @@ const candidateConnectionIDPrefix = "route_"
 func (r *router) peerSignalAuthorization(input peerSignalInput) signalAuthorization {
 	rm, _ := r.rooms.Get(input.roomID)
 	if rm == nil || rm.controller == nil {
+		if input.signalKind == "punch" || input.punched {
+			return signalAuthorizationDenied
+		}
 		return signalAuthorizationUnassigned
 	}
 	controller := rm.controller
@@ -584,16 +589,32 @@ func (r *router) peerSignalAuthorization(input peerSignalInput) signalAuthorizat
 			}
 			if hasParent && hasChild &&
 				parent.SessionID == parentSession &&
-				child.SessionID == childSession &&
-				(input.signalKind == "candidate" ||
+				child.SessionID == childSession {
+				if input.signalKind == "punch" || input.punched {
+					if current.ConnectionAttempt == nil || current.ConnectionAttempt.Current <= 1 {
+						return signalAuthorizationDenied
+					}
+					if (input.punched && parentToChild && input.descriptionType == "offer") ||
+						(parentToChild && (input.punchPhase == "prepare" || input.punchPhase == "start")) ||
+						(childToParent && (input.punchPhase == "ready" || input.punchPhase == "complete")) {
+						return signalAuthorizationProbe
+					}
+					return signalAuthorizationDenied
+				}
+				if input.signalKind == "candidate" ||
 					(parentToChild && input.descriptionType == "offer") ||
-					(childToParent && input.descriptionType == "answer")) {
-				return signalAuthorizationProbe
+					(childToParent && input.descriptionType == "answer") {
+					return signalAuthorizationProbe
+				}
 			}
 			return signalAuthorizationDenied
 		}
 	}
 
+	// Preparation is never an active-edge capability or an unassigned signal.
+	if input.signalKind == "punch" || input.punched {
+		return signalAuthorizationDenied
+	}
 	childPeerID := childForPair(snapshot, input.sourcePeerID, input.targetPeerID)
 	if childPeerID == "" {
 		return signalAuthorizationUnassigned
diff --git a/internal/server/signal/server.go b/internal/server/signal/server.go
index 73a8a0403..bb68f3fb0 100644
--- a/internal/server/signal/server.go
+++ b/internal/server/signal/server.go
@@ -1618,6 +1618,10 @@ func (s *Server) routePeerAssistedSignal(sess *session, source *authenticatedSes
 	if payload.Kind == "description" && payload.Description != nil {
 		descriptionType = payload.Description.Type
 	}
+	punchPhase := ""
+	if payload.Punch != nil {
+		punchPhase = payload.Punch.Phase
+	}
 	candidateAuthorized := s.router.peerSignalAuthorization(peerSignalInput{
 		roomID:          source.roomID,
 		sourcePeerID:    source.peerID,
@@ -1627,6 +1631,8 @@ func (s *Server) routePeerAssistedSignal(sess *session, source *authenticatedSes
 		connectionID:    payload.ConnectionID,
 		signalKind:      payload.Kind,
 		descriptionType: descriptionType,
+		punchPhase:      punchPhase,
+		punched:         payload.Punched,
 	})
 	debugInput := peerSignalDebugInput{
 		roomID:          source.roomID,
diff --git a/src/client/native/client.ts b/src/client/native/client.ts
index 7deaf2836..37eae833c 100644
--- a/src/client/native/client.ts
+++ b/src/client/native/client.ts
@@ -6,6 +6,7 @@ import type {
   QualitySettings,
   SignalPayload,
   SfuSignalMessage,
+  PunchPrediction,
 } from "../../shared/protocol";
 import { createOpaqueId } from "../lib/opaque-id";
 import {
@@ -35,6 +36,8 @@ import {
   sourceListResponseSchema,
   microphoneListResponseSchema,
   sourcePreviewResponseSchema,
+  punchPreparedResponseSchema,
+  punchCompleteResponseSchema,
   type NativeAdapter,
   type NativeClientEvent,
   type NativeHealth,
@@ -395,12 +398,14 @@ export class NativeClient {
     connectionId: string,
     iceConfig: IceConfig,
     sourceConnectionId?: string,
+    punched = false,
   ): Promise<RTCSessionDescriptionInit> {
     const response = await this.request(
       "prepare-edge",
       {
         shareId,
         connectionId,
+        ...(punched ? { punched: true } : {}),
         ...(sourceConnectionId ? { sourceConnectionId } : {}),
         iceServers: iceConfig.iceServers.map((server) => ({
           urls: Array.isArray(server.urls) ? server.urls : [server.urls],
@@ -417,6 +422,24 @@ export class NativeClient {
     return { type: "offer", sdp: response.sdp };
   }
 
+  async preparePunch(shareId: string, connectionId: string, iceConfig: IceConfig,
+    secret: string, edgeCapacity: number, sourceConnectionId?: string): Promise<PunchPrediction | null> {
+    const response = await this.request("prepare-punch", {
+      shareId, connectionId, secret, edgeCapacity,
+      ...(sourceConnectionId ? { sourceConnectionId } : {}),
+      iceServers: iceConfig.iceServers.map(server => ({ urls: Array.isArray(server.urls) ? server.urls : [server.urls] })),
+    }, punchPreparedResponseSchema);
+    return response.prediction;
+  }
+
+  async runPunch(shareId: string, connectionId: string, prediction: PunchPrediction): Promise<boolean> {
+    return (await this.request("run-punch", { shareId, connectionId, prediction }, punchCompleteResponseSchema)).connected;
+  }
+
+  async closePunch(shareId: string, connectionId: string): Promise<void> {
+    await this.request("close-punch", { shareId, connectionId }, nativeAckResponseSchema);
+  }
+
   async preparePublication(
     shareId: string,
     publicationGeneration: string,
@@ -551,6 +574,7 @@ export class NativeClient {
     offer: RTCSessionDescriptionInit,
     iceConfig: IceConfig,
     edgeCapacity: number,
+    punched = false,
   ): Promise<{
     answer: { type: "answer"; sdp: string };
     audio: boolean;
@@ -567,6 +591,7 @@ export class NativeClient {
         connectionId,
         ...(this.health.nativeMedia.receiverReuse ? { reuseReceiver: true } : {}),
         edgeCapacity,
+        ...(punched ? { punched: true } : {}),
         iceServers: iceConfig.iceServers.map((server) => ({
           urls: Array.isArray(server.urls) ? server.urls : [server.urls],
         })),
@@ -618,7 +643,7 @@ export class NativeClient {
     payload: SignalPayload,
     offerId?: string,
   ): Promise<void> {
-    if (payload.connectionId !== connectionId) return;
+    if (payload.connectionId !== connectionId || payload.kind === "punch") return;
     if (payload.kind === "description") {
       if (payload.description.type !== "answer") return;
       await this.request(
diff --git a/src/client/native/media-ingress.ts b/src/client/native/media-ingress.ts
index 717ebf51e..937defdd2 100644
--- a/src/client/native/media-ingress.ts
+++ b/src/client/native/media-ingress.ts
@@ -124,6 +124,7 @@ export class NativeMediaIngress {
   }
 
   private async sendSignal(payload: SignalPayload): Promise<void> {
+    if (payload.kind === "punch") return;
     if (payload.kind === "candidate") {
       if (!this.receiverReady) {
         if (this.pendingCandidates.length >= MAX_PENDING_CANDIDATES) throw new Error("Native candidate queue is full");
diff --git a/src/client/native/native-punch.ts b/src/client/native/native-punch.ts
new file mode 100644
index 000000000..e578e0615
--- /dev/null
+++ b/src/client/native/native-punch.ts
@@ -0,0 +1,151 @@
+import type { IceConfig, PunchPrediction, PunchSignal, SignalPayload } from "../../shared/protocol";
+import { debugEvent } from "../lib/debug";
+import { natPredictionSurveyUrls } from "../webrtc/nat-prediction";
+
+const PREPARATION_TIMEOUT_MS = 3_500;
+
+export interface NativePunchControl {
+  preparePunch(shareId: string, connectionId: string, ice: IceConfig, secret: string,
+    edgeCapacity: number, sourceConnectionId?: string): Promise<PunchPrediction | null>;
+  runPunch(shareId: string, connectionId: string, remote: PunchPrediction): Promise<boolean>;
+  closePunch(shareId: string, connectionId: string): Promise<void>;
+}
+
+export function punchIceConfig(ice: Pick<RTCConfiguration, "iceServers"> & { natPredictionStunUrls?: readonly string[] }): IceConfig | null {
+  const urls = [...natPredictionSurveyUrls(ice.iceServers, ice.natPredictionStunUrls)];
+  return urls.length === 3 ? { iceServers: [{ urls }] } : null;
+}
+
+type SendPunch = (payload: SignalPayload) => boolean;
+
+// This short preparation belongs to an existing server-issued retry. Ordinary
+// ICE starts after it; only mutual success authorizes both ends to consume their
+// prepared sockets. No route, media readiness, or retry authority lives here.
+export class NativePunchSender {
+  private closed = false;
+  private timer: ReturnType<typeof setTimeout> | null = null;
+  private finishResult: ((value: boolean) => void) | null = null;
+  private prediction: Promise<PunchPrediction | null> = Promise.resolve(null);
+  private local: boolean | null = null;
+  private remote: boolean | null = null;
+  private readyReceived = false;
+
+  constructor(private readonly control: NativePunchControl, private readonly shareId: string,
+    readonly connectionId: string, private readonly ice: IceConfig,
+    private readonly send: SendPunch, private readonly sourceConnectionId?: string) {}
+
+  start(): Promise<boolean> {
+    const secret = Array.from(crypto.getRandomValues(new Uint8Array(32)), byte => byte.toString(16).padStart(2, "0")).join("");
+    return new Promise(resolve => {
+      this.finishResult = resolve;
+      this.timer = setTimeout(() => this.finish(false), PREPARATION_TIMEOUT_MS);
+      this.prediction = this.control.preparePunch(this.shareId, this.connectionId, this.ice, secret, 3, this.sourceConnectionId)
+        .catch(() => null);
+      if (!this.send({ kind: "punch", connectionId: this.connectionId, punch: { phase: "prepare", secret } })) {
+        this.finish(false);
+      }
+    });
+  }
+
+  accept(signal: PunchSignal): void {
+    if (this.closed || !this.finishResult) return;
+    if (signal.phase === "ready" && !this.readyReceived) {
+      this.readyReceived = true;
+      if (!signal.prediction) { this.finish(false); return; }
+      const remote = signal.prediction;
+      void this.prediction.then(async local => {
+        if (this.closed || !this.finishResult) return;
+        if (!local || !this.send({ kind: "punch", connectionId: this.connectionId,
+          punch: { phase: "start", prediction: local } })) {
+          this.finish(false);
+          return;
+        }
+        this.local = await this.control.runPunch(this.shareId, this.connectionId, remote).catch(() => false);
+        this.maybeFinish();
+      });
+    } else if (signal.phase === "complete" && this.readyReceived) {
+      this.remote = signal.connected;
+      this.maybeFinish();
+    }
+  }
+
+  dispose(): void {
+    if (this.closed) return;
+    this.closed = true;
+    this.finish(false);
+    void this.control.closePunch(this.shareId, this.connectionId).catch(() => undefined);
+  }
+
+  private maybeFinish(): void {
+    if (this.local === false || this.remote === false) this.finish(false);
+    else if (this.local === true && this.remote === true) this.finish(true);
+  }
+
+  private finish(value: boolean): void {
+    if (this.timer !== null) clearTimeout(this.timer);
+    this.timer = null;
+    const resolve = this.finishResult;
+    this.finishResult = null;
+    if (!resolve) return;
+    debugEvent("native", "punch-prepared", { connectionId: this.connectionId, connected: value });
+    if (!value) void this.control.closePunch(this.shareId, this.connectionId).catch(() => undefined);
+    resolve(value);
+  }
+}
+
+export class NativePunchReceiver {
+  private closed = false;
+  private control: NativePunchControl | null = null;
+  private timer: ReturnType<typeof setTimeout> | null = null;
+  private ready = false;
+  private started = false;
+  private connected = false;
+
+  constructor(readonly peerId: string, readonly connectionId: string,
+    private readonly shareId: string, private readonly ice: IceConfig,
+    private readonly capacity: number, private readonly acquire: () => Promise<NativePunchControl | null>,
+    private readonly send: SendPunch) {}
+
+  async prepare(secret: string): Promise<void> {
+    this.timer = setTimeout(() => this.dispose(), PREPARATION_TIMEOUT_MS);
+    const control = await this.acquire().catch(() => null);
+    if (this.closed) return;
+    this.control = control;
+    const prediction = control
+      ? await control.preparePunch(this.shareId, this.connectionId, this.ice, secret, this.capacity).catch(() => null)
+      : null;
+    if (this.closed) return;
+    this.ready = prediction !== null;
+    this.send({ kind: "punch", connectionId: this.connectionId,
+      punch: { phase: "ready", ...(prediction ? { prediction } : {}) } });
+    if (!prediction) this.dispose();
+  }
+
+  async run(prediction: PunchPrediction): Promise<void> {
+    if (this.closed || !this.control || !this.ready || this.started) return;
+    this.started = true;
+    this.connected = await this.control.runPunch(this.shareId, this.connectionId, prediction).catch(() => false);
+    if (this.closed) return;
+    this.send({ kind: "punch", connectionId: this.connectionId,
+      punch: { phase: "complete", connected: this.connected } });
+    if (!this.connected) this.dispose();
+  }
+
+  // The SDP offer is the commit decision. The App's five-second resource bound
+  // still applies if its browser disappears before consuming the socket.
+  commit(): boolean {
+    if (this.closed || !this.connected) return false;
+    this.closed = true;
+    if (this.timer !== null) clearTimeout(this.timer);
+    this.timer = null;
+    return true;
+  }
+
+  dispose(): void {
+    if (this.closed) return;
+    this.closed = true;
+    if (this.timer !== null) clearTimeout(this.timer);
+    this.timer = null;
+    void this.control?.closePunch(this.shareId, this.connectionId).catch(() => undefined);
+  }
+}
diff --git a/src/client/native/native-sender-edge.ts b/src/client/native/native-sender-edge.ts
index 580527911..d3f03467a 100644
--- a/src/client/native/native-sender-edge.ts
+++ b/src/client/native/native-sender-edge.ts
@@ -7,16 +7,18 @@ import {
   type SignalCandidate,
 } from "../webrtc/nat-prediction";
 import type { NativeClientEvent } from "./wire";
+import { NativePunchSender, punchIceConfig, type NativePunchControl } from "./native-punch";
 
 const MAX_PENDING_CANDIDATES = 64;
 
-export interface NativeEdgeControl {
+export interface NativeEdgeControl extends NativePunchControl {
   updateShare(shareId: string, profile: QualitySettings): Promise<void>;
   prepareEdge(
     shareId: string,
     connectionId: string,
     iceConfig: IceConfig,
     sourceConnectionId?: string,
+    punched?: boolean,
   ): Promise<RTCSessionDescriptionInit>;
   acceptSignal(
     shareId: string,
@@ -48,6 +50,7 @@ export class NativeSenderEdge {
   private offerSent = false;
   private disposed = false;
   private connected = false;
+  private punch: NativePunchSender | null = null;
 
   constructor(
     readonly peerId: string,
@@ -58,6 +61,7 @@ export class NativeSenderEdge {
     private readonly control: NativeEdgeControl,
     private readonly events: NativeSenderEdgeEvents,
     private readonly sourceConnectionId?: string,
+    private readonly retry = false,
   ) {
     const predictionEnabled =
       natPredictionEnabled &&
@@ -84,12 +88,23 @@ export class NativeSenderEdge {
     if (this.disposed || this.unsubscribe) return false;
     this.unsubscribe = this.control.onEvent((event) => this.onEvent(event));
     try {
+      let punched = false;
+      const survey = this.retry && this.localIceCandidates ? punchIceConfig(this.iceConfig) : null;
+      if (survey) {
+        this.punch = new NativePunchSender(this.control, this.shareId, this.connectionId, survey,
+          payload => this.events.sendSignal(this.peerId, payload), this.sourceConnectionId);
+        punched = await this.punch.start();
+        if (this.disposed) return false;
+      }
       const offer = await this.control.prepareEdge(
         this.shareId,
         this.connectionId,
         this.iceConfig,
         this.sourceConnectionId,
+        punched,
       );
+      this.punch?.dispose();
+      this.punch = null;
       if (
         this.disposed ||
         offer.type !== "offer" ||
@@ -98,6 +113,7 @@ export class NativeSenderEdge {
           kind: "description",
           connectionId: this.connectionId,
           description: { type: "offer", sdp: offer.sdp },
+          ...(punched ? { punched: true } : {}),
         })
       ) {
         this.dispose();
@@ -116,6 +132,10 @@ export class NativeSenderEdge {
 
   async acceptSignal(payload: SignalPayload): Promise<void> {
     if (this.disposed || payload.connectionId !== this.connectionId) return;
+    if (payload.kind === "punch") {
+      this.punch?.accept(payload.punch);
+      return;
+    }
     await this.control.acceptSignal(
       this.shareId,
       this.connectionId,
@@ -131,6 +151,8 @@ export class NativeSenderEdge {
     if (this.disposed) return;
     this.disposed = true;
     this.connected = false;
+    this.punch?.dispose();
+    this.punch = null;
     this.pendingCandidates.length = 0;
     this.localIceCandidates?.discard();
     this.unsubscribe?.();
diff --git a/src/client/native/native-sender-peer.ts b/src/client/native/native-sender-peer.ts
index 32adc90a5..43369efa2 100644
--- a/src/client/native/native-sender-peer.ts
+++ b/src/client/native/native-sender-peer.ts
@@ -44,6 +44,7 @@ export class NativeSenderPeer implements HostMediaPeer {
     events: NativeSenderPeerEvents,
     codec: NativeVideoCodec,
     private readonly source?: NativeSenderSource,
+    retry = false,
   ) {
     this.connectionId = connectionId;
     this.snapshot = {
@@ -139,6 +140,7 @@ export class NativeSenderPeer implements HostMediaPeer {
         },
       },
       this.source?.connectionId,
+      retry,
     );
     this.events = events;
   }
diff --git a/src/client/native/native-viewer-peer.ts b/src/client/native/native-viewer-peer.ts
index 7ef98690d..a6b564116 100644
--- a/src/client/native/native-viewer-peer.ts
+++ b/src/client/native/native-viewer-peer.ts
@@ -28,6 +28,7 @@ import {
 import { NativeClient } from "./client";
 import { NativeMediaBridge } from "./media-bridge";
 import type { NativeClientEvent, NativeVideoCodec } from "./wire";
+import { NativePunchReceiver, punchIceConfig } from "./native-punch";
 
 
 export interface NativeViewerSource {
@@ -52,6 +53,7 @@ export class NativeCapableViewerPeer implements ViewerMediaPeer {
   private identity: { parentPeerId: string; connectionId: string } | null = null;
   private signalTail: Promise<void> = Promise.resolve();
   private currentIceConfig: PeerIceConfig;
+  private punch: NativePunchReceiver | null = null;
 
   constructor(
     iceConfig: PeerIceConfig,
@@ -70,6 +72,26 @@ export class NativeCapableViewerPeer implements ViewerMediaPeer {
   }
 
   acceptSignal(parentPeerId: string, payload: SignalPayload): Promise<void> {
+    if (payload.kind === "punch") {
+      if (this.disposed) return Promise.resolve();
+      const survey = this.options.natPredictionEnabled && this.options.recoveryOwner === "route"
+        ? punchIceConfig(this.currentIceConfig) : null;
+      if (payload.punch.phase === "prepare") {
+        if (this.identity?.connectionId === payload.connectionId) return Promise.resolve();
+        if (!survey) {
+          this.events.sendSignal(parentPeerId, { kind: "punch", connectionId: payload.connectionId, punch: { phase: "ready" } });
+        } else if (!this.punch) {
+          this.punch = new NativePunchReceiver(parentPeerId, payload.connectionId, this.nativeSessionId,
+            survey, this.edgeCapacity, this.acquireNativeClient,
+            signal => !this.disposed && this.events.sendSignal(parentPeerId, signal));
+          void this.punch.prepare(payload.punch.secret);
+        }
+      } else if (payload.punch.phase === "start" && this.punch?.peerId === parentPeerId &&
+        this.punch.connectionId === payload.connectionId) {
+        void this.punch.run(payload.punch.prediction);
+      }
+      return Promise.resolve();
+    }
     const work = async () => {
       if (this.disposed) return;
       if (
@@ -82,6 +104,19 @@ export class NativeCapableViewerPeer implements ViewerMediaPeer {
         return;
       }
       if (payload.kind === "description" && payload.description.type === "offer") {
+        const preparation = this.punch;
+        this.punch = null;
+        const committed = payload.punched && preparation?.peerId === parentPeerId &&
+          preparation.connectionId === payload.connectionId && preparation.commit();
+        if (!committed) {
+          preparation?.dispose();
+          if (payload.punched) {
+            // An expired optional preparation is a route failure, not evidence
+            // that the App's media capability is unavailable for this session.
+            this.events.onRecoveryExhausted?.(parentPeerId, payload.connectionId);
+            return;
+          }
+        }
         const nextIdentity = {
           parentPeerId,
           connectionId: payload.connectionId,
@@ -165,6 +200,8 @@ export class NativeCapableViewerPeer implements ViewerMediaPeer {
   dispose(): void {
     if (this.disposed) return;
     this.disposed = true;
+    this.punch?.dispose();
+    this.punch = null;
     this.backend?.dispose();
     this.backend = null;
     this.identity = null;
@@ -254,6 +291,7 @@ class NativeViewerPeer implements ViewerMediaPeer {
 
   async acceptSignal(parentPeerId: string, payload: SignalPayload): Promise<void> {
     if (this.disposed) return;
+    if (payload.kind === "punch") return;
     if (payload.kind === "candidate") {
       if (
         this.parentPeerId !== parentPeerId ||
@@ -276,7 +314,11 @@ class NativeViewerPeer implements ViewerMediaPeer {
     try {
       await this.acceptOffer(parentPeerId, payload);
     } catch {
-      this.handleBridgeFailure(payload.connectionId);
+      if (payload.punched) {
+        this.retireFailedConnection(payload.connectionId);
+      } else {
+        this.handleBridgeFailure(payload.connectionId);
+      }
     }
   }
 
@@ -435,6 +477,7 @@ class NativeViewerPeer implements ViewerMediaPeer {
     try {
       result = await this.client.receiveOffer(
         this.sessionId, connectionId, payload.description, nativeIceConfig, this.edgeCapacity,
+        payload.punched === true,
       );
     } finally {
       if (this.pendingOffer === pending) this.pendingOffer = null;
@@ -480,16 +523,7 @@ class NativeViewerPeer implements ViewerMediaPeer {
       // A room-signaling outage is not evidence the local Native capability is
       // unavailable: close only this receiver and use the ordinary recovery
       // path, like the Browser peer's "signal send rejected" handling.
-      this.sourceReady = false;
-      this.sourceCodec = null;
-      void this.client.closeReceiver(this.sessionId, connectionId).catch(
-        () => undefined,
-      );
-      if (this.recoveryOwner === "route") {
-        this.reportRecoveryExhausted();
-      } else {
-        this.attemptAutomaticRecovery(true);
-      }
+      this.retireFailedConnection(connectionId);
       return;
     }
     this.scheduleInitialConnectionDeadline(connectionId);
@@ -518,6 +552,15 @@ class NativeViewerPeer implements ViewerMediaPeer {
     else this.handleBridgeFailure(connectionId);
   }
 
+  private retireFailedConnection(connectionId: string): void {
+    if (this.disposed || this.connectionId !== connectionId) return;
+    this.sourceReady = false;
+    this.sourceCodec = null;
+    void this.client.closeReceiver(this.sessionId, connectionId).catch(() => undefined);
+    if (this.recoveryOwner === "route") this.reportRecoveryExhausted();
+    else this.attemptAutomaticRecovery(true);
+  }
+
   private onEvent(event: NativeClientEvent): void {
     if (this.disposed || this.failureNotified || event.shareId !== this.sessionId) {
       return;
diff --git a/src/client/native/wire.ts b/src/client/native/wire.ts
index 07b97a07b..ffc46ac9b 100644
--- a/src/client/native/wire.ts
+++ b/src/client/native/wire.ts
@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { sfuMediaSchema, positiveUint32Schema, qualityResolutionSchema,
+import { sfuMediaSchema, positiveUint32Schema, qualityResolutionSchema, punchPredictionSchema,
   nullableSafeEvidenceNumber, nullableSafeEvidenceInteger } from "../../shared/protocol";
 
 export const NATIVE_CLIENT_PROTOCOL = 10;
@@ -125,6 +125,13 @@ const responseBase = {
   id: opaqueIdentifierSchema,
 };
 
+export const punchPreparedResponseSchema = z.object({
+  ...responseBase, type: z.literal("punch-prepared"), prediction: punchPredictionSchema.nullable(),
+}).strict();
+export const punchCompleteResponseSchema = z.object({
+  ...responseBase, type: z.literal("punch-complete"), connected: z.boolean(),
+}).strict();
+
 const nativeVideoCodecSchema = z.enum(["h264", "vp8"]);
 export type NativeVideoCodec = z.infer<typeof nativeVideoCodecSchema>;
 
@@ -242,6 +249,7 @@ export const nativeAckResponseSchema = z
       "edge-answer-accepted",
       "edge-candidate-accepted",
       "edge-closed",
+	  "punch-closed",
       "receive-candidate-accepted",
       "receiver-closed",
       "receive-stopped",
diff --git a/src/client/pages/HostPage.tsx b/src/client/pages/HostPage.tsx
index 903df0d34..5e8afb432 100644
--- a/src/client/pages/HostPage.tsx
+++ b/src/client/pages/HostPage.tsx
@@ -2107,6 +2107,7 @@ export function HostPage({
                 events,
                 videoCodecRef.current.primary,
                 nativeMediaIngressRef.current?.source,
+                (candidate.connectionAttempt?.current ?? 1) > 1,
               );
             }
           : undefined,
@@ -2178,7 +2179,7 @@ export function HostPage({
     const peerEvents: {
       sendSignal: (
         targetPeerId: string,
-        payload: Extract<SignalPayload, { kind: "description" | "candidate" }>,
+        payload: SignalPayload,
       ) => boolean;
       onUpdate: (snapshot: PeerSnapshot) => void;
     } = {
diff --git a/src/client/pages/ViewerPage.tsx b/src/client/pages/ViewerPage.tsx
index 34f04aab0..3ae8111a0 100644
--- a/src/client/pages/ViewerPage.tsx
+++ b/src/client/pages/ViewerPage.tsx
@@ -761,6 +761,7 @@ export function ViewerPage({
                         };
                       },
                     },
+                    (candidate?.connectionAttempt?.current ?? 1) > 1,
                   ),
           }
         : null;
diff --git a/src/client/webrtc/host-peer.ts b/src/client/webrtc/host-peer.ts
index b4322ea36..057ac02a5 100644
--- a/src/client/webrtc/host-peer.ts
+++ b/src/client/webrtc/host-peer.ts
@@ -436,7 +436,7 @@ export class HostPeer {
   }
 
   async acceptSignal(payload: SignalPayload): Promise<void> {
-    if (this.disposed || payload.connectionId !== this.connectionId) {
+    if (this.disposed || payload.connectionId !== this.connectionId || payload.kind === "punch") {
       return;
     }
 
diff --git a/src/client/webrtc/viewer-peer.ts b/src/client/webrtc/viewer-peer.ts
index d5da408e0..dfa55576a 100644
--- a/src/client/webrtc/viewer-peer.ts
+++ b/src/client/webrtc/viewer-peer.ts
@@ -128,6 +128,12 @@ export class ViewerPeer implements ViewerMediaPeer {
     if (this.disposed) {
       return;
     }
+    if (payload.kind === "punch") {
+      if (payload.punch.phase === "prepare") this.events.sendSignal(parentPeerId, {
+        kind: "punch", connectionId: payload.connectionId, punch: { phase: "ready" },
+      });
+      return;
+    }
     if (payload.kind === "description") {
       if (payload.description.type !== "offer") {
         return;
diff --git a/src/shared/protocol.ts b/src/shared/protocol.ts
index b11e6dd2f..9b0aca705 100644
--- a/src/shared/protocol.ts
+++ b/src/shared/protocol.ts
@@ -324,12 +324,29 @@ const iceCandidateSchema = z
   })
   .strict();
 
+export const punchPredictionSchema = z.object({
+  address: z.ipv4(),
+  port: z.number().int().min(1024).max(65535),
+  step: z.number().int().min(1).max(16),
+}).strict().refine(({ port, step }) => port + 4 * step <= 65535);
+export type PunchPrediction = z.infer<typeof punchPredictionSchema>;
+
+export const punchSignalSchema = z.discriminatedUnion("phase", [
+  z.object({ phase: z.literal("prepare"), secret: z.string().regex(/^[0-9a-f]{64}$/) }).strict(),
+  z.object({ phase: z.literal("ready"), prediction: punchPredictionSchema.optional() }).strict(),
+  z.object({ phase: z.literal("start"), prediction: punchPredictionSchema }).strict(),
+  z.object({ phase: z.literal("complete"), connected: z.boolean() }).strict(),
+]);
+export type PunchSignal = z.infer<typeof punchSignalSchema>;
+
 export const signalPayloadSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("punch"), connectionId: opaqueIdSchema, punch: punchSignalSchema }).strict(),
   z
     .object({
       kind: z.literal("description"),
       connectionId: opaqueIdSchema,
       description: sessionDescriptionSchema,
+      punched: z.literal(true).optional(),
     })
     .strict(),
   z
diff --git a/tests/native-punch.test.ts b/tests/native-punch.test.ts
new file mode 100644
index 000000000..bdfcab4dd
--- /dev/null
+++ b/tests/native-punch.test.ts
@@ -0,0 +1,106 @@
+import { afterEach, expect, it, vi } from "vitest";
+import { NativePunchReceiver, NativePunchSender, type NativePunchControl } from "../src/client/native/native-punch";
+import type { PunchPrediction, SignalPayload } from "../src/shared/protocol";
+
+afterEach(() => { vi.useRealTimers(); vi.restoreAllMocks(); });
+
+const prediction: PunchPrediction = { address: "198.51.100.1", port: 40000, step: 1 };
+const ice = { iceServers: [] };
+const control = () => ({
+  preparePunch: vi.fn<NativePunchControl["preparePunch"]>(async () => prediction),
+  runPunch: vi.fn<NativePunchControl["runPunch"]>(async () => true),
+  closePunch: vi.fn<NativePunchControl["closePunch"]>(async () => undefined),
+});
+const flush = async () => { for (let i = 0; i < 12; i++) await Promise.resolve(); };
+
+it.each(["success", "receiver-fails", "sender-fails", "browser", "timeout", "dispose"])(
+  "uses one bounded preparation and requires mutual success: %s", async outcome => {
+    vi.useFakeTimers();
+    const source = control();
+    const target = control();
+    const sent: SignalPayload[] = [];
+    if (outcome === "receiver-fails") target.runPunch.mockResolvedValue(false);
+    if (outcome === "sender-fails") source.runPunch.mockResolvedValue(false);
+    let receiver!: NativePunchReceiver;
+    const sender = new NativePunchSender(source, "share", "connection", ice, payload => {
+      sent.push(payload);
+      if (payload.kind !== "punch" || outcome === "timeout" || outcome === "dispose") return true;
+      if (payload.punch.phase === "prepare") {
+        if (outcome === "browser") sender.accept({ phase: "ready" });
+        else void receiver.prepare(payload.punch.secret);
+      } else if (payload.punch.phase === "start") void receiver.run(payload.punch.prediction);
+      return true;
+    });
+    receiver = new NativePunchReceiver("parent", "connection", "share", ice, 2, async () => target, payload => {
+      if (payload.kind === "punch") sender.accept(payload.punch);
+      return true;
+    });
+    try {
+      const result = sender.start();
+      if (outcome === "dispose") sender.dispose();
+      await flush();
+      if (outcome === "timeout") await vi.advanceTimersByTimeAsync(3_500);
+      expect(await result).toBe(outcome === "success");
+      expect(source.preparePunch).toHaveBeenCalledOnce();
+      if (outcome === "success") {
+        expect(receiver.commit()).toBe(true);
+        expect(source.closePunch).not.toHaveBeenCalled();
+        expect(target.closePunch).not.toHaveBeenCalled();
+        // The SDP commit consumes the prepared sockets; duplicate preflight
+        // phases cannot allocate more sockets or send a second start.
+        sender.accept({ phase: "ready", prediction });
+        await receiver.run(prediction);
+        await flush();
+        expect(source.runPunch).toHaveBeenCalledOnce();
+        expect(target.runPunch).toHaveBeenCalledOnce();
+      } else {
+        expect(source.closePunch).toHaveBeenCalled();
+      }
+      if (["browser", "timeout", "dispose"].includes(outcome)) expect(source.runPunch).not.toHaveBeenCalled();
+      const prepare = sent[0];
+      expect(prepare.kind === "punch" && prepare.punch.phase === "prepare" && prepare.punch.secret).toMatch(/^[a-f0-9]{64}$/);
+    } finally { sender.dispose(); receiver.dispose(); }
+  },
+);
+
+it("does not allocate after late App discovery or revive an expired receiver", async () => {
+  vi.useFakeTimers();
+  const target = control();
+  let discovered!: (value: NativePunchControl) => void;
+  const sent = vi.fn(() => true);
+  const receiver = new NativePunchReceiver("parent", "connection", "share", ice, 2,
+    () => new Promise(resolve => { discovered = resolve; }), sent);
+  const prepared = receiver.prepare("42".repeat(32));
+  await vi.advanceTimersByTimeAsync(3_500);
+  discovered(target);
+  await prepared;
+  expect(target.preparePunch).not.toHaveBeenCalled();
+  expect(sent).not.toHaveBeenCalled();
+  expect(receiver.commit()).toBe(false);
+});
+
+it("retires successful sockets if their SDP never arrives", async () => {
+  vi.useFakeTimers();
+  const target = control();
+  const receiver = new NativePunchReceiver("parent", "connection", "share", ice, 2, async () => target, () => true);
+  await receiver.prepare("42".repeat(32));
+  await receiver.run(prediction);
+  await vi.advanceTimersByTimeAsync(3_500);
+  expect(receiver.commit()).toBe(false);
+  expect(target.closePunch).toHaveBeenCalledExactlyOnceWith("share", "connection");
+});
+
+it("ignores late success after sender cancellation", async () => {
+  vi.useFakeTimers();
+  const source = control();
+  let complete!: (value: boolean) => void;
+  source.runPunch.mockImplementation(() => new Promise(resolve => { complete = resolve; }));
+  const sender = new NativePunchSender(source, "share", "connection", ice, () => true);
+  const result = sender.start();
+  sender.accept({ phase: "ready", prediction });
+  await flush();
+  sender.dispose();
+  complete(true);
+  sender.accept({ phase: "complete", connected: true });
+  expect(await result).toBe(false);
+});
diff --git a/tests/native-sender-edge.test.ts b/tests/native-sender-edge.test.ts
index 218844124..7dfc8985b 100644
--- a/tests/native-sender-edge.test.ts
+++ b/tests/native-sender-edge.test.ts
@@ -7,13 +7,16 @@ import {
 } from "../src/client/native/native-sender-edge";
 import type { NativeClientEvent } from "../src/client/native/wire";
 
-function fixture(natPrediction = false, extraStun = false) {
+function fixture(natPrediction = false, extraStun = false, retry = false) {
   let listener: ((event: NativeClientEvent) => void) | null = null;
   const prepareEdge = vi.fn<NativeEdgeControl["prepareEdge"]>(async () => ({
     type: "offer",
     sdp: "v=0\r\n",
   }));
   const control: NativeEdgeControl = {
+    preparePunch: vi.fn(async () => null),
+    runPunch: vi.fn(async () => false),
+    closePunch: vi.fn(async () => undefined),
     updateShare: vi.fn(async () => undefined),
     prepareEdge,
     acceptSignal: vi.fn(async () => undefined),
@@ -50,6 +53,7 @@ function fixture(natPrediction = false, extraStun = false) {
       sendSignal,
       onState: (state) => states.push(state),
     },
+    undefined, retry,
   );
   return {
     edge,
@@ -62,6 +66,22 @@ function fixture(natPrediction = false, extraStun = false) {
 }
 
 describe("native sender edge adapter", () => {
+  it("keeps initial ICE immediate and falls through immediately for a Browser retry", async () => {
+    const initial = fixture(true);
+    expect(await initial.edge.start()).toBe(true);
+    expect(initial.control.preparePunch).not.toHaveBeenCalled();
+    initial.edge.dispose();
+
+    const retry = fixture(true, false, true);
+    const started = retry.edge.start();
+    expect(retry.sent[0].kind).toBe("punch");
+    await retry.edge.acceptSignal({ kind: "punch", connectionId: "edge_12345678", punch: { phase: "ready" } });
+    expect(await started).toBe(true);
+    expect(retry.control.runPunch).not.toHaveBeenCalled();
+    expect(retry.control.prepareEdge).toHaveBeenCalledWith("share_1234567", "edge_12345678", expect.anything(), undefined, false);
+    expect(retry.sent.find(signal => signal.kind === "description")).not.toHaveProperty("punched");
+    retry.edge.dispose();
+  });
   it.each([null, { candidate: "candidate:1 1 udp 1 127.0.0.1 9 typ host" }])(
     "keeps connected media when trickle signaling is unavailable: %j", async (candidate) => {
       const current = fixture();
diff --git a/tests/native-sender-peer.test.ts b/tests/native-sender-peer.test.ts
index 91b8123b4..3c9d242df 100644
--- a/tests/native-sender-peer.test.ts
+++ b/tests/native-sender-peer.test.ts
@@ -18,6 +18,9 @@ describe("native Host peer quality", () => {
     invalidateSenderQualityEvidence();
     let listener: (event: NativeClientEvent) => void = () => undefined;
     const control: NativeEdgeControl = {
+    preparePunch: vi.fn(async () => null),
+    runPunch: vi.fn(async () => false),
+    closePunch: vi.fn(async () => undefined),
       updateShare: vi.fn(async () => undefined),
       prepareEdge: vi.fn<NativeEdgeControl["prepareEdge"]>(async () => ({
         type: "offer",
@@ -117,6 +120,9 @@ describe("native Host peer quality", () => {
   it("applies the latest relay ceiling before preparing a child", async () => {
     let profile: QualitySettings = DEFAULT_QUALITY_SETTINGS;
     const control: NativeEdgeControl = {
+    preparePunch: vi.fn(async () => null),
+    runPunch: vi.fn(async () => false),
+    closePunch: vi.fn(async () => undefined),
       updateShare: vi.fn(async () => undefined),
       prepareEdge: vi.fn(async () => ({ type: "offer" as const, sdp: "v=0\r\n" })),
       acceptSignal: vi.fn(async () => undefined),
diff --git a/tests/native-viewer-peer.test.ts b/tests/native-viewer-peer.test.ts
index 4643467f6..a6f2cc598 100644
--- a/tests/native-viewer-peer.test.ts
+++ b/tests/native-viewer-peer.test.ts
@@ -16,6 +16,52 @@ afterEach(() => {
   vi.unstubAllGlobals();
 });
 
+it.each(["commit", "expired", "rpc-expired"])("scopes optional connection preparation to its route: %s", async outcome => {
+  vi.useFakeTimers();
+  vi.stubGlobal("window", globalThis);
+  vi.stubGlobal("MediaStream", class { getTracks() { return []; } });
+  vi.stubGlobal("RTCPeerConnection", class { close() {} });
+  vi.spyOn(NativeMediaBridge.prototype, "start").mockResolvedValue({} as MediaStream);
+  const client = {
+    preparePunch: vi.fn(async () => ({ address: "198.51.100.1", port: 40000, step: 1 })),
+    runPunch: vi.fn(async () => true), closePunch: vi.fn(async () => undefined),
+    receiveOffer: vi.fn(async () => ({ answer: { type: "answer", sdp: "answer" }, audio: false, codec: "vp8" })),
+    onEvent: () => () => {}, onClose: () => () => {},
+    closeReceiver: vi.fn(async () => {}), closeEdge: vi.fn(async () => {}),
+  } as unknown as NativeClient;
+  const unavailable = vi.fn(), exhausted = vi.fn(() => true), sent = vi.fn(() => true);
+  const peer = new NativeCapableViewerPeer({
+    iceServers: [{ urls: ["stun:site.example:3478"] }],
+    natPredictionStunUrls: ["stun:site.example:3479", "stun:site.example:3480"],
+  }, { sendSignal: sent, sendRestartRequest: () => true, onStream: () => {}, onUpdate: () => {}, onRecoveryExhausted: exhausted },
+  { natPredictionEnabled: true, recoveryOwner: "route" }, async () => client, unavailable, "session", 2);
+  const prepare: SignalPayload = { kind: "punch", connectionId: "current", punch: { phase: "prepare", secret: "42".repeat(32) } };
+  try {
+    await peer.acceptSignal("parent", prepare);
+    await vi.advanceTimersByTimeAsync(0);
+    await peer.acceptSignal("parent", { kind: "punch", connectionId: "current", punch: {
+      phase: "start", prediction: { address: "198.51.100.2", port: 50000, step: 1 },
+    } });
+    await vi.advanceTimersByTimeAsync(0);
+    if (outcome === "expired") await vi.advanceTimersByTimeAsync(3_500);
+    if (outcome === "rpc-expired") vi.mocked(client.receiveOffer).mockRejectedValueOnce(new Error("prepared socket expired"));
+    await peer.acceptSignal("parent", {
+      kind: "description", connectionId: "current", punched: true,
+      description: { type: "offer", sdp: "v=0\r\nm=video 9 UDP/TLS/RTP/SAVPF 96\r\na=sendonly\r\na=rtpmap:96 VP8/90000\r\n" },
+    });
+    expect(unavailable).not.toHaveBeenCalled();
+    if (outcome === "commit") {
+      expect(exhausted).not.toHaveBeenCalled();
+      expect(client.receiveOffer).toHaveBeenCalledWith("session", "current", expect.anything(), expect.anything(), 2, true);
+      await peer.acceptSignal("parent", prepare);
+      expect(client.preparePunch).toHaveBeenCalledOnce();
+    } else {
+      expect(exhausted).toHaveBeenCalledExactlyOnceWith("parent", "current");
+      if (outcome === "expired") expect(client.receiveOffer).not.toHaveBeenCalled();
+    }
+  } finally { peer.dispose(); }
+});
+
 it("uses the offer's STUN destinations for prediction while the next ICE config changes", async () => {
   vi.useFakeTimers();
   vi.stubGlobal("window", globalThis);

From d7b3be0a05f20cf4883527e2ce47c68fd1c3c30d Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Mon, 12 Oct 2026 17:48:14 +0800
Subject: [PATCH 186/262] fix(app): retain media roles during native connection
 preparation

---
 docs/research/nat-traversal.md           | 16 ++++++--
 docs/status.md                           |  5 ++-
 docs/todo.md                             |  7 ++--
 internal/app/mediaedge/edge_test.go      | 15 +++++++-
 internal/app/nativecontrol/punch.go      | 18 ++++++---
 internal/app/nativecontrol/punch_test.go | 48 ++++++++++++++++++++++++
 scripts/app-browser-fanout-gate.ts       | 33 +++++++++++++++-
 src/client/native/client.ts              |  5 ++-
 src/client/native/native-punch.ts        |  4 +-
 tests/native-punch.test.ts               |  2 +
 10 files changed, 132 insertions(+), 21 deletions(-)
 create mode 100644 internal/app/nativecontrol/punch_test.go

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 709a1d67e..4202db131 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -459,9 +459,19 @@ bounded composition, not a physical difficult-network success-rate improvement.
 The candidate's send window is 800 ms within a 1.1-second hard bound; the earlier
 isolated experiment's shorter window is not its product timing.
 
-Real signaling, decoded-picture acceptance and cross-device checks remain part
-of candidate acceptance. Random-port overlap assumptions do not establish a
-solution for two independently random endpoint-dependent NATs or blocked UDP.
+The Windows Browser-to-App fanout gate also exercises the actual room retry,
+both Native control preparations and ordinary ICE continuation when the mapping
+is ineligible. Two Viewers decode about 30 fps; live quality, pause/resume, source
+audio changes and App-exit fallback remain usable. Run the existing
+`gate:app-browser-fanout` entry with `PIIK_CLIENT_BROWSER_FANOUT_GATE=true`,
+`PIIK_CLIENT_PUNCH_GATE=true` and `CHROME_PATH` set. This arm uses loopback STUN
+listeners on UDP 3478/3479/3480 and injects one candidate rejection; it does not
+contact public STUN services.
+
+Successful coordinated preparation through a real difficult network, decoded
+pictures on that path and cross-device behavior remain field-beta checks.
+Random-port overlap assumptions do not establish a solution for two independently
+random endpoint-dependent NATs or blocked UDP.
 
 ### Browser-Compatible Follow-Up
 
diff --git a/docs/status.md b/docs/status.md
index af46db64a..068181811 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -85,8 +85,9 @@ owns the retained experiment and adoption boundary. Its package is retired;
 independent ordinary ICE and media repairs remain in the candidate.
 An independent bounded Native UDP preparation now augments existing retries
 under ADR-0009. Production Engine checks cover socket adoption, video and reverse
-feedback in a sequential-NAT fixture. It is awaiting complete candidate
-acceptance and the owner's field beta; it does not establish a public success
+feedback in a sequential-NAT fixture. Actual App control/signaling checks cover
+ineligible preparation continuing to decoded Browser video. Successful paths
+still need the owner's field beta; this does not establish a public success
 rate or remove Browser-only operation.
 The original candidate packages pass their identity/checksum checks; Windows
 Local startup/retirement, saved Site approval/revocation and explicit 1.x
diff --git a/docs/todo.md b/docs/todo.md
index d6de7927d..07282eed1 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -178,9 +178,10 @@ experiments and their limits.
 
 - [ ] **Coordinated Native retry acceptance.**
   The optional two-App preparation is integrated into the existing retry owner;
-  production Engine virtual-network checks carry media and reverse feedback.
-  Complete candidate signaling, decoded-picture and retirement acceptance,
-  following the
+  production Engine virtual-network checks carry media and reverse feedback;
+  actual App signaling checks cover ineligible preparation and ordinary decoded
+  media continuation. Verify successful preparation through a difficult network
+  and decoded-picture continuity on that path, following the
   [assessment](./research/nat-traversal.md#coordinated-native-punching-assessment).
   Preserve the first ordinary attempt, immediate Browser decline and fixed
   operation deadlines. The owner will arrange a small difficult-network beta
diff --git a/internal/app/mediaedge/edge_test.go b/internal/app/mediaedge/edge_test.go
index f251d31be..1f10619ac 100644
--- a/internal/app/mediaedge/edge_test.go
+++ b/internal/app/mediaedge/edge_test.go
@@ -773,7 +773,17 @@ func connectedReceiver(
 	connectionID string,
 ) (*Edge, *webrtc.PeerConnection, <-chan *rtp.Packet) {
 	t.Helper()
-	edge, err := engine.NewEdge(source, EdgeOptions{ConnectionID: connectionID})
+	connected := make(chan struct{}, 1)
+	edge, err := engine.NewEdge(source, EdgeOptions{ConnectionID: connectionID, Events: EdgeEvents{
+		ConnectionState: func(state webrtc.PeerConnectionState, _ *SelectedPair) {
+			if state == webrtc.PeerConnectionStateConnected {
+				select {
+				case connected <- struct{}{}:
+				default:
+				}
+			}
+		},
+	}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -796,6 +806,9 @@ func connectedReceiver(
 	})
 
 	connectEdgeToReceiver(t, edge, receiver)
+	// Pion publishes Connected before our callback activates the media output.
+	// A one-frame test must await that callback, not race it with its only frame.
+	waitSignal(t, connected, "media activation")
 	return edge, receiver, packets
 }
 
diff --git a/internal/app/nativecontrol/punch.go b/internal/app/nativecontrol/punch.go
index 86f5db005..e38bf02b5 100644
--- a/internal/app/nativecontrol/punch.go
+++ b/internal/app/nativecontrol/punch.go
@@ -12,7 +12,7 @@ type preparePunchRequest struct {
 	ShareID            string      `json:"shareId"`
 	ConnectionID       string      `json:"connectionId"`
 	SourceConnectionID string      `json:"sourceConnectionId,omitempty"`
-	EdgeCapacity       int         `json:"edgeCapacity"`
+	EdgeCapacity       *int        `json:"edgeCapacity,omitempty"`
 	ICEServers         []iceServer `json:"iceServers"`
 	Secret             string      `json:"secret"`
 }
@@ -40,7 +40,7 @@ func (session *Session) handlePunch(envelope requestEnvelope, payload []byte, co
 		var request preparePunchRequest
 		if err := decodeStrict(payload, &request); err != nil || !validIdentities(request.ShareID, request.ConnectionID) ||
 			(request.SourceConnectionID != "" && !validIdentities(request.SourceConnectionID)) ||
-			request.EdgeCapacity < 1 || request.EdgeCapacity > maxEdgeCapacity {
+			(request.EdgeCapacity != nil && (*request.EdgeCapacity < 1 || *request.EdgeCapacity > maxEdgeCapacity || request.SourceConnectionID != "")) {
 			return nil, protocolViolation("native connection preparation is invalid")
 		}
 		key, err := hex.DecodeString(request.Secret)
@@ -52,14 +52,20 @@ func (session *Session) handlePunch(envelope requestEnvelope, payload []byte, co
 			return nil, err
 		}
 		var preparation *mediaedge.PunchPreparation
-		if host := session.current(request.ShareID); host != nil && request.SourceConnectionID == "" {
-			preparation, err = host.BeginPunch(request.ConnectionID, servers, request.Secret)
-		} else {
-			viewer, viewerErr := session.ensureViewer(request.ShareID, request.EdgeCapacity)
+		if request.EdgeCapacity != nil {
+			// Only a receiving request may establish a Viewer role. A late sender
+			// request must not replace its retired Host/relay source with a Viewer.
+			viewer, viewerErr := session.ensureViewer(request.ShareID, *request.EdgeCapacity)
 			if viewerErr != nil {
 				return nil, viewerErr
 			}
+			preparation, err = viewer.BeginPunch(request.ConnectionID, "", servers, request.Secret)
+		} else if host := session.current(request.ShareID); host != nil && request.SourceConnectionID == "" {
+			preparation, err = host.BeginPunch(request.ConnectionID, servers, request.Secret)
+		} else if viewer := session.currentViewer(request.ShareID); viewer != nil && request.SourceConnectionID != "" {
 			preparation, err = viewer.BeginPunch(request.ConnectionID, request.SourceConnectionID, servers, request.Secret)
+		} else {
+			return nil, errors.New("native media source does not exist")
 		}
 		if err != nil {
 			return nil, err
diff --git a/internal/app/nativecontrol/punch_test.go b/internal/app/nativecontrol/punch_test.go
new file mode 100644
index 000000000..af67c8bc0
--- /dev/null
+++ b/internal/app/nativecontrol/punch_test.go
@@ -0,0 +1,48 @@
+package nativecontrol
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/TNTcraftHIM/Piik/internal/app/nativecapture"
+)
+
+func TestPunchPreparationPreservesMediaRole(t *testing.T) {
+	for _, sourceID := range []string{"", "retired_receiver"} {
+		t.Run("sender/"+sourceID, func(t *testing.T) {
+			session := New("", nativecapture.Capabilities{}, false)
+			t.Cleanup(func() { _ = session.Close() })
+			request := preparePunchRequest{
+				requestEnvelope: requestEnvelope{Version: 10, ID: "prepare_request", Type: "prepare-punch"},
+				ShareID:         "retired_share", ConnectionID: "new_connection", SourceConnectionID: sourceID,
+				Secret: strings.Repeat("42", 32),
+			}
+			payload, _ := json.Marshal(request)
+			value, err := session.Handle(t.Context(), payload)
+			if _, failed := value.(requestFailedResponse); err != nil || !failed {
+				t.Fatalf("missing sender must fail only its request: %#v, %v", value, err)
+			}
+			if session.currentViewer(request.ShareID) != nil {
+				t.Fatal("late sender preparation installed a Viewer role")
+			}
+		})
+	}
+	t.Run("receiver", func(t *testing.T) {
+		session := New("", nativecapture.Capabilities{}, false)
+		t.Cleanup(func() { _ = session.Close() })
+		capacity := 2
+		request := preparePunchRequest{
+			requestEnvelope: requestEnvelope{Version: 10, ID: "prepare_request", Type: "prepare-punch"},
+			ShareID:         "receiving_share", ConnectionID: "new_connection", EdgeCapacity: &capacity,
+			Secret: strings.Repeat("42", 32),
+		}
+		payload, _ := json.Marshal(request)
+		if _, err := session.Handle(t.Context(), payload); err != nil {
+			t.Fatal(err)
+		}
+		if session.currentViewer(request.ShareID) == nil {
+			t.Fatal("explicit receiving preparation did not install its Viewer role")
+		}
+	})
+}
diff --git a/scripts/app-browser-fanout-gate.ts b/scripts/app-browser-fanout-gate.ts
index 531e881e3..3f0715fbb 100644
--- a/scripts/app-browser-fanout-gate.ts
+++ b/scripts/app-browser-fanout-gate.ts
@@ -18,6 +18,7 @@ const BUILD_ROOT = join(ROOT, "build/go-check");
 const LAN_ADDRESS = "192.0.2.1";
 
 const initialAudio = process.env.PIIK_CLIENT_GATE_AUDIO !== "false";
+const punchRetry = process.env.PIIK_CLIENT_PUNCH_GATE === "true";
 const captureSize = parseVideoGateSize(process.env.PIIK_CLIENT_GATE_VIDEO_SIZE || "1920x1080");
 const probe = String.raw`(() => {
   localStorage.setItem('piik:ui-lang', 'en');
@@ -30,12 +31,27 @@ const probe = String.raw`(() => {
     catch (error) { errors.push(String(error)); throw error; }
   };
   const PC = RTCPeerConnection, WS = WebSocket;
+  let rejectFirstEdge = ${punchRetry};
   window.RTCPeerConnection = class extends PC { constructor(...args) { super(...args); pcs.push(this); } };
   window.WebSocket = class extends WS {
     constructor(...args) { super(...args); if (String(args[0]).includes('/control')) {
       sockets.push(this);
     } }
-    send(raw) { if (this.url.includes('/control')) { const value = JSON.parse(raw); requests.push(value.type); } super.send(raw); }
+    send(raw) {
+      if (this.url.includes('/control')) {
+        const value = JSON.parse(raw); requests.push(value.type);
+        // Fail one candidate through the ordinary operation-error boundary.
+        // The real room controller must authorize the next preparation.
+        if (rejectFirstEdge && value.type === 'prepare-edge') {
+          rejectFirstEdge = false;
+          queueMicrotask(() => this.dispatchEvent(new MessageEvent('message', {data: JSON.stringify({
+            version:value.version, id:value.id, type:'request-failed', code:'operation-failed',
+          })})));
+          return;
+        }
+      }
+      super.send(raw);
+    }
   };
   let audio = ${initialAudio}, captures = 0;
   navigator.mediaDevices.getDisplayMedia = async () => {
@@ -136,6 +152,8 @@ async function startRoomServer(
       LISTEN_HOST: "127.0.0.1",
       PUBLIC_BASE_URL: `http://${LAN_ADDRESS}:${port}`,
       ALLOWED_ORIGINS: origins.join(","),
+      ...(punchRetry ? { STUN_URLS: "stun:127.0.0.1:3478", STUN_LISTEN_HOST: "127.0.0.1",
+        NAT_PREDICTION_ENABLED: "true" } : {}),
     },
   });
   child.stdout.resume();
@@ -252,6 +270,17 @@ async function main(): Promise<void> {
       (s) => matchesCaptureSize(s.width, s.height, captureSize) && s.outbound===0, 30000);
     checks.host = await read(host);
     checks.viewers = await Promise.all(viewers.map(read));
+    if (punchRetry) {
+      // Loopback mappings are deliberately ineligible. Both real App controls
+      // must prepare, decline and continue ordinary ICE without losing media.
+      const source = checks.host as Awaited<ReturnType<typeof read>>;
+      const target = (checks.viewers as Awaited<ReturnType<typeof read>>[])[0];
+      if (!source.requests.includes("prepare-punch") || !target.requests.includes("prepare-punch") ||
+        source.requests.includes("run-punch") || target.requests.includes("run-punch")) {
+        throw new Error("Authorized retry did not decline its ineligible Native preparation");
+      }
+      checks.nativePreparationDeclined = true;
+    }
     if ((checks.host as any).outbound !== 1 || !(checks.viewers as any[]).every((v) => v.outbound === 0)) {
       throw new Error("Shared encode count did not match the Native fanout");
     }
@@ -310,7 +339,7 @@ async function main(): Promise<void> {
     const cleanup = await cleanupRun({cdp, native:app, chrome, server, profile, ports:[appPort,debugPort,...(nativePort?[nativePort]:[])]});
     const result = {passed: error===null && Object.values(cleanup).every(Boolean) && relayCleanup.nativeExited && relayCleanup.portsClosed, stage, checks, error, cleanup};
     await mkdir(BUILD_ROOT,{recursive:true});
-    await writeFile(join(BUILD_ROOT,"browser-fanout.json"), JSON.stringify(result,null,2));
+    await writeFile(join(BUILD_ROOT,punchRetry ? "browser-fanout-punch.json" : "browser-fanout.json"), JSON.stringify(result,null,2));
     process.stdout.write(JSON.stringify(result)+"\n");
     if (!result.passed) process.exitCode=1;
   }
diff --git a/src/client/native/client.ts b/src/client/native/client.ts
index 37eae833c..ce2040aab 100644
--- a/src/client/native/client.ts
+++ b/src/client/native/client.ts
@@ -423,9 +423,10 @@ export class NativeClient {
   }
 
   async preparePunch(shareId: string, connectionId: string, iceConfig: IceConfig,
-    secret: string, edgeCapacity: number, sourceConnectionId?: string): Promise<PunchPrediction | null> {
+    secret: string, edgeCapacity?: number, sourceConnectionId?: string): Promise<PunchPrediction | null> {
     const response = await this.request("prepare-punch", {
-      shareId, connectionId, secret, edgeCapacity,
+      shareId, connectionId, secret,
+      ...(edgeCapacity !== undefined ? { edgeCapacity } : {}),
       ...(sourceConnectionId ? { sourceConnectionId } : {}),
       iceServers: iceConfig.iceServers.map(server => ({ urls: Array.isArray(server.urls) ? server.urls : [server.urls] })),
     }, punchPreparedResponseSchema);
diff --git a/src/client/native/native-punch.ts b/src/client/native/native-punch.ts
index e578e0615..f4bc8f7cc 100644
--- a/src/client/native/native-punch.ts
+++ b/src/client/native/native-punch.ts
@@ -6,7 +6,7 @@ const PREPARATION_TIMEOUT_MS = 3_500;
 
 export interface NativePunchControl {
   preparePunch(shareId: string, connectionId: string, ice: IceConfig, secret: string,
-    edgeCapacity: number, sourceConnectionId?: string): Promise<PunchPrediction | null>;
+    edgeCapacity?: number, sourceConnectionId?: string): Promise<PunchPrediction | null>;
   runPunch(shareId: string, connectionId: string, remote: PunchPrediction): Promise<boolean>;
   closePunch(shareId: string, connectionId: string): Promise<void>;
 }
@@ -39,7 +39,7 @@ export class NativePunchSender {
     return new Promise(resolve => {
       this.finishResult = resolve;
       this.timer = setTimeout(() => this.finish(false), PREPARATION_TIMEOUT_MS);
-      this.prediction = this.control.preparePunch(this.shareId, this.connectionId, this.ice, secret, 3, this.sourceConnectionId)
+      this.prediction = this.control.preparePunch(this.shareId, this.connectionId, this.ice, secret, undefined, this.sourceConnectionId)
         .catch(() => null);
       if (!this.send({ kind: "punch", connectionId: this.connectionId, punch: { phase: "prepare", secret } })) {
         this.finish(false);
diff --git a/tests/native-punch.test.ts b/tests/native-punch.test.ts
index bdfcab4dd..3c47e1e30 100644
--- a/tests/native-punch.test.ts
+++ b/tests/native-punch.test.ts
@@ -42,7 +42,9 @@ it.each(["success", "receiver-fails", "sender-fails", "browser", "timeout", "dis
       if (outcome === "timeout") await vi.advanceTimersByTimeAsync(3_500);
       expect(await result).toBe(outcome === "success");
       expect(source.preparePunch).toHaveBeenCalledOnce();
+      expect(source.preparePunch.mock.calls[0][4]).toBeUndefined();
       if (outcome === "success") {
+        expect(target.preparePunch.mock.calls[0][4]).toBe(2);
         expect(receiver.commit()).toBe(true);
         expect(source.closePunch).not.toHaveBeenCalled();
         expect(target.closePunch).not.toHaveBeenCalled();

From 5667286fe74a8f614944fe6f7d9149b73c9335b3 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Mon, 12 Oct 2026 18:18:51 +0800
Subject: [PATCH 187/262] fix(app): detect native capture features without OS
 version gates

---
 docs/adr/0008-window-scoped-audio-capture.md |  8 ++---
 docs/research/native-client-media.md         |  8 ++---
 docs/standards/engineering.md                |  4 +++
 native/capture/windows/README.md             |  2 +-
 native/capture/windows/main.cpp              | 33 +++++++++-----------
 5 files changed, 27 insertions(+), 28 deletions(-)

diff --git a/docs/adr/0008-window-scoped-audio-capture.md b/docs/adr/0008-window-scoped-audio-capture.md
index bca4a55ca..fdb3f0716 100644
--- a/docs/adr/0008-window-scoped-audio-capture.md
+++ b/docs/adr/0008-window-scoped-audio-capture.md
@@ -2,7 +2,7 @@
 
 - Status: accepted for Browser capture and the Windows App audio paths
 - Date: 2026-08-21
-- Last updated: 2026-10-06
+- Last updated: 2026-10-12
 
 ## Context
 
@@ -40,9 +40,9 @@ platform probe and physical gate report it.
    [Native App media](../research/native-client-media.md).
 7. Windows App screen sharing can optionally exclude one selected process tree
    through WASAPI's exclusion mode after successful activation of that mode.
-   Probe Windows 10 build 19041+ to include backported implementations, following
-   the same capability boundary as application capture. Microsoft's documented
-   minimum remains 20348; a Windows version alone does not establish support.
+   Probe inclusion and exclusion independently without a Windows build-number
+   gate. Successful activation establishes availability; unsupported activation
+   leaves that capability unavailable.
    This mode spans all render endpoints; it is not restricted to the
    default playback device. Reuse source enumeration and the existing PCM/mixed
    output. Generic Browser capture and arbitrary unrelated process sets are not
diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index d32fd84c4..34d44bef8 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -32,10 +32,10 @@ application's process tree or simultaneous playback across several output device
 device acceptance boundaries. [ADR-0008](../adr/0008-window-scoped-audio-capture.md)
 owns the platform choice.
 
-The capability check now attempts exclusion activation on Windows 10 2004+
-instead of rejecting all builds below 20348. Microsoft documents 20348 as the
-minimum, while OBS documents application loopback on Windows 10 2004+; the
-activation result, not an OS label, controls availability. Physical Windows 10
+The capability check attempts inclusion and exclusion activation independently,
+without an OS-version gate. Microsoft documents 20348 as the minimum, while OBS
+documents application loopback on Windows 10 2004+; the activation result, not
+an OS label, controls availability. Physical Windows 10
 exclusion remains unverified. A session regression check changes exclusion and
 source-audio off/on while video preparation is deliberately unavailable: the
 capture stream, encoded source, audio output and connected edge remain the same.
diff --git a/docs/standards/engineering.md b/docs/standards/engineering.md
index e1152c193..5c8341939 100644
--- a/docs/standards/engineering.md
+++ b/docs/standards/engineering.md
@@ -95,6 +95,10 @@ An unusable optional metric should become unavailable without discarding valid
 evidence or closing media control. Identity, generation, authority and required
 state consistency remain strict; never clamp a measurement into an invented fact.
 
+Detect optional platform features through bounded capability checks and actual
+operation results, not OS/browser version allowlists. Keep API availability,
+permission and successful execution distinct; version data is diagnostic context.
+
 Preserve meaningful authorization and resource bounds; prove that a producer's
 valid aggregate output fits its consumer, including serialization overhead.
 A per-item limit alone does not establish that contract.
diff --git a/native/capture/windows/README.md b/native/capture/windows/README.md
index 76aac48f0..8115ce8c0 100644
--- a/native/capture/windows/README.md
+++ b/native/capture/windows/README.md
@@ -33,7 +33,7 @@ unavailable instead of failing the whole source. Process loopback is probed by
 activation rather than inferred from a Windows build number; display sources
 normally use the standard render-device loopback available on Windows 10 and
 later. The optional `--capture-audio exclude <pid> <creation-time>` mode requires
-build 19041+ and a successful exclusion-mode probe. Windows 10 isolation still
+a successful exclusion-mode probe, without an additional OS-version gate. Windows 10 isolation still
 needs physical verification; see the [audio evidence](../../../docs/research/native-client-media.md#windows-audio-exclusion).
 It captures all output devices
 except the selected process tree, and retires when that process exits. The
diff --git a/native/capture/windows/main.cpp b/native/capture/windows/main.cpp
index e834e6e02..542fe737e 100644
--- a/native/capture/windows/main.cpp
+++ b/native/capture/windows/main.cpp
@@ -1158,33 +1158,28 @@ UINT32 WindowsBuild() {
   }
   RTL_OSVERSIONINFOW version = {};
   version.dwOSVersionInfoSize = sizeof(version);
-  if (get_version(&version) < 0 || version.dwMajorVersion != 10) {
-    Fail("windows-version", "unsupported Windows version");
+  if (get_version(&version) < 0) {
+    Fail("windows-version", "could not read Windows version");
   }
   return version.dwBuildNumber;
 }
 
 void WriteCapabilityProbe() {
-  constexpr UINT32 kCreateForWindowMinimumBuild = 18'362;
-  constexpr UINT32 kProcessLoopbackMinimumBuild = 19'041;
   const UINT32 build = WindowsBuild();
   bool window_capture = false;
-  if (build >= kCreateForWindowMinimumBuild) {
-    try {
-      window_capture =
-          winrt::Windows::Graphics::Capture::GraphicsCaptureSession::IsSupported();
-    } catch (const winrt::hresult_error&) {
-      window_capture = false;
-    }
-  }
-  const bool process_audio =
-      build >= kProcessLoopbackMinimumBuild &&
-      piik::capture::ProcessAudioAvailable();
+  try {
+    using namespace winrt::Windows::Graphics::Capture;
+    // Probe the entry points used by capture and previews, not their OS versions.
+    window_capture = GraphicsCaptureSession::IsSupported() &&
+        winrt::Windows::Foundation::Metadata::ApiInformation::IsMethodPresent(
+            L"Windows.Graphics.Capture.Direct3D11CaptureFramePool", L"CreateFreeThreaded") &&
+        !!winrt::get_activation_factory<GraphicsCaptureItem, IGraphicsCaptureItemInterop>();
+  } catch (const winrt::hresult_error&) {
+    window_capture = false;
+  }
+  const bool process_audio = piik::capture::ProcessAudioAvailable();
   const bool system_audio = piik::capture::SystemAudioAvailable();
-  // Process loopback was backported to Windows 10 2004. Probe each mode;
-  // the documented 20348 minimum must not hide a working exclusion interface.
-  const bool process_audio_exclusion = build >= kProcessLoopbackMinimumBuild &&
-      piik::capture::ProcessAudioAvailable(true);
+  const bool process_audio_exclusion = piik::capture::ProcessAudioAvailable(true);
 
   std::vector<Adapter> adapters = EnumerateAdapters();
   std::ostringstream output;

From bf4854489df991d8635bd8c917c066ee210f4403 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Mon, 12 Oct 2026 20:49:26 +0800
Subject: [PATCH 188/262] fix(nat): retain stable endpoints during coordinated
 retries

---
 docs/adr/0009-optional-nat-prediction.md |  12 +-
 docs/research/nat-traversal.md           |  35 ++++
 docs/todo.md                             |   4 +-
 internal/app/mediaedge/punch.go          | 100 +++++++++--
 internal/app/mediaedge/punch_sockets.go  |  26 ++-
 internal/app/mediaedge/punch_test.go     | 210 ++++++++++++++++++++++-
 internal/app/mediaedge/stun.go           |   6 +-
 internal/app/nativecontrol/punch.go      |  12 +-
 internal/app/nativecontrol/punch_test.go |  19 ++
 internal/server/protocol/punch.go        |   2 +-
 internal/server/protocol/punch_test.go   |   2 +
 src/shared/protocol.ts                   |   2 +-
 tests/fixtures/wire-samples.json         |  12 ++
 13 files changed, 405 insertions(+), 37 deletions(-)

diff --git a/docs/adr/0009-optional-nat-prediction.md b/docs/adr/0009-optional-nat-prediction.md
index 98d87920f..57a49bb55 100644
--- a/docs/adr/0009-optional-nat-prediction.md
+++ b/docs/adr/0009-optional-nat-prediction.md
@@ -71,10 +71,14 @@ connection acquisition reuses the route controller's existing opportunity ledger
    prepare an authenticated Native socket at both ends before creating its one
    PeerConnection. It reuses the current peer/session/connection authorization
    and the same share switch; Browser peers decline immediately. Each Engine
-   permits one preparation: an ordered three-destination observation, then at
-   most eight temporary sockets aimed at one bounded sequential-port estimate,
-   with at most 64 requests and 64 authenticated replies. The observation socket
-   closes before those sockets open. The page waits at most 3.5 seconds; the App
+   permits one preparation: an ordered three-destination observation, then
+   checks against one bounded peer endpoint. Three equal observations retain
+   that exact socket; a positive sequential observation closes it before opening
+   at most eight temporary sockets. These cases can pair in either direction;
+   neither observation establishes a permanent NAT classification. The bound
+   remains 64 requests and 64 authenticated replies. Survey readers, writers
+   and cancellation callbacks retire before socket reuse or transfer. The page
+   waits at most 3.5 seconds; the App
    expires unconsumed work after five seconds. Mutual success and the existing
    SDP offer commit one proved socket and peer tuple to Pion. Other sockets and
    workers retire before reuse. Missing observations or unsuccessful preparation
diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 4202db131..782c1a7c3 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -366,6 +366,26 @@ when hole punching fails; neither statistic transfers to our user population.
 | Switch between direct and relay paths | Iroh manages QUIC paths; Piik hands off WebRTC edges through one room-route operation. These are different contracts. |
 | Relay data over TLS/TCP when direct UDP fails | Iroh and Tailscale provide this. Piik currently has optional SFU/UDP, while App public invitations remain P2P-only. This is a coverage difference, not a missing prediction formula. |
 
+Reviewing [Tailscale v1.104.1's DISCO messages](https://github.com/tailscale/tailscale/blob/v1.104.1/disco/disco.go)
+and [endpoint handling](https://github.com/tailscale/tailscale/blob/v1.104.1/wgengine/magicsock/endpoint.go)
+gives a more specific ownership comparison:
+
+| DISCO behavior | Piik application |
+| --- | --- |
+| `CallMeMaybe` sends recently observed endpoints and requests return traffic after outbound probes. | Current-generation room signaling and Trickle ICE already exchange candidates. Optional Native preparation coordinates its bounded sends through that same signaling owner. A second discovery protocol adds no established benefit. |
+| Authenticated Ping/Pong ties responses to transactions and learns actual peer endpoints. | ICE already owns authenticated checks, triggered checks and peer-reflexive discovery. Native preparation additionally requires the current operation's key and actual response before socket adoption. Do not maintain a parallel peer-address database. |
+| Endpoint trust expires; fresh observations replace stale advertised addresses. | Existing connection-owned discovery, gateway refresh and ICE recovery own freshness. Preserve their generations and retirement instead of adding another keepalive/retry timer. |
+| Peers can coordinate even when their mappings behave differently. | The candidate incorrectly declined preparation whenever either side observed a stable mapping. Retaining that side's actual observation socket lets it participate alongside a sequentially mapped peer. This is the concrete gap adopted below. |
+
+These are mechanism correspondences, not proof that the two stacks have equal
+reachability. [ICE's peer-reflexive processing](https://www.rfc-editor.org/rfc/rfc8445.html#section-7.2.5.3)
+can discover an endpoint different from the advertised candidates; it must
+remain the owner of that discovery and nomination. Extending the preflight to
+accept arbitrary authenticated reply ports would also require mutual winner
+selection, duplicating ICE. The current extension keeps one expected peer tuple
+and leaves ordinary ICE usable when the finite preparation fails. It adds no
+DERP service, media wrapper or new dependency.
+
 [Tailscale magicsock](https://github.com/tailscale/tailscale/blob/main/wgengine/magicsock/magicsock.go)
 is implemented in Go and is integrated with WireGuard, peer discovery, network
 maps and DERP. Its language is not an obstacle, but it is not an interchangeable
@@ -459,6 +479,21 @@ bounded composition, not a physical difficult-network success-rate improvement.
 The candidate's send window is 800 ms within a 1.1-second hard bound; the earlier
 isolated experiment's shorter window is not its product timing.
 
+Stable observations now use the exact survey socket in that same preparation;
+reopening a socket would invalidate the observed address. Mixed stable/sequential
+fixtures previously declined at observation and now carry production SRTP and
+reverse SRTCP in both directions, including 250 ms of start skew. Stable/stable
+and sequential/sequential controls also pass. This removes an eligibility gap;
+it does not prove those pairs could never connect through ordinary ICE. Three
+equal observations, especially against different ports on one STUN IP, do not
+establish endpoint-independent mapping for every destination. Wrong-generation
+responses remain rejected, and no-response paths remain bounded. Raw survey I/O
+has the survey deadline and cancellation interruption; Pion's reader and
+retransmitter and the cancellation callback finish before a socket transfers.
+Blocked initial/retransmission writes and unused stable-socket retirement have
+regression coverage. The shared wire decoder requires an explicit zero step;
+missing/null fields cannot silently select this behavior.
+
 The Windows Browser-to-App fanout gate also exercises the actual room retry,
 both Native control preparations and ordinary ICE continuation when the mapping
 is ineligible. Two Viewers decode about 30 fps; live quality, pause/resume, source
diff --git a/docs/todo.md b/docs/todo.md
index 07282eed1..34fb0cf18 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -186,7 +186,9 @@ experiments and their limits.
   Preserve the first ordinary attempt, immediate Browser decline and fixed
   operation deadlines. The owner will arrange a small difficult-network beta
   after packaging; compare the same peers with the share's enhancement switch
-  enabled/disabled. Random-port overlap remains separate and unproven.
+  enabled/disabled, including mixed stable/sequential observations in both
+  directions. Local coverage does not establish their field benefit. Random-port
+  overlap remains separate and unproven.
 
 For the transport assessment, measure connection success, time to first picture and
 failure causes on representative networks, especially App and P2P-only sites.
diff --git a/internal/app/mediaedge/punch.go b/internal/app/mediaedge/punch.go
index b6f961152..be3c06458 100644
--- a/internal/app/mediaedge/punch.go
+++ b/internal/app/mediaedge/punch.go
@@ -7,13 +7,14 @@ import (
 	"net"
 	"net/netip"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/pion/stun/v4"
 	"github.com/pion/webrtc/v4"
 )
 
-// PunchPrediction is a transient sequential mapping observation, not a NAT
+// PunchPrediction is a transient mapping observation, not a NAT
 // classification. Only an authenticated peer in the current route may supply it.
 type PunchPrediction struct {
 	Address string `json:"address"`
@@ -24,7 +25,7 @@ type PunchPrediction struct {
 func (prediction PunchPrediction) Target() (*net.UDPAddr, error) {
 	address, err := netip.ParseAddr(prediction.Address)
 	if err != nil || !address.Is4() || !address.IsGlobalUnicast() || address.IsPrivate() ||
-		address.IsLinkLocalUnicast() || prediction.Step < 1 || prediction.Step > 16 ||
+		address.IsLinkLocalUnicast() || prediction.Step < 0 || prediction.Step > 16 ||
 		prediction.Port < 1024 || prediction.Port > 65535 {
 		return nil, errors.New("unsupported peer mapping observation")
 	}
@@ -59,6 +60,34 @@ type PunchedSocket struct {
 	remote *net.UDPAddr
 }
 
+// STUN owns its reader only until Client.Close joins it. Retain the UDP socket
+// across sequential observations, then either close it or use its stable mapping.
+type punchSurveySocket struct {
+	net.PacketConn
+	closed atomic.Bool
+}
+
+func (socket *punchSurveySocket) Close() error {
+	if socket.closed.Swap(true) {
+		return nil
+	}
+	return socket.SetReadDeadline(time.Now())
+}
+
+func (socket *punchSurveySocket) ReadFrom(buffer []byte) (int, net.Addr, error) {
+	if socket.closed.Load() {
+		return 0, nil, net.ErrClosed
+	}
+	return socket.PacketConn.ReadFrom(buffer)
+}
+
+func (socket *punchSurveySocket) WriteTo(buffer []byte, address net.Addr) (int, error) {
+	if socket.closed.Load() {
+		return 0, net.ErrClosed
+	}
+	return socket.PacketConn.WriteTo(buffer, address)
+}
+
 func (engine *Engine) BeginPunch(connectionID string, source *Source, servers []webrtc.ICEServer, secret string) (*PunchPreparation, error) {
 	key, err := hex.DecodeString(secret)
 	if err != nil || len(key) != 32 || connectionID == "" || len(connectionID) > 256 {
@@ -93,8 +122,8 @@ func (engine *Engine) BeginPunch(connectionID string, source *Source, servers []
 	return preparation, nil
 }
 
-// Prepare observes three destinations in order before any peer checks on this
-// disposable socket. The ordinary initial ICE attempt never enters this path.
+// Prepare observes three destinations in order before any peer checks. A stable
+// mapping retains this socket. The ordinary initial ICE attempt never enters here.
 func (preparation *PunchPreparation) Prepare() (*PunchPrediction, error) {
 	if !preparation.workMu.TryLock() {
 		return nil, errors.New("connection preparation is busy")
@@ -105,11 +134,36 @@ func (preparation *PunchPreparation) Prepare() (*PunchPrediction, error) {
 	}
 	ctx, cancel := context.WithTimeout(preparation.ctx, 1500*time.Millisecond)
 	defer cancel()
-	socket, err := preparation.engine.newICESocket(nil, false)
+	socket, err := preparation.engine.listenPacket("udp", preparation.engine.bindAddress)
 	if err != nil {
 		return nil, err
 	}
-	defer socket.close()
+	defer func() {
+		if socket != nil {
+			_ = socket.Close()
+		}
+	}()
+	deadline, _ := ctx.Deadline()
+	if err := socket.SetDeadline(deadline); err != nil {
+		return nil, err
+	}
+	// Pion's initial and retransmission writes are synchronous. Bound both I/O
+	// directions, and join cancellation before this socket can change owners.
+	surveySocket := socket
+	deadlineDone := make(chan struct{})
+	stopDeadline := context.AfterFunc(ctx, func() {
+		defer close(deadlineDone)
+		_ = surveySocket.SetDeadline(time.Now())
+	})
+	stopSurvey := func() {
+		if stopDeadline != nil {
+			if !stopDeadline() {
+				<-deadlineDone
+			}
+			stopDeadline = nil
+		}
+	}
+	defer stopSurvey()
 	var observations []*stun.XORMappedAddress
 	seen := make(map[string]bool)
 	for _, server := range preparation.servers {
@@ -127,21 +181,40 @@ func (preparation *PunchPreparation) Prepare() (*PunchPrediction, error) {
 				continue
 			}
 			seen[address.String()] = true
-			mapped, mappingErr := socket.querySTUN(ctx, address)
+			mapped, mappingErr := querySTUNBinding(ctx, &punchSurveySocket{PacketConn: socket}, address,
+				stun.MustBuild(stun.TransactionID, stun.BindingRequest))
 			if mappingErr != nil {
 				return nil, mappingErr
 			}
+			if err := socket.SetReadDeadline(deadline); err != nil {
+				return nil, err
+			}
 			observations = append(observations, mapped)
 			if len(observations) == 3 {
 				first, second, third := observations[0], observations[1], observations[2]
 				prediction := PunchPrediction{Address: third.IP.String(), Port: third.Port, Step: third.Port - second.Port}
 				_, valid := prediction.Target()
 				if valid != nil || !first.IP.Equal(second.IP) || !second.IP.Equal(third.IP) || second.Port-first.Port != prediction.Step {
-					return nil, errors.New("no sequential mapping observation")
+					return nil, errors.New("no usable mapping observation")
+				}
+				stopSurvey()
+				if err := ctx.Err(); err != nil {
+					return nil, err
 				}
-				if !preparation.transition("survey", "ready") {
+				if err := socket.SetDeadline(time.Time{}); err != nil {
+					return nil, err
+				}
+				preparation.mu.Lock()
+				defer preparation.mu.Unlock()
+				if preparation.ctx.Err() != nil || preparation.stage != "survey" {
 					return nil, errors.New("connection preparation was retired")
 				}
+				preparation.stage = "ready"
+				if prediction.Step == 0 {
+					// A stable observed endpoint is usable only with this exact socket.
+					preparation.socket = &PunchedSocket{PacketConn: socket}
+					socket = nil
+				}
 				return &prediction, nil
 			}
 		}
@@ -158,9 +231,16 @@ func (preparation *PunchPreparation) Run(remote PunchPrediction) bool {
 	if err != nil || !preparation.transition("ready", "running") {
 		return false
 	}
+	preparation.mu.Lock()
+	var retained net.PacketConn
+	if preparation.socket != nil {
+		retained = preparation.socket.PacketConn
+		preparation.socket = nil
+	}
+	preparation.mu.Unlock()
 	winner, err := punchSocketArray(preparation.ctx, func() (net.PacketConn, error) {
 		return preparation.engine.listenPacket("udp", preparation.engine.bindAddress)
-	}, target, preparation.secret)
+	}, target, preparation.secret, retained)
 	preparation.mu.Lock()
 	defer preparation.mu.Unlock()
 	if err != nil || preparation.ctx.Err() != nil || preparation.stage != "running" {
diff --git a/internal/app/mediaedge/punch_sockets.go b/internal/app/mediaedge/punch_sockets.go
index d3d331d5e..8d04ab5bf 100644
--- a/internal/app/mediaedge/punch_sockets.go
+++ b/internal/app/mediaedge/punch_sockets.go
@@ -12,15 +12,16 @@ import (
 	"github.com/pion/stun/v4"
 )
 
-// A bounded, authenticated preflight on eight fresh sockets. All readers stop
-// before the single winner transfers to the existing Pion connection owner.
-func punchSocketArray(ctx context.Context, listen func() (net.PacketConn, error), remote *net.UDPAddr, secret []byte) (net.PacketConn, error) {
-	if remote == nil || remote.IP.To4() == nil || remote.Port < 1 || remote.Port > 65535 || len(secret) != 32 {
-		return nil, errors.New("invalid peer or generation secret")
-	}
-	ctx, cancel := context.WithTimeout(ctx, 1100*time.Millisecond)
-	defer cancel()
+// A bounded, authenticated preflight on eight fresh sockets, or the one retained
+// observation socket when its mapping was stable. This function owns retained.
+// All readers stop before the winner transfers to the existing Pion owner.
+func punchSocketArray(ctx context.Context, listen func() (net.PacketConn, error), remote *net.UDPAddr, secret []byte, retained net.PacketConn) (net.PacketConn, error) {
 	var sockets []net.PacketConn
+	count := 8
+	if retained != nil {
+		sockets = append(sockets, retained)
+		count = 1
+	}
 	winner := -1
 	defer func() {
 		for i, connection := range sockets {
@@ -29,7 +30,12 @@ func punchSocketArray(ctx context.Context, listen func() (net.PacketConn, error)
 			}
 		}
 	}()
-	for range 8 {
+	if remote == nil || remote.IP.To4() == nil || remote.Port < 1 || remote.Port > 65535 || len(secret) != 32 {
+		return nil, errors.New("invalid peer or generation secret")
+	}
+	ctx, cancel := context.WithTimeout(ctx, 1100*time.Millisecond)
+	defer cancel()
+	for len(sockets) < count {
 		if err := ctx.Err(); err != nil {
 			return nil, err
 		}
@@ -38,6 +44,8 @@ func punchSocketArray(ctx context.Context, listen func() (net.PacketConn, error)
 			return nil, err
 		}
 		sockets = append(sockets, connection)
+	}
+	for _, connection := range sockets {
 		deadline, _ := ctx.Deadline()
 		if err := connection.SetDeadline(deadline); err != nil {
 			return nil, err
diff --git a/internal/app/mediaedge/punch_test.go b/internal/app/mediaedge/punch_test.go
index abf169bf5..9810da6a1 100644
--- a/internal/app/mediaedge/punch_test.go
+++ b/internal/app/mediaedge/punch_test.go
@@ -14,6 +14,7 @@ import (
 
 	"github.com/livekit/livekit-server/pkg/sfu"
 	"github.com/pion/ice/v4"
+	"github.com/pion/stun/v4"
 	"github.com/pion/transport/v5/vnet"
 	"github.com/pion/webrtc/v4"
 )
@@ -52,9 +53,20 @@ func preparePunch(t *testing.T, engine *Engine, source *Source, id, secret strin
 }
 
 func TestPunchAdoptsProvedTupleIntoMediaAndFeedback(t *testing.T) {
-	for _, skew := range []time.Duration{0, 250 * time.Millisecond} {
-		t.Run(skew.String(), func(t *testing.T) {
-			network := newPunchLab(t, sequentialPunchNAT, sequentialPunchNAT)
+	stable := vnet.NATType{MappingBehavior: vnet.EndpointIndependent, FilteringBehavior: vnet.EndpointAddrPortDependent}
+	for _, scenario := range []struct {
+		name        string
+		left, right vnet.NATType
+		skew        time.Duration
+	}{
+		{"sequential", sequentialPunchNAT, sequentialPunchNAT, 0},
+		{"sequential-delayed", sequentialPunchNAT, sequentialPunchNAT, 250 * time.Millisecond},
+		{"stable-sender", stable, sequentialPunchNAT, 250 * time.Millisecond},
+		{"stable-receiver", sequentialPunchNAT, stable, 250 * time.Millisecond},
+		{"both-stable", stable, stable, 0},
+	} {
+		t.Run(scenario.name, func(t *testing.T) {
+			network := newPunchLab(t, scenario.left, scenario.right)
 			engines := [2]*Engine{punchEngine(t, network, 0), punchEngine(t, network, 1)}
 			keyFrames := make(chan struct{}, 8)
 			source, err := engines[0].NewSource("vp8", 1, 1, func([]int) {
@@ -71,7 +83,7 @@ func TestPunchAdoptsProvedTupleIntoMediaAndFeedback(t *testing.T) {
 			right, rightPrediction := preparePunch(t, engines[1], nil, "connection", strings.Repeat("42", 32))
 			results := make(chan bool, 2)
 			go func() { results <- left.Run(*rightPrediction) }()
-			time.Sleep(skew)
+			time.Sleep(scenario.skew)
 			go func() { results <- right.Run(*leftPrediction) }()
 			for range 2 {
 				if !<-results {
@@ -138,6 +150,193 @@ func TestPunchAdoptsProvedTupleIntoMediaAndFeedback(t *testing.T) {
 	}
 }
 
+func TestPunchRetiresStableObservationSocket(t *testing.T) {
+	stable := vnet.NATType{MappingBehavior: vnet.EndpointIndependent, FilteringBehavior: vnet.EndpointAddrPortDependent}
+	for _, scenario := range []string{"connection", "source", "engine", "cancel-during", "no-response"} {
+		t.Run(scenario, func(t *testing.T) {
+			network := newPunchLab(t, stable, sequentialPunchNAT)
+			engine := punchEngine(t, network, 0)
+			var connections []*countedPunchConn
+			engine.listenPacket = func(_, address string) (net.PacketConn, error) {
+				conn, err := network.nets[0].ListenPacket("udp4", address)
+				if err != nil {
+					return nil, err
+				}
+				counted := &countedPunchConn{PacketConn: conn}
+				connections = append(connections, counted)
+				return counted, nil
+			}
+			source, err := engine.NewSource("vp8", 1, 1, nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+			t.Cleanup(func() { _ = source.Close() })
+			preparation, prediction := preparePunch(t, engine, source, "stable", strings.Repeat("42", 32))
+			if prediction.Step != 0 || len(connections) != 1 || connections[0].closed.Load() {
+				t.Fatal("stable observation did not retain its original socket")
+			}
+			if engine.TakePunchedSocket("stable", source) != nil {
+				t.Fatal("observation alone authorized socket adoption")
+			}
+			before := connections[0].writes.Load()
+			switch scenario {
+			case "connection":
+				engine.ClosePunch("stable")
+			case "source":
+				_ = source.Close()
+			case "engine":
+				_ = engine.Close()
+			default:
+				if scenario == "cancel-during" {
+					connections[0].firstWrite = preparation.cancel
+				}
+				if preparation.Run(PunchPrediction{Address: network.public[1], Port: 5000, Step: 1}) {
+					t.Fatal("unreachable peer completed preparation")
+				}
+				engine.ClosePunch("stable")
+			}
+			if len(connections) != 1 || !connections[0].closed.Load() || connections[0].writes.Load()-before > 8 {
+				t.Fatal("stable preparation replaced or leaked its socket, or exceeded its send budget")
+			}
+		})
+	}
+}
+
+func TestPunchRejectsAnotherGenerationOnStableMapping(t *testing.T) {
+	stable := vnet.NATType{MappingBehavior: vnet.EndpointIndependent, FilteringBehavior: vnet.EndpointIndependent}
+	network := newPunchLab(t, stable, stable)
+	leftEngine, rightEngine := punchEngine(t, network, 0), punchEngine(t, network, 1)
+	left, leftPrediction := preparePunch(t, leftEngine, nil, "left", strings.Repeat("42", 32))
+	right, rightPrediction := preparePunch(t, rightEngine, nil, "right", strings.Repeat("24", 32))
+	results := make(chan bool, 2)
+	go func() { results <- left.Run(*rightPrediction) }()
+	go func() { results <- right.Run(*leftPrediction) }()
+	for range 2 {
+		if <-results {
+			t.Fatal("another generation's packets authorized adoption")
+		}
+	}
+	if leftEngine.TakePunchedSocket("left", nil) != nil || rightEngine.TakePunchedSocket("right", nil) != nil {
+		t.Fatal("unauthenticated preparation exposed a socket")
+	}
+}
+
+func TestPunchSurveyViewRetiresWithoutClosingRetainedSocket(t *testing.T) {
+	network := newPunchLab(t, sequentialPunchNAT, sequentialPunchNAT)
+	socket, err := network.nets[0].ListenPacket("udp4", network.private[0]+":0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = socket.Close() })
+	view := &punchSurveySocket{PacketConn: socket}
+	if err := view.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err := socket.SetDeadline(time.Now().Add(500 * time.Millisecond)); err != nil {
+		t.Fatal(err)
+	}
+	buffer := make([]byte, 1024)
+	remote := &net.UDPAddr{IP: net.ParseIP(punchSTUNIP), Port: 3478}
+	if _, _, err := view.ReadFrom(buffer); !errors.Is(err, net.ErrClosed) {
+		t.Fatalf("closed survey view can read the next owner's socket: %v", err)
+	}
+	if _, err := view.WriteTo(buffer, remote); !errors.Is(err, net.ErrClosed) {
+		t.Fatalf("closed survey view can write the next owner's socket: %v", err)
+	}
+	if err := view.Close(); err != nil {
+		t.Fatal(err)
+	}
+	request := stun.MustBuild(stun.TransactionID, stun.BindingRequest)
+	if _, err := socket.WriteTo(request.Raw, remote); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := socket.ReadFrom(buffer); err != nil {
+		t.Fatalf("retiring the view damaged the retained socket: %v", err)
+	}
+}
+
+// A pipe models a backpressured write without timing-sensitive UDP buffers.
+// The first successful send may be dropped to exercise Pion's retransmitter.
+type blockedSurveyConn struct {
+	net.PacketConn
+	writer  net.Conn
+	entered chan struct{}
+	blockAt int32
+	writes  atomic.Int32
+	closed  atomic.Bool
+	once    sync.Once
+}
+
+func (c *blockedSurveyConn) WriteTo(p []byte, _ net.Addr) (int, error) {
+	if c.writes.Add(1) < c.blockAt {
+		return len(p), nil
+	}
+	c.once.Do(func() { close(c.entered) })
+	return c.writer.Write(p)
+}
+
+func (c *blockedSurveyConn) SetDeadline(deadline time.Time) error {
+	return errors.Join(c.writer.SetWriteDeadline(deadline), c.PacketConn.SetDeadline(deadline))
+}
+
+func (c *blockedSurveyConn) Close() error {
+	c.closed.Store(true)
+	return errors.Join(c.writer.Close(), c.PacketConn.Close())
+}
+
+func TestPunchSurveyRetiresBlockedWrites(t *testing.T) {
+	for _, phase := range []struct {
+		name    string
+		blockAt int32
+	}{{"initial", 1}, {"retransmission", 2}} {
+		for _, retirement := range []string{"cancel", "timeout"} {
+			t.Run(phase.name+"/"+retirement, func(t *testing.T) {
+				network := newPunchLab(t, sequentialPunchNAT, sequentialPunchNAT)
+				engine := punchEngine(t, network, 0)
+				packet, err := network.nets[0].ListenPacket("udp4", network.private[0]+":0")
+				if err != nil {
+					t.Fatal(err)
+				}
+				writer, reader := net.Pipe()
+				socket := &blockedSurveyConn{PacketConn: packet, writer: writer, entered: make(chan struct{}), blockAt: phase.blockAt}
+				t.Cleanup(func() { _ = socket.Close(); _ = reader.Close() })
+				engine.listenPacket = func(_, _ string) (net.PacketConn, error) { return socket, nil }
+				preparation, err := engine.BeginPunch("blocked", nil, []webrtc.ICEServer{{URLs: []string{
+					"stun:" + punchSTUNIP + ":3478", "stun:" + punchSTUNIP + ":3479", "stun:" + punchSTUNIP + ":3480",
+				}}}, strings.Repeat("42", 32))
+				if err != nil {
+					t.Fatal(err)
+				}
+				done := make(chan error, 1)
+				go func() { _, err := preparation.Prepare(); done <- err }()
+				waitSignal(t, socket.entered, "blocked STUN write")
+				closed := make(chan struct{})
+				wait := 2 * time.Second
+				if retirement == "cancel" {
+					wait = 500 * time.Millisecond
+					go func() { engine.ClosePunch("blocked"); close(closed) }()
+				}
+				select {
+				case err := <-done:
+					if err == nil || !socket.closed.Load() {
+						t.Fatal("failed survey succeeded or retained its socket")
+					}
+				case <-time.After(wait):
+					t.Fatal("retirement did not release a blocked STUN write")
+				}
+				if retirement == "cancel" {
+					waitSignal(t, closed, "blocked survey owner retirement")
+				} else {
+					engine.ClosePunch("blocked")
+				}
+				if engine.TakePunchedSocket("blocked", nil) != nil {
+					t.Fatal("failed survey exposed a socket")
+				}
+			})
+		}
+	}
+}
+
 func TestPunchRetirementJoinsBeforeSlotReuse(t *testing.T) {
 	for _, retire := range []string{"connection", "source", "engine", "context"} {
 		t.Run(retire, func(t *testing.T) {
@@ -238,7 +437,7 @@ func TestPunchSocketResourcesAreBoundedOnFailure(t *testing.T) {
 			if scenario == "invalid-secret" {
 				secret = nil
 			}
-			winner, err := punchSocketArray(ctx, listen, &net.UDPAddr{IP: net.ParseIP(network.public[1]), Port: 50000}, secret)
+			winner, err := punchSocketArray(ctx, listen, &net.UDPAddr{IP: net.ParseIP(network.public[1]), Port: 50000}, secret, nil)
 			if err == nil || winner != nil {
 				t.Fatal("failed preparation transferred a socket")
 			}
@@ -265,6 +464,7 @@ func TestPunchPredictionRejectsUnsafeDestinationsAndOverflow(t *testing.T) {
 		{Address: "224.0.0.1", Port: 5000, Step: 1}, {Address: "::1", Port: 5000, Step: 1},
 		{Address: "198.51.100.1", Port: math.MaxInt, Step: 1}, {Address: "198.51.100.1", Port: 65534, Step: 1},
 		{Address: "198.51.100.1", Port: 1000, Step: 1}, {Address: "198.51.100.1", Port: 5000, Step: 17},
+		{Address: "10.0.0.1", Port: 5000, Step: 0}, {Address: "198.51.100.1", Port: 5000, Step: -1},
 	} {
 		if _, err := prediction.Target(); err == nil {
 			t.Fatalf("accepted unsafe prediction: %+v", prediction)
diff --git a/internal/app/mediaedge/stun.go b/internal/app/mediaedge/stun.go
index 82dacd97e..f91c4eb3e 100644
--- a/internal/app/mediaedge/stun.go
+++ b/internal/app/mediaedge/stun.go
@@ -46,6 +46,10 @@ func (socket *iceSocket) querySTUN(ctx context.Context, server *net.UDPAddr) (*s
 	}
 	defer socket.mux.RemoveConnByUfrag(key)
 	defer connection.Close()
+	return querySTUNBinding(ctx, connection, server, request)
+}
+
+func querySTUNBinding(ctx context.Context, connection net.PacketConn, server *net.UDPAddr, request *stun.Message) (*stun.XORMappedAddress, error) {
 	client, err := stun.NewClient(&stunConnection{PacketConn: connection, server: server},
 		stun.WithLoggerFactory(diagnostics.PionLoggerFactory()))
 	if err != nil {
@@ -82,7 +86,7 @@ func (socket *iceSocket) querySTUN(ctx context.Context, server *net.UDPAddr) (*s
 }
 
 // Pion's STUN client owns transaction matching and retransmission. This view
-// only addresses its packets on the existing media mux.
+// only addresses its packets to the current discovery destination.
 type stunConnection struct {
 	net.PacketConn
 	server *net.UDPAddr
diff --git a/internal/app/nativecontrol/punch.go b/internal/app/nativecontrol/punch.go
index e38bf02b5..77d70cf6f 100644
--- a/internal/app/nativecontrol/punch.go
+++ b/internal/app/nativecontrol/punch.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 
 	"github.com/TNTcraftHIM/Piik/internal/app/mediaedge"
+	"github.com/TNTcraftHIM/Piik/internal/server/protocol"
 )
 
 type preparePunchRequest struct {
@@ -19,9 +20,9 @@ type preparePunchRequest struct {
 
 type runPunchRequest struct {
 	requestEnvelope
-	ShareID      string                    `json:"shareId"`
-	ConnectionID string                    `json:"connectionId"`
-	Prediction   mediaedge.PunchPrediction `json:"prediction"`
+	ShareID      string                   `json:"shareId"`
+	ConnectionID string                   `json:"connectionId"`
+	Prediction   protocol.PunchPrediction `json:"prediction"`
 }
 
 type punchPreparedResponse struct {
@@ -84,7 +85,8 @@ func (session *Session) handlePunch(envelope requestEnvelope, payload []byte, co
 		if err := decodeStrict(payload, &request); err != nil || !validIdentities(request.ShareID, request.ConnectionID) {
 			return nil, protocolViolation("native connection probe is invalid")
 		}
-		if _, err := request.Prediction.Target(); err != nil {
+		prediction := mediaedge.PunchPrediction(request.Prediction)
+		if _, err := prediction.Target(); err != nil {
 			return nil, err
 		}
 		media := session.currentMedia(request.ShareID)
@@ -96,7 +98,7 @@ func (session *Session) handlePunch(envelope requestEnvelope, payload []byte, co
 			return nil, errors.New("connection preparation was retired")
 		}
 		go func() {
-			result := punchCompleteResponse{response(envelope, "punch-complete"), preparation.Run(request.Prediction)}
+			result := punchCompleteResponse{response(envelope, "punch-complete"), preparation.Run(prediction)}
 			complete(result, nil)
 			session.emit(result)
 		}()
diff --git a/internal/app/nativecontrol/punch_test.go b/internal/app/nativecontrol/punch_test.go
index af67c8bc0..a0f9b5139 100644
--- a/internal/app/nativecontrol/punch_test.go
+++ b/internal/app/nativecontrol/punch_test.go
@@ -46,3 +46,22 @@ func TestPunchPreparationPreservesMediaRole(t *testing.T) {
 		}
 	})
 }
+
+func TestPunchRequiresExplicitMappingStep(t *testing.T) {
+	for _, step := range []string{"", `,"step":null`, `,"step":0`} {
+		t.Run(step, func(t *testing.T) {
+			session := New("", nativecapture.Capabilities{}, false)
+			t.Cleanup(func() { _ = session.Close() })
+			payload := []byte(`{"version":10,"id":"run_request","type":"run-punch","shareId":"share_id",` +
+				`"connectionId":"connection","prediction":{"address":"198.51.100.1","port":5000` + step + `}}`)
+			result, err := session.Handle(t.Context(), payload)
+			if step != `,"step":0` {
+				if err == nil {
+					t.Fatal("missing or null step accepted as a stable observation")
+				}
+			} else if _, failed := result.(requestFailedResponse); err != nil || !failed {
+				t.Fatalf("valid observation should reach the absent media session: %#v, %v", result, err)
+			}
+		})
+	}
+}
diff --git a/internal/server/protocol/punch.go b/internal/server/protocol/punch.go
index c7b5e9730..e74c151de 100644
--- a/internal/server/protocol/punch.go
+++ b/internal/server/protocol/punch.go
@@ -23,7 +23,7 @@ func (v *PunchPrediction) UnmarshalJSON(data []byte) error {
 		return err
 	}
 	address, err := netip.ParseAddr(v.Address)
-	if err != nil || !address.Is4() || v.Port < 1024 || v.Port > 65535 || v.Step < 1 || v.Step > 16 || v.Port+4*v.Step > 65535 {
+	if err != nil || !address.Is4() || v.Port < 1024 || v.Port > 65535 || v.Step < 0 || v.Step > 16 || v.Port+4*v.Step > 65535 {
 		return errors.New("invalid mapping observation")
 	}
 	return nil
diff --git a/internal/server/protocol/punch_test.go b/internal/server/protocol/punch_test.go
index 046b6fc01..fd992b89d 100644
--- a/internal/server/protocol/punch_test.go
+++ b/internal/server/protocol/punch_test.go
@@ -12,6 +12,7 @@ func TestPunchSignalStrictBoundedRoundTrip(t *testing.T) {
 		`{"phase":"prepare","secret":"` + strings.Repeat("42", 32) + `"}`,
 		`{"phase":"ready"}`, `{"phase":"ready","prediction":` + prediction + `}`,
 		`{"phase":"start","prediction":` + prediction + `}`,
+		`{"phase":"start","prediction":{"address":"198.51.100.1","port":65535,"step":0}}`,
 		`{"phase":"complete","connected":false}`, `{"phase":"complete","connected":true}`,
 	} {
 		raw := `{"kind":"punch","connectionId":"connection_123456","punch":` + body + `}`
@@ -32,6 +33,7 @@ func TestPunchSignalStrictBoundedRoundTrip(t *testing.T) {
 		`{"phase":"start","prediction":{"address":"::1","port":40000,"step":1}}`,
 		`{"phase":"start","prediction":{"address":"198.51.100.1","port":65535,"step":1}}`,
 		`{"phase":"start","prediction":{"address":"198.51.100.1","port":40000,"step":17}}`,
+		`{"phase":"start","prediction":{"address":"198.51.100.1","port":40000,"step":-1}}`,
 	} {
 		var payload PunchSignal
 		if err := json.Unmarshal([]byte(body), &payload); err == nil {
diff --git a/src/shared/protocol.ts b/src/shared/protocol.ts
index 9b0aca705..b070100e2 100644
--- a/src/shared/protocol.ts
+++ b/src/shared/protocol.ts
@@ -327,7 +327,7 @@ const iceCandidateSchema = z
 export const punchPredictionSchema = z.object({
   address: z.ipv4(),
   port: z.number().int().min(1024).max(65535),
-  step: z.number().int().min(1).max(16),
+  step: z.number().int().min(0).max(16),
 }).strict().refine(({ port, step }) => port + 4 * step <= 65535);
 export type PunchPrediction = z.infer<typeof punchPredictionSchema>;
 
diff --git a/tests/fixtures/wire-samples.json b/tests/fixtures/wire-samples.json
index 6ab72a219..788694d03 100644
--- a/tests/fixtures/wire-samples.json
+++ b/tests/fixtures/wire-samples.json
@@ -43,6 +43,18 @@
     "interactionIntervalMs": 800
   },
   "clientMessages": [
+    {
+      "name": "signal-punch-stable-mapping",
+      "schema": "client",
+      "json": "{\"type\":\"signal\",\"targetPeerId\":\"viewer_12345678\",\"payload\":{\"kind\":\"punch\",\"connectionId\":\"connection_12345678\",\"punch\":{\"phase\":\"ready\",\"prediction\":{\"address\":\"198.51.100.1\",\"port\":65535,\"step\":0}}}}",
+      "valid": true
+    },
+    {
+      "name": "signal-punch-negative-step",
+      "schema": "client",
+      "json": "{\"type\":\"signal\",\"targetPeerId\":\"viewer_12345678\",\"payload\":{\"kind\":\"punch\",\"connectionId\":\"connection_12345678\",\"punch\":{\"phase\":\"start\",\"prediction\":{\"address\":\"198.51.100.1\",\"port\":40000,\"step\":-1}}}}",
+      "valid": false
+    },
     {
       "name": "send-unregistered-reaction",
       "schema": "client",

From 7ef2e0ad5ebe0aed6615fb352eea45e8072d37c8 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 02:10:30 +0800
Subject: [PATCH 189/262] test(network): add isolated real-process laboratory

---
 .github/workflows/repository-hygiene.yml |  29 ++++
 CONTRIBUTING.md                          |   4 +
 docs/research/network-lab.md             |  76 +++++++++
 docs/todo.md                             |   9 +-
 package.json                             |   1 +
 scripts/network-lab.ts                   | 192 +++++++++++++++++++++++
 scripts/network-lab/endpoint.ts          |  87 ++++++++++
 scripts/network-lab/network.ts           | 137 ++++++++++++++++
 scripts/network-lab/page.ts              |  79 ++++++++++
 scripts/network-lab/scenarios.ts         |  65 ++++++++
 scripts/network-lab/udp.ts               |  66 ++++++++
 scripts/tsconfig.json                    |   1 +
 tests/network-lab.test.ts                |  40 +++++
 13 files changed, 785 insertions(+), 1 deletion(-)
 create mode 100644 docs/research/network-lab.md
 create mode 100644 scripts/network-lab.ts
 create mode 100644 scripts/network-lab/endpoint.ts
 create mode 100644 scripts/network-lab/network.ts
 create mode 100644 scripts/network-lab/page.ts
 create mode 100644 scripts/network-lab/scenarios.ts
 create mode 100644 scripts/network-lab/udp.ts
 create mode 100644 tests/network-lab.test.ts

diff --git a/.github/workflows/repository-hygiene.yml b/.github/workflows/repository-hygiene.yml
index 1831958e5..a8020b4b7 100644
--- a/.github/workflows/repository-hygiene.yml
+++ b/.github/workflows/repository-hygiene.yml
@@ -17,6 +17,12 @@ on:
         description: Optional candidate version (vMAJOR.MINOR.PATCH); never publishes
         required: false
         type: string
+      network_lab:
+        description: Run the isolated Linux network laboratory (never publishes)
+        required: false
+        default: none
+        type: choice
+        options: [none, smoke, full]
 
 permissions:
   contents: read
@@ -101,6 +107,29 @@ jobs:
           PIIK_BUILD_VERSION: ${{ steps.release.outputs.version }}
           VITE_PIIK_VERSION: ${{ steps.release.outputs.version }}
           VITE_PIIK_REVISION: ${{ github.sha }}
+      - name: Prepare isolated network laboratory
+        if: github.event_name == 'workflow_dispatch' && inputs.network_lab != 'none' && inputs.network_lab != ''
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y nftables iproute2
+          mkdir -p build/network-lab/bin
+          CGO_ENABLED=0 go build -trimpath -o build/network-lab/bin/piik-server ./cmd/piik-server
+          CGO_ENABLED=0 go build -trimpath -o build/network-lab/bin/piik-app ./cmd/piik-app
+      - name: Run isolated network laboratory
+        if: github.event_name == 'workflow_dispatch' && inputs.network_lab != 'none' && inputs.network_lab != ''
+        timeout-minutes: 35
+        env:
+          CHROME_PATH: /usr/bin/google-chrome
+          PIIK_NETWORK_LAB_SUITE: ${{ inputs.network_lab }}
+        run: sudo --preserve-env=PATH,CHROME_PATH "$(command -v node)" --import tsx scripts/network-lab.ts --suite "$PIIK_NETWORK_LAB_SUITE"
+      - name: Save network laboratory evidence
+        if: always() && github.event_name == 'workflow_dispatch' && inputs.network_lab != 'none' && inputs.network_lab != ''
+        uses: actions/upload-artifact@v7
+        with:
+          name: network-lab-${{ github.sha }}
+          path: build/network-lab/results/
+          if-no-files-found: error
+          retention-days: 7
 
   release-server:
     needs: validate
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 8b2cb698e..d7f3608fc 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -121,6 +121,10 @@ does not establish coverage.
   result. A manual diagnostic may locate a failure, but is not retained as pass
   evidence. Existing `PIIK_CLIENT_*` gate environment names retain their current
   contract; renaming the tools does not change those overrides.
+- `gate:network-lab` runs the opt-in [controlled network laboratory](./docs/research/network-lab.md).
+  It requires a disposable Linux runner with namespace administration. Its own
+  routers contain all firewall and traffic-shaping changes; do not run it on a
+  production service or treat its model results as a public success rate.
 - On Windows, execute App/Server and Go test binaries only from stable
   project build paths. Go's temporary compiler/cache files are not firewall
   identities; do not run network tests with a changing temporary executable
diff --git a/docs/research/network-lab.md b/docs/research/network-lab.md
new file mode 100644
index 000000000..3ffab3af7
--- /dev/null
+++ b/docs/research/network-lab.md
@@ -0,0 +1,76 @@
+# Controlled Network Laboratory
+
+This document owns the laboratory's method and evidence limits. Product routing
+remains in [routing and transport](../standards/routing-transport.md); pending
+work remains in [TODO](../todo.md). The laboratory does not authorize NAT or
+adaptation changes.
+
+## Design And References
+
+Reviewed on 2026-10-13:
+
+- [Tailscale NAT Lab](https://github.com/tailscale/tailscale/issues/13038)
+  combines precise in-memory models with real systems attached to a virtual
+  Internet. Keep both layers: a model regression cannot establish complete App
+  or Browser behavior.
+- [WebRTC Network Emulation Framework](https://webrtc.googlesource.com/src/+/HEAD/test/network/g3doc/index.md)
+  separates endpoints, routes, traffic behavior and measurements. Preserve
+  directional links and distinguish simulated time from real-process timing.
+- [Mahimahi, ATC 2015](https://www.usenix.org/conference/atc15/technical-session/presentation/netravali)
+  motivates isolated, reproducible network conditions around real applications.
+- [CellReplay, NSDI 2025](https://www.usenix.org/conference/nsdi25/presentation/sentosa)
+  shows that replay can be workload-sensitive. Synthetic delay/loss profiles are
+  named impairments, not validated replicas of a carrier or Wi-Fi network.
+- [RFC 4787](https://www.rfc-editor.org/rfc/rfc4787) separates UDP mapping from
+  filtering. Describe both; a random-port Linux SNAT rule alone does not prove a
+  named consumer-router NAT type.
+- [Linux network namespaces](https://man7.org/linux/man-pages/man8/ip-netns.8.html),
+  [nftables NAT](https://wiki.nftables.org/wiki-nftables/index.php/Performing_Network_Address_Translation_(NAT))
+  and [netem](https://man7.org/linux/man-pages/man8/tc-netem.8.html)
+  provide the real-process substrate without another product dependency.
+
+## Acceptance Contract
+
+The laboratory is complete only when the following are executable and verified:
+
+1. Isolated Host, Viewer, routers and Site run real processes. Only laboratory
+   namespaces, profiles and files are mutated; ordinary routes/firewall rules
+   remain unchanged. Cancellation and failed setup clean up owned resources.
+2. Existing Pion model tests retain precise mapping/filtering and socket-transfer
+   coverage. Real-network calibration independently checks the configured NAT,
+   reachability, delay, rate and loss before attributing an outcome to Piik.
+3. Browser/Browser, App/Browser, Browser/App and App/App paths use the actual UI,
+   signaling and media owners. A generated picture/tone replaces physical capture
+   only; no route, SDP, candidate, timeout or readiness is synthesized.
+4. Scenarios cover discovery failure, different NAT behavior, asymmetric paths,
+   finite outage, address/mapping changes, constrained/recovered media, a healthy
+   sibling, signaling-only interruption, SFU fallback and bounded total failure.
+   IPv4/IPv6 are distinguished. Unsupported environments fail preflight rather
+   than silently omitting required cases.
+5. Success requires decoded, progressing media and feedback, not merely an ICE
+   connection or route message. Record first-picture and recovery times, media
+   dimensions/cadence, loss, selected path, UI state and cleanup. Unmatched
+   measurements and timed-out cases remain failures, never zero-valued successes.
+6. Repeatable scenario inputs, software/kernel identity, seeds, observed fault
+   counters and bounded timelines accompany a structured report. Paired
+   enhancement on/off comparisons use the same scenario and endpoints. Report
+   counts and distributions without presenting a model pass rate as Internet
+   success probability.
+7. A documented command and opt-in Linux CI entry run the same checks. Exercise
+   failed/cancelled runs as well as passing runs; verify that a deliberately
+   missing fault or broken media path cannot produce a passing report.
+
+## Boundaries
+
+The fast layer already uses Pion vnet in `internal/app/mediaedge` and
+`internal/media/forwarding`. It exercises production transport with synthetic
+media, not every Browser/OS behavior. The process layer uses Linux namespaces,
+kernel NAT/firewall rules and traffic shaping. Neither layer establishes
+Windows/macOS driver behavior, physical radio scheduling, mobile suspension or
+the distribution of real-world NATs.
+
+Actual packets/counters must corroborate each impairment. DevTools accepting a
+network-emulation request is insufficient: an earlier Piik check observed RTP
+outside the requested limits. Keep negative controls, finite deadlines and
+resource limits as part of the laboratory rather than changing product recovery
+to make an experiment pass.
diff --git a/docs/todo.md b/docs/todo.md
index 34fb0cf18..338de6202 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -1,6 +1,6 @@
 # Current TODO Ledger
 
-Last reviewed: 2026-10-12
+Last reviewed: 2026-10-13
 
 The current 2.0 preparation includes independent investigation across this
 ledger. Explicit owner holds remain in force; an investigation does not itself
@@ -10,6 +10,13 @@ Git/PRs own completed history.
 
 ## Now
 
+- [ ] **Controlled network laboratory.** Complete the owned
+  [acceptance contract](./research/network-lab.md#acceptance-contract): real
+  isolated App/Browser paths, calibrated impairments, NAT/recovery/SFU scenarios,
+  repeatable reports, negative controls and cancellation cleanup. Establish this
+  evidence before further NAT mechanism changes. Model results do not replace
+  physical-network beta or establish a public success percentage.
+
 - [ ] **2.0 candidate preparation and acceptance.** The owner reopened investigation,
   useful improvements and outstanding acceptance on 2026-10-07, and on 2026-10-09
   chose to hold the maintenance changes for 2.0 rather than publish them separately.
diff --git a/package.json b/package.json
index 556aa3c8e..c3f4bba17 100644
--- a/package.json
+++ b/package.json
@@ -21,6 +21,7 @@
     "check:container": "node scripts/check-container.mjs",
     "check:native": "node scripts/check-go.mjs --capture-only",
     "gate:app-media": "tsx scripts/app-media-gate.ts",
+    "gate:network-lab": "tsx scripts/network-lab.ts",
     "gate:app-native-host": "tsx scripts/app-native-host-gate.ts",
     "gate:app-browser-fanout": "tsx scripts/app-browser-fanout-gate.ts",
     "gate:embedded-sfu": "tsx scripts/embedded-sfu-gate.ts",
diff --git a/scripts/network-lab.ts b/scripts/network-lab.ts
new file mode 100644
index 000000000..d22fefa84
--- /dev/null
+++ b/scripts/network-lab.ts
@@ -0,0 +1,192 @@
+import { spawn, type ChildProcessWithoutNullStreams } from "node:child_process";
+import { once } from "node:events";
+import { mkdir, writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { createInterface } from "node:readline";
+import { parseArgs } from "node:util";
+import { setTimeout as delay } from "node:timers/promises";
+import { withDeadline } from "./browser-gate-harness";
+import { endpointWorker } from "./network-lab/endpoint";
+import { command, LabNetwork, SITE_IP, SITE_ORIGIN } from "./network-lab/network";
+import { checkCalibration, hasPicture, selectScenarios, type Scenario } from "./network-lab/scenarios";
+import { echoWorker, type ProbeResult } from "./network-lab/udp";
+import type { MediaSample } from "./network-lab/page";
+
+const ROOT = resolve(import.meta.dirname, ".."), ENTRY = resolve(import.meta.filename);
+const { values } = parseArgs({ options: { worker: { type: "string" }, suite: { type: "string", default: "smoke" },
+  cases: { type: "string" }, repeat: { type: "string", default: "1" }, seed: { type: "string", default: "1" }, list: { type: "boolean" } } });
+
+class Endpoint {
+  private id = 0;
+  private readonly pending = new Map<number, { resolve: (value: unknown) => void; reject: (error: Error) => void }>();
+  readonly process: ChildProcessWithoutNullStreams;
+  constructor(namespace: string) {
+    this.process = spawn("ip", ["netns", "exec", namespace, process.execPath, "--import", "tsx", ENTRY, "--worker", "endpoint"],
+      { cwd: ROOT, env: labEnvironment(), stdio: "pipe" });
+    this.process.stderr.on("data", data => process.stderr.write(data));
+    createInterface({ input: this.process.stdout }).on("line", line => {
+      try {
+        const reply = JSON.parse(line), pending = this.pending.get(reply.id);
+        if (!pending) return;
+        this.pending.delete(reply.id);
+        if (reply.error) pending.reject(new Error(reply.error)); else pending.resolve(reply.result);
+      } catch { this.fail(new Error("Invalid endpoint response")); }
+    });
+    this.process.on("error", error => this.fail(error));
+    this.process.on("exit", (code, signal) => this.fail(new Error(`Endpoint exited (${code ?? signal})`)));
+  }
+  private fail(error: Error): void { for (const item of this.pending.values()) item.reject(error); this.pending.clear(); }
+  async call<T>(action: string, args: Record<string, unknown> = {}, timeout = 45_000): Promise<T> {
+    const id = ++this.id;
+    try {
+      return await withDeadline(() => new Promise<T>((resolveCall, reject) => {
+        this.pending.set(id, { resolve: value => resolveCall(value as T), reject });
+        this.process.stdin.write(JSON.stringify({ id, action, ...args }) + "\n", error => {
+          if (error) { this.pending.delete(id); reject(error); }
+        });
+      }), Date.now() + timeout);
+    } finally { this.pending.delete(id); }
+  }
+}
+
+function labEnvironment(): NodeJS.ProcessEnv {
+  return { PATH: process.env.PATH, CHROME_PATH: process.env.CHROME_PATH, LANG: "C.UTF-8", TMPDIR: process.env.TMPDIR };
+}
+
+async function runCase(scenario: Scenario, seed: number, output: string): Promise<Record<string, unknown>> {
+  const network = new LabNetwork(), samples: Array<{ elapsedMs: number; host: MediaSample; viewer: MediaSample }> = [];
+  const started = performance.now(), endpoints: Endpoint[] = [];
+  let server: ChildProcessWithoutNullStreams | null = null, echo: ChildProcessWithoutNullStreams | null = null;
+  const result: Record<string, unknown> = { scenario, seed, passed: false, stage: "setup", samples };
+  let signal: string | null = null;
+  const interrupted = () => { signal = "interrupted"; };
+  process.once("SIGINT", interrupted); process.once("SIGTERM", interrupted);
+  try {
+    network.setup([scenario.nat, scenario.nat]);
+    echo = spawn("ip", ["netns", "exec", network.wan, process.execPath, "--import", "tsx", ENTRY, "--worker", "echo"],
+      { cwd: ROOT, env: labEnvironment(), stdio: "pipe" });
+    echo.stderr.on("data", data => process.stderr.write(data));
+    await withDeadline(() => once(echo!.stdout, "data"), Date.now() + 10_000);
+    for (let i = 0; i < 2; i++) endpoints.push(new Endpoint(network.endpoint(i)));
+    result.stage = "calibration";
+    const before = await endpoints[0]!.call<ProbeResult>("probe");
+    network.setFault(0, scenario.duringShare ? "none" : scenario.fault, seed);
+    const after = await endpoints[0]!.call<ProbeResult>("probe", { load: ["rate", "loss"].includes(scenario.fault) });
+    checkCalibration(before, after, scenario.duringShare ? "none" : scenario.fault);
+    result.calibration = { before, after }; result.initialCounters = network.counters(0);
+    result.stage = "startup";
+    server = spawn("ip", ["netns", "exec", network.wan, resolve("build/network-lab/bin/piik-server")], {
+      cwd: output, stdio: "pipe", env: { ...labEnvironment(), PIIK_ENV: "development", ROOM_DATABASE_PATH: ":memory:",
+        LISTEN_HOST: SITE_IP, PORT: "9000", PUBLIC_BASE_URL: SITE_ORIGIN, ALLOWED_ORIGINS: SITE_ORIGIN,
+        STUN_URLS: `stun:${SITE_IP}:3478,stun:${SITE_IP}:3479,stun:${SITE_IP}:3480`, STUN_LISTEN_HOST: SITE_IP,
+        NAT_PREDICTION_ENABLED: "true", ...(scenario.sfu ? { SFU_UDP_PORT: "7882", SFU_LISTEN_HOST: SITE_IP, SFU_PUBLIC_IP: SITE_IP } : {}) },
+    });
+    let serverLog = "";
+    server.stdout.on("data", data => { serverLog = (serverLog + data).slice(-32_000); });
+    server.stderr.on("data", data => { serverLog = (serverLog + data).slice(-32_000); });
+    await once(server, "spawn"); await delay(300);
+    result.versions = await Promise.all(endpoints.map((endpoint, index) => endpoint.call("start", {
+      origin: SITE_ORIGIN, app: (index === 0 ? scenario.host : scenario.viewer) === "app",
+    })));
+    result.stage = "share";
+    await endpoints[0]!.call("navigate", { url: SITE_ORIGIN + (scenario.host === "app" ? "/#piik-client=1" : "/") });
+    const invitation = await endpoints[0]!.call<string>("share");
+    const joinedAt = performance.now();
+    await endpoints[1]!.call("navigate", { url: invitation + (scenario.viewer === "app" ? "&piik-client=1" : "") });
+    result.stage = "first-picture";
+    let connected = false, exhausted = false;
+    while (performance.now() - joinedAt < 110_000) {
+      if (signal) throw new Error(signal);
+      const host = await endpoints[0]!.call<MediaSample>("sample"), viewer = await endpoints[1]!.call<MediaSample>("sample");
+      samples.push({ elapsedMs: performance.now() - started, host, viewer });
+      connected = hasPicture(viewer); exhausted = viewer.events.some(event => event.reason === "route-exhausted");
+      if (connected || exhausted) break;
+      await delay(500);
+    }
+    result.firstPictureMs = connected ? performance.now() - joinedAt : null;
+    result.outcome = connected ? "media" : exhausted ? "unavailable" : "timeout";
+    if (result.outcome !== scenario.expected) throw new Error(`Expected ${scenario.expected}, observed ${result.outcome}; ${serverLog.slice(-1000)}`);
+    if (connected) {
+      result.stage = "continuity";
+      const first = samples.at(-1)!.viewer;
+      await delay(3000);
+      const next = await endpoints[1]!.call<MediaSample>("sample");
+      samples.push({ elapsedMs: performance.now() - started, host: await endpoints[0]!.call("sample"), viewer: next });
+      if (next.frames - first.frames < 30) throw new Error("Decoded video did not continue after initial picture");
+      if (scenario.host === "app" && !samples.at(-1)!.host.controls.includes("receive-offer")) throw new Error("Host bypassed expected App ingress");
+      if (scenario.viewer === "app" && !next.controls.includes("receive-offer")) throw new Error("Viewer bypassed expected App reception");
+      if (scenario.duringShare) {
+        result.stage = "impairment";
+        network.setFault(0, scenario.fault, seed);
+        const impaired = await endpoints[0]!.call<ProbeResult>("probe", { load: scenario.fault === "rate" });
+        checkCalibration(before, impaired, scenario.fault);
+        result.impairedCalibration = impaired;
+        const impairedAt = performance.now();
+        while (performance.now() - impairedAt < 8000) {
+          if (signal) throw new Error(signal);
+          samples.push({ elapsedMs: performance.now() - started, host: await endpoints[0]!.call("sample"), viewer: await endpoints[1]!.call("sample") });
+          await delay(500);
+        }
+        result.impairedCounters = network.counters(0);
+        network.setFault(0, "none", seed);
+        result.stage = "recovery";
+        const restoredAt = performance.now(); let recovered = false;
+        while (performance.now() - restoredAt < 60_000) {
+          if (signal) throw new Error(signal);
+          const previous = samples.at(-1)!.viewer;
+          await delay(1000);
+          const viewer = await endpoints[1]!.call<MediaSample>("sample");
+          samples.push({ elapsedMs: performance.now() - started, host: await endpoints[0]!.call("sample"), viewer });
+          if (hasPicture(viewer) && viewer.frames - previous.frames >= 15) { recovered = true; break; }
+        }
+        result.recoveryMs = recovered ? performance.now() - restoredAt : null;
+        if (!recovered) throw new Error("Media did not resume within the recovery observation window");
+      }
+    }
+    await endpoints[1]!.call("screenshot", { output: join(output, "viewer.png") });
+    result.finalCounters = network.counters(0);
+    await endpoints[0]!.call("stop");
+    result.passed = true; result.stage = "done";
+  } catch (error) { result.error = error instanceof Error ? error.message : String(error); }
+  finally {
+    result.endpointCleanup = await Promise.all(endpoints.map(endpoint => endpoint.call("close", {}, 15_000).catch(error => ({ error: String(error) }))));
+    echo?.stdin.end(); server?.kill("SIGTERM");
+    await delay(200);
+    result.cleanup = await network.close();
+    if (!(result.endpointCleanup as Array<Record<string, unknown>>).every(value => Object.values(value).every(flag => flag === true)) ||
+        !Object.values(result.cleanup as Record<string, boolean>).every(Boolean)) result.passed = false;
+    process.off("SIGINT", interrupted); process.off("SIGTERM", interrupted);
+    result.durationMs = performance.now() - started;
+    await writeFile(join(output, "result.json"), JSON.stringify(result, null, 2) + "\n");
+  }
+  return result;
+}
+
+async function main(): Promise<void> {
+  const selected = selectScenarios(values.suite!, values.cases);
+  if (values.list) { process.stdout.write(JSON.stringify(selected, null, 2) + "\n"); return; }
+  if (process.platform !== "linux" || process.getuid?.() !== 0) throw new Error("Network lab requires an isolated Linux runner and root for owned namespaces");
+  if (!process.env.CHROME_PATH) throw new Error("CHROME_PATH is required");
+  const repeat = Number(values.repeat), seed = Number(values.seed);
+  if (!Number.isInteger(repeat) || repeat < 1 || repeat > 20 || !Number.isInteger(seed) || seed < 1 || seed > 0xffff_ffff) throw new Error("Invalid repeat (1..20) or seed (uint32)");
+  for (const tool of ["ip", "tc", "nft", "sysctl"]) command("which", [tool]);
+  const output = resolve("build/network-lab/results", new Date().toISOString().replaceAll(/[:.]/g, "-"));
+  await mkdir(output, { recursive: true });
+  const identity = { revision: command("git", ["rev-parse", "HEAD"]), kernel: command("uname", ["-a"]),
+    node: process.version, iproute: command("ip", ["-Version"]), nftables: command("nft", ["--version"]), selected, repeat, seed };
+  await writeFile(join(output, "environment.json"), JSON.stringify(identity, null, 2) + "\n");
+  const results: Array<Record<string, unknown>> = [];
+  for (let iteration = 0; iteration < repeat; iteration++) for (const scenario of selected) {
+    const directory = join(output, `${scenario.id}-${iteration + 1}`); await mkdir(directory);
+    process.stdout.write(JSON.stringify({ starting: scenario.id, iteration: iteration + 1 }) + "\n");
+    const result = await runCase(scenario, seed + iteration, directory); results.push(result);
+    process.stdout.write(JSON.stringify({ case: scenario.id, passed: result.passed, stage: result.stage, error: result.error }) + "\n");
+  }
+  await writeFile(join(output, "summary.json"), JSON.stringify(results.map(({ samples: _samples, ...result }) => result), null, 2) + "\n");
+  if (results.some(result => result.passed !== true)) process.exitCode = 1;
+}
+
+if (values.worker === "endpoint") await endpointWorker();
+else if (values.worker === "echo") await echoWorker();
+else if (values.worker) throw new Error("Unknown network lab worker");
+else await main();
diff --git a/scripts/network-lab/endpoint.ts b/scripts/network-lab/endpoint.ts
new file mode 100644
index 000000000..ba56ce25a
--- /dev/null
+++ b/scripts/network-lab/endpoint.ts
@@ -0,0 +1,87 @@
+import { spawn, type ChildProcessWithoutNullStreams } from "node:child_process";
+import { once } from "node:events";
+import { mkdtemp, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { createInterface } from "node:readline";
+import { CdpConnection, cleanupRun, createPage, evaluate, launchChrome, reservePort, waitForSample,
+  waitForVersion, type PageHandle } from "../browser-gate-harness";
+import { readAppEndpoint } from "../app-gate-endpoint";
+import { pageProbe, type MediaSample } from "./page";
+import { udpProbe } from "./udp";
+
+export async function endpointWorker(): Promise<void> {
+  let chrome: ChildProcessWithoutNullStreams | null = null, app: ChildProcessWithoutNullStreams | null = null;
+  let cdp: CdpConnection | null = null, page: PageHandle | null = null;
+  const profile = await mkdtemp(join(tmpdir(), "piik-client-media-"));
+  const ports: number[] = [];
+  let closed = false;
+  const cleanup = async () => {
+    if (closed) return;
+    closed = true;
+    return cleanupRun({ chrome, native: app, cdp, server: null, profile, ports });
+  };
+  const sample = () => evaluate<MediaSample>(cdp!, page!, "networkLab.sample()", Date.now() + 5000);
+  const click = async (selector: string) => {
+    await waitForSample(deadline => evaluate<boolean>(cdp!, page!,
+      `Boolean(document.querySelector(${JSON.stringify(selector)}))`, deadline), Boolean, 10_000);
+    await evaluate(cdp!, page!, `document.querySelector(${JSON.stringify(selector)}).click()`, Date.now() + 5000);
+  };
+  try {
+    for await (const line of createInterface({ input: process.stdin })) {
+      const request = JSON.parse(line) as { id: number; action: string; origin?: string; app?: boolean;
+        url?: string; output?: string; load?: boolean };
+      try {
+        let result: unknown;
+        if (request.action === "probe") {
+          result = await udpProbe(request.load === true);
+        } else if (request.action === "start") {
+          const origin = new URL(request.origin!).origin;
+          if (request.app) {
+            app = spawn(resolve("build/network-lab/bin/piik-app"), ["--site", origin, "--config", join(profile, "app.json")],
+              { stdio: "pipe", env: { ...process.env, PIIK_CLIENT_GATE_NO_BROWSER: "true", PIIK_LOG_DIR: join(profile, "logs") } });
+            await once(app, "spawn"); app.stderr.resume();
+            ports.push((await readAppEndpoint(app)).port); app.stdout.resume();
+          }
+          const debugPort = await reservePort(); ports.push(debugPort);
+          chrome = await launchChrome(process.env.CHROME_PATH!, debugPort, profile, [
+            "--headless=new", "--no-sandbox", "--disable-dev-shm-usage", "--no-first-run", "--no-default-browser-check",
+            "--no-proxy-server", "--autoplay-policy=no-user-gesture-required", "--disable-background-timer-throttling",
+            "--disable-renderer-backgrounding", "--disable-backgrounding-occluded-windows",
+            `--unsafely-treat-insecure-origin-as-secure=${origin}`,
+          ]);
+          chrome.stdout.resume(); chrome.stderr.resume();
+          const version = await waitForVersion(debugPort, chrome);
+          cdp = await CdpConnection.connect(version.webSocketDebuggerUrl, Date.now() + 10_000);
+          await cdp.call("Browser.setPermission", { origin, permission: { name: "loopback-network" }, setting: "granted" }, undefined, Date.now() + 5000);
+          result = { browser: version.Browser, app: request.app === true };
+        } else if (request.action === "navigate") {
+          page = await createPage(cdp!, request.url!, pageProbe);
+          result = true;
+        } else if (request.action === "share") {
+          await click('button[aria-controls="host-advanced-door"]');
+          await click('button[aria-label^="VP8"]');
+          await click('button[aria-label="720p"]');
+          await click("button.lr-tv-big.is-action");
+          await click('button[data-source-tab="browser"]');
+          await click(".lr-source-option.is-browser");
+          await waitForSample(sample, value => value.sharing && value.width > 0, 30_000);
+          result = await evaluate<string>(cdp!, page!, "document.querySelector('.lr-invite-url').value", Date.now() + 5000);
+        } else if (request.action === "sample") {
+          result = await sample();
+        } else if (request.action === "stop") {
+          await click('button[aria-label="Stop sharing"]'); result = true;
+        } else if (request.action === "screenshot") {
+          const shot = await cdp!.call<{ data: string }>("Page.captureScreenshot", { format: "png" }, page!.sessionId, Date.now() + 5000);
+          await writeFile(request.output!, Buffer.from(shot.data, "base64")); result = true;
+        } else if (request.action === "close") {
+          result = await cleanup();
+        } else throw new Error("Unknown endpoint action");
+        process.stdout.write(JSON.stringify({ id: request.id, result }) + "\n");
+        if (closed) break;
+      } catch (error) {
+        process.stdout.write(JSON.stringify({ id: request.id, error: error instanceof Error ? error.message : String(error) }) + "\n");
+      }
+    }
+  } finally { await cleanup(); }
+}
diff --git a/scripts/network-lab/network.ts b/scripts/network-lab/network.ts
new file mode 100644
index 000000000..6dc34570f
--- /dev/null
+++ b/scripts/network-lab/network.ts
@@ -0,0 +1,137 @@
+import { execFileSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { readlinkSync } from "node:fs";
+
+export const SITE_IP = "198.51.100.1";
+export const SITE_ORIGIN = `http://${SITE_IP}:9000`;
+export type NatMode = "preserve" | "random";
+export type Fault = "none" | "peer-block" | "udp-block" | "stun-primary" | "delay" | "loss" | "rate" | "signaling";
+
+export function command(program: string, args: string[], input?: string): string {
+  return execFileSync(program, args, { encoding: "utf8", timeout: 10_000,
+    maxBuffer: 2 * 1024 * 1024, stdio: ["pipe", "pipe", "pipe"], input }).trim();
+}
+
+// Owns only namespaces and veth pairs created by this run. All routing,
+// firewall and sysctl changes happen inside those namespaces.
+export class LabNetwork {
+  readonly prefix = `piiklab-${randomBytes(4).toString("hex")}`;
+  readonly namespaces: string[] = [];
+  private readonly pendingLinks = new Set<string>();
+  private readonly originalRoutes = command("ip", ["-j", "route", "show", "table", "all"]);
+  private readonly originalRules = command("nft", ["-s", "list", "ruleset"]);
+  readonly wan = `${this.prefix}-wan`;
+
+  exec(namespace: string, program: string, args: string[], input?: string): string {
+    if (!this.namespaces.includes(namespace)) throw new Error("Unowned network namespace");
+    return command("ip", ["netns", "exec", namespace, program, ...args], input);
+  }
+
+  private add(name: string): void {
+    command("ip", ["netns", "add", name]);
+    this.namespaces.push(name);
+    this.exec(name, "ip", ["link", "set", "lo", "up"]);
+  }
+
+  private wire(left: string, leftName: string, right: string, rightName: string): void {
+    const suffix = randomBytes(4).toString("hex");
+    const a = `pl${suffix}a`, b = `pl${suffix}b`;
+    command("ip", ["link", "add", a, "type", "veth", "peer", "name", b]);
+    this.pendingLinks.add(a); this.pendingLinks.add(b);
+    for (const [device, namespace, name] of [[a, left, leftName], [b, right, rightName]]) {
+      command("ip", ["link", "set", device!, "netns", namespace!]);
+      this.pendingLinks.delete(device!);
+      this.exec(namespace!, "ip", ["link", "set", device!, "name", name!]);
+      this.exec(namespace!, "ip", ["link", "set", name!, "up"]);
+    }
+  }
+
+  setup(modes: NatMode[]): void {
+    this.add(this.wan);
+    this.exec(this.wan, "ip", ["link", "add", "internet", "type", "bridge"]);
+    this.exec(this.wan, "ip", ["addr", "add", `${SITE_IP}/24`, "dev", "internet"]);
+    this.exec(this.wan, "ip", ["addr", "add", "198.51.100.2/24", "dev", "internet"]);
+    this.exec(this.wan, "ip", ["link", "set", "internet", "up"]);
+    for (const [index, mode] of modes.entries()) {
+      const n = index + 1, endpoint = this.endpoint(index), router = this.router(index);
+      this.add(endpoint); this.add(router);
+      this.wire(endpoint, "eth0", router, "lan0");
+      this.wire(router, "wan0", this.wan, `port${n}`);
+      this.exec(this.wan, "ip", ["link", "set", `port${n}`, "master", "internet"]);
+      this.exec(endpoint, "ip", ["addr", "add", `10.71.${n}.2/24`, "dev", "eth0"]);
+      this.exec(router, "ip", ["addr", "add", `10.71.${n}.1/24`, "dev", "lan0"]);
+      this.exec(router, "ip", ["addr", "add", `${this.publicIP(index)}/24`, "dev", "wan0"]);
+      this.exec(endpoint, "ip", ["route", "add", "default", "via", `10.71.${n}.1`]);
+      this.exec(router, "sysctl", ["-qw", "net.ipv4.ip_forward=1"]);
+      this.exec(router, "nft", ["-f", "-"], `
+table ip lab_nat {
+ chain postrouting { type nat hook postrouting priority srcnat; policy accept;
+  oifname "wan0" snat to ${this.publicIP(index)}${mode === "random" ? " fully-random" : ""}
+ }
+}
+table inet lab_filter {
+ chain faults {}
+ chain forward { type filter hook forward priority filter; policy drop;
+  jump faults
+  iifname "lan0" counter accept
+  ct state established,related counter accept
+ }
+}
+`);
+    }
+  }
+
+  endpoint(index: number): string { return `${this.prefix}-end${index}`; }
+  router(index: number): string { return `${this.prefix}-nat${index}`; }
+  publicIP(index: number): string { return `198.51.100.${11 + index}`; }
+
+  setFault(index: number, fault: Fault, seed: number): void {
+    const router = this.router(index);
+    this.exec(router, "nft", ["flush", "chain", "inet", "lab_filter", "faults"]);
+    const rules: Partial<Record<Fault, string>> = {
+      "peer-block": "ip daddr 198.51.100.11-198.51.100.30 udp dport 1-65535 counter drop",
+      "udp-block": "meta l4proto udp counter drop",
+      "stun-primary": `ip daddr ${SITE_IP} udp dport 3478 counter drop`,
+      signaling: `ip daddr ${SITE_IP} tcp dport 9000 counter drop`,
+    };
+    if (rules[fault]) this.exec(router, "nft", ["-f", "-"],
+      `add rule inet lab_filter faults ${rules[fault]}\n`);
+    const impairment = fault === "delay" ? ["delay", "100ms", "20ms", "distribution", "normal"]
+      : fault === "loss" ? ["loss", "random", "5%", "seed", String(seed)]
+      : fault === "rate" ? ["rate", "600kbit", "limit", "30"] : ["delay", "0ms"];
+    this.exec(router, "tc", ["qdisc", "replace", "dev", "wan0", "root", "netem", ...impairment]);
+  }
+
+  counters(index: number): unknown {
+    return {
+      firewall: JSON.parse(this.exec(this.router(index), "nft", ["-j", "list", "table", "inet", "lab_filter"])),
+      queue: JSON.parse(this.exec(this.router(index), "tc", ["-j", "-s", "qdisc", "show", "dev", "wan0"])),
+    };
+  }
+
+  async close(): Promise<{ namespacesRemoved: boolean; hostNetworkUnchanged: boolean }> {
+    const failures: string[] = [];
+    for (const namespace of [...this.namespaces].reverse()) {
+      try {
+        const identity = this.exec(namespace, "readlink", ["/proc/self/ns/net"]);
+        const pids = command("ip", ["netns", "pids", namespace]).split(/\s+/).filter(Boolean);
+        for (const pid of pids) {
+          // Check membership again: do not signal an unrelated reused PID.
+          try { if (readlinkSync(`/proc/${pid}/ns/net`) === identity) process.kill(Number(pid), "SIGKILL"); }
+          catch (error) { if ((error as NodeJS.ErrnoException).code !== "ENOENT" && (error as NodeJS.ErrnoException).code !== "ESRCH") throw error; }
+        }
+        command("ip", ["netns", "delete", namespace]);
+      } catch { failures.push(namespace); }
+    }
+    for (const link of this.pendingLinks) {
+      // A failed move may already have destroyed the pair through namespace cleanup.
+      try { command("ip", ["link", "delete", link]); } catch {}
+    }
+    const remaining = command("ip", ["netns", "list"]);
+    return {
+      namespacesRemoved: failures.length === 0 && !remaining.includes(this.prefix),
+      hostNetworkUnchanged: command("ip", ["-j", "route", "show", "table", "all"]) === this.originalRoutes &&
+        command("nft", ["-s", "list", "ruleset"]) === this.originalRules,
+    };
+  }
+}
diff --git a/scripts/network-lab/page.ts b/scripts/network-lab/page.ts
new file mode 100644
index 000000000..fd52aba2b
--- /dev/null
+++ b/scripts/network-lab/page.ts
@@ -0,0 +1,79 @@
+// Synthetic capture is the only media substitution. PeerConnection, signaling,
+// candidate selection and readiness remain the production implementation.
+export const pageProbe = String.raw`(() => {
+  localStorage.setItem('piik:ui-lang','en'); localStorage.setItem('piik:ui-mode','text');
+  const peers=[], sockets=[], events=[], errors=[], controls=[];
+  const PC=RTCPeerConnection, WS=WebSocket;
+  const record=(list,value)=>{ list.push(value); if(list.length>240)list.shift(); };
+  window.addEventListener('unhandledrejection', e=>record(errors,String(e.reason)));
+  window.RTCPeerConnection=class extends PC { constructor(...args){super(...args); peers.push(this);} };
+  window.WebSocket=class extends WS {
+    constructor(...args){ super(...args); sockets.push(this);
+      this.addEventListener('message', event=>{
+        let message; try{message=JSON.parse(event.data);}catch{return;}
+        record(events,{at:performance.now(),type:message.type,state:message.state,reason:message.reason,
+          phase:message.phase,route:message.route?.kind});
+      });
+    }
+    send(raw){if(this.url.includes('/control')){try{record(controls,JSON.parse(raw).type);}catch{}}super.send(raw);}
+  };
+  navigator.mediaDevices.getDisplayMedia=async()=>{
+    const canvas=document.createElement('canvas'); canvas.width=1280; canvas.height=720;
+    const ctx=canvas.getContext('2d');let frame=0;
+    const draw=()=>{ctx.fillStyle='#19292f';ctx.fillRect(0,0,1280,720);
+      ctx.fillStyle='#68dab3';ctx.fillRect((frame*11)%1150,80,130,250);
+      ctx.fillStyle='#fff';ctx.font='70px sans-serif';ctx.fillText(String(frame++),80,540);};
+    draw();const timer=setInterval(draw,1000/30),stream=canvas.captureStream(30);
+    const video=stream.getVideoTracks()[0],stop=video.stop.bind(video);
+    video.stop=()=>{clearInterval(timer);stop();};
+    const ac=new AudioContext(),osc=ac.createOscillator(),dest=ac.createMediaStreamDestination();
+    osc.frequency.value=440;osc.connect(dest);osc.start();await ac.resume();
+    const sound=dest.stream.getAudioTracks()[0],stopSound=sound.stop.bind(sound);let stopped=false;
+    sound.stop=()=>{if(stopped)return;stopped=true;osc.stop();void ac.close();stopSound();};
+    stream.addTrack(sound);return stream;
+  };
+  window.networkLab={async sample(){
+    const stats=[];
+    for(const peer of peers){if(peer.connectionState==='closed')continue;
+      const report=await peer.getStats();
+      for(const row of report.values()){
+        if(row.type==='inbound-rtp'||row.type==='outbound-rtp'||row.type==='remote-inbound-rtp'){
+          const selected={type:row.type,kind:row.kind};
+          for(const key of ['framesDecoded','framesReceived','framesEncoded','framesDropped','framesPerSecond',
+            'frameWidth','frameHeight','bytesReceived','bytesSent','packetsLost','packetsReceived','nackCount',
+            'pliCount','totalDecodeTime','jitterBufferDelay','jitterBufferEmittedCount','totalAudioEnergy',
+            'totalSamplesDuration','roundTripTime','reportsReceived','qualityLimitationReason','targetBitrate']){
+            if(row[key]!==undefined)selected[key]=row[key];
+          }stats.push(selected);
+        }
+        if(row.type==='candidate-pair'&&row.nominated&&row.state==='succeeded'){
+          const local=report.get(row.localCandidateId),remote=report.get(row.remoteCandidateId);
+          stats.push({type:'selected-pair',rtt:row.currentRoundTripTime,bwe:row.availableOutgoingBitrate,
+            localType:local?.candidateType,remoteType:remote?.candidateType,protocol:remote?.protocol,
+            localAddress:local?.address,remoteAddress:remote?.address});
+        }
+      }
+    }
+    const video=document.querySelector('video');
+    return{at:performance.now(),width:video?.videoWidth||0,height:video?.videoHeight||0,
+      frames:video?.getVideoPlaybackQuality().totalVideoFrames||0,stats,events:[...events],errors:[...errors],controls:[...controls],
+      sharing:!!document.querySelector('button[aria-label="Stop sharing"]'),
+      controlOpen:sockets.some(s=>s.url.includes('/control')&&s.readyState===WS.OPEN),
+      peerStates:peers.map(p=>p.connectionState),text:document.body.innerText.slice(-2000)};
+  }};
+})();`;
+
+export interface MediaSample {
+  at: number;
+  width: number;
+  height: number;
+  frames: number;
+  stats: Array<Record<string, string | number>>;
+  events: Array<{ at: number; type: string; state?: string; reason?: string; phase?: string; route?: string }>;
+  errors: string[];
+  controls: string[];
+  sharing: boolean;
+  controlOpen: boolean;
+  peerStates: string[];
+  text: string;
+}
diff --git a/scripts/network-lab/scenarios.ts b/scripts/network-lab/scenarios.ts
new file mode 100644
index 000000000..fb498c448
--- /dev/null
+++ b/scripts/network-lab/scenarios.ts
@@ -0,0 +1,65 @@
+import type { Fault, NatMode } from "./network";
+import type { MediaSample } from "./page";
+import type { ProbeResult } from "./udp";
+
+export interface Scenario {
+  id: string;
+  host: "browser" | "app";
+  viewer: "browser" | "app";
+  nat: NatMode;
+  fault: Fault;
+  sfu: boolean;
+  expected: "media" | "unavailable";
+  duringShare?: boolean;
+}
+
+const baseline = { nat: "preserve", fault: "none", sfu: false, expected: "media" } as const;
+export const scenarios: readonly Scenario[] = [
+  { ...baseline, id: "browser-browser", host: "browser", viewer: "browser" },
+  { ...baseline, id: "app-browser", host: "app", viewer: "browser" },
+  { ...baseline, id: "browser-app", host: "browser", viewer: "app" },
+  { ...baseline, id: "app-app", host: "app", viewer: "app" },
+  { ...baseline, id: "delayed-browser", host: "browser", viewer: "browser", fault: "delay" },
+  { ...baseline, id: "lossy-browser", host: "browser", viewer: "browser", fault: "loss" },
+  { ...baseline, id: "stun-backup", host: "browser", viewer: "browser", fault: "stun-primary" },
+  { ...baseline, id: "sfu-fallback", host: "browser", viewer: "browser", fault: "peer-block", sfu: true },
+  { ...baseline, id: "blocked-media", host: "browser", viewer: "browser", fault: "udp-block", expected: "unavailable" },
+  { ...baseline, id: "bandwidth-recovery", host: "browser", viewer: "browser", fault: "rate", duringShare: true },
+  { ...baseline, id: "media-outage", host: "app", viewer: "app", fault: "udp-block", duringShare: true },
+  { ...baseline, id: "signaling-outage", host: "browser", viewer: "browser", fault: "signaling", duringShare: true },
+];
+
+export function selectScenarios(suite: string, names?: string): Scenario[] {
+  if (!["smoke", "full"].includes(suite)) throw new Error("Suite must be smoke or full");
+  if (!names) return suite === "full" ? [...scenarios] : scenarios.slice(0, 4);
+  const requested = names.split(",");
+  if (new Set(requested).size !== requested.length) throw new Error("Duplicate case name");
+  return requested.map(id => {
+    const scenario = scenarios.find(value => value.id === id);
+    if (!scenario) throw new Error(`Unknown case: ${id}`);
+    return scenario;
+  });
+}
+
+export function hasPicture(sample: MediaSample): boolean {
+  return sample.width > 0 && sample.height > 0 && sample.frames >= 15 &&
+    sample.stats.some(row => row.type === "inbound-rtp" && row.kind === "video" && Number(row.framesDecoded) >= 15);
+}
+
+export function checkCalibration(before: ProbeResult, after: ProbeResult, fault: Fault): void {
+  if (before.received !== before.sent || before.mappings.length !== 3 ||
+      before.mappings.some(mapping => !mapping.address.startsWith("198.51.100."))) {
+    throw new Error("Baseline probe did not traverse the expected NAT and all three destinations");
+  }
+  if (fault === "udp-block") {
+    if (after.received !== 0) throw new Error("Blocked UDP still reached the probe");
+  } else if (fault === "delay") {
+    if (after.received === 0 || Math.min(...after.rttMs) < 65) throw new Error("Configured delay was not observed");
+  } else if (fault === "loss") {
+    if (after.received === 0 || after.received >= after.sent) throw new Error("Configured loss was not observed");
+  } else if (fault === "rate") {
+    if (after.receivedBytes === 0 || after.receivedBytes * 8000 / after.durationMs > 900_000) {
+      throw new Error("Configured rate ceiling was not observed");
+    }
+  } else if (after.received !== after.sent) throw new Error("Control path unexpectedly lost calibration packets");
+}
diff --git a/scripts/network-lab/udp.ts b/scripts/network-lab/udp.ts
new file mode 100644
index 000000000..0c8ecf758
--- /dev/null
+++ b/scripts/network-lab/udp.ts
@@ -0,0 +1,66 @@
+import { createSocket, type Socket } from "node:dgram";
+import { once } from "node:events";
+import { performance } from "node:perf_hooks";
+import { setTimeout as delay } from "node:timers/promises";
+import { SITE_IP } from "./network";
+
+const targets = [{ host: SITE_IP, port: 41001 }, { host: SITE_IP, port: 41002 }, { host: "198.51.100.2", port: 41001 }];
+
+export async function echoWorker(): Promise<void> {
+  const sockets: Socket[] = [];
+  try {
+    for (const { host, port } of targets) {
+      const socket = createSocket("udp4"); sockets.push(socket);
+      socket.on("message", (data, remote) => {
+        if (data.length !== 1200 || data.readUInt32BE(0) !== 0x50494c42) return;
+        const reply = Buffer.from(data);
+        reply.writeUInt16BE(remote.port, 16);
+        remote.address.split(".").forEach((part, index) => reply[18 + index] = Number(part));
+        socket.send(reply, remote.port, remote.address, () => {});
+      });
+      socket.bind(port, host); await once(socket, "listening");
+    }
+    process.stdout.write(JSON.stringify({ ready: true }) + "\n");
+    await new Promise<void>(resolve => { process.stdin.once("end", resolve); process.stdin.resume(); });
+  } finally { for (const socket of sockets) socket.close(); }
+}
+
+export interface ProbeResult {
+  sent: number;
+  received: number;
+  receivedBytes: number;
+  durationMs: number;
+  rttMs: number[];
+  mappings: Array<{ destination: string; address: string; port: number }>;
+}
+
+export async function udpProbe(load: boolean): Promise<ProbeResult> {
+  const socket = createSocket("udp4"), start = performance.now();
+  const result: ProbeResult = { sent: 0, received: 0, receivedBytes: 0, durationMs: 0, rttMs: [], mappings: [] };
+  const seen = new Set<number>();
+  socket.on("message", (data, remote) => {
+    if (data.length !== 1200 || data.readUInt32BE(0) !== 0x50494c42) return;
+    const id = data.readUInt32BE(4);
+    if (id >= result.sent || seen.has(id)) return;
+    seen.add(id); result.received++; result.receivedBytes += data.length;
+    result.rttMs.push(performance.now() - data.readDoubleBE(8));
+    const destination = `${remote.address}:${remote.port}`;
+    if (!result.mappings.some(value => value.destination === destination)) result.mappings.push({
+      destination, address: [...data.subarray(18, 22)].join("."), port: data.readUInt16BE(16),
+    });
+  });
+  socket.bind(0, "0.0.0.0"); await once(socket, "listening");
+  try {
+    const count = load ? 1000 : 12;
+    for (let i = 0; i < count; i++) {
+      const target = targets[load ? 0 : i % targets.length]!;
+      const packet = Buffer.alloc(1200); packet.writeUInt32BE(0x50494c42, 0);
+      packet.writeUInt32BE(result.sent++, 4); packet.writeDoubleBE(performance.now(), 8);
+      await new Promise<void>((resolve, reject) => socket.send(packet, target.port, target.host, error => error ? reject(error) : resolve()));
+      await delay(load ? 1 : 20);
+    }
+    await delay(load ? 1000 : 600);
+    result.durationMs = performance.now() - start;
+    return result;
+  } finally { socket.close(); }
+}
diff --git a/scripts/tsconfig.json b/scripts/tsconfig.json
index bac74da98..977239a8e 100644
--- a/scripts/tsconfig.json
+++ b/scripts/tsconfig.json
@@ -25,6 +25,7 @@
     "../site/film/ui/website.ts",
     "access-privacy-gate.ts",
     "browser-local-pool-probe.ts",
+    "network-lab.ts",
     "app-browser-fanout-gate.ts",
     "app-media-gate.ts",
     "app-native-host-gate.ts",
diff --git a/tests/network-lab.test.ts b/tests/network-lab.test.ts
new file mode 100644
index 000000000..6ae739688
--- /dev/null
+++ b/tests/network-lab.test.ts
@@ -0,0 +1,40 @@
+import { describe, expect, it } from "vitest";
+import { checkCalibration, hasPicture, selectScenarios } from "../scripts/network-lab/scenarios";
+import type { MediaSample } from "../scripts/network-lab/page";
+import type { ProbeResult } from "../scripts/network-lab/udp";
+
+const baseline: ProbeResult = { sent: 12, received: 12, receivedBytes: 14400, durationMs: 850,
+  rttMs: [1, 2, 1], mappings: ["198.51.100.1:41001", "198.51.100.1:41002", "198.51.100.2:41001"].map(destination =>
+    ({ destination, address: "198.51.100.11", port: 45678 })) };
+
+describe("network laboratory evidence", () => {
+  it("rejects absent impairments rather than blessing an unaffected media path", () => {
+    for (const fault of ["udp-block", "delay", "loss", "rate"] as const) {
+      expect(() => checkCalibration(baseline, { ...baseline, durationMs: 20 }, fault)).toThrow();
+    }
+    expect(() => checkCalibration(baseline, { ...baseline, received: 0, receivedBytes: 0, rttMs: [] }, "udp-block")).not.toThrow();
+    expect(() => checkCalibration(baseline, { ...baseline, rttMs: [100, 95, 120] }, "delay")).not.toThrow();
+  });
+
+  it("rejects a bypassed NAT or broken baseline", () => {
+    expect(() => checkCalibration({ ...baseline, mappings: [] }, baseline, "none")).toThrow();
+    expect(() => checkCalibration({ ...baseline, received: 11 }, baseline, "none")).toThrow();
+    expect(() => checkCalibration({ ...baseline, mappings: baseline.mappings.map(value => ({ ...value, address: "10.71.1.2" })) }, baseline, "none")).toThrow();
+  });
+
+  it("does not confuse a connected transport or stale video dimensions with decoded media", () => {
+    const sample = { width: 1280, height: 720, frames: 30, stats: [] } as unknown as MediaSample;
+    expect(hasPicture(sample)).toBe(false);
+    expect(hasPicture({ ...sample, stats: [{ type: "inbound-rtp", kind: "video", framesDecoded: 30 }] })).toBe(true);
+    expect(hasPicture({ ...sample, stats: [{ type: "inbound-rtp", kind: "audio", framesDecoded: 30 }] })).toBe(false);
+  });
+
+  it("rejects misspelled or duplicated scenarios and lists every transport pairing", () => {
+    expect(() => selectScenarios("all")).toThrow();
+    expect(() => selectScenarios("full", "browser-brower")).toThrow();
+    expect(() => selectScenarios("full", "app-app,app-app")).toThrow();
+    expect(selectScenarios("smoke").map(value => `${value.host}/${value.viewer}`)).toEqual([
+      "browser/browser", "app/browser", "browser/app", "app/app",
+    ]);
+  });
+});

From 979ab66384d508b436ddf466b26cc1555797b414 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 02:15:44 +0800
Subject: [PATCH 190/262] test(network): pass namespace rules directly to nft

---
 scripts/network-lab/network.ts | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/scripts/network-lab/network.ts b/scripts/network-lab/network.ts
index 6dc34570f..e87e1fcfe 100644
--- a/scripts/network-lab/network.ts
+++ b/scripts/network-lab/network.ts
@@ -63,7 +63,7 @@ export class LabNetwork {
       this.exec(router, "ip", ["addr", "add", `${this.publicIP(index)}/24`, "dev", "wan0"]);
       this.exec(endpoint, "ip", ["route", "add", "default", "via", `10.71.${n}.1`]);
       this.exec(router, "sysctl", ["-qw", "net.ipv4.ip_forward=1"]);
-      this.exec(router, "nft", ["-f", "-"], `
+      this.exec(router, "nft", [`
 table ip lab_nat {
  chain postrouting { type nat hook postrouting priority srcnat; policy accept;
   oifname "wan0" snat to ${this.publicIP(index)}${mode === "random" ? " fully-random" : ""}
@@ -77,7 +77,7 @@ table inet lab_filter {
   ct state established,related counter accept
  }
 }
-`);
+`]);
     }
   }
 
@@ -94,8 +94,7 @@ table inet lab_filter {
       "stun-primary": `ip daddr ${SITE_IP} udp dport 3478 counter drop`,
       signaling: `ip daddr ${SITE_IP} tcp dport 9000 counter drop`,
     };
-    if (rules[fault]) this.exec(router, "nft", ["-f", "-"],
-      `add rule inet lab_filter faults ${rules[fault]}\n`);
+    if (rules[fault]) this.exec(router, "nft", [`add rule inet lab_filter faults ${rules[fault]}`]);
     const impairment = fault === "delay" ? ["delay", "100ms", "20ms", "distribution", "normal"]
       : fault === "loss" ? ["loss", "random", "5%", "seed", String(seed)]
       : fault === "rate" ? ["rate", "600kbit", "limit", "30"] : ["delay", "0ms"];

From 224cb91d897b53485ec986b8ce27d9ea3024becf Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 02:25:38 +0800
Subject: [PATCH 191/262] test(network): verify actual faults, media feedback
 and run cleanup

---
 .github/workflows/repository-hygiene.yml |   2 +-
 scripts/network-lab.ts                   | 135 ++++++++++++++++-------
 scripts/network-lab/endpoint.ts          |  21 +++-
 scripts/network-lab/network.ts           |  10 +-
 scripts/network-lab/packets.ts           |  66 +++++++++++
 scripts/network-lab/page.ts              |  55 ++++++---
 scripts/network-lab/scenarios.ts         |  17 +++
 tests/network-lab.test.ts                |  43 +++++++-
 8 files changed, 287 insertions(+), 62 deletions(-)
 create mode 100644 scripts/network-lab/packets.ts

diff --git a/.github/workflows/repository-hygiene.yml b/.github/workflows/repository-hygiene.yml
index a8020b4b7..e2ac04511 100644
--- a/.github/workflows/repository-hygiene.yml
+++ b/.github/workflows/repository-hygiene.yml
@@ -111,7 +111,7 @@ jobs:
         if: github.event_name == 'workflow_dispatch' && inputs.network_lab != 'none' && inputs.network_lab != ''
         run: |
           sudo apt-get update
-          sudo apt-get install -y nftables iproute2
+          sudo apt-get install -y nftables iproute2 tcpdump
           mkdir -p build/network-lab/bin
           CGO_ENABLED=0 go build -trimpath -o build/network-lab/bin/piik-server ./cmd/piik-server
           CGO_ENABLED=0 go build -trimpath -o build/network-lab/bin/piik-app ./cmd/piik-app
diff --git a/scripts/network-lab.ts b/scripts/network-lab.ts
index d22fefa84..63032ac2e 100644
--- a/scripts/network-lab.ts
+++ b/scripts/network-lab.ts
@@ -1,16 +1,18 @@
 import { spawn, type ChildProcessWithoutNullStreams } from "node:child_process";
 import { once } from "node:events";
-import { mkdir, writeFile } from "node:fs/promises";
+import { access, mkdir, mkdtemp, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { parseArgs } from "node:util";
 import { setTimeout as delay } from "node:timers/promises";
-import { withDeadline } from "./browser-gate-harness";
+import { cleanupRun, withDeadline } from "./browser-gate-harness";
 import { endpointWorker } from "./network-lab/endpoint";
 import { command, LabNetwork, SITE_IP, SITE_ORIGIN } from "./network-lab/network";
-import { checkCalibration, hasPicture, selectScenarios, type Scenario } from "./network-lab/scenarios";
+import { checkCalibration, checkContinuity, checkFaultHit, hasPicture, selectScenarios, type Scenario } from "./network-lab/scenarios";
 import { echoWorker, type ProbeResult } from "./network-lab/udp";
 import type { MediaSample } from "./network-lab/page";
+import { checkMediaFeedback, readPacketFlows } from "./network-lab/packets";
 
 const ROOT = resolve(import.meta.dirname, ".."), ENTRY = resolve(import.meta.filename);
 const { values } = parseArgs({ options: { worker: { type: "string" }, suite: { type: "string", default: "smoke" },
@@ -20,9 +22,9 @@ class Endpoint {
   private id = 0;
   private readonly pending = new Map<number, { resolve: (value: unknown) => void; reject: (error: Error) => void }>();
   readonly process: ChildProcessWithoutNullStreams;
-  constructor(namespace: string) {
+  constructor(namespace: string, readonly profile: string, private readonly signal: AbortSignal) {
     this.process = spawn("ip", ["netns", "exec", namespace, process.execPath, "--import", "tsx", ENTRY, "--worker", "endpoint"],
-      { cwd: ROOT, env: labEnvironment(), stdio: "pipe" });
+      { cwd: ROOT, env: { ...labEnvironment(), PIIK_NETWORK_LAB_PROFILE: profile }, stdio: "pipe" });
     this.process.stderr.on("data", data => process.stderr.write(data));
     createInterface({ input: this.process.stdout }).on("line", line => {
       try {
@@ -38,14 +40,18 @@ class Endpoint {
   private fail(error: Error): void { for (const item of this.pending.values()) item.reject(error); this.pending.clear(); }
   async call<T>(action: string, args: Record<string, unknown> = {}, timeout = 45_000): Promise<T> {
     const id = ++this.id;
+    const observeAbort = !["close", "logs", "screenshot"].includes(action);
+    if (observeAbort) this.signal.throwIfAborted();
+    const abort = () => this.pending.get(id)?.reject(new Error("Laboratory run cancelled"));
     try {
       return await withDeadline(() => new Promise<T>((resolveCall, reject) => {
         this.pending.set(id, { resolve: value => resolveCall(value as T), reject });
+        if (observeAbort) this.signal.addEventListener("abort", abort, { once: true });
         this.process.stdin.write(JSON.stringify({ id, action, ...args }) + "\n", error => {
           if (error) { this.pending.delete(id); reject(error); }
         });
       }), Date.now() + timeout);
-    } finally { this.pending.delete(id); }
+    } finally { this.pending.delete(id); this.signal.removeEventListener("abort", abort); }
   }
 }
 
@@ -53,27 +59,31 @@ function labEnvironment(): NodeJS.ProcessEnv {
   return { PATH: process.env.PATH, CHROME_PATH: process.env.CHROME_PATH, LANG: "C.UTF-8", TMPDIR: process.env.TMPDIR };
 }
 
-async function runCase(scenario: Scenario, seed: number, output: string): Promise<Record<string, unknown>> {
+async function runCase(scenario: Scenario, seed: number, output: string, signal: AbortSignal): Promise<Record<string, unknown>> {
   const network = new LabNetwork(), samples: Array<{ elapsedMs: number; host: MediaSample; viewer: MediaSample }> = [];
   const started = performance.now(), endpoints: Endpoint[] = [];
   let server: ChildProcessWithoutNullStreams | null = null, echo: ChildProcessWithoutNullStreams | null = null;
+  let capture: ChildProcessWithoutNullStreams | null = null;
+  let serverLog = "", captureLog = "";
+  const pcapPath = join(output, "wan.pcap");
   const result: Record<string, unknown> = { scenario, seed, passed: false, stage: "setup", samples };
-  let signal: string | null = null;
-  const interrupted = () => { signal = "interrupted"; };
-  process.once("SIGINT", interrupted); process.once("SIGTERM", interrupted);
   try {
+    signal.throwIfAborted();
     network.setup([scenario.nat, scenario.nat]);
     echo = spawn("ip", ["netns", "exec", network.wan, process.execPath, "--import", "tsx", ENTRY, "--worker", "echo"],
       { cwd: ROOT, env: labEnvironment(), stdio: "pipe" });
     echo.stderr.on("data", data => process.stderr.write(data));
     await withDeadline(() => once(echo!.stdout, "data"), Date.now() + 10_000);
-    for (let i = 0; i < 2; i++) endpoints.push(new Endpoint(network.endpoint(i)));
+    for (let i = 0; i < 2; i++) endpoints.push(new Endpoint(network.endpoint(i),
+      await mkdtemp(join(tmpdir(), "piik-client-media-")), signal));
     result.stage = "calibration";
     const before = await endpoints[0]!.call<ProbeResult>("probe");
-    network.setFault(0, scenario.duringShare ? "none" : scenario.fault, seed);
+    network.setFault(0, scenario.fault, seed);
     const after = await endpoints[0]!.call<ProbeResult>("probe", { load: ["rate", "loss"].includes(scenario.fault) });
-    checkCalibration(before, after, scenario.duringShare ? "none" : scenario.fault);
+    checkCalibration(before, after, scenario.fault);
     result.calibration = { before, after }; result.initialCounters = network.counters(0);
+    // Load probes are calibration traffic, never competing with measured media.
+    if (scenario.duringShare) network.setFault(0, "none", seed);
     result.stage = "startup";
     server = spawn("ip", ["netns", "exec", network.wan, resolve("build/network-lab/bin/piik-server")], {
       cwd: output, stdio: "pipe", env: { ...labEnvironment(), PIIK_ENV: "development", ROOM_DATABASE_PATH: ":memory:",
@@ -81,13 +91,19 @@ async function runCase(scenario: Scenario, seed: number, output: string): Promis
         STUN_URLS: `stun:${SITE_IP}:3478,stun:${SITE_IP}:3479,stun:${SITE_IP}:3480`, STUN_LISTEN_HOST: SITE_IP,
         NAT_PREDICTION_ENABLED: "true", ...(scenario.sfu ? { SFU_UDP_PORT: "7882", SFU_LISTEN_HOST: SITE_IP, SFU_PUBLIC_IP: SITE_IP } : {}) },
     });
-    let serverLog = "";
     server.stdout.on("data", data => { serverLog = (serverLog + data).slice(-32_000); });
     server.stderr.on("data", data => { serverLog = (serverLog + data).slice(-32_000); });
-    await once(server, "spawn"); await delay(300);
+    await once(server, "spawn");
     result.versions = await Promise.all(endpoints.map((endpoint, index) => endpoint.call("start", {
       origin: SITE_ORIGIN, app: (index === 0 ? scenario.host : scenario.viewer) === "app",
     })));
+    capture = spawn("ip", ["netns", "exec", network.wan, "tcpdump", "-i", "internet", "-n", "-s", "96", "-U",
+      "-w", pcapPath, "-c", "100000", "udp"], { stdio: "pipe" });
+    capture.stderr.on("data", data => { captureLog = (captureLog + data).slice(-4000); });
+    await withDeadline(async () => { while (!captureLog.includes("listening on")) {
+      if (capture!.exitCode !== null) throw new Error(`Packet capture failed: ${captureLog}`);
+      await delay(50, undefined, { signal });
+    } }, Date.now() + 5000);
     result.stage = "share";
     await endpoints[0]!.call("navigate", { url: SITE_ORIGIN + (scenario.host === "app" ? "/#piik-client=1" : "/") });
     const invitation = await endpoints[0]!.call<string>("share");
@@ -96,12 +112,12 @@ async function runCase(scenario: Scenario, seed: number, output: string): Promis
     result.stage = "first-picture";
     let connected = false, exhausted = false;
     while (performance.now() - joinedAt < 110_000) {
-      if (signal) throw new Error(signal);
+      signal.throwIfAborted();
       const host = await endpoints[0]!.call<MediaSample>("sample"), viewer = await endpoints[1]!.call<MediaSample>("sample");
       samples.push({ elapsedMs: performance.now() - started, host, viewer });
       connected = hasPicture(viewer); exhausted = viewer.events.some(event => event.reason === "route-exhausted");
       if (connected || exhausted) break;
-      await delay(500);
+      await delay(500, undefined, { signal });
     }
     result.firstPictureMs = connected ? performance.now() - joinedAt : null;
     result.outcome = connected ? "media" : exhausted ? "unavailable" : "timeout";
@@ -109,59 +125,97 @@ async function runCase(scenario: Scenario, seed: number, output: string): Promis
     if (connected) {
       result.stage = "continuity";
       const first = samples.at(-1)!.viewer;
-      await delay(3000);
+      await delay(3000, undefined, { signal });
       const next = await endpoints[1]!.call<MediaSample>("sample");
       samples.push({ elapsedMs: performance.now() - started, host: await endpoints[0]!.call("sample"), viewer: next });
-      if (next.frames - first.frames < 30) throw new Error("Decoded video did not continue after initial picture");
-      if (scenario.host === "app" && !samples.at(-1)!.host.controls.includes("receive-offer")) throw new Error("Host bypassed expected App ingress");
-      if (scenario.viewer === "app" && !next.controls.includes("receive-offer")) throw new Error("Viewer bypassed expected App reception");
+      checkContinuity(first, next);
+      if (scenario.sfu && next.route !== "sfu") throw new Error("Expected SFU route, but media used another path");
+      if (scenario.host === "app") checkAppPath(samples.at(-1)!.host, "prepare-edge");
+      if (scenario.viewer === "app") checkAppPath(next, "receive-offer");
       if (scenario.duringShare) {
         result.stage = "impairment";
         network.setFault(0, scenario.fault, seed);
-        const impaired = await endpoints[0]!.call<ProbeResult>("probe", { load: scenario.fault === "rate" });
-        checkCalibration(before, impaired, scenario.fault);
-        result.impairedCalibration = impaired;
         const impairedAt = performance.now();
+        if (scenario.fault === "signaling" && await endpoints[0]!.call("signal-probe")) throw new Error("Signaling remained reachable during blackhole");
         while (performance.now() - impairedAt < 8000) {
-          if (signal) throw new Error(signal);
+          signal.throwIfAborted();
           samples.push({ elapsedMs: performance.now() - started, host: await endpoints[0]!.call("sample"), viewer: await endpoints[1]!.call("sample") });
-          await delay(500);
+          await delay(500, undefined, { signal });
         }
         result.impairedCounters = network.counters(0);
+        checkFaultHit(scenario.fault, network.counters(0).faultDrops);
+        if (scenario.fault === "signaling") checkContinuity(next, samples.at(-1)!.viewer);
         network.setFault(0, "none", seed);
         result.stage = "recovery";
         const restoredAt = performance.now(); let recovered = false;
         while (performance.now() - restoredAt < 60_000) {
-          if (signal) throw new Error(signal);
+          signal.throwIfAborted();
           const previous = samples.at(-1)!.viewer;
-          await delay(1000);
+          await delay(1000, undefined, { signal });
           const viewer = await endpoints[1]!.call<MediaSample>("sample");
           samples.push({ elapsedMs: performance.now() - started, host: await endpoints[0]!.call("sample"), viewer });
           if (hasPicture(viewer) && viewer.frames - previous.frames >= 15) { recovered = true; break; }
         }
         result.recoveryMs = recovered ? performance.now() - restoredAt : null;
         if (!recovered) throw new Error("Media did not resume within the recovery observation window");
+        if (scenario.fault === "signaling" && !await endpoints[0]!.call("signal-probe")) throw new Error("Signaling roundtrip did not recover");
       }
     }
     await endpoints[1]!.call("screenshot", { output: join(output, "viewer.png") });
     result.finalCounters = network.counters(0);
+    if (!scenario.duringShare) checkFaultHit(scenario.fault, network.counters(0).faultDrops);
     await endpoints[0]!.call("stop");
+    signal.throwIfAborted();
     result.passed = true; result.stage = "done";
   } catch (error) { result.error = error instanceof Error ? error.message : String(error); }
   finally {
-    result.endpointCleanup = await Promise.all(endpoints.map(endpoint => endpoint.call("close", {}, 15_000).catch(error => ({ error: String(error) }))));
-    echo?.stdin.end(); server?.kill("SIGTERM");
-    await delay(200);
-    result.cleanup = await network.close();
-    if (!(result.endpointCleanup as Array<Record<string, unknown>>).every(value => Object.values(value).every(flag => flag === true)) ||
-        !Object.values(result.cleanup as Record<string, boolean>).every(Boolean)) result.passed = false;
-    process.off("SIGINT", interrupted); process.off("SIGTERM", interrupted);
+    try {
+      result.logs = await Promise.all(endpoints.map(endpoint => endpoint.call("logs", {}, 5000).catch(String)));
+      if (!result.passed) await Promise.all(endpoints.map((endpoint, index) =>
+        endpoint.call("screenshot", { output: join(output, `failure-${index}.png`) }, 5000).catch(() => {})));
+      result.endpointCleanup = await Promise.all(endpoints.map(endpoint => endpoint.call("close", {}, 30_000).catch(error => ({ error: String(error) }))));
+      echo?.stdin.end();
+      if (capture && capture.exitCode !== null) { result.captureError = "Capture ended before observation completed"; result.passed = false; }
+      result.serviceCleanup = await Promise.all([echo, server, capture].map(child => cleanupRun({
+        chrome: null, native: null, cdp: null, server: child, profile: null, ports: [],
+      })));
+      result.cleanup = await network.close();
+      // If a worker died, the parent still owns its profile and removes it only
+      // after namespace processes have stopped, using the same guarded cleanup.
+      result.profileCleanup = await Promise.all(endpoints.map(async endpoint => {
+        if (!await access(endpoint.profile).then(() => true, () => false)) return true;
+        return (await cleanupRun({ chrome: null, native: null, cdp: null, server: null,
+          profile: endpoint.profile, ports: [] })).profileRemoved;
+      }));
+      if (![...(result.endpointCleanup as object[]), ...(result.serviceCleanup as object[]), result.cleanup as object]
+        .every(value => Object.values(value).every(flag => flag === true)) ||
+        !(result.profileCleanup as boolean[]).every(Boolean)) result.passed = false;
+    } catch (error) { result.cleanupError = String(error); result.passed = false; }
+    // Parsing or assertion failures must never skip process/network cleanup.
+    if (capture) try {
+      const flows = await readPacketFlows(pcapPath); result.packetFlows = flows;
+      if (!captureLog.includes("0 packets dropped by kernel")) throw new Error(`Capture loss prevents a complete observation: ${captureLog}`);
+      if (result.outcome === "media") {
+        if (scenario.sfu) { checkMediaFeedback(flows, network.publicIP(0), SITE_IP); checkMediaFeedback(flows, SITE_IP, network.publicIP(1)); }
+        else checkMediaFeedback(flows, network.publicIP(0), network.publicIP(1));
+      }
+    } catch (error) { result.captureError = String(error); result.passed = false; }
+    if (signal.aborted) { result.cancelled = true; result.passed = false; }
+    await writeFile(join(output, "server.log"), serverLog);
+    await writeFile(join(output, "capture.log"), captureLog);
     result.durationMs = performance.now() - started;
     await writeFile(join(output, "result.json"), JSON.stringify(result, null, 2) + "\n");
   }
   return result;
 }
 
+function checkAppPath(sample: MediaSample, action: "prepare-edge" | "receive-offer"): void {
+  const connected = sample.controls.some(control => control.type === action && control.connectionId &&
+    sample.events.some(event => event.scope === "app" && event.type === "edge-state" &&
+      event.connectionId === control.connectionId && event.state === "connected"));
+  if (!sample.controlOpen || !connected) throw new Error(`Missing successful App ${action} path`);
+}
+
 async function main(): Promise<void> {
   const selected = selectScenarios(values.suite!, values.cases);
   if (values.list) { process.stdout.write(JSON.stringify(selected, null, 2) + "\n"); return; }
@@ -169,21 +223,26 @@ async function main(): Promise<void> {
   if (!process.env.CHROME_PATH) throw new Error("CHROME_PATH is required");
   const repeat = Number(values.repeat), seed = Number(values.seed);
   if (!Number.isInteger(repeat) || repeat < 1 || repeat > 20 || !Number.isInteger(seed) || seed < 1 || seed > 0xffff_ffff) throw new Error("Invalid repeat (1..20) or seed (uint32)");
-  for (const tool of ["ip", "tc", "nft", "sysctl"]) command("which", [tool]);
+  for (const tool of ["ip", "tc", "nft", "sysctl", "tcpdump"]) command("which", [tool]);
   const output = resolve("build/network-lab/results", new Date().toISOString().replaceAll(/[:.]/g, "-"));
   await mkdir(output, { recursive: true });
   const identity = { revision: command("git", ["rev-parse", "HEAD"]), kernel: command("uname", ["-a"]),
     node: process.version, iproute: command("ip", ["-Version"]), nftables: command("nft", ["--version"]), selected, repeat, seed };
   await writeFile(join(output, "environment.json"), JSON.stringify(identity, null, 2) + "\n");
   const results: Array<Record<string, unknown>> = [];
+  const controller = new AbortController();
+  const interrupted = () => controller.abort(new Error("Laboratory run cancelled"));
+  process.once("SIGINT", interrupted); process.once("SIGTERM", interrupted);
   for (let iteration = 0; iteration < repeat; iteration++) for (const scenario of selected) {
+    if (controller.signal.aborted) break;
     const directory = join(output, `${scenario.id}-${iteration + 1}`); await mkdir(directory);
     process.stdout.write(JSON.stringify({ starting: scenario.id, iteration: iteration + 1 }) + "\n");
-    const result = await runCase(scenario, seed + iteration, directory); results.push(result);
+    const result = await runCase(scenario, seed + iteration, directory, controller.signal); results.push(result);
     process.stdout.write(JSON.stringify({ case: scenario.id, passed: result.passed, stage: result.stage, error: result.error }) + "\n");
   }
+  process.off("SIGINT", interrupted); process.off("SIGTERM", interrupted);
   await writeFile(join(output, "summary.json"), JSON.stringify(results.map(({ samples: _samples, ...result }) => result), null, 2) + "\n");
-  if (results.some(result => result.passed !== true)) process.exitCode = 1;
+  if (controller.signal.aborted || results.some(result => result.passed !== true)) process.exitCode = 1;
 }
 
 if (values.worker === "endpoint") await endpointWorker();
diff --git a/scripts/network-lab/endpoint.ts b/scripts/network-lab/endpoint.ts
index ba56ce25a..38c5a1e0c 100644
--- a/scripts/network-lab/endpoint.ts
+++ b/scripts/network-lab/endpoint.ts
@@ -1,10 +1,9 @@
 import { spawn, type ChildProcessWithoutNullStreams } from "node:child_process";
 import { once } from "node:events";
-import { mkdtemp, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
+import { writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { createInterface } from "node:readline";
-import { CdpConnection, cleanupRun, createPage, evaluate, launchChrome, reservePort, waitForSample,
+import { CdpConnection, cleanupRun, createPage, evaluate, fetchJsonBefore, launchChrome, reservePort, waitForSample,
   waitForVersion, type PageHandle } from "../browser-gate-harness";
 import { readAppEndpoint } from "../app-gate-endpoint";
 import { pageProbe, type MediaSample } from "./page";
@@ -13,8 +12,11 @@ import { udpProbe } from "./udp";
 export async function endpointWorker(): Promise<void> {
   let chrome: ChildProcessWithoutNullStreams | null = null, app: ChildProcessWithoutNullStreams | null = null;
   let cdp: CdpConnection | null = null, page: PageHandle | null = null;
-  const profile = await mkdtemp(join(tmpdir(), "piik-client-media-"));
+  const profile = process.env.PIIK_NETWORK_LAB_PROFILE;
+  if (!profile) throw new Error("Parent-owned browser profile is required");
   const ports: number[] = [];
+  const logs: Record<string, string> = {};
+  const log = (name: string, data: Buffer) => { logs[name] = ((logs[name] ?? "") + data).slice(-64_000); };
   let closed = false;
   const cleanup = async () => {
     if (closed) return;
@@ -37,10 +39,13 @@ export async function endpointWorker(): Promise<void> {
           result = await udpProbe(request.load === true);
         } else if (request.action === "start") {
           const origin = new URL(request.origin!).origin;
+          await waitForSample(deadline => fetchJsonBefore<{ status: string }>(`${origin}/healthz`, deadline),
+            value => value.status === "ok", 10_000);
           if (request.app) {
             app = spawn(resolve("build/network-lab/bin/piik-app"), ["--site", origin, "--config", join(profile, "app.json")],
               { stdio: "pipe", env: { ...process.env, PIIK_CLIENT_GATE_NO_BROWSER: "true", PIIK_LOG_DIR: join(profile, "logs") } });
-            await once(app, "spawn"); app.stderr.resume();
+            app.stderr.on("data", data => log("app", data));
+            await once(app, "spawn");
             ports.push((await readAppEndpoint(app)).port); app.stdout.resume();
           }
           const debugPort = await reservePort(); ports.push(debugPort);
@@ -50,7 +55,7 @@ export async function endpointWorker(): Promise<void> {
             "--disable-renderer-backgrounding", "--disable-backgrounding-occluded-windows",
             `--unsafely-treat-insecure-origin-as-secure=${origin}`,
           ]);
-          chrome.stdout.resume(); chrome.stderr.resume();
+          chrome.stdout.resume(); chrome.stderr.on("data", data => log("browser", data));
           const version = await waitForVersion(debugPort, chrome);
           cdp = await CdpConnection.connect(version.webSocketDebuggerUrl, Date.now() + 10_000);
           await cdp.call("Browser.setPermission", { origin, permission: { name: "loopback-network" }, setting: "granted" }, undefined, Date.now() + 5000);
@@ -69,6 +74,10 @@ export async function endpointWorker(): Promise<void> {
           result = await evaluate<string>(cdp!, page!, "document.querySelector('.lr-invite-url').value", Date.now() + 5000);
         } else if (request.action === "sample") {
           result = await sample();
+        } else if (request.action === "signal-probe") {
+          result = await evaluate(cdp!, page!, "networkLab.signalProbe()", Date.now() + 5000);
+        } else if (request.action === "logs") {
+          result = logs;
         } else if (request.action === "stop") {
           await click('button[aria-label="Stop sharing"]'); result = true;
         } else if (request.action === "screenshot") {
diff --git a/scripts/network-lab/network.ts b/scripts/network-lab/network.ts
index e87e1fcfe..df94f9253 100644
--- a/scripts/network-lab/network.ts
+++ b/scripts/network-lab/network.ts
@@ -101,14 +101,17 @@ table inet lab_filter {
     this.exec(router, "tc", ["qdisc", "replace", "dev", "wan0", "root", "netem", ...impairment]);
   }
 
-  counters(index: number): unknown {
+  counters(index: number): { firewall: unknown; queue: unknown; faultDrops: number } {
+    const firewall = JSON.parse(this.exec(this.router(index), "nft", ["-j", "list", "table", "inet", "lab_filter"]));
+    const faultDrops = firewall.nftables.reduce((total: number, entry: { rule?: { chain: string; expr: Array<{ counter?: { packets: number } }> } }) =>
+      total + (entry.rule?.chain === "faults" ? entry.rule.expr.reduce((n, expression) => n + (expression.counter?.packets ?? 0), 0) : 0), 0);
     return {
-      firewall: JSON.parse(this.exec(this.router(index), "nft", ["-j", "list", "table", "inet", "lab_filter"])),
+      firewall, faultDrops,
       queue: JSON.parse(this.exec(this.router(index), "tc", ["-j", "-s", "qdisc", "show", "dev", "wan0"])),
     };
   }
 
-  async close(): Promise<{ namespacesRemoved: boolean; hostNetworkUnchanged: boolean }> {
+  async close(): Promise<{ namespacesRemoved: boolean; hostNetworkUnchanged: boolean; linksRemoved: boolean }> {
     const failures: string[] = [];
     for (const namespace of [...this.namespaces].reverse()) {
       try {
@@ -129,6 +132,7 @@ table inet lab_filter {
     const remaining = command("ip", ["netns", "list"]);
     return {
       namespacesRemoved: failures.length === 0 && !remaining.includes(this.prefix),
+      linksRemoved: !JSON.parse(command("ip", ["-j", "link", "show"])).some((link: { ifname: string }) => this.pendingLinks.has(link.ifname)),
       hostNetworkUnchanged: command("ip", ["-j", "route", "show", "table", "all"]) === this.originalRoutes &&
         command("nft", ["-s", "list", "ruleset"]) === this.originalRules,
     };
diff --git a/scripts/network-lab/packets.ts b/scripts/network-lab/packets.ts
new file mode 100644
index 000000000..7151817d3
--- /dev/null
+++ b/scripts/network-lab/packets.ts
@@ -0,0 +1,66 @@
+import { readFile } from "node:fs/promises";
+
+export interface PacketFlow {
+  source: string;
+  destination: string;
+  sourcePort: number;
+  destinationPort: number;
+  kind: "rtp" | "rtcp" | "stun" | "other";
+  packets: number;
+  bytes: number;
+  firstMs: number;
+  lastMs: number;
+}
+
+// Read the bounded Ethernet pcap produced by this lab, not arbitrary capture
+// formats. Only clear transport headers are inspected (RFC 5761); no decryption.
+export function packetFlows(data: Buffer): PacketFlow[] {
+  if (data.length < 24 || data.readUInt32LE(0) !== 0xa1b2c3d4 || data.readUInt32LE(20) !== 1) {
+    throw new Error("Expected little-endian Ethernet pcap with microsecond timestamps");
+  }
+  const flows = new Map<string, PacketFlow>();
+  for (let offset = 24; offset < data.length;) {
+    if (offset + 16 > data.length) throw new Error("Truncated pcap record");
+    const timestamp = data.readUInt32LE(offset) * 1000 + data.readUInt32LE(offset + 4) / 1000;
+    const size = data.readUInt32LE(offset + 8);
+    if (size > 96 || offset + 16 + size > data.length) throw new Error("Invalid laboratory capture length");
+    const frame = data.subarray(offset + 16, offset + 16 + size); offset += 16 + size;
+    if (frame.length < 14) throw new Error("Truncated Ethernet header");
+    const etherType = frame.readUInt16BE(12);
+    let ipLength: number, source: string, destination: string;
+    if (etherType === 0x0800) {
+      if (frame.length < 34 || frame[23] !== 17) continue;
+      ipLength = (frame[14]! & 15) * 4;
+      if (ipLength < 20 || (frame.readUInt16BE(20) & 0x3fff) !== 0) throw new Error("Unexpected fragmented laboratory UDP");
+      source = [...frame.subarray(26, 30)].join("."); destination = [...frame.subarray(30, 34)].join(".");
+    } else if (etherType === 0x86dd) {
+      if (frame.length < 54 || frame[20] !== 17) continue;
+      ipLength = 40;
+      const address = (start: number) => Array.from({ length: 8 }, (_, index) => frame.readUInt16BE(start + index * 2).toString(16)).join(":");
+      source = address(22); destination = address(38);
+    } else continue;
+    const udp = 14 + ipLength, payload = udp + 8;
+    if (frame.length < payload + 2) throw new Error("Truncated UDP header");
+    const sourcePort = frame.readUInt16BE(udp), destinationPort = frame.readUInt16BE(udp + 2);
+    const kind = (frame[payload]! & 0xc0) === 0x80
+      ? (frame[payload + 1]! >= 192 && frame[payload + 1]! <= 223 ? "rtcp" : "rtp")
+      : frame.length >= payload + 8 && frame.readUInt32BE(payload + 4) === 0x2112a442 ? "stun" : "other";
+    const key = `${source}:${sourcePort}>${destination}:${destinationPort}/${kind}`;
+    const flow = flows.get(key) ?? { source, destination, sourcePort, destinationPort, kind,
+      packets: 0, bytes: 0, firstMs: timestamp, lastMs: timestamp };
+    flow.packets++; flow.bytes += frame.readUInt16BE(udp + 4); flow.lastMs = timestamp; flows.set(key, flow);
+  }
+  return [...flows.values()];
+}
+
+export async function readPacketFlows(path: string): Promise<PacketFlow[]> {
+  return packetFlows(await readFile(path));
+}
+
+export function checkMediaFeedback(flows: PacketFlow[], source: string, destination: string): void {
+  const media = flows.filter(flow => flow.source === source && flow.destination === destination && flow.kind === "rtp" && flow.packets >= 30);
+  if (!media.some(flow => flows.some(reply => reply.kind === "rtcp" && reply.source === destination && reply.destination === source &&
+    reply.sourcePort === flow.destinationPort && reply.destinationPort === flow.sourcePort && reply.packets > 1 && reply.lastMs > flow.firstMs))) {
+    throw new Error(`Missing WAN media/feedback pair: ${source} -> ${destination}`);
+  }
+}
diff --git a/scripts/network-lab/page.ts b/scripts/network-lab/page.ts
index fd52aba2b..e35a1f8d3 100644
--- a/scripts/network-lab/page.ts
+++ b/scripts/network-lab/page.ts
@@ -3,25 +3,39 @@
 export const pageProbe = String.raw`(() => {
   localStorage.setItem('piik:ui-lang','en'); localStorage.setItem('piik:ui-mode','text');
   const peers=[], sockets=[], events=[], errors=[], controls=[];
+  let route=null;
   const PC=RTCPeerConnection, WS=WebSocket;
   const record=(list,value)=>{ list.push(value); if(list.length>240)list.shift(); };
   window.addEventListener('unhandledrejection', e=>record(errors,String(e.reason)));
-  window.RTCPeerConnection=class extends PC { constructor(...args){super(...args); peers.push(this);} };
+  window.RTCPeerConnection=class extends PC { constructor(...args){super(...args);const peerId=peers.push(this)-1;
+    this.addEventListener('icecandidate',e=>record(events,{at:performance.now(),type:'ice-candidate',peerId,candidate:e.candidate?.candidate}));
+    this.addEventListener('icecandidateerror',e=>record(events,{at:performance.now(),type:'ice-error',peerId,code:e.errorCode,reason:e.errorText,url:e.url}));
+  } };
   window.WebSocket=class extends WS {
     constructor(...args){ super(...args); sockets.push(this);
+      const scope=this.url.includes('/control')?'app':'room';
+      for(const type of ['open','close','error'])this.addEventListener(type,()=>record(events,{at:performance.now(),type:'ws-'+type,scope}));
       this.addEventListener('message', event=>{
         let message; try{message=JSON.parse(event.data);}catch{return;}
-        record(events,{at:performance.now(),type:message.type,state:message.state,reason:message.reason,
-          phase:message.phase,route:message.route?.kind});
+        if(message.type==='route-update'&&message.phase==='active')route=message.assignment.upstream.kind;
+        const value={at:performance.now(),type:message.type,state:message.state,reason:message.reason,scope,
+          phase:message.phase,route:message.assignment?.upstream?.kind,connectionId:message.connectionId};
+        for(const key of ['localType','remoteType','natTraversalPath','sampleWindowMs','intervalFramesEncoded',
+          'framesPerSecond','bitrateKbps','availableOutgoingKbps','width','height'])if(message[key]!==undefined)value[key]=message[key];
+        record(events,value);
       });
     }
-    send(raw){if(this.url.includes('/control')){try{record(controls,JSON.parse(raw).type);}catch{}}super.send(raw);}
+    send(raw){if(this.url.includes('/control')){try{const m=JSON.parse(raw);record(controls,{type:m.type,connectionId:m.connectionId});}catch{}}super.send(raw);}
   };
   navigator.mediaDevices.getDisplayMedia=async()=>{
     const canvas=document.createElement('canvas'); canvas.width=1280; canvas.height=720;
     const ctx=canvas.getContext('2d');let frame=0;
     const draw=()=>{ctx.fillStyle='#19292f';ctx.fillRect(0,0,1280,720);
-      ctx.fillStyle='#68dab3';ctx.fillRect((frame*11)%1150,80,130,250);
+      // Deterministic moving detail puts real pressure on a constrained encoder.
+      for(let y=0;y<12;y++)for(let x=0;x<20;x++){
+        ctx.fillStyle='hsl('+((x*37+y*19+frame*3)%360)+' 65% 55%)';
+        ctx.fillRect((x*64+frame*7)%1280,y*60,45,42);
+      }
       ctx.fillStyle='#fff';ctx.font='70px sans-serif';ctx.fillText(String(frame++),80,540);};
     draw();const timer=setInterval(draw,1000/30),stream=canvas.captureStream(30);
     const video=stream.getVideoTracks()[0],stop=video.stop.bind(video);
@@ -32,13 +46,26 @@ export const pageProbe = String.raw`(() => {
     sound.stop=()=>{if(stopped)return;stopped=true;osc.stop();void ac.close();stopSound();};
     stream.addTrack(sound);return stream;
   };
-  window.networkLab={async sample(){
+  window.networkLab={async signalProbe(){
+    const socket=sockets.findLast(s=>!s.url.includes('/control')&&s.readyState===WS.OPEN);
+    if(!socket)return false;
+    return new Promise(resolve=>{
+      const finish=value=>{clearTimeout(timer);socket.removeEventListener('message',receive);resolve(value);};
+      const receive=event=>{try{if(JSON.parse(event.data).type==='route-diagnostic-snapshot')finish(true);}catch{}};
+      const timer=setTimeout(()=>finish(false),1800);socket.addEventListener('message',receive);
+      socket.send(JSON.stringify({type:'request-route-diagnostic'}));
+    });
+  },async sample(){
     const stats=[];
-    for(const peer of peers){if(peer.connectionState==='closed')continue;
+    for(const [peerId,peer] of peers.entries()){if(peer.connectionState==='closed')continue;
       const report=await peer.getStats();
       for(const row of report.values()){
+        if(row.type==='candidate-pair')stats.push({type:'pair-state',peerId,state:row.state,
+          requestsSent:row.requestsSent,responsesReceived:row.responsesReceived,localCandidateId:row.localCandidateId,remoteCandidateId:row.remoteCandidateId});
+        if(row.type==='local-candidate'||row.type==='remote-candidate')stats.push({type:row.type,id:row.id,peerId,
+          address:row.address,port:row.port,protocol:row.protocol,candidateType:row.candidateType});
         if(row.type==='inbound-rtp'||row.type==='outbound-rtp'||row.type==='remote-inbound-rtp'){
-          const selected={type:row.type,kind:row.kind};
+          const selected={type:row.type,kind:row.kind,id:row.id,peerId};
           for(const key of ['framesDecoded','framesReceived','framesEncoded','framesDropped','framesPerSecond',
             'frameWidth','frameHeight','bytesReceived','bytesSent','packetsLost','packetsReceived','nackCount',
             'pliCount','totalDecodeTime','jitterBufferDelay','jitterBufferEmittedCount','totalAudioEnergy',
@@ -48,15 +75,15 @@ export const pageProbe = String.raw`(() => {
         }
         if(row.type==='candidate-pair'&&row.nominated&&row.state==='succeeded'){
           const local=report.get(row.localCandidateId),remote=report.get(row.remoteCandidateId);
-          stats.push({type:'selected-pair',rtt:row.currentRoundTripTime,bwe:row.availableOutgoingBitrate,
+          stats.push({type:'selected-pair',peerId,rtt:row.currentRoundTripTime,bwe:row.availableOutgoingBitrate,
             localType:local?.candidateType,remoteType:remote?.candidateType,protocol:remote?.protocol,
-            localAddress:local?.address,remoteAddress:remote?.address});
+            localAddress:local?.address,remoteAddress:remote?.address,localPort:local?.port,remotePort:remote?.port});
         }
       }
     }
     const video=document.querySelector('video');
     return{at:performance.now(),width:video?.videoWidth||0,height:video?.videoHeight||0,
-      frames:video?.getVideoPlaybackQuality().totalVideoFrames||0,stats,events:[...events],errors:[...errors],controls:[...controls],
+      frames:video?.getVideoPlaybackQuality().totalVideoFrames||0,route,stats,events:[...events],errors:[...errors],controls:[...controls],
       sharing:!!document.querySelector('button[aria-label="Stop sharing"]'),
       controlOpen:sockets.some(s=>s.url.includes('/control')&&s.readyState===WS.OPEN),
       peerStates:peers.map(p=>p.connectionState),text:document.body.innerText.slice(-2000)};
@@ -68,10 +95,12 @@ export interface MediaSample {
   width: number;
   height: number;
   frames: number;
+  route: string | null;
   stats: Array<Record<string, string | number>>;
-  events: Array<{ at: number; type: string; state?: string; reason?: string; phase?: string; route?: string }>;
+  events: Array<{ at: number; type: string; scope?: string; state?: string; reason?: string; phase?: string; route?: string;
+    connectionId?: string; [key: string]: string | number | undefined }>;
   errors: string[];
-  controls: string[];
+  controls: Array<{ type: string; connectionId?: string }>;
   sharing: boolean;
   controlOpen: boolean;
   peerStates: string[];
diff --git a/scripts/network-lab/scenarios.ts b/scripts/network-lab/scenarios.ts
index fb498c448..2cb5cdfd8 100644
--- a/scripts/network-lab/scenarios.ts
+++ b/scripts/network-lab/scenarios.ts
@@ -46,6 +46,23 @@ export function hasPicture(sample: MediaSample): boolean {
     sample.stats.some(row => row.type === "inbound-rtp" && row.kind === "video" && Number(row.framesDecoded) >= 15);
 }
 
+export function checkFaultHit(fault: Fault, faultDrops: number): void {
+  if (["peer-block", "udp-block", "stun-primary", "signaling"].includes(fault) && faultDrops < 1) {
+    throw new Error(`No packets hit the ${fault} rule; outcome cannot validate this fault`);
+  }
+}
+
+export function checkContinuity(before: MediaSample, after: MediaSample): void {
+  if (after.frames - before.frames < 30) throw new Error("Decoded video did not continue");
+  const audible = after.stats.some(row => {
+    if (row.type !== "inbound-rtp" || row.kind !== "audio") return false;
+    const previous = before.stats.find(other => other.id === row.id && other.peerId === row.peerId);
+    return previous && Number(row.totalAudioEnergy) > Number(previous.totalAudioEnergy) &&
+      Number(row.totalSamplesDuration) > Number(previous.totalSamplesDuration);
+  });
+  if (!audible) throw new Error("Decoded audio energy and sample duration did not advance");
+}
+
 export function checkCalibration(before: ProbeResult, after: ProbeResult, fault: Fault): void {
   if (before.received !== before.sent || before.mappings.length !== 3 ||
       before.mappings.some(mapping => !mapping.address.startsWith("198.51.100."))) {
diff --git a/tests/network-lab.test.ts b/tests/network-lab.test.ts
index 6ae739688..c0f04923f 100644
--- a/tests/network-lab.test.ts
+++ b/tests/network-lab.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from "vitest";
-import { checkCalibration, hasPicture, selectScenarios } from "../scripts/network-lab/scenarios";
+import { checkCalibration, checkContinuity, checkFaultHit, hasPicture, selectScenarios } from "../scripts/network-lab/scenarios";
+import { checkMediaFeedback, packetFlows, type PacketFlow } from "../scripts/network-lab/packets";
 import type { MediaSample } from "../scripts/network-lab/page";
 import type { ProbeResult } from "../scripts/network-lab/udp";
 
@@ -37,4 +38,44 @@ describe("network laboratory evidence", () => {
       "browser/browser", "app/browser", "browser/app", "app/app",
     ]);
   });
+
+  it("requires the actual blackhole rule to see traffic", () => {
+    for (const fault of ["peer-block", "udp-block", "stun-primary", "signaling"] as const) {
+      expect(() => checkFaultHit(fault, 0)).toThrow();
+      expect(() => checkFaultHit(fault, 3)).not.toThrow();
+    }
+  });
+
+  it("rejects frozen/silent media and counter resets on replacement peers", () => {
+    const before = { frames: 50, stats: [{ id: "audio", peerId: 0, type: "inbound-rtp", kind: "audio",
+      totalAudioEnergy: 1, totalSamplesDuration: 2 }] } as unknown as MediaSample;
+    expect(() => checkContinuity(before, { ...before, frames: 100 })).toThrow();
+    const after = { ...before, frames: 100, stats: [{ ...before.stats[0]!, totalAudioEnergy: 2, totalSamplesDuration: 5 }] };
+    expect(() => checkContinuity(before, after)).not.toThrow();
+    expect(() => checkContinuity(before, { ...after, stats: [{ ...after.stats[0]!, peerId: 1 }] })).toThrow();
+    expect(() => checkContinuity(before, { ...after, frames: 50 })).toThrow();
+  });
+
+  it("requires feedback on the same WAN transport, not a healthy loopback or sibling", () => {
+    const media: PacketFlow = { source: "198.51.100.11", destination: "198.51.100.12", sourcePort: 5000,
+      destinationPort: 6000, kind: "rtp", packets: 50, bytes: 50_000, firstMs: 1, lastMs: 5000 };
+    const feedback: PacketFlow = { ...media, source: media.destination, destination: media.source, sourcePort: 6000,
+      destinationPort: 5000, kind: "rtcp", packets: 10 };
+    expect(() => checkMediaFeedback([media], media.source, media.destination)).toThrow();
+    expect(() => checkMediaFeedback([media, { ...feedback, source: "127.0.0.1" }], media.source, media.destination)).toThrow();
+    expect(() => checkMediaFeedback([media, { ...feedback, destinationPort: 5001 }], media.source, media.destination)).toThrow();
+    expect(() => checkMediaFeedback([media, feedback], media.source, media.destination)).not.toThrow();
+  });
+
+  it("reads clear RTP/RTCP headers from a bounded capture and rejects truncation", () => {
+    const header = Buffer.alloc(24); header.writeUInt32LE(0xa1b2c3d4, 0); header.writeUInt16LE(2, 4);
+    header.writeUInt16LE(4, 6); header.writeUInt32LE(96, 16); header.writeUInt32LE(1, 20);
+    const frame = Buffer.from("00000000000000000000000008004500002c0000000040110000c633640bc633640c138817700018000080600001000000010000000100000000", "hex");
+    const record = Buffer.alloc(16); record.writeUInt32LE(1, 0); record.writeUInt32LE(frame.length, 8); record.writeUInt32LE(frame.length, 12);
+    const capture = Buffer.concat([header, record, frame]);
+    expect(packetFlows(capture)[0]).toMatchObject({ source: "198.51.100.11", destination: "198.51.100.12", sourcePort: 5000, destinationPort: 6000, kind: "rtp" });
+    capture[24 + 16 + 43] = 201;
+    expect(packetFlows(capture)[0]?.kind).toBe("rtcp");
+    expect(() => packetFlows(capture.subarray(0, -1))).toThrow();
+  });
 });

From 918d1870d4e7ac5c84526ba56376d7cd15bd1f72 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 02:34:12 +0800
Subject: [PATCH 192/262] test(network): calibrate bidirectional NAT and
 prevent router tuple collisions

---
 .github/workflows/repository-hygiene.yml |  7 ++++-
 docs/research/network-lab.md             | 32 ++++++++++++++++++++++
 scripts/network-lab.ts                   | 21 +++++++++++---
 scripts/network-lab/endpoint.ts          | 15 ++++++++--
 scripts/network-lab/network.ts           |  8 ++++++
 scripts/network-lab/udp.ts               | 35 ++++++++++++++++++++++++
 6 files changed, 110 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/repository-hygiene.yml b/.github/workflows/repository-hygiene.yml
index e2ac04511..f9944acee 100644
--- a/.github/workflows/repository-hygiene.yml
+++ b/.github/workflows/repository-hygiene.yml
@@ -23,6 +23,10 @@ on:
         default: none
         type: choice
         options: [none, smoke, full]
+      network_cases:
+        description: Optional comma-separated laboratory cases (empty runs the selected suite)
+        required: false
+        type: string
 
 permissions:
   contents: read
@@ -121,7 +125,8 @@ jobs:
         env:
           CHROME_PATH: /usr/bin/google-chrome
           PIIK_NETWORK_LAB_SUITE: ${{ inputs.network_lab }}
-        run: sudo --preserve-env=PATH,CHROME_PATH "$(command -v node)" --import tsx scripts/network-lab.ts --suite "$PIIK_NETWORK_LAB_SUITE"
+          PIIK_NETWORK_LAB_CASES: ${{ inputs.network_cases }}
+        run: sudo --preserve-env=PATH,CHROME_PATH "$(command -v node)" --import tsx scripts/network-lab.ts --suite "$PIIK_NETWORK_LAB_SUITE" --cases "$PIIK_NETWORK_LAB_CASES"
       - name: Save network laboratory evidence
         if: always() && github.event_name == 'workflow_dispatch' && inputs.network_lab != 'none' && inputs.network_lab != ''
         uses: actions/upload-artifact@v7
diff --git a/docs/research/network-lab.md b/docs/research/network-lab.md
index 3ffab3af7..addbc2be8 100644
--- a/docs/research/network-lab.md
+++ b/docs/research/network-lab.md
@@ -21,6 +21,9 @@ Reviewed on 2026-10-13:
 - [CellReplay, NSDI 2025](https://www.usenix.org/conference/nsdi25/presentation/sentosa)
   shows that replay can be workload-sensitive. Synthetic delay/loss profiles are
   named impairments, not validated replicas of a carrier or Wi-Fi network.
+- [MirrorNet, NSDI 2026](https://www.usenix.org/conference/nsdi26/presentation/miao)
+  reinforces checking control, data and traffic together. Piik needs that
+  consistency, not a large WAN orchestration platform.
 - [RFC 4787](https://www.rfc-editor.org/rfc/rfc4787) separates UDP mapping from
   filtering. Describe both; a random-port Linux SNAT rule alone does not prove a
   named consumer-router NAT type.
@@ -74,3 +77,32 @@ network-emulation request is insufficient: an earlier Piik check observed RTP
 outside the requested limits. Keep negative controls, finite deadlines and
 resource limits as part of the laboratory rather than changing product recovery
 to make an experiment pass.
+
+## Running The Process Layer
+
+Use an isolated Linux machine or VM with Node/Go from the repository toolchain,
+Google Chrome, `iproute2`, `nftables` and `tcpdump`. Namespace administration
+requires root. Windows/macOS can run the model/unit layer; they need a Linux VM
+for this process layer. Root on a production host is not an equivalent setup.
+
+```sh
+npm ci
+npm run build:web
+mkdir -p build/network-lab/bin
+CGO_ENABLED=0 go build -trimpath -o build/network-lab/bin/piik-server ./cmd/piik-server
+CGO_ENABLED=0 go build -trimpath -o build/network-lab/bin/piik-app ./cmd/piik-app
+sudo --preserve-env=PATH,CHROME_PATH "$(command -v node)" --import tsx scripts/network-lab.ts --suite smoke
+```
+
+Set `CHROME_PATH` to the installed Chrome executable before running. `--list`
+lists scenarios without root; `--suite full`, `--cases browser-browser,app-app`,
+`--repeat 3` and `--seed 42` select reproducible inputs. Netem seeds do not make
+browser scheduling, kernel port allocation or real-time timings deterministic.
+The manual CI workflow's `network_lab` input runs this same entry point and never
+publishes. Reports and bounded synthetic-traffic captures are under ignored
+`build/network-lab/results/`; CI retains them for seven days.
+
+The process layer is still under validation. Listed scenarios are implementation
+targets until their reports pass the acceptance contract. In particular, App
+Host checks must use the real H264 Browser-to-App ingress and App WAN sender;
+launching an App alongside a Browser-only VP8 share is not an App-path test.
diff --git a/scripts/network-lab.ts b/scripts/network-lab.ts
index 63032ac2e..6a6e7ea25 100644
--- a/scripts/network-lab.ts
+++ b/scripts/network-lab.ts
@@ -20,12 +20,14 @@ const { values } = parseArgs({ options: { worker: { type: "string" }, suite: { t
 
 class Endpoint {
   private id = 0;
+  private failure: Error | null = null;
   private readonly pending = new Map<number, { resolve: (value: unknown) => void; reject: (error: Error) => void }>();
   readonly process: ChildProcessWithoutNullStreams;
   constructor(namespace: string, readonly profile: string, private readonly signal: AbortSignal) {
     this.process = spawn("ip", ["netns", "exec", namespace, process.execPath, "--import", "tsx", ENTRY, "--worker", "endpoint"],
       { cwd: ROOT, env: { ...labEnvironment(), PIIK_NETWORK_LAB_PROFILE: profile }, stdio: "pipe" });
     this.process.stderr.on("data", data => process.stderr.write(data));
+    this.process.stdin.on("error", error => this.fail(error));
     createInterface({ input: this.process.stdout }).on("line", line => {
       try {
         const reply = JSON.parse(line), pending = this.pending.get(reply.id);
@@ -37,9 +39,10 @@ class Endpoint {
     this.process.on("error", error => this.fail(error));
     this.process.on("exit", (code, signal) => this.fail(new Error(`Endpoint exited (${code ?? signal})`)));
   }
-  private fail(error: Error): void { for (const item of this.pending.values()) item.reject(error); this.pending.clear(); }
+  private fail(error: Error): void { this.failure = error; for (const item of this.pending.values()) item.reject(error); this.pending.clear(); }
   async call<T>(action: string, args: Record<string, unknown> = {}, timeout = 45_000): Promise<T> {
     const id = ++this.id;
+    if (this.failure) throw this.failure;
     const observeAbort = !["close", "logs", "screenshot"].includes(action);
     if (observeAbort) this.signal.throwIfAborted();
     const abort = () => this.pending.get(id)?.reject(new Error("Laboratory run cancelled"));
@@ -73,11 +76,16 @@ async function runCase(scenario: Scenario, seed: number, output: string, signal:
     echo = spawn("ip", ["netns", "exec", network.wan, process.execPath, "--import", "tsx", ENTRY, "--worker", "echo"],
       { cwd: ROOT, env: labEnvironment(), stdio: "pipe" });
     echo.stderr.on("data", data => process.stderr.write(data));
+    echo.stdin.on("error", () => {});
     await withDeadline(() => once(echo!.stdout, "data"), Date.now() + 10_000);
     for (let i = 0; i < 2; i++) endpoints.push(new Endpoint(network.endpoint(i),
       await mkdtemp(join(tmpdir(), "piik-client-media-")), signal));
     result.stage = "calibration";
     const before = await endpoints[0]!.call<ProbeResult>("probe");
+    const mappings = await Promise.all(endpoints.map(endpoint => endpoint.call<{ address: string; port: number }>("peer-prepare")));
+    const reachability = await Promise.all(endpoints.map((endpoint, index) => endpoint.call<{ replies: number }>("peer-probe", { peer: mappings[1 - index] })));
+    result.peerCalibration = { mappings, reachability };
+    if (scenario.nat === "preserve" && reachability.some(probe => probe.replies < 5)) throw new Error("Baseline UDP rendezvous failed independently of Piik");
     network.setFault(0, scenario.fault, seed);
     const after = await endpoints[0]!.call<ProbeResult>("probe", { load: ["rate", "loss"].includes(scenario.fault) });
     checkCalibration(before, after, scenario.fault);
@@ -178,12 +186,17 @@ async function runCase(scenario: Scenario, seed: number, output: string, signal:
       if (capture && capture.exitCode !== null) { result.captureError = "Capture ended before observation completed"; result.passed = false; }
       result.serviceCleanup = await Promise.all([echo, server, capture].map(child => cleanupRun({
         chrome: null, native: null, cdp: null, server: child, profile: null, ports: [],
-      })));
-      result.cleanup = await network.close();
+      }).catch(error => ({ error: String(error) }))));
+      result.cleanup = await network.close().catch(error => ({ error: String(error) }));
       // If a worker died, the parent still owns its profile and removes it only
       // after namespace processes have stopped, using the same guarded cleanup.
       result.profileCleanup = await Promise.all(endpoints.map(async endpoint => {
-        if (!await access(endpoint.profile).then(() => true, () => false)) return true;
+        const exists = await access(endpoint.profile).then(() => true, error => {
+          if ((error as NodeJS.ErrnoException).code === "ENOENT") return false;
+          throw error;
+        });
+        if (!exists) return true;
+        if (!(result.cleanup as { namespacesRemoved?: boolean }).namespacesRemoved) return false;
         return (await cleanupRun({ chrome: null, native: null, cdp: null, server: null,
           profile: endpoint.profile, ports: [] })).profileRemoved;
       }));
diff --git a/scripts/network-lab/endpoint.ts b/scripts/network-lab/endpoint.ts
index 38c5a1e0c..b970fcf94 100644
--- a/scripts/network-lab/endpoint.ts
+++ b/scripts/network-lab/endpoint.ts
@@ -7,7 +7,7 @@ import { CdpConnection, cleanupRun, createPage, evaluate, fetchJsonBefore, launc
   waitForVersion, type PageHandle } from "../browser-gate-harness";
 import { readAppEndpoint } from "../app-gate-endpoint";
 import { pageProbe, type MediaSample } from "./page";
-import { udpProbe } from "./udp";
+import { preparePeerProbe, udpProbe } from "./udp";
 
 export async function endpointWorker(): Promise<void> {
   let chrome: ChildProcessWithoutNullStreams | null = null, app: ChildProcessWithoutNullStreams | null = null;
@@ -15,12 +15,14 @@ export async function endpointWorker(): Promise<void> {
   const profile = process.env.PIIK_NETWORK_LAB_PROFILE;
   if (!profile) throw new Error("Parent-owned browser profile is required");
   const ports: number[] = [];
+  let rendezvous: Awaited<ReturnType<typeof preparePeerProbe>> | null = null;
   const logs: Record<string, string> = {};
   const log = (name: string, data: Buffer) => { logs[name] = ((logs[name] ?? "") + data).slice(-64_000); };
   let closed = false;
   const cleanup = async () => {
     if (closed) return;
     closed = true;
+    rendezvous?.close();
     return cleanupRun({ chrome, native: app, cdp, server: null, profile, ports });
   };
   const sample = () => evaluate<MediaSample>(cdp!, page!, "networkLab.sample()", Date.now() + 5000);
@@ -32,11 +34,16 @@ export async function endpointWorker(): Promise<void> {
   try {
     for await (const line of createInterface({ input: process.stdin })) {
       const request = JSON.parse(line) as { id: number; action: string; origin?: string; app?: boolean;
-        url?: string; output?: string; load?: boolean };
+        url?: string; output?: string; load?: boolean; peer?: { address: string; port: number } };
       try {
         let result: unknown;
         if (request.action === "probe") {
           result = await udpProbe(request.load === true);
+        } else if (request.action === "peer-prepare") {
+          rendezvous?.close(); rendezvous = await preparePeerProbe(); result = rendezvous.mapping;
+        } else if (request.action === "peer-probe") {
+          if (!rendezvous) throw new Error("Survey must precede peer probing");
+          result = await rendezvous.run(request.peer!);
         } else if (request.action === "start") {
           const origin = new URL(request.origin!).origin;
           await waitForSample(deadline => fetchJsonBefore<{ status: string }>(`${origin}/healthz`, deadline),
@@ -65,7 +72,9 @@ export async function endpointWorker(): Promise<void> {
           result = true;
         } else if (request.action === "share") {
           await click('button[aria-controls="host-advanced-door"]');
-          await click('button[aria-label^="VP8"]');
+          // Browser-to-App encoded fanout is the production H264 path. VP8
+          // deliberately stays in the Browser and must not masquerade as App WAN.
+          await click(app ? 'button[aria-label^="H264"]' : 'button[aria-label^="VP8"]');
           await click('button[aria-label="720p"]');
           await click("button.lr-tv-big.is-action");
           await click('button[data-source-tab="browser"]');
diff --git a/scripts/network-lab/network.ts b/scripts/network-lab/network.ts
index df94f9253..112ac363d 100644
--- a/scripts/network-lab/network.ts
+++ b/scripts/network-lab/network.ts
@@ -1,6 +1,7 @@
 import { execFileSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { readlinkSync } from "node:fs";
+import { setTimeout as delay } from "node:timers/promises";
 
 export const SITE_IP = "198.51.100.1";
 export const SITE_ORIGIN = `http://${SITE_IP}:9000`;
@@ -70,6 +71,11 @@ table ip lab_nat {
  }
 }
 table inet lab_filter {
+ chain input { type filter hook input priority filter; policy accept;
+  # Do not confirm unsolicited UDP as a router-local connection. Its reverse
+  # tuple can otherwise steal the peer's later SNAT mapping before hole punching.
+  iifname "wan0" meta l4proto udp ct state new counter drop
+ }
  chain faults {}
  chain forward { type filter hook forward priority filter; policy drop;
   jump faults
@@ -122,6 +128,8 @@ table inet lab_filter {
           try { if (readlinkSync(`/proc/${pid}/ns/net`) === identity) process.kill(Number(pid), "SIGKILL"); }
           catch (error) { if ((error as NodeJS.ErrnoException).code !== "ENOENT" && (error as NodeJS.ErrnoException).code !== "ESRCH") throw error; }
         }
+        for (let attempt = 0; attempt < 20 && command("ip", ["netns", "pids", namespace]); attempt++) await delay(25);
+        if (command("ip", ["netns", "pids", namespace])) failures.push(`${namespace}:processes`);
         command("ip", ["netns", "delete", namespace]);
       } catch { failures.push(namespace); }
     }
diff --git a/scripts/network-lab/udp.ts b/scripts/network-lab/udp.ts
index 0c8ecf758..50d9577ca 100644
--- a/scripts/network-lab/udp.ts
+++ b/scripts/network-lab/udp.ts
@@ -34,6 +34,41 @@ export interface ProbeResult {
   mappings: Array<{ destination: string; address: string; port: number }>;
 }
 
+/** Survey and peer rendezvous retain one socket, independently of ICE/Piik. */
+export async function preparePeerProbe() {
+  const socket = createSocket("udp4"), result = { requests: 0, replies: 0, errors: [] as string[] };
+  let closed = false, peer: { address: string; port: number } | null = null;
+  const close = () => { if (!closed) { closed = true; socket.close(); } };
+  socket.on("error", error => result.errors.push(error.message));
+  socket.on("message", (data, remote) => {
+    if (data.length !== 8 || data.readUInt32BE(0) !== 0x50495052 || !peer || remote.address !== peer.address) return;
+    if (data[4] === 1) { result.replies++; return; }
+    result.requests++;
+    const reply = Buffer.from(data); reply[4] = 1;
+    socket.send(reply, remote.port, remote.address, () => {});
+  });
+  socket.bind(0, "0.0.0.0"); await once(socket, "listening");
+  try {
+    const observed = once(socket, "message", { signal: AbortSignal.timeout(2000) });
+    const request = Buffer.alloc(1200); request.writeUInt32BE(0x50494c42, 0);
+    socket.send(request, targets[0]!.port, targets[0]!.host, () => {});
+    const [reply] = await observed as [Buffer];
+    if (reply.length !== 1200 || reply.readUInt32BE(0) !== 0x50494c42) throw new Error("Invalid rendezvous survey response");
+    return { mapping: { address: [...reply.subarray(18, 22)].join("."), port: reply.readUInt16BE(16) }, close,
+      async run(destination: { address: string; port: number }) {
+        peer = destination;
+        try {
+          for (let attempt = 0; attempt < 20; attempt++) {
+            const packet = Buffer.alloc(8); packet.writeUInt32BE(0x50495052, 0); packet[5] = attempt;
+            socket.send(packet, peer.port, peer.address, () => {}); await delay(100);
+          }
+          await delay(300); return result;
+        } finally { close(); }
+      },
+    };
+  } catch (error) { close(); throw error; }
+}
+
 export async function udpProbe(load: boolean): Promise<ProbeResult> {
   const socket = createSocket("udp4"), start = performance.now();
   const result: ProbeResult = { sent: 0, received: 0, receivedBytes: 0, durationMs: 0, rttMs: [], mappings: [] };

From cd5773e072e3c0c82f3219efd94e968fb82285e8 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 02:44:51 +0800
Subject: [PATCH 193/262] test(network): wait for App ownership and verify
 rendered motion

---
 scripts/network-lab/endpoint.ts  |  5 +++++
 scripts/network-lab/page.ts      | 11 ++++++++++-
 scripts/network-lab/scenarios.ts |  3 +++
 tests/network-lab.test.ts        |  5 +++--
 4 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/scripts/network-lab/endpoint.ts b/scripts/network-lab/endpoint.ts
index b970fcf94..d11dbfc75 100644
--- a/scripts/network-lab/endpoint.ts
+++ b/scripts/network-lab/endpoint.ts
@@ -77,6 +77,11 @@ export async function endpointWorker(): Promise<void> {
           await click(app ? 'button[aria-label^="H264"]' : 'button[aria-label^="VP8"]');
           await click('button[aria-label="720p"]');
           await click("button.lr-tv-big.is-action");
+          // Selecting Browser before App discovery completes intentionally uses
+          // Browser fanout. An App scenario waits for the real control session.
+          if (app) await waitForSample(deadline => evaluate<boolean>(cdp!, page!,
+            `Boolean(document.querySelector('.lr-source-picker-refresh:not(:disabled)')) && networkLab.sample().then(value => value.controlOpen)`,
+            deadline), Boolean, 10_000);
           await click('button[data-source-tab="browser"]');
           await click(".lr-source-option.is-browser");
           await waitForSample(sample, value => value.sharing && value.width > 0, 30_000);
diff --git a/scripts/network-lab/page.ts b/scripts/network-lab/page.ts
index e35a1f8d3..499338346 100644
--- a/scripts/network-lab/page.ts
+++ b/scripts/network-lab/page.ts
@@ -5,6 +5,8 @@ export const pageProbe = String.raw`(() => {
   const peers=[], sockets=[], events=[], errors=[], controls=[];
   let route=null;
   const PC=RTCPeerConnection, WS=WebSocket;
+  const picture=document.createElement('canvas');picture.width=64;picture.height=36;
+  const pictureContext=picture.getContext('2d',{willReadFrequently:true});
   const record=(list,value)=>{ list.push(value); if(list.length>240)list.shift(); };
   window.addEventListener('unhandledrejection', e=>record(errors,String(e.reason)));
   window.RTCPeerConnection=class extends PC { constructor(...args){super(...args);const peerId=peers.push(this)-1;
@@ -82,8 +84,14 @@ export const pageProbe = String.raw`(() => {
       }
     }
     const video=document.querySelector('video');
+    let pictureHash=null;
+    if(video?.videoWidth&&video.readyState>=2){
+      pictureContext.drawImage(video,0,0,64,36);let hash=2166136261;
+      for(const byte of pictureContext.getImageData(0,0,64,36).data)hash=Math.imul(hash^byte,16777619);
+      pictureHash=hash>>>0;
+    }
     return{at:performance.now(),width:video?.videoWidth||0,height:video?.videoHeight||0,
-      frames:video?.getVideoPlaybackQuality().totalVideoFrames||0,route,stats,events:[...events],errors:[...errors],controls:[...controls],
+      frames:video?.getVideoPlaybackQuality().totalVideoFrames||0,pictureHash,route,stats,events:[...events],errors:[...errors],controls:[...controls],
       sharing:!!document.querySelector('button[aria-label="Stop sharing"]'),
       controlOpen:sockets.some(s=>s.url.includes('/control')&&s.readyState===WS.OPEN),
       peerStates:peers.map(p=>p.connectionState),text:document.body.innerText.slice(-2000)};
@@ -95,6 +103,7 @@ export interface MediaSample {
   width: number;
   height: number;
   frames: number;
+  pictureHash: number | null;
   route: string | null;
   stats: Array<Record<string, string | number>>;
   events: Array<{ at: number; type: string; scope?: string; state?: string; reason?: string; phase?: string; route?: string;
diff --git a/scripts/network-lab/scenarios.ts b/scripts/network-lab/scenarios.ts
index 2cb5cdfd8..9ad7582b4 100644
--- a/scripts/network-lab/scenarios.ts
+++ b/scripts/network-lab/scenarios.ts
@@ -54,6 +54,9 @@ export function checkFaultHit(fault: Fault, faultDrops: number): void {
 
 export function checkContinuity(before: MediaSample, after: MediaSample): void {
   if (after.frames - before.frames < 30) throw new Error("Decoded video did not continue");
+  if (before.pictureHash === null || after.pictureHash === null || before.pictureHash === after.pictureHash) {
+    throw new Error("Rendered synthetic picture did not change");
+  }
   const audible = after.stats.some(row => {
     if (row.type !== "inbound-rtp" || row.kind !== "audio") return false;
     const previous = before.stats.find(other => other.id === row.id && other.peerId === row.peerId);
diff --git a/tests/network-lab.test.ts b/tests/network-lab.test.ts
index c0f04923f..40a4944ef 100644
--- a/tests/network-lab.test.ts
+++ b/tests/network-lab.test.ts
@@ -47,13 +47,14 @@ describe("network laboratory evidence", () => {
   });
 
   it("rejects frozen/silent media and counter resets on replacement peers", () => {
-    const before = { frames: 50, stats: [{ id: "audio", peerId: 0, type: "inbound-rtp", kind: "audio",
+    const before = { frames: 50, pictureHash: 100, stats: [{ id: "audio", peerId: 0, type: "inbound-rtp", kind: "audio",
       totalAudioEnergy: 1, totalSamplesDuration: 2 }] } as unknown as MediaSample;
     expect(() => checkContinuity(before, { ...before, frames: 100 })).toThrow();
-    const after = { ...before, frames: 100, stats: [{ ...before.stats[0]!, totalAudioEnergy: 2, totalSamplesDuration: 5 }] };
+    const after = { ...before, frames: 100, pictureHash: 200, stats: [{ ...before.stats[0]!, totalAudioEnergy: 2, totalSamplesDuration: 5 }] };
     expect(() => checkContinuity(before, after)).not.toThrow();
     expect(() => checkContinuity(before, { ...after, stats: [{ ...after.stats[0]!, peerId: 1 }] })).toThrow();
     expect(() => checkContinuity(before, { ...after, frames: 50 })).toThrow();
+    expect(() => checkContinuity(before, { ...after, pictureHash: 100 })).toThrow();
   });
 
   it("requires feedback on the same WAN transport, not a healthy loopback or sibling", () => {

From ba574ed69e50d8ae237ce94363631e4562180a86 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 02:58:42 +0800
Subject: [PATCH 194/262] test(network): calibrate impairment recovery and
 expand isolated paths

---
 .github/workflows/repository-hygiene.yml |  20 +++-
 docs/research/network-lab.md             |   8 +-
 scripts/network-lab.ts                   | 121 ++++++++++++++++-------
 scripts/network-lab/endpoint.ts          |   4 +-
 scripts/network-lab/network.ts           |  40 ++++++--
 scripts/network-lab/packets.ts           |  20 +++-
 scripts/network-lab/scenarios.ts         |  27 ++++-
 scripts/network-lab/udp.ts               |  20 ++--
 tests/network-lab.test.ts                |  20 +++-
 9 files changed, 215 insertions(+), 65 deletions(-)

diff --git a/.github/workflows/repository-hygiene.yml b/.github/workflows/repository-hygiene.yml
index f9944acee..161ddc9e1 100644
--- a/.github/workflows/repository-hygiene.yml
+++ b/.github/workflows/repository-hygiene.yml
@@ -115,18 +115,34 @@ jobs:
         if: github.event_name == 'workflow_dispatch' && inputs.network_lab != 'none' && inputs.network_lab != ''
         run: |
           sudo apt-get update
-          sudo apt-get install -y nftables iproute2 tcpdump
+          sudo apt-get install -y nftables iproute2 tcpdump bison flex libmnl-dev libcap-dev
           mkdir -p build/network-lab/bin
           CGO_ENABLED=0 go build -trimpath -o build/network-lab/bin/piik-server ./cmd/piik-server
           CGO_ENABLED=0 go build -trimpath -o build/network-lab/bin/piik-app ./cmd/piik-app
+      # The runner's iproute2 6.1 lacks netem's seed parameter. Keep this tool
+      # local to the opt-in lab; do not replace system networking utilities.
+      - name: Check out laboratory traffic-control tool
+        if: github.event_name == 'workflow_dispatch' && inputs.network_lab != 'none' && inputs.network_lab != ''
+        uses: actions/checkout@v6
+        with:
+          repository: iproute2/iproute2
+          ref: d2a8ffe85ac64f91ee2aa7679a5046f321b54127 # v6.17.0
+          path: build/network-lab/iproute2
+          persist-credentials: false
+      - name: Build laboratory traffic-control tool
+        if: github.event_name == 'workflow_dispatch' && inputs.network_lab != 'none' && inputs.network_lab != ''
+        run: |
+          make -C build/network-lab/iproute2 -j2 SUBDIRS='lib tc netem' TC_CONFIG_NO_XT=y
+          echo "$GITHUB_WORKSPACE/build/network-lab/iproute2/tc" >> "$GITHUB_PATH"
       - name: Run isolated network laboratory
         if: github.event_name == 'workflow_dispatch' && inputs.network_lab != 'none' && inputs.network_lab != ''
         timeout-minutes: 35
         env:
           CHROME_PATH: /usr/bin/google-chrome
+          TC_LIB_DIR: ${{ github.workspace }}/build/network-lab/iproute2/netem
           PIIK_NETWORK_LAB_SUITE: ${{ inputs.network_lab }}
           PIIK_NETWORK_LAB_CASES: ${{ inputs.network_cases }}
-        run: sudo --preserve-env=PATH,CHROME_PATH "$(command -v node)" --import tsx scripts/network-lab.ts --suite "$PIIK_NETWORK_LAB_SUITE" --cases "$PIIK_NETWORK_LAB_CASES"
+        run: sudo --preserve-env=PATH,CHROME_PATH,TC_LIB_DIR "$(command -v node)" --import tsx scripts/network-lab.ts --suite "$PIIK_NETWORK_LAB_SUITE" --cases "$PIIK_NETWORK_LAB_CASES"
       - name: Save network laboratory evidence
         if: always() && github.event_name == 'workflow_dispatch' && inputs.network_lab != 'none' && inputs.network_lab != ''
         uses: actions/upload-artifact@v7
diff --git a/docs/research/network-lab.md b/docs/research/network-lab.md
index addbc2be8..f26444721 100644
--- a/docs/research/network-lab.md
+++ b/docs/research/network-lab.md
@@ -81,7 +81,9 @@ to make an experiment pass.
 ## Running The Process Layer
 
 Use an isolated Linux machine or VM with Node/Go from the repository toolchain,
-Google Chrome, `iproute2`, `nftables` and `tcpdump`. Namespace administration
+Google Chrome, current `iproute2` with netem `seed` support, `nftables` and
+`tcpdump`. CI builds a pinned iproute2 6.17 traffic-control binary locally because
+the runner's distribution package lacks that option. Namespace administration
 requires root. Windows/macOS can run the model/unit layer; they need a Linux VM
 for this process layer. Root on a production host is not an equivalent setup.
 
@@ -98,6 +100,10 @@ Set `CHROME_PATH` to the installed Chrome executable before running. `--list`
 lists scenarios without root; `--suite full`, `--cases browser-browser,app-app`,
 `--repeat 3` and `--seed 42` select reproducible inputs. Netem seeds do not make
 browser scheduling, kernel port allocation or real-time timings deterministic.
+Each fault phase replaces its owned qdisc completely: netem's in-place change
+retains some omitted attributes, including a previous rate limit. Restoration
+therefore checks the resulting rules and independent UDP reachability as well as
+the resumed media. Recovery has its own picture/audio/feedback observation window.
 The manual CI workflow's `network_lab` input runs this same entry point and never
 publishes. Reports and bounded synthetic-traffic captures are under ignored
 `build/network-lab/results/`; CI retains them for seven days.
diff --git a/scripts/network-lab.ts b/scripts/network-lab.ts
index 6a6e7ea25..c17040afd 100644
--- a/scripts/network-lab.ts
+++ b/scripts/network-lab.ts
@@ -9,14 +9,15 @@ import { setTimeout as delay } from "node:timers/promises";
 import { cleanupRun, withDeadline } from "./browser-gate-harness";
 import { endpointWorker } from "./network-lab/endpoint";
 import { command, LabNetwork, SITE_IP, SITE_ORIGIN } from "./network-lab/network";
-import { checkCalibration, checkContinuity, checkFaultHit, hasPicture, selectScenarios, type Scenario } from "./network-lab/scenarios";
+import { checkCalibration, checkContinuity, checkFaultHit, checkMapping, hasPicture, selectScenarios, type Scenario } from "./network-lab/scenarios";
 import { echoWorker, type ProbeResult } from "./network-lab/udp";
 import type { MediaSample } from "./network-lab/page";
-import { checkMediaFeedback, readPacketFlows } from "./network-lab/packets";
+import { checkMediaFeedback, checkMediaPath, readPacketFlows, type PacketFlow } from "./network-lab/packets";
 
 const ROOT = resolve(import.meta.dirname, ".."), ENTRY = resolve(import.meta.filename);
 const { values } = parseArgs({ options: { worker: { type: "string" }, suite: { type: "string", default: "smoke" },
-  cases: { type: "string" }, repeat: { type: "string", default: "1" }, seed: { type: "string", default: "1" }, list: { type: "boolean" } } });
+  cases: { type: "string" }, repeat: { type: "string", default: "1" }, seed: { type: "string", default: "1" },
+  ipv6: { type: "boolean" }, list: { type: "boolean" } } });
 
 class Endpoint {
   private id = 0;
@@ -63,35 +64,59 @@ function labEnvironment(): NodeJS.ProcessEnv {
 }
 
 async function runCase(scenario: Scenario, seed: number, output: string, signal: AbortSignal): Promise<Record<string, unknown>> {
-  const network = new LabNetwork(), samples: Array<{ elapsedMs: number; host: MediaSample; viewer: MediaSample }> = [];
+  const network = new LabNetwork(), samples: Array<{ elapsedMs: number; host: MediaSample; viewer: MediaSample; sibling?: MediaSample }> = [];
   const started = performance.now(), endpoints: Endpoint[] = [];
   let server: ChildProcessWithoutNullStreams | null = null, echo: ChildProcessWithoutNullStreams | null = null;
   let capture: ChildProcessWithoutNullStreams | null = null;
   let serverLog = "", captureLog = "";
+  const mediaWindows: Array<{ name: string; startMs: number; endMs: number }> = [];
   const pcapPath = join(output, "wan.pcap");
   const result: Record<string, unknown> = { scenario, seed, passed: false, stage: "setup", samples };
+  const faultIndex = scenario.faultEndpoint ?? 0;
+  const setFault = (fault: Scenario["fault"]) => network.setFault(faultIndex, fault, seed, scenario.direction);
+  const counters = () => network.counters(faultIndex);
+  const sampleAll = async () => {
+    const [host, viewer, sibling] = await Promise.all(endpoints.map(endpoint => endpoint.call<MediaSample>("sample")));
+    const sample = { elapsedMs: performance.now() - started, host: host!, viewer: viewer!, sibling };
+    samples.push(sample); return sample;
+  };
+  const proveMedia = (flows: PacketFlow[]) => {
+    if (scenario.sfu) { checkMediaFeedback(flows, network.publicIP(0), SITE_IP); checkMediaFeedback(flows, SITE_IP, network.publicIP(1)); }
+    else if (scenario.ipv6) checkMediaFeedback(flows, network.ipv6(0), network.ipv6(1));
+    else checkMediaPath(flows, network.publicIP(0), network.publicIP(1), scenario.sibling ? [network.publicIP(2)] : []);
+    if (scenario.sibling) checkMediaPath(flows, network.publicIP(0), network.publicIP(2), [network.publicIP(1)]);
+  };
   try {
     signal.throwIfAborted();
-    network.setup([scenario.nat, scenario.nat]);
-    echo = spawn("ip", ["netns", "exec", network.wan, process.execPath, "--import", "tsx", ENTRY, "--worker", "echo"],
+    network.setup([...scenario.nat, ...(scenario.sibling ? ["preserve" as const] : [])], scenario.ipv6);
+    echo = spawn("ip", ["netns", "exec", network.wan, process.execPath, "--import", "tsx", ENTRY, "--worker", "echo", ...(scenario.ipv6 ? ["--ipv6"] : [])],
       { cwd: ROOT, env: labEnvironment(), stdio: "pipe" });
     echo.stderr.on("data", data => process.stderr.write(data));
     echo.stdin.on("error", () => {});
     await withDeadline(() => once(echo!.stdout, "data"), Date.now() + 10_000);
-    for (let i = 0; i < 2; i++) endpoints.push(new Endpoint(network.endpoint(i),
+    for (let i = 0; i < (scenario.sibling ? 3 : 2); i++) endpoints.push(new Endpoint(network.endpoint(i),
       await mkdtemp(join(tmpdir(), "piik-client-media-")), signal));
     result.stage = "calibration";
-    const before = await endpoints[0]!.call<ProbeResult>("probe");
-    const mappings = await Promise.all(endpoints.map(endpoint => endpoint.call<{ address: string; port: number }>("peer-prepare")));
-    const reachability = await Promise.all(endpoints.map((endpoint, index) => endpoint.call<{ replies: number }>("peer-probe", { peer: mappings[1 - index] })));
+    const baselines = await Promise.all(endpoints.map(endpoint => endpoint.call<ProbeResult>("probe")));
+    result.mappingCalibration = baselines;
+    baselines.forEach((probe, index) => checkMapping(probe, scenario.nat[index] ?? "preserve"));
+    const before = baselines[faultIndex]!;
+    const pair = endpoints.slice(0, 2);
+    const mappings = await Promise.all(pair.map(endpoint => endpoint.call<{ address: string; port: number }>("peer-prepare")));
+    const reachability = await Promise.all(pair.map((endpoint, index) => endpoint.call<{ replies: number }>("peer-probe", { peer: mappings[1 - index] })));
     result.peerCalibration = { mappings, reachability };
-    if (scenario.nat === "preserve" && reachability.some(probe => probe.replies < 5)) throw new Error("Baseline UDP rendezvous failed independently of Piik");
-    network.setFault(0, scenario.fault, seed);
-    const after = await endpoints[0]!.call<ProbeResult>("probe", { load: ["rate", "loss"].includes(scenario.fault) });
+    if (scenario.nat.every(mode => mode === "preserve") && reachability.some(probe => probe.replies < 5)) throw new Error("Baseline UDP rendezvous failed independently of Piik");
+    if (scenario.ipv6) {
+      const probes = await Promise.all(endpoints.map(endpoint => endpoint.call<ProbeResult>("probe", { ipv6: true })));
+      if (probes.some(probe => probe.received !== probe.sent || !probe.mappings[0]?.address.startsWith("2001:db8:72:"))) throw new Error("IPv6 calibration failed");
+      result.ipv6Calibration = probes;
+    }
+    setFault(scenario.fault);
+    const after = await endpoints[faultIndex]!.call<ProbeResult>("probe", { load: ["rate", "loss"].includes(scenario.fault) });
+    result.calibration = { before, after }; result.initialCounters = counters();
     checkCalibration(before, after, scenario.fault);
-    result.calibration = { before, after }; result.initialCounters = network.counters(0);
     // Load probes are calibration traffic, never competing with measured media.
-    if (scenario.duringShare) network.setFault(0, "none", seed);
+    if (scenario.duringShare) setFault("none");
     result.stage = "startup";
     server = spawn("ip", ["netns", "exec", network.wan, resolve("build/network-lab/bin/piik-server")], {
       cwd: output, stdio: "pipe", env: { ...labEnvironment(), PIIK_ENV: "development", ROOM_DATABASE_PATH: ":memory:",
@@ -103,7 +128,7 @@ async function runCase(scenario: Scenario, seed: number, output: string, signal:
     server.stderr.on("data", data => { serverLog = (serverLog + data).slice(-32_000); });
     await once(server, "spawn");
     result.versions = await Promise.all(endpoints.map((endpoint, index) => endpoint.call("start", {
-      origin: SITE_ORIGIN, app: (index === 0 ? scenario.host : scenario.viewer) === "app",
+      origin: SITE_ORIGIN, app: index < 2 && (index === 0 ? scenario.host : scenario.viewer) === "app",
     })));
     capture = spawn("ip", ["netns", "exec", network.wan, "tcpdump", "-i", "internet", "-n", "-s", "96", "-U",
       "-w", pcapPath, "-c", "100000", "udp"], { stdio: "pipe" });
@@ -117,61 +142,82 @@ async function runCase(scenario: Scenario, seed: number, output: string, signal:
     const invitation = await endpoints[0]!.call<string>("share");
     const joinedAt = performance.now();
     await endpoints[1]!.call("navigate", { url: invitation + (scenario.viewer === "app" ? "&piik-client=1" : "") });
+    if (scenario.sibling) await endpoints[2]!.call("navigate", { url: invitation });
     result.stage = "first-picture";
     let connected = false, exhausted = false;
     while (performance.now() - joinedAt < 110_000) {
       signal.throwIfAborted();
-      const host = await endpoints[0]!.call<MediaSample>("sample"), viewer = await endpoints[1]!.call<MediaSample>("sample");
-      samples.push({ elapsedMs: performance.now() - started, host, viewer });
-      connected = hasPicture(viewer); exhausted = viewer.events.some(event => event.reason === "route-exhausted");
+      const { viewer, sibling } = await sampleAll();
+      connected = hasPicture(viewer) && (!scenario.sibling || !!sibling && hasPicture(sibling));
+      exhausted = viewer.events.some(event => event.reason === "route-exhausted");
       if (connected || exhausted) break;
       await delay(500, undefined, { signal });
     }
     result.firstPictureMs = connected ? performance.now() - joinedAt : null;
     result.outcome = connected ? "media" : exhausted ? "unavailable" : "timeout";
-    if (result.outcome !== scenario.expected) throw new Error(`Expected ${scenario.expected}, observed ${result.outcome}; ${serverLog.slice(-1000)}`);
+    if (result.outcome === "timeout" || (scenario.expected !== "observed" && result.outcome !== scenario.expected)) throw new Error(`Expected ${scenario.expected}, observed ${result.outcome}; ${serverLog.slice(-1000)}`);
     if (connected) {
       result.stage = "continuity";
       const first = samples.at(-1)!.viewer;
+      const steadyStart = Date.now();
       await delay(3000, undefined, { signal });
-      const next = await endpoints[1]!.call<MediaSample>("sample");
-      samples.push({ elapsedMs: performance.now() - started, host: await endpoints[0]!.call("sample"), viewer: next });
+      const { viewer: next, sibling: healthy } = await sampleAll();
       checkContinuity(first, next);
+      mediaWindows.push({ name: "baseline", startMs: steadyStart, endMs: Date.now() });
       if (scenario.sfu && next.route !== "sfu") throw new Error("Expected SFU route, but media used another path");
       if (scenario.host === "app") checkAppPath(samples.at(-1)!.host, "prepare-edge");
       if (scenario.viewer === "app") checkAppPath(next, "receive-offer");
       if (scenario.duringShare) {
         result.stage = "impairment";
-        network.setFault(0, scenario.fault, seed);
+        setFault(scenario.fault);
         const impairedAt = performance.now();
+        let healthyWindow = healthy, healthyAt = impairedAt;
         if (scenario.fault === "signaling" && await endpoints[0]!.call("signal-probe")) throw new Error("Signaling remained reachable during blackhole");
         while (performance.now() - impairedAt < 8000) {
           signal.throwIfAborted();
-          samples.push({ elapsedMs: performance.now() - started, host: await endpoints[0]!.call("sample"), viewer: await endpoints[1]!.call("sample") });
+          await sampleAll();
+          if (healthyWindow && performance.now() - healthyAt >= 2000) {
+            const current = samples.at(-1)!.sibling!;
+            checkContinuity(healthyWindow, current);
+            if (current.height < healthy!.height) throw new Error("Weak Viewer reduced its healthy sibling's resolution");
+            healthyWindow = current; healthyAt = performance.now();
+          }
           await delay(500, undefined, { signal });
         }
-        result.impairedCounters = network.counters(0);
-        checkFaultHit(scenario.fault, network.counters(0).faultDrops);
+        result.impairedCounters = counters();
+        checkFaultHit(scenario.fault, counters().faultDrops);
         if (scenario.fault === "signaling") checkContinuity(next, samples.at(-1)!.viewer);
-        network.setFault(0, "none", seed);
+        if (healthy) {
+          checkContinuity(healthy, samples.at(-1)!.sibling!);
+          if (samples.at(-1)!.sibling!.height < healthy.height) throw new Error("Weak Viewer reduced its healthy sibling's resolution");
+        }
+        setFault("none");
+        result.restoredCounters = counters();
+        const restoredProbe = await endpoints[faultIndex]!.call<ProbeResult>("probe");
+        result.restoredCalibration = restoredProbe;
+        checkCalibration(before, restoredProbe, "none");
         result.stage = "recovery";
         const restoredAt = performance.now(); let recovered = false;
         while (performance.now() - restoredAt < 60_000) {
           signal.throwIfAborted();
           const previous = samples.at(-1)!.viewer;
           await delay(1000, undefined, { signal });
-          const viewer = await endpoints[1]!.call<MediaSample>("sample");
-          samples.push({ elapsedMs: performance.now() - started, host: await endpoints[0]!.call("sample"), viewer });
+          const { viewer } = await sampleAll();
           if (hasPicture(viewer) && viewer.frames - previous.frames >= 15) { recovered = true; break; }
         }
         result.recoveryMs = recovered ? performance.now() - restoredAt : null;
         if (!recovered) throw new Error("Media did not resume within the recovery observation window");
+        const recoveredFirst = samples.at(-1)!.viewer, recoveredStart = Date.now();
+        await delay(3000, undefined, { signal });
+        const { viewer: recoveredNext } = await sampleAll();
+        checkContinuity(recoveredFirst, recoveredNext);
+        mediaWindows.push({ name: "recovered", startMs: recoveredStart, endMs: Date.now() });
         if (scenario.fault === "signaling" && !await endpoints[0]!.call("signal-probe")) throw new Error("Signaling roundtrip did not recover");
       }
     }
     await endpoints[1]!.call("screenshot", { output: join(output, "viewer.png") });
-    result.finalCounters = network.counters(0);
-    if (!scenario.duringShare) checkFaultHit(scenario.fault, network.counters(0).faultDrops);
+    result.finalCounters = counters();
+    if (!scenario.duringShare) checkFaultHit(scenario.fault, counters().faultDrops);
     await endpoints[0]!.call("stop");
     signal.throwIfAborted();
     result.passed = true; result.stage = "done";
@@ -208,9 +254,12 @@ async function runCase(scenario: Scenario, seed: number, output: string, signal:
     if (capture) try {
       const flows = await readPacketFlows(pcapPath); result.packetFlows = flows;
       if (!captureLog.includes("0 packets dropped by kernel")) throw new Error(`Capture loss prevents a complete observation: ${captureLog}`);
-      if (result.outcome === "media") {
-        if (scenario.sfu) { checkMediaFeedback(flows, network.publicIP(0), SITE_IP); checkMediaFeedback(flows, SITE_IP, network.publicIP(1)); }
-        else checkMediaFeedback(flows, network.publicIP(0), network.publicIP(1));
+      if (result.outcome === "media") proveMedia(flows);
+      result.mediaWindows = [];
+      for (const window of mediaWindows) {
+        const selected = await readPacketFlows(pcapPath, window);
+        proveMedia(selected);
+        (result.mediaWindows as unknown[]).push({ ...window, flows: selected });
       }
     } catch (error) { result.captureError = String(error); result.passed = false; }
     if (signal.aborted) { result.cancelled = true; result.passed = false; }
@@ -240,7 +289,7 @@ async function main(): Promise<void> {
   const output = resolve("build/network-lab/results", new Date().toISOString().replaceAll(/[:.]/g, "-"));
   await mkdir(output, { recursive: true });
   const identity = { revision: command("git", ["rev-parse", "HEAD"]), kernel: command("uname", ["-a"]),
-    node: process.version, iproute: command("ip", ["-Version"]), nftables: command("nft", ["--version"]), selected, repeat, seed };
+    node: process.version, iproute: command("ip", ["-Version"]), tc: command("tc", ["-Version"]), nftables: command("nft", ["--version"]), selected, repeat, seed };
   await writeFile(join(output, "environment.json"), JSON.stringify(identity, null, 2) + "\n");
   const results: Array<Record<string, unknown>> = [];
   const controller = new AbortController();
@@ -259,6 +308,6 @@ async function main(): Promise<void> {
 }
 
 if (values.worker === "endpoint") await endpointWorker();
-else if (values.worker === "echo") await echoWorker();
+else if (values.worker === "echo") await echoWorker(values.ipv6);
 else if (values.worker) throw new Error("Unknown network lab worker");
 else await main();
diff --git a/scripts/network-lab/endpoint.ts b/scripts/network-lab/endpoint.ts
index d11dbfc75..dbfe28532 100644
--- a/scripts/network-lab/endpoint.ts
+++ b/scripts/network-lab/endpoint.ts
@@ -34,11 +34,11 @@ export async function endpointWorker(): Promise<void> {
   try {
     for await (const line of createInterface({ input: process.stdin })) {
       const request = JSON.parse(line) as { id: number; action: string; origin?: string; app?: boolean;
-        url?: string; output?: string; load?: boolean; peer?: { address: string; port: number } };
+        url?: string; output?: string; load?: boolean; ipv6?: boolean; peer?: { address: string; port: number } };
       try {
         let result: unknown;
         if (request.action === "probe") {
-          result = await udpProbe(request.load === true);
+          result = await udpProbe(request.load === true, request.ipv6 === true);
         } else if (request.action === "peer-prepare") {
           rendezvous?.close(); rendezvous = await preparePeerProbe(); result = rendezvous.mapping;
         } else if (request.action === "peer-probe") {
diff --git a/scripts/network-lab/network.ts b/scripts/network-lab/network.ts
index 112ac363d..26ccf388b 100644
--- a/scripts/network-lab/network.ts
+++ b/scripts/network-lab/network.ts
@@ -4,6 +4,7 @@ import { readlinkSync } from "node:fs";
 import { setTimeout as delay } from "node:timers/promises";
 
 export const SITE_IP = "198.51.100.1";
+export const SITE_IPV6 = "2001:db8:71::1";
 export const SITE_ORIGIN = `http://${SITE_IP}:9000`;
 export type NatMode = "preserve" | "random";
 export type Fault = "none" | "peer-block" | "udp-block" | "stun-primary" | "delay" | "loss" | "rate" | "signaling";
@@ -19,7 +20,9 @@ export class LabNetwork {
   readonly prefix = `piiklab-${randomBytes(4).toString("hex")}`;
   readonly namespaces: string[] = [];
   private readonly pendingLinks = new Set<string>();
+  private readonly shaped = new Set<string>();
   private readonly originalRoutes = command("ip", ["-j", "route", "show", "table", "all"]);
+  private readonly originalRoutes6 = command("ip", ["-6", "-j", "route", "show", "table", "all"]);
   private readonly originalRules = command("nft", ["-s", "list", "ruleset"]);
   readonly wan = `${this.prefix}-wan`;
 
@@ -47,12 +50,13 @@ export class LabNetwork {
     }
   }
 
-  setup(modes: NatMode[]): void {
+  setup(modes: readonly NatMode[], ipv6 = false): void {
     this.add(this.wan);
     this.exec(this.wan, "ip", ["link", "add", "internet", "type", "bridge"]);
     this.exec(this.wan, "ip", ["addr", "add", `${SITE_IP}/24`, "dev", "internet"]);
     this.exec(this.wan, "ip", ["addr", "add", "198.51.100.2/24", "dev", "internet"]);
     this.exec(this.wan, "ip", ["link", "set", "internet", "up"]);
+    if (ipv6) this.exec(this.wan, "ip", ["-6", "addr", "add", `${SITE_IPV6}/64`, "dev", "internet", "nodad"]);
     for (const [index, mode] of modes.entries()) {
       const n = index + 1, endpoint = this.endpoint(index), router = this.router(index);
       this.add(endpoint); this.add(router);
@@ -64,6 +68,16 @@ export class LabNetwork {
       this.exec(router, "ip", ["addr", "add", `${this.publicIP(index)}/24`, "dev", "wan0"]);
       this.exec(endpoint, "ip", ["route", "add", "default", "via", `10.71.${n}.1`]);
       this.exec(router, "sysctl", ["-qw", "net.ipv4.ip_forward=1"]);
+      if (ipv6) {
+        const wan = `2001:db8:71::${11 + index}`, lan = `2001:db8:72:${n}::1`;
+        this.exec(router, "sysctl", ["-qw", "net.ipv6.conf.all.forwarding=1"]);
+        this.exec(router, "ip", ["-6", "addr", "add", `${wan}/64`, "dev", "wan0", "nodad"]);
+        this.exec(router, "ip", ["-6", "addr", "add", `${lan}/64`, "dev", "lan0", "nodad"]);
+        this.exec(endpoint, "ip", ["-6", "addr", "add", `${this.ipv6(index)}/64`, "dev", "eth0", "nodad"]);
+        this.exec(endpoint, "ip", ["-6", "route", "add", "default", "via", lan]);
+        this.exec(router, "ip", ["-6", "route", "add", "default", "via", SITE_IPV6]);
+        this.exec(this.wan, "ip", ["-6", "route", "add", `2001:db8:72:${n}::/64`, "via", wan]);
+      }
       this.exec(router, "nft", [`
 table ip lab_nat {
  chain postrouting { type nat hook postrouting priority srcnat; policy accept;
@@ -85,13 +99,15 @@ table inet lab_filter {
 }
 `]);
     }
+    if (ipv6) this.exec(this.wan, "sysctl", ["-qw", "net.ipv6.conf.all.forwarding=1"]);
   }
 
   endpoint(index: number): string { return `${this.prefix}-end${index}`; }
   router(index: number): string { return `${this.prefix}-nat${index}`; }
   publicIP(index: number): string { return `198.51.100.${11 + index}`; }
+  ipv6(index: number): string { return `2001:db8:72:${index + 1}:0:0:0:2`; }
 
-  setFault(index: number, fault: Fault, seed: number): void {
+  setFault(index: number, fault: Fault, seed: number, direction: "uplink" | "downlink" = "uplink"): void {
     const router = this.router(index);
     this.exec(router, "nft", ["flush", "chain", "inet", "lab_filter", "faults"]);
     const rules: Partial<Record<Fault, string>> = {
@@ -101,10 +117,21 @@ table inet lab_filter {
       signaling: `ip daddr ${SITE_IP} tcp dport 9000 counter drop`,
     };
     if (rules[fault]) this.exec(router, "nft", [`add rule inet lab_filter faults ${rules[fault]}`]);
-    const impairment = fault === "delay" ? ["delay", "100ms", "20ms", "distribution", "normal"]
+    // netem change/replace retains omitted attributes (including RATE). A new
+    // scenario phase owns a fresh qdisc, not the previous phase's hidden state.
+    for (const device of ["wan0", "lan0"]) {
+      if (!this.shaped.has(`${router}/${device}`)) continue;
+      this.exec(router, "tc", ["qdisc", "del", "dev", device, "root"]);
+      this.shaped.delete(`${router}/${device}`);
+    }
+    const impairment = fault === "delay" ? ["delay", "100ms", "20ms", "distribution", "normal", "seed", String(seed)]
       : fault === "loss" ? ["loss", "random", "5%", "seed", String(seed)]
-      : fault === "rate" ? ["rate", "600kbit", "limit", "30"] : ["delay", "0ms"];
-    this.exec(router, "tc", ["qdisc", "replace", "dev", "wan0", "root", "netem", ...impairment]);
+      : fault === "rate" ? ["rate", "600kbit", "limit", "30"] : null;
+    if (impairment) {
+      const device = direction === "uplink" ? "wan0" : "lan0";
+      this.exec(router, "tc", ["qdisc", "add", "dev", device, "root", "netem", ...impairment]);
+      this.shaped.add(`${router}/${device}`);
+    }
   }
 
   counters(index: number): { firewall: unknown; queue: unknown; faultDrops: number } {
@@ -113,7 +140,7 @@ table inet lab_filter {
       total + (entry.rule?.chain === "faults" ? entry.rule.expr.reduce((n, expression) => n + (expression.counter?.packets ?? 0), 0) : 0), 0);
     return {
       firewall, faultDrops,
-      queue: JSON.parse(this.exec(this.router(index), "tc", ["-j", "-s", "qdisc", "show", "dev", "wan0"])),
+      queue: JSON.parse(this.exec(this.router(index), "tc", ["-j", "-s", "qdisc", "show"])),
     };
   }
 
@@ -142,6 +169,7 @@ table inet lab_filter {
       namespacesRemoved: failures.length === 0 && !remaining.includes(this.prefix),
       linksRemoved: !JSON.parse(command("ip", ["-j", "link", "show"])).some((link: { ifname: string }) => this.pendingLinks.has(link.ifname)),
       hostNetworkUnchanged: command("ip", ["-j", "route", "show", "table", "all"]) === this.originalRoutes &&
+        command("ip", ["-6", "-j", "route", "show", "table", "all"]) === this.originalRoutes6 &&
         command("nft", ["-s", "list", "ruleset"]) === this.originalRules,
     };
   }
diff --git a/scripts/network-lab/packets.ts b/scripts/network-lab/packets.ts
index 7151817d3..255e28ffe 100644
--- a/scripts/network-lab/packets.ts
+++ b/scripts/network-lab/packets.ts
@@ -14,7 +14,7 @@ export interface PacketFlow {
 
 // Read the bounded Ethernet pcap produced by this lab, not arbitrary capture
 // formats. Only clear transport headers are inspected (RFC 5761); no decryption.
-export function packetFlows(data: Buffer): PacketFlow[] {
+export function packetFlows(data: Buffer, window?: { startMs: number; endMs: number }): PacketFlow[] {
   if (data.length < 24 || data.readUInt32LE(0) !== 0xa1b2c3d4 || data.readUInt32LE(20) !== 1) {
     throw new Error("Expected little-endian Ethernet pcap with microsecond timestamps");
   }
@@ -25,6 +25,7 @@ export function packetFlows(data: Buffer): PacketFlow[] {
     const size = data.readUInt32LE(offset + 8);
     if (size > 96 || offset + 16 + size > data.length) throw new Error("Invalid laboratory capture length");
     const frame = data.subarray(offset + 16, offset + 16 + size); offset += 16 + size;
+    if (window && (timestamp < window.startMs || timestamp > window.endMs)) continue;
     if (frame.length < 14) throw new Error("Truncated Ethernet header");
     const etherType = frame.readUInt16BE(12);
     let ipLength: number, source: string, destination: string;
@@ -53,8 +54,8 @@ export function packetFlows(data: Buffer): PacketFlow[] {
   return [...flows.values()];
 }
 
-export async function readPacketFlows(path: string): Promise<PacketFlow[]> {
-  return packetFlows(await readFile(path));
+export async function readPacketFlows(path: string, window?: { startMs: number; endMs: number }): Promise<PacketFlow[]> {
+  return packetFlows(await readFile(path), window);
 }
 
 export function checkMediaFeedback(flows: PacketFlow[], source: string, destination: string): void {
@@ -64,3 +65,16 @@ export function checkMediaFeedback(flows: PacketFlow[], source: string, destinat
     throw new Error(`Missing WAN media/feedback pair: ${source} -> ${destination}`);
   }
 }
+
+/** A relay is allowed only when every hop has matching reverse feedback. */
+export function checkMediaPath(flows: PacketFlow[], source: string, destination: string, relays: string[] = []): string[] {
+  try { checkMediaFeedback(flows, source, destination); return [source, destination]; } catch {}
+  for (const relay of relays) {
+    try {
+      checkMediaFeedback(flows, source, relay);
+      checkMediaFeedback(flows, relay, destination);
+      return [source, relay, destination];
+    } catch {}
+  }
+  throw new Error(`Missing complete WAN media/feedback path: ${source} -> ${destination}`);
+}
diff --git a/scripts/network-lab/scenarios.ts b/scripts/network-lab/scenarios.ts
index 9ad7582b4..e687c6007 100644
--- a/scripts/network-lab/scenarios.ts
+++ b/scripts/network-lab/scenarios.ts
@@ -6,14 +6,18 @@ export interface Scenario {
   id: string;
   host: "browser" | "app";
   viewer: "browser" | "app";
-  nat: NatMode;
+  nat: readonly [NatMode, NatMode];
   fault: Fault;
   sfu: boolean;
-  expected: "media" | "unavailable";
+  expected: "media" | "unavailable" | "observed";
   duringShare?: boolean;
+  ipv6?: boolean;
+  faultEndpoint?: 0 | 1;
+  direction?: "uplink" | "downlink";
+  sibling?: boolean;
 }
 
-const baseline = { nat: "preserve", fault: "none", sfu: false, expected: "media" } as const;
+const baseline = { nat: ["preserve", "preserve"], fault: "none", sfu: false, expected: "media" } as const;
 export const scenarios: readonly Scenario[] = [
   { ...baseline, id: "browser-browser", host: "browser", viewer: "browser" },
   { ...baseline, id: "app-browser", host: "app", viewer: "browser" },
@@ -27,6 +31,12 @@ export const scenarios: readonly Scenario[] = [
   { ...baseline, id: "bandwidth-recovery", host: "browser", viewer: "browser", fault: "rate", duringShare: true },
   { ...baseline, id: "media-outage", host: "app", viewer: "app", fault: "udp-block", duringShare: true },
   { ...baseline, id: "signaling-outage", host: "browser", viewer: "browser", fault: "signaling", duringShare: true },
+  { ...baseline, id: "random-nat", host: "app", viewer: "app", nat: ["random", "random"], expected: "observed" },
+  { ...baseline, id: "asymmetric-nat", host: "browser", viewer: "app", nat: ["random", "preserve"], expected: "observed" },
+  { ...baseline, id: "ipv6-browser", host: "browser", viewer: "browser", ipv6: true, fault: "peer-block" },
+  { ...baseline, id: "ipv6-app", host: "app", viewer: "app", ipv6: true, fault: "peer-block" },
+  { ...baseline, id: "healthy-sibling", host: "browser", viewer: "browser", sibling: true,
+    fault: "rate", faultEndpoint: 1, direction: "downlink", duringShare: true },
 ];
 
 export function selectScenarios(suite: string, names?: string): Scenario[] {
@@ -74,7 +84,9 @@ export function checkCalibration(before: ProbeResult, after: ProbeResult, fault:
   if (fault === "udp-block") {
     if (after.received !== 0) throw new Error("Blocked UDP still reached the probe");
   } else if (fault === "delay") {
-    if (after.received === 0 || Math.min(...after.rttMs) < 65) throw new Error("Configured delay was not observed");
+    const median = (values: number[]) => [...values].sort((a, b) => a - b)[Math.floor(values.length / 2)] ?? 0;
+    // Normal jitter has tails; its minimum is not the configured delay.
+    if (after.received === 0 || median(after.rttMs) - median(before.rttMs) < 65) throw new Error("Configured delay was not observed");
   } else if (fault === "loss") {
     if (after.received === 0 || after.received >= after.sent) throw new Error("Configured loss was not observed");
   } else if (fault === "rate") {
@@ -83,3 +95,10 @@ export function checkCalibration(before: ProbeResult, after: ProbeResult, fault:
     }
   } else if (after.received !== after.sent) throw new Error("Control path unexpectedly lost calibration packets");
 }
+
+export function checkMapping(probe: ProbeResult, mode: NatMode): void {
+  const ports = new Set(probe.mappings.map(value => value.port));
+  if (probe.mappings.length !== 3 || (mode === "preserve" ? ports.size !== 1 : ports.size < 2)) {
+    throw new Error(`Observed mappings do not match the configured ${mode} SNAT behavior`);
+  }
+}
diff --git a/scripts/network-lab/udp.ts b/scripts/network-lab/udp.ts
index 50d9577ca..50562993a 100644
--- a/scripts/network-lab/udp.ts
+++ b/scripts/network-lab/udp.ts
@@ -2,20 +2,21 @@ import { createSocket, type Socket } from "node:dgram";
 import { once } from "node:events";
 import { performance } from "node:perf_hooks";
 import { setTimeout as delay } from "node:timers/promises";
-import { SITE_IP } from "./network";
+import { SITE_IP, SITE_IPV6 } from "./network";
 
 const targets = [{ host: SITE_IP, port: 41001 }, { host: SITE_IP, port: 41002 }, { host: "198.51.100.2", port: 41001 }];
 
-export async function echoWorker(): Promise<void> {
+export async function echoWorker(ipv6 = false): Promise<void> {
   const sockets: Socket[] = [];
   try {
-    for (const { host, port } of targets) {
-      const socket = createSocket("udp4"); sockets.push(socket);
+    for (const { host, port } of [...targets, ...(ipv6 ? [{ host: SITE_IPV6, port: 41001 }] : [])]) {
+      const socket = createSocket(host.includes(":") ? "udp6" : "udp4"); sockets.push(socket);
       socket.on("message", (data, remote) => {
         if (data.length !== 1200 || data.readUInt32BE(0) !== 0x50494c42) return;
         const reply = Buffer.from(data);
         reply.writeUInt16BE(remote.port, 16);
         remote.address.split(".").forEach((part, index) => reply[18 + index] = Number(part));
+        reply.write(remote.address, 32, 64, "utf8");
         socket.send(reply, remote.port, remote.address, () => {});
       });
       socket.bind(port, host); await once(socket, "listening");
@@ -69,8 +70,9 @@ export async function preparePeerProbe() {
   } catch (error) { close(); throw error; }
 }
 
-export async function udpProbe(load: boolean): Promise<ProbeResult> {
-  const socket = createSocket("udp4"), start = performance.now();
+export async function udpProbe(load: boolean, ipv6 = false): Promise<ProbeResult> {
+  const socket = createSocket(ipv6 ? "udp6" : "udp4"), start = performance.now();
+  const destinations = ipv6 ? [{ host: SITE_IPV6, port: 41001 }] : targets;
   const result: ProbeResult = { sent: 0, received: 0, receivedBytes: 0, durationMs: 0, rttMs: [], mappings: [] };
   const seen = new Set<number>();
   socket.on("message", (data, remote) => {
@@ -81,14 +83,14 @@ export async function udpProbe(load: boolean): Promise<ProbeResult> {
     result.rttMs.push(performance.now() - data.readDoubleBE(8));
     const destination = `${remote.address}:${remote.port}`;
     if (!result.mappings.some(value => value.destination === destination)) result.mappings.push({
-      destination, address: [...data.subarray(18, 22)].join("."), port: data.readUInt16BE(16),
+      destination, address: data.subarray(32, 96).toString("utf8").replace(/\0.*$/, ""), port: data.readUInt16BE(16),
     });
   });
-  socket.bind(0, "0.0.0.0"); await once(socket, "listening");
+  socket.bind(0, ipv6 ? "::" : "0.0.0.0"); await once(socket, "listening");
   try {
     const count = load ? 1000 : 12;
     for (let i = 0; i < count; i++) {
-      const target = targets[load ? 0 : i % targets.length]!;
+      const target = destinations[load ? 0 : i % destinations.length]!;
       const packet = Buffer.alloc(1200); packet.writeUInt32BE(0x50494c42, 0);
       packet.writeUInt32BE(result.sent++, 4); packet.writeDoubleBE(performance.now(), 8);
       await new Promise<void>((resolve, reject) => socket.send(packet, target.port, target.host, error => error ? reject(error) : resolve()));
diff --git a/tests/network-lab.test.ts b/tests/network-lab.test.ts
index 40a4944ef..79ddcf1c8 100644
--- a/tests/network-lab.test.ts
+++ b/tests/network-lab.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
-import { checkCalibration, checkContinuity, checkFaultHit, hasPicture, selectScenarios } from "../scripts/network-lab/scenarios";
-import { checkMediaFeedback, packetFlows, type PacketFlow } from "../scripts/network-lab/packets";
+import { checkCalibration, checkContinuity, checkFaultHit, checkMapping, hasPicture, selectScenarios } from "../scripts/network-lab/scenarios";
+import { checkMediaFeedback, checkMediaPath, packetFlows, type PacketFlow } from "../scripts/network-lab/packets";
 import type { MediaSample } from "../scripts/network-lab/page";
 import type { ProbeResult } from "../scripts/network-lab/udp";
 
@@ -23,6 +23,14 @@ describe("network laboratory evidence", () => {
     expect(() => checkCalibration({ ...baseline, mappings: baseline.mappings.map(value => ({ ...value, address: "10.71.1.2" })) }, baseline, "none")).toThrow();
   });
 
+  it("checks mapping observations rather than trusting a NAT configuration name", () => {
+    expect(() => checkMapping(baseline, "preserve")).not.toThrow();
+    expect(() => checkMapping(baseline, "random")).toThrow();
+    const random = { ...baseline, mappings: baseline.mappings.map((value, index) => ({ ...value, port: value.port + index })) };
+    expect(() => checkMapping(random, "random")).not.toThrow();
+    expect(() => checkMapping(random, "preserve")).toThrow();
+  });
+
   it("does not confuse a connected transport or stale video dimensions with decoded media", () => {
     const sample = { width: 1280, height: 720, frames: 30, stats: [] } as unknown as MediaSample;
     expect(hasPicture(sample)).toBe(false);
@@ -66,6 +74,12 @@ describe("network laboratory evidence", () => {
     expect(() => checkMediaFeedback([media, { ...feedback, source: "127.0.0.1" }], media.source, media.destination)).toThrow();
     expect(() => checkMediaFeedback([media, { ...feedback, destinationPort: 5001 }], media.source, media.destination)).toThrow();
     expect(() => checkMediaFeedback([media, feedback], media.source, media.destination)).not.toThrow();
+    const onward = { ...media, source: media.destination, destination: "198.51.100.13" };
+    const reverse = { ...feedback, source: onward.destination, destination: onward.source };
+    expect(checkMediaPath([media, feedback, onward, reverse], media.source, onward.destination, [media.destination])).toEqual([
+      media.source, media.destination, onward.destination,
+    ]);
+    expect(() => checkMediaPath([media, feedback, onward], media.source, onward.destination, [media.destination])).toThrow();
   });
 
   it("reads clear RTP/RTCP headers from a bounded capture and rejects truncation", () => {
@@ -77,6 +91,8 @@ describe("network laboratory evidence", () => {
     expect(packetFlows(capture)[0]).toMatchObject({ source: "198.51.100.11", destination: "198.51.100.12", sourcePort: 5000, destinationPort: 6000, kind: "rtp" });
     capture[24 + 16 + 43] = 201;
     expect(packetFlows(capture)[0]?.kind).toBe("rtcp");
+    expect(packetFlows(capture, { startMs: 2000, endMs: 5000 })).toEqual([]);
+    expect(packetFlows(capture, { startMs: 500, endMs: 1500 })).toHaveLength(1);
     expect(() => packetFlows(capture.subarray(0, -1))).toThrow();
   });
 });

From 9736ae928f22247b0e22a011a0b28dbc02471bb8 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 03:05:53 +0800
Subject: [PATCH 195/262] test(network): verify fault detection and
 cancelled-run cleanup

---
 .github/workflows/repository-hygiene.yml |  9 +++-
 docs/research/network-lab.md             |  4 ++
 scripts/network-lab.ts                   | 41 +++++++++++-----
 scripts/network-lab/endpoint.ts          |  2 +
 scripts/network-lab/network.ts           |  3 +-
 scripts/network-lab/page.ts              |  5 +-
 scripts/network-lab/verify.ts            | 61 ++++++++++++++++++++++++
 7 files changed, 108 insertions(+), 17 deletions(-)
 create mode 100644 scripts/network-lab/verify.ts

diff --git a/.github/workflows/repository-hygiene.yml b/.github/workflows/repository-hygiene.yml
index 161ddc9e1..b3cd2137f 100644
--- a/.github/workflows/repository-hygiene.yml
+++ b/.github/workflows/repository-hygiene.yml
@@ -22,7 +22,7 @@ on:
         required: false
         default: none
         type: choice
-        options: [none, smoke, full]
+        options: [none, verify, smoke, full]
       network_cases:
         description: Optional comma-separated laboratory cases (empty runs the selected suite)
         required: false
@@ -142,7 +142,12 @@ jobs:
           TC_LIB_DIR: ${{ github.workspace }}/build/network-lab/iproute2/netem
           PIIK_NETWORK_LAB_SUITE: ${{ inputs.network_lab }}
           PIIK_NETWORK_LAB_CASES: ${{ inputs.network_cases }}
-        run: sudo --preserve-env=PATH,CHROME_PATH,TC_LIB_DIR "$(command -v node)" --import tsx scripts/network-lab.ts --suite "$PIIK_NETWORK_LAB_SUITE" --cases "$PIIK_NETWORK_LAB_CASES"
+        run: |
+          if [ "$PIIK_NETWORK_LAB_SUITE" = verify ]; then
+            sudo --preserve-env=PATH,CHROME_PATH,TC_LIB_DIR "$(command -v node)" --import tsx scripts/network-lab.ts --verify
+          else
+            sudo --preserve-env=PATH,CHROME_PATH,TC_LIB_DIR "$(command -v node)" --import tsx scripts/network-lab.ts --suite "$PIIK_NETWORK_LAB_SUITE" --cases "$PIIK_NETWORK_LAB_CASES"
+          fi
       - name: Save network laboratory evidence
         if: always() && github.event_name == 'workflow_dispatch' && inputs.network_lab != 'none' && inputs.network_lab != ''
         uses: actions/upload-artifact@v7
diff --git a/docs/research/network-lab.md b/docs/research/network-lab.md
index f26444721..078644196 100644
--- a/docs/research/network-lab.md
+++ b/docs/research/network-lab.md
@@ -100,6 +100,10 @@ Set `CHROME_PATH` to the installed Chrome executable before running. `--list`
 lists scenarios without root; `--suite full`, `--cases browser-browser,app-app`,
 `--repeat 3` and `--seed 42` select reproducible inputs. Netem seeds do not make
 browser scheduling, kernel port allocation or real-time timings deterministic.
+`--verify` (CI `network_lab: verify`) runs negative controls against the actual
+runner: missing fault, frozen picture, partially failed setup, and cancellation
+during calibration or sharing. Each must fail for its intended reason and leave
+no owned resources; an unrelated process failure is not a passing control.
 Each fault phase replaces its owned qdisc completely: netem's in-place change
 retains some omitted attributes, including a previous rate limit. Restoration
 therefore checks the resulting rules and independent UDP reachability as well as
diff --git a/scripts/network-lab.ts b/scripts/network-lab.ts
index c17040afd..b98635403 100644
--- a/scripts/network-lab.ts
+++ b/scripts/network-lab.ts
@@ -13,11 +13,12 @@ import { checkCalibration, checkContinuity, checkFaultHit, checkMapping, hasPict
 import { echoWorker, type ProbeResult } from "./network-lab/udp";
 import type { MediaSample } from "./network-lab/page";
 import { checkMediaFeedback, checkMediaPath, readPacketFlows, type PacketFlow } from "./network-lab/packets";
+import { verifyLaboratory } from "./network-lab/verify";
 
 const ROOT = resolve(import.meta.dirname, ".."), ENTRY = resolve(import.meta.filename);
 const { values } = parseArgs({ options: { worker: { type: "string" }, suite: { type: "string", default: "smoke" },
   cases: { type: "string" }, repeat: { type: "string", default: "1" }, seed: { type: "string", default: "1" },
-  ipv6: { type: "boolean" }, list: { type: "boolean" } } });
+  ipv6: { type: "boolean" }, list: { type: "boolean" }, verify: { type: "boolean" }, negative: { type: "string" } } });
 
 class Endpoint {
   private id = 0;
@@ -72,8 +73,11 @@ async function runCase(scenario: Scenario, seed: number, output: string, signal:
   const mediaWindows: Array<{ name: string; startMs: number; endMs: number }> = [];
   const pcapPath = join(output, "wan.pcap");
   const result: Record<string, unknown> = { scenario, seed, passed: false, stage: "setup", samples };
+  const stage = (name: string) => {
+    result.stage = name; process.stdout.write(JSON.stringify({ case: scenario.id, stage: name }) + "\n");
+  };
   const faultIndex = scenario.faultEndpoint ?? 0;
-  const setFault = (fault: Scenario["fault"]) => network.setFault(faultIndex, fault, seed, scenario.direction);
+  const setFault = (fault: Scenario["fault"]) => network.setFault(faultIndex, values.negative === "missing-fault" ? "none" : fault, seed, scenario.direction);
   const counters = () => network.counters(faultIndex);
   const sampleAll = async () => {
     const [host, viewer, sibling] = await Promise.all(endpoints.map(endpoint => endpoint.call<MediaSample>("sample")));
@@ -88,7 +92,7 @@ async function runCase(scenario: Scenario, seed: number, output: string, signal:
   };
   try {
     signal.throwIfAborted();
-    network.setup([...scenario.nat, ...(scenario.sibling ? ["preserve" as const] : [])], scenario.ipv6);
+    network.setup([...scenario.nat, ...(scenario.sibling ? ["preserve" as const] : [])], scenario.ipv6, values.negative === "partial-setup");
     echo = spawn("ip", ["netns", "exec", network.wan, process.execPath, "--import", "tsx", ENTRY, "--worker", "echo", ...(scenario.ipv6 ? ["--ipv6"] : [])],
       { cwd: ROOT, env: labEnvironment(), stdio: "pipe" });
     echo.stderr.on("data", data => process.stderr.write(data));
@@ -96,7 +100,7 @@ async function runCase(scenario: Scenario, seed: number, output: string, signal:
     await withDeadline(() => once(echo!.stdout, "data"), Date.now() + 10_000);
     for (let i = 0; i < (scenario.sibling ? 3 : 2); i++) endpoints.push(new Endpoint(network.endpoint(i),
       await mkdtemp(join(tmpdir(), "piik-client-media-")), signal));
-    result.stage = "calibration";
+    stage("calibration");
     const baselines = await Promise.all(endpoints.map(endpoint => endpoint.call<ProbeResult>("probe")));
     result.mappingCalibration = baselines;
     baselines.forEach((probe, index) => checkMapping(probe, scenario.nat[index] ?? "preserve"));
@@ -117,7 +121,7 @@ async function runCase(scenario: Scenario, seed: number, output: string, signal:
     checkCalibration(before, after, scenario.fault);
     // Load probes are calibration traffic, never competing with measured media.
     if (scenario.duringShare) setFault("none");
-    result.stage = "startup";
+    stage("startup");
     server = spawn("ip", ["netns", "exec", network.wan, resolve("build/network-lab/bin/piik-server")], {
       cwd: output, stdio: "pipe", env: { ...labEnvironment(), PIIK_ENV: "development", ROOM_DATABASE_PATH: ":memory:",
         LISTEN_HOST: SITE_IP, PORT: "9000", PUBLIC_BASE_URL: SITE_ORIGIN, ALLOWED_ORIGINS: SITE_ORIGIN,
@@ -137,13 +141,13 @@ async function runCase(scenario: Scenario, seed: number, output: string, signal:
       if (capture!.exitCode !== null) throw new Error(`Packet capture failed: ${captureLog}`);
       await delay(50, undefined, { signal });
     } }, Date.now() + 5000);
-    result.stage = "share";
+    stage("share");
     await endpoints[0]!.call("navigate", { url: SITE_ORIGIN + (scenario.host === "app" ? "/#piik-client=1" : "/") });
     const invitation = await endpoints[0]!.call<string>("share");
     const joinedAt = performance.now();
     await endpoints[1]!.call("navigate", { url: invitation + (scenario.viewer === "app" ? "&piik-client=1" : "") });
     if (scenario.sibling) await endpoints[2]!.call("navigate", { url: invitation });
-    result.stage = "first-picture";
+    stage("first-picture");
     let connected = false, exhausted = false;
     while (performance.now() - joinedAt < 110_000) {
       signal.throwIfAborted();
@@ -157,18 +161,28 @@ async function runCase(scenario: Scenario, seed: number, output: string, signal:
     result.outcome = connected ? "media" : exhausted ? "unavailable" : "timeout";
     if (result.outcome === "timeout" || (scenario.expected !== "observed" && result.outcome !== scenario.expected)) throw new Error(`Expected ${scenario.expected}, observed ${result.outcome}; ${serverLog.slice(-1000)}`);
     if (connected) {
-      result.stage = "continuity";
+      stage("continuity");
       const first = samples.at(-1)!.viewer;
       const steadyStart = Date.now();
       await delay(3000, undefined, { signal });
       const { viewer: next, sibling: healthy } = await sampleAll();
       checkContinuity(first, next);
       mediaWindows.push({ name: "baseline", startMs: steadyStart, endMs: Date.now() });
+      if (values.negative === "frozen-picture") {
+        stage("negative-control");
+        await endpoints[0]!.call("freeze-picture");
+        // Drain already encoded frames before measuring the deliberately static source.
+        await delay(2000, undefined, { signal });
+        const frozen = await endpoints[1]!.call<MediaSample>("sample");
+        await delay(3000, undefined, { signal });
+        checkContinuity(frozen, (await sampleAll()).viewer);
+        throw new Error("Frozen synthetic picture incorrectly passed");
+      }
       if (scenario.sfu && next.route !== "sfu") throw new Error("Expected SFU route, but media used another path");
       if (scenario.host === "app") checkAppPath(samples.at(-1)!.host, "prepare-edge");
       if (scenario.viewer === "app") checkAppPath(next, "receive-offer");
       if (scenario.duringShare) {
-        result.stage = "impairment";
+        stage("impairment");
         setFault(scenario.fault);
         const impairedAt = performance.now();
         let healthyWindow = healthy, healthyAt = impairedAt;
@@ -196,7 +210,7 @@ async function runCase(scenario: Scenario, seed: number, output: string, signal:
         const restoredProbe = await endpoints[faultIndex]!.call<ProbeResult>("probe");
         result.restoredCalibration = restoredProbe;
         checkCalibration(before, restoredProbe, "none");
-        result.stage = "recovery";
+        stage("recovery");
         const restoredAt = performance.now(); let recovered = false;
         while (performance.now() - restoredAt < 60_000) {
           signal.throwIfAborted();
@@ -220,7 +234,7 @@ async function runCase(scenario: Scenario, seed: number, output: string, signal:
     if (!scenario.duringShare) checkFaultHit(scenario.fault, counters().faultDrops);
     await endpoints[0]!.call("stop");
     signal.throwIfAborted();
-    result.passed = true; result.stage = "done";
+    result.passed = true; stage("done");
   } catch (error) { result.error = error instanceof Error ? error.message : String(error); }
   finally {
     try {
@@ -254,7 +268,7 @@ async function runCase(scenario: Scenario, seed: number, output: string, signal:
     if (capture) try {
       const flows = await readPacketFlows(pcapPath); result.packetFlows = flows;
       if (!captureLog.includes("0 packets dropped by kernel")) throw new Error(`Capture loss prevents a complete observation: ${captureLog}`);
-      if (result.outcome === "media") proveMedia(flows);
+      if (result.outcome === "media" && !signal.aborted) proveMedia(flows);
       result.mediaWindows = [];
       for (const window of mediaWindows) {
         const selected = await readPacketFlows(pcapPath, window);
@@ -283,11 +297,13 @@ async function main(): Promise<void> {
   if (values.list) { process.stdout.write(JSON.stringify(selected, null, 2) + "\n"); return; }
   if (process.platform !== "linux" || process.getuid?.() !== 0) throw new Error("Network lab requires an isolated Linux runner and root for owned namespaces");
   if (!process.env.CHROME_PATH) throw new Error("CHROME_PATH is required");
+  if (values.negative && !["missing-fault", "frozen-picture", "partial-setup"].includes(values.negative)) throw new Error("Unknown negative control");
   const repeat = Number(values.repeat), seed = Number(values.seed);
   if (!Number.isInteger(repeat) || repeat < 1 || repeat > 20 || !Number.isInteger(seed) || seed < 1 || seed > 0xffff_ffff) throw new Error("Invalid repeat (1..20) or seed (uint32)");
   for (const tool of ["ip", "tc", "nft", "sysctl", "tcpdump"]) command("which", [tool]);
   const output = resolve("build/network-lab/results", new Date().toISOString().replaceAll(/[:.]/g, "-"));
   await mkdir(output, { recursive: true });
+  process.stdout.write(JSON.stringify({ report: output }) + "\n");
   const identity = { revision: command("git", ["rev-parse", "HEAD"]), kernel: command("uname", ["-a"]),
     node: process.version, iproute: command("ip", ["-Version"]), tc: command("tc", ["-Version"]), nftables: command("nft", ["--version"]), selected, repeat, seed };
   await writeFile(join(output, "environment.json"), JSON.stringify(identity, null, 2) + "\n");
@@ -310,4 +326,5 @@ async function main(): Promise<void> {
 if (values.worker === "endpoint") await endpointWorker();
 else if (values.worker === "echo") await echoWorker(values.ipv6);
 else if (values.worker) throw new Error("Unknown network lab worker");
+else if (values.verify) await verifyLaboratory(ENTRY);
 else await main();
diff --git a/scripts/network-lab/endpoint.ts b/scripts/network-lab/endpoint.ts
index dbfe28532..d0fa310bd 100644
--- a/scripts/network-lab/endpoint.ts
+++ b/scripts/network-lab/endpoint.ts
@@ -88,6 +88,8 @@ export async function endpointWorker(): Promise<void> {
           result = await evaluate<string>(cdp!, page!, "document.querySelector('.lr-invite-url').value", Date.now() + 5000);
         } else if (request.action === "sample") {
           result = await sample();
+        } else if (request.action === "freeze-picture") {
+          result = await evaluate(cdp!, page!, "networkLab.freezeCapture()", Date.now() + 5000);
         } else if (request.action === "signal-probe") {
           result = await evaluate(cdp!, page!, "networkLab.signalProbe()", Date.now() + 5000);
         } else if (request.action === "logs") {
diff --git a/scripts/network-lab/network.ts b/scripts/network-lab/network.ts
index 26ccf388b..e47442901 100644
--- a/scripts/network-lab/network.ts
+++ b/scripts/network-lab/network.ts
@@ -50,7 +50,7 @@ export class LabNetwork {
     }
   }
 
-  setup(modes: readonly NatMode[], ipv6 = false): void {
+  setup(modes: readonly NatMode[], ipv6 = false, failSetup = false): void {
     this.add(this.wan);
     this.exec(this.wan, "ip", ["link", "add", "internet", "type", "bridge"]);
     this.exec(this.wan, "ip", ["addr", "add", `${SITE_IP}/24`, "dev", "internet"]);
@@ -61,6 +61,7 @@ export class LabNetwork {
       const n = index + 1, endpoint = this.endpoint(index), router = this.router(index);
       this.add(endpoint); this.add(router);
       this.wire(endpoint, "eth0", router, "lan0");
+      if (failSetup) throw new Error("Injected partial network setup failure");
       this.wire(router, "wan0", this.wan, `port${n}`);
       this.exec(this.wan, "ip", ["link", "set", `port${n}`, "master", "internet"]);
       this.exec(endpoint, "ip", ["addr", "add", `10.71.${n}.2/24`, "dev", "eth0"]);
diff --git a/scripts/network-lab/page.ts b/scripts/network-lab/page.ts
index 499338346..5b50b0511 100644
--- a/scripts/network-lab/page.ts
+++ b/scripts/network-lab/page.ts
@@ -3,7 +3,7 @@
 export const pageProbe = String.raw`(() => {
   localStorage.setItem('piik:ui-lang','en'); localStorage.setItem('piik:ui-mode','text');
   const peers=[], sockets=[], events=[], errors=[], controls=[];
-  let route=null;
+  let route=null,freezeCapture=()=>{};
   const PC=RTCPeerConnection, WS=WebSocket;
   const picture=document.createElement('canvas');picture.width=64;picture.height=36;
   const pictureContext=picture.getContext('2d',{willReadFrequently:true});
@@ -40,6 +40,7 @@ export const pageProbe = String.raw`(() => {
       }
       ctx.fillStyle='#fff';ctx.font='70px sans-serif';ctx.fillText(String(frame++),80,540);};
     draw();const timer=setInterval(draw,1000/30),stream=canvas.captureStream(30);
+    freezeCapture=()=>clearInterval(timer);
     const video=stream.getVideoTracks()[0],stop=video.stop.bind(video);
     video.stop=()=>{clearInterval(timer);stop();};
     const ac=new AudioContext(),osc=ac.createOscillator(),dest=ac.createMediaStreamDestination();
@@ -48,7 +49,7 @@ export const pageProbe = String.raw`(() => {
     sound.stop=()=>{if(stopped)return;stopped=true;osc.stop();void ac.close();stopSound();};
     stream.addTrack(sound);return stream;
   };
-  window.networkLab={async signalProbe(){
+  window.networkLab={freezeCapture:()=>freezeCapture(),async signalProbe(){
     const socket=sockets.findLast(s=>!s.url.includes('/control')&&s.readyState===WS.OPEN);
     if(!socket)return false;
     return new Promise(resolve=>{
diff --git a/scripts/network-lab/verify.ts b/scripts/network-lab/verify.ts
new file mode 100644
index 000000000..72eeb3ae1
--- /dev/null
+++ b/scripts/network-lab/verify.ts
@@ -0,0 +1,61 @@
+import { spawn } from "node:child_process";
+import { once } from "node:events";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { createInterface } from "node:readline";
+import { withDeadline } from "../browser-gate-harness";
+
+// Exercise the actual runner and OS signals. An arbitrary nonzero exit is not
+// a passing negative control: it must reject the intended condition and clean up.
+export async function verifyLaboratory(entry: string): Promise<void> {
+  if (process.platform !== "linux" || process.getuid?.() !== 0) throw new Error("Laboratory verification requires isolated Linux root");
+  const controls = [
+    { name: "partial-setup", cases: "browser-browser", error: /^Injected partial network setup failure$/ },
+    { name: "missing-fault", cases: "stun-backup", error: /^No packets hit the stun-primary rule;/, media: true },
+    { name: "frozen-picture", cases: "browser-browser", error: /^(Decoded video did not continue|Rendered synthetic picture did not change)$/, media: true },
+    { name: "cancel-calibration", cases: "browser-browser,app-app", cancelAt: "calibration" },
+    { name: "cancel-sharing", cases: "browser-browser,app-app", cancelAt: "continuity" },
+  ];
+  const results: unknown[] = [];
+  const output = resolve("build/network-lab/results", `verification-${new Date().toISOString().replaceAll(/[:.]/g, "-")}`);
+  await mkdir(output, { recursive: true });
+  for (const control of controls) {
+    let report = "", stderr = "", cancelled = false;
+    const child = spawn(process.execPath, ["--import", "tsx", entry, "--cases", control.cases,
+      ...(control.cancelAt ? [] : ["--negative", control.name])], { stdio: "pipe" });
+    child.stderr.on("data", data => { stderr = (stderr + data).slice(-4000); });
+    createInterface({ input: child.stdout }).on("line", line => {
+      try {
+        const message = JSON.parse(line);
+        if (message.report) report = message.report;
+        if (control.cancelAt && message.stage === control.cancelAt && !cancelled) {
+          cancelled = true; child.kill("SIGINT");
+        }
+      } catch {}
+    });
+    try {
+      const [code] = await withDeadline(() => once(child, "exit"), Date.now() + 180_000);
+      if (code !== 1 || !report) throw new Error(`Expected a recorded failure; exit ${code}: ${stderr}`);
+      const records = JSON.parse(await readFile(resolve(report, "summary.json"), "utf8"));
+      if (records.length !== 1) throw new Error("A cancelled run continued into another case");
+      const result = records[0];
+      if (result.passed || (control.error && !control.error.test(result.error ?? "")) ||
+          (control.cancelAt && (!cancelled || !result.cancelled)) ||
+          (control.media && result.outcome !== "media")) throw new Error(`Wrong failure: ${JSON.stringify(result.error)}`);
+      const cleanup = [result.cleanup, ...result.endpointCleanup, ...result.serviceCleanup];
+      if (!cleanup.every(value => Object.values(value).every(flag => flag === true)) ||
+          !result.profileCleanup.every(Boolean) || result.cleanupError || result.captureError) throw new Error("Negative control leaked resources or lost evidence");
+      results.push({ control: control.name, verified: true, report, error: result.error, cleanup: result.cleanup });
+    } catch (error) {
+      results.push({ control: control.name, verified: false, report, error: String(error) });
+      process.exitCode = 1;
+    } finally {
+      if (child.exitCode === null && child.signalCode === null) {
+        child.kill("SIGTERM");
+        await withDeadline(() => once(child, "exit"), Date.now() + 45_000).catch(() => child.kill("SIGKILL"));
+      }
+    }
+    process.stdout.write(JSON.stringify(results.at(-1)) + "\n");
+  }
+  await writeFile(resolve(output, "verification.json"), JSON.stringify(results, null, 2) + "\n");
+}

From 4a4eb409b534fbbfc4087e6aab1292cce404618f Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 03:11:22 +0800
Subject: [PATCH 196/262] test(network): compare NAT settings and exercise
 public address changes

---
 .github/workflows/repository-hygiene.yml | 17 ++++++-
 docs/research/network-lab.md             | 17 ++++++-
 docs/todo.md                             |  7 +++
 scripts/network-lab.ts                   | 58 +++++++++++++++---------
 scripts/network-lab/endpoint.ts          | 14 ++++--
 scripts/network-lab/network.ts           | 19 +++++++-
 scripts/network-lab/page.ts              |  6 ++-
 scripts/network-lab/scenarios.ts         | 36 +++++++++++++++
 scripts/network-lab/udp.ts               | 23 ++++++++++
 tests/network-lab.test.ts                | 14 +++++-
 10 files changed, 178 insertions(+), 33 deletions(-)

diff --git a/.github/workflows/repository-hygiene.yml b/.github/workflows/repository-hygiene.yml
index b3cd2137f..034cab81e 100644
--- a/.github/workflows/repository-hygiene.yml
+++ b/.github/workflows/repository-hygiene.yml
@@ -27,6 +27,17 @@ on:
         description: Optional comma-separated laboratory cases (empty runs the selected suite)
         required: false
         type: string
+      network_prediction:
+        description: NAT enhancement setting (compare runs paired on/off trials)
+        required: false
+        default: 'on'
+        type: choice
+        options: ['on', 'off', compare]
+      network_repeat:
+        description: Repetitions per laboratory case (1..20)
+        required: false
+        default: '1'
+        type: string
 
 permissions:
   contents: read
@@ -115,7 +126,7 @@ jobs:
         if: github.event_name == 'workflow_dispatch' && inputs.network_lab != 'none' && inputs.network_lab != ''
         run: |
           sudo apt-get update
-          sudo apt-get install -y nftables iproute2 tcpdump bison flex libmnl-dev libcap-dev
+          sudo apt-get install -y nftables iproute2 tcpdump conntrack bison flex libmnl-dev libcap-dev
           mkdir -p build/network-lab/bin
           CGO_ENABLED=0 go build -trimpath -o build/network-lab/bin/piik-server ./cmd/piik-server
           CGO_ENABLED=0 go build -trimpath -o build/network-lab/bin/piik-app ./cmd/piik-app
@@ -142,11 +153,13 @@ jobs:
           TC_LIB_DIR: ${{ github.workspace }}/build/network-lab/iproute2/netem
           PIIK_NETWORK_LAB_SUITE: ${{ inputs.network_lab }}
           PIIK_NETWORK_LAB_CASES: ${{ inputs.network_cases }}
+          PIIK_NETWORK_LAB_PREDICTION: ${{ inputs.network_prediction }}
+          PIIK_NETWORK_LAB_REPEAT: ${{ inputs.network_repeat }}
         run: |
           if [ "$PIIK_NETWORK_LAB_SUITE" = verify ]; then
             sudo --preserve-env=PATH,CHROME_PATH,TC_LIB_DIR "$(command -v node)" --import tsx scripts/network-lab.ts --verify
           else
-            sudo --preserve-env=PATH,CHROME_PATH,TC_LIB_DIR "$(command -v node)" --import tsx scripts/network-lab.ts --suite "$PIIK_NETWORK_LAB_SUITE" --cases "$PIIK_NETWORK_LAB_CASES"
+            sudo --preserve-env=PATH,CHROME_PATH,TC_LIB_DIR "$(command -v node)" --import tsx scripts/network-lab.ts --suite "$PIIK_NETWORK_LAB_SUITE" --cases "$PIIK_NETWORK_LAB_CASES" --prediction "$PIIK_NETWORK_LAB_PREDICTION" --repeat "$PIIK_NETWORK_LAB_REPEAT"
           fi
       - name: Save network laboratory evidence
         if: always() && github.event_name == 'workflow_dispatch' && inputs.network_lab != 'none' && inputs.network_lab != ''
diff --git a/docs/research/network-lab.md b/docs/research/network-lab.md
index 078644196..7e838637d 100644
--- a/docs/research/network-lab.md
+++ b/docs/research/network-lab.md
@@ -81,8 +81,8 @@ to make an experiment pass.
 ## Running The Process Layer
 
 Use an isolated Linux machine or VM with Node/Go from the repository toolchain,
-Google Chrome, current `iproute2` with netem `seed` support, `nftables` and
-`tcpdump`. CI builds a pinned iproute2 6.17 traffic-control binary locally because
+Google Chrome, current `iproute2` with netem `seed` support, `nftables`,
+`conntrack` and `tcpdump`. CI builds a pinned iproute2 6.17 traffic-control binary locally because
 the runner's distribution package lacks that option. Namespace administration
 requires root. Windows/macOS can run the model/unit layer; they need a Linux VM
 for this process layer. Root on a production host is not an equivalent setup.
@@ -100,6 +100,11 @@ Set `CHROME_PATH` to the installed Chrome executable before running. `--list`
 lists scenarios without root; `--suite full`, `--cases browser-browser,app-app`,
 `--repeat 3` and `--seed 42` select reproducible inputs. Netem seeds do not make
 browser scheduling, kernel port allocation or real-time timings deterministic.
+`--prediction compare --repeat 3` pairs the existing Host enhancement switch on
+and off with the same inputs and alternates run order. `distributions.json`
+reports trial/failure counts and nearest-rank timing summaries for validated
+media trials; unavailable and timed-out attempts never become zero-millisecond
+successes. Small trial counts are observations, not population estimates.
 `--verify` (CI `network_lab: verify`) runs negative controls against the actual
 runner: missing fault, frozen picture, partially failed setup, and cancellation
 during calibration or sharing. Each must fail for its intended reason and leave
@@ -116,3 +121,11 @@ The process layer is still under validation. Listed scenarios are implementation
 targets until their reports pass the acceptance contract. In particular, App
 Host checks must use the real H264 Browser-to-App ingress and App WAN sender;
 launching an App alongside a Browser-only VP8 share is not an App-path test.
+
+Each router uses destination-aware connection tracking for filtering. Independent
+probes check responses from the contacted endpoint, another port and another
+address before sharing. The preserve/random SNAT cases describe observed port
+mapping, not every consumer NAT implementation. Address-change cases replace
+only the isolated router's UDP public address and conntrack entries while
+proving that TCP signaling stays usable; both old and new media windows retain
+their respective addresses for packet/feedback checks.
diff --git a/docs/todo.md b/docs/todo.md
index 338de6202..b70a4fb51 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -16,6 +16,13 @@ Git/PRs own completed history.
   repeatable reports, negative controls and cancellation cleanup. Establish this
   evidence before further NAT mechanism changes. Model results do not replace
   physical-network beta or establish a public success percentage.
+- [ ] **Warm-source first-video allocation.** The network laboratory's App/App
+  outage test loses video after transport replacement. A separate real-RTP
+  reproduction confirms that a measured raw source above a new transport's
+  initial budget can pause before TWCC establishes capacity. Correct startup
+  allocation at the shared forwarding owner, preserve observed congestion
+  limits, then rerun outage, constrained-link and healthy-sibling acceptance.
+  This mechanism does not yet establish every field disconnect's cause.
 
 - [ ] **2.0 candidate preparation and acceptance.** The owner reopened investigation,
   useful improvements and outstanding acceptance on 2026-10-07, and on 2026-10-09
diff --git a/scripts/network-lab.ts b/scripts/network-lab.ts
index b98635403..ab097042d 100644
--- a/scripts/network-lab.ts
+++ b/scripts/network-lab.ts
@@ -9,7 +9,7 @@ import { setTimeout as delay } from "node:timers/promises";
 import { cleanupRun, withDeadline } from "./browser-gate-harness";
 import { endpointWorker } from "./network-lab/endpoint";
 import { command, LabNetwork, SITE_IP, SITE_ORIGIN } from "./network-lab/network";
-import { checkCalibration, checkContinuity, checkFaultHit, checkMapping, hasPicture, selectScenarios, type Scenario } from "./network-lab/scenarios";
+import { checkCalibration, checkContinuity, checkFaultHit, checkMapping, hasPicture, selectScenarios, summarizeTrials, type Scenario, type TrialSummary } from "./network-lab/scenarios";
 import { echoWorker, type ProbeResult } from "./network-lab/udp";
 import type { MediaSample } from "./network-lab/page";
 import { checkMediaFeedback, checkMediaPath, readPacketFlows, type PacketFlow } from "./network-lab/packets";
@@ -18,6 +18,7 @@ import { verifyLaboratory } from "./network-lab/verify";
 const ROOT = resolve(import.meta.dirname, ".."), ENTRY = resolve(import.meta.filename);
 const { values } = parseArgs({ options: { worker: { type: "string" }, suite: { type: "string", default: "smoke" },
   cases: { type: "string" }, repeat: { type: "string", default: "1" }, seed: { type: "string", default: "1" },
+  prediction: { type: "string", default: "on" },
   ipv6: { type: "boolean" }, list: { type: "boolean" }, verify: { type: "boolean" }, negative: { type: "string" } } });
 
 class Endpoint {
@@ -64,15 +65,15 @@ function labEnvironment(): NodeJS.ProcessEnv {
   return { PATH: process.env.PATH, CHROME_PATH: process.env.CHROME_PATH, LANG: "C.UTF-8", TMPDIR: process.env.TMPDIR };
 }
 
-async function runCase(scenario: Scenario, seed: number, output: string, signal: AbortSignal): Promise<Record<string, unknown>> {
+async function runCase(scenario: Scenario, seed: number, prediction: boolean, output: string, signal: AbortSignal): Promise<TrialSummary & Record<string, unknown>> {
   const network = new LabNetwork(), samples: Array<{ elapsedMs: number; host: MediaSample; viewer: MediaSample; sibling?: MediaSample }> = [];
   const started = performance.now(), endpoints: Endpoint[] = [];
   let server: ChildProcessWithoutNullStreams | null = null, echo: ChildProcessWithoutNullStreams | null = null;
   let capture: ChildProcessWithoutNullStreams | null = null;
   let serverLog = "", captureLog = "";
-  const mediaWindows: Array<{ name: string; startMs: number; endMs: number }> = [];
+  const mediaWindows: Array<{ name: string; startMs: number; endMs: number; addresses: string[] }> = [];
   const pcapPath = join(output, "wan.pcap");
-  const result: Record<string, unknown> = { scenario, seed, passed: false, stage: "setup", samples };
+  const result: TrialSummary & Record<string, unknown> = { scenario, seed, prediction, passed: false, stage: "setup", samples };
   const stage = (name: string) => {
     result.stage = name; process.stdout.write(JSON.stringify({ case: scenario.id, stage: name }) + "\n");
   };
@@ -84,11 +85,11 @@ async function runCase(scenario: Scenario, seed: number, output: string, signal:
     const sample = { elapsedMs: performance.now() - started, host: host!, viewer: viewer!, sibling };
     samples.push(sample); return sample;
   };
-  const proveMedia = (flows: PacketFlow[]) => {
-    if (scenario.sfu) { checkMediaFeedback(flows, network.publicIP(0), SITE_IP); checkMediaFeedback(flows, SITE_IP, network.publicIP(1)); }
-    else if (scenario.ipv6) checkMediaFeedback(flows, network.ipv6(0), network.ipv6(1));
-    else checkMediaPath(flows, network.publicIP(0), network.publicIP(1), scenario.sibling ? [network.publicIP(2)] : []);
-    if (scenario.sibling) checkMediaPath(flows, network.publicIP(0), network.publicIP(2), [network.publicIP(1)]);
+  const addresses = () => endpoints.map((_, index) => scenario.ipv6 ? network.ipv6(index) : network.publicIP(index));
+  const proveMedia = (flows: PacketFlow[], peers = addresses()) => {
+    if (scenario.sfu) { checkMediaFeedback(flows, peers[0]!, SITE_IP); checkMediaFeedback(flows, SITE_IP, peers[1]!); }
+    else checkMediaPath(flows, peers[0]!, peers[1]!, scenario.sibling ? [peers[2]!] : []);
+    if (scenario.sibling) checkMediaPath(flows, peers[0]!, peers[2]!, [peers[1]!]);
   };
   try {
     signal.throwIfAborted();
@@ -104,6 +105,9 @@ async function runCase(scenario: Scenario, seed: number, output: string, signal:
     const baselines = await Promise.all(endpoints.map(endpoint => endpoint.call<ProbeResult>("probe")));
     result.mappingCalibration = baselines;
     baselines.forEach((probe, index) => checkMapping(probe, scenario.nat[index] ?? "preserve"));
+    const filtering = await Promise.all(endpoints.map(endpoint => endpoint.call<{ sameEndpoint: boolean; changedPort: boolean; changedAddress: boolean }>("filter-probe")));
+    result.filteringCalibration = filtering;
+    if (filtering.some(probe => !probe.sameEndpoint || probe.changedPort || probe.changedAddress)) throw new Error("Observed NAT filtering differs from the configured endpoint-dependent filter");
     const before = baselines[faultIndex]!;
     const pair = endpoints.slice(0, 2);
     const mappings = await Promise.all(pair.map(endpoint => endpoint.call<{ address: string; port: number }>("peer-prepare")));
@@ -143,7 +147,7 @@ async function runCase(scenario: Scenario, seed: number, output: string, signal:
     } }, Date.now() + 5000);
     stage("share");
     await endpoints[0]!.call("navigate", { url: SITE_ORIGIN + (scenario.host === "app" ? "/#piik-client=1" : "/") });
-    const invitation = await endpoints[0]!.call<string>("share");
+    const invitation = await endpoints[0]!.call<string>("share", { prediction });
     const joinedAt = performance.now();
     await endpoints[1]!.call("navigate", { url: invitation + (scenario.viewer === "app" ? "&piik-client=1" : "") });
     if (scenario.sibling) await endpoints[2]!.call("navigate", { url: invitation });
@@ -167,7 +171,7 @@ async function runCase(scenario: Scenario, seed: number, output: string, signal:
       await delay(3000, undefined, { signal });
       const { viewer: next, sibling: healthy } = await sampleAll();
       checkContinuity(first, next);
-      mediaWindows.push({ name: "baseline", startMs: steadyStart, endMs: Date.now() });
+      mediaWindows.push({ name: "baseline", startMs: steadyStart, endMs: Date.now(), addresses: addresses() });
       if (values.negative === "frozen-picture") {
         stage("negative-control");
         await endpoints[0]!.call("freeze-picture");
@@ -205,11 +209,16 @@ async function runCase(scenario: Scenario, seed: number, output: string, signal:
           checkContinuity(healthy, samples.at(-1)!.sibling!);
           if (samples.at(-1)!.sibling!.height < healthy.height) throw new Error("Weak Viewer reduced its healthy sibling's resolution");
         }
+        if (scenario.remap) {
+          result.addressChange = network.remapUDP(faultIndex);
+          if (!await endpoints[0]!.call("signal-probe")) throw new Error("UDP address change interrupted TCP signaling");
+        }
         setFault("none");
         result.restoredCounters = counters();
         const restoredProbe = await endpoints[faultIndex]!.call<ProbeResult>("probe");
         result.restoredCalibration = restoredProbe;
         checkCalibration(before, restoredProbe, "none");
+        if (scenario.remap && restoredProbe.mappings.some(mapping => mapping.address !== network.publicIP(faultIndex))) throw new Error("UDP mappings retained the old public address");
         stage("recovery");
         const restoredAt = performance.now(); let recovered = false;
         while (performance.now() - restoredAt < 60_000) {
@@ -225,7 +234,7 @@ async function runCase(scenario: Scenario, seed: number, output: string, signal:
         await delay(3000, undefined, { signal });
         const { viewer: recoveredNext } = await sampleAll();
         checkContinuity(recoveredFirst, recoveredNext);
-        mediaWindows.push({ name: "recovered", startMs: recoveredStart, endMs: Date.now() });
+        mediaWindows.push({ name: "recovered", startMs: recoveredStart, endMs: Date.now(), addresses: addresses() });
         if (scenario.fault === "signaling" && !await endpoints[0]!.call("signal-probe")) throw new Error("Signaling roundtrip did not recover");
       }
     }
@@ -272,7 +281,7 @@ async function runCase(scenario: Scenario, seed: number, output: string, signal:
       result.mediaWindows = [];
       for (const window of mediaWindows) {
         const selected = await readPacketFlows(pcapPath, window);
-        proveMedia(selected);
+        proveMedia(selected, window.addresses);
         (result.mediaWindows as unknown[]).push({ ...window, flows: selected });
       }
     } catch (error) { result.captureError = String(error); result.passed = false; }
@@ -299,27 +308,32 @@ async function main(): Promise<void> {
   if (!process.env.CHROME_PATH) throw new Error("CHROME_PATH is required");
   if (values.negative && !["missing-fault", "frozen-picture", "partial-setup"].includes(values.negative)) throw new Error("Unknown negative control");
   const repeat = Number(values.repeat), seed = Number(values.seed);
-  if (!Number.isInteger(repeat) || repeat < 1 || repeat > 20 || !Number.isInteger(seed) || seed < 1 || seed > 0xffff_ffff) throw new Error("Invalid repeat (1..20) or seed (uint32)");
-  for (const tool of ["ip", "tc", "nft", "sysctl", "tcpdump"]) command("which", [tool]);
+  if (!Number.isInteger(repeat) || repeat < 1 || repeat > 20 || !Number.isInteger(seed) || seed < 1 || seed + repeat - 1 > 0xffff_ffff) throw new Error("Invalid repeat (1..20) or seed (uint32)");
+  if (!["on", "off", "compare"].includes(values.prediction!)) throw new Error("Prediction must be on, off or compare");
+  for (const tool of ["ip", "tc", "nft", "sysctl", "tcpdump", ...(selected.some(scenario => scenario.remap) ? ["conntrack"] : [])]) command("which", [tool]);
   const output = resolve("build/network-lab/results", new Date().toISOString().replaceAll(/[:.]/g, "-"));
   await mkdir(output, { recursive: true });
   process.stdout.write(JSON.stringify({ report: output }) + "\n");
   const identity = { revision: command("git", ["rev-parse", "HEAD"]), kernel: command("uname", ["-a"]),
-    node: process.version, iproute: command("ip", ["-Version"]), tc: command("tc", ["-Version"]), nftables: command("nft", ["--version"]), selected, repeat, seed };
+    node: process.version, iproute: command("ip", ["-Version"]), tc: command("tc", ["-Version"]), nftables: command("nft", ["--version"]), selected, repeat, seed, prediction: values.prediction };
   await writeFile(join(output, "environment.json"), JSON.stringify(identity, null, 2) + "\n");
-  const results: Array<Record<string, unknown>> = [];
+  const results: Array<TrialSummary & Record<string, unknown>> = [];
   const controller = new AbortController();
   const interrupted = () => controller.abort(new Error("Laboratory run cancelled"));
   process.once("SIGINT", interrupted); process.once("SIGTERM", interrupted);
   for (let iteration = 0; iteration < repeat; iteration++) for (const scenario of selected) {
-    if (controller.signal.aborted) break;
-    const directory = join(output, `${scenario.id}-${iteration + 1}`); await mkdir(directory);
-    process.stdout.write(JSON.stringify({ starting: scenario.id, iteration: iteration + 1 }) + "\n");
-    const result = await runCase(scenario, seed + iteration, directory, controller.signal); results.push(result);
-    process.stdout.write(JSON.stringify({ case: scenario.id, passed: result.passed, stage: result.stage, error: result.error }) + "\n");
+    const variants = values.prediction === "compare" ? (iteration % 2 === 0 ? [false, true] : [true, false]) : [values.prediction === "on"];
+    for (const prediction of variants) {
+      if (controller.signal.aborted) break;
+      const directory = join(output, `${scenario.id}-${iteration + 1}-${prediction ? "on" : "off"}`); await mkdir(directory);
+      process.stdout.write(JSON.stringify({ starting: scenario.id, iteration: iteration + 1, prediction }) + "\n");
+      const result = await runCase(scenario, seed + iteration, prediction, directory, controller.signal); results.push(result);
+      process.stdout.write(JSON.stringify({ case: scenario.id, passed: result.passed, stage: result.stage, error: result.error, prediction }) + "\n");
+    }
   }
   process.off("SIGINT", interrupted); process.off("SIGTERM", interrupted);
   await writeFile(join(output, "summary.json"), JSON.stringify(results.map(({ samples: _samples, ...result }) => result), null, 2) + "\n");
+  await writeFile(join(output, "distributions.json"), JSON.stringify(summarizeTrials(results), null, 2) + "\n");
   if (controller.signal.aborted || results.some(result => result.passed !== true)) process.exitCode = 1;
 }
 
diff --git a/scripts/network-lab/endpoint.ts b/scripts/network-lab/endpoint.ts
index d0fa310bd..3224e401c 100644
--- a/scripts/network-lab/endpoint.ts
+++ b/scripts/network-lab/endpoint.ts
@@ -7,7 +7,7 @@ import { CdpConnection, cleanupRun, createPage, evaluate, fetchJsonBefore, launc
   waitForVersion, type PageHandle } from "../browser-gate-harness";
 import { readAppEndpoint } from "../app-gate-endpoint";
 import { pageProbe, type MediaSample } from "./page";
-import { preparePeerProbe, udpProbe } from "./udp";
+import { filteringProbe, preparePeerProbe, udpProbe } from "./udp";
 
 export async function endpointWorker(): Promise<void> {
   let chrome: ChildProcessWithoutNullStreams | null = null, app: ChildProcessWithoutNullStreams | null = null;
@@ -34,11 +34,13 @@ export async function endpointWorker(): Promise<void> {
   try {
     for await (const line of createInterface({ input: process.stdin })) {
       const request = JSON.parse(line) as { id: number; action: string; origin?: string; app?: boolean;
-        url?: string; output?: string; load?: boolean; ipv6?: boolean; peer?: { address: string; port: number } };
+        url?: string; output?: string; load?: boolean; ipv6?: boolean; prediction?: boolean; peer?: { address: string; port: number } };
       try {
         let result: unknown;
         if (request.action === "probe") {
           result = await udpProbe(request.load === true, request.ipv6 === true);
+        } else if (request.action === "filter-probe") {
+          result = await filteringProbe();
         } else if (request.action === "peer-prepare") {
           rendezvous?.close(); rendezvous = await preparePeerProbe(); result = rendezvous.mapping;
         } else if (request.action === "peer-probe") {
@@ -72,6 +74,12 @@ export async function endpointWorker(): Promise<void> {
           result = true;
         } else if (request.action === "share") {
           await click('button[aria-controls="host-advanced-door"]');
+          const prediction = 'button[role="switch"][aria-label^="Enhanced NAT traversal"]';
+          await waitForSample(deadline => evaluate<boolean>(cdp!, page!,
+            `document.querySelector(${JSON.stringify(prediction)})?.getAttribute('aria-disabled') !== 'true' && Boolean(document.querySelector(${JSON.stringify(prediction)}))`, deadline), Boolean, 10_000);
+          const checked = await evaluate<boolean>(cdp!, page!,
+            `document.querySelector(${JSON.stringify(prediction)}).getAttribute('aria-checked') === 'true'`, Date.now() + 5000);
+          if (checked !== request.prediction) await click(prediction);
           // Browser-to-App encoded fanout is the production H264 path. VP8
           // deliberately stays in the Browser and must not masquerade as App WAN.
           await click(app ? 'button[aria-label^="H264"]' : 'button[aria-label^="VP8"]');
@@ -84,7 +92,7 @@ export async function endpointWorker(): Promise<void> {
             deadline), Boolean, 10_000);
           await click('button[data-source-tab="browser"]');
           await click(".lr-source-option.is-browser");
-          await waitForSample(sample, value => value.sharing && value.width > 0, 30_000);
+          await waitForSample(sample, value => value.sharing && value.width > 0 && value.natPrediction === request.prediction, 30_000);
           result = await evaluate<string>(cdp!, page!, "document.querySelector('.lr-invite-url').value", Date.now() + 5000);
         } else if (request.action === "sample") {
           result = await sample();
diff --git a/scripts/network-lab/network.ts b/scripts/network-lab/network.ts
index e47442901..44edbd397 100644
--- a/scripts/network-lab/network.ts
+++ b/scripts/network-lab/network.ts
@@ -21,6 +21,7 @@ export class LabNetwork {
   readonly namespaces: string[] = [];
   private readonly pendingLinks = new Set<string>();
   private readonly shaped = new Set<string>();
+  private readonly udpAddresses = new Map<number, string>();
   private readonly originalRoutes = command("ip", ["-j", "route", "show", "table", "all"]);
   private readonly originalRoutes6 = command("ip", ["-6", "-j", "route", "show", "table", "all"]);
   private readonly originalRules = command("nft", ["-s", "list", "ruleset"]);
@@ -105,9 +106,25 @@ table inet lab_filter {
 
   endpoint(index: number): string { return `${this.prefix}-end${index}`; }
   router(index: number): string { return `${this.prefix}-nat${index}`; }
-  publicIP(index: number): string { return `198.51.100.${11 + index}`; }
+  publicIP(index: number): string { return this.udpAddresses.get(index) ?? `198.51.100.${11 + index}`; }
   ipv6(index: number): string { return `2001:db8:72:${index + 1}:0:0:0:2`; }
 
+  remapUDP(index: number): { before: string; after: string } {
+    const router = this.router(index), before = this.publicIP(index), after = `198.51.100.${51 + index}`;
+    if (this.udpAddresses.has(index)) throw new Error("UDP address has already changed");
+    this.exec(router, "ip", ["addr", "add", `${after}/24`, "dev", "wan0"]);
+    this.exec(router, "nft", [`
+flush chain ip lab_nat postrouting
+add rule ip lab_nat postrouting oifname "wan0" meta l4proto udp snat to ${after}
+add rule ip lab_nat postrouting oifname "wan0" snat to ${before}
+`]);
+    // Only this isolated router's UDP mappings change; the real TCP signaling
+    // connection retains its original address and connection tracking entry.
+    this.exec(router, "conntrack", ["-D", "-p", "udp"]);
+    this.udpAddresses.set(index, after);
+    return { before, after };
+  }
+
   setFault(index: number, fault: Fault, seed: number, direction: "uplink" | "downlink" = "uplink"): void {
     const router = this.router(index);
     this.exec(router, "nft", ["flush", "chain", "inet", "lab_filter", "faults"]);
diff --git a/scripts/network-lab/page.ts b/scripts/network-lab/page.ts
index 5b50b0511..4a7cf2c1e 100644
--- a/scripts/network-lab/page.ts
+++ b/scripts/network-lab/page.ts
@@ -3,7 +3,7 @@
 export const pageProbe = String.raw`(() => {
   localStorage.setItem('piik:ui-lang','en'); localStorage.setItem('piik:ui-mode','text');
   const peers=[], sockets=[], events=[], errors=[], controls=[];
-  let route=null,freezeCapture=()=>{};
+  let route=null,natPrediction=null,freezeCapture=()=>{};
   const PC=RTCPeerConnection, WS=WebSocket;
   const picture=document.createElement('canvas');picture.width=64;picture.height=36;
   const pictureContext=picture.getContext('2d',{willReadFrequently:true});
@@ -19,6 +19,7 @@ export const pageProbe = String.raw`(() => {
       for(const type of ['open','close','error'])this.addEventListener(type,()=>record(events,{at:performance.now(),type:'ws-'+type,scope}));
       this.addEventListener('message', event=>{
         let message; try{message=JSON.parse(event.data);}catch{return;}
+        if(typeof message.routePolicy?.natPrediction==='boolean')natPrediction=message.routePolicy.natPrediction;
         if(message.type==='route-update'&&message.phase==='active')route=message.assignment.upstream.kind;
         const value={at:performance.now(),type:message.type,state:message.state,reason:message.reason,scope,
           phase:message.phase,route:message.assignment?.upstream?.kind,connectionId:message.connectionId};
@@ -92,7 +93,7 @@ export const pageProbe = String.raw`(() => {
       pictureHash=hash>>>0;
     }
     return{at:performance.now(),width:video?.videoWidth||0,height:video?.videoHeight||0,
-      frames:video?.getVideoPlaybackQuality().totalVideoFrames||0,pictureHash,route,stats,events:[...events],errors:[...errors],controls:[...controls],
+      frames:video?.getVideoPlaybackQuality().totalVideoFrames||0,pictureHash,route,natPrediction,stats,events:[...events],errors:[...errors],controls:[...controls],
       sharing:!!document.querySelector('button[aria-label="Stop sharing"]'),
       controlOpen:sockets.some(s=>s.url.includes('/control')&&s.readyState===WS.OPEN),
       peerStates:peers.map(p=>p.connectionState),text:document.body.innerText.slice(-2000)};
@@ -106,6 +107,7 @@ export interface MediaSample {
   frames: number;
   pictureHash: number | null;
   route: string | null;
+  natPrediction: boolean | null;
   stats: Array<Record<string, string | number>>;
   events: Array<{ at: number; type: string; scope?: string; state?: string; reason?: string; phase?: string; route?: string;
     connectionId?: string; [key: string]: string | number | undefined }>;
diff --git a/scripts/network-lab/scenarios.ts b/scripts/network-lab/scenarios.ts
index e687c6007..f266fc86c 100644
--- a/scripts/network-lab/scenarios.ts
+++ b/scripts/network-lab/scenarios.ts
@@ -15,6 +15,40 @@ export interface Scenario {
   faultEndpoint?: 0 | 1;
   direction?: "uplink" | "downlink";
   sibling?: boolean;
+  remap?: boolean;
+}
+
+export interface TrialSummary {
+  scenario: Scenario;
+  seed: number;
+  prediction: boolean;
+  passed: boolean;
+  outcome?: "media" | "unavailable" | "timeout";
+  firstPictureMs?: number | null;
+  recoveryMs?: number | null;
+}
+
+export function summarizeTrials(trials: readonly TrialSummary[]) {
+  const groups = new Map<string, TrialSummary[]>();
+  for (const trial of trials) {
+    const key = JSON.stringify([trial.scenario.id, trial.prediction]);
+    const group = groups.get(key) ?? []; group.push(trial); groups.set(key, group);
+  }
+  const distribution = (values: number[]) => {
+    values.sort((a, b) => a - b);
+    return { count: values.length, min: values[0] ?? null, median: values[Math.ceil(values.length / 2) - 1] ?? null,
+      p95: values[Math.ceil(values.length * 0.95) - 1] ?? null, max: values.at(-1) ?? null };
+  };
+  return [...groups.values()].map(group => ({
+    scenario: group[0]!.scenario.id, prediction: group[0]!.prediction, trials: group.length,
+    checksPassed: group.filter(trial => trial.passed).length,
+    failures: group.filter(trial => !trial.passed).length,
+    media: group.filter(trial => trial.passed && trial.outcome === "media").length,
+    unavailable: group.filter(trial => trial.outcome === "unavailable").length,
+    timeouts: group.filter(trial => trial.outcome === "timeout").length,
+    firstPictureMs: distribution(group.flatMap(trial => trial.passed && typeof trial.firstPictureMs === "number" ? [trial.firstPictureMs] : [])),
+    recoveryMs: distribution(group.flatMap(trial => trial.passed && typeof trial.recoveryMs === "number" ? [trial.recoveryMs] : [])),
+  }));
 }
 
 const baseline = { nat: ["preserve", "preserve"], fault: "none", sfu: false, expected: "media" } as const;
@@ -37,6 +71,8 @@ export const scenarios: readonly Scenario[] = [
   { ...baseline, id: "ipv6-app", host: "app", viewer: "app", ipv6: true, fault: "peer-block" },
   { ...baseline, id: "healthy-sibling", host: "browser", viewer: "browser", sibling: true,
     fault: "rate", faultEndpoint: 1, direction: "downlink", duringShare: true },
+  { ...baseline, id: "remap-browser", host: "browser", viewer: "browser", fault: "udp-block", duringShare: true, remap: true },
+  { ...baseline, id: "remap-app", host: "app", viewer: "app", fault: "udp-block", duringShare: true, remap: true },
 ];
 
 export function selectScenarios(suite: string, names?: string): Scenario[] {
diff --git a/scripts/network-lab/udp.ts b/scripts/network-lab/udp.ts
index 50562993a..a91f9683c 100644
--- a/scripts/network-lab/udp.ts
+++ b/scripts/network-lab/udp.ts
@@ -18,6 +18,11 @@ export async function echoWorker(ipv6 = false): Promise<void> {
         remote.address.split(".").forEach((part, index) => reply[18 + index] = Number(part));
         reply.write(remote.address, 32, 64, "utf8");
         socket.send(reply, remote.port, remote.address, () => {});
+        // A separate filtering probe contacts only the first address/port. Send
+        // back from the other two without any preceding outbound permission.
+        if (data[24] === 1 && socket === sockets[0]) {
+          for (const alternate of sockets.slice(1, 3)) alternate.send(reply, remote.port, remote.address, () => {});
+        }
       });
       socket.bind(port, host); await once(socket, "listening");
     }
@@ -35,6 +40,24 @@ export interface ProbeResult {
   mappings: Array<{ destination: string; address: string; port: number }>;
 }
 
+export async function filteringProbe() {
+  const socket = createSocket("udp4"), received = new Set<string>();
+  socket.on("message", (data, remote) => {
+    if (data.length === 1200 && data.readUInt32BE(0) === 0x50494c42) received.add(`${remote.address}:${remote.port}`);
+  });
+  socket.bind(0, "0.0.0.0"); await once(socket, "listening");
+  try {
+    const packet = Buffer.alloc(1200); packet.writeUInt32BE(0x50494c42); packet[24] = 1;
+    for (let i = 0; i < 3; i++) {
+      await new Promise<void>((resolve, reject) => socket.send(packet, targets[0]!.port, targets[0]!.host, error => error ? reject(error) : resolve()));
+      await delay(100);
+    }
+    await delay(600);
+    const [sameEndpoint, changedPort, changedAddress] = targets.map(target => received.has(`${target.host}:${target.port}`));
+    return { sameEndpoint, changedPort, changedAddress };
+  } finally { socket.close(); }
+}
+
 /** Survey and peer rendezvous retain one socket, independently of ICE/Piik. */
 export async function preparePeerProbe() {
   const socket = createSocket("udp4"), result = { requests: 0, replies: 0, errors: [] as string[] };
diff --git a/tests/network-lab.test.ts b/tests/network-lab.test.ts
index 79ddcf1c8..e6ed2d167 100644
--- a/tests/network-lab.test.ts
+++ b/tests/network-lab.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { checkCalibration, checkContinuity, checkFaultHit, checkMapping, hasPicture, selectScenarios } from "../scripts/network-lab/scenarios";
+import { checkCalibration, checkContinuity, checkFaultHit, checkMapping, hasPicture, selectScenarios, summarizeTrials } from "../scripts/network-lab/scenarios";
 import { checkMediaFeedback, checkMediaPath, packetFlows, type PacketFlow } from "../scripts/network-lab/packets";
 import type { MediaSample } from "../scripts/network-lab/page";
 import type { ProbeResult } from "../scripts/network-lab/udp";
@@ -9,6 +9,18 @@ const baseline: ProbeResult = { sent: 12, received: 12, receivedBytes: 14400, du
     ({ destination, address: "198.51.100.11", port: 45678 })) };
 
 describe("network laboratory evidence", () => {
+  it("keeps failed trials in counts without treating missing latency as zero", () => {
+    const scenario = selectScenarios("smoke")[0]!;
+    const trial = { scenario, prediction: true, seed: 1, passed: true, outcome: "media" as const };
+    const summary = summarizeTrials([
+      { ...trial, firstPictureMs: 200 }, { ...trial, firstPictureMs: 400 },
+      { ...trial, passed: false, outcome: "timeout", firstPictureMs: null },
+      { ...trial, prediction: false, passed: false, outcome: "unavailable" },
+    ]);
+    expect(summary[0]).toMatchObject({ trials: 3, checksPassed: 2, failures: 1, timeouts: 1,
+      firstPictureMs: { count: 2, min: 200, median: 200, p95: 400, max: 400 }, recoveryMs: { count: 0, median: null } });
+    expect(summary[1]).toMatchObject({ trials: 1, checksPassed: 0, failures: 1, unavailable: 1, firstPictureMs: { count: 0, min: null } });
+  });
   it("rejects absent impairments rather than blessing an unaffected media path", () => {
     for (const fault of ["udp-block", "delay", "loss", "rate"] as const) {
       expect(() => checkCalibration(baseline, { ...baseline, durationMs: 20 }, fault)).toThrow();

From 0d79da7a2002cf66113de98dd20725690a425048 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 03:24:55 +0800
Subject: [PATCH 197/262] fix(media): bootstrap warm sources before transport
 feedback

---
 .github/workflows/repository-hygiene.yml      |   9 +-
 docs/research/network-lab.md                  |   7 +
 internal/media/forwarding/output.go           |  26 ++--
 internal/media/forwarding/output_test.go      |  13 ++
 internal/media/forwarding/transport.go        |   1 +
 internal/media/forwarding/warm_source_test.go | 137 ++++++++++++++++++
 scripts/network-lab.ts                        |  17 ++-
 scripts/network-lab/scenarios.ts              |   4 +-
 scripts/network-lab/stun/main.go              |  45 ++++++
 tests/network-lab.test.ts                     |   1 +
 10 files changed, 240 insertions(+), 20 deletions(-)
 create mode 100644 internal/media/forwarding/warm_source_test.go
 create mode 100644 scripts/network-lab/stun/main.go

diff --git a/.github/workflows/repository-hygiene.yml b/.github/workflows/repository-hygiene.yml
index 034cab81e..9fb39f220 100644
--- a/.github/workflows/repository-hygiene.yml
+++ b/.github/workflows/repository-hygiene.yml
@@ -130,6 +130,7 @@ jobs:
           mkdir -p build/network-lab/bin
           CGO_ENABLED=0 go build -trimpath -o build/network-lab/bin/piik-server ./cmd/piik-server
           CGO_ENABLED=0 go build -trimpath -o build/network-lab/bin/piik-app ./cmd/piik-app
+          CGO_ENABLED=0 go build -trimpath -o build/network-lab/bin/stun ./scripts/network-lab/stun
       # The runner's iproute2 6.1 lacks netem's seed parameter. Keep this tool
       # local to the opt-in lab; do not replace system networking utilities.
       - name: Check out laboratory traffic-control tool
@@ -146,6 +147,7 @@ jobs:
           make -C build/network-lab/iproute2 -j2 SUBDIRS='lib tc netem' TC_CONFIG_NO_XT=y
           echo "$GITHUB_WORKSPACE/build/network-lab/iproute2/tc" >> "$GITHUB_PATH"
       - name: Run isolated network laboratory
+        id: network_lab
         if: github.event_name == 'workflow_dispatch' && inputs.network_lab != 'none' && inputs.network_lab != ''
         timeout-minutes: 35
         env:
@@ -156,13 +158,14 @@ jobs:
           PIIK_NETWORK_LAB_PREDICTION: ${{ inputs.network_prediction }}
           PIIK_NETWORK_LAB_REPEAT: ${{ inputs.network_repeat }}
         run: |
-          if [ "$PIIK_NETWORK_LAB_SUITE" = verify ]; then
+          if [ "$PIIK_NETWORK_LAB_SUITE" = verify ] || [ "$PIIK_NETWORK_LAB_SUITE" = full ]; then
             sudo --preserve-env=PATH,CHROME_PATH,TC_LIB_DIR "$(command -v node)" --import tsx scripts/network-lab.ts --verify
-          else
+          fi
+          if [ "$PIIK_NETWORK_LAB_SUITE" != verify ]; then
             sudo --preserve-env=PATH,CHROME_PATH,TC_LIB_DIR "$(command -v node)" --import tsx scripts/network-lab.ts --suite "$PIIK_NETWORK_LAB_SUITE" --cases "$PIIK_NETWORK_LAB_CASES" --prediction "$PIIK_NETWORK_LAB_PREDICTION" --repeat "$PIIK_NETWORK_LAB_REPEAT"
           fi
       - name: Save network laboratory evidence
-        if: always() && github.event_name == 'workflow_dispatch' && inputs.network_lab != 'none' && inputs.network_lab != ''
+        if: always() && steps.network_lab.outcome != 'skipped' && github.event_name == 'workflow_dispatch' && inputs.network_lab != 'none' && inputs.network_lab != ''
         uses: actions/upload-artifact@v7
         with:
           name: network-lab-${{ github.sha }}
diff --git a/docs/research/network-lab.md b/docs/research/network-lab.md
index 7e838637d..2686a8b8f 100644
--- a/docs/research/network-lab.md
+++ b/docs/research/network-lab.md
@@ -93,6 +93,7 @@ npm run build:web
 mkdir -p build/network-lab/bin
 CGO_ENABLED=0 go build -trimpath -o build/network-lab/bin/piik-server ./cmd/piik-server
 CGO_ENABLED=0 go build -trimpath -o build/network-lab/bin/piik-app ./cmd/piik-app
+CGO_ENABLED=0 go build -trimpath -o build/network-lab/bin/stun ./scripts/network-lab/stun
 sudo --preserve-env=PATH,CHROME_PATH "$(command -v node)" --import tsx scripts/network-lab.ts --suite smoke
 ```
 
@@ -129,3 +130,9 @@ mapping, not every consumer NAT implementation. Address-change cases replace
 only the isolated router's UDP public address and conntrack entries while
 proving that TCP signaling stays usable; both old and new media windows retain
 their respective addresses for packet/feedback checks.
+IPv6 cases provide a Pion-based external STUN endpoint as well as IPv4 embedded
+STUN. Browser mDNS host names cannot resolve across these routed networks;
+keep normal Browser privacy behavior and obtain IPv6 reflexive candidates through
+STUN. The App may use its ordinary IPv6 host candidates. Continuity checks require
+changing decoded pictures and advancing audio energy; cadence and dimensions are
+measured separately, without imposing a new minimum on WebRTC adaptation.
diff --git a/internal/media/forwarding/output.go b/internal/media/forwarding/output.go
index 469afc7a4..dd440926a 100644
--- a/internal/media/forwarding/output.go
+++ b/internal/media/forwarding/output.go
@@ -19,15 +19,16 @@ import (
 // another scheduler. Do not attach a StreamAllocator to the same DownTrack.
 type Output struct {
 	*sfu.DownTrack
-	mu              sync.Mutex
-	writeMu         sync.Mutex
-	budget          int64
-	current         int32
-	allocation      sfu.VideoAllocation
-	hasAllocation   bool
-	closed          bool
-	onActivity      func()
-	onDemandChanged func()
+	mu               sync.Mutex
+	writeMu          sync.Mutex
+	budget           int64
+	current          int32
+	allocation       sfu.VideoAllocation
+	hasAllocation    bool
+	closed           bool
+	feedbackObserved func() bool
+	onActivity       func()
+	onDemandChanged  func()
 }
 
 // Snapshot is read by the parent at its input-frame boundary. Current means
@@ -78,10 +79,11 @@ func (output *Output) reconcileLocked() {
 			break
 		}
 	}
-	if !measured {
+	if !measured || (output.feedbackObserved != nil && !output.feedbackObserved()) {
 		if len(available) > 0 {
-			// A real layer can deliver before its bitrate window exists. The
-			// library bootstrap also establishes the target for PLI recovery.
+			// Source history is not this new connection's capacity. Bootstrap
+			// through the library until video can establish real feedback;
+			// pausing against the initial estimate would prevent that feedback.
 			output.allocation = output.AllocateOptimal(false, false)
 			output.hasAllocation = true
 		}
diff --git a/internal/media/forwarding/output_test.go b/internal/media/forwarding/output_test.go
index c5ecf799a..f4d897555 100644
--- a/internal/media/forwarding/output_test.go
+++ b/internal/media/forwarding/output_test.go
@@ -111,6 +111,19 @@ func TestOutputUsesLibraryAllocationAndExactLifetime(t *testing.T) {
 	if state := output.State(); !state.Paused || state.Target != -1 || state.Prepare != 0 || state.VideoBudget != 60_000 {
 		t.Fatalf("below-lowest budget cannot request codec adaptation: %+v", state)
 	}
+	// A new child's seed cannot veto a warm source's first video. Once feedback
+	// arrives, the same source must obey the real connection's allocation again.
+	observed := false
+	output.feedbackObserved = func() bool { return observed }
+	output.Reconcile()
+	if state := output.State(); state.Paused || state.Target < 0 {
+		t.Fatalf("warm source could not establish first feedback: %+v", state)
+	}
+	observed = true
+	output.Reconcile()
+	if state := output.State(); !state.Paused {
+		t.Fatalf("bootstrap bypassed observed raw-source limits: %+v", state)
+	}
 	receiver.controlled = true
 	output.Reconcile()
 	if state := output.State(); state.Paused || state.Target != 0 {
diff --git a/internal/media/forwarding/transport.go b/internal/media/forwarding/transport.go
index 2f872a9a6..edaa44909 100644
--- a/internal/media/forwarding/transport.go
+++ b/internal/media/forwarding/transport.go
@@ -153,6 +153,7 @@ func NewTransport(options TransportOptions) (_ *Transport, err error) {
 		return nil, err
 	}
 	transport.Output = NewOutput(track, int64(options.InitialBitrate))
+	transport.Output.feedbackObserved = transport.observed.Load
 	track.Receiver().(*outputReceiver).output = transport.Output
 	transport.Output.onActivity = transport.mediaActivity
 	transport.Output.onDemandChanged = options.OnDemandChanged
diff --git a/internal/media/forwarding/warm_source_test.go b/internal/media/forwarding/warm_source_test.go
new file mode 100644
index 000000000..9143eb2bf
--- /dev/null
+++ b/internal/media/forwarding/warm_source_test.go
@@ -0,0 +1,137 @@
+package forwarding
+
+import (
+	"context"
+	"net"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/TNTcraftHIM/Piik/internal/media/encoded"
+	"github.com/livekit/livekit-server/pkg/sfu"
+	"github.com/pion/interceptor"
+	"github.com/pion/webrtc/v4"
+)
+
+// A late child must establish real video/TWCC even when its initial estimate
+// is below the source's measured rate. Payloads exercise RTP, not decoding.
+func TestTransportBootstrapsWarmRawSource(t *testing.T) {
+	ctx, cancel := context.WithTimeout(t.Context(), 15*time.Second)
+	defer cancel()
+	check := func(err error) {
+		t.Helper()
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	wait := func(done <-chan struct{}) {
+		t.Helper()
+		select {
+		case <-done:
+		case <-ctx.Done():
+			t.Fatal(ctx.Err())
+		}
+	}
+	codec := webrtc.RTPCodecParameters{RTPCodecCapability: webrtc.RTPCodecCapability{
+		MimeType: webrtc.MimeTypeVP8, ClockRate: 90_000,
+		RTCPFeedback: []webrtc.RTCPFeedback{{Type: "nack"}, {Type: "nack", Parameter: "pli"}, {Type: webrtc.TypeRTCPFBTransportCC}},
+	}, PayloadType: 96}
+	source, err := NewEncodedSource(SourceOptions{ID: "warm", StreamID: "fixture", Codec: codec,
+		Formats: []LayerFormat{{Width: 8, Height: 8, Bitrate: 5_000_000}}})
+	check(err)
+	done, producerError := make(chan struct{}), make(chan error, 1)
+	go func() {
+		defer close(done)
+		ticker := time.NewTicker(time.Second / 30)
+		defer ticker.Stop()
+		data := make([]byte, 20_000)
+		copy(data, sfu.VP8KeyFrame8x8)
+		for frame := 0; ; frame++ {
+			select {
+			case <-ctx.Done():
+				return
+			case now := <-ticker.C:
+				pts := time.Duration(frame) * (time.Second / 30)
+				if err := source.BeginFrame(pts, now); err != nil {
+					producerError <- err
+					return
+				}
+				if err := source.WriteFrame(0, encoded.Frame{Data: data, PTS: pts, Duration: time.Second / 30}); err != nil {
+					producerError <- err
+					return
+				}
+			}
+		}
+	}()
+	defer func() { cancel(); <-done; source.Close() }()
+	for {
+		available, rates := source.GetLayeredBitrate()
+		if len(available) > 0 && rates[0][0] > 4_000_000 {
+			break
+		}
+		select {
+		case err := <-producerError:
+			t.Fatal(err)
+		case <-ctx.Done():
+			t.Fatal("source did not establish its measured bitrate")
+		case <-time.After(20 * time.Millisecond):
+		}
+	}
+	settings := webrtc.SettingEngine{}
+	settings.SetNetworkTypes([]webrtc.NetworkType{webrtc.NetworkTypeUDP4})
+	settings.SetIncludeLoopbackCandidate(true)
+	settings.SetIPFilter(func(ip net.IP) bool { return ip.IsLoopback() })
+	transport, err := NewTransport(TransportOptions{Source: source.Source, Settings: settings,
+		ConnectionID: "late-child", InitialBitrate: 3_000_000})
+	check(err)
+	defer transport.Close()
+	media := &webrtc.MediaEngine{}
+	check(media.RegisterDefaultCodecs())
+	registry := &interceptor.Registry{}
+	check(webrtc.RegisterDefaultInterceptors(media, registry))
+	receiver, err := webrtc.NewAPI(webrtc.WithMediaEngine(media), webrtc.WithInterceptorRegistry(registry),
+		webrtc.WithSettingEngine(settings)).NewPeerConnection(webrtc.Configuration{})
+	check(err)
+	defer receiver.Close()
+	var packets atomic.Uint32
+	receiver.OnTrack(func(track *webrtc.TrackRemote, _ *webrtc.RTPReceiver) {
+		for {
+			packet, _, err := track.ReadRTP()
+			if err != nil {
+				return
+			}
+			if len(packet.Payload) > 0 {
+				packets.Add(1)
+			}
+		}
+	})
+	offer, err := transport.PC.CreateOffer(nil)
+	check(err)
+	gathered := webrtc.GatheringCompletePromise(transport.PC)
+	check(transport.PC.SetLocalDescription(offer))
+	wait(gathered)
+	check(receiver.SetRemoteDescription(*transport.PC.LocalDescription()))
+	answer, err := receiver.CreateAnswer(nil)
+	check(err)
+	gathered = webrtc.GatheringCompletePromise(receiver)
+	check(receiver.SetLocalDescription(answer))
+	wait(gathered)
+	check(transport.PC.SetRemoteDescription(*receiver.LocalDescription()))
+	for transport.PC.ConnectionState() != webrtc.PeerConnectionStateConnected {
+		select {
+		case <-time.After(5 * time.Millisecond):
+		case <-ctx.Done():
+			t.Fatal(ctx.Err())
+		}
+	}
+	check(transport.SetConnected())
+	for packets.Load() == 0 || !transport.observed.Load() {
+		select {
+		case err := <-producerError:
+			t.Fatal(err)
+		case <-ctx.Done():
+			t.Fatalf("warm source could not establish video/feedback: packets=%d state=%+v", packets.Load(), transport.Output.State())
+		case <-time.After(10 * time.Millisecond):
+		}
+	}
+}
diff --git a/scripts/network-lab.ts b/scripts/network-lab.ts
index ab097042d..055c0cdb5 100644
--- a/scripts/network-lab.ts
+++ b/scripts/network-lab.ts
@@ -8,7 +8,7 @@ import { parseArgs } from "node:util";
 import { setTimeout as delay } from "node:timers/promises";
 import { cleanupRun, withDeadline } from "./browser-gate-harness";
 import { endpointWorker } from "./network-lab/endpoint";
-import { command, LabNetwork, SITE_IP, SITE_ORIGIN } from "./network-lab/network";
+import { command, LabNetwork, SITE_IP, SITE_IPV6, SITE_ORIGIN } from "./network-lab/network";
 import { checkCalibration, checkContinuity, checkFaultHit, checkMapping, hasPicture, selectScenarios, summarizeTrials, type Scenario, type TrialSummary } from "./network-lab/scenarios";
 import { echoWorker, type ProbeResult } from "./network-lab/udp";
 import type { MediaSample } from "./network-lab/page";
@@ -69,6 +69,7 @@ async function runCase(scenario: Scenario, seed: number, prediction: boolean, ou
   const network = new LabNetwork(), samples: Array<{ elapsedMs: number; host: MediaSample; viewer: MediaSample; sibling?: MediaSample }> = [];
   const started = performance.now(), endpoints: Endpoint[] = [];
   let server: ChildProcessWithoutNullStreams | null = null, echo: ChildProcessWithoutNullStreams | null = null;
+  let stun: ChildProcessWithoutNullStreams | null = null;
   let capture: ChildProcessWithoutNullStreams | null = null;
   let serverLog = "", captureLog = "";
   const mediaWindows: Array<{ name: string; startMs: number; endMs: number; addresses: string[] }> = [];
@@ -99,6 +100,13 @@ async function runCase(scenario: Scenario, seed: number, prediction: boolean, ou
     echo.stderr.on("data", data => process.stderr.write(data));
     echo.stdin.on("error", () => {});
     await withDeadline(() => once(echo!.stdout, "data"), Date.now() + 10_000);
+    if (scenario.ipv6) {
+      stun = spawn("ip", ["netns", "exec", network.wan, resolve("build/network-lab/bin/stun"), `[${SITE_IPV6}]:3478`],
+        { env: labEnvironment(), stdio: "pipe" });
+      stun.stderr.on("data", data => { serverLog = (serverLog + data).slice(-32_000); });
+      stun.stdin.on("error", () => {});
+      await withDeadline(() => once(stun!.stdout, "data"), Date.now() + 5000);
+    }
     for (let i = 0; i < (scenario.sibling ? 3 : 2); i++) endpoints.push(new Endpoint(network.endpoint(i),
       await mkdtemp(join(tmpdir(), "piik-client-media-")), signal));
     stage("calibration");
@@ -129,7 +137,7 @@ async function runCase(scenario: Scenario, seed: number, prediction: boolean, ou
     server = spawn("ip", ["netns", "exec", network.wan, resolve("build/network-lab/bin/piik-server")], {
       cwd: output, stdio: "pipe", env: { ...labEnvironment(), PIIK_ENV: "development", ROOM_DATABASE_PATH: ":memory:",
         LISTEN_HOST: SITE_IP, PORT: "9000", PUBLIC_BASE_URL: SITE_ORIGIN, ALLOWED_ORIGINS: SITE_ORIGIN,
-        STUN_URLS: `stun:${SITE_IP}:3478,stun:${SITE_IP}:3479,stun:${SITE_IP}:3480`, STUN_LISTEN_HOST: SITE_IP,
+        STUN_URLS: `stun:${SITE_IP}:3478,stun:${SITE_IP}:3479,stun:${SITE_IP}:3480${scenario.ipv6 ? `,stun:[${SITE_IPV6}]:3478` : ""}`, STUN_LISTEN_HOST: SITE_IP,
         NAT_PREDICTION_ENABLED: "true", ...(scenario.sfu ? { SFU_UDP_PORT: "7882", SFU_LISTEN_HOST: SITE_IP, SFU_PUBLIC_IP: SITE_IP } : {}) },
     });
     server.stdout.on("data", data => { serverLog = (serverLog + data).slice(-32_000); });
@@ -226,7 +234,7 @@ async function runCase(scenario: Scenario, seed: number, prediction: boolean, ou
           const previous = samples.at(-1)!.viewer;
           await delay(1000, undefined, { signal });
           const { viewer } = await sampleAll();
-          if (hasPicture(viewer) && viewer.frames - previous.frames >= 15) { recovered = true; break; }
+          if (hasPicture(viewer) && viewer.frames > previous.frames) { recovered = true; break; }
         }
         result.recoveryMs = recovered ? performance.now() - restoredAt : null;
         if (!recovered) throw new Error("Media did not resume within the recovery observation window");
@@ -252,8 +260,9 @@ async function runCase(scenario: Scenario, seed: number, prediction: boolean, ou
         endpoint.call("screenshot", { output: join(output, `failure-${index}.png`) }, 5000).catch(() => {})));
       result.endpointCleanup = await Promise.all(endpoints.map(endpoint => endpoint.call("close", {}, 30_000).catch(error => ({ error: String(error) }))));
       echo?.stdin.end();
+      stun?.stdin.end();
       if (capture && capture.exitCode !== null) { result.captureError = "Capture ended before observation completed"; result.passed = false; }
-      result.serviceCleanup = await Promise.all([echo, server, capture].map(child => cleanupRun({
+      result.serviceCleanup = await Promise.all([echo, stun, server, capture].map(child => cleanupRun({
         chrome: null, native: null, cdp: null, server: child, profile: null, ports: [],
       }).catch(error => ({ error: String(error) }))));
       result.cleanup = await network.close().catch(error => ({ error: String(error) }));
diff --git a/scripts/network-lab/scenarios.ts b/scripts/network-lab/scenarios.ts
index f266fc86c..0a3d5833e 100644
--- a/scripts/network-lab/scenarios.ts
+++ b/scripts/network-lab/scenarios.ts
@@ -99,7 +99,9 @@ export function checkFaultHit(fault: Fault, faultDrops: number): void {
 }
 
 export function checkContinuity(before: MediaSample, after: MediaSample): void {
-  if (after.frames - before.frames < 30) throw new Error("Decoded video did not continue");
+  // Liveness is separate from quality: WebRTC may legitimately reduce cadence
+  // under jitter/loss. Preserve the measured cadence rather than imposing a floor.
+  if (after.frames <= before.frames) throw new Error("Decoded video did not continue");
   if (before.pictureHash === null || after.pictureHash === null || before.pictureHash === after.pictureHash) {
     throw new Error("Rendered synthetic picture did not change");
   }
diff --git a/scripts/network-lab/stun/main.go b/scripts/network-lab/stun/main.go
new file mode 100644
index 000000000..1035a03e2
--- /dev/null
+++ b/scripts/network-lab/stun/main.go
@@ -0,0 +1,45 @@
+// This laboratory-only external STUN endpoint uses the same mature Binding
+// implementation as Piik. It supplies IPv6 discovery without changing product
+// configuration or disabling the browser's mDNS privacy behavior.
+package main
+
+import (
+	"fmt"
+	"io"
+	"net"
+	"os"
+
+	"github.com/pion/logging"
+	"github.com/pion/turn/v5"
+)
+
+func main() {
+	if err := run(); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+func run() error {
+	if len(os.Args) != 2 {
+		return fmt.Errorf("expected one IPv6 listen address")
+	}
+	connection, err := net.ListenPacket("udp6", os.Args[1])
+	if err != nil {
+		return err
+	}
+	defer connection.Close()
+	logger := logging.NewDefaultLoggerFactory()
+	logger.Writer = io.Discard
+	server, err := turn.NewServer(turn.ServerConfig{
+		PacketConnConfigs: []turn.PacketConnConfig{{PacketConn: connection}},
+		LoggerFactory:     logger,
+	})
+	if err != nil {
+		return err
+	}
+	defer server.Close()
+	fmt.Println(`{"ready":true}`)
+	_, err = io.Copy(io.Discard, os.Stdin)
+	return err
+}
diff --git a/tests/network-lab.test.ts b/tests/network-lab.test.ts
index e6ed2d167..8dd21497a 100644
--- a/tests/network-lab.test.ts
+++ b/tests/network-lab.test.ts
@@ -72,6 +72,7 @@ describe("network laboratory evidence", () => {
     expect(() => checkContinuity(before, { ...before, frames: 100 })).toThrow();
     const after = { ...before, frames: 100, pictureHash: 200, stats: [{ ...before.stats[0]!, totalAudioEnergy: 2, totalSamplesDuration: 5 }] };
     expect(() => checkContinuity(before, after)).not.toThrow();
+    expect(() => checkContinuity(before, { ...after, frames: 51 })).not.toThrow();
     expect(() => checkContinuity(before, { ...after, stats: [{ ...after.stats[0]!, peerId: 1 }] })).toThrow();
     expect(() => checkContinuity(before, { ...after, frames: 50 })).toThrow();
     expect(() => checkContinuity(before, { ...after, pictureHash: 100 })).toThrow();

From b0f60ef4b9af8f1a0781b78681da270a9782f697 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 03:31:29 +0800
Subject: [PATCH 198/262] test(network): bind recovery evidence to current
 media paths

---
 docs/research/network-lab.md     |  6 ++++++
 scripts/network-lab.ts           | 21 ++++++++++-----------
 scripts/network-lab/network.ts   |  3 +++
 scripts/network-lab/page.ts      |  5 ++++-
 scripts/network-lab/scenarios.ts | 19 +++++++++++++++++++
 scripts/network-lab/udp.ts       |  5 ++++-
 tests/network-lab.test.ts        | 23 +++++++++++++++++++++--
 7 files changed, 67 insertions(+), 15 deletions(-)

diff --git a/docs/research/network-lab.md b/docs/research/network-lab.md
index 2686a8b8f..ad2686dbb 100644
--- a/docs/research/network-lab.md
+++ b/docs/research/network-lab.md
@@ -136,3 +136,9 @@ keep normal Browser privacy behavior and obtain IPv6 reflexive candidates throug
 STUN. The App may use its ordinary IPv6 host candidates. Continuity checks require
 changing decoded pictures and advancing audio energy; cadence and dimensions are
 measured separately, without imposing a new minimum on WebRTC adaptation.
+App checks require current Native connection state and a local Browser bridge in
+both initial and recovered media windows; a Browser WAN fallback cannot validate
+Native recovery. Rate calibration requires offered traffic above the configured
+ceiling, so a slow test process cannot impersonate a constrained network.
+Recovery timing begins when the impairment is removed, including subsequent
+calibration and sampling time.
diff --git a/scripts/network-lab.ts b/scripts/network-lab.ts
index 055c0cdb5..43ccb4e20 100644
--- a/scripts/network-lab.ts
+++ b/scripts/network-lab.ts
@@ -9,7 +9,7 @@ import { setTimeout as delay } from "node:timers/promises";
 import { cleanupRun, withDeadline } from "./browser-gate-harness";
 import { endpointWorker } from "./network-lab/endpoint";
 import { command, LabNetwork, SITE_IP, SITE_IPV6, SITE_ORIGIN } from "./network-lab/network";
-import { checkCalibration, checkContinuity, checkFaultHit, checkMapping, hasPicture, selectScenarios, summarizeTrials, type Scenario, type TrialSummary } from "./network-lab/scenarios";
+import { checkAppPath, checkCalibration, checkContinuity, checkFaultHit, checkMapping, hasPicture, selectScenarios, summarizeTrials, type Scenario, type TrialSummary } from "./network-lab/scenarios";
 import { echoWorker, type ProbeResult } from "./network-lab/udp";
 import type { MediaSample } from "./network-lab/page";
 import { checkMediaFeedback, checkMediaPath, readPacketFlows, type PacketFlow } from "./network-lab/packets";
@@ -87,6 +87,11 @@ async function runCase(scenario: Scenario, seed: number, prediction: boolean, ou
     samples.push(sample); return sample;
   };
   const addresses = () => endpoints.map((_, index) => scenario.ipv6 ? network.ipv6(index) : network.publicIP(index));
+  const checkAppPaths = () => {
+    const current = samples.at(-1)!;
+    if (scenario.host === "app") checkAppPath(current.host, "prepare-edge", network.localAddresses(0));
+    if (scenario.viewer === "app") checkAppPath(current.viewer, "receive-offer", network.localAddresses(1));
+  };
   const proveMedia = (flows: PacketFlow[], peers = addresses()) => {
     if (scenario.sfu) { checkMediaFeedback(flows, peers[0]!, SITE_IP); checkMediaFeedback(flows, SITE_IP, peers[1]!); }
     else checkMediaPath(flows, peers[0]!, peers[1]!, scenario.sibling ? [peers[2]!] : []);
@@ -179,6 +184,7 @@ async function runCase(scenario: Scenario, seed: number, prediction: boolean, ou
       await delay(3000, undefined, { signal });
       const { viewer: next, sibling: healthy } = await sampleAll();
       checkContinuity(first, next);
+      checkAppPaths();
       mediaWindows.push({ name: "baseline", startMs: steadyStart, endMs: Date.now(), addresses: addresses() });
       if (values.negative === "frozen-picture") {
         stage("negative-control");
@@ -191,8 +197,6 @@ async function runCase(scenario: Scenario, seed: number, prediction: boolean, ou
         throw new Error("Frozen synthetic picture incorrectly passed");
       }
       if (scenario.sfu && next.route !== "sfu") throw new Error("Expected SFU route, but media used another path");
-      if (scenario.host === "app") checkAppPath(samples.at(-1)!.host, "prepare-edge");
-      if (scenario.viewer === "app") checkAppPath(next, "receive-offer");
       if (scenario.duringShare) {
         stage("impairment");
         setFault(scenario.fault);
@@ -221,6 +225,7 @@ async function runCase(scenario: Scenario, seed: number, prediction: boolean, ou
           result.addressChange = network.remapUDP(faultIndex);
           if (!await endpoints[0]!.call("signal-probe")) throw new Error("UDP address change interrupted TCP signaling");
         }
+        const restoredAt = performance.now();
         setFault("none");
         result.restoredCounters = counters();
         const restoredProbe = await endpoints[faultIndex]!.call<ProbeResult>("probe");
@@ -228,7 +233,7 @@ async function runCase(scenario: Scenario, seed: number, prediction: boolean, ou
         checkCalibration(before, restoredProbe, "none");
         if (scenario.remap && restoredProbe.mappings.some(mapping => mapping.address !== network.publicIP(faultIndex))) throw new Error("UDP mappings retained the old public address");
         stage("recovery");
-        const restoredAt = performance.now(); let recovered = false;
+        let recovered = false;
         while (performance.now() - restoredAt < 60_000) {
           signal.throwIfAborted();
           const previous = samples.at(-1)!.viewer;
@@ -242,6 +247,7 @@ async function runCase(scenario: Scenario, seed: number, prediction: boolean, ou
         await delay(3000, undefined, { signal });
         const { viewer: recoveredNext } = await sampleAll();
         checkContinuity(recoveredFirst, recoveredNext);
+        checkAppPaths();
         mediaWindows.push({ name: "recovered", startMs: recoveredStart, endMs: Date.now(), addresses: addresses() });
         if (scenario.fault === "signaling" && !await endpoints[0]!.call("signal-probe")) throw new Error("Signaling roundtrip did not recover");
       }
@@ -303,13 +309,6 @@ async function runCase(scenario: Scenario, seed: number, prediction: boolean, ou
   return result;
 }
 
-function checkAppPath(sample: MediaSample, action: "prepare-edge" | "receive-offer"): void {
-  const connected = sample.controls.some(control => control.type === action && control.connectionId &&
-    sample.events.some(event => event.scope === "app" && event.type === "edge-state" &&
-      event.connectionId === control.connectionId && event.state === "connected"));
-  if (!sample.controlOpen || !connected) throw new Error(`Missing successful App ${action} path`);
-}
-
 async function main(): Promise<void> {
   const selected = selectScenarios(values.suite!, values.cases);
   if (values.list) { process.stdout.write(JSON.stringify(selected, null, 2) + "\n"); return; }
diff --git a/scripts/network-lab/network.ts b/scripts/network-lab/network.ts
index 44edbd397..0f5dcb53b 100644
--- a/scripts/network-lab/network.ts
+++ b/scripts/network-lab/network.ts
@@ -108,6 +108,9 @@ table inet lab_filter {
   router(index: number): string { return `${this.prefix}-nat${index}`; }
   publicIP(index: number): string { return this.udpAddresses.get(index) ?? `198.51.100.${11 + index}`; }
   ipv6(index: number): string { return `2001:db8:72:${index + 1}:0:0:0:2`; }
+  localAddresses(index: number): string[] {
+    return [`10.71.${index + 1}.2`, new URL(`http://[${this.ipv6(index)}]`).hostname.slice(1, -1)];
+  }
 
   remapUDP(index: number): { before: string; after: string } {
     const router = this.router(index), before = this.publicIP(index), after = `198.51.100.${51 + index}`;
diff --git a/scripts/network-lab/page.ts b/scripts/network-lab/page.ts
index 4a7cf2c1e..38b3d5b94 100644
--- a/scripts/network-lab/page.ts
+++ b/scripts/network-lab/page.ts
@@ -86,6 +86,8 @@ export const pageProbe = String.raw`(() => {
       }
     }
     const video=document.querySelector('video');
+    const playbackTrack=video?.srcObject?.getVideoTracks?.()[0];
+    const playbackPeerId=playbackTrack?peers.findIndex(peer=>peer.getReceivers().some(receiver=>receiver.track===playbackTrack)):-1;
     let pictureHash=null;
     if(video?.videoWidth&&video.readyState>=2){
       pictureContext.drawImage(video,0,0,64,36);let hash=2166136261;
@@ -93,7 +95,7 @@ export const pageProbe = String.raw`(() => {
       pictureHash=hash>>>0;
     }
     return{at:performance.now(),width:video?.videoWidth||0,height:video?.videoHeight||0,
-      frames:video?.getVideoPlaybackQuality().totalVideoFrames||0,pictureHash,route,natPrediction,stats,events:[...events],errors:[...errors],controls:[...controls],
+      frames:video?.getVideoPlaybackQuality().totalVideoFrames||0,pictureHash,playbackPeerId,route,natPrediction,stats,events:[...events],errors:[...errors],controls:[...controls],
       sharing:!!document.querySelector('button[aria-label="Stop sharing"]'),
       controlOpen:sockets.some(s=>s.url.includes('/control')&&s.readyState===WS.OPEN),
       peerStates:peers.map(p=>p.connectionState),text:document.body.innerText.slice(-2000)};
@@ -106,6 +108,7 @@ export interface MediaSample {
   height: number;
   frames: number;
   pictureHash: number | null;
+  playbackPeerId: number;
   route: string | null;
   natPrediction: boolean | null;
   stats: Array<Record<string, string | number>>;
diff --git a/scripts/network-lab/scenarios.ts b/scripts/network-lab/scenarios.ts
index 0a3d5833e..837a8b956 100644
--- a/scripts/network-lab/scenarios.ts
+++ b/scripts/network-lab/scenarios.ts
@@ -92,6 +92,22 @@ export function hasPicture(sample: MediaSample): boolean {
     sample.stats.some(row => row.type === "inbound-rtp" && row.kind === "video" && Number(row.framesDecoded) >= 15);
 }
 
+export function checkAppPath(sample: MediaSample, action: "prepare-edge" | "receive-offer", localAddresses: readonly string[]): void {
+  const connected = sample.controls.some((control, index) => control.type === action && control.connectionId &&
+    !sample.controls.slice(index + 1).some(later => later.connectionId === control.connectionId &&
+      ["close-edge", "close-receiver"].includes(later.type)) &&
+    sample.events.findLast(event => event.scope === "app" && event.type === "edge-state" &&
+      event.connectionId === control.connectionId)?.state === "connected");
+  const local = (row: MediaSample["stats"][number]) => localAddresses.includes(String(row.remoteAddress)) ||
+    ["127.0.0.1", "::1", "0:0:0:0:0:0:0:1"].includes(String(row.remoteAddress));
+  const pairs = sample.stats.filter(row => row.type === "selected-pair");
+  const browserWAN = pairs.some(row => !local(row));
+  const playbackBridge = action !== "receive-offer" || pairs.some(row => row.peerId === sample.playbackPeerId && local(row));
+  if (!sample.controlOpen || !connected || browserWAN || !playbackBridge) {
+    throw new Error(`Missing current App ${action} path; Browser fallback cannot validate Native media`);
+  }
+}
+
 export function checkFaultHit(fault: Fault, faultDrops: number): void {
   if (["peer-block", "udp-block", "stun-primary", "signaling"].includes(fault) && faultDrops < 1) {
     throw new Error(`No packets hit the ${fault} rule; outcome cannot validate this fault`);
@@ -128,6 +144,9 @@ export function checkCalibration(before: ProbeResult, after: ProbeResult, fault:
   } else if (fault === "loss") {
     if (after.received === 0 || after.received >= after.sent) throw new Error("Configured loss was not observed");
   } else if (fault === "rate") {
+    if (!(after.sendDurationMs > 0) || after.sent * 1200 * 8000 / after.sendDurationMs < 1_800_000) {
+      throw new Error("Calibration sender did not exceed the configured rate ceiling");
+    }
     if (after.receivedBytes === 0 || after.receivedBytes * 8000 / after.durationMs > 900_000) {
       throw new Error("Configured rate ceiling was not observed");
     }
diff --git a/scripts/network-lab/udp.ts b/scripts/network-lab/udp.ts
index a91f9683c..450ffbf2e 100644
--- a/scripts/network-lab/udp.ts
+++ b/scripts/network-lab/udp.ts
@@ -36,6 +36,7 @@ export interface ProbeResult {
   received: number;
   receivedBytes: number;
   durationMs: number;
+  sendDurationMs: number;
   rttMs: number[];
   mappings: Array<{ destination: string; address: string; port: number }>;
 }
@@ -96,7 +97,7 @@ export async function preparePeerProbe() {
 export async function udpProbe(load: boolean, ipv6 = false): Promise<ProbeResult> {
   const socket = createSocket(ipv6 ? "udp6" : "udp4"), start = performance.now();
   const destinations = ipv6 ? [{ host: SITE_IPV6, port: 41001 }] : targets;
-  const result: ProbeResult = { sent: 0, received: 0, receivedBytes: 0, durationMs: 0, rttMs: [], mappings: [] };
+  const result: ProbeResult = { sent: 0, received: 0, receivedBytes: 0, durationMs: 0, sendDurationMs: 0, rttMs: [], mappings: [] };
   const seen = new Set<number>();
   socket.on("message", (data, remote) => {
     if (data.length !== 1200 || data.readUInt32BE(0) !== 0x50494c42) return;
@@ -112,6 +113,7 @@ export async function udpProbe(load: boolean, ipv6 = false): Promise<ProbeResult
   socket.bind(0, ipv6 ? "::" : "0.0.0.0"); await once(socket, "listening");
   try {
     const count = load ? 1000 : 12;
+    const sendingAt = performance.now();
     for (let i = 0; i < count; i++) {
       const target = destinations[load ? 0 : i % destinations.length]!;
       const packet = Buffer.alloc(1200); packet.writeUInt32BE(0x50494c42, 0);
@@ -119,6 +121,7 @@ export async function udpProbe(load: boolean, ipv6 = false): Promise<ProbeResult
       await new Promise<void>((resolve, reject) => socket.send(packet, target.port, target.host, error => error ? reject(error) : resolve()));
       await delay(load ? 1 : 20);
     }
+    result.sendDurationMs = performance.now() - sendingAt;
     await delay(load ? 1000 : 600);
     result.durationMs = performance.now() - start;
     return result;
diff --git a/tests/network-lab.test.ts b/tests/network-lab.test.ts
index 8dd21497a..0c7c4ce47 100644
--- a/tests/network-lab.test.ts
+++ b/tests/network-lab.test.ts
@@ -1,10 +1,10 @@
 import { describe, expect, it } from "vitest";
-import { checkCalibration, checkContinuity, checkFaultHit, checkMapping, hasPicture, selectScenarios, summarizeTrials } from "../scripts/network-lab/scenarios";
+import { checkAppPath, checkCalibration, checkContinuity, checkFaultHit, checkMapping, hasPicture, selectScenarios, summarizeTrials } from "../scripts/network-lab/scenarios";
 import { checkMediaFeedback, checkMediaPath, packetFlows, type PacketFlow } from "../scripts/network-lab/packets";
 import type { MediaSample } from "../scripts/network-lab/page";
 import type { ProbeResult } from "../scripts/network-lab/udp";
 
-const baseline: ProbeResult = { sent: 12, received: 12, receivedBytes: 14400, durationMs: 850,
+const baseline: ProbeResult = { sent: 12, received: 12, receivedBytes: 14400, durationMs: 850, sendDurationMs: 250,
   rttMs: [1, 2, 1], mappings: ["198.51.100.1:41001", "198.51.100.1:41002", "198.51.100.2:41001"].map(destination =>
     ({ destination, address: "198.51.100.11", port: 45678 })) };
 
@@ -35,6 +35,25 @@ describe("network laboratory evidence", () => {
     expect(() => checkCalibration({ ...baseline, mappings: baseline.mappings.map(value => ({ ...value, address: "10.71.1.2" })) }, baseline, "none")).toThrow();
   });
 
+  it("does not mistake a slow calibration sender for network shaping", () => {
+    const slow = { ...baseline, sent: 1000, received: 1000, receivedBytes: 1_200_000, sendDurationMs: 10_000, durationMs: 11_000 };
+    expect(() => checkCalibration(baseline, slow, "rate")).toThrow("sender");
+    expect(() => checkCalibration(baseline, { ...slow, received: 120, receivedBytes: 144_000, sendDurationMs: 1000, durationMs: 2000 }, "rate")).not.toThrow();
+  });
+
+  it("requires a current Native receiver and the actual playback bridge", () => {
+    const sample = { controlOpen: true, playbackPeerId: 0,
+      controls: [{ type: "receive-offer", connectionId: "current" }],
+      events: [{ scope: "app", type: "edge-state", connectionId: "current", state: "connected" }],
+      stats: [{ type: "selected-pair", peerId: 0, remoteAddress: "127.0.0.1" }],
+    } as unknown as MediaSample;
+    expect(() => checkAppPath(sample, "receive-offer", ["10.71.2.2"])).not.toThrow();
+    expect(() => checkAppPath({ ...sample, events: [...sample.events, { ...sample.events[0]!, state: "failed" }] }, "receive-offer", ["10.71.2.2"])).toThrow();
+    expect(() => checkAppPath({ ...sample, controls: [...sample.controls, { type: "close-receiver", connectionId: "current" }] }, "receive-offer", ["10.71.2.2"])).toThrow();
+    expect(() => checkAppPath({ ...sample, playbackPeerId: 1 }, "receive-offer", ["10.71.2.2"])).toThrow();
+    expect(() => checkAppPath({ ...sample, stats: [{ ...sample.stats[0]!, remoteAddress: "198.51.100.11" }] }, "receive-offer", ["10.71.2.2"])).toThrow();
+  });
+
   it("checks mapping observations rather than trusting a NAT configuration name", () => {
     expect(() => checkMapping(baseline, "preserve")).not.toThrow();
     expect(() => checkMapping(baseline, "random")).toThrow();

From c24ed5b7870c3a0715064732b166a58fd54307f0 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 03:37:25 +0800
Subject: [PATCH 199/262] test(media): distinguish startup evidence from
 observed allocation

---
 internal/app/mediaedge/quality_test.go | 3 +++
 scripts/network-lab/scenarios.ts       | 5 +++--
 tests/network-lab.test.ts              | 9 +++++----
 3 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/internal/app/mediaedge/quality_test.go b/internal/app/mediaedge/quality_test.go
index 3a62e7e71..2a64192e7 100644
--- a/internal/app/mediaedge/quality_test.go
+++ b/internal/app/mediaedge/quality_test.go
@@ -7,6 +7,7 @@ import (
 	"github.com/TNTcraftHIM/Piik/internal/media/encoded"
 	"github.com/TNTcraftHIM/Piik/internal/media/forwarding"
 	"github.com/livekit/livekit-server/pkg/sfu"
+	"github.com/pion/rtcp"
 )
 
 type qualityAllocationReceiver struct{ sfu.TrackReceiver }
@@ -103,6 +104,8 @@ func TestQualitySampleUsesEstimatorCapacityAgainstEncodedPayload(t *testing.T) {
 
 	// Real library allocation remains deficient after selecting a layer that
 	// fits the link; steady low delivery must not cancel quality convergence.
+	// This fixture supplies observed capacity, beyond first-feedback bootstrap.
+	edge.transport.OnTransportCCFeedback(nil, &rtcp.TransportLayerCC{})
 	output := edge.transport.Output
 	output.SetReceiver(qualityAllocationReceiver{TrackReceiver: output.Receiver()})
 	output.UpTrackMaxPublishedLayerChange(1)
diff --git a/scripts/network-lab/scenarios.ts b/scripts/network-lab/scenarios.ts
index 837a8b956..a0faaa2cd 100644
--- a/scripts/network-lab/scenarios.ts
+++ b/scripts/network-lab/scenarios.ts
@@ -89,7 +89,8 @@ export function selectScenarios(suite: string, names?: string): Scenario[] {
 
 export function hasPicture(sample: MediaSample): boolean {
   return sample.width > 0 && sample.height > 0 && sample.frames >= 15 &&
-    sample.stats.some(row => row.type === "inbound-rtp" && row.kind === "video" && Number(row.framesDecoded) >= 15);
+    sample.stats.some(row => row.type === "inbound-rtp" && row.kind === "video" &&
+      row.peerId === sample.playbackPeerId && Number(row.framesDecoded) >= 15);
 }
 
 export function checkAppPath(sample: MediaSample, action: "prepare-edge" | "receive-offer", localAddresses: readonly string[]): void {
@@ -122,7 +123,7 @@ export function checkContinuity(before: MediaSample, after: MediaSample): void {
     throw new Error("Rendered synthetic picture did not change");
   }
   const audible = after.stats.some(row => {
-    if (row.type !== "inbound-rtp" || row.kind !== "audio") return false;
+    if (row.type !== "inbound-rtp" || row.kind !== "audio" || row.peerId !== after.playbackPeerId) return false;
     const previous = before.stats.find(other => other.id === row.id && other.peerId === row.peerId);
     return previous && Number(row.totalAudioEnergy) > Number(previous.totalAudioEnergy) &&
       Number(row.totalSamplesDuration) > Number(previous.totalSamplesDuration);
diff --git a/tests/network-lab.test.ts b/tests/network-lab.test.ts
index 0c7c4ce47..bb6a5c324 100644
--- a/tests/network-lab.test.ts
+++ b/tests/network-lab.test.ts
@@ -63,10 +63,11 @@ describe("network laboratory evidence", () => {
   });
 
   it("does not confuse a connected transport or stale video dimensions with decoded media", () => {
-    const sample = { width: 1280, height: 720, frames: 30, stats: [] } as unknown as MediaSample;
+    const sample = { width: 1280, height: 720, frames: 30, playbackPeerId: 0, stats: [] } as unknown as MediaSample;
     expect(hasPicture(sample)).toBe(false);
-    expect(hasPicture({ ...sample, stats: [{ type: "inbound-rtp", kind: "video", framesDecoded: 30 }] })).toBe(true);
-    expect(hasPicture({ ...sample, stats: [{ type: "inbound-rtp", kind: "audio", framesDecoded: 30 }] })).toBe(false);
+    expect(hasPicture({ ...sample, stats: [{ type: "inbound-rtp", kind: "video", peerId: 0, framesDecoded: 30 }] })).toBe(true);
+    expect(hasPicture({ ...sample, stats: [{ type: "inbound-rtp", kind: "audio", peerId: 0, framesDecoded: 30 }] })).toBe(false);
+    expect(hasPicture({ ...sample, stats: [{ type: "inbound-rtp", kind: "video", peerId: 1, framesDecoded: 30 }] })).toBe(false);
   });
 
   it("rejects misspelled or duplicated scenarios and lists every transport pairing", () => {
@@ -86,7 +87,7 @@ describe("network laboratory evidence", () => {
   });
 
   it("rejects frozen/silent media and counter resets on replacement peers", () => {
-    const before = { frames: 50, pictureHash: 100, stats: [{ id: "audio", peerId: 0, type: "inbound-rtp", kind: "audio",
+    const before = { frames: 50, pictureHash: 100, playbackPeerId: 0, stats: [{ id: "audio", peerId: 0, type: "inbound-rtp", kind: "audio",
       totalAudioEnergy: 1, totalSamplesDuration: 2 }] } as unknown as MediaSample;
     expect(() => checkContinuity(before, { ...before, frames: 100 })).toThrow();
     const after = { ...before, frames: 100, pictureHash: 200, stats: [{ ...before.stats[0]!, totalAudioEnergy: 2, totalSamplesDuration: 5 }] };

From 91776101f85fb3822e5409d0dda9d2122869f951 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 03:56:32 +0800
Subject: [PATCH 200/262] test(network): calibrate IPv4 blocking before IPv6
 trials

---
 docs/research/network-lab.md     | 4 +++-
 scripts/network-lab/network.ts   | 3 ++-
 scripts/network-lab/scenarios.ts | 8 ++++----
 tests/network-lab.test.ts        | 5 +++--
 4 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/docs/research/network-lab.md b/docs/research/network-lab.md
index ad2686dbb..61b0817e1 100644
--- a/docs/research/network-lab.md
+++ b/docs/research/network-lab.md
@@ -133,7 +133,9 @@ their respective addresses for packet/feedback checks.
 IPv6 cases provide a Pion-based external STUN endpoint as well as IPv4 embedded
 STUN. Browser mDNS host names cannot resolve across these routed networks;
 keep normal Browser privacy behavior and obtain IPv6 reflexive candidates through
-STUN. The App may use its ordinary IPv6 host candidates. Continuity checks require
+STUN. The App may use its ordinary IPv6 host candidates. IPv6 cases block IPv4
+UDP and independently verify that block; they do not require a Browser to try a
+blocked IPv4 candidate before selecting working IPv6. Continuity checks require
 changing decoded pictures and advancing audio energy; cadence and dimensions are
 measured separately, without imposing a new minimum on WebRTC adaptation.
 App checks require current Native connection state and a local Browser bridge in
diff --git a/scripts/network-lab/network.ts b/scripts/network-lab/network.ts
index 0f5dcb53b..d4095454c 100644
--- a/scripts/network-lab/network.ts
+++ b/scripts/network-lab/network.ts
@@ -7,7 +7,7 @@ export const SITE_IP = "198.51.100.1";
 export const SITE_IPV6 = "2001:db8:71::1";
 export const SITE_ORIGIN = `http://${SITE_IP}:9000`;
 export type NatMode = "preserve" | "random";
-export type Fault = "none" | "peer-block" | "udp-block" | "stun-primary" | "delay" | "loss" | "rate" | "signaling";
+export type Fault = "none" | "peer-block" | "udp-block" | "ipv4-block" | "stun-primary" | "delay" | "loss" | "rate" | "signaling";
 
 export function command(program: string, args: string[], input?: string): string {
   return execFileSync(program, args, { encoding: "utf8", timeout: 10_000,
@@ -134,6 +134,7 @@ add rule ip lab_nat postrouting oifname "wan0" snat to ${before}
     const rules: Partial<Record<Fault, string>> = {
       "peer-block": "ip daddr 198.51.100.11-198.51.100.30 udp dport 1-65535 counter drop",
       "udp-block": "meta l4proto udp counter drop",
+      "ipv4-block": "meta nfproto ipv4 meta l4proto udp counter drop",
       "stun-primary": `ip daddr ${SITE_IP} udp dport 3478 counter drop`,
       signaling: `ip daddr ${SITE_IP} tcp dport 9000 counter drop`,
     };
diff --git a/scripts/network-lab/scenarios.ts b/scripts/network-lab/scenarios.ts
index a0faaa2cd..71f3f4ce6 100644
--- a/scripts/network-lab/scenarios.ts
+++ b/scripts/network-lab/scenarios.ts
@@ -67,8 +67,8 @@ export const scenarios: readonly Scenario[] = [
   { ...baseline, id: "signaling-outage", host: "browser", viewer: "browser", fault: "signaling", duringShare: true },
   { ...baseline, id: "random-nat", host: "app", viewer: "app", nat: ["random", "random"], expected: "observed" },
   { ...baseline, id: "asymmetric-nat", host: "browser", viewer: "app", nat: ["random", "preserve"], expected: "observed" },
-  { ...baseline, id: "ipv6-browser", host: "browser", viewer: "browser", ipv6: true, fault: "peer-block" },
-  { ...baseline, id: "ipv6-app", host: "app", viewer: "app", ipv6: true, fault: "peer-block" },
+  { ...baseline, id: "ipv6-browser", host: "browser", viewer: "browser", ipv6: true, fault: "ipv4-block" },
+  { ...baseline, id: "ipv6-app", host: "app", viewer: "app", ipv6: true, fault: "ipv4-block" },
   { ...baseline, id: "healthy-sibling", host: "browser", viewer: "browser", sibling: true,
     fault: "rate", faultEndpoint: 1, direction: "downlink", duringShare: true },
   { ...baseline, id: "remap-browser", host: "browser", viewer: "browser", fault: "udp-block", duringShare: true, remap: true },
@@ -110,7 +110,7 @@ export function checkAppPath(sample: MediaSample, action: "prepare-edge" | "rece
 }
 
 export function checkFaultHit(fault: Fault, faultDrops: number): void {
-  if (["peer-block", "udp-block", "stun-primary", "signaling"].includes(fault) && faultDrops < 1) {
+  if (["peer-block", "udp-block", "ipv4-block", "stun-primary", "signaling"].includes(fault) && faultDrops < 1) {
     throw new Error(`No packets hit the ${fault} rule; outcome cannot validate this fault`);
   }
 }
@@ -136,7 +136,7 @@ export function checkCalibration(before: ProbeResult, after: ProbeResult, fault:
       before.mappings.some(mapping => !mapping.address.startsWith("198.51.100."))) {
     throw new Error("Baseline probe did not traverse the expected NAT and all three destinations");
   }
-  if (fault === "udp-block") {
+  if (fault === "udp-block" || fault === "ipv4-block") {
     if (after.received !== 0) throw new Error("Blocked UDP still reached the probe");
   } else if (fault === "delay") {
     const median = (values: number[]) => [...values].sort((a, b) => a - b)[Math.floor(values.length / 2)] ?? 0;
diff --git a/tests/network-lab.test.ts b/tests/network-lab.test.ts
index bb6a5c324..5db47d0fc 100644
--- a/tests/network-lab.test.ts
+++ b/tests/network-lab.test.ts
@@ -22,10 +22,11 @@ describe("network laboratory evidence", () => {
     expect(summary[1]).toMatchObject({ trials: 1, checksPassed: 0, failures: 1, unavailable: 1, firstPictureMs: { count: 0, min: null } });
   });
   it("rejects absent impairments rather than blessing an unaffected media path", () => {
-    for (const fault of ["udp-block", "delay", "loss", "rate"] as const) {
+    for (const fault of ["udp-block", "ipv4-block", "delay", "loss", "rate"] as const) {
       expect(() => checkCalibration(baseline, { ...baseline, durationMs: 20 }, fault)).toThrow();
     }
     expect(() => checkCalibration(baseline, { ...baseline, received: 0, receivedBytes: 0, rttMs: [] }, "udp-block")).not.toThrow();
+    expect(() => checkCalibration(baseline, { ...baseline, received: 0, receivedBytes: 0, rttMs: [] }, "ipv4-block")).not.toThrow();
     expect(() => checkCalibration(baseline, { ...baseline, rttMs: [100, 95, 120] }, "delay")).not.toThrow();
   });
 
@@ -80,7 +81,7 @@ describe("network laboratory evidence", () => {
   });
 
   it("requires the actual blackhole rule to see traffic", () => {
-    for (const fault of ["peer-block", "udp-block", "stun-primary", "signaling"] as const) {
+    for (const fault of ["peer-block", "udp-block", "ipv4-block", "stun-primary", "signaling"] as const) {
       expect(() => checkFaultHit(fault, 0)).toThrow();
       expect(() => checkFaultHit(fault, 3)).not.toThrow();
     }

From 7eb043ad2a143f02f1d9597739d15211dbd540a0 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 04:00:54 +0800
Subject: [PATCH 201/262] test(media): retain state when RTP clock checks time
 out

---
 internal/app/mediaedge/edge_test.go | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/internal/app/mediaedge/edge_test.go b/internal/app/mediaedge/edge_test.go
index 1f10619ac..9e9bc365c 100644
--- a/internal/app/mediaedge/edge_test.go
+++ b/internal/app/mediaedge/edge_test.go
@@ -483,7 +483,7 @@ func TestCaptureTimestampsDriveTheRTPClock(t *testing.T) {
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { _ = source.Close() })
-	_, receiver, packets := connectedReceiver(t, engine, source, "timed-edge")
+	edge, receiver, packets := connectedReceiver(t, engine, source, "timed-edge")
 	t.Cleanup(func() { _ = receiver.Close() })
 	accessUnit := sfu.VP8KeyFrame8x8
 	start := 10 * time.Second
@@ -492,18 +492,18 @@ func TestCaptureTimestampsDriveTheRTPClock(t *testing.T) {
 	if err = writeSourceFrame(source, accessUnit, start, frameDuration); err != nil {
 		t.Fatal(err)
 	}
-	first := waitPacket(t, packets)
+	first := waitPacket(t, packets, edge)
 	if err = writeSourceFrame(source, accessUnit, start+frameDuration, frameDuration); err != nil {
 		t.Fatal(err)
 	}
-	second := waitPacket(t, packets)
+	second := waitPacket(t, packets, edge)
 	if got := second.Timestamp - first.Timestamp; got < 2_999 || got > 3_001 {
 		t.Fatalf("steady timestamp delta = %d", got)
 	}
 	if err = writeSourceFrame(source, accessUnit, start+5*time.Second, frameDuration); err != nil {
 		t.Fatal(err)
 	}
-	third := waitPacket(t, packets)
+	third := waitPacket(t, packets, edge)
 	if got := third.Timestamp - second.Timestamp; got < 446_999 || got > 447_001 {
 		t.Fatalf("sparse timestamp delta = %d", got)
 	}
@@ -519,19 +519,19 @@ func TestNewCaptureGenerationKeepsTheRTPClockContinuous(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	_, receiver, packets := connectedReceiver(t, engine, source, "generation-edge")
+	edge, receiver, packets := connectedReceiver(t, engine, source, "generation-edge")
 	t.Cleanup(func() { _ = receiver.Close() })
 	accessUnit := sfu.VP8KeyFrame8x8
 	frameDuration := time.Second / 30
 	if err = writeSourceFrame(source, accessUnit, 50*time.Second, frameDuration); err != nil {
 		t.Fatal(err)
 	}
-	first := waitPacket(t, packets)
+	first := waitPacket(t, packets, edge)
 	source.BeginGeneration()
 	if err = writeSourceFrame(source, accessUnit, 100*time.Millisecond, frameDuration); err != nil {
 		t.Fatal(err)
 	}
-	second := waitPacket(t, packets)
+	second := waitPacket(t, packets, edge)
 	if got := second.Timestamp - first.Timestamp; got < 2_999 || got > 3_001 {
 		t.Fatalf("generation timestamp delta = %d", got)
 	}
@@ -915,12 +915,16 @@ func waitSignal(t *testing.T, signal <-chan struct{}, label string) {
 	}
 }
 
-func waitPacket(t *testing.T, packets <-chan *rtp.Packet) *rtp.Packet {
+func waitPacket(t *testing.T, packets <-chan *rtp.Packet, edges ...*Edge) *rtp.Packet {
 	t.Helper()
 	select {
 	case packet := <-packets:
 		return packet
 	case <-time.After(5 * time.Second):
+		for _, edge := range edges {
+			t.Logf("edge=%s output=%+v egress=%+v source=%+v", edge.State(),
+				edge.transport.Output.State(), edge.transport.Egress(), edge.source.media.DebugInfo())
+		}
 		t.Fatal("timed out waiting for RTP")
 		return nil
 	}

From 957184b590be5f27bb1787130dff8300ba719ec5 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 04:21:46 +0800
Subject: [PATCH 202/262] docs(network): record laboratory acceptance and
 evidence limits

---
 docs/research/network-lab.md | 26 +++++++++++++++++++++-----
 docs/todo.md                 | 18 +++++-------------
 2 files changed, 26 insertions(+), 18 deletions(-)

diff --git a/docs/research/network-lab.md b/docs/research/network-lab.md
index 61b0817e1..ebc3e87b2 100644
--- a/docs/research/network-lab.md
+++ b/docs/research/network-lab.md
@@ -70,7 +70,10 @@ The fast layer already uses Pion vnet in `internal/app/mediaedge` and
 media, not every Browser/OS behavior. The process layer uses Linux namespaces,
 kernel NAT/firewall rules and traffic shaping. Neither layer establishes
 Windows/macOS driver behavior, physical radio scheduling, mobile suspension or
-the distribution of real-world NATs.
+the distribution of real-world NATs. The current process matrix uses desktop
+Chrome and a Linux App with Browser-generated H264 ingress; it does not exercise
+physical capture, other Browser engines, real gateway mapping or the public
+invitation provider.
 
 Actual packets/counters must corroborate each impairment. DevTools accepting a
 network-emulation request is insufficient: an earlier Piik check observed RTP
@@ -118,9 +121,19 @@ The manual CI workflow's `network_lab` input runs this same entry point and neve
 publishes. Reports and bounded synthetic-traffic captures are under ignored
 `build/network-lab/results/`; CI retains them for seven days.
 
-The process layer is still under validation. Listed scenarios are implementation
-targets until their reports pass the acceptance contract. In particular, App
-Host checks must use the real H264 Browser-to-App ingress and App WAN sender;
+The [full process acceptance](https://github.com/TNTcraftHIM/Piik/actions/runs/38300988699)
+on 2026-10-13 passed all 19 scenarios and five negative controls, including
+resource cleanup and unchanged host networking. Sixteen scenarios produced
+advancing decoded audio/video; blocked UDP and the two random-mapping profiles
+produced bounded unavailability. A passing failure observation is not a
+successful connection or an Internet success-rate measurement.
+The [paired comparison](https://github.com/TNTcraftHIM/Piik/actions/runs/38301455274)
+also passed eight trials across two seeds with alternating enhancement on/off
+order. All four ordinary App/App trials delivered media; all four random-mapping
+trials exhausted their routes. This validates comparison/reporting and establishes
+no enhancement gain for that random-mapping profile.
+
+App Host checks must use the real H264 Browser-to-App ingress and App WAN sender;
 launching an App alongside a Browser-only VP8 share is not an App-path test.
 
 Each router uses destination-aware connection tracking for filtering. Independent
@@ -143,4 +156,7 @@ both initial and recovered media windows; a Browser WAN fallback cannot validate
 Native recovery. Rate calibration requires offered traffic above the configured
 ceiling, so a slow test process cannot impersonate a constrained network.
 Recovery timing begins when the impairment is removed, including subsequent
-calibration and sampling time.
+calibration and sampling time. `firstPictureMs` starts at Viewer navigation and
+ends at the first sample with at least 15 decoded frames; sampling is every
+500 ms. Recovery checks poll every second. These are sampled media-admission
+times, not exact first-packet timestamps or one-way media latency.
diff --git a/docs/todo.md b/docs/todo.md
index b70a4fb51..e404dfd66 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -10,19 +10,11 @@ Git/PRs own completed history.
 
 ## Now
 
-- [ ] **Controlled network laboratory.** Complete the owned
-  [acceptance contract](./research/network-lab.md#acceptance-contract): real
-  isolated App/Browser paths, calibrated impairments, NAT/recovery/SFU scenarios,
-  repeatable reports, negative controls and cancellation cleanup. Establish this
-  evidence before further NAT mechanism changes. Model results do not replace
-  physical-network beta or establish a public success percentage.
-- [ ] **Warm-source first-video allocation.** The network laboratory's App/App
-  outage test loses video after transport replacement. A separate real-RTP
-  reproduction confirms that a measured raw source above a new transport's
-  initial budget can pause before TWCC establishes capacity. Correct startup
-  allocation at the shared forwarding owner, preserve observed congestion
-  limits, then rerun outage, constrained-link and healthy-sibling acceptance.
-  This mechanism does not yet establish every field disconnect's cause.
+- [ ] **Intermittent RTP clock-check timeout.** Two Linux CI runs timed out waiting
+  for the second packet in the existing timestamp/generation checks. Local
+  repetitions and explicit source pauses did not reproduce the timeout. Retain
+  the assertions and inspect the added source/allocation/egress diagnostics on
+  recurrence before assigning a product cause or changing forwarding.
 
 - [ ] **2.0 candidate preparation and acceptance.** The owner reopened investigation,
   useful improvements and outstanding acceptance on 2026-10-07, and on 2026-10-09

From 2118f2b4fd438b7fce32a64ca3d6f7ad662fd929 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 09:07:00 +0800
Subject: [PATCH 203/262] test(network): compare traversal through sequential
 kernel NAT

---
 docs/todo.md                     |  6 ++++++
 scripts/network-lab/network.ts   |  3 ++-
 scripts/network-lab/page.ts      |  4 +++-
 scripts/network-lab/scenarios.ts | 10 ++++++++++
 tests/network-lab.test.ts        |  4 ++++
 5 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/docs/todo.md b/docs/todo.md
index e404dfd66..d4efeee10 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -10,6 +10,12 @@ Git/PRs own completed history.
 
 ## Now
 
+- [ ] **NAT laboratory follow-up.** Compare bounded prediction and Native
+  preparation through sequential kernel NAT, inspect retry/socket retirement,
+  and retain only verified improvements within ADR-0009's resource and ownership
+  bounds. Authenticated observed-address learning alone does not establish that
+  both ends selected the same socket pair.
+
 - [ ] **Intermittent RTP clock-check timeout.** Two Linux CI runs timed out waiting
   for the second packet in the existing timestamp/generation checks. Local
   repetitions and explicit source pauses did not reproduce the timeout. Retain
diff --git a/scripts/network-lab/network.ts b/scripts/network-lab/network.ts
index d4095454c..b1d41188e 100644
--- a/scripts/network-lab/network.ts
+++ b/scripts/network-lab/network.ts
@@ -6,7 +6,7 @@ import { setTimeout as delay } from "node:timers/promises";
 export const SITE_IP = "198.51.100.1";
 export const SITE_IPV6 = "2001:db8:71::1";
 export const SITE_ORIGIN = `http://${SITE_IP}:9000`;
-export type NatMode = "preserve" | "random";
+export type NatMode = "preserve" | "sequential" | "random";
 export type Fault = "none" | "peer-block" | "udp-block" | "ipv4-block" | "stun-primary" | "delay" | "loss" | "rate" | "signaling";
 
 export function command(program: string, args: string[], input?: string): string {
@@ -83,6 +83,7 @@ export class LabNetwork {
       this.exec(router, "nft", [`
 table ip lab_nat {
  chain postrouting { type nat hook postrouting priority srcnat; policy accept;
+  ${mode === "sequential" ? `oifname "wan0" meta l4proto udp snat to ${this.publicIP(index)}:numgen inc mod 20000 offset 40000` : ""}
   oifname "wan0" snat to ${this.publicIP(index)}${mode === "random" ? " fully-random" : ""}
  }
 }
diff --git a/scripts/network-lab/page.ts b/scripts/network-lab/page.ts
index 38b3d5b94..e756e199c 100644
--- a/scripts/network-lab/page.ts
+++ b/scripts/network-lab/page.ts
@@ -23,12 +23,14 @@ export const pageProbe = String.raw`(() => {
         if(message.type==='route-update'&&message.phase==='active')route=message.assignment.upstream.kind;
         const value={at:performance.now(),type:message.type,state:message.state,reason:message.reason,scope,
           phase:message.phase,route:message.assignment?.upstream?.kind,connectionId:message.connectionId};
+        if(message.type==='punch-prepared')value.predictionStep=message.prediction?.step;
+        if(message.type==='punch-complete')value.connected=message.connected;
         for(const key of ['localType','remoteType','natTraversalPath','sampleWindowMs','intervalFramesEncoded',
           'framesPerSecond','bitrateKbps','availableOutgoingKbps','width','height'])if(message[key]!==undefined)value[key]=message[key];
         record(events,value);
       });
     }
-    send(raw){if(this.url.includes('/control')){try{const m=JSON.parse(raw);record(controls,{type:m.type,connectionId:m.connectionId});}catch{}}super.send(raw);}
+    send(raw){if(this.url.includes('/control')){try{const m=JSON.parse(raw);record(controls,{type:m.type,connectionId:m.connectionId,punched:m.punched});}catch{}}super.send(raw);}
   };
   navigator.mediaDevices.getDisplayMedia=async()=>{
     const canvas=document.createElement('canvas'); canvas.width=1280; canvas.height=720;
diff --git a/scripts/network-lab/scenarios.ts b/scripts/network-lab/scenarios.ts
index 71f3f4ce6..de3d9e078 100644
--- a/scripts/network-lab/scenarios.ts
+++ b/scripts/network-lab/scenarios.ts
@@ -67,6 +67,9 @@ export const scenarios: readonly Scenario[] = [
   { ...baseline, id: "signaling-outage", host: "browser", viewer: "browser", fault: "signaling", duringShare: true },
   { ...baseline, id: "random-nat", host: "app", viewer: "app", nat: ["random", "random"], expected: "observed" },
   { ...baseline, id: "asymmetric-nat", host: "browser", viewer: "app", nat: ["random", "preserve"], expected: "observed" },
+  { ...baseline, id: "sequential-app", host: "app", viewer: "app", nat: ["sequential", "sequential"], expected: "observed" },
+  { ...baseline, id: "sequential-browser", host: "browser", viewer: "browser", nat: ["sequential", "sequential"], expected: "observed" },
+  { ...baseline, id: "sequential-mixed", host: "app", viewer: "browser", nat: ["sequential", "sequential"], expected: "observed" },
   { ...baseline, id: "ipv6-browser", host: "browser", viewer: "browser", ipv6: true, fault: "ipv4-block" },
   { ...baseline, id: "ipv6-app", host: "app", viewer: "app", ipv6: true, fault: "ipv4-block" },
   { ...baseline, id: "healthy-sibling", host: "browser", viewer: "browser", sibling: true,
@@ -159,4 +162,11 @@ export function checkMapping(probe: ProbeResult, mode: NatMode): void {
   if (probe.mappings.length !== 3 || (mode === "preserve" ? ports.size !== 1 : ports.size < 2)) {
     throw new Error(`Observed mappings do not match the configured ${mode} SNAT behavior`);
   }
+  if (mode === "sequential") {
+    const ordered = [...ports].sort((a, b) => a - b);
+    if (ordered.length !== 3 || ordered[0]! < 40000 || ordered[2]! >= 60000 ||
+      ordered[1]! !== ordered[0]! + 1 || ordered[2]! !== ordered[1]! + 1) {
+      throw new Error("Sequential SNAT did not allocate consecutive ports across three destinations");
+    }
+  }
 }
diff --git a/tests/network-lab.test.ts b/tests/network-lab.test.ts
index 5db47d0fc..d16db33e2 100644
--- a/tests/network-lab.test.ts
+++ b/tests/network-lab.test.ts
@@ -61,6 +61,10 @@ describe("network laboratory evidence", () => {
     const random = { ...baseline, mappings: baseline.mappings.map((value, index) => ({ ...value, port: value.port + index })) };
     expect(() => checkMapping(random, "random")).not.toThrow();
     expect(() => checkMapping(random, "preserve")).toThrow();
+    expect(() => checkMapping(random, "sequential")).not.toThrow();
+    expect(() => checkMapping(baseline, "sequential")).toThrow();
+    expect(() => checkMapping({ ...random, mappings: random.mappings.map((value, index) => ({ ...value, port: value.port + index })) }, "sequential")).toThrow();
+    expect(() => checkMapping({ ...random, mappings: random.mappings.map((value, index) => ({ ...value, port: 1024 + index })) }, "sequential")).toThrow();
   });
 
   it("does not confuse a connected transport or stale video dimensions with decoded media", () => {

From 7775cee3059274c00394a78a6c091018d5d027bd Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 09:12:45 +0800
Subject: [PATCH 204/262] test(network): type sequential NAT allocations as
 service ports

---
 scripts/network-lab/network.ts   | 7 ++++---
 scripts/network-lab/scenarios.ts | 2 +-
 tests/network-lab.test.ts        | 5 +++--
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/scripts/network-lab/network.ts b/scripts/network-lab/network.ts
index b1d41188e..763a057d7 100644
--- a/scripts/network-lab/network.ts
+++ b/scripts/network-lab/network.ts
@@ -80,10 +80,11 @@ export class LabNetwork {
         this.exec(router, "ip", ["-6", "route", "add", "default", "via", SITE_IPV6]);
         this.exec(this.wan, "ip", ["-6", "route", "add", `2001:db8:72:${n}::/64`, "via", wan]);
       }
-      this.exec(router, "nft", [`
+      this.exec(router, "nft", ["-f", "-"], `
 table ip lab_nat {
+ ${mode === "sequential" ? `map ports { type integer : inet_service; elements = { ${Array.from({ length: 4096 }, (_, port) => `${port} : ${40000 + port}`).join(", ")} } }` : ""}
  chain postrouting { type nat hook postrouting priority srcnat; policy accept;
-  ${mode === "sequential" ? `oifname "wan0" meta l4proto udp snat to ${this.publicIP(index)}:numgen inc mod 20000 offset 40000` : ""}
+  ${mode === "sequential" ? `oifname "wan0" meta l4proto udp snat to ${this.publicIP(index)}:numgen inc mod 4096 map @ports` : ""}
   oifname "wan0" snat to ${this.publicIP(index)}${mode === "random" ? " fully-random" : ""}
  }
 }
@@ -100,7 +101,7 @@ table inet lab_filter {
   ct state established,related counter accept
  }
 }
-`]);
+`);
     }
     if (ipv6) this.exec(this.wan, "sysctl", ["-qw", "net.ipv6.conf.all.forwarding=1"]);
   }
diff --git a/scripts/network-lab/scenarios.ts b/scripts/network-lab/scenarios.ts
index de3d9e078..0290dd43f 100644
--- a/scripts/network-lab/scenarios.ts
+++ b/scripts/network-lab/scenarios.ts
@@ -164,7 +164,7 @@ export function checkMapping(probe: ProbeResult, mode: NatMode): void {
   }
   if (mode === "sequential") {
     const ordered = [...ports].sort((a, b) => a - b);
-    if (ordered.length !== 3 || ordered[0]! < 40000 || ordered[2]! >= 60000 ||
+    if (ordered.length !== 3 || ordered[0]! < 40000 || ordered[2]! >= 44096 ||
       ordered[1]! !== ordered[0]! + 1 || ordered[2]! !== ordered[1]! + 1) {
       throw new Error("Sequential SNAT did not allocate consecutive ports across three destinations");
     }
diff --git a/tests/network-lab.test.ts b/tests/network-lab.test.ts
index d16db33e2..4c9dd7a3e 100644
--- a/tests/network-lab.test.ts
+++ b/tests/network-lab.test.ts
@@ -61,9 +61,10 @@ describe("network laboratory evidence", () => {
     const random = { ...baseline, mappings: baseline.mappings.map((value, index) => ({ ...value, port: value.port + index })) };
     expect(() => checkMapping(random, "random")).not.toThrow();
     expect(() => checkMapping(random, "preserve")).toThrow();
-    expect(() => checkMapping(random, "sequential")).not.toThrow();
+    const sequential = { ...baseline, mappings: baseline.mappings.map((value, index) => ({ ...value, port: 40000 + index })) };
+    expect(() => checkMapping(sequential, "sequential")).not.toThrow();
     expect(() => checkMapping(baseline, "sequential")).toThrow();
-    expect(() => checkMapping({ ...random, mappings: random.mappings.map((value, index) => ({ ...value, port: value.port + index })) }, "sequential")).toThrow();
+    expect(() => checkMapping({ ...sequential, mappings: sequential.mappings.map((value, index) => ({ ...value, port: value.port + index })) }, "sequential")).toThrow();
     expect(() => checkMapping({ ...random, mappings: random.mappings.map((value, index) => ({ ...value, port: 1024 + index })) }, "sequential")).toThrow();
   });
 

From 810faf9d5b92550add8d23eb5a9726e2606227d2 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 09:19:24 +0800
Subject: [PATCH 205/262] test(network): pass nftables rules through its
 command argument

---
 scripts/network-lab/network.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/network-lab/network.ts b/scripts/network-lab/network.ts
index 763a057d7..b6831e2ae 100644
--- a/scripts/network-lab/network.ts
+++ b/scripts/network-lab/network.ts
@@ -80,7 +80,7 @@ export class LabNetwork {
         this.exec(router, "ip", ["-6", "route", "add", "default", "via", SITE_IPV6]);
         this.exec(this.wan, "ip", ["-6", "route", "add", `2001:db8:72:${n}::/64`, "via", wan]);
       }
-      this.exec(router, "nft", ["-f", "-"], `
+      this.exec(router, "nft", [`
 table ip lab_nat {
  ${mode === "sequential" ? `map ports { type integer : inet_service; elements = { ${Array.from({ length: 4096 }, (_, port) => `${port} : ${40000 + port}`).join(", ")} } }` : ""}
  chain postrouting { type nat hook postrouting priority srcnat; policy accept;
@@ -101,7 +101,7 @@ table inet lab_filter {
   ct state established,related counter accept
  }
 }
-`);
+`]);
     }
     if (ipv6) this.exec(this.wan, "sysctl", ["-qw", "net.ipv6.conf.all.forwarding=1"]);
   }

From 80e09e47eeadf22af2860c4379c3b803bd259308 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 09:26:27 +0800
Subject: [PATCH 206/262] test(media): trace sparse RTP through input and
 forwarding

---
 docs/todo.md                        | 10 +++++-----
 internal/app/mediaedge/edge_test.go |  4 ++++
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/docs/todo.md b/docs/todo.md
index d4efeee10..b05a84971 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -16,11 +16,11 @@ Git/PRs own completed history.
   bounds. Authenticated observed-address learning alone does not establish that
   both ends selected the same socket pair.
 
-- [ ] **Intermittent RTP clock-check timeout.** Two Linux CI runs timed out waiting
-  for the second packet in the existing timestamp/generation checks. Local
-  repetitions and explicit source pauses did not reproduce the timeout. Retain
-  the assertions and inspect the added source/allocation/egress diagnostics on
-  recurrence before assigning a product cause or changing forwarding.
+- [ ] **Intermittent RTP clock-check timeout.** Linux CI intermittently times out
+  waiting for the second packet in the existing timestamp/generation checks.
+  Local repetitions and explicit source pauses did not reproduce the timeout.
+  Retain the assertions and correlate input-buffer, forwarder and egress
+  diagnostics on recurrence before assigning a product cause or changing forwarding.
 
 - [ ] **2.0 candidate preparation and acceptance.** The owner reopened investigation,
   useful improvements and outstanding acceptance on 2026-10-07, and on 2026-10-09
diff --git a/internal/app/mediaedge/edge_test.go b/internal/app/mediaedge/edge_test.go
index 9e9bc365c..87f65ddb7 100644
--- a/internal/app/mediaedge/edge_test.go
+++ b/internal/app/mediaedge/edge_test.go
@@ -924,6 +924,10 @@ func waitPacket(t *testing.T, packets <-chan *rtp.Packet, edges ...*Edge) *rtp.P
 		for _, edge := range edges {
 			t.Logf("edge=%s output=%+v egress=%+v source=%+v", edge.State(),
 				edge.transport.Output.State(), edge.transport.Egress(), edge.source.media.DebugInfo())
+			t.Logf("forwarder=%+v", edge.transport.Output.DebugInfo())
+			for index, input := range edge.source.media.GetAllBuffers() {
+				t.Logf("input=%d stats=%+v", index, input.GetStats())
+			}
 		}
 		t.Fatal("timed out waiting for RTP")
 		return nil

From 5614bd77e7965588a29d36c66c90d82922c47d6c Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 09:28:15 +0800
Subject: [PATCH 207/262] test(network): derive the NAT map key width from
 numgen

---
 scripts/network-lab/network.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/network-lab/network.ts b/scripts/network-lab/network.ts
index b6831e2ae..1d3eaa80d 100644
--- a/scripts/network-lab/network.ts
+++ b/scripts/network-lab/network.ts
@@ -82,7 +82,7 @@ export class LabNetwork {
       }
       this.exec(router, "nft", [`
 table ip lab_nat {
- ${mode === "sequential" ? `map ports { type integer : inet_service; elements = { ${Array.from({ length: 4096 }, (_, port) => `${port} : ${40000 + port}`).join(", ")} } }` : ""}
+ ${mode === "sequential" ? `map ports { typeof numgen inc mod 4096 : udp dport; elements = { ${Array.from({ length: 4096 }, (_, port) => `${port} : ${40000 + port}`).join(", ")} } }` : ""}
  chain postrouting { type nat hook postrouting priority srcnat; policy accept;
   ${mode === "sequential" ? `oifname "wan0" meta l4proto udp snat to ${this.publicIP(index)}:numgen inc mod 4096 map @ports` : ""}
   oifname "wan0" snat to ${this.publicIP(index)}${mode === "random" ? " fully-random" : ""}

From 753809fafbd29fcd13c43a49fefde64ef3a9f95c Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 09:46:26 +0800
Subject: [PATCH 208/262] test(network): require media on enhanced sequential
 NAT paths

---
 docs/research/nat-traversal.md   | 16 +++++++++-------
 docs/research/network-lab.md     | 28 +++++++++++++++++++++++-----
 docs/status.md                   | 12 ++++++------
 docs/todo.md                     | 16 +++++-----------
 scripts/network-lab.ts           |  3 ++-
 scripts/network-lab/scenarios.ts |  3 ++-
 6 files changed, 47 insertions(+), 31 deletions(-)

diff --git a/docs/research/nat-traversal.md b/docs/research/nat-traversal.md
index 782c1a7c3..c0e04a7a7 100644
--- a/docs/research/nat-traversal.md
+++ b/docs/research/nat-traversal.md
@@ -456,11 +456,10 @@ credentials, first-packet loss and winner adoption have explicit controls.
 100 ms of peer-start skew succeeds in the fixture; 350 ms exceeds its overlap
 and fails cleanly. These are experimental budgets, not product defaults.
 
-The policy comparator follows the current TS emission order, but surveys run
-sequentially before ICE; production surveys run concurrently while candidates
-trickle. The payload is synthetic RTP, not a decoded picture. Random allocation,
-real signaling delay, first-picture latency, Browser interoperation and actual
-Piik operation retirement still need acceptance before product adoption.
+The isolated policy comparator follows TS emission order, but surveys run before
+ICE; ordinary production gathering trickles while STUN work is still running.
+Its synthetic RTP does not establish decoded pictures or complete control and
+signaling integration.
 
 The 2.0 candidate now adopts the winning socket before constructing Pion, only
 on an existing server-issued retry. Pion's WebRTC API does not expose ICE's
@@ -503,8 +502,11 @@ audio changes and App-exit fallback remain usable. Run the existing
 listeners on UDP 3478/3479/3480 and injects one candidate rejection; it does not
 contact public STUN services.
 
-Successful coordinated preparation through a real difficult network, decoded
-pictures on that path and cross-device behavior remain field-beta checks.
+The [process laboratory](./network-lab.md#running-the-process-layer) now verifies
+successful preparation and socket adoption through sequential Linux kernel NAT,
+including decoded picture/audio continuity and reverse feedback in actual App
+processes. Its Browser and mixed controls do not establish a gain in that profile.
+Physical difficult networks and cross-device behavior remain field-beta checks.
 Random-port overlap assumptions do not establish a solution for two independently
 random endpoint-dependent NATs or blocked UDP.
 
diff --git a/docs/research/network-lab.md b/docs/research/network-lab.md
index ebc3e87b2..8245ea861 100644
--- a/docs/research/network-lab.md
+++ b/docs/research/network-lab.md
@@ -133,16 +133,34 @@ order. All four ordinary App/App trials delivered media; all four random-mapping
 trials exhausted their routes. This validates comparison/reporting and establishes
 no enhancement gain for that random-mapping profile.
 
+The [sequential-mapping comparison](https://github.com/TNTcraftHIM/Piik/actions/runs/38332289068)
+passed twelve trials across two seeds. Both enhanced App/App trials delivered
+1280x720 video and audio after about 23.7 seconds; both disabled controls exhausted
+their routes. Both Apps reported step-one observations, successful preparation
+and socket adoption for the same connection. Packet captures confirmed SRTP and
+reverse SRTCP on that tuple. The enhanced App/App case now requires media; its
+disabled control remains observational so an ordinary-ICE improvement can pass.
+Browser/Browser and App/Browser exhausted their routes with either setting in
+this profile. This establishes one complete product path through sequential
+kernel NAT, not a field success rate or general benefit for Browser participants.
+
 App Host checks must use the real H264 Browser-to-App ingress and App WAN sender;
 launching an App alongside a Browser-only VP8 share is not an App-path test.
 
 Each router uses destination-aware connection tracking for filtering. Independent
 probes check responses from the contacted endpoint, another port and another
-address before sharing. The preserve/random SNAT cases describe observed port
-mapping, not every consumer NAT implementation. Address-change cases replace
-only the isolated router's UDP public address and conntrack entries while
-proving that TCP signaling stays usable; both old and new media windows retain
-their respective addresses for packet/feedback checks.
+address before sharing. Preserve, random and sequential SNAT describe observed
+mapping, not every consumer NAT implementation. Sequential cases use nftables'
+number generator and a typed port map: new UDP flows advance through ports
+40000..44095, with the same destination-dependent filter. Calibration must
+observe three consecutive mappings before Piik starts. App/App, Browser/Browser
+and App/Browser cases compare the existing enhancement switch; this switch also
+changes the retry budget, so aggregate differences do not isolate one mechanism.
+The recorded Native preparation and adoption results distinguish its use from
+ordinary ICE. Address-change cases replace only the isolated router's UDP public
+address and conntrack entries while proving that TCP signaling stays usable;
+both old and new media windows retain their respective addresses for
+packet/feedback checks.
 IPv6 cases provide a Pion-based external STUN endpoint as well as IPv4 embedded
 STUN. Browser mDNS host names cannot resolve across these routed networks;
 keep normal Browser privacy behavior and obtain IPv6 reflexive candidates through
diff --git a/docs/status.md b/docs/status.md
index 068181811..cfb6e8628 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -1,6 +1,6 @@
 # Current Status
 
-Last updated: 2026-10-12
+Last updated: 2026-10-13
 
 This is the compact execution/deployment index. Product modules own behavior,
 [verification status](./verification-status.md) owns unresolved physical limits,
@@ -84,11 +84,11 @@ its integration costs. The
 owns the retained experiment and adoption boundary. Its package is retired;
 independent ordinary ICE and media repairs remain in the candidate.
 An independent bounded Native UDP preparation now augments existing retries
-under ADR-0009. Production Engine checks cover socket adoption, video and reverse
-feedback in a sequential-NAT fixture. Actual App control/signaling checks cover
-ineligible preparation continuing to decoded Browser video. Successful paths
-still need the owner's field beta; this does not establish a public success
-rate or remove Browser-only operation.
+under ADR-0009. Actual App process checks cover socket adoption, decoded media
+and reverse feedback through sequential kernel NAT, as well as ineligible
+preparation continuing ordinary ICE. The [network laboratory](./research/network-lab.md)
+owns paired outcomes and evidence limits. The owner's field beta remains open;
+this does not establish a public success rate or remove Browser-only operation.
 The original candidate packages pass their identity/checksum checks; Windows
 Local startup/retirement, saved Site approval/revocation and explicit 1.x
 rejection have packaged acceptance evidence. Publication remains subject to
diff --git a/docs/todo.md b/docs/todo.md
index b05a84971..619301808 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -10,12 +10,6 @@ Git/PRs own completed history.
 
 ## Now
 
-- [ ] **NAT laboratory follow-up.** Compare bounded prediction and Native
-  preparation through sequential kernel NAT, inspect retry/socket retirement,
-  and retain only verified improvements within ADR-0009's resource and ownership
-  bounds. Authenticated observed-address learning alone does not establish that
-  both ends selected the same socket pair.
-
 - [ ] **Intermittent RTP clock-check timeout.** Linux CI intermittently times out
   waiting for the second packet in the existing timestamp/generation checks.
   Local repetitions and explicit source pauses did not reproduce the timeout.
@@ -189,11 +183,11 @@ experiments and their limits.
 ## Next: P2P Connection And Feedback Evidence
 
 - [ ] **Coordinated Native retry acceptance.**
-  The optional two-App preparation is integrated into the existing retry owner;
-  production Engine virtual-network checks carry media and reverse feedback;
-  actual App signaling checks cover ineligible preparation and ordinary decoded
-  media continuation. Verify successful preparation through a difficult network
-  and decoded-picture continuity on that path, following the
+  The optional two-App preparation is integrated into the existing retry owner.
+  The [process laboratory](./research/network-lab.md) covers successful adoption
+  through sequential kernel NAT; ordinary continuation when preparation is
+  ineligible also passes. Verify successful preparation through physical difficult
+  networks and decoded-picture continuity on that path, following the
   [assessment](./research/nat-traversal.md#coordinated-native-punching-assessment).
   Preserve the first ordinary attempt, immediate Browser decline and fixed
   operation deadlines. The owner will arrange a small difficult-network beta
diff --git a/scripts/network-lab.ts b/scripts/network-lab.ts
index 43ccb4e20..ae63ec550 100644
--- a/scripts/network-lab.ts
+++ b/scripts/network-lab.ts
@@ -176,7 +176,8 @@ async function runCase(scenario: Scenario, seed: number, prediction: boolean, ou
     }
     result.firstPictureMs = connected ? performance.now() - joinedAt : null;
     result.outcome = connected ? "media" : exhausted ? "unavailable" : "timeout";
-    if (result.outcome === "timeout" || (scenario.expected !== "observed" && result.outcome !== scenario.expected)) throw new Error(`Expected ${scenario.expected}, observed ${result.outcome}; ${serverLog.slice(-1000)}`);
+    const expected = prediction ? scenario.enhancedExpected ?? scenario.expected : scenario.expected;
+    if (result.outcome === "timeout" || (expected !== "observed" && result.outcome !== expected)) throw new Error(`Expected ${expected}, observed ${result.outcome}; ${serverLog.slice(-1000)}`);
     if (connected) {
       stage("continuity");
       const first = samples.at(-1)!.viewer;
diff --git a/scripts/network-lab/scenarios.ts b/scripts/network-lab/scenarios.ts
index 0290dd43f..24c672cb9 100644
--- a/scripts/network-lab/scenarios.ts
+++ b/scripts/network-lab/scenarios.ts
@@ -10,6 +10,7 @@ export interface Scenario {
   fault: Fault;
   sfu: boolean;
   expected: "media" | "unavailable" | "observed";
+  enhancedExpected?: "media" | "unavailable";
   duringShare?: boolean;
   ipv6?: boolean;
   faultEndpoint?: 0 | 1;
@@ -67,7 +68,7 @@ export const scenarios: readonly Scenario[] = [
   { ...baseline, id: "signaling-outage", host: "browser", viewer: "browser", fault: "signaling", duringShare: true },
   { ...baseline, id: "random-nat", host: "app", viewer: "app", nat: ["random", "random"], expected: "observed" },
   { ...baseline, id: "asymmetric-nat", host: "browser", viewer: "app", nat: ["random", "preserve"], expected: "observed" },
-  { ...baseline, id: "sequential-app", host: "app", viewer: "app", nat: ["sequential", "sequential"], expected: "observed" },
+  { ...baseline, id: "sequential-app", host: "app", viewer: "app", nat: ["sequential", "sequential"], expected: "observed", enhancedExpected: "media" },
   { ...baseline, id: "sequential-browser", host: "browser", viewer: "browser", nat: ["sequential", "sequential"], expected: "observed" },
   { ...baseline, id: "sequential-mixed", host: "app", viewer: "browser", nat: ["sequential", "sequential"], expected: "observed" },
   { ...baseline, id: "ipv6-browser", host: "browser", viewer: "browser", ipv6: true, fault: "ipv4-block" },

From fd6bfbad3585bcd100952ed715def81f0061a428 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 12:03:25 +0800
Subject: [PATCH 209/262] feat(media): extend custom quality controls and show
 App readiness

Separate practical capture limits from presets, admit higher refresh rates and ultrawide sources within existing codec budgets, and verify loopback authorization before showing App readiness. Keep platform decoder provisioning independent of axis ceilings.
---
 docs/guide/getting-started.md                 |  11 +-
 docs/guide/getting-started.zh-CN.md           |   9 +-
 docs/research/native-client-media.md          |  21 +++-
 docs/standards/media-quality.md               |  15 ++-
 docs/standards/presentation-lifecycle.md      |   4 +
 docs/status.md                                |   3 +-
 internal/app/mediaedge/relay_input_test.go    |   7 +-
 internal/app/nativecapture/protocol.go        |  10 +-
 internal/app/nativecapture/protocol_test.go   |  18 ++--
 internal/app/nativecapture/stream.go          |   4 +-
 internal/app/nativecontrol/session_test.go    |   6 +-
 native/capture/darwin/main.swift              |  25 +++--
 native/capture/linux/main.c                   |  18 ++--
 native/capture/linux/main.test.c              |  16 ++-
 native/capture/windows/h264_decoder.h         |  18 ++--
 native/capture/windows/main.cpp               |   4 +-
 native/capture/windows/output_worker.test.cpp |  15 ++-
 native/capture/windows/video_bounds.h         |  12 ++-
 .../components/living/AppConnectionButton.tsx |  43 ++++++--
 .../components/living/QualityPresets.tsx      | 100 +++++++++---------
 src/client/media/quality.ts                   |  15 +--
 src/client/pages/ControlsPreview.tsx          |   6 +-
 src/client/pages/HostPage.tsx                 |  18 +---
 src/client/styles.css                         |  30 +++---
 tests/app-connection-button.test.ts           |  46 ++++++--
 tests/host-quality-ownership.test.ts          |   4 +-
 tests/quality-preference.test.ts              |   2 +-
 tests/quality.test.ts                         |  24 +++--
 28 files changed, 314 insertions(+), 190 deletions(-)

diff --git a/docs/guide/getting-started.md b/docs/guide/getting-started.md
index f948ed11e..5d40915e4 100644
--- a/docs/guide/getting-started.md
+++ b/docs/guide/getting-started.md
@@ -170,13 +170,14 @@ sharing to allow that fallback. The project's online site uses P2P only.
 Open **Sharing settings** below the picture to adjust picture and audio quality.
 
 - Choose a picture preset, or enter width and height under **Resolution ceiling**.
-  Piik preserves the source's proportions within that ceiling. 4K supports a
-  frame-rate ceiling of up to 60 fps.
-- Use the sliders or enter a **Frame rate ceiling** from 1 to 60 fps and a
-  **Video bitrate ceiling** from 0.1 to 50 Mbps.
+  Piik preserves the source's proportions within that ceiling, including portrait
+  and ultrawide pictures.
+- Use the sliders or enter a **Frame rate ceiling** from 1 to 240 fps and a
+  **Video bitrate ceiling** from 0.1 to 240 Mbps. The frame-rate limit depends
+  on picture size: for example, 1080p240, 1440p144 and 4K60 are accepted requests.
 - Choose an audio preset, or enter an **Audio bitrate limit** from 6 to 320 kbps.
 
-The controls reflect the current device's supported limits. Picture and sound
+The selectable range depends on picture size and the connected App. Picture and sound
 still adapt to the source, device and available bandwidth.
 
 Piik remembers your applied settings for the next visit. Browser-only use remembers
diff --git a/docs/guide/getting-started.zh-CN.md b/docs/guide/getting-started.zh-CN.md
index 1d77ed917..dbea67e7b 100644
--- a/docs/guide/getting-started.zh-CN.md
+++ b/docs/guide/getting-started.zh-CN.md
@@ -147,12 +147,13 @@ Linux 原生采集还需要[系统组件](../../native/capture/linux/README.md)
 
 在画面下方打开 **分享设置**，调整画质和音频质量。
 
-- 可选画质预设，也可在 **分辨率上限** 中填写宽和高。画面在上限内保留来源比例；
-  4K 可搭配最高 60 帧的帧率上限。
-- 可拖动滑块，也可直接填写 1–60 帧的 **帧率上限** 和 0.1–50 Mbps 的 **视频码率上限**。
+- 可选画质预设，也可在 **分辨率上限** 中填写宽和高。画面在上限内保留来源比例，
+  包括竖屏和超宽屏。
+- 可拖动滑块，也可直接填写 1–240 帧的 **帧率上限** 和 0.1–240 Mbps 的 **视频码率上限**。
+  帧率范围随画幅变化，例如可以请求 1080p240、1440p144 或 4K60。
 - 音频保留三档预设，也可填写 6–320 kbps 的 **音频码率上限**。
 
-控件会按当前设备能力限制可选范围。实际画质和声音仍会根据来源、设备与可用带宽调整。
+可选范围会随画幅和连接的 App 变化。实际画质和声音仍会根据来源、设备与可用带宽调整。
 
 Piik 会记住已应用的设置，供下次使用。仅用浏览器时，设置保存在当前站点；
 通过新版 App 打开时，更换公网邀请网址也能保留设置。
diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 34d44bef8..27a77a15d 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -754,8 +754,8 @@ recommends 50 Mbps for 4K60, but its ingest/re-encoding workload is not a Piik
 WebRTC operating policy. These references motivate testing both ends of the
 range, rather than inheriting the old controls or copying another service's cap.
 
-The candidate now admits 1..60 integer fps and 0.1..50 Mbps. Its lower-output
-construction caps the usual 150 kbps floor by the source ceiling, in both Browser
+The initial numeric candidate admitted 1..60 integer fps and 0.1..50 Mbps. Its
+lower-output construction caps the usual 150 kbps floor by the source ceiling, in both Browser
 SFU and Native. Browser and Native preflight require positive encoded progress;
 the old one-frame tolerance could otherwise pass zero output at 1 fps.
 An earlier raw H.264 encode/decode control established local feasibility beyond
@@ -808,6 +808,23 @@ performance. Ignored controls and results are under
 `build/candidate-review/four-k60/` (`range-worker.cpp`, `range-browser.js`,
 `low-rate-pool.js`).
 
+The 2026-10-13 extension uses the existing H.264 Level 5.2 budget instead of
+the earlier menu maximum: see [FFmpeg's level table](https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/h264_levels.c).
+The Windows production worker delivered H.264 and VP8 output for 1080p120/
+80 Mbps, 1440p144/100 Mbps and 1080p240/240 Mbps, including small-source changes
+and restoration. VP8 also delivered 5120x1440/60 at a 100 Mbps ceiling; this
+machine's hardware H.264 candidates rejected that width. These short synthetic
+checks establish useful output and retirement, not sustained cadence or bitrate.
+Browser WebRTC loopback also retained the requested sender limits and continued
+decoding all four sizes/rates with H.264 and VP8. These controls used synthetic
+canvas input; they do not establish screen-capture cadence or cross-device support.
+Setting both Windows decoder axis ceilings to 8192 made an existing 4K fixture
+fail at `BEGIN_STREAMING` with `E_OUTOFMEMORY`. Retaining platform provisioning
+defaults passed the same padding/visible-crop regression; SPS and output buffer
+guards remain in their existing owners. Raw H.264 1080p120/80 Mbps also decoded
+30/30 pictures. The higher-range changes still need other-platform SDK and
+physical-device acceptance. Local controls are in ignored `build/quality-polish/`.
+
 [WebRTC statistics](https://www.w3.org/TR/webrtc-stats/#dom-rtcicecandidatepairstats-availableoutgoingbitrate)
 describe estimated available capacity, not a configured send-rate ceiling;
 [Pion exposes it as a floating-point observation](https://github.com/pion/ice/blob/main/stats.go).
diff --git a/docs/standards/media-quality.md b/docs/standards/media-quality.md
index 4289aeffe..4f6a0212a 100644
--- a/docs/standards/media-quality.md
+++ b/docs/standards/media-quality.md
@@ -138,7 +138,7 @@ rate in the same quality operation when the larger size requires a lower limit.
 Larger wire-valid requests do not
 authorize an adapter to exceed its local capture, codec or allocation limits.
 Numeric requests use representational bounds rather than the current control
-ranges. Candidate capture admits integer 1..60 fps and 0.1..50 Mbps, further
+ranges. Candidate capture admits integer 1..240 fps and 0.1..240 Mbps, further
 limited by picture size. Advanced controls accept typed values alongside sliders;
 the three recommended profiles and default remain unchanged. These are useful
 product controls, not universal codec
@@ -166,16 +166,21 @@ derivation, validate every H.264 sequence parameter set's supported format,
 coded storage and visible crop; a later small descriptor cannot authorize earlier
 large input.
 
-The candidate Native adapters admit even visible dimensions up to 3840 per
-axis and 3840x2160 total pixels. Their shared output-rate bound follows H.264
-Level 5.2: 2,073,600 16x16 macroblocks per second, with at most 60 fps. This admits
-landscape/portrait 4K60 and existing 1440p60. Decoder alignment has a
+Candidate capture admits even dimensions up to 8192 per axis and 36,864
+16x16 macroblocks per picture, including alignment. Its shared codec budget
+follows H.264 Level 5.2: 2,073,600 macroblocks per second and a 240 Mbps video
+bitrate ceiling; capture scheduling is separately bounded at 240 fps.
+This admits 1080p240, 1440p144, 5120x1440 at 60 fps and landscape/portrait
+4K60. It does not admit a full 8K picture. Decoder alignment has a
 separate coded-storage bound; reference-picture storage is bounded before
 Native derivation. These are admission limits, not a device performance promise.
 App discovery reports size, pixel-count, frame-rate and bitrate limits through the
 existing native health description. Controls use the intersection with local
 implementation limits; a remote claim cannot raise those limits. Whole-route
 and physical-device acceptance remain separate from available controls.
+Use platform decoder defaults for internal provisioning, rather than turning
+independent axis ceilings into a maximum-square preallocation. Encoded input
+and actual output storage remain bounded before use.
 
 Quality observations have independent numeric bounds. A valid capacity estimate
 above the requested send rate remains evidence; invalid optional measurements
diff --git a/docs/standards/presentation-lifecycle.md b/docs/standards/presentation-lifecycle.md
index 3b56e312b..8df0e57ce 100644
--- a/docs/standards/presentation-lifecycle.md
+++ b/docs/standards/presentation-lifecycle.md
@@ -45,6 +45,10 @@ successful connection refreshes its current list. An already approved exact
 origin needs no repeat confirmation, but the page still verifies authorized App
 health. Closing the selector cancels its pending connection action. Existing
 Browser shares retain their capture implementation until sharing ends.
+App-created Local/public-invite Host pages open at their automatically approved
+loopback origin. The shared App button reflects verified authorized health,
+including on returning to an activated page; a remembered activation alone
+cannot show readiness. Idle verification holds no media session or polling loop.
 Viewer links opened at that activated origin may use the same running App
 without changing the Viewer UI. Starting a share offers the
 Browser picker and any exact App-owned native windows. It never chooses a
diff --git a/docs/status.md b/docs/status.md
index cfb6e8628..148341c7e 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -67,7 +67,8 @@ capture v7 and SQLite schema 2
 remain unchanged. Matched candidate App/Web/Server builds are required;
 1.x participants are rejected by the existing compatibility checks.
 Custom width/height controls apply combined size and frame-rate limits, admitting
-4K60. Advanced video controls now span 1..60 fps and 0.1..50 Mbps while retaining
+4K60, ultrawide input and higher frame rates at smaller sizes. Advanced video
+controls span 1..240 fps and 0.1..240 Mbps while retaining
 the three recommended presets. Windows and Linux output preserve source shape
 within the selected ceiling.
 The [media assessment](./research/native-client-media.md#media-capability-extension-assessment)
diff --git a/internal/app/mediaedge/relay_input_test.go b/internal/app/mediaedge/relay_input_test.go
index f7a792fdf..f69602924 100644
--- a/internal/app/mediaedge/relay_input_test.go
+++ b/internal/app/mediaedge/relay_input_test.go
@@ -60,9 +60,9 @@ func TestRelayInputKeepsRecoveryAndEmitsACompleteQuietFrame(t *testing.T) {
 }
 
 func TestRelayInputRejectsUnsafeH264Configuration(t *testing.T) {
-	// Locally generated Constrained Baseline SPS: ID 0 is 4096x2160; ID 1 is
+	// Generated Constrained Baseline SPS: ID 0 is 5120x2880; ID 1 is
 	// 160x90. A decoder may use either, regardless of which arrived last.
-	const oversized = "6742c033dc0100010fb016a02020280000030008000003001478c19c"
+	const oversized = "6742c034da0050005a64"
 	const small = "6742c015570a37e4c05a8303035280000003008000000301478b17c0"
 	for _, test := range []struct {
 		name string
@@ -114,6 +114,9 @@ func TestRelayH264AllocationBounds(t *testing.T) {
 		{"portrait-4k", "6742c033da008701e190", 2160, 3840},
 		{"level-5.2-4k", "6742c034da00f0010f90", 3840, 2160},
 		{"level-5.2-portrait-4k", "6742c034da008701e190", 2160, 3840},
+		{"level-5.2-dci", "6742c034da0040004864", 4096, 2304},
+		{"level-5.2-ultrawide", "6742c034da005000b590", 5120, 1440},
+		{"level-5.2-portrait-ultrawide", "6742c034da0168028190", 1440, 5120},
 		{"padded-4k", "6742c033da00f00111f894", 3840, 2160},
 		{"4k-reference-buffer-limit", "6742c033f300780087c8", 3840, 2160},
 		{"4k-reference-buffer-overflow", "6742c033f380780087c8", 0, 0},
diff --git a/internal/app/nativecapture/protocol.go b/internal/app/nativecapture/protocol.go
index 1b44917d2..f9d3bbe63 100644
--- a/internal/app/nativecapture/protocol.go
+++ b/internal/app/nativecapture/protocol.go
@@ -15,13 +15,13 @@ const (
 	maxMediaBytes                = encoded.MaxAccessUnitBytes
 	maxStatusBytes               = 4 * 1024
 	maxControlBytes              = 64
-	MaxVideoDimension            = 3840
-	MaxVideoPixels               = 3840 * 2160
+	MaxVideoDimension            = 8192
+	MaxVideoPixels               = 36_864 * 16 * 16
 	MaxVideoMacroblocksPerSecond = 2_073_600
-	MaxVideoFramerate            = 60
+	MaxVideoFramerate            = 240 // Bound capture scheduling independently of codec throughput.
 	// Coded pictures may include alignment outside the visible crop. Keep this
 	// separate from visible dimensions and within H.264 Level 5.2 storage.
-	MaxCodedVideoDimension = 4096
+	MaxCodedVideoDimension = 8192
 	MaxCodedVideoPixels    = 36_864 * 16 * 16
 )
 
@@ -29,7 +29,7 @@ const (
 func ValidVideoSize(width, height uint32) bool {
 	return width >= 2 && width <= MaxVideoDimension && width%2 == 0 &&
 		height >= 2 && height <= MaxVideoDimension && height%2 == 0 &&
-		uint64(width)*uint64(height) <= MaxVideoPixels
+		uint64((width+15)/16)*uint64((height+15)/16)*256 <= MaxVideoPixels
 }
 
 // ValidVideoFormat keeps both current encoders within the shared receive
diff --git a/internal/app/nativecapture/protocol_test.go b/internal/app/nativecapture/protocol_test.go
index 4774503ea..fee2f4f5b 100644
--- a/internal/app/nativecapture/protocol_test.go
+++ b/internal/app/nativecapture/protocol_test.go
@@ -300,6 +300,11 @@ func TestVideoProfileUsesTheProductBounds(t *testing.T) {
 		{Width: 3840, Height: 2160, Framerate: 60, Bitrate: 12_000_000, Preference: "balanced"},
 		{Width: 2160, Height: 3840, Framerate: 60, Bitrate: 12_000_000, Preference: "balanced"},
 		{Width: 3000, Height: 2764, Framerate: 30, Bitrate: 12_000_000, Preference: "balanced"},
+		{Width: 1920, Height: 1080, Framerate: 240, Bitrate: 240_000_000, Preference: "balanced"},
+		{Width: 2560, Height: 1440, Framerate: 144, Bitrate: 100_000_000, Preference: "balanced"},
+		{Width: 5120, Height: 1440, Framerate: 60, Bitrate: 100_000_000, Preference: "balanced"},
+		{Width: 1440, Height: 5120, Framerate: 60, Bitrate: 100_000_000, Preference: "balanced"},
+		{Width: 4096, Height: 2304, Framerate: 56, Bitrate: 80_000_000, Preference: "balanced"},
 		{Width: 4, Height: 4, Framerate: 15, Bitrate: 2_000_000, Preference: "balanced"},
 	} {
 		if !profile.Valid() {
@@ -317,16 +322,17 @@ func TestVideoProfileUsesTheProductBounds(t *testing.T) {
 		{Width: 1280, Height: 2, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
 		{Width: 1279, Height: 720, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
 		{Width: 1280, Height: 719, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
-		{Width: 3842, Height: 2160, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
-		{Width: 2160, Height: 3842, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
-		{Width: 3840, Height: 2162, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
-		{Width: 3000, Height: 2766, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
-		{Width: 3840, Height: 2160, Framerate: 61, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: 8194, Height: 100, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: 5120, Height: 2880, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: 4096, Height: 2306, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: 6562, Height: 1438, Framerate: 30, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: 3840, Height: 2160, Framerate: 65, Bitrate: 3_000_000, Preference: "balanced"},
+		{Width: 1920, Height: 1080, Framerate: 241, Bitrate: 3_000_000, Preference: "balanced"},
 		{Width: 2160, Height: 3840, Framerate: 120, Bitrate: 3_000_000, Preference: "balanced"},
 		{Width: ^uint32(0), Height: ^uint32(0), Framerate: ^uint32(0), Bitrate: 3_000_000, Preference: "balanced"},
 		{Width: 1920, Height: 1080, Framerate: 0, Bitrate: 5_000_000, Preference: "balanced"},
 		{Width: 1920, Height: 1080, Framerate: 30, Bitrate: 99_999, Preference: "balanced"},
-		{Width: 1920, Height: 1080, Framerate: 30, Bitrate: 50_000_001, Preference: "balanced"},
+		{Width: 1920, Height: 1080, Framerate: 30, Bitrate: 240_000_001, Preference: "balanced"},
 		{Width: 1920, Height: 1080, Framerate: 30, Bitrate: 5_000_000, Preference: "unknown"},
 	} {
 		if profile.Valid() {
diff --git a/internal/app/nativecapture/stream.go b/internal/app/nativecapture/stream.go
index 82d8962c9..38e96de5c 100644
--- a/internal/app/nativecapture/stream.go
+++ b/internal/app/nativecapture/stream.go
@@ -23,8 +23,8 @@ const (
 	captureStopTimeout  = time.Second
 	maxPreviewBytes     = 192 * 1024
 	maxOutputs          = 6
-	minOutputBitrate    = 1_000 // Codec rate APIs use whole kbps.
-	MaxVideoBitrate     = 50_000_000
+	minOutputBitrate    = 1_000       // Codec rate APIs use whole kbps.
+	MaxVideoBitrate     = 240_000_000 // H.264 Level 5.2 Constrained Baseline video bitrate.
 	maxSources          = 1024
 	maxSourceTitleBytes = 4096
 	// Leave room for the control envelope within loopback's 256 KiB message.
diff --git a/internal/app/nativecontrol/session_test.go b/internal/app/nativecontrol/session_test.go
index aebceff7a..8b0ea67e3 100644
--- a/internal/app/nativecontrol/session_test.go
+++ b/internal/app/nativecontrol/session_test.go
@@ -677,7 +677,7 @@ func TestQualitySettingsMapOnceIntoNativeMedia(t *testing.T) {
 	if !nativeQualityProfile(settings).Valid() {
 		t.Fatal("4K30 was rejected")
 	}
-	for _, fps := range []protocol.Num{30.5, 61, 120, 0x1_0000_0000 + 30} {
+	for _, fps := range []protocol.Num{30.5, 65, 120, 0x1_0000_0000 + 30} {
 		settings.MaxFramerate = fps
 		if nativeQualityProfile(settings).Valid() {
 			t.Fatalf("unsupported fps %v was narrowed into a valid profile", fps)
@@ -698,9 +698,9 @@ func TestUpdateShareRequiresTheCurrentStrictProfile(t *testing.T) {
 		`"resolution":{"width":7680,"height":4320}`, 1))
 	for _, replace := range [][2]string{
 		{`"width":1920`, `"width":32768`}, {`"width":1920`, `"width":1921`},
-		{`"maxFramerate":30`, `"maxFramerate":120`}, {`"maxFramerate":30`, `"maxFramerate":30.5`},
+		{`"maxFramerate":30`, `"maxFramerate":480`}, {`"maxFramerate":30`, `"maxFramerate":30.5`},
 		{`"maxFramerate":30`, `"maxFramerate":4294967326`}, {`"maxFramerate":30`, `"maxFramerate":0.5`},
-		{`"maxBitrate":5000000`, `"maxBitrate":50000001`}, {`"maxBitrate":5000000`, `"maxBitrate":1000`},
+		{`"maxBitrate":5000000`, `"maxBitrate":240000001`}, {`"maxBitrate":5000000`, `"maxBitrate":1000`},
 	} {
 		assertOperationFailure(t, session, strings.Replace(valid, replace[0], replace[1], 1))
 	}
diff --git a/native/capture/darwin/main.swift b/native/capture/darwin/main.swift
index 8e7899a86..d07c0a7c0 100644
--- a/native/capture/darwin/main.swift
+++ b/native/capture/darwin/main.swift
@@ -15,9 +15,11 @@ private let height = 720
 private let frameRate: Int32 = 30
 private let bitrate = 3_000_000
 private let maxPayloadBytes = 4_194_304
-private let maxVideoDimension = 3840
-private let maxVideoPixels = 3840 * 2160
-private let maxCodedVideoDimension = 4096
+private let maxVideoDimension = 8192
+private let maxVideoPixels = 36_864 * 16 * 16
+private let maxVideoFramerate: Int32 = 240
+private let maxVideoBitrate = 240_000_000
+private let maxCodedVideoDimension = 8192
 private let maxCodedVideoPixels = 36_864 * 16 * 16
 private let supportedH264Levels: Set<UInt8> = [
     0x0a, 0x0b, 0x0c, 0x0d, 0x14, 0x15, 0x16,
@@ -1184,13 +1186,10 @@ private func geometrySelfTest() throws {
         CGRect(x: 0, y: 0, width: 3840, height: 2160) else {
         throw CaptureFailure(description: "H.264 visible aperture self-test failed")
     }
-    // Uncropped 4096x2160 exceeds the visible-picture budget. Raw SPS storage
+    // Uncropped 5120x2880 exceeds the visible-picture budget. Raw SPS storage
     // and reference counts are validated by Go before reaching this process;
     // CoreMedia can fold SPS cropping into its reported format dimensions.
-    let oversized = Data([0x67, 0x42, 0xc0, 0x33, 0xdc, 0x01, 0x00, 0x01,
-                          0x0f, 0xb0, 0x16, 0xa0, 0x20, 0x20, 0x28, 0x00,
-                          0x00, 0x03, 0x00, 0x08, 0x00, 0x00, 0x03, 0x00,
-                          0x14, 0x78, 0xc1, 0x9c])
+    let oversized = Data([0x67, 0x42, 0xc0, 0x34, 0xda, 0x00, 0x50, 0x00, 0x5a, 0x64])
     guard (try? h264InputFormat(sps: oversized, pps: pps)) == nil else {
         throw CaptureFailure(description: "H.264 oversized visible picture was accepted")
     }
@@ -1499,12 +1498,12 @@ private func captureFilter(
 private func validVideoSize(_ width: Int, _ height: Int) -> Bool {
     width >= 2 && width <= maxVideoDimension && width % 2 == 0 &&
         height >= 2 && height <= maxVideoDimension && height % 2 == 0 &&
-        width * height <= maxVideoPixels
+        ((width + 15) / 16) * ((height + 15) / 16) * 256 <= maxVideoPixels
 }
 
 private func validVideoFormat(_ width: Int, _ height: Int, _ fps: Int32) -> Bool {
     // Match the shared H.264 Level 5.2 receive ceiling, including numeric sizes.
-    validVideoSize(width, height) && fps >= 1 && fps <= 60 &&
+    validVideoSize(width, height) && fps >= 1 && fps <= maxVideoFramerate &&
         ((width + 15) / 16) * ((height + 15) / 16) * Int(fps) <= 2_073_600
 }
 
@@ -1522,7 +1521,7 @@ private func videoProfile(_ arguments: [String]) throws -> VideoProfile {
         throw CaptureFailure(description: "invalid video profile arguments")
     }
     guard validVideoFormat(width, height, frameRate), width >= 4, height >= 4,
-          bitrate >= 100_000, bitrate <= 50_000_000 else {
+          bitrate >= 100_000, bitrate <= maxVideoBitrate else {
         throw CaptureFailure(description: "video profile is outside the product bounds")
     }
     return VideoProfile(
@@ -1549,8 +1548,8 @@ private func outputProfiles(_ arguments: [String], start: Int = 23,
               let bitrate = Int(arguments[index + 4]),
               validVideoFormat(width, height, fps),
               width <= (source?.width ?? maxVideoDimension), height <= (source?.height ?? maxVideoDimension),
-              fps <= (source?.frameRate ?? 60),
-              bitrate >= 1000, bitrate <= (source?.bitrate ?? 50_000_000) else {
+              fps <= (source?.frameRate ?? maxVideoFramerate),
+              bitrate >= 1000, bitrate <= (source?.bitrate ?? maxVideoBitrate) else {
             throw CaptureFailure(description: "output profile is outside source bounds")
         }
         result.append(OutputProfile(width: width, height: height, fps: fps, bitrate: bitrate))
diff --git a/native/capture/linux/main.c b/native/capture/linux/main.c
index 01a4fe500..1e583cdde 100644
--- a/native/capture/linux/main.c
+++ b/native/capture/linux/main.c
@@ -19,8 +19,10 @@ enum {
   kMaxOutputs = 6,
   kMaxPayloadBytes = 4 * 1024 * 1024,
   kAudioFrameBytes = 960 * 2 * 2,
-  kMaxVideoDimension = 3840,
-  kMaxVideoPixels = 3840 * 2160,
+  kMaxVideoDimension = 8192,
+  kMaxVideoPixels = 36864 * 16 * 16,
+  kMaxVideoFramerate = 240,
+  kMaxVideoBitrate = 240000000,
 };
 
 typedef enum {
@@ -375,12 +377,12 @@ static gboolean parse_uint(const char *value, guint minimum, guint maximum,
 static gboolean valid_video_size(guint width, guint height) {
   return width >= 2 && width <= kMaxVideoDimension && width % 2 == 0 &&
          height >= 2 && height <= kMaxVideoDimension && height % 2 == 0 &&
-         (guint64)width * height <= kMaxVideoPixels;
+         (guint64)((width + 15) / 16) * ((height + 15) / 16) * 256 <= kMaxVideoPixels;
 }
 
 static gboolean valid_video_format(guint width, guint height, guint fps) {
   // Match the shared H.264 Level 5.2 receive ceiling, including numeric sizes.
-  return valid_video_size(width, height) && fps >= 1 && fps <= 60 &&
+  return valid_video_size(width, height) && fps >= 1 && fps <= kMaxVideoFramerate &&
          (guint64)((width + 15) / 16) * ((height + 15) / 16) * fps <= 2073600;
 }
 
@@ -401,8 +403,8 @@ static gboolean parse_outputs(int count, char **values, guint start, CaptureRun
     if (strcmp(values[offset], "--output") != 0 ||
         !parse_uint(values[offset + 1], 2, kMaxVideoDimension, &output->profile.width) ||
         !parse_uint(values[offset + 2], 2, kMaxVideoDimension, &output->profile.height) ||
-        !parse_uint(values[offset + 3], 1, 60, &output->profile.frame_rate) ||
-        !parse_uint(values[offset + 4], 1000, 50000000, &output->profile.bit_rate) ||
+        !parse_uint(values[offset + 3], 1, kMaxVideoFramerate, &output->profile.frame_rate) ||
+        !parse_uint(values[offset + 4], 1000, kMaxVideoBitrate, &output->profile.bit_rate) ||
         !valid_video_format(output->profile.width, output->profile.height,
                             output->profile.frame_rate)) return FALSE;
   }
@@ -454,8 +456,8 @@ static gboolean parse_profile(int count, char **values, CaptureRun *run,
       !parse_uint(values[9], 0, 63, encoder_index) ||
       !parse_uint(values[11], 1, 16384, &profile->width) ||
       !parse_uint(values[13], 1, 16384, &profile->height) ||
-      !parse_uint(values[15], 1, 60, &profile->frame_rate) ||
-      !parse_uint(values[17], 100000, 50000000, &profile->bit_rate)) {
+      !parse_uint(values[15], 1, kMaxVideoFramerate, &profile->frame_rate) ||
+      !parse_uint(values[17], 100000, kMaxVideoBitrate, &profile->bit_rate)) {
     return FALSE;
   }
   if (!valid_video_format(profile->width, profile->height, profile->frame_rate) ||
diff --git a/native/capture/linux/main.test.c b/native/capture/linux/main.test.c
index 8ea905433..0806cbcdc 100644
--- a/native/capture/linux/main.test.c
+++ b/native/capture/linux/main.test.c
@@ -165,8 +165,9 @@ static void check_slot_profiles(void) {
       {"3840", "2160", TRUE}, {"2160", "3840", TRUE}, {"3000", "2764", TRUE},
       {"0", "720", FALSE}, {"2", "720", FALSE}, {"1280", "2", FALSE},
       {"1279", "720", FALSE}, {"1280", "719", FALSE},
-      {"3842", "2160", FALSE}, {"2160", "3842", FALSE},
-      {"3840", "2162", FALSE}, {"3000", "2766", FALSE}};
+      {"5120", "1440", TRUE}, {"4096", "2304", TRUE},
+      {"8194", "100", FALSE}, {"5120", "2880", FALSE},
+      {"4096", "2306", FALSE}, {"6562", "1438", FALSE}};
   for (guint index = 0; index < G_N_ELEMENTS(sizes); ++index) {
     numeric[11] = numeric[24] = sizes[index].width;
     numeric[13] = numeric[25] = sizes[index].height;
@@ -182,7 +183,8 @@ static void check_slot_profiles(void) {
   g_assert_false(parse_profile(G_N_ELEMENTS(numeric), numeric, &run, &encoder));
   const struct { char *fps; char *bitrate; gboolean valid; } rates[] = {
       {"1", "100000", TRUE}, {"5", "800000", TRUE}, {"60", "50000000", TRUE},
-      {"0", "100000", FALSE}, {"1", "99999", FALSE}, {"60", "50000001", FALSE}};
+      {"60", "240000000", TRUE}, {"65", "100000000", FALSE},
+      {"0", "100000", FALSE}, {"1", "99999", FALSE}, {"60", "240000001", FALSE}};
   for (guint index = 0; index < G_N_ELEMENTS(rates); ++index) {
     numeric[15] = numeric[26] = rates[index].fps;
     numeric[17] = numeric[27] = rates[index].bitrate;
@@ -190,6 +192,14 @@ static void check_slot_profiles(void) {
     g_assert_cmpint(parse_profile(G_N_ELEMENTS(numeric), numeric, &run, &encoder), ==, rates[index].valid);
   }
   g_assert_false(valid_video_format(G_MAXUINT, G_MAXUINT, G_MAXUINT));
+  numeric[11] = numeric[24] = "1920";
+  numeric[13] = numeric[25] = "1080";
+  numeric[15] = numeric[26] = "240";
+  numeric[17] = numeric[27] = "240000000";
+  run = (CaptureRun){0};
+  g_assert_true(parse_profile(G_N_ELEMENTS(numeric), numeric, &run, &encoder));
+  numeric[15] = numeric[26] = "241";
+  g_assert_false(parse_profile(G_N_ELEMENTS(numeric), numeric, &run, &encoder));
 }
 
 static GstPadProbeReturn record_key_request(GstPad *pad, GstPadProbeInfo *info,
diff --git a/native/capture/windows/h264_decoder.h b/native/capture/windows/h264_decoder.h
index 76cced74e..1a5f29c14 100644
--- a/native/capture/windows/h264_decoder.h
+++ b/native/capture/windows/h264_decoder.h
@@ -39,16 +39,14 @@ class H264Decoder final {
     }
     Microsoft::WRL::ComPtr<ICodecAPI> codec;
     Check(decoder_.As(&codec), "codec-api");
-    for (const auto& setting : {
-             std::pair<GUID, ULONG>{CODECAPI_AVLowLatencyMode, TRUE},
-             std::pair<GUID, ULONG>{CODECAPI_AVDecVideoMaxCodedWidth, kMaxCodedVideoDimension},
-             std::pair<GUID, ULONG>{CODECAPI_AVDecVideoMaxCodedHeight, kMaxCodedVideoDimension}}) {
-      VARIANT value;
-      VariantInit(&value);
-      value.vt = VT_UI4;
-      value.ulVal = setting.second;
-      Check(codec->SetValue(&setting.first, &value), "codec-setting");
-    }
+    VARIANT value;
+    VariantInit(&value);
+    value.vt = VT_UI4;
+    value.ulVal = TRUE;
+    Check(codec->SetValue(&CODECAPI_AVLowLatencyMode, &value), "codec-setting");
+    // Let the MFT own its supported dimensions. Setting both global axis
+    // ceilings preallocates a square and can fail even for a small input.
+    // Go validates SPS storage before this process; SelectOutput bounds its buffers.
   }
 
   ~H264Decoder() {
diff --git a/native/capture/windows/main.cpp b/native/capture/windows/main.cpp
index 542fe737e..7f650f23b 100644
--- a/native/capture/windows/main.cpp
+++ b/native/capture/windows/main.cpp
@@ -968,7 +968,7 @@ DegradationPreference ParseDegradationPreference(const wchar_t* value) {
 void ValidateVideoProfile(const VideoProfile& profile) {
   if (!piik::capture::ValidVideoFormat(profile.width, profile.height, profile.frame_rate) ||
       profile.width < 4 || profile.height < 4 ||
-      profile.bit_rate < 100'000 || profile.bit_rate > 50'000'000) {
+      profile.bit_rate < 100'000 || profile.bit_rate > piik::capture::kMaxVideoBitrate) {
     Fail("argument-profile", "video profile is outside the product bounds");
   }
 }
@@ -982,7 +982,7 @@ void ParseOutputProfiles(ProductArguments& arguments, int first, int count, wcha
     output.frame_rate = ParseIndex(values[index + 3], "argument-output-fps");
     output.bit_rate = ParseIndex(values[index + 4], "argument-output-bitrate");
     if (!piik::capture::ValidVideoFormat(output.width, output.height, output.frame_rate) ||
-        output.bit_rate < 1'000 || output.bit_rate > 50'000'000) {
+        output.bit_rate < 1'000 || output.bit_rate > piik::capture::kMaxVideoBitrate) {
       Fail("argument-output", "output profile exceeds codec bounds");
     }
     if (arguments.mode == ProductArguments::Mode::video &&
diff --git a/native/capture/windows/output_worker.test.cpp b/native/capture/windows/output_worker.test.cpp
index b2e6e2e8c..a5316e7f0 100644
--- a/native/capture/windows/output_worker.test.cpp
+++ b/native/capture/windows/output_worker.test.cpp
@@ -405,12 +405,17 @@ int main() {
   ValidateVideoProfile(profile);
   for (const auto& requested : {VideoProfile{1280, 720, 1, 100'000},
                                VideoProfile{1280, 720, 5, 800'000},
-                               VideoProfile{3840, 2160, 60, 50'000'000}}) {
+                               VideoProfile{3840, 2160, 60, 50'000'000},
+                               VideoProfile{1920, 1080, 240, 240'000'000},
+                               VideoProfile{2560, 1440, 144, 100'000'000},
+                               VideoProfile{5120, 1440, 60, 100'000'000},
+                               VideoProfile{4096, 2304, 56, 80'000'000}}) {
     ValidateVideoProfile(requested);
   }
   for (const auto& requested : {VideoProfile{1280, 720, 0, 100'000},
                                VideoProfile{1280, 720, 1, 99'999},
-                               VideoProfile{3840, 2160, 60, 50'000'001}}) {
+                               VideoProfile{3840, 2160, 60, 240'000'001},
+                               VideoProfile{1920, 1080, 241, 100'000'000}}) {
     try {
       ValidateVideoProfile(requested);
       assert(false);
@@ -423,8 +428,8 @@ int main() {
     ValidateVideoProfile(VideoProfile{static_cast<UINT32>(size.cx), static_cast<UINT32>(size.cy), 60, 3'000'000});
   }
   for (const SIZE size : {SIZE{0, 720}, SIZE{2, 720}, SIZE{1280, 2}, SIZE{1279, 720},
-                          SIZE{1280, 719}, SIZE{3842, 2160}, SIZE{2160, 3842},
-                          SIZE{3840, 2162}, SIZE{3000, 2766}}) {
+                          SIZE{1280, 719}, SIZE{8194, 100}, SIZE{5120, 2880},
+                          SIZE{4096, 2306}, SIZE{6562, 1438}}) {
     try {
       ValidateVideoProfile(VideoProfile{static_cast<UINT32>(size.cx), static_cast<UINT32>(size.cy), 30, 3'000'000});
       assert(false);
@@ -435,7 +440,7 @@ int main() {
   assert(piik::capture::ValidVideoFormat(3840, 2160, 30));
   assert(piik::capture::ValidVideoFormat(3840, 2160, 60));
   assert(piik::capture::ValidVideoFormat(2160, 3840, 60));
-  assert(!piik::capture::ValidVideoFormat(3840, 2160, 61));
+  assert(!piik::capture::ValidVideoFormat(3840, 2160, 65));
   assert(!piik::capture::ValidVideoFormat(UINT32_MAX, UINT32_MAX, UINT32_MAX));
   assert(piik::capture::ValidCodedVideoSize(3840, 2176));
   assert(piik::capture::ValidCodedVideoSize(2176, 3840));
diff --git a/native/capture/windows/video_bounds.h b/native/capture/windows/video_bounds.h
index 93648722e..1b8316cf9 100644
--- a/native/capture/windows/video_bounds.h
+++ b/native/capture/windows/video_bounds.h
@@ -4,20 +4,22 @@
 
 namespace piik::capture {
 
-inline constexpr uint32_t kMaxVideoDimension = 3840;
-inline constexpr uint64_t kMaxVideoPixels = 3840 * 2160;
+inline constexpr uint32_t kMaxVideoDimension = 8192;
+inline constexpr uint64_t kMaxVideoPixels = 36'864 * 16 * 16;
+inline constexpr uint32_t kMaxVideoFramerate = 240;
+inline constexpr uint32_t kMaxVideoBitrate = 240'000'000;
 // H.264 Level 5.2 coded storage, including padding outside the visible crop.
-inline constexpr uint32_t kMaxCodedVideoDimension = 4096;
+inline constexpr uint32_t kMaxCodedVideoDimension = 8192;
 inline constexpr uint64_t kMaxCodedVideoPixels = 36'864 * 16 * 16;
 
 inline bool ValidVideoSize(uint32_t width, uint32_t height) {
   return width >= 2 && width <= kMaxVideoDimension && !(width & 1) &&
          height >= 2 && height <= kMaxVideoDimension && !(height & 1) &&
-         static_cast<uint64_t>(width) * height <= kMaxVideoPixels;
+         static_cast<uint64_t>((width + 15) / 16) * ((height + 15) / 16) * 256 <= kMaxVideoPixels;
 }
 
 inline bool ValidVideoFormat(uint32_t width, uint32_t height, uint32_t fps) {
-  return ValidVideoSize(width, height) && fps >= 1 && fps <= 60 &&
+  return ValidVideoSize(width, height) && fps >= 1 && fps <= kMaxVideoFramerate &&
          static_cast<uint64_t>((width + 15) / 16) * ((height + 15) / 16) * fps <= 2'073'600;
 }
 
diff --git a/src/client/components/living/AppConnectionButton.tsx b/src/client/components/living/AppConnectionButton.tsx
index 7ab0d3aa5..4a8ce8b5d 100644
--- a/src/client/components/living/AppConnectionButton.tsx
+++ b/src/client/components/living/AppConnectionButton.tsx
@@ -1,5 +1,5 @@
 import { useEffect, useRef, useState } from "react";
-import { activateClient } from "../../lib/session";
+import { activateClient, isClientActivated } from "../../lib/session";
 import { useCopy } from "../../ui/copy";
 import { Glyph } from "../../ui/icons";
 import { Tooltip } from "./Tooltip";
@@ -9,12 +9,38 @@ export function AppConnectionButton({ sourcePicker = false, onConnected }: {
   onConnected?: () => void;
 } = {}) {
   const { t, vis } = useCopy();
-  const [state, setState] = useState<"idle" | "busy" | "unavailable" | "incompatible">("idle");
+  const [state, setState] = useState<"idle" | "busy" | "ready" | "unavailable" | "incompatible">("idle");
   const pending = useRef<{ controller: AbortController; popup: Window | null } | null>(null);
+  const healthCheck = useRef<AbortController | null>(null);
+  useEffect(() => {
+    if (sourcePicker) return;
+    const refresh = async () => {
+      if (pending.current || !isClientActivated()) return;
+      healthCheck.current?.abort();
+      const current = healthCheck.current = new AbortController();
+      const native = await import("../../native/client");
+      if (current.signal.aborted) return;
+      try {
+        const health = await native.discoverNativeHealth({ signal: current.signal, waitForPermission: false });
+        if (!current.signal.aborted && !pending.current) setState(health ? "ready" : "idle");
+      } catch (error) {
+        if (!current.signal.aborted && !pending.current) {
+          setState(error instanceof native.NativeCompatibilityError ? "incompatible" : "idle");
+        }
+      }
+    };
+    // Launch/remembered activation is intent, not proof of current permission.
+    // Recheck on return without keeping a media session or a polling timer alive.
+    const onFocus = () => { void refresh().catch(() => undefined); };
+    onFocus();
+    window.addEventListener("focus", onFocus);
+    return () => { healthCheck.current?.abort(); window.removeEventListener("focus", onFocus); };
+  }, [sourcePicker]);
   useEffect(() => () => { pending.current?.controller.abort(); pending.current?.popup?.close(); }, []);
 
   async function connect(): Promise<void> {
     if (pending.current) return;
+    healthCheck.current?.abort();
     // Reserve the window during the click, before local-network discovery waits.
     const attempt = { controller: new AbortController(), popup: window.open("about:blank", "_blank") };
     if (!attempt.popup) { setState("unavailable"); return; }
@@ -30,7 +56,7 @@ export function AppConnectionButton({ sourcePicker = false, onConnected }: {
       // The approval message only asks us to recheck the App-owned permission.
       const health = await native?.discoverNativeHealth({ signal }).catch(() => null);
       if (signal.aborted) return;
-      finish(health ? "idle" : "unavailable");
+      finish(health ? "ready" : "unavailable");
       if (health) {
         activateClient();
         onConnected?.();
@@ -66,14 +92,15 @@ export function AppConnectionButton({ sourcePicker = false, onConnected }: {
     }
   }
 
-  const label = t(state === "incompatible" ? "native.incompatible" :
+  const label = t(state === "ready" ? "client.connect.standby" : state === "incompatible" ? "native.incompatible" :
     state === "unavailable" ? "client.connect.unavailable" : sourcePicker ? "client.connect.captureHint" : "client.connect.action");
   return <Tooltip kind={state === "unavailable" ? "signal-failed" : state === "incompatible" ? "warning" : "hint-client-site"}
-    text={vis ? undefined : label} place={sourcePicker ? "above" : "below"} align={sourcePicker ? "center" : "end"}>
-    <button type="button" className={sourcePicker ? "lr-source-picker-refresh lr-source-app-connect" : "lr-btn lr-app-connect"}
+    text={vis ? undefined : label} toggleOnClick={state === "ready"}
+    place={sourcePicker ? "above" : "below"} align={sourcePicker ? "center" : "end"}>
+    <button type="button" className={`${sourcePicker ? "lr-source-picker-refresh lr-source-app-connect" : "lr-btn lr-app-connect"}${state === "ready" ? " is-ready" : ""}`}
       aria-label={sourcePicker ? t("client.connect.action") : label} aria-busy={state === "busy" || undefined}
-      onClick={() => void connect()} disabled={state === "busy"}>
-      <Glyph name={state === "busy" ? "loader" : state === "unavailable" || state === "incompatible" ? "alert" : "window"}
+      onClick={state === "ready" ? undefined : () => void connect()} disabled={state === "busy"}>
+      <Glyph name={state === "ready" ? "check" : state === "busy" ? "loader" : state === "unavailable" || state === "incompatible" ? "alert" : "window"}
         size={16} className={state === "busy" ? "lr-spin" : undefined} />
       {vis ? null : <span className="lr-cap">{sourcePicker ? t("client.connect.action") : "App"}</span>}
     </button>
diff --git a/src/client/components/living/QualityPresets.tsx b/src/client/components/living/QualityPresets.tsx
index 6eedf09d1..1c81e82c1 100644
--- a/src/client/components/living/QualityPresets.tsx
+++ b/src/client/components/living/QualityPresets.tsx
@@ -74,6 +74,24 @@ export function ResolutionControl({ value, limits, disabled, onChange }: {
       if (event.key === "Escape") reset(event.currentTarget);
       event.target.blur();
     }}>
+    <div className="lr-quality-heading">
+      <span className="lr-door-glyph"><Glyph name="expand" size={19} /><Cap k="host.advanced.resolution" /></span>
+      <Tooltip kind="hint-quality" text={vis ? undefined : t("host.video.resolutionHint", {
+        width: String(limits.maxVideoResolution.width), height: String(limits.maxVideoResolution.height),
+        pixels: limits.maxVideoPixels.toLocaleString("en-US"),
+      })}>
+        <span className="lr-input lr-video-size" key={`${value.width}x${value.height}`}
+          role="group" aria-label={t("host.advanced.resolution")}>
+          {axes.map((axis, index) => <Fragment key={axis}>
+            {index === 1 ? <span aria-hidden="true">×</span> : null}
+            <input type="number" inputMode="numeric" name={axis} defaultValue={value[axis]}
+              min={4} max={limits.maxVideoResolution[axis]} step={2} disabled={disabled}
+              aria-label={t(axis === "width" ? "host.video.width" : "host.video.height")} />
+          </Fragment>)}
+          <span aria-hidden="true">px</span>
+        </span>
+      </Tooltip>
+    </div>
     <div className="lr-row-group" role="group" aria-label={t("host.advanced.resolution")}>
       {Object.entries(QUALITY_RESOLUTIONS).map(([label, resolution]) => <Chip key={label}
         selected={qualityResolutionEqual(value, resolution)}
@@ -84,21 +102,6 @@ export function ResolutionControl({ value, limits, disabled, onChange }: {
           onChange(resolution);
         }}>{label}</Chip>)}
     </div>
-    <Tooltip kind="hint-quality" text={vis ? undefined : t("host.video.resolutionHint", {
-      width: String(limits.maxVideoResolution.width), height: String(limits.maxVideoResolution.height),
-      pixels: limits.maxVideoPixels.toLocaleString("en-US"),
-    })}>
-      <span className="lr-input lr-video-size" key={`${value.width}x${value.height}`}
-        role="group" aria-label={t("host.advanced.resolution")}>
-        {axes.map((axis, index) => <Fragment key={axis}>
-          {index === 1 ? <span aria-hidden="true">×</span> : null}
-          <input type="number" inputMode="numeric" name={axis} defaultValue={value[axis]}
-            min={4} max={limits.maxVideoResolution[axis]} step={2} disabled={disabled}
-            aria-label={t(axis === "width" ? "host.video.width" : "host.video.height")} />
-        </Fragment>)}
-        <span aria-hidden="true">px</span>
-      </span>
-    </Tooltip>
   </div>;
 }
 
@@ -166,21 +169,22 @@ export function VideoRateControls({ value, limits, disabled, onChange }: {
       change: (mbps: number) => onChange({ maxBitrate: Math.round(mbps * 1_000_000) }) },
   ] as const;
   return <div className="lr-sharing-limits">
-    {controls.map(control => <div className="lr-door-group" key={control.name}>
-      <span className="lr-door-glyph"><Glyph name={control.icon} size={19} /><Cap k={control.label} /></span>
-      <Tooltip kind={control.hint} text={vis ? undefined : t(control.label)} className="lr-slider-hint">
-        <QualityNumberControl {...control} className="lr-quality-rate" label={t(control.label)}
-          disabled={disabled || control.max < control.min} onChange={control.change}>
-          {(input, select) => <>
-            <input type="range" min={control.min} max={Math.max(control.min, control.max)} step={control.step}
-              value={control.value} disabled={disabled || control.max < control.min} aria-label={t(control.label)}
-              onChange={event => select(event.currentTarget.valueAsNumber)}
-              onClick={event => select(event.currentTarget.valueAsNumber)} />
+    {controls.map(control => <QualityNumberControl key={control.name} {...control}
+      className="lr-quality-rate" label={t(control.label)}
+      disabled={disabled || control.max < control.min} onChange={control.change}>
+      {(input, select) => <>
+        <div className="lr-quality-heading">
+          <span className="lr-door-glyph"><Glyph name={control.icon} size={19} /><Cap k={control.label} /></span>
+          <Tooltip kind={control.hint} text={vis ? undefined : `${t(control.label)}: ${control.min}–${control.max} ${control.unit}`}>
             {input}
-          </>}
-        </QualityNumberControl>
-      </Tooltip>
-    </div>)}
+          </Tooltip>
+        </div>
+        <input type="range" min={control.min} max={Math.max(control.min, control.max)} step={control.step}
+          value={control.value} disabled={disabled || control.max < control.min} aria-label={t(control.label)}
+          onChange={event => select(event.currentTarget.valueAsNumber)}
+          onClick={event => select(event.currentTarget.valueAsNumber)} />
+      </>}
+    </QualityNumberControl>)}
   </div>;
 }
 
@@ -191,26 +195,26 @@ export function AudioBitrateControl({ value, max, disabled, onChange }: {
   onChange: (bitrate: number) => void;
 }) {
   const { t, vis } = useCopy();
-  return <div className="lr-door-group">
-    <span className="lr-door-glyph"><Glyph name="speaker" size={19} /><Cap k="host.advanced.audio" /></span>
-    <QualityNumberControl value={value / 1_000} min={MIN_AUDIO_BITRATE / 1_000} max={max / 1_000} step={1}
-      name="audioBitrate" unit="kbps" label={t("host.advanced.audioBitrate")} className="lr-door-group"
-      disabled={disabled} onChange={kbps => onChange(kbps * 1_000)}>
-      {(input, select) => <>
-        <div className="lr-row-group" role="group" aria-label={t("host.advanced.audio")}>
-          {(Object.keys(SCREEN_AUDIO_BITRATES) as ScreenAudioPreset[]).map(preset => {
-            const bitrate = SCREEN_AUDIO_BITRATES[preset];
-            return <Chip key={preset} selected={value === bitrate} disabled={disabled || bitrate > max}
-              title={t("host.audio.title", { label: t(AUDIO_QUALITY_CAPTIONS[preset]), kbps: String(bitrate / 1_000) })}
-              hint="hint-audio-quality" onClick={() => select(bitrate / 1_000)}>
-              <Cap k={AUDIO_QUALITY_CAPTIONS[preset]} /><small className="lr-audio-rate">{bitrate / 1_000}</small>
-            </Chip>;
-          })}
-        </div>
+  return <QualityNumberControl value={value / 1_000} min={MIN_AUDIO_BITRATE / 1_000} max={max / 1_000} step={1}
+    name="audioBitrate" unit="kbps" label={t("host.advanced.audioBitrate")} className="lr-door-group"
+    disabled={disabled} onChange={kbps => onChange(kbps * 1_000)}>
+    {(input, select) => <>
+      <div className="lr-quality-heading">
+        <span className="lr-door-glyph"><Glyph name="speaker" size={19} /><Cap k="host.advanced.audio" /></span>
         <Tooltip kind="hint-audio-quality" text={vis ? undefined : t("host.audio.bitrateHint", {
           min: String(MIN_AUDIO_BITRATE / 1_000), max: String(max / 1_000),
         })}>{input}</Tooltip>
-      </>}
-    </QualityNumberControl>
-  </div>;
+      </div>
+      <div className="lr-row-group" role="group" aria-label={t("host.advanced.audio")}>
+        {(Object.keys(SCREEN_AUDIO_BITRATES) as ScreenAudioPreset[]).map(preset => {
+          const bitrate = SCREEN_AUDIO_BITRATES[preset];
+          return <Chip key={preset} selected={value === bitrate} disabled={disabled || bitrate > max}
+            title={t("host.audio.title", { label: t(AUDIO_QUALITY_CAPTIONS[preset]), kbps: String(bitrate / 1_000) })}
+            hint="hint-audio-quality" onClick={() => select(bitrate / 1_000)}>
+            <Cap k={AUDIO_QUALITY_CAPTIONS[preset]} /><small className="lr-audio-rate">{bitrate / 1_000}</small>
+          </Chip>;
+        })}
+      </div>
+    </>}
+  </QualityNumberControl>;
 }
diff --git a/src/client/media/quality.ts b/src/client/media/quality.ts
index eff1c782c..390265853 100644
--- a/src/client/media/quality.ts
+++ b/src/client/media/quality.ts
@@ -34,13 +34,15 @@ export interface VideoCaptureLimits {
 }
 
 // Current output boundary, independent of descriptive wire bounds and UI presets.
-// H.264 Level 5.2 admits 4K60 in either orientation; actual output still adapts.
+// H.264 Level 5.2 bounds frame area, processing rate and bitrate independently.
+// Keep a finite 240 fps scheduling budget; ultrawide/high-refresh inputs need
+// not fit a named preset. Actual output still depends on the source and encoder.
 export const VIDEO_CAPTURE_LIMITS: VideoCaptureLimits = {
-  maxVideoResolution: { width: 3840, height: 3840 },
-  maxVideoPixels: 3840 * 2160,
+  maxVideoResolution: { width: 8192, height: 8192 },
+  maxVideoPixels: 36_864 * 16 * 16,
   maxVideoMacroblocksPerSecond: 2_073_600,
-  maxVideoFramerate: 60,
-  maxVideoBitrate: 50_000_000,
+  maxVideoFramerate: 240,
+  maxVideoBitrate: 240_000_000,
 };
 
 export function videoCaptureLimits(advertised?: Partial<VideoCaptureLimits>): VideoCaptureLimits {
@@ -61,7 +63,8 @@ export function videoCaptureLimits(advertised?: Partial<VideoCaptureLimits>): Vi
 export function captureFramerateCeiling(size: QualityResolution, limits = VIDEO_CAPTURE_LIMITS): number {
   if (![size.width, size.height].every(value => Number.isInteger(value) && value >= 4 && value % 2 === 0)
     || size.width > limits.maxVideoResolution.width || size.height > limits.maxVideoResolution.height
-    || size.width * size.height > limits.maxVideoPixels) return 0;
+    || size.width * size.height > limits.maxVideoPixels
+    || Math.ceil(size.width / 16) * Math.ceil(size.height / 16) * 256 > VIDEO_CAPTURE_LIMITS.maxVideoPixels) return 0;
   return Math.floor(Math.min(limits.maxVideoFramerate, limits.maxVideoMacroblocksPerSecond /
     (Math.ceil(size.width / 16) * Math.ceil(size.height / 16))));
 }
diff --git a/src/client/pages/ControlsPreview.tsx b/src/client/pages/ControlsPreview.tsx
index 1d624a3ed..144592dc4 100644
--- a/src/client/pages/ControlsPreview.tsx
+++ b/src/client/pages/ControlsPreview.tsx
@@ -21,7 +21,7 @@ import { useTheaterMode } from "../components/living/use-theater-mode";
 
 import { AudioBitrateControl, QualityPresets, ResolutionControl, VideoRateControls } from "../components/living/QualityPresets";
 import { RoomCodeInput } from "../components/living/RoomCodeInput";
-import { MAX_SCREEN_AUDIO_BITRATE, VIDEO_CAPTURE_LIMITS, QUALITY_PROFILES, matchingQualityProfileId, type QualityProfile } from "../media/quality";
+import { MAX_SCREEN_AUDIO_BITRATE, VIDEO_CAPTURE_LIMITS, QUALITY_PROFILES, captureFramerateCeiling, matchingQualityProfileId, type QualityProfile } from "../media/quality";
 import type { loadCameraPreviews } from "../media/camera-previews";
 import { Tooltip } from "../components/living/Tooltip";
 import { StatusIndicator } from "../components/living/StatusIndicator";
@@ -120,7 +120,9 @@ export function ControlsPreview() {
           presets={<QualityPresets selected={matchingQualityProfileId(quality)}
             onSelect={id => setQuality(current => ({ ...QUALITY_PROFILES[id], maxAudioBitrate: current.maxAudioBitrate }))} />}
           picture={<><ResolutionControl value={quality.resolution} limits={VIDEO_CAPTURE_LIMITS} disabled={false}
-            onChange={resolution => setQuality(current => ({ ...current, resolution }))} />
+            onChange={resolution => setQuality(current => ({ ...current, resolution,
+              maxFramerate: Math.min(current.maxFramerate, captureFramerateCeiling(resolution)),
+            }))} />
             <VideoRateControls value={quality} limits={VIDEO_CAPTURE_LIMITS} disabled={false}
               onChange={change => setQuality(current => ({ ...current, ...change }))} /></>}
           audio={<><div className="lr-door-group lr-source-audio-settings">
diff --git a/src/client/pages/HostPage.tsx b/src/client/pages/HostPage.tsx
index 5e8afb432..6d55c993b 100644
--- a/src/client/pages/HostPage.tsx
+++ b/src/client/pages/HostPage.tsx
@@ -3822,19 +3822,11 @@ export function HostPage({
                 })} />
             }
             picture={<>
-              <div className="lr-door-group">
-                <span
-                  className="lr-door-glyph"
-                >
-                  <Glyph name="expand" size={19} />
-                  <Cap k="host.advanced.resolution" />
-                </span>
-                <ResolutionControl value={advancedQuality.resolution} limits={videoLimits}
-                  disabled={phase === "starting" || switchingSource}
-                  onChange={resolution => changeAdvancedQuality({ resolution,
-                    maxFramerate: Math.min(advancedQualityRef.current.maxFramerate, captureFramerateCeiling(resolution, videoLimits)),
-                  })} />
-              </div>
+              <ResolutionControl value={advancedQuality.resolution} limits={videoLimits}
+                disabled={phase === "starting" || switchingSource}
+                onChange={resolution => changeAdvancedQuality({ resolution,
+                  maxFramerate: Math.min(advancedQualityRef.current.maxFramerate, captureFramerateCeiling(resolution, videoLimits)),
+                })} />
               <VideoRateControls value={advancedQuality} limits={videoLimits}
                 disabled={phase === "starting" || switchingSource} onChange={changeAdvancedQuality} />
               <div className="lr-door-group">
diff --git a/src/client/styles.css b/src/client/styles.css
index 5c4b76559..6746d7702 100644
--- a/src/client/styles.css
+++ b/src/client/styles.css
@@ -1010,6 +1010,8 @@ html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #334
 .lr-btn.is-on { border-color: var(--ink); background: var(--ink); color: var(--paper); }
 .lr-btn .lr-cap { margin-left: 2px; font-size: 12.5px; font-weight: 600; }
 .lr-app-connect { min-width: 40px; height: 40px; }
+.lr-app-connect.is-ready { color: var(--live); cursor: default; }
+.lr-app-connect.is-ready:hover { transform: none; }
 .lr-cap { font-size: 12.5px; font-weight: 600; color: inherit; white-space: nowrap; }
 
 /* Sharing and local playback have distinct owners, but one control grammar. */
@@ -1181,16 +1183,23 @@ html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #334
 .lr-input:focus-within { border-color: var(--action); outline: 3px solid var(--action); outline-offset: 2px; }
 .lr-input input { min-width: 0; flex: 1; height: 100%; border: 0; outline: 0; background: transparent; font: inherit; font-size: 16px; }
 .lr-input input[type="password"]:not(:placeholder-shown) { letter-spacing: .25em; }
-.lr-input.lr-quality-number { width: 160px; max-width: 100%; font-family: var(--mono); }
-.lr-quality-number span { color: var(--muted); font-size: 12px; }
-.lr-quality-rate { display: flex; align-items: center; gap: 10px; width: 100%; min-width: 0; }
-.lr-quality-rate > input { flex: 1; min-width: 0; width: 0; height: 32px; accent-color: var(--action); }
-.lr-quality-rate .lr-quality-number { flex: 0 0 132px; min-height: 40px; padding: 6px 10px; }
-.lr-input.lr-video-size { display: grid; grid-template-columns: minmax(0, 1fr) auto minmax(0, 1fr) auto; gap: 4px; padding-inline: 8px; width: 252px; max-width: 100%; font-family: var(--mono); }
+.lr-quality-heading { display: flex; flex-wrap: wrap; align-items: center; justify-content: space-between; gap: 6px 12px; min-width: 0; }
+.lr-quality-heading > .lr-comic-tip-wrap { margin-inline-start: auto; max-width: 100%; }
+.lr-input.lr-quality-number, .lr-input.lr-video-size {
+  height: 36px; padding: 0 10px; border-width: 1px; border-radius: 12px;
+  background: var(--wall); max-width: 100%; font-family: var(--mono);
+}
+.lr-input.lr-quality-number { width: 110px; gap: 6px; }
+.lr-quality-number input, .lr-video-size input { font-size: 13px; font-weight: 650; appearance: textfield; }
+.lr-quality-number input { text-align: right; }
+.lr-quality-number span, .lr-video-size span { color: var(--muted); font-size: 11px; }
+.lr-quality-number input::-webkit-inner-spin-button, .lr-quality-number input::-webkit-outer-spin-button,
+.lr-video-size input::-webkit-inner-spin-button, .lr-video-size input::-webkit-outer-spin-button { appearance: none; margin: 0; }
+.lr-quality-rate { display: grid; gap: 4px; width: 100%; min-width: 0; }
+.lr-quality-rate > input { min-width: 0; width: 100%; height: 28px; margin: 0; accent-color: var(--action); }
+.lr-input.lr-video-size { display: grid; grid-template-columns: minmax(0, 1fr) auto minmax(0, 1fr) auto; gap: 5px; width: 176px; }
 .lr-resolution-controls { display: flex; flex-direction: column; gap: 8px; min-width: 0; }
 .lr-video-size input { width: 100%; padding: 0; text-align: center; appearance: textfield; }
-.lr-video-size input::-webkit-inner-spin-button, .lr-video-size input::-webkit-outer-spin-button { appearance: none; margin: 0; }
-.lr-video-size span { color: var(--muted); font-size: 12px; }
 .lr-welcome { width: 100%; min-width: 0; max-width: 100%; margin: 0; overflow: hidden; color: inherit; font-size: 15px; font-weight: 600; line-height: 1.7; text-align: center; white-space: nowrap; text-overflow: ellipsis; }
 .lr-welcome:not(.is-cipher)::before { content: "✦"; color: #d7982b; margin-right: 8px; }
 .lr-welcome-cipher { display: inline-flex; align-items: center; gap: 8px; vertical-align: middle; opacity: .72; white-space: nowrap; }
@@ -1874,11 +1883,6 @@ html[data-theme="dark"] .lr-switch::after { background: var(--ink); }
   .lr-sharing-columns { grid-template-columns: 1fr; gap: 22px; }
   .lr-sharing-section + .lr-sharing-section { padding: 20px 0 0; border-inline-start: 0; border-top: 1px solid var(--wall-2); }
 }
-@container sharing-settings (max-width: 260px) {
-  .lr-quality-rate { flex-direction: column-reverse; align-items: stretch; gap: 2px; }
-  .lr-quality-rate > input { flex: auto; width: 100%; margin-inline: 0; }
-  .lr-quality-rate .lr-quality-number { flex: auto; width: 100%; }
-}
 .lr-host-share-controls {
   display: flex; flex-wrap: wrap; align-items: center; justify-content: center; gap: 4px;
   width: fit-content; max-width: 100%; margin: 12px auto 0; padding: 6px;
diff --git a/tests/app-connection-button.test.ts b/tests/app-connection-button.test.ts
index 941625f18..6ac60d5a9 100644
--- a/tests/app-connection-button.test.ts
+++ b/tests/app-connection-button.test.ts
@@ -9,24 +9,25 @@ const source = ts.createSourceFile("AppConnectionButton.tsx", readFileSync(
   new URL("../src/client/components/living/AppConnectionButton.tsx", import.meta.url), "utf8",
 ), ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
 let connect: string | undefined;
-let effect: string | undefined;
+const effects: string[] = [];
 function collect(node: ts.Node): void {
   if (ts.isFunctionDeclaration(node) && node.name?.text === "connect") connect = node.getText(source);
   if (ts.isCallExpression(node) && node.expression.getText(source) === "useEffect") {
-    effect = node.arguments[0]!.getText(source);
+    effects.push(node.arguments[0]!.getText(source));
   }
   ts.forEachChild(node, collect);
 }
 collect(source);
-if (!connect || !effect) throw new Error("Missing App connection operation or cleanup");
-const executable = ts.transpileModule(`${connect}\n({ connect, cleanup: (${effect})() });`, {
+if (!connect || !effects.length) throw new Error("Missing App connection operation or cleanup");
+const executable = ts.transpileModule(`${connect}\nconst cleanups = [${effects.map(effect => `(${effect})()`).join(",")}];
+  ({ connect, cleanup: () => cleanups.reverse().forEach(fn => fn?.()) });`, {
   compilerOptions: { target: ts.ScriptTarget.ES2022, module: ts.ModuleKind.CommonJS },
 }).outputText;
 const settle = () => new Promise<void>(resolve => setImmediate(resolve));
 const site = "https://site.example";
 const approval = `http://127.0.0.1:39721/client?site=${encodeURIComponent(site)}`;
 
-function mount() {
+function mount(activated = false) {
   const popup = { closed: false, close: vi.fn(() => { popup.closed = true; }), location: { replace: vi.fn() } };
   const window = Object.assign(new EventTarget(), { open: vi.fn(() => popup), location: { origin: site } });
   const native = {
@@ -35,11 +36,13 @@ function mount() {
     NativeCompatibilityError: class extends Error {},
   };
   const pending = { current: null as { controller: AbortController } | null };
+  const healthCheck = { current: null as AbortController | null };
   const setState = vi.fn();
   const activateClient = vi.fn();
   const onConnected = vi.fn();
   const operation = runInNewContext(executable, {
-    window, pending, setState, activateClient, onConnected, AbortController, URL,
+    window, pending, healthCheck, setState, activateClient, onConnected, AbortController, URL,
+    sourcePicker: false, isClientActivated: () => activated,
     require: (path: string) => {
       if (path !== "../../native/client") throw new Error(`Unexpected dependency: ${path}`);
       return native;
@@ -76,6 +79,7 @@ describe("App connection approval", () => {
     await settle();
     expect(page.activateClient).toHaveBeenCalledOnce();
     expect(page.onConnected).toHaveBeenCalledOnce();
+    expect(page.setState).toHaveBeenLastCalledWith("ready");
     expect(page.popup.closed).toBe(true);
     expect(page.pending.current).toBeNull();
     expect(page.native.discoverNativeConnect.mock.calls[0]![0].aborted).toBe(true);
@@ -145,4 +149,34 @@ describe("App connection approval", () => {
     expect(page.window.open).toHaveBeenCalledTimes(2);
     page.cleanup();
   });
+
+  it("verifies remembered activation without prompting and refreshes it on return", async () => {
+    const page = mount(true);
+    await settle();
+    expect(page.native.discoverNativeHealth).toHaveBeenCalledWith(expect.objectContaining({ waitForPermission: false }));
+    expect(page.setState).toHaveBeenLastCalledWith("ready");
+    expect(page.window.open).not.toHaveBeenCalled();
+    expect(page.activateClient).not.toHaveBeenCalled();
+    page.native.discoverNativeHealth.mockResolvedValue(null);
+    page.window.dispatchEvent(new Event("focus"));
+    await settle();
+    expect(page.setState).toHaveBeenLastCalledWith("idle");
+    page.cleanup();
+  });
+
+  it("does not let an earlier health check overwrite a newer approval", async () => {
+    const page = mount(true);
+    let complete!: (health: object | null) => void;
+    page.native.discoverNativeHealth.mockImplementationOnce(() => new Promise(resolve => { complete = resolve; }));
+    await settle();
+    await page.connect();
+    expect(page.native.discoverNativeHealth.mock.calls[0]![0].signal.aborted).toBe(true);
+    page.message();
+    await settle();
+    expect(page.setState).toHaveBeenLastCalledWith("ready");
+    complete(null);
+    await settle();
+    expect(page.setState).toHaveBeenLastCalledWith("ready");
+    page.cleanup();
+  });
 });
diff --git a/tests/host-quality-ownership.test.ts b/tests/host-quality-ownership.test.ts
index 986ec250c..dd1283155 100644
--- a/tests/host-quality-ownership.test.ts
+++ b/tests/host-quality-ownership.test.ts
@@ -548,7 +548,7 @@ describe("Host room-link copy feedback", () => {
 describe("Host quality ownership", () => {
   it("rejects unsupported settings without changing capture, room or saved intent", async () => {
     const current = fixture();
-    await current.change({ ...original, maxFramerate: 120, maxBitrate: 40_000_000 });
+    await current.change({ ...original, maxFramerate: 480, maxBitrate: 40_000_000 });
     expect(current.qualitySettingsRef.current).toEqual(original);
     expect(current.applyCaptureProfile).not.toHaveBeenCalled();
     expect(current.signalRef.current.setHostQualitySettings).not.toHaveBeenCalled();
@@ -559,7 +559,7 @@ describe("Host quality ownership", () => {
   it("ignores an unsupported App preference without erasing it", async () => {
     const current = fixture();
     current.activeGenerationRef.current = null;
-    const preference = { read: vi.fn(async () => ({ ...original, maxFramerate: 120 })), save: vi.fn() };
+    const preference = { read: vi.fn(async () => ({ ...original, maxFramerate: 480 })), save: vi.fn() };
     current.context.AppQualityPreference = { connect: vi.fn(async () => preference) };
     await current.context.loadAppQualityPreference(new AbortController().signal);
     expect(current.qualitySettingsRef.current).toEqual(original);
diff --git a/tests/quality-preference.test.ts b/tests/quality-preference.test.ts
index 1181b3751..8caf6752d 100644
--- a/tests/quality-preference.test.ts
+++ b/tests/quality-preference.test.ts
@@ -35,7 +35,7 @@ describe("sharing quality preference", () => {
   });
 
   it("uses supported defaults without overwriting a preference from a stronger implementation", () => {
-    const stored = JSON.stringify({ ...DEFAULT_QUALITY_SETTINGS, maxFramerate: 120, maxBitrate: 40_000_000 });
+    const stored = JSON.stringify({ ...DEFAULT_QUALITY_SETTINGS, maxFramerate: 480, maxBitrate: 40_000_000 });
     const setItem = vi.fn();
     vi.stubGlobal("window", { localStorage: { getItem: () => stored, setItem } });
     expect(readPreferredQuality()).toEqual(DEFAULT_QUALITY_SETTINGS);
diff --git a/tests/quality.test.ts b/tests/quality.test.ts
index c0b89a5e3..ba8ea91c5 100644
--- a/tests/quality.test.ts
+++ b/tests/quality.test.ts
@@ -54,15 +54,18 @@ afterEach(() => {
 
 describe("realtime quality controls", () => {
   it("bounds custom size, orientation and frame rate together before capture", () => {
-    expect(captureFramerateCeiling(QUALITY_RESOLUTIONS["4K"])).toBe(60);
-    expect(captureFramerateCeiling({ width: 2160, height: 3840 })).toBe(60);
-    expect(captureFramerateCeiling(QUALITY_RESOLUTIONS["1440p"])).toBe(60);
-    expect(captureFramerateCeiling({ width: 1440, height: 2560 })).toBe(60);
-    expect(captureFramerateCeiling({ width: 3840, height: 2100 })).toBe(60);
+    expect(captureFramerateCeiling(QUALITY_RESOLUTIONS["4K"])).toBe(64);
+    expect(captureFramerateCeiling({ width: 2160, height: 3840 })).toBe(64);
+    expect(captureFramerateCeiling(QUALITY_RESOLUTIONS["1440p"])).toBe(144);
+    expect(captureFramerateCeiling({ width: 1440, height: 2560 })).toBe(144);
+    expect(captureFramerateCeiling({ width: 3840, height: 2100 })).toBe(65);
+    expect(captureFramerateCeiling({ width: 5120, height: 1440 })).toBe(72);
+    expect(captureFramerateCeiling({ width: 1920, height: 1080 })).toBe(240);
     const level51 = videoCaptureLimits({ maxVideoMacroblocksPerSecond: 983_040 });
     expect(captureFramerateCeiling(QUALITY_RESOLUTIONS["4K"], level51)).toBe(30);
     expect(captureFramerateCeiling({ width: 2160, height: 3840 }, level51)).toBe(30);
     for (const size of [{ width: 3840, height: 3840 }, { width: 1921, height: 1080 },
+      { width: 8194, height: 100 }, { width: 6562, height: 1438 },
       { width: 4.5, height: 4 }, { width: Infinity, height: 4 }, { width: 2, height: 4 }]) {
       expect(captureFramerateCeiling(size)).toBe(0);
     }
@@ -70,10 +73,10 @@ describe("realtime quality controls", () => {
       maxVideoPixels: 1920 * 1080, maxVideoMacroblocksPerSecond: 245_760 });
     expect(captureFramerateCeiling(QUALITY_RESOLUTIONS["4K"], limited)).toBe(0);
     expect(captureFramerateCeiling(QUALITY_RESOLUTIONS["1080p"], limited)).toBe(30);
-    expect(captureFramerateCeiling(QUALITY_RESOLUTIONS["720p"], limited)).toBe(60);
+    expect(captureFramerateCeiling(QUALITY_RESOLUTIONS["720p"], limited)).toBe(68);
     expect(videoCaptureLimits({ maxVideoResolution: { width: 8192, height: 8192 },
       maxVideoPixels: 8192 * 8192, maxVideoMacroblocksPerSecond: 9_000_000,
-      maxVideoFramerate: 120, maxVideoBitrate: 100_000_000 })).toEqual(videoCaptureLimits());
+      maxVideoFramerate: 480, maxVideoBitrate: 1_000_000_000 })).toEqual(videoCaptureLimits());
     const slower = videoCaptureLimits({ maxVideoFramerate: 30, maxVideoBitrate: 5_000_000 });
     expect(supportsCaptureProfile(QUALITY_PROFILES["1080p30"], slower)).toBe(true);
     expect(supportsCaptureProfile(QUALITY_PROFILES["1080p60"], slower)).toBe(false);
@@ -83,8 +86,8 @@ describe("realtime quality controls", () => {
     const { stream, videoTrack } = createVideoStream();
     const getDisplayMedia = vi.fn(async () => stream);
     vi.stubGlobal("navigator", { mediaDevices: { getDisplayMedia } });
-    for (const change of [{ maxFramerate: 120 }, { maxFramerate: 30.5 }, { maxFramerate: 0 },
-      { maxBitrate: 99_999 }, { maxBitrate: 50_000_001 },
+    for (const change of [{ maxFramerate: 241 }, { maxFramerate: 30.5 }, { maxFramerate: 0 },
+      { maxBitrate: 99_999 }, { maxBitrate: 240_000_001 },
       { resolution: { width: 32768, height: 32768 } }, { maxAudioBitrate: 510_000 }]) {
       const requested = { ...QUALITY_PROFILES["1080p30"], ...change };
       expect(supportsCaptureProfile(requested)).toBe(false);
@@ -97,7 +100,8 @@ describe("realtime quality controls", () => {
 
   it("admits useful low-rate and high-rate requests without changing presets", async () => {
     const { stream, videoTrack } = createVideoStream();
-    for (const [maxFramerate, maxBitrate] of [[1, 100_000], [5, 800_000], [60, 50_000_000]]) {
+    for (const [maxFramerate, maxBitrate] of [[1, 100_000], [5, 800_000], [60, 50_000_000],
+      [120, 80_000_000], [144, 100_000_000], [240, 240_000_000]]) {
       const profile = { ...QUALITY_PROFILES["1080p30"], maxFramerate, maxBitrate };
       expect(supportsCaptureProfile(profile)).toBe(true);
       await applyCaptureProfile(stream, profile);

From 1e5da450c85610d789cdd412fb30a8363dc3f7dd Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 12:10:03 +0800
Subject: [PATCH 210/262] fix(capture): align native H264 output admission
 across platforms

Accept equivalent Constrained Baseline signaling under RFC 6184 and the shared supported levels. Linux output must admit the Level 5.2 streams allowed by its numeric controls; retain Main/High rejection and add platform self-checks.
---
 docs/research/native-client-media.md |  6 ++++--
 native/capture/darwin/main.swift     | 23 +++++++++++++++++++++--
 native/capture/linux/main.c          | 14 +++++++++-----
 native/capture/linux/main.test.c     | 18 ++++++++++++++++++
 4 files changed, 52 insertions(+), 9 deletions(-)

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 27a77a15d..64aefc0d3 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -485,9 +485,11 @@ Baseline alternatives. The original field quality cause remains unproven.
 
 One independent compatibility defect was confirmed: capture admission compared
 against `42c0` literally, rejecting equivalent Constrained Baseline SPS such as
-`42e0`. Windows validation and the shared Go capture-state reader now follow
+`42e0`. The three Native adapters and shared Go capture-state reader now follow
 [RFC 6184 Table 5](https://www.rfc-editor.org/rfc/rfc6184.html#section-8.1), retaining
-the existing level bounds and rejecting actual Main/High. Windows active status
+the shared level bounds and rejecting actual Main/High. Linux's former output
+gate also omitted Level 5.2 and lower automatic levels; it now follows the same
+admission as its requested profiles. Windows active status
 reads the emitted SPS instead of synthesizing a vendor-specific value. This is
 not a profile upgrade or an explanation for `DXGI_ERROR_DEVICE_REMOVED`.
 
diff --git a/native/capture/darwin/main.swift b/native/capture/darwin/main.swift
index d07c0a7c0..9e2fdc188 100644
--- a/native/capture/darwin/main.swift
+++ b/native/capture/darwin/main.swift
@@ -493,13 +493,21 @@ private func h264ParameterSets(_ format: CMFormatDescription) throws -> [Data] {
         result.append(Data(bytes: pointer, count: size))
     }
     let sps = result[0]
-    guard sps.count >= 4, sps[1] == 0x42, sps[2] == 0xc0,
-          supportedH264Levels.contains(sps[3]) else {
+    guard sps.count >= 4, supportedH264Profile(sps[1], sps[2], sps[3]) else {
         throw CaptureFailure(description: "H.264 profile is outside the product envelope")
     }
     return result
 }
 
+private func supportedH264Profile(_ profile: UInt8, _ constraints: UInt8, _ level: UInt8) -> Bool {
+    // RFC 6184 Table 5: equivalent Constrained Baseline tools, as in the Go reader.
+    supportedH264Levels.contains(level) && (
+        (profile == 0x42 && constraints & 0x4f == 0x40) ||
+        (profile == 0x4d && constraints & 0x8f == 0x80) ||
+        (profile == 0x58 && constraints & 0xcf == 0xc0)
+    )
+}
+
 private func annexB(_ sample: CMSampleBuffer, keyFrame: Bool) throws -> (payload: Data, recovery: Bool) {
     guard let block = CMSampleBufferGetDataBuffer(sample),
           let format = CMSampleBufferGetFormatDescription(sample) else {
@@ -1141,6 +1149,17 @@ private func selfTest() throws {
 }
 
 private func geometrySelfTest() throws {
+    let profiles: [(UInt32, Bool)] = [
+        (0x42c034, true), (0x42e034, true), (0x42c00a, true),
+        (0x4d8034, true), (0x58c034, true),
+        (0x4d0034, false), (0x640034, false), (0x42c035, false), (0x42c134, false),
+    ]
+    for (profile, expected) in profiles {
+        guard supportedH264Profile(UInt8(profile >> 16), UInt8((profile >> 8) & 0xff),
+                                   UInt8(profile & 0xff)) == expected else {
+            throw CaptureFailure(description: "H.264 profile admission self-test failed")
+        }
+    }
     let buffer = try syntheticPixelBuffer()
     let ceiling = OutputProfile(width: 1280, height: 720, fps: frameRate, bitrate: bitrate)
     let rect = CGRect(x: 50, y: 40, width: 200, height: 300)
diff --git a/native/capture/linux/main.c b/native/capture/linux/main.c
index 1e583cdde..c4e6628d0 100644
--- a/native/capture/linux/main.c
+++ b/native/capture/linux/main.c
@@ -551,9 +551,13 @@ static gboolean configure_encoder(VideoOutput *output) {
   return TRUE;
 }
 
-static gboolean supported_level(guint8 level) {
-  const guint8 levels[] = {0x1e, 0x1f, 0x20, 0x28,
-                           0x29, 0x2a, 0x32, 0x33};
+static gboolean supported_h264_profile(guint8 profile, guint8 constraints, guint8 level) {
+  // RFC 6184 Table 5: equivalent Constrained Baseline tools, as in the Go reader.
+  if (!((profile == 0x42 && (constraints & 0x4f) == 0x40) ||
+        (profile == 0x4d && (constraints & 0x8f) == 0x80) ||
+        (profile == 0x58 && (constraints & 0xcf) == 0xc0))) return FALSE;
+  const guint8 levels[] = {0x0a, 0x0b, 0x0c, 0x0d, 0x14, 0x15, 0x16,
+                           0x1e, 0x1f, 0x20, 0x28, 0x29, 0x2a, 0x32, 0x33, 0x34};
   for (guint index = 0; index < G_N_ELEMENTS(levels); ++index) {
     if (levels[index] == level) return TRUE;
   }
@@ -596,8 +600,8 @@ static NalSummary inspect_h264(const guint8 *data, gsize size) {
       summary.sps |= type == 7;
       summary.pps |= type == 8;
       summary.idr |= type == 5;
-      if (type == 7 && nal + 3 < size && data[nal + 1] == 0x42 &&
-          data[nal + 2] == 0xc0 && supported_level(data[nal + 3])) {
+      if (type == 7 && nal + 3 < size &&
+          supported_h264_profile(data[nal + 1], data[nal + 2], data[nal + 3])) {
         g_snprintf(summary.profile_level_id, sizeof(summary.profile_level_id),
                    "%02x%02x%02x", data[nal + 1], data[nal + 2],
                    data[nal + 3]);
diff --git a/native/capture/linux/main.test.c b/native/capture/linux/main.test.c
index 0806cbcdc..3fe567dbe 100644
--- a/native/capture/linux/main.test.c
+++ b/native/capture/linux/main.test.c
@@ -570,8 +570,26 @@ static void check_pipewire_target_identity(void) {
   g_free(target);
 }
 
+static void check_h264_profile_admission(void) {
+  const struct { guint profile; gboolean supported; } cases[] = {
+      {0x42c034, TRUE}, {0x42e034, TRUE}, {0x42c00a, TRUE},
+      {0x4d8034, TRUE}, {0x58c034, TRUE},
+      {0x4d0034, FALSE}, {0x640034, FALSE}, {0x42c035, FALSE}, {0x42c134, FALSE}};
+  for (guint index = 0; index < G_N_ELEMENTS(cases); ++index) {
+    const guint profile = cases[index].profile;
+    const guint8 bytes[] = {0, 0, 0, 1, 0x67, profile >> 16, profile >> 8, profile,
+                           0, 0, 0, 1, 0x68, 0x80, 0, 0, 1, 0x65, 0x80};
+    const NalSummary nal = inspect_h264(bytes, sizeof(bytes));
+    g_assert_true(nal.sps && nal.pps && nal.idr);
+    char expected[7] = {0};
+    if (cases[index].supported) g_snprintf(expected, sizeof(expected), "%06x", profile);
+    g_assert_cmpstr(nal.profile_level_id, ==, expected);
+  }
+}
+
 int main(int argc, char **argv) {
   gst_init(&argc, &argv);
+  check_h264_profile_admission();
   check_pipewire_target_identity();
   check_encoder_admission_and_control();
   check_bus_error_retains_primary_cause();

From 78457c2c618426b5acc3f0f104c96dc7066f9039 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 12:20:02 +0800
Subject: [PATCH 211/262] fix(ui): retain readable custom quality inputs on
 touch screens

---
 docs/research/native-client-media.md | 5 +++--
 src/client/styles.css                | 4 +++-
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 64aefc0d3..157605b86 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -824,8 +824,9 @@ Setting both Windows decoder axis ceilings to 8192 made an existing 4K fixture
 fail at `BEGIN_STREAMING` with `E_OUTOFMEMORY`. Retaining platform provisioning
 defaults passed the same padding/visible-crop regression; SPS and output buffer
 guards remain in their existing owners. Raw H.264 1080p120/80 Mbps also decoded
-30/30 pictures. The higher-range changes still need other-platform SDK and
-physical-device acceptance. Local controls are in ignored `build/quality-polish/`.
+30/30 pictures. Both macOS and Linux architectures pass SDK compilation and
+geometry/profile checks; higher-range physical-device acceptance remains open.
+Local controls are in ignored `build/quality-polish/`.
 
 [WebRTC statistics](https://www.w3.org/TR/webrtc-stats/#dom-rtcicecandidatepairstats-availableoutgoingbitrate)
 describe estimated available capacity, not a configured send-rate ceiling;
diff --git a/src/client/styles.css b/src/client/styles.css
index 6746d7702..e0fb39ea5 100644
--- a/src/client/styles.css
+++ b/src/client/styles.css
@@ -942,7 +942,6 @@ html[data-theme="dark"] .lr-viewer-host-slot svg { color: #9bb0c5; }
 html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #33465c; }
 /* Touch only: the compact mono URL would auto-zoom iOS on focus under 16px,
    and the zoom never returns. Pointer devices keep the dense line. */
-@media (pointer: coarse) { .lr-invite-url { font-size: 16px; } }
 /* LCD room code */
 .lr-room-chip { display: inline-flex; align-items: center; gap: 6px; max-width: 100%; }
 .lr-lcd {
@@ -1200,6 +1199,9 @@ html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #334
 .lr-input.lr-video-size { display: grid; grid-template-columns: minmax(0, 1fr) auto minmax(0, 1fr) auto; gap: 5px; width: 176px; }
 .lr-resolution-controls { display: flex; flex-direction: column; gap: 8px; min-width: 0; }
 .lr-video-size input { width: 100%; padding: 0; text-align: center; appearance: textfield; }
+@media (pointer: coarse) {
+  .lr-invite-url, .lr-quality-number input, .lr-video-size input { font-size: 16px; }
+}
 .lr-welcome { width: 100%; min-width: 0; max-width: 100%; margin: 0; overflow: hidden; color: inherit; font-size: 15px; font-weight: 600; line-height: 1.7; text-align: center; white-space: nowrap; text-overflow: ellipsis; }
 .lr-welcome:not(.is-cipher)::before { content: "✦"; color: #d7982b; margin-right: 8px; }
 .lr-welcome-cipher { display: inline-flex; align-items: center; gap: 8px; vertical-align: middle; opacity: .72; white-space: nowrap; }

From 37643d862ddd41ed18dd7de85af08c33c17cd164 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 13:41:03 +0800
Subject: [PATCH 212/262] fix(app): cancel retired connections and refresh
 readiness

Retire discovery, control opening and hello with their owning acquisition. Continue ordinary ICE immediately when local optional NAT preparation fails, and refresh App readiness on existing activation events.
---
 docs/standards/presentation-lifecycle.md      | 10 +--
 .../components/living/AppConnectionButton.tsx |  5 +-
 src/client/native/client.ts                   | 66 ++++++++++---------
 src/client/native/native-punch.ts             |  7 +-
 src/client/native/quality-preference.ts       |  2 +-
 src/client/pages/HostPage.tsx                 | 16 +++--
 src/client/pages/ViewerPage.tsx               | 29 ++++----
 tests/app-connection-button.test.ts           | 21 +++++-
 tests/host-quality-ownership.test.ts          |  9 ++-
 tests/native-client.test.ts                   | 46 ++++++++++++-
 tests/native-punch.test.ts                    | 22 +++++++
 tests/native-quality-preference.test.ts       |  1 +
 tests/viewer-native-client-ownership.test.ts  | 11 ++--
 13 files changed, 178 insertions(+), 67 deletions(-)

diff --git a/docs/standards/presentation-lifecycle.md b/docs/standards/presentation-lifecycle.md
index 8df0e57ce..182696160 100644
--- a/docs/standards/presentation-lifecycle.md
+++ b/docs/standards/presentation-lifecycle.md
@@ -47,8 +47,9 @@ health. Closing the selector cancels its pending connection action. Existing
 Browser shares retain their capture implementation until sharing ends.
 App-created Local/public-invite Host pages open at their automatically approved
 loopback origin. The shared App button reflects verified authorized health,
-including on returning to an activated page; a remembered activation alone
-cannot show readiness. Idle verification holds no media session or polling loop.
+including activation through another entry and return to an activated page;
+a remembered activation alone cannot show readiness. Idle verification holds
+no media session or polling loop.
 Viewer links opened at that activated origin may use the same running App
 without changing the Viewer UI. Starting a share offers the
 Browser picker and any exact App-owned native windows. It never chooses a
@@ -76,8 +77,9 @@ blocks Browser selection or overrides an explicitly chosen tab. Refresh remains
 reachable after failed App discovery; pending attempts are shared, completed failures
 do not suppress later discovery. Cancelling the selector or ending a share
 releases its unused control session; an obsolete operation cannot install or
-retire another operation's media. Camera thumbnails own only temporary preview
-inputs; leaving their tab or picker retires them. An active shared camera is
+retire another operation's media. Cancellation covers discovery and the opening
+handshake, not just a connection returned later. Camera thumbnails own only
+temporary preview inputs; leaving their tab or picker retires them. An active shared camera is
 borrowed, never reopened or stopped by preview. Optional native ingress uses an already
 available connection without another scan. If it is not ready at Browser
 startup, that share keeps Browser senders.
diff --git a/src/client/components/living/AppConnectionButton.tsx b/src/client/components/living/AppConnectionButton.tsx
index 4a8ce8b5d..2f51554e6 100644
--- a/src/client/components/living/AppConnectionButton.tsx
+++ b/src/client/components/living/AppConnectionButton.tsx
@@ -1,5 +1,5 @@
 import { useEffect, useRef, useState } from "react";
-import { activateClient, isClientActivated } from "../../lib/session";
+import { activateClient, isClientActivated, watchClientActivation } from "../../lib/session";
 import { useCopy } from "../../ui/copy";
 import { Glyph } from "../../ui/icons";
 import { Tooltip } from "./Tooltip";
@@ -34,7 +34,8 @@ export function AppConnectionButton({ sourcePicker = false, onConnected }: {
     const onFocus = () => { void refresh().catch(() => undefined); };
     onFocus();
     window.addEventListener("focus", onFocus);
-    return () => { healthCheck.current?.abort(); window.removeEventListener("focus", onFocus); };
+    const unwatch = watchClientActivation(onFocus);
+    return () => { healthCheck.current?.abort(); window.removeEventListener("focus", onFocus); unwatch(); };
   }, [sourcePicker]);
   useEffect(() => () => { pending.current?.controller.abort(); pending.current?.popup?.close(); }, []);
 
diff --git a/src/client/native/client.ts b/src/client/native/client.ts
index ce2040aab..dacf2384c 100644
--- a/src/client/native/client.ts
+++ b/src/client/native/client.ts
@@ -141,6 +141,7 @@ async function discoverNative<T>(
   path: "health" | "connect-discovery", read: (body: unknown) => T,
   { waitForPermission = true, signal }: NativeDiscoveryOptions,
 ): Promise<T | null> {
+  if (signal?.aborted) return null;
   if (!waitForPermission) {
     const permission = await ungrantedLocalPermission();
     if (permission) {
@@ -148,6 +149,7 @@ async function discoverNative<T>(
       return null;
     }
   }
+  if (signal?.aborted) return null;
   const controller = new AbortController();
   // The first request may wait for browser permission. One shared deadline
   // bounds the scan; a silent port must not hide an App on another port.
@@ -198,7 +200,7 @@ export async function notifyNativePresentation(
   signal: AbortSignal,
 ): Promise<void> {
   if (signal.aborted) return;
-  const health = await discoverNativeHealth();
+  const health = await discoverNativeHealth({ signal });
   if (!health || signal.aborted) return;
   await fetch(`http://127.0.0.1:${health.port}/presentation`, {
     method: "POST",
@@ -228,49 +230,49 @@ export class NativeClient {
   }
 
   static async connect(options?: NativeDiscoveryOptions): Promise<NativeClient | null> {
+    const signal = options?.signal;
     const health = await discoverNativeHealth(options);
-    if (!health) return null;
+    if (!health || signal?.aborted) return null;
     const socket = new WebSocket(`ws://127.0.0.1:${health.port}/control`, [
       `${NATIVE_CLIENT_SUBPROTOCOL}.${health.instanceToken}`,
     ]);
-    const opened = await new Promise<boolean>((resolveOpen) => {
-      const timer = window.setTimeout(
-        () => resolveOpen(false),
-        REQUEST_TIMEOUT_MS,
-      );
-      socket.addEventListener(
-        "open",
-        () => {
-          window.clearTimeout(timer);
-          resolveOpen(
-            socket.protocol ===
-              `${NATIVE_CLIENT_SUBPROTOCOL}.${health.instanceToken}`,
-          );
-        },
-        { once: true },
-      );
-      socket.addEventListener(
-        "error",
-        () => {
-          window.clearTimeout(timer);
-          resolveOpen(false);
-        },
-        { once: true },
-      );
-    });
-    if (!opened) {
-      debugEvent("native", "unavailable", { stage: "control" });
-      socket.close();
-      return null;
-    }
     const client = new NativeClient(health, socket);
+    // Acquisition owns discovery, the WebSocket handshake and hello together.
+    // Once returned, the caller owns the live client independently of this signal.
+    const abort = () => client.close();
+    signal?.addEventListener("abort", abort, { once: true });
     try {
+      const opened = await new Promise<boolean>((resolveOpen) => {
+        const finish = (value: boolean) => {
+          window.clearTimeout(timer);
+          socket.removeEventListener("open", onOpen);
+          socket.removeEventListener("error", fail);
+          socket.removeEventListener("close", fail);
+          signal?.removeEventListener("abort", fail);
+          resolveOpen(value);
+        };
+        const onOpen = () => finish(socket.protocol === `${NATIVE_CLIENT_SUBPROTOCOL}.${health.instanceToken}`);
+        const fail = () => finish(false);
+        const timer = window.setTimeout(fail, REQUEST_TIMEOUT_MS);
+        socket.addEventListener("open", onOpen);
+        socket.addEventListener("error", fail);
+        socket.addEventListener("close", fail);
+        signal?.addEventListener("abort", fail, { once: true });
+      });
+      if (!opened || client.closed || signal?.aborted) {
+        if (!signal?.aborted) debugEvent("native", "unavailable", { stage: "control" });
+        client.close();
+        return null;
+      }
       await client.request("hello", {}, readyResponseSchema);
+      if (client.closed || signal?.aborted) { client.close(); return null; }
       debugEvent("native", "connected");
       return client;
     } catch {
       client.close();
       return null;
+    } finally {
+      signal?.removeEventListener("abort", abort);
     }
   }
 
diff --git a/src/client/native/native-punch.ts b/src/client/native/native-punch.ts
index f4bc8f7cc..1db766689 100644
--- a/src/client/native/native-punch.ts
+++ b/src/client/native/native-punch.ts
@@ -40,7 +40,12 @@ export class NativePunchSender {
       this.finishResult = resolve;
       this.timer = setTimeout(() => this.finish(false), PREPARATION_TIMEOUT_MS);
       this.prediction = this.control.preparePunch(this.shareId, this.connectionId, this.ice, secret, undefined, this.sourceConnectionId)
-        .catch(() => null);
+        .catch(() => null).then(prediction => {
+          // Once this side cannot prepare, a remote reply cannot make the
+          // optional path usable. Leave the remaining operation time to ICE.
+          if (!prediction) this.finish(false);
+          return prediction;
+        });
       if (!this.send({ kind: "punch", connectionId: this.connectionId, punch: { phase: "prepare", secret } })) {
         this.finish(false);
       }
diff --git a/src/client/native/quality-preference.ts b/src/client/native/quality-preference.ts
index 82d186f3a..19b518e7b 100644
--- a/src/client/native/quality-preference.ts
+++ b/src/client/native/quality-preference.ts
@@ -15,7 +15,7 @@ export class AppQualityPreference {
 
   static async connect(signal: AbortSignal): Promise<AppQualityPreference | null> {
     if (signal.aborted) return null;
-    const health = await discoverNativeHealth();
+    const health = await discoverNativeHealth({ signal });
     return health?.qualityPreference && !signal.aborted
       ? new AppQualityPreference(health, signal) : null;
   }
diff --git a/src/client/pages/HostPage.tsx b/src/client/pages/HostPage.tsx
index 6d55c993b..6678b8913 100644
--- a/src/client/pages/HostPage.tsx
+++ b/src/client/pages/HostPage.tsx
@@ -621,7 +621,7 @@ export function HostPage({
   const retiringStreamRef = useRef<MediaStream | null>(null);
   const hostSfuRouteRef = useRef<HostSfuRoute | null>(null);
   const nativeClientRef = useRef<NativeClient | null>(null);
-  const nativeClientConnectRef = useRef<Promise<NativeClient | null> | null>(null);
+  const nativeClientConnectRef = useRef<{ promise: Promise<NativeClient | null>; controller: AbortController } | null>(null);
   const nativeShareGenerationRef = useRef<string | null>(null);
   const serverShareGenerationRef = useRef<string | null>(null);
   const nativeMediaBridgeRef = useRef<NativeMediaBridge | null>(null);
@@ -767,6 +767,7 @@ export function HostPage({
       disposeNativeShare();
       nativeClientCloseCleanupRef.current?.();
       nativeClientCloseCleanupRef.current = null;
+      nativeClientConnectRef.current?.controller.abort();
       nativeClientConnectRef.current = null;
       nativeClientRef.current?.close();
       nativeClientRef.current = null;
@@ -1346,6 +1347,7 @@ export function HostPage({
     nativeClientCloseCleanupRef.current = client.onClose(() => {
       if (nativeClientRef.current !== client) return;
       nativeClientRef.current = null;
+      nativeClientConnectRef.current?.controller.abort();
       nativeClientConnectRef.current = null;
       nativeClientCloseCleanupRef.current = null;
       if (nativeSourceRequestRef.current) {
@@ -1365,16 +1367,18 @@ export function HostPage({
       nativeClientCloseCleanupRef.current?.();
       nativeClientCloseCleanupRef.current = null;
       nativeClientRef.current = null;
+      nativeClientConnectRef.current?.controller.abort();
       nativeClientConnectRef.current = null;
     }
     client.close();
   }
 
   function acquireNativeClient(): Promise<NativeClient | null> {
-    if (nativeClientConnectRef.current) return nativeClientConnectRef.current;
-    const connecting: Promise<NativeClient | null> = nativeShareCleanupRef.current.then(() =>
+    if (nativeClientConnectRef.current) return nativeClientConnectRef.current.promise;
+    const controller = new AbortController();
+    const promise: Promise<NativeClient | null> = nativeShareCleanupRef.current.then(() =>
       nativeClientConnectRef.current === connecting
-        ? nativeClientRef.current ?? NativeClient.connect()
+        ? nativeClientRef.current ?? NativeClient.connect({ signal: controller.signal })
         : null,
     ).catch((error) => {
       debugError("native", "discovery-failed", error);
@@ -1390,8 +1394,9 @@ export function HostPage({
     }).finally(() => {
       if (nativeClientConnectRef.current === connecting) nativeClientConnectRef.current = null;
     });
+    const connecting = { promise, controller };
     nativeClientConnectRef.current = connecting;
-    return connecting;
+    return promise;
   }
 
   function releaseUnusedNativeClient(): void {
@@ -1399,6 +1404,7 @@ export function HostPage({
     // needs to keep it after startup. Merely visiting the page owns no session.
     if (nativeSourceRequestRef.current || nativeShareGenerationRef.current ||
       (activeGenerationRef.current !== null && roomMutationRef.current !== null)) return;
+    nativeClientConnectRef.current?.controller.abort();
     nativeClientConnectRef.current = null;
     const client = nativeClientRef.current;
     if (client) discardNativeClient(client);
diff --git a/src/client/pages/ViewerPage.tsx b/src/client/pages/ViewerPage.tsx
index 3ae8111a0..57cbf0f91 100644
--- a/src/client/pages/ViewerPage.tsx
+++ b/src/client/pages/ViewerPage.tsx
@@ -480,35 +480,38 @@ export function ViewerPage({
     });
     setRelayChildEvidence(relayChildEvidenceStore.getSnapshot());
     let sfuTransportConnected = false;
-    let nativeClientPromise: Promise<NativeClient | null> | null = null;
+    let nativeClientConnection: { promise: Promise<NativeClient | null>; controller: AbortController } | null = null;
     let nativeViewerAvailable = true;
     const nativeViewerSessionId = createOpaqueId();
 
     const releaseNativeClient = (): void => {
-      const connecting = nativeClientPromise;
-      nativeClientPromise = null;
-      void connecting?.then((client) => client?.close());
+      const connecting = nativeClientConnection;
+      nativeClientConnection = null;
+      connecting?.controller.abort();
+      void connecting?.promise.then((client) => client?.close());
     };
 
     const acquireNativeClient = async (): Promise<NativeClient | null> => {
       if (!active || !clientActivationRef.current || !nativeViewerAvailable) return null;
-      if (!nativeClientPromise) {
-        const connecting: Promise<NativeClient | null> = NativeClient.connect({ waitForPermission: false }).catch(() => null).then((client) => {
-          if (!client || !active || nativeClientPromise !== connecting) {
-            if (nativeClientPromise === connecting) nativeClientPromise = null;
+      if (!nativeClientConnection) {
+        const controller = new AbortController();
+        const promise = NativeClient.connect({ waitForPermission: false, signal: controller.signal }).catch(() => null).then((client) => {
+          if (!client || !active || nativeClientConnection !== connecting) {
+            if (nativeClientConnection === connecting) nativeClientConnection = null;
             client?.close();
             return null;
           }
           client.onClose(() => {
-            if (nativeClientPromise === connecting) nativeClientPromise = null;
+            if (nativeClientConnection === connecting) nativeClientConnection = null;
           });
           return client;
         });
-        nativeClientPromise = connecting;
+        const connecting = { promise, controller };
+        nativeClientConnection = connecting;
       }
-      const connecting = nativeClientPromise;
-      const client = await connecting;
-      return active && nativeViewerAvailable && nativeClientPromise === connecting ? client : null;
+      const connecting = nativeClientConnection;
+      const client = await connecting.promise;
+      return active && nativeViewerAvailable && nativeClientConnection === connecting ? client : null;
     };
 
     function createViewerMediaPeer(
diff --git a/tests/app-connection-button.test.ts b/tests/app-connection-button.test.ts
index 6ac60d5a9..a0d007a23 100644
--- a/tests/app-connection-button.test.ts
+++ b/tests/app-connection-button.test.ts
@@ -43,6 +43,10 @@ function mount(activated = false) {
   const operation = runInNewContext(executable, {
     window, pending, healthCheck, setState, activateClient, onConnected, AbortController, URL,
     sourcePicker: false, isClientActivated: () => activated,
+    watchClientActivation: (changed: () => void) => {
+      window.addEventListener("activation", changed);
+      return () => window.removeEventListener("activation", changed);
+    },
     require: (path: string) => {
       if (path !== "../../native/client") throw new Error(`Unexpected dependency: ${path}`);
       return native;
@@ -53,7 +57,8 @@ function mount(activated = false) {
       source: popup, origin: new URL(approval).origin, data: { type: "piik-app-approved", site }, ...overrides,
     }));
   }
-  return { ...operation, popup, window, native, pending, setState, activateClient, onConnected, message };
+  const activateElsewhere = () => { activated = true; window.dispatchEvent(new Event("activation")); };
+  return { ...operation, popup, window, native, pending, setState, activateClient, activateElsewhere, onConnected, message };
 }
 
 describe("App connection approval", () => {
@@ -164,6 +169,20 @@ describe("App connection approval", () => {
     page.cleanup();
   });
 
+  it("reflects another App entry's activation without needing a focus change", async () => {
+    const page = mount();
+    await settle();
+    expect(page.native.discoverNativeHealth).not.toHaveBeenCalled();
+    page.activateElsewhere();
+    await settle();
+    expect(page.setState).toHaveBeenLastCalledWith("ready");
+    expect(page.window.open).not.toHaveBeenCalled();
+    page.cleanup();
+    page.activateElsewhere();
+    await settle();
+    expect(page.native.discoverNativeHealth).toHaveBeenCalledOnce();
+  });
+
   it("does not let an earlier health check overwrite a newer approval", async () => {
     const page = mount(true);
     let complete!: (health: object | null) => void;
diff --git a/tests/host-quality-ownership.test.ts b/tests/host-quality-ownership.test.ts
index dd1283155..add2c70f6 100644
--- a/tests/host-quality-ownership.test.ts
+++ b/tests/host-quality-ownership.test.ts
@@ -72,10 +72,10 @@ function fixture(launchedByClient = true) {
     stopReceive: vi.fn(async () => undefined), stopShare: vi.fn(async () => undefined) };
   const route = { updateProfile: vi.fn(async () => true), resyncAuthoritative: vi.fn(async (): Promise<void> => undefined) };
   const state = {
-    debugError, debugEvent, debugOperation, NativeCompatibilityError, NativeRequestError, NativeMediaBridgeError, isCapturePermissionFailure, hostFailureCode, DOMException,
+    debugError, debugEvent, debugOperation, NativeCompatibilityError, NativeRequestError, NativeMediaBridgeError, isCapturePermissionFailure, hostFailureCode, DOMException, AbortController,
     launchedByClient, isClientActivated: vi.fn(() => launchedByClient), hostRoomSessionAvailable: false,
-    NativeClient: { connect: vi.fn(async (): Promise<typeof client | null> => null) },
-    nativeClientConnectRef: ref<Promise<typeof client | null> | null>(null),
+    NativeClient: { connect: vi.fn(async (_options?: { signal: AbortSignal }): Promise<typeof client | null> => null) },
+    nativeClientConnectRef: ref<{ promise: Promise<typeof client | null>; controller: AbortController } | null>(null),
     ownNativeClient: vi.fn(), setJoiningRoom: vi.fn(), startSharing: vi.fn(), openCaptureSourcePicker: vi.fn(),
     videoCodecRef: ref({ primary: "h264" }),
     videoCodecModeRef: ref("h264"), MAX_ENDPOINT_MEDIA_CHILDREN: 2,
@@ -1205,7 +1205,10 @@ describe("Host quality ownership", () => {
     current.NativeClient.connect.mockReturnValueOnce(discovery.promise);
     const opening = current.openPicker();
     await vi.waitFor(() => expect(current.NativeClient.connect).toHaveBeenCalledOnce());
+    const signal = current.NativeClient.connect.mock.calls[0]![0]!.signal;
+    expect(signal.aborted).toBe(false);
     current.closePicker();
+    expect(signal.aborted).toBe(true);
     discovery.resolve(current.client);
     await opening;
     expect(current.client.close).toHaveBeenCalledOnce();
diff --git a/tests/native-client.test.ts b/tests/native-client.test.ts
index 2818b9069..2555f8483 100644
--- a/tests/native-client.test.ts
+++ b/tests/native-client.test.ts
@@ -82,6 +82,48 @@ describe("native App private wire", () => {
     expect(nativeHealthSchema.safeParse({ ...health, nativeMedia: { ...nativeMedia, maxVideoMacroblocksPerSecond: -1 } }).success).toBe(false);
   });
 
+  it.each(["opening", "hello", "close"])("retires App acquisition during %s without waiting for its timeout", async stage => {
+    vi.useFakeTimers();
+    vi.stubGlobal("window", { setTimeout, clearTimeout });
+    vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify(health))));
+    const sockets: Socket[] = [];
+    class Socket extends EventTarget {
+      static readonly OPEN = 1;
+      static readonly CLOSING = 2;
+      readyState = 0;
+      protocol = `piik-client-v10.${health.instanceToken}`;
+      close = vi.fn(() => { this.readyState = Socket.CLOSING; });
+      send = vi.fn();
+      constructor() { super(); sockets.push(this); }
+    }
+    vi.stubGlobal("WebSocket", Socket);
+    const controller = new AbortController();
+    const settled = vi.fn();
+    const connecting = NativeClient.connect({ signal: controller.signal }).then(settled);
+    await vi.advanceTimersByTimeAsync(0);
+    const socket = sockets[0]!;
+    expect(socket).toBeDefined();
+    if (stage === "hello") {
+      socket.readyState = Socket.OPEN;
+      socket.dispatchEvent(new Event("open"));
+      await vi.advanceTimersByTimeAsync(0);
+      expect(socket.send).toHaveBeenCalledOnce();
+    }
+    if (stage === "close") {
+      socket.readyState = 3;
+      socket.dispatchEvent(new Event("close"));
+    } else controller.abort();
+    await vi.advanceTimersByTimeAsync(0);
+    expect(settled).toHaveBeenCalledExactlyOnceWith(null);
+    expect(vi.getTimerCount()).toBe(0);
+    if (stage !== "close") expect(socket.close).toHaveBeenCalledOnce();
+    // An obsolete opening event cannot start a hello or revive acquisition.
+    socket.dispatchEvent(new Event("open"));
+    await vi.advanceTimersByTimeAsync(0);
+    expect(socket.send).toHaveBeenCalledTimes(stage === "hello" ? 1 : 0);
+    await connecting;
+  });
+
   it("binds a local answer to its prepare request across an ICE restart", async () => {
     const requests: Record<string, unknown>[] = [];
     class Socket extends EventTarget {
@@ -106,7 +148,9 @@ describe("native App private wire", () => {
     vi.stubGlobal("WebSocket", Socket);
     vi.stubGlobal("window", { setTimeout, clearTimeout });
     vi.stubGlobal("fetch", vi.fn(async () => new Response(JSON.stringify(health))));
-    const client = (await NativeClient.connect())!;
+    const controller = new AbortController();
+    const client = (await NativeClient.connect({ signal: controller.signal }))!;
+    controller.abort(); // Acquisition cancellation no longer owns this accepted client.
     try {
       let lastOffer = "";
       for (const restart of [false, true]) {
diff --git a/tests/native-punch.test.ts b/tests/native-punch.test.ts
index 3c47e1e30..0a0e53535 100644
--- a/tests/native-punch.test.ts
+++ b/tests/native-punch.test.ts
@@ -106,3 +106,25 @@ it("ignores late success after sender cancellation", async () => {
   sender.accept({ phase: "complete", connected: true });
   expect(await result).toBe(false);
 });
+
+it.each(["unavailable", "rejected"])("continues ordinary ICE as soon as local preparation is %s", async outcome => {
+  vi.useFakeTimers();
+  const source = control();
+  if (outcome === "unavailable") source.preparePunch.mockResolvedValue(null);
+  else source.preparePunch.mockRejectedValue(new Error("discovery unavailable"));
+  const sent = vi.fn(() => true);
+  const sender = new NativePunchSender(source, "share", "connection", ice, sent);
+  const continued = vi.fn();
+  try {
+    const result = sender.start().then(continued);
+    await flush(); // The remote side has not answered and no timeout has elapsed.
+    expect(continued).toHaveBeenCalledExactlyOnceWith(false);
+    expect(source.closePunch).toHaveBeenCalledWith("share", "connection");
+    expect(vi.getTimerCount()).toBe(0);
+    sender.accept({ phase: "ready", prediction });
+    await flush();
+    expect(source.runPunch).not.toHaveBeenCalled();
+    expect(sent).toHaveBeenCalledOnce();
+    await result;
+  } finally { sender.dispose(); }
+});
diff --git a/tests/native-quality-preference.test.ts b/tests/native-quality-preference.test.ts
index 9e0fc9f33..c716027c9 100644
--- a/tests/native-quality-preference.test.ts
+++ b/tests/native-quality-preference.test.ts
@@ -22,6 +22,7 @@ describe("App quality preference transport", () => {
     controller.abort();
     expect(await AppQualityPreference.connect(controller.signal)).toBeNull();
     expect(discoverNativeHealth).toHaveBeenCalledOnce();
+    expect(discoverNativeHealth).toHaveBeenCalledWith({ signal: controller.signal });
     expect(fetcher).not.toHaveBeenCalled();
   });
 
diff --git a/tests/viewer-native-client-ownership.test.ts b/tests/viewer-native-client-ownership.test.ts
index 22a75b5b9..8eca262c9 100644
--- a/tests/viewer-native-client-ownership.test.ts
+++ b/tests/viewer-native-client-ownership.test.ts
@@ -8,7 +8,7 @@ import { NativeCompatibilityError } from "../src/client/native/client";
 const source = ts.createSourceFile("ViewerPage.tsx", readFileSync(
   new URL("../src/client/pages/ViewerPage.tsx", import.meta.url), "utf8",
 ), ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
-const owners = new Set(["nativeClientPromise", "nativeViewerAvailable", "acquireNativeClient", "releaseNativeClient"]);
+const owners = new Set(["nativeClientConnection", "nativeViewerAvailable", "acquireNativeClient", "releaseNativeClient"]);
 const declarations: string[] = [];
 let denyAccess = "";
 function collect(node: ts.Node): void {
@@ -42,9 +42,9 @@ function control() {
 }
 
 function fixture(launchedByClient = true) {
-  const connect = vi.fn(async (): Promise<ReturnType<typeof control> | null> => null);
+  const connect = vi.fn(async (_options: { signal: AbortSignal; waitForPermission: boolean }): Promise<ReturnType<typeof control> | null> => null);
   const context = createContext({
-    clientActivationRef: { current: launchedByClient }, NativeClient: { connect },
+    clientActivationRef: { current: launchedByClient }, NativeClient: { connect }, AbortController,
     messageAuthority: { invalidate: vi.fn() }, setAssignedRoute: vi.fn(),
     clearViewerSfuRoute: vi.fn(), clearPeerState: vi.fn(), clearParticipantPresence: vi.fn(),
     dispatchPresentation: vi.fn(),
@@ -64,7 +64,7 @@ it.each([false, true])("retries an absent or rejected App on the next offer: rej
   if (reject) current.connect.mockRejectedValueOnce(new Error("App unavailable"));
   await expect(current.acquire()).resolves.toBeNull();
   expect(current.connect).toHaveBeenCalledOnce();
-  expect(current.connect).toHaveBeenCalledWith({ waitForPermission: false });
+  expect(current.connect).toHaveBeenCalledWith({ waitForPermission: false, signal: expect.any(AbortSignal) });
   const client = control();
   current.connect.mockResolvedValue(client);
   await expect(current.acquire()).resolves.toBe(client);
@@ -96,10 +96,13 @@ it("retires pending discovery after access loss without replacing or closing a n
   let resolve!: (value: typeof obsolete) => void;
   current.connect.mockReturnValueOnce(new Promise((done) => { resolve = done; }));
   const pending = current.acquire();
+  const obsoleteSignal = current.connect.mock.calls[0]![0].signal;
   current.deny("INVALID_TOKEN");
+  expect(obsoleteSignal.aborted).toBe(true);
   const replacement = control();
   current.connect.mockResolvedValueOnce(replacement);
   await expect(current.acquire()).resolves.toBe(replacement);
+  expect(current.connect.mock.calls[1]![0].signal.aborted).toBe(false);
   resolve(obsolete);
   await expect(pending).resolves.toBeNull();
   expect(obsolete.close).toHaveBeenCalledOnce();

From 170bcc6326f4a5f66fb3055edd2546d6c33f0c7b Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 15:55:18 +0800
Subject: [PATCH 213/262] fix(ui): refine sharing settings and common slider
 ranges

---
 docs/guide/getting-started.md                 |  7 +-
 docs/guide/getting-started.zh-CN.md           |  3 +-
 docs/standards/visual-language.md             | 10 ++-
 .../components/living/HostMicrophone.tsx      |  3 +-
 .../components/living/QualityPresets.tsx      | 86 ++++++++++++++-----
 .../components/living/SharingSettings.tsx     | 20 ++---
 src/client/locales/en.ts                      | 11 ++-
 src/client/locales/zh.ts                      |  5 ++
 src/client/pages/ControlsPreview.tsx          | 13 +--
 src/client/pages/HostPage.tsx                 | 75 ++--------------
 src/client/styles.css                         | 69 +++++++++++----
 tests/quality-controls.test.ts                | 26 ++++++
 12 files changed, 195 insertions(+), 133 deletions(-)

diff --git a/docs/guide/getting-started.md b/docs/guide/getting-started.md
index 5d40915e4..8d7e369a5 100644
--- a/docs/guide/getting-started.md
+++ b/docs/guide/getting-started.md
@@ -169,11 +169,12 @@ sharing to allow that fallback. The project's online site uses P2P only.
 
 Open **Sharing settings** below the picture to adjust picture and audio quality.
 
-- Choose a picture preset, or enter width and height under **Resolution ceiling**.
+- Choose a picture preset, or enter width and height under **Resolution limit**.
   Piik preserves the source's proportions within that ceiling, including portrait
   and ultrawide pictures.
-- Use the sliders or enter a **Frame rate ceiling** from 1 to 240 fps and a
-  **Video bitrate ceiling** from 0.1 to 240 Mbps. The frame-rate limit depends
+- Sliders cover common values up to 60 fps and 20 Mbps. You can also enter an
+  **FPS limit** from 1 to 240 fps and a **Bitrate limit** from 0.1 to 240 Mbps.
+  The frame-rate limit depends
   on picture size: for example, 1080p240, 1440p144 and 4K60 are accepted requests.
 - Choose an audio preset, or enter an **Audio bitrate limit** from 6 to 320 kbps.
 
diff --git a/docs/guide/getting-started.zh-CN.md b/docs/guide/getting-started.zh-CN.md
index dbea67e7b..53886536c 100644
--- a/docs/guide/getting-started.zh-CN.md
+++ b/docs/guide/getting-started.zh-CN.md
@@ -149,7 +149,8 @@ Linux 原生采集还需要[系统组件](../../native/capture/linux/README.md)
 
 - 可选画质预设，也可在 **分辨率上限** 中填写宽和高。画面在上限内保留来源比例，
   包括竖屏和超宽屏。
-- 可拖动滑块，也可直接填写 1–240 帧的 **帧率上限** 和 0.1–240 Mbps 的 **视频码率上限**。
+- 滑块覆盖最高 60 帧、20 Mbps 的常用范围；也可直接填写 1–240 帧的 **帧率上限**
+  和 0.1–240 Mbps 的 **视频码率上限**。
   帧率范围随画幅变化，例如可以请求 1080p240、1440p144 或 4K60。
 - 音频保留三档预设，也可填写 6–320 kbps 的 **音频码率上限**。
 
diff --git a/docs/standards/visual-language.md b/docs/standards/visual-language.md
index 18ef8d893..92477e3bc 100644
--- a/docs/standards/visual-language.md
+++ b/docs/standards/visual-language.md
@@ -156,9 +156,13 @@ the television, above the couch. Its disclosure groups quality presets and pictu
 parameters with sound and microphone settings; presets remain available before
 sharing starts. Separate the less frequent connection/codec options in a nested
 disclosure. Expand in page flow, pushing later content down instead of covering
-the picture or participants. Use two content groups on wide screens and stack
-them on narrow screens; avoid another permanent row of settings cards. Keep
-shared presentation separate from the existing setting/resource owners.
+the picture or participants. Keep picture and sound in distinct sections; place
+related adjustments side by side where space permits and stack them on narrow
+screens. Avoid another permanent row of settings cards. Numeric quality inputs
+retain the accepted capability range; sliders offer a labelled common range for
+quick adjustment. A higher typed value remains visible and must not be reduced
+merely by opening or focusing its slider. Shared presentation stays separate
+from the existing setting/resource owners.
 The microphone comic depicts Host commentary gain;
 the Viewer's listening-volume comic remains a different action.
 
diff --git a/src/client/components/living/HostMicrophone.tsx b/src/client/components/living/HostMicrophone.tsx
index 0a70c7dd2..602a69de2 100644
--- a/src/client/components/living/HostMicrophone.tsx
+++ b/src/client/components/living/HostMicrophone.tsx
@@ -1,4 +1,4 @@
-import { useId } from "react";
+import { useId, type CSSProperties } from "react";
 import { Btn, SwitchItem } from "./primitives";
 import { Tooltip } from "./Tooltip";
 import { Glyph } from "../../ui/icons";
@@ -43,6 +43,7 @@ export function HostMicrophoneSettings({ enabled, disabled, volume, onVolume, de
       </label>
       <Tooltip kind="hint-microphone-volume" text={vis ? undefined : t("host.microphone.settings")}>
         <input id={id} type="range" min={0} max={200} step={1} value={percent} disabled={disabled}
+          style={{ "--range-fill": `${percent / 2}%` } as CSSProperties}
           aria-label={t("host.microphone.volume")} aria-valuetext={`${percent}%`}
           onChange={event => onVolume(Number(event.target.value) / 100)} />
       </Tooltip>
diff --git a/src/client/components/living/QualityPresets.tsx b/src/client/components/living/QualityPresets.tsx
index 1c81e82c1..cac74cf12 100644
--- a/src/client/components/living/QualityPresets.tsx
+++ b/src/client/components/living/QualityPresets.tsx
@@ -1,10 +1,10 @@
-import { Fragment, useRef, type ReactNode } from "react";
+import { Fragment, useRef, type CSSProperties, type ReactNode } from "react";
 import { MIN_AUDIO_BITRATE } from "../../../shared/protocol";
 import {
-  QUALITY_PROFILES, QUALITY_PROFILE_KEYS, QUALITY_RESOLUTIONS, qualityResolutionEqual,
+  QUALITY_PROFILES, QUALITY_PROFILE_KEYS, QUALITY_RESOLUTIONS, DEGRADATION_PREFERENCE_KEYS, qualityResolutionEqual,
   captureFramerateCeiling, supportsCaptureProfile, MIN_VIDEO_FRAMERATE, MIN_VIDEO_BITRATE,
   VIDEO_CAPTURE_LIMITS, type VideoCaptureLimits, type QualityProfile, type QualityProfileId, type QualityResolution,
-  SCREEN_AUDIO_BITRATES, type ScreenAudioPreset,
+  SCREEN_AUDIO_BITRATES, type ScreenAudioPreset, type DegradationPreference,
 } from "../../media/quality";
 import { useCopy, type CopyKey } from "../../ui/copy";
 import { Glyph } from "../../ui/icons";
@@ -12,6 +12,12 @@ import { Cap, Chip } from "./primitives";
 import { QualityTileGlyph } from "./QualityTileGlyph";
 import { Tooltip } from "./Tooltip";
 
+const PRESET_LABELS: Record<QualityProfileId, CopyKey> = {
+  "720p30": "host.quality.light",
+  "1080p30": "host.quality.hd",
+  "1080p60": "host.quality.highFps",
+};
+
 export function QualityPresets({ selected, limits = VIDEO_CAPTURE_LIMITS, disabled = false, busy = false, onSelect }: {
   selected: QualityProfileId | null;
   limits?: VideoCaptureLimits;
@@ -27,9 +33,10 @@ export function QualityPresets({ selected, limits = VIDEO_CAPTURE_LIMITS, disabl
       return <Tooltip key={id} kind="hint-quality" align={index === 0 ? "start" : "center"}
         text={vis ? undefined : t("host.quality.title", { label: caption, mbps: (profile.maxBitrate / 1_000_000).toFixed(0) })}>
         <button type="button" className={`lr-tile${selected === id ? " is-selected" : ""}`}
-          aria-pressed={selected === id} aria-label={caption}
+          aria-pressed={selected === id} aria-label={`${t(PRESET_LABELS[id])} · ${caption}`}
           disabled={disabled || !supportsCaptureProfile(profile, limits)} onClick={() => onSelect(id)}>
           <QualityTileGlyph resolution={`${profile.resolution.height}p`} framerate={profile.maxFramerate} />
+          {vis ? null : <strong>{t(PRESET_LABELS[id])}</strong>}
           <small>{vis ? `${profile.resolution.height} ${profile.maxFramerate}` : caption}</small>
         </button>
       </Tooltip>;
@@ -161,30 +168,42 @@ export function VideoRateControls({ value, limits, disabled, onChange }: {
   const fpsMax = captureFramerateCeiling(value.resolution, limits);
   const controls = [
     { name: "maxFramerate", label: "host.advanced.framerate", icon: "frames", hint: "hint-metric-fps",
-      value: value.maxFramerate, min: MIN_VIDEO_FRAMERATE, max: fpsMax, step: 1, unit: "fps",
+      value: value.maxFramerate, min: MIN_VIDEO_FRAMERATE, max: fpsMax, sliderMax: 60, step: 1, unit: "fps",
       change: (maxFramerate: number) => onChange({ maxFramerate }) },
     { name: "maxBitrate", label: "host.advanced.bitrate", icon: "gauge", hint: "hint-metric-bitrate",
       value: value.maxBitrate / 1_000_000, min: MIN_VIDEO_BITRATE / 1_000_000,
-      max: limits.maxVideoBitrate / 1_000_000, step: 0.1, unit: "Mbps",
+      max: limits.maxVideoBitrate / 1_000_000, sliderMax: 20, step: 0.1, unit: "Mbps",
       change: (mbps: number) => onChange({ maxBitrate: Math.round(mbps * 1_000_000) }) },
   ] as const;
   return <div className="lr-sharing-limits">
-    {controls.map(control => <QualityNumberControl key={control.name} {...control}
-      className="lr-quality-rate" label={t(control.label)}
-      disabled={disabled || control.max < control.min} onChange={control.change}>
-      {(input, select) => <>
-        <div className="lr-quality-heading">
-          <span className="lr-door-glyph"><Glyph name={control.icon} size={19} /><Cap k={control.label} /></span>
-          <Tooltip kind={control.hint} text={vis ? undefined : `${t(control.label)}: ${control.min}–${control.max} ${control.unit}`}>
-            {input}
-          </Tooltip>
-        </div>
-        <input type="range" min={control.min} max={Math.max(control.min, control.max)} step={control.step}
-          value={control.value} disabled={disabled || control.max < control.min} aria-label={t(control.label)}
-          onChange={event => select(event.currentTarget.valueAsNumber)}
-          onClick={event => select(event.currentTarget.valueAsNumber)} />
-      </>}
-    </QualityNumberControl>)}
+    {controls.map(control => {
+      // The slider is a common-range shortcut, not the capture admission limit.
+      const sliderMax = Math.max(control.min, Math.min(control.sliderMax, control.max));
+      return <QualityNumberControl key={control.name} {...control}
+        className="lr-quality-rate" label={t(control.label)}
+        disabled={disabled || control.max < control.min} onChange={control.change}>
+        {(input, select) => <>
+          <div className="lr-quality-heading">
+            <span className="lr-door-glyph"><Glyph name={control.icon} size={19} /><Cap k={control.label} /></span>
+            <Tooltip kind={control.hint} text={vis ? undefined : t("host.video.inputHint", {
+              min: String(control.min), max: String(control.max), unit: control.unit,
+            })}>
+              {input}
+            </Tooltip>
+          </div>
+          <input type="range" min={control.min} max={sliderMax} step={control.step}
+            value={Math.min(control.value, sliderMax)} disabled={disabled || control.max < control.min}
+            style={{ "--range-fill": `${100 * (Math.min(control.value, sliderMax) - control.min) / (sliderMax - control.min || 1)}%` } as CSSProperties}
+            aria-label={`${t(control.label)} · ${t("host.video.commonRange")}`}
+            onChange={event => select(event.currentTarget.valueAsNumber)}
+            onClick={event => select(event.currentTarget.valueAsNumber)} />
+          <div className="lr-quality-range-labels" aria-hidden="true">
+            <span>{control.min}</span>
+            <span>{sliderMax} {control.unit}</span>
+          </div>
+        </>}
+      </QualityNumberControl>;
+    })}
   </div>;
 }
 
@@ -196,7 +215,7 @@ export function AudioBitrateControl({ value, max, disabled, onChange }: {
 }) {
   const { t, vis } = useCopy();
   return <QualityNumberControl value={value / 1_000} min={MIN_AUDIO_BITRATE / 1_000} max={max / 1_000} step={1}
-    name="audioBitrate" unit="kbps" label={t("host.advanced.audioBitrate")} className="lr-door-group"
+    name="audioBitrate" unit="kbps" label={t("host.advanced.audioBitrate")} className="lr-door-group lr-audio-quality"
     disabled={disabled} onChange={kbps => onChange(kbps * 1_000)}>
     {(input, select) => <>
       <div className="lr-quality-heading">
@@ -218,3 +237,24 @@ export function AudioBitrateControl({ value, max, disabled, onChange }: {
     </>}
   </QualityNumberControl>;
 }
+
+export function PicturePreferenceControl({ value, disabled, onChange }: {
+  value: DegradationPreference; disabled: boolean; onChange: (value: DegradationPreference) => void;
+}) {
+  const { t } = useCopy();
+  const choices = [
+    { value: "maintain-resolution", icon: "mountain", hint: "host.advanced.preference.resolutionHint", comic: "hint-prefer-resolution" },
+    { value: "balanced", icon: "balance", hint: "host.advanced.preference.balancedHint", comic: "hint-degrade-pref" },
+    { value: "maintain-framerate", icon: "frames", hint: "host.advanced.preference.framerateHint", comic: "hint-prefer-framerate" },
+  ] as const;
+  return <div className="lr-door-group lr-picture-preference">
+    <span className="lr-door-glyph"><Glyph name="mountain" size={19} /><Cap k="host.advanced.preference" /></span>
+    <div className="lr-row-group" role="group" aria-label={t("host.advanced.preference")}>
+      {choices.map(choice => <Chip key={choice.value} name="degradationPreference" value={choice.value}
+        selected={value === choice.value} disabled={disabled} onClick={() => onChange(choice.value)}
+        title={`${t(DEGRADATION_PREFERENCE_KEYS[choice.value])} · ${t(choice.hint)}`} hint={choice.comic}>
+        <Glyph name={choice.icon} size={18} /><Cap k={DEGRADATION_PREFERENCE_KEYS[choice.value]} />
+      </Chip>)}
+    </div>
+  </div>;
+}
diff --git a/src/client/components/living/SharingSettings.tsx b/src/client/components/living/SharingSettings.tsx
index 68e4c595d..9b32eb94f 100644
--- a/src/client/components/living/SharingSettings.tsx
+++ b/src/client/components/living/SharingSettings.tsx
@@ -11,17 +11,15 @@ export function SharingSettings({ id, open, busy, presets, picture, audio, techn
   const { t } = useCopy();
   return <div id={id} className={`lr-sharing-settings lr-door-reveal${open ? " is-open" : ""}`}>
     <div>{open ? <section className="lr-sharing-panel" aria-label={t("host.advanced")} aria-busy={busy}>
-      <div className="lr-sharing-columns">
-        <section className="lr-sharing-section" aria-label={t("host.settings.picture")}>
-          <h2 aria-label={t("host.settings.picture")}><Glyph name="tv" size={20} /><Cap k="host.settings.picture" /></h2>
-          {presets}
-          {picture}
-        </section>
-        <section className="lr-sharing-section" aria-label={t("host.settings.sound")}>
-          <h2 aria-label={t("host.settings.sound")}><Glyph name="speaker" size={20} /><Cap k="host.settings.sound" /></h2>
-          {audio}
-        </section>
-      </div>
+      <section className="lr-sharing-section" aria-label={t("host.settings.picture")}>
+        <h2 aria-label={t("host.settings.picture")}><Glyph name="tv" size={20} /><Cap k="host.settings.picture" /></h2>
+        {presets}
+        {picture}
+      </section>
+      <section className="lr-sharing-section" aria-label={t("host.settings.sound")}>
+        <h2 aria-label={t("host.settings.sound")}><Glyph name="speaker" size={20} /><Cap k="host.settings.sound" /></h2>
+        <div className="lr-sharing-audio-controls">{audio}</div>
+      </section>
       {technical ? <details className="lr-sharing-technical">
         <summary aria-label={t("host.settings.technical")}><Glyph name="sliders" size={17} /><Cap k="host.settings.technical" /></summary>
         <div>{technical}</div>
diff --git a/src/client/locales/en.ts b/src/client/locales/en.ts
index 143675c3c..5a64f5193 100644
--- a/src/client/locales/en.ts
+++ b/src/client/locales/en.ts
@@ -354,6 +354,9 @@ export const en: Record<CopyKey, string> = {
   "host.viewerOverview": "All viewer connections",
 
   "host.quality": "Video preset",
+  "host.quality.light": "Light",
+  "host.quality.hd": "HD",
+  "host.quality.highFps": "High FPS",
   "host.quality.720p30": "720p 30\u00a0fps",
   "host.quality.1080p30": "1080p 30\u00a0fps",
   "host.quality.1080p60": "1080p 60\u00a0fps",
@@ -363,9 +366,9 @@ export const en: Record<CopyKey, string> = {
   "host.settings.picture": "Picture",
   "host.settings.sound": "Sound",
   "host.settings.technical": "Connection & encoding",
-  "host.advanced.resolution": "Resolution ceiling",
-  "host.advanced.framerate": "Frame rate ceiling",
-  "host.advanced.bitrate": "Video bitrate ceiling",
+  "host.advanced.resolution": "Resolution limit",
+  "host.advanced.framerate": "FPS limit",
+  "host.advanced.bitrate": "Bitrate limit",
   "host.advanced.preference": "Picture preference",
   "host.advanced.preference.resolution": "Clarity",
   "host.advanced.preference.balanced": "Balanced",
@@ -377,6 +380,8 @@ export const en: Record<CopyKey, string> = {
   "host.advanced.audioBitrate": "Audio bitrate limit",
   "host.video.width": "Width limit in pixels",
   "host.video.height": "Height limit in pixels",
+  "host.video.commonRange": "Common range",
+  "host.video.inputHint": "Drag for common values, or enter {min}–{max} {unit} directly.",
   "host.video.resolutionHint": "Width ≤ {width} px; height ≤ {height} px; total ≤ {pixels} pixels. Source proportions are preserved; the FPS limit follows the size.",
   "host.audio.bitrateHint": "Audio bitrate limit: {min}–{max} kbps.",
   "host.advanced.audio.saver": "Standard",
diff --git a/src/client/locales/zh.ts b/src/client/locales/zh.ts
index 1721e6aa5..6b7fafbbb 100644
--- a/src/client/locales/zh.ts
+++ b/src/client/locales/zh.ts
@@ -354,6 +354,9 @@ export const zh = {
   "host.viewerOverview": "全员连接数据",
 
   "host.quality": "视频预设",
+  "host.quality.light": "轻量",
+  "host.quality.hd": "高清",
+  "host.quality.highFps": "高帧率",
   "host.quality.720p30": "720p 30\u00a0帧",
   "host.quality.1080p30": "1080p 30\u00a0帧",
   "host.quality.1080p60": "1080p 60\u00a0帧",
@@ -377,6 +380,8 @@ export const zh = {
   "host.advanced.audioBitrate": "音频码率上限",
   "host.video.width": "宽度上限（像素）",
   "host.video.height": "高度上限（像素）",
+  "host.video.commonRange": "常用范围",
+  "host.video.inputHint": "拖动选择常用值，也可直接输入 {min}–{max} {unit}。",
   "host.video.resolutionHint": "宽 ≤ {width}，高 ≤ {height} 像素；总像素 ≤ {pixels}。保留来源比例，帧率上限随尺寸调整。",
   "host.audio.bitrateHint": "音频码率上限：{min}–{max} kbps。",
   "host.advanced.audio.saver": "普通",
diff --git a/src/client/pages/ControlsPreview.tsx b/src/client/pages/ControlsPreview.tsx
index 144592dc4..6b18ed326 100644
--- a/src/client/pages/ControlsPreview.tsx
+++ b/src/client/pages/ControlsPreview.tsx
@@ -19,7 +19,7 @@ import { LauncherForm, type AppMode } from "../components/living/LauncherForm";
 import { AppReleaseNotice } from "../components/living/AppReleaseNotice";
 import { useTheaterMode } from "../components/living/use-theater-mode";
 
-import { AudioBitrateControl, QualityPresets, ResolutionControl, VideoRateControls } from "../components/living/QualityPresets";
+import { AudioBitrateControl, PicturePreferenceControl, QualityPresets, ResolutionControl, VideoRateControls } from "../components/living/QualityPresets";
 import { RoomCodeInput } from "../components/living/RoomCodeInput";
 import { MAX_SCREEN_AUDIO_BITRATE, VIDEO_CAPTURE_LIMITS, QUALITY_PROFILES, captureFramerateCeiling, matchingQualityProfileId, type QualityProfile } from "../media/quality";
 import type { loadCameraPreviews } from "../media/camera-previews";
@@ -124,16 +124,19 @@ export function ControlsPreview() {
               maxFramerate: Math.min(current.maxFramerate, captureFramerateCeiling(resolution)),
             }))} />
             <VideoRateControls value={quality} limits={VIDEO_CAPTURE_LIMITS} disabled={false}
-              onChange={change => setQuality(current => ({ ...current, ...change }))} /></>}
-          audio={<><div className="lr-door-group lr-source-audio-settings">
+              onChange={change => setQuality(current => ({ ...current, ...change }))} />
+            <PicturePreferenceControl value={quality.degradationPreference} disabled={false}
+              onChange={degradationPreference => setQuality(current => ({ ...current, degradationPreference }))} /></>}
+          audio={<><AudioBitrateControl value={quality.maxAudioBitrate ?? QUALITY_PROFILES["1080p30"].maxAudioBitrate} max={MAX_SCREEN_AUDIO_BITRATE}
+              disabled={false} onChange={maxAudioBitrate => setQuality(current => ({ ...current, maxAudioBitrate }))} />
+          <div className="lr-door-group lr-source-audio-settings">
             <SwitchItem checked={sound} onChange={setSound} label={t("host.sourcePicker.systemAudio")}
               hint={sound ? "hint-stop-audio" : "hint-share-audio"} />
             <LiveAudioExclusion load={previewApplications} value={excludedAudio} onChange={setExcludedAudio} disabled={!sound || paused} />
           </div><HostMicrophoneSettings deviceId={microphoneDevice} onDevice={setMicrophoneDevice} loadDevices={previewMicrophones}
             native enabled={microphone} disabled={paused} volume={microphoneVolume} onVolume={setMicrophoneVolume}
             voiceProcessing={voiceProcessing} onVoiceProcessing={setVoiceProcessing} />
-            <AudioBitrateControl value={quality.maxAudioBitrate ?? QUALITY_PROFILES["1080p30"].maxAudioBitrate} max={MAX_SCREEN_AUDIO_BITRATE}
-              disabled={false} onChange={maxAudioBitrate => setQuality(current => ({ ...current, maxAudioBitrate }))} /></>}
+          </>}
         />
       </section>
       <section id="option-preview" className="cp-card">
diff --git a/src/client/pages/HostPage.tsx b/src/client/pages/HostPage.tsx
index 6678b8913..ab396df5d 100644
--- a/src/client/pages/HostPage.tsx
+++ b/src/client/pages/HostPage.tsx
@@ -52,7 +52,7 @@ import type { ComicKind } from "../components/living/Comic";
 import type { HintKind } from "../ui/visual-kinds";
 import type { ComicTone } from "../components/living/comic-presentation";
 import { Tooltip } from "../components/living/Tooltip";
-import { AudioBitrateControl, QualityPresets, ResolutionControl, VideoRateControls } from "../components/living/QualityPresets";
+import { AudioBitrateControl, PicturePreferenceControl, QualityPresets, ResolutionControl, VideoRateControls } from "../components/living/QualityPresets";
 import { RoomCodeInput, RoomCodeError } from "../components/living/RoomCodeInput";
 import { MetricCell } from "../components/living/Metrics";
 import {
@@ -74,7 +74,7 @@ import {
   SwitchItem,
 } from "../components/living/primitives";
 import { hasPeerRouteEvidence } from "../components/status-badge-model";
-import { Glyph, type GlyphName } from "../ui/icons";
+import { Glyph } from "../ui/icons";
 import { say, useCopy, type CopyKey } from "../ui/copy";
 import { resolveMediaFailure, type MediaFailure } from "../ui/media-failure";
 import {
@@ -127,7 +127,6 @@ import {
   type BrowserCaptureSource,
   matchingQualityProfileId,
   QUALITY_PROFILES,
-  DEGRADATION_PREFERENCE_KEYS,
   videoCaptureLimits,
   captureFramerateCeiling,
   supportsCaptureProfile,
@@ -138,7 +137,6 @@ import {
   MAX_SCREEN_AUDIO_BITRATE,
   setMediaPaused,
   videoQualitySettingsEqual,
-  type DegradationPreference,
   type QualitySettings,
 } from "../media/quality";
 import { HostSfuRoute } from "../media/host-sfu-route";
@@ -217,24 +215,6 @@ type NoticeValue = (
 
 type StatusNoticeMessage = string | { key: CopyKey; vars?: Record<string, string>; failureCode?: string };
 
-const PREFERENCE_PRESENTATION: Record<
-  DegradationPreference,
-  { icon: GlyphName; hint: CopyKey }
-> = {
-  "maintain-resolution": {
-    icon: "mountain",
-    hint: "host.advanced.preference.resolutionHint",
-  },
-  balanced: {
-    icon: "balance",
-    hint: "host.advanced.preference.balancedHint",
-  },
-  "maintain-framerate": {
-    icon: "frames",
-    hint: "host.advanced.preference.framerateHint",
-  },
-};
-
 type ViewerQualityEvidence = Extract<
   ServerMessage,
   { type: "viewer-quality-evidence" }
@@ -3835,50 +3815,14 @@ export function HostPage({
                 })} />
               <VideoRateControls value={advancedQuality} limits={videoLimits}
                 disabled={phase === "starting" || switchingSource} onChange={changeAdvancedQuality} />
-              <div className="lr-door-group">
-                <span
-                  className="lr-door-glyph"
-                >
-                  <Glyph name="mountain" size={19} />
-                  <Cap k="host.advanced.preference" />
-                </span>
-                <div
-                  className="lr-row-group"
-                  role="group"
-                  aria-label={t("host.advanced.preference")}
-                >
-                  {(
-                    Object.keys(
-                      PREFERENCE_PRESENTATION,
-                    ) as DegradationPreference[]
-                  ).map((preference) => (
-                    <Chip
-                      key={preference}
-                      name="degradationPreference"
-                      value={preference}
-                      selected={
-                        advancedQuality.degradationPreference === preference
-                      }
-                      disabled={phase === "starting" || switchingSource}
-                      title={`${t(DEGRADATION_PREFERENCE_KEYS[preference])} · ${t(PREFERENCE_PRESENTATION[preference].hint)}`}
-                      hint={preference === "maintain-resolution" ? "hint-prefer-resolution" : preference === "maintain-framerate" ? "hint-prefer-framerate" : "hint-degrade-pref"}
-                      onClick={() =>
-                        changeAdvancedQuality({
-                          degradationPreference: preference,
-                        })
-                      }
-                    >
-                      <Glyph
-                        name={PREFERENCE_PRESENTATION[preference].icon}
-                        size={18}
-                      />
-                      <Cap k={DEGRADATION_PREFERENCE_KEYS[preference]} />
-                    </Chip>
-                  ))}
-                </div>
-              </div>
+              <PicturePreferenceControl value={advancedQuality.degradationPreference}
+                disabled={phase === "starting" || switchingSource}
+                onChange={degradationPreference => changeAdvancedQuality({ degradationPreference })} />
             </>}
             audio={<>
+              <AudioBitrateControl value={screenAudioBitrate(advancedQuality.maxAudioBitrate)}
+                max={audioBitrateCeiling} disabled={phase === "starting" || switchingSource}
+                onChange={changeMaxAudioBitrate} />
               {phase === "live" && nativeActive && nativeSourceSelectionRef.current?.target.kind === "display" &&
                 nativeClientRef.current?.health.nativeMedia.microphone && nativeClientRef.current.health.nativeMedia.processAudioExclusion ? (
                 <div className="lr-door-group lr-source-audio-settings">
@@ -3915,9 +3859,6 @@ export function HostPage({
                   onVoiceProcessing={enabled => void changeMicrophone(microphoneEnabled, microphoneDevices.browser, enabled)}
                 />
               ) : null}
-              <AudioBitrateControl value={screenAudioBitrate(advancedQuality.maxAudioBitrate)}
-                max={audioBitrateCeiling} disabled={phase === "starting" || switchingSource}
-                onChange={changeMaxAudioBitrate} />
             </>}
             technical={<>
               <div className="lr-door-group">
diff --git a/src/client/styles.css b/src/client/styles.css
index e0fb39ea5..b0c66b919 100644
--- a/src/client/styles.css
+++ b/src/client/styles.css
@@ -1185,9 +1185,12 @@ html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #334
 .lr-quality-heading { display: flex; flex-wrap: wrap; align-items: center; justify-content: space-between; gap: 6px 12px; min-width: 0; }
 .lr-quality-heading > .lr-comic-tip-wrap { margin-inline-start: auto; max-width: 100%; }
 .lr-input.lr-quality-number, .lr-input.lr-video-size {
-  height: 36px; padding: 0 10px; border-width: 1px; border-radius: 12px;
+  height: 38px; padding: 0 10px; border-width: 1px; border-radius: 12px;
   background: var(--wall); max-width: 100%; font-family: var(--mono);
+  transition: border-color 140ms ease, background-color 140ms ease;
 }
+.lr-input:is(.lr-quality-number, .lr-video-size):hover:not(:has(:disabled)) { border-color: var(--ink); background: var(--control-hover); }
+.lr-input:is(.lr-quality-number, .lr-video-size):has(:disabled) { opacity: .55; }
 .lr-input.lr-quality-number { width: 110px; gap: 6px; }
 .lr-quality-number input, .lr-video-size input { font-size: 13px; font-weight: 650; appearance: textfield; }
 .lr-quality-number input { text-align: right; }
@@ -1196,8 +1199,11 @@ html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #334
 .lr-video-size input::-webkit-inner-spin-button, .lr-video-size input::-webkit-outer-spin-button { appearance: none; margin: 0; }
 .lr-quality-rate { display: grid; gap: 4px; width: 100%; min-width: 0; }
 .lr-quality-rate > input { min-width: 0; width: 100%; height: 28px; margin: 0; accent-color: var(--action); }
+.lr-quality-range-labels { display: flex; justify-content: space-between; color: var(--muted); font-family: var(--mono); font-size: 10px; }
 .lr-input.lr-video-size { display: grid; grid-template-columns: minmax(0, 1fr) auto minmax(0, 1fr) auto; gap: 5px; width: 176px; }
 .lr-resolution-controls { display: flex; flex-direction: column; gap: 8px; min-width: 0; }
+.lr-resolution-controls > .lr-row-group { display: grid; grid-auto-flow: column; grid-auto-columns: minmax(0, 1fr); max-width: 520px; }
+.lr-resolution-controls .lr-chip { width: 100%; justify-content: center; }
 .lr-video-size input { width: 100%; padding: 0; text-align: center; appearance: textfield; }
 @media (pointer: coarse) {
   .lr-invite-url, .lr-quality-number input, .lr-video-size input { font-size: 16px; }
@@ -1853,37 +1859,66 @@ html[data-theme="dark"] .lr-switch::after { background: var(--ink); }
 .lr-stage-notices:empty { display: none; }
 .lr-sharing-settings { width: min(820px, 100%); margin: 0 auto; container: sharing-settings / inline-size; }
 .lr-sharing-panel {
-  margin-top: 14px; padding: 22px; background: var(--paper);
+  margin-top: 14px; padding: 24px; background: var(--paper);
   border: 1px solid var(--control-edge); border-radius: 24px; box-shadow: var(--control-shadow);
   animation: lr-sharing-enter 180ms ease-out;
 }
-.lr-sharing-columns { display: grid; grid-template-columns: minmax(0, 1.2fr) minmax(0, 1fr); gap: 28px; }
-.lr-sharing-section { display: grid; align-content: start; gap: 18px; min-width: 0; }
-.lr-sharing-section + .lr-sharing-section { padding-inline-start: 24px; border-inline-start: 1px solid var(--wall-2); }
-.lr-sharing-section h2 { display: flex; align-items: center; gap: 8px; font-size: 15px; }
+.lr-sharing-section { display: grid; align-content: start; gap: 20px; min-width: 0; }
+.lr-sharing-section + .lr-sharing-section { margin-top: 24px; padding-top: 20px; border-top: 1px solid var(--wall-2); }
+.lr-sharing-section h2 { display: flex; align-items: center; gap: 8px; font-size: 16px; }
+.lr-sharing-section h2 .lr-cap { font-size: inherit; }
 .lr-sharing-section .lr-door-group { gap: 8px; }
 .lr-sharing-panel .lr-sharing-section .lr-door-glyph { color: var(--muted); }
 .lr-sharing-section .lr-door-glyph .lr-cap { white-space: normal; }
-.lr-sharing-limits { display: grid; grid-template-columns: 1fr; gap: 16px; }
+.lr-sharing-limits { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 24px; }
 .lr-sharing-panel .lr-slider { width: 100%; }
 .lr-sharing-panel .lr-slider output { min-width: 9ch; }
-.lr-sharing-section .lr-tiles { gap: 8px; }
+.lr-sharing-section .lr-tiles { gap: 12px; }
 .lr-sharing-section .lr-tiles > .lr-comic-tip-wrap { flex: 1; min-width: 0; }
-.lr-sharing-section .lr-tile { width: 100%; min-width: 0; padding: 8px 5px; gap: 2px; border-radius: 14px; }
-.lr-sharing-section .lr-tile > svg { height: 28px; }
+.lr-sharing-section .lr-tile { width: 100%; min-width: 0; padding: 12px 8px; gap: 5px; border-radius: 16px; }
+.lr-sharing-section .lr-tile > svg { height: 30px; }
+.lr-sharing-section .lr-tile strong { font-size: 14px; font-weight: 650; }
 .lr-sharing-section .lr-slider input { width: 100%; min-width: 0; }
-.lr-sharing-section .lr-row-group { gap: 7px; }
-.lr-sharing-section .lr-chip { min-height: 38px; padding: 7px 11px; }
+.lr-sharing-section .lr-row-group { gap: 8px; }
+.lr-sharing-section .lr-chip { min-height: 40px; padding: 7px 12px; }
+.lr-sharing-audio-controls { display: grid; gap: 20px; min-width: 0; }
+.lr-sharing-audio-controls:has(> .lr-source-audio-settings):has(> .lr-microphone-settings) { grid-template-columns: repeat(2, minmax(0, 1fr)); }
+.lr-sharing-audio-controls > .lr-audio-quality { grid-column: 1 / -1; }
+.lr-sharing-panel .lr-microphone-settings { max-width: none; }
+.lr-sharing-panel input[type="range"] { appearance: none; background: transparent; }
+.lr-sharing-panel input[type="range"]:disabled { opacity: .55; cursor: default; }
+.lr-sharing-panel input[type="range"]::-webkit-slider-runnable-track { height: 6px; border-radius: 999px; background: linear-gradient(to right, var(--action) var(--range-fill), var(--wall-2) var(--range-fill)); }
+.lr-sharing-panel input[type="range"]::-moz-range-track { height: 6px; border-radius: 999px; background: linear-gradient(to right, var(--action) var(--range-fill), var(--wall-2) var(--range-fill)); }
+.lr-sharing-panel input[type="range"]::-webkit-slider-thumb { appearance: none; width: 20px; height: 20px; margin-top: -7px; border: 3px solid var(--paper); border-radius: 50%; background: var(--action); box-shadow: 0 0 0 1px var(--action); transition: transform 180ms var(--spring); }
+.lr-sharing-panel input[type="range"]::-moz-range-thumb { width: 14px; height: 14px; border: 3px solid var(--paper); border-radius: 50%; background: var(--action); box-shadow: 0 0 0 1px var(--action); transition: transform 180ms var(--spring); }
+.lr-sharing-panel input[type="range"]:is(:hover, :focus-visible):not(:disabled)::-webkit-slider-thumb { transform: scale(1.1); }
+.lr-sharing-panel input[type="range"]:is(:hover, :focus-visible):not(:disabled)::-moz-range-thumb { transform: scale(1.1); }
 .lr-sharing-technical { margin-top: 20px; padding-top: 12px; border-top: 1px solid var(--wall-2); }
-.lr-sharing-technical > summary { width: fit-content; padding: 7px 3px; color: var(--muted); cursor: pointer; font-size: 12px; }
+.lr-sharing-technical > summary { padding: 10px 8px; border-radius: 12px; color: var(--muted); cursor: pointer; font-size: 12px; transition: color 140ms ease, background-color 140ms ease; }
+.lr-sharing-technical > summary:is(:hover, :focus-visible) { color: var(--ink); background: var(--control-hover); }
 .lr-sharing-technical > summary > svg { vertical-align: middle; margin-inline-end: 6px; }
 .lr-sharing-technical > div { display: grid; gap: 18px; padding-top: 16px; }
+.lr-sharing-technical .lr-row-group:has(.lr-switch-item) { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 16px; }
+.lr-sharing-technical .lr-switch-item .lr-cap { white-space: normal; }
 @keyframes lr-sharing-enter { from { opacity: 0; transform: translateY(-6px); } to { opacity: 1; transform: translateY(0); } }
 @media (prefers-reduced-motion: reduce) { .lr-sharing-panel { animation: none; } }
-@container sharing-settings (max-width: 680px) {
+@container sharing-settings (max-width: 600px) {
   .lr-sharing-panel { padding: 16px; border-radius: 20px; }
-  .lr-sharing-columns { grid-template-columns: 1fr; gap: 22px; }
-  .lr-sharing-section + .lr-sharing-section { padding: 20px 0 0; border-inline-start: 0; border-top: 1px solid var(--wall-2); }
+  .lr-sharing-limits, .lr-sharing-audio-controls:has(> .lr-source-audio-settings):has(> .lr-microphone-settings),
+  .lr-sharing-technical .lr-row-group:has(.lr-switch-item) { grid-template-columns: 1fr; gap: 20px; }
+  .lr-sharing-section .lr-tiles { gap: 8px; }
+  .lr-sharing-section .lr-tile { padding: 10px 4px; }
+  .lr-sharing-section .lr-tile strong { font-size: 12px; }
+  .lr-resolution-controls > .lr-row-group { gap: 5px; }
+  .lr-resolution-controls .lr-chip { padding-inline: 3px; font-size: 12px; letter-spacing: 0; }
+}
+@container sharing-settings (max-width: 400px) {
+  .lr-picture-preference .lr-row-group, .lr-audio-quality .lr-row-group { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); }
+  .lr-picture-preference .lr-chip, .lr-audio-quality .lr-chip { width: 100%; justify-content: center; padding-inline: 6px; }
+  .lr-picture-preference .lr-chip:has(.lr-cap) > svg, .lr-audio-quality .lr-chip:has(.lr-cap) > .lr-audio-rate { display: none; }
+}
+@container sharing-settings (max-width: 340px) {
+  .lr-sharing-section .lr-tile small { max-width: 8ch; min-height: 2.8em; line-height: 1.4; }
 }
 .lr-host-share-controls {
   display: flex; flex-wrap: wrap; align-items: center; justify-content: center; gap: 4px;
@@ -2171,6 +2206,8 @@ svg[data-comic-motion="still"] .lr-person-eyes > ellipse {
   }
   .lr-tv-static { animation: none; opacity: .35; }
   .lr-btn, .lr-chip, .lr-tile, .lr-toggle button, .lr-lang > button, .lr-language-menu button, .lr-source-option, .lr-source-picker-refresh, .lr-source-picker-close { transform: none !important; }
+  .lr-sharing-panel input[type="range"]::-webkit-slider-thumb { transform: none !important; }
+  .lr-sharing-panel input[type="range"]::-moz-range-thumb { transform: none !important; }
   .lr-route-edge.is-pending { animation: none; }
 }
 
diff --git a/tests/quality-controls.test.ts b/tests/quality-controls.test.ts
index 5c6ff349d..f474cd656 100644
--- a/tests/quality-controls.test.ts
+++ b/tests/quality-controls.test.ts
@@ -1,8 +1,12 @@
 import { readFileSync } from "node:fs";
 import { runInNewContext } from "node:vm";
 import * as jsxRuntime from "react/jsx-runtime";
+import { createElement } from "react";
+import { renderToStaticMarkup } from "react-dom/server";
 import ts from "typescript";
 import { describe, expect, it, vi } from "vitest";
+import { VideoRateControls } from "../src/client/components/living/QualityPresets";
+import { QUALITY_PROFILES, VIDEO_CAPTURE_LIMITS } from "../src/client/media/quality";
 
 // Exercise the private draft owner without adding a DOM runtime to unit tests.
 // Real pointer/focus ordering is also checked in the existing Browser preview.
@@ -42,6 +46,28 @@ function editor() {
 }
 
 describe("Numeric quality editing group", () => {
+  it.each([
+    { fps: 144, mbps: 80, maxFps: 240, maxMbps: 240, sliderFps: 60, sliderMbps: 20 },
+    { fps: 15, mbps: 5, maxFps: 30, maxMbps: 10, sliderFps: 30, sliderMbps: 10 },
+  ])("keeps common sliders separate from accepted input limits ($maxFps fps, $maxMbps Mbps)", test => {
+    const onChange = vi.fn();
+    const html = renderToStaticMarkup(createElement(VideoRateControls, {
+      value: { ...QUALITY_PROFILES["1080p30"], maxFramerate: test.fps, maxBitrate: test.mbps * 1_000_000 },
+      limits: { ...VIDEO_CAPTURE_LIMITS, maxVideoFramerate: test.maxFps, maxVideoBitrate: test.maxMbps * 1_000_000 },
+      disabled: false, onChange,
+    }));
+    const inputs = html.match(/<input\b[^>]*>/g)!;
+    const numbers = inputs.filter(input => input.includes('type="number"'));
+    const sliders = inputs.filter(input => input.includes('type="range"'));
+    for (const [index, value, max, sliderMax] of [[0, test.fps, test.maxFps, test.sliderFps], [1, test.mbps, test.maxMbps, test.sliderMbps]] as const) {
+      expect(numbers[index]).toContain(`max="${max}"`);
+      expect(numbers[index]).toContain(`value="${value}"`);
+      expect(sliders[index]).toContain(`max="${sliderMax}"`);
+      expect(sliders[index]).toContain(`value="${Math.min(value, sliderMax)}"`);
+    }
+    expect(onChange).not.toHaveBeenCalled();
+  });
+
   it("preserves a draft through group navigation or cancelled selection, then commits on leaving", () => {
     const current = editor();
     current.input.value = "256";

From 65595c833cbd2b7138af92ea671f40b8bc5466b7 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 18:07:25 +0800
Subject: [PATCH 214/262] fix(ui): distinguish custom quality values from
 common sliders

---
 docs/guide/getting-started.md                 |  4 +-
 docs/guide/getting-started.zh-CN.md           |  3 +-
 docs/standards/visual-language.md             |  7 ++-
 .../components/living/QualityPresets.tsx      | 55 ++++++++++++++-----
 src/client/locales/en.ts                      |  3 +
 src/client/locales/zh.ts                      |  3 +
 src/client/styles.css                         |  6 +-
 tests/quality-controls.test.ts                | 36 +++++++++++-
 8 files changed, 95 insertions(+), 22 deletions(-)

diff --git a/docs/guide/getting-started.md b/docs/guide/getting-started.md
index 8d7e369a5..6900f119b 100644
--- a/docs/guide/getting-started.md
+++ b/docs/guide/getting-started.md
@@ -172,8 +172,10 @@ Open **Sharing settings** below the picture to adjust picture and audio quality.
 - Choose a picture preset, or enter width and height under **Resolution limit**.
   Piik preserves the source's proportions within that ceiling, including portrait
   and ultrawide pictures.
-- Sliders cover common values up to 60 fps and 20 Mbps. You can also enter an
+- Sliders cover 15–60 fps in steps of 5 and 2–12 Mbps in steps of 0.5. You can also enter an
   **FPS limit** from 1 to 240 fps and a **Bitrate limit** from 0.1 to 240 Mbps.
+  Values outside those slider steps show **Custom**; **Use common range**
+  selects the nearest available slider value.
   The frame-rate limit depends
   on picture size: for example, 1080p240, 1440p144 and 4K60 are accepted requests.
 - Choose an audio preset, or enter an **Audio bitrate limit** from 6 to 320 kbps.
diff --git a/docs/guide/getting-started.zh-CN.md b/docs/guide/getting-started.zh-CN.md
index 53886536c..51fec1c16 100644
--- a/docs/guide/getting-started.zh-CN.md
+++ b/docs/guide/getting-started.zh-CN.md
@@ -149,8 +149,9 @@ Linux 原生采集还需要[系统组件](../../native/capture/linux/README.md)
 
 - 可选画质预设，也可在 **分辨率上限** 中填写宽和高。画面在上限内保留来源比例，
   包括竖屏和超宽屏。
-- 滑块覆盖最高 60 帧、20 Mbps 的常用范围；也可直接填写 1–240 帧的 **帧率上限**
+- 滑块覆盖 15–60 帧（每步 5 帧）、2–12 Mbps（每步 0.5 Mbps）的常用范围；也可直接填写 1–240 帧的 **帧率上限**
   和 0.1–240 Mbps 的 **视频码率上限**。
+  不在滑块档位上的数值显示为 **自定义**；点击 **返回常用范围**，使用最近的可用档位。
   帧率范围随画幅变化，例如可以请求 1080p240、1440p144 或 4K60。
 - 音频保留三档预设，也可填写 6–320 kbps 的 **音频码率上限**。
 
diff --git a/docs/standards/visual-language.md b/docs/standards/visual-language.md
index 92477e3bc..3b1bb9062 100644
--- a/docs/standards/visual-language.md
+++ b/docs/standards/visual-language.md
@@ -160,8 +160,11 @@ the picture or participants. Keep picture and sound in distinct sections; place
 related adjustments side by side where space permits and stack them on narrow
 screens. Avoid another permanent row of settings cards. Numeric quality inputs
 retain the accepted capability range; sliders offer a labelled common range for
-quick adjustment. A higher typed value remains visible and must not be reduced
-merely by opening or focusing its slider. Shared presentation stays separate
+quick adjustment. Values outside its range or steps show a custom-value row
+instead of an inaccurate slider position. Returning to the nearest available
+common step is an explicit action; rendering, focus or reopening never changes
+the value. Derive this presentation from the current value, without a second
+setting mode. Shared presentation stays separate
 from the existing setting/resource owners.
 The microphone comic depicts Host commentary gain;
 the Viewer's listening-volume comic remains a different action.
diff --git a/src/client/components/living/QualityPresets.tsx b/src/client/components/living/QualityPresets.tsx
index cac74cf12..9e3781656 100644
--- a/src/client/components/living/QualityPresets.tsx
+++ b/src/client/components/living/QualityPresets.tsx
@@ -168,17 +168,23 @@ export function VideoRateControls({ value, limits, disabled, onChange }: {
   const fpsMax = captureFramerateCeiling(value.resolution, limits);
   const controls = [
     { name: "maxFramerate", label: "host.advanced.framerate", icon: "frames", hint: "hint-metric-fps",
-      value: value.maxFramerate, min: MIN_VIDEO_FRAMERATE, max: fpsMax, sliderMax: 60, step: 1, unit: "fps",
+      value: value.maxFramerate, min: MIN_VIDEO_FRAMERATE, max: fpsMax, step: 1, unit: "fps",
+      sliderMin: 15, sliderMax: 60, sliderStep: 5,
       change: (maxFramerate: number) => onChange({ maxFramerate }) },
     { name: "maxBitrate", label: "host.advanced.bitrate", icon: "gauge", hint: "hint-metric-bitrate",
       value: value.maxBitrate / 1_000_000, min: MIN_VIDEO_BITRATE / 1_000_000,
-      max: limits.maxVideoBitrate / 1_000_000, sliderMax: 20, step: 0.1, unit: "Mbps",
+      max: limits.maxVideoBitrate / 1_000_000, step: 0.1, unit: "Mbps",
+      sliderMin: 2, sliderMax: 12, sliderStep: 0.5,
       change: (mbps: number) => onChange({ maxBitrate: Math.round(mbps * 1_000_000) }) },
   ] as const;
   return <div className="lr-sharing-limits">
     {controls.map(control => {
-      // The slider is a common-range shortcut, not the capture admission limit.
-      const sliderMax = Math.max(control.min, Math.min(control.sliderMax, control.max));
+      // Keep the slider on its own steps; typed values must never be rounded by the DOM.
+      const sliderMax = Math.min(control.sliderMax, Math.floor(control.max / control.sliderStep) * control.sliderStep);
+      const hasCommonRange = sliderMax >= control.sliderMin;
+      const commonValue = Math.min(sliderMax, Math.max(control.sliderMin,
+        Math.round(control.value / control.sliderStep) * control.sliderStep));
+      const custom = !hasCommonRange || control.value !== commonValue;
       return <QualityNumberControl key={control.name} {...control}
         className="lr-quality-rate" label={t(control.label)}
         disabled={disabled || control.max < control.min} onChange={control.change}>
@@ -191,16 +197,37 @@ export function VideoRateControls({ value, limits, disabled, onChange }: {
               {input}
             </Tooltip>
           </div>
-          <input type="range" min={control.min} max={sliderMax} step={control.step}
-            value={Math.min(control.value, sliderMax)} disabled={disabled || control.max < control.min}
-            style={{ "--range-fill": `${100 * (Math.min(control.value, sliderMax) - control.min) / (sliderMax - control.min || 1)}%` } as CSSProperties}
-            aria-label={`${t(control.label)} · ${t("host.video.commonRange")}`}
-            onChange={event => select(event.currentTarget.valueAsNumber)}
-            onClick={event => select(event.currentTarget.valueAsNumber)} />
-          <div className="lr-quality-range-labels" aria-hidden="true">
-            <span>{control.min}</span>
-            <span>{sliderMax} {control.unit}</span>
-          </div>
+          {custom ? <div className="lr-quality-custom">
+            <span className="lr-quality-custom-label">
+              <Glyph name="pencil" size={16} />
+              <span className={vis ? "visually-hidden" : "lr-cap"}>{t("host.video.custom")}</span>
+            </span>
+            {hasCommonRange ? <Tooltip kind={control.hint} text={vis ? undefined : t("host.video.returnCommonHint", {
+              value: String(commonValue), unit: control.unit,
+            })}>
+              <button type="button" className="lr-btn" disabled={disabled}
+                aria-label={`${t(control.label)} · ${t("host.video.returnCommonHint", { value: String(commonValue), unit: control.unit })}`}
+                onClick={event => {
+                  const group = event.currentTarget.closest(".lr-quality-rate");
+                  select(commonValue);
+                  // The return button disappears; keep keyboard focus in this field.
+                  if (event.detail === 0) requestAnimationFrame(() => group?.querySelector<HTMLInputElement>('input[type="number"]')?.focus());
+                }}>
+                <Glyph name="sliders" size={17} /><Cap k="host.video.returnCommon" />
+              </button>
+            </Tooltip> : null}
+          </div> : <>
+            <input type="range" min={control.sliderMin} max={sliderMax} step={control.sliderStep}
+              value={control.value} disabled={disabled}
+              style={{ "--range-fill": `${100 * (control.value - control.sliderMin) / (sliderMax - control.sliderMin || 1)}%` } as CSSProperties}
+              aria-label={`${t(control.label)} · ${t("host.video.commonRange")}`}
+              onChange={event => select(event.currentTarget.valueAsNumber)}
+              onClick={event => select(event.currentTarget.valueAsNumber)} />
+            <div className="lr-quality-range-labels" aria-hidden="true">
+              <span>{control.sliderMin}</span>
+              <span>{sliderMax} {control.unit}</span>
+            </div>
+          </>}
         </>}
       </QualityNumberControl>;
     })}
diff --git a/src/client/locales/en.ts b/src/client/locales/en.ts
index 5a64f5193..7f5af7216 100644
--- a/src/client/locales/en.ts
+++ b/src/client/locales/en.ts
@@ -381,6 +381,9 @@ export const en: Record<CopyKey, string> = {
   "host.video.width": "Width limit in pixels",
   "host.video.height": "Height limit in pixels",
   "host.video.commonRange": "Common range",
+  "host.video.custom": "Custom",
+  "host.video.returnCommon": "Use common range",
+  "host.video.returnCommonHint": "Use the nearest common value: {value} {unit}.",
   "host.video.inputHint": "Drag for common values, or enter {min}–{max} {unit} directly.",
   "host.video.resolutionHint": "Width ≤ {width} px; height ≤ {height} px; total ≤ {pixels} pixels. Source proportions are preserved; the FPS limit follows the size.",
   "host.audio.bitrateHint": "Audio bitrate limit: {min}–{max} kbps.",
diff --git a/src/client/locales/zh.ts b/src/client/locales/zh.ts
index 6b7fafbbb..fbbf18680 100644
--- a/src/client/locales/zh.ts
+++ b/src/client/locales/zh.ts
@@ -381,6 +381,9 @@ export const zh = {
   "host.video.width": "宽度上限（像素）",
   "host.video.height": "高度上限（像素）",
   "host.video.commonRange": "常用范围",
+  "host.video.custom": "自定义",
+  "host.video.returnCommon": "返回常用范围",
+  "host.video.returnCommonHint": "使用最近的常用档位：{value} {unit}。",
   "host.video.inputHint": "拖动选择常用值，也可直接输入 {min}–{max} {unit}。",
   "host.video.resolutionHint": "宽 ≤ {width}，高 ≤ {height} 像素；总像素 ≤ {pixels}。保留来源比例，帧率上限随尺寸调整。",
   "host.audio.bitrateHint": "音频码率上限：{min}–{max} kbps。",
diff --git a/src/client/styles.css b/src/client/styles.css
index b0c66b919..e04daae77 100644
--- a/src/client/styles.css
+++ b/src/client/styles.css
@@ -1197,9 +1197,13 @@ html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #334
 .lr-quality-number span, .lr-video-size span { color: var(--muted); font-size: 11px; }
 .lr-quality-number input::-webkit-inner-spin-button, .lr-quality-number input::-webkit-outer-spin-button,
 .lr-video-size input::-webkit-inner-spin-button, .lr-video-size input::-webkit-outer-spin-button { appearance: none; margin: 0; }
-.lr-quality-rate { display: grid; gap: 4px; width: 100%; min-width: 0; }
+.lr-quality-rate { display: grid; align-content: start; gap: 4px; width: 100%; min-width: 0; }
 .lr-quality-rate > input { min-width: 0; width: 100%; height: 28px; margin: 0; accent-color: var(--action); }
 .lr-quality-range-labels { display: flex; justify-content: space-between; color: var(--muted); font-family: var(--mono); font-size: 10px; }
+.lr-quality-custom { display: flex; align-items: center; justify-content: space-between; gap: 8px; min-height: 47px; }
+.lr-quality-custom-label { display: inline-flex; align-items: center; gap: 6px; color: var(--muted); }
+.lr-quality-custom .lr-btn { min-width: 40px; height: 36px; padding: 0 10px; gap: 5px; border-width: 1px; }
+.lr-quality-custom .lr-cap { font-size: 12px; }
 .lr-input.lr-video-size { display: grid; grid-template-columns: minmax(0, 1fr) auto minmax(0, 1fr) auto; gap: 5px; width: 176px; }
 .lr-resolution-controls { display: flex; flex-direction: column; gap: 8px; min-width: 0; }
 .lr-resolution-controls > .lr-row-group { display: grid; grid-auto-flow: column; grid-auto-columns: minmax(0, 1fr); max-width: 520px; }
diff --git a/tests/quality-controls.test.ts b/tests/quality-controls.test.ts
index f474cd656..fa4a679fa 100644
--- a/tests/quality-controls.test.ts
+++ b/tests/quality-controls.test.ts
@@ -47,8 +47,9 @@ function editor() {
 
 describe("Numeric quality editing group", () => {
   it.each([
-    { fps: 144, mbps: 80, maxFps: 240, maxMbps: 240, sliderFps: 60, sliderMbps: 20 },
+    { fps: 30, mbps: 5, maxFps: 240, maxMbps: 240, sliderFps: 60, sliderMbps: 12 },
     { fps: 15, mbps: 5, maxFps: 30, maxMbps: 10, sliderFps: 30, sliderMbps: 10 },
+    { fps: 25, mbps: 5, maxFps: 29, maxMbps: 5.2, sliderFps: 25, sliderMbps: 5 },
   ])("keeps common sliders separate from accepted input limits ($maxFps fps, $maxMbps Mbps)", test => {
     const onChange = vi.fn();
     const html = renderToStaticMarkup(createElement(VideoRateControls, {
@@ -59,11 +60,40 @@ describe("Numeric quality editing group", () => {
     const inputs = html.match(/<input\b[^>]*>/g)!;
     const numbers = inputs.filter(input => input.includes('type="number"'));
     const sliders = inputs.filter(input => input.includes('type="range"'));
-    for (const [index, value, max, sliderMax] of [[0, test.fps, test.maxFps, test.sliderFps], [1, test.mbps, test.maxMbps, test.sliderMbps]] as const) {
+    for (const [index, value, max, sliderMin, sliderMax, step] of [
+      [0, test.fps, test.maxFps, 15, test.sliderFps, 5], [1, test.mbps, test.maxMbps, 2, test.sliderMbps, 0.5],
+    ] as const) {
       expect(numbers[index]).toContain(`max="${max}"`);
       expect(numbers[index]).toContain(`value="${value}"`);
+      expect(sliders[index]).toContain(`min="${sliderMin}"`);
       expect(sliders[index]).toContain(`max="${sliderMax}"`);
-      expect(sliders[index]).toContain(`value="${Math.min(value, sliderMax)}"`);
+      expect(sliders[index]).toContain(`step="${step}"`);
+      expect(sliders[index]).toContain(`value="${value}"`);
+    }
+    expect(onChange).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    { fps: 144, mbps: 80, maxFps: 240, maxMbps: 240, returnFps: 60, returnMbps: 12 },
+    { fps: 5, mbps: 0.5, maxFps: 240, maxMbps: 240, returnFps: 15, returnMbps: 2 },
+    { fps: 29, mbps: 5.1, maxFps: 240, maxMbps: 240, returnFps: 30, returnMbps: 5 },
+    { fps: 29, mbps: 5.2, maxFps: 29, maxMbps: 5.2, returnFps: 25, returnMbps: 5 },
+    { fps: 8, mbps: 0.5, maxFps: 10, maxMbps: 1, returnFps: null, returnMbps: null },
+  ])("preserves custom values without an inaccurate slider ($fps fps, $mbps Mbps)", test => {
+    const onChange = vi.fn();
+    const html = renderToStaticMarkup(createElement(VideoRateControls, {
+      value: { ...QUALITY_PROFILES["1080p30"], maxFramerate: test.fps, maxBitrate: test.mbps * 1_000_000 },
+      limits: { ...VIDEO_CAPTURE_LIMITS, maxVideoFramerate: test.maxFps, maxVideoBitrate: test.maxMbps * 1_000_000 },
+      disabled: false, onChange,
+    }));
+    const fields = html.split('<div class="lr-quality-rate">').slice(1);
+    expect(fields).toHaveLength(2);
+    for (const [index, value, nearest, unit] of [[0, test.fps, test.returnFps, "fps"], [1, test.mbps, test.returnMbps, "Mbps"]] as const) {
+      expect(fields[index]).toContain(`value="${value}"`);
+      expect(fields[index]).not.toContain('type="range"');
+      expect(fields[index]).toContain('class="lr-quality-custom"');
+      if (nearest === null) expect(fields[index]).not.toContain('<button');
+      else expect(fields[index]).toMatch(new RegExp(`<button[^>]*aria-label="[^"]*${nearest} ${unit}`));
     }
     expect(onChange).not.toHaveBeenCalled();
   });

From 399c4c97da659d98af34a751c6f93be0e3bb51a7 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 18:18:14 +0800
Subject: [PATCH 215/262] docs(audio): explain virtual mixer source-audio
 routing

---
 docs/guide/getting-started.md       | 6 ++++++
 docs/guide/getting-started.zh-CN.md | 4 ++++
 docs/guide/troubleshooting.md       | 1 +
 docs/guide/troubleshooting.zh-CN.md | 1 +
 docs/todo.md                        | 6 ++++++
 5 files changed, 18 insertions(+)

diff --git a/docs/guide/getting-started.md b/docs/guide/getting-started.md
index 6900f119b..26a05126b 100644
--- a/docs/guide/getting-started.md
+++ b/docs/guide/getting-started.md
@@ -221,6 +221,12 @@ This excludes one process and its children. Other apps remain audible, including
 those playing through other output devices.
 It does not mute your Piik microphone or prevent speaker sound reaching a microphone.
 
+If a virtual microphone remains audible with Piik's microphone off, temporarily
+turn off **System sound** to compare. If the voice disappears, check the mixer's
+playback output and monitoring, or capture only the desired application's window
+audio. Excluding a voice app does not also exclude a separate mixer that plays
+your processed voice, even through a virtual output device.
+
 While sharing, use **Sharing settings → Sound** to change system sound or the
 excluded app without stopping the share. If the app closes or restarts, source
 audio stops; refresh the application list and select it again.
diff --git a/docs/guide/getting-started.zh-CN.md b/docs/guide/getting-started.zh-CN.md
index 51fec1c16..376da9d3c 100644
--- a/docs/guide/getting-started.zh-CN.md
+++ b/docs/guide/getting-started.zh-CN.md
@@ -187,6 +187,10 @@ Piik 会记住已应用的设置，供下次使用。仅用浏览器时，设置
 其他应用的声音仍会被分享，包括输出到其他播放设备的声音。
 它不影响 Piik 麦克风，也不能消除扬声器被麦克风收音产生的回声。
 
+使用虚拟麦克风时，如果关闭 Piik 麦克风后仍能听到你的声音，可暂时关闭 **系统声音** 对照。
+若声音随之消失，请检查混音软件的播放输出与监听，或改为只分享目标应用的窗口音频。
+排除语音软件不会同时排除另一个混音软件；后者输出到虚拟播放设备的声音也可能被采集。
+
 开播后，可在 **分享设置 → 声音** 中调整系统声音和排除的应用，无需停止分享。
 所选应用关闭或重启后，来源声音会停止；请刷新应用列表并重新选择。
 暂时关闭来源声音会保留排除选择；需要恢复完整的系统声音时，选择 **不排除**。
diff --git a/docs/guide/troubleshooting.md b/docs/guide/troubleshooting.md
index ce5234029..dfb8dbfd9 100644
--- a/docs/guide/troubleshooting.md
+++ b/docs/guide/troubleshooting.md
@@ -25,6 +25,7 @@ collect a diagnostic report if the problem persists.
 | Picture but no source sound | Unmute the video. The host should choose a source with shareable audio and enable sound in the source picker. Camera video and audio inputs are selected separately; see [audio settings](./getting-started.md#add-your-voice). |
 | Cannot hear the host's voice | The host can enable **Microphone** below the picture, then check the selected input and its volume in **Settings → Sound**. Check the device connection and microphone permission. If the control is unavailable, update the App and refresh the page. |
 | Screen sharing includes a voice app's audio | Windows App screen capture can [exclude application audio](./getting-started.md#exclude-a-voice-app-from-screen-audio). This does not remove echo from speakers picked up by a microphone. |
+| Virtual microphone has echo, or remains audible when muted in Piik | Temporarily turn off **System sound** to compare. A mixer's playback can enter source audio separately from Piik's microphone; check its [audio routing](./getting-started.md#exclude-a-voice-app-from-screen-audio). |
 | Page opens but video will not connect | Use **Reconnect** if available, or refresh the viewing page. See [connection troubleshooting](#when-video-will-not-connect) if it still fails. |
 | WebRTC or IP-leak protection is enabled | Check whether it blocks media connections using [browser WebRTC settings](#browser-webrtc-restrictions). |
 | Connection fails on a campus or restricted network | Compare with a phone hotspot, then consider a [site with SFU forwarding](#campus-networks-and-strict-nat). |
diff --git a/docs/guide/troubleshooting.zh-CN.md b/docs/guide/troubleshooting.zh-CN.md
index 7b5464511..0c0cc40de 100644
--- a/docs/guide/troubleshooting.zh-CN.md
+++ b/docs/guide/troubleshooting.zh-CN.md
@@ -25,6 +25,7 @@
 | 有画面，没来源声音 | 先取消视频静音。房主应选择支持分享声音的来源，并在选源器中打开声音。摄像头画面与音频输入分别选择，见[声音设置](./getting-started.zh-CN.md#加上自己的声音)。 |
 | 听不到房主说话 | 房主可在画面下方开启 **麦克风**，在 **设置 → 声音** 中检查输入设备和音量，并确认设备连接与麦克风权限。如控件不可用，请更新 App 并刷新页面。 |
 | 分享时把语音软件的声音也传出去了 | Windows App 屏幕采集可选择[排除应用声音](./getting-started.zh-CN.md#分享屏幕时排除语音软件的声音)；该功能不消除扬声器被麦克风收音产生的回声。 |
+| 虚拟麦克风有回声，或在 Piik 闭麦后仍能听到 | 暂时关闭 **系统声音** 对照。混音软件的播放输出可能通过来源音频进入分享，请检查[音频路由](./getting-started.zh-CN.md#分享屏幕时排除语音软件的声音)。 |
 | 网页能打开，画面连不上 | **重新连接** 按钮可用时先点击，否则刷新观看页。仍然失败时，查看 [画面连接排查](#画面连接不上)。 |
 | 开启了 WebRTC 或 IP 泄露保护 | 按[浏览器 WebRTC 设置](#浏览器限制了-webrtc)检查是否阻止了媒体连接。 |
 | 校园网或受限网络连不上 | 先用手机热点对照，再考虑[启用 SFU 的自建站点](#校园网或严格-nat)。 |
diff --git a/docs/todo.md b/docs/todo.md
index 619301808..4a22a12fc 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -95,6 +95,12 @@ experiments and their limits.
   [camera and microphone assessment](./research/camera-and-microphone.md)
   additionally owns levels, echo, device replacement/native mixing, OBS input
   A/V synchronization and phone camera permission/orientation/background limits.
+- [ ] **Virtual-microphone echo (#473).** The screenshot has Piik's microphone
+  off while screen audio excludes a different voice app. Process exclusion captures
+  other renderers across output devices, so a virtual mixer can still enter source
+  audio. Obtain the reporter's system-sound-off comparison and routing before
+  attributing the duplicate voice to Piik's mixer. The [audio guide](./guide/getting-started.md#exclude-a-voice-app-from-screen-audio)
+  explains this boundary; no automatic extra exclusion is planned.
 - [ ] **Native H.264 motion quality (#432).** Obtain matched source/decoded
   pictures and bitstream for the original 720p30 game comparison. Retain current
   codec parameters. The [evidence review](./research/native-client-media.md#native-h264-motion-quality)

From 70a596f311bc5ad07c6ebcc9bd06a5ae2306946a Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 18:21:10 +0800
Subject: [PATCH 216/262] test(media): accept capability-bounded 4K frame rates

---
 scripts/app-native-host-gate.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/app-native-host-gate.ts b/scripts/app-native-host-gate.ts
index 7c64376e8..68003168c 100644
--- a/scripts/app-native-host-gate.ts
+++ b/scripts/app-native-host-gate.ts
@@ -1039,7 +1039,8 @@ async function main(): Promise<void> {
         const fps = document.querySelector('input[name="maxFramerate"]');
         const width = document.querySelector('.lr-video-size input[name="width"]');
         const height = document.querySelector('.lr-video-size input[name="height"]');
-        return fps?.max === '60' && fps.value === '60' && width?.value === '3840' && height?.value === '2160';
+        return fps && Number(fps.max) >= 60 && fps.validity.valid && fps.value === '60' &&
+          width?.value === '3840' && height?.value === '2160';
       })()`, deadline), Boolean, 10_000);
       stage = "native-4k-decode";
       result.fourKQualityChanged = await waitForValue(deadline => evaluate<boolean>(cdp!, viewer, `(() => {

From 1b1e28e46ec86a5762c7571aed5ff21e5c985181 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 19:53:24 +0800
Subject: [PATCH 217/262] fix(ui): clarify App connection recovery and home
 navigation

---
 docs/guide/getting-started.md                 |  4 +-
 docs/guide/getting-started.zh-CN.md           |  3 +-
 .../components/living/AppConnectionButton.tsx | 75 ++++++++++++++++---
 .../components/living/CaptureSourcePicker.tsx |  3 +-
 src/client/components/living/Header.tsx       |  4 +-
 src/client/components/living/Tooltip.tsx      |  5 +-
 src/client/locales/en.ts                      |  3 +
 src/client/locales/zh.ts                      |  3 +
 src/client/styles.css                         | 27 ++++++-
 tests/app-connection-button.test.ts           | 33 +++++++-
 10 files changed, 139 insertions(+), 21 deletions(-)

diff --git a/docs/guide/getting-started.md b/docs/guide/getting-started.md
index 26a05126b..cfb25bc56 100644
--- a/docs/guide/getting-started.md
+++ b/docs/guide/getting-started.md
@@ -110,12 +110,14 @@ access passphrase.
 access if the browser asks. No room mode needs to be selected in the launcher.
 You can also choose **Connect Piik App** inside the **Start sharing** source
 selector; its list updates as soon as the connection completes.
+If connection fails, the App button offers **Retry** and **Download App**.
+You can still share and watch in your browser.
 
 The same browser remembers this connection. On later visits, **Start sharing**
 offers **Apps / Windows** and **Screens** from the running App. In another browser,
 in a private window or after clearing site data, connect again. The same exact
 site already approved by App needs no repeat confirmation. The launcher
-shows the approved site and lets you revoke it. Approving a different site
+shows the approved site; **×** beside its address revokes access. Approving a different site
 replaces the previous one and ends that site's App connections.
 
 **A page that opens does not guarantee a video connection.** Public invite gives
diff --git a/docs/guide/getting-started.zh-CN.md b/docs/guide/getting-started.zh-CN.md
index 376da9d3c..5be3bbc8b 100644
--- a/docs/guide/getting-started.zh-CN.md
+++ b/docs/guide/getting-started.zh-CN.md
@@ -98,11 +98,12 @@ Linux 原生采集还需要[系统组件](../../native/capture/linux/README.md)
 在本机确认页核对网址，点击 **允许使用**。如果站点要求口令，在站点页面输入。
 浏览器询问本地网络权限时，请允许访问。启动页无需选择房间模式。
 也可以在 **开始分享** 的选源窗口里点击 **连接 Piik App**，连接后列表会直接显示 App 来源。
+连接失败时，App 按钮旁会提供 **重试** 和 **下载 App**；仍可继续使用浏览器分享和观看。
 
 同一浏览器会记住这次连接。之后直接访问站点，点击 **开始分享**，
 选择 **程序 / 窗口** 或 **屏幕**，即可使用正在运行的 App。
 换浏览器、使用无痕窗口或清除站点数据后，重新连接即可；App 已允许的同一站点无需再次确认。
-启动页显示已授权的站点，也可以取消授权；允许新站点会替换旧站点，并结束旧站点的 App 连接。
+启动页显示已授权的站点，网址右侧的 **×** 可取消授权；允许新站点会替换旧站点，并结束旧站点的 App 连接。
 
 **网页能打开，不代表视频一定能连通。** 公网邀请为房间提供临时网页地址，
 画面和声音仍靠参与者之间的连接传输。此模式没有媒体服务器兜底，
diff --git a/src/client/components/living/AppConnectionButton.tsx b/src/client/components/living/AppConnectionButton.tsx
index 2f51554e6..df3e97523 100644
--- a/src/client/components/living/AppConnectionButton.tsx
+++ b/src/client/components/living/AppConnectionButton.tsx
@@ -1,8 +1,9 @@
-import { useEffect, useRef, useState } from "react";
+import { useEffect, useId, useRef, useState } from "react";
 import { activateClient, isClientActivated, watchClientActivation } from "../../lib/session";
 import { useCopy } from "../../ui/copy";
 import { Glyph } from "../../ui/icons";
 import { Tooltip } from "./Tooltip";
+import { Comic } from "./Comic";
 
 export function AppConnectionButton({ sourcePicker = false, onConnected }: {
   sourcePicker?: boolean;
@@ -10,12 +11,16 @@ export function AppConnectionButton({ sourcePicker = false, onConnected }: {
 } = {}) {
   const { t, vis } = useCopy();
   const [state, setState] = useState<"idle" | "busy" | "ready" | "unavailable" | "incompatible">("idle");
+  const [helpOpen, setHelpOpen] = useState(false);
+  const helpId = useId();
+  const trigger = useRef<HTMLButtonElement>(null);
+  const help = useRef<HTMLDivElement>(null);
   const pending = useRef<{ controller: AbortController; popup: Window | null } | null>(null);
   const healthCheck = useRef<AbortController | null>(null);
   useEffect(() => {
     if (sourcePicker) return;
     const refresh = async () => {
-      if (pending.current || !isClientActivated()) return;
+      if (pending.current || help.current?.matches(":popover-open") || !isClientActivated()) return;
       healthCheck.current?.abort();
       const current = healthCheck.current = new AbortController();
       const native = await import("../../native/client");
@@ -38,13 +43,25 @@ export function AppConnectionButton({ sourcePicker = false, onConnected }: {
     return () => { healthCheck.current?.abort(); window.removeEventListener("focus", onFocus); unwatch(); };
   }, [sourcePicker]);
   useEffect(() => () => { pending.current?.controller.abort(); pending.current?.popup?.close(); }, []);
+  useEffect(() => {
+    // A one-shot disclosure follows its trigger again on the next opening.
+    const close = () => help.current?.hidePopover();
+    window.addEventListener("resize", close);
+    window.addEventListener("scroll", close);
+    return () => { window.removeEventListener("resize", close); window.removeEventListener("scroll", close); };
+  }, []);
+
+  function showHelp(): void {
+    if (trigger.current) help.current?.showPopover({ source: trigger.current });
+  }
 
   async function connect(): Promise<void> {
     if (pending.current) return;
+    help.current?.hidePopover();
     healthCheck.current?.abort();
     // Reserve the window during the click, before local-network discovery waits.
     const attempt = { controller: new AbortController(), popup: window.open("about:blank", "_blank") };
-    if (!attempt.popup) { setState("unavailable"); return; }
+    if (!attempt.popup) { setState("unavailable"); showHelp(); return; }
     pending.current = attempt;
     setState("busy");
     const signal = attempt.controller.signal;
@@ -69,7 +86,11 @@ export function AppConnectionButton({ sourcePicker = false, onConnected }: {
       window.removeEventListener("focus", onFocus);
       attempt.controller.abort();
       attempt.popup?.close();
-      if (pending.current === attempt) { pending.current = null; setState(result); }
+      if (pending.current === attempt) {
+        pending.current = null;
+        setState(result);
+        if (result === "unavailable" || result === "incompatible") showHelp();
+      }
     };
     const onFocus = () => {
       if (attempt.popup?.closed && !approving) finish("idle");
@@ -95,15 +116,51 @@ export function AppConnectionButton({ sourcePicker = false, onConnected }: {
 
   const label = t(state === "ready" ? "client.connect.standby" : state === "incompatible" ? "native.incompatible" :
     state === "unavailable" ? "client.connect.unavailable" : sourcePicker ? "client.connect.captureHint" : "client.connect.action");
-  return <Tooltip kind={state === "unavailable" ? "signal-failed" : state === "incompatible" ? "warning" : "hint-client-site"}
-    text={vis ? undefined : label} toggleOnClick={state === "ready"}
+  const failed = state === "unavailable" || state === "incompatible";
+  return <><Tooltip kind={state === "unavailable" ? "signal-failed" : state === "incompatible" ? "warning" : "hint-client-site"}
+    text={vis ? undefined : label} toggleOnClick={state === "ready"} disabled={helpOpen}
     place={sourcePicker ? "above" : "below"} align={sourcePicker ? "center" : "end"}>
-    <button type="button" className={`${sourcePicker ? "lr-source-picker-refresh lr-source-app-connect" : "lr-btn lr-app-connect"}${state === "ready" ? " is-ready" : ""}`}
+    <button ref={trigger} type="button" className={`${sourcePicker ? "lr-source-picker-refresh lr-source-app-connect" : "lr-btn lr-app-connect"}${state === "ready" ? " is-ready" : ""}`}
       aria-label={sourcePicker ? t("client.connect.action") : label} aria-busy={state === "busy" || undefined}
-      onClick={state === "ready" ? undefined : () => void connect()} disabled={state === "busy"}>
+      popoverTarget={failed ? helpId : undefined} aria-haspopup={failed ? "dialog" : undefined}
+      onClick={state === "ready" || failed ? undefined : event => {
+        // Failure may attach popoverTarget during this click; do not toggle the
+        // recovery card closed immediately after opening it.
+        event.preventDefault();
+        void connect();
+      }} disabled={state === "busy"}>
       <Glyph name={state === "ready" ? "check" : state === "busy" ? "loader" : state === "unavailable" || state === "incompatible" ? "alert" : "window"}
         size={16} className={state === "busy" ? "lr-spin" : undefined} />
       {vis ? null : <span className="lr-cap">{sourcePicker ? t("client.connect.action") : "App"}</span>}
     </button>
-  </Tooltip>;
+  </Tooltip>
+    <div ref={help} id={helpId} popover="auto" role="dialog" aria-label={t("client.connect.action")} aria-describedby={`${helpId}-message`}
+      className="lr-app-connect-help" onToggle={event => {
+        setHelpOpen(event.newState === "open");
+        if (event.newState !== "open" || !trigger.current) return;
+        const panel = event.currentTarget;
+        const rect = trigger.current.getBoundingClientRect();
+        if (rect.bottom <= 0 || rect.top >= window.innerHeight) { panel.hidePopover(); return; }
+        const below = window.innerHeight - rect.bottom - 16;
+        const above = rect.top - 16;
+        const openAbove = below < panel.scrollHeight && above > below;
+        panel.classList.toggle("is-above", openAbove);
+        panel.style.maxHeight = `${Math.max(0, openAbove ? above : below)}px`;
+        panel.style.left = `${Math.max(8, Math.min(rect.right - panel.offsetWidth, window.innerWidth - panel.offsetWidth - 8))}px`;
+        panel.style.top = `${Math.max(8, openAbove ? rect.top - panel.offsetHeight - 8 : rect.bottom + 8)}px`;
+        panel.querySelector<HTMLButtonElement>("button")?.focus();
+      }}>
+      <div className="lr-app-connect-scene" aria-hidden="true">{helpOpen && <Comic kind={state === "incompatible" ? "warning" : "signal-failed"} theme="paper" />}</div>
+      <p id={`${helpId}-message`} className={vis ? "visually-hidden" : undefined}>{label}</p>
+      <div className="lr-app-connect-actions">
+        <button type="button" className="lr-btn" aria-label={t("common.retry")} onClick={() => void connect()}>
+          <Glyph name="refresh" size={16} /><span className={vis ? "visually-hidden" : undefined}>{t("common.retry")}</span>
+        </button>
+        <a className="lr-btn" href="https://piik.tv/#download" target="_blank" rel="noopener noreferrer" aria-label={t("client.connect.download")}>
+          <Glyph name="arrowDown" size={16} /><span className={vis ? "visually-hidden" : undefined}>{t("client.connect.download")}</span>
+        </a>
+      </div>
+      <p className={vis ? "visually-hidden" : "lr-app-connect-optional"}>{t("client.connect.browserHint")}</p>
+    </div>
+  </>;
 }
diff --git a/src/client/components/living/CaptureSourcePicker.tsx b/src/client/components/living/CaptureSourcePicker.tsx
index 7cbb748b6..69d4872bb 100644
--- a/src/client/components/living/CaptureSourcePicker.tsx
+++ b/src/client/components/living/CaptureSourcePicker.tsx
@@ -109,7 +109,8 @@ export function CaptureSourcePicker({
 
   useEffect(() => {
     const cancelOnEscape = (event: KeyboardEvent) => {
-      if (event.key !== "Escape" || event.defaultPrevented ||
+      if (event.key !== "Escape" || event.defaultPrevented || event.isComposing ||
+          panelRef.current?.querySelector('[popover="auto"]:popover-open') ||
           !panelRef.current?.contains(event.target as Node | null)) return;
       event.preventDefault();
       onCancel();
diff --git a/src/client/components/living/Header.tsx b/src/client/components/living/Header.tsx
index 67ff246f5..27919aadd 100644
--- a/src/client/components/living/Header.tsx
+++ b/src/client/components/living/Header.tsx
@@ -130,7 +130,7 @@ export function AppHeader({
   diagnosticControl?: React.ReactNode;
   showAppConnection?: boolean;
 }) {
-  const { t } = useCopy();
+  const { t, vis } = useCopy();
   return (
     <header className="lr-top">
       <a
@@ -139,6 +139,8 @@ export function AppHeader({
         aria-label={t("brand.home")}
       >
         <BrandMark size={34} motion="once" />
+        {vis && <Glyph name="arrowRight" size={15} className="lr-home-arrow" />}
+        <span className={vis ? "visually-hidden" : "lr-brand-label"}>{t("brand.home.short")}</span>
       </a>
       <span className="lr-top-right">
         {led}
diff --git a/src/client/components/living/Tooltip.tsx b/src/client/components/living/Tooltip.tsx
index 27ae5e033..26bc595b1 100644
--- a/src/client/components/living/Tooltip.tsx
+++ b/src/client/components/living/Tooltip.tsx
@@ -59,6 +59,7 @@ export function Tooltip({
   place = "above",
   align = "center",
   toggleOnClick = false,
+  disabled = false,
   overflow,
   children,
 }: TooltipContent & {
@@ -71,6 +72,8 @@ export function Tooltip({
   align?: Align;
   /** For help-only buttons; action controls keep click and touch long-press. */
   toggleOnClick?: boolean;
+  /** Suppress guidance while the control's own disclosure is open. */
+  disabled?: boolean;
   children: ReactNode;
 }) {
   const defaults = getComicPresentation(kind);
@@ -94,7 +97,7 @@ export function Tooltip({
   // True while the current gesture is a touch, so contextmenu can tell a
   // long-press from a mouse right-click without reading vendor event fields.
   const touchGesture = useRef(false);
-  const enabled = kind !== undefined || overflowing;
+  const enabled = !disabled && (kind !== undefined || overflowing);
   const caption = [overflowing ? overflow?.text : undefined, text].filter(Boolean).join(" · ") || undefined;
   const interactionOpen = enabled && (hoverOpen || focusOpen || pressOpen);
   const trigger = isValidElement<{
diff --git a/src/client/locales/en.ts b/src/client/locales/en.ts
index 7f5af7216..e5b0d0766 100644
--- a/src/client/locales/en.ts
+++ b/src/client/locales/en.ts
@@ -27,6 +27,7 @@ export const en: Record<CopyKey, string> = {
   "debug.exportHint": "Download browser diagnostics; may include network addresses and device details",
   "debug.exportFailed": "Could not download diagnostics; try again",
   "brand.home": "Piik home",
+  "brand.home.short": "Home",
 
   "common.roomCode": "Room code",
   "host.roomCodePending": "A room code appears when sharing starts",
@@ -78,6 +79,8 @@ export const en: Record<CopyKey, string> = {
   "client.connect.saveFailed": "Could not finish the connection change. Please try again.",
   "client.connect.invalid": "Invalid Site address",
   "client.connect.unavailable": "Could not connect to App. Keep Piik App running and allow popups and local-network access in your browser.",
+  "client.connect.download": "Download App",
+  "client.connect.browserHint": "You can share and watch in your browser.",
   "client.launch.lanAddress": "Local invitation address",
   "client.launch.chooseAddress": "Choose an address",
   "client.launch.lanHint": "Choose an address on the same network as your friends.",
diff --git a/src/client/locales/zh.ts b/src/client/locales/zh.ts
index fbbf18680..67a9c4346 100644
--- a/src/client/locales/zh.ts
+++ b/src/client/locales/zh.ts
@@ -27,6 +27,7 @@ export const zh = {
   "debug.exportHint": "下载网页诊断，可能包含网络地址和设备信息",
   "debug.exportFailed": "诊断下载失败，请重试",
   "brand.home": "Piik 首页",
+  "brand.home.short": "首页",
 
   "common.roomCode": "房间号",
   "host.roomCodePending": "开始分享后生成房间号",
@@ -78,6 +79,8 @@ export const zh = {
   "client.connect.saveFailed": "未能完成连接更改，请重试。",
   "client.connect.invalid": "站点网址无效",
   "client.connect.unavailable": "未能连接 App。请保持 Piik App 运行，并允许浏览器打开新窗口和访问本地网络。",
+  "client.connect.download": "下载 App",
+  "client.connect.browserHint": "可继续使用浏览器分享和观看。",
   "client.launch.lanAddress": "局域网邀请地址",
   "client.launch.chooseAddress": "选择地址",
   "client.launch.lanHint": "选择与朋友处于同一网络的地址。",
diff --git a/src/client/styles.css b/src/client/styles.css
index e04daae77..6815c3fa1 100644
--- a/src/client/styles.css
+++ b/src/client/styles.css
@@ -115,18 +115,22 @@ ul { margin: 0; padding: 0; list-style: none; }
 }
 
 .lr-brand {
-  display: grid;
+  display: inline-flex;
   flex: none;
-  width: 44px; height: 44px;
-  place-items: center;
+  min-width: 44px; height: 44px;
+  align-items: center; justify-content: center; gap: 6px;
+  padding: 0 6px;
   border: 0;
   border-radius: 12px;
   background: transparent;
   color: var(--ink);
+  text-decoration: none;
   transition: background 160ms ease, color 160ms ease, transform 160ms var(--spring);
 }
 .lr-brand:hover { background: var(--wall-2); }
 .lr-brand:active { transform: scale(.92); }
+.lr-brand-label { font-size: 12px; font-weight: 700; white-space: nowrap; }
+.lr-home-arrow { transform: rotate(180deg); }
 
 .lr-top-right { display: inline-flex; gap: 10px; align-items: center; }
 .lr-top > .lr-top-right { min-width: 0; flex-wrap: wrap; justify-content: flex-end; }
@@ -1011,6 +1015,23 @@ html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #334
 .lr-app-connect { min-width: 40px; height: 40px; }
 .lr-app-connect.is-ready { color: var(--live); cursor: default; }
 .lr-app-connect.is-ready:hover { transform: none; }
+.lr-app-connect-help {
+  position: fixed; inset: auto; margin: 0; padding: 16px;
+  width: min(300px, calc(100vw - 16px)); box-sizing: border-box;
+  color: var(--ink); background: var(--paper);
+  border: 1px solid var(--control-edge); border-radius: 20px;
+  box-shadow: var(--control-shadow), 0 12px 36px #101a2c33;
+  overflow: auto; overscroll-behavior: contain;
+}
+.lr-app-connect-help p { margin: 12px 0; font-size: 13px; line-height: 1.6; }
+.lr-app-connect-help:popover-open { animation: lr-language-open 180ms var(--spring); }
+.lr-app-connect-help.is-above { --language-offset: 5px; }
+.lr-app-connect-scene { width: min(220px, 100%); aspect-ratio: 10 / 3; margin-inline: auto; --comic-repeat: infinite; }
+.lr-app-connect-scene > svg { width: 100% !important; }
+.lr-app-connect-actions { display: flex; flex-wrap: wrap; justify-content: center; gap: 8px; }
+.lr-app-connect-actions .lr-btn { min-height: 40px; }
+.lr-app-connect-help .lr-app-connect-optional { color: var(--muted); font-size: 12px; margin-bottom: 0; }
+@media (prefers-reduced-motion: reduce) { .lr-app-connect-help:popover-open { animation: none; } }
 .lr-cap { font-size: 12.5px; font-weight: 600; color: inherit; white-space: nowrap; }
 
 /* Sharing and local playback have distinct owners, but one control grammar. */
diff --git a/tests/app-connection-button.test.ts b/tests/app-connection-button.test.ts
index a0d007a23..b402dd0eb 100644
--- a/tests/app-connection-button.test.ts
+++ b/tests/app-connection-button.test.ts
@@ -29,19 +29,21 @@ const approval = `http://127.0.0.1:39721/client?site=${encodeURIComponent(site)}
 
 function mount(activated = false) {
   const popup = { closed: false, close: vi.fn(() => { popup.closed = true; }), location: { replace: vi.fn() } };
-  const window = Object.assign(new EventTarget(), { open: vi.fn(() => popup), location: { origin: site } });
+  const window = Object.assign(new EventTarget(), { open: vi.fn((): typeof popup | null => popup), location: { origin: site } });
   const native = {
-    discoverNativeConnect: vi.fn(async (_signal: AbortSignal) => approval),
+    discoverNativeConnect: vi.fn(async (_signal: AbortSignal): Promise<string | null> => approval),
     discoverNativeHealth: vi.fn(async (_options: { signal: AbortSignal }): Promise<object | null> => ({})),
     NativeCompatibilityError: class extends Error {},
   };
   const pending = { current: null as { controller: AbortController } | null };
   const healthCheck = { current: null as AbortController | null };
+  const help = { current: { hidePopover: vi.fn(), matches: vi.fn(() => false) } };
+  const showHelp = vi.fn();
   const setState = vi.fn();
   const activateClient = vi.fn();
   const onConnected = vi.fn();
   const operation = runInNewContext(executable, {
-    window, pending, healthCheck, setState, activateClient, onConnected, AbortController, URL,
+    window, pending, healthCheck, help, showHelp, setState, activateClient, onConnected, AbortController, URL,
     sourcePicker: false, isClientActivated: () => activated,
     watchClientActivation: (changed: () => void) => {
       window.addEventListener("activation", changed);
@@ -58,10 +60,33 @@ function mount(activated = false) {
     }));
   }
   const activateElsewhere = () => { activated = true; window.dispatchEvent(new Event("activation")); };
-  return { ...operation, popup, window, native, pending, setState, activateClient, activateElsewhere, onConnected, message };
+  return { ...operation, popup, window, native, pending, help, showHelp, setState, activateClient, activateElsewhere, onConnected, message };
 }
 
 describe("App connection approval", () => {
+  it("offers recovery without activation or a stranded popup when no App is found", async () => {
+    const page = mount();
+    page.native.discoverNativeConnect.mockResolvedValue(null);
+    await page.connect();
+    expect(page.setState).toHaveBeenLastCalledWith("unavailable");
+    expect(page.showHelp).toHaveBeenCalledOnce();
+    expect(page.popup.closed).toBe(true);
+    expect(page.pending.current).toBeNull();
+    expect(page.activateClient).not.toHaveBeenCalled();
+    page.cleanup();
+  });
+
+  it("offers recovery when the browser blocks the approval window", async () => {
+    const page = mount();
+    page.window.open.mockReturnValue(null);
+    await page.connect();
+    expect(page.setState).toHaveBeenLastCalledWith("unavailable");
+    expect(page.showHelp).toHaveBeenCalledOnce();
+    expect(page.native.discoverNativeConnect).not.toHaveBeenCalled();
+    expect(page.activateClient).not.toHaveBeenCalled();
+    page.cleanup();
+  });
+
   it("requires the exact window, origin and site, then verifies App health once", async () => {
     const page = mount();
     let complete!: (health: object) => void;

From 49649847b7501fcdd058cd7c410bc696c2189b0f Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 22:37:28 +0800
Subject: [PATCH 218/262] fix(ui): refine App entry feedback and mascot
 hierarchy

---
 docs/research/media-fidelity.md               | 40 ++++++++++++++++++-
 docs/standards/visual-language.md             | 16 +++++++-
 .../components/living/AppConnectionButton.tsx |  2 +-
 src/client/components/living/Header.tsx       |  5 +--
 src/client/components/living/LauncherForm.tsx |  9 ++---
 src/client/components/living/WelcomeLine.tsx  |  6 ++-
 .../components/living/comic-presentation.ts   |  1 +
 src/client/components/living/hints/index.tsx  |  1 +
 src/client/components/living/hints/set4.tsx   |  2 +
 src/client/locales/en.ts                      |  1 -
 src/client/locales/zh.ts                      |  1 -
 src/client/pages/AppLauncherPage.tsx          |  5 +--
 src/client/styles.css                         | 28 +++++++++----
 src/client/ui/text-rotation.ts                |  7 +++-
 src/client/ui/use-text-rotation.ts            |  5 ++-
 src/client/ui/visual-kinds.ts                 |  1 +
 tests/text-rotation.test.ts                   | 19 ++++++++-
 17 files changed, 116 insertions(+), 33 deletions(-)

diff --git a/docs/research/media-fidelity.md b/docs/research/media-fidelity.md
index 34f2c67b0..50c8118d1 100644
--- a/docs/research/media-fidelity.md
+++ b/docs/research/media-fidelity.md
@@ -1,6 +1,6 @@
 # Media Fidelity
 
-Reviewed 2026-10-03. [Media quality](../standards/media-quality.md) owns behavior;
+Reviewed 2026-10-13. [Media quality](../standards/media-quality.md) owns behavior;
 [TODO](../todo.md) owns remaining work. These synthetic checks do not establish
 all-device acceptance or full HDR support.
 
@@ -169,3 +169,41 @@ Full HDR requires a separate end-to-end decision for bit depth, codec support,
 color metadata, decoding and mixed Viewer capabilities. It is not a quality
 dropdown addition. Preserve ordinary SDR routing and existing compatibility
 with HDR-to-SDR; no full-HDR or surround implementation is claimed.
+
+## 2.0 Fidelity Reassessment
+
+Reviewed 2026-10-13 after the owner reopened HDR and multichannel consideration.
+Changing Piik's signaling contract does not by itself extend WebRTC codecs,
+capture formats or decoded outputs. Numeric quality limits and media formats
+have different compatibility boundaries.
+
+| Capability | Current evidence and additional work |
+| --- | --- |
+| Mono/stereo | Already carried by the existing Opus track, including microphone mixing, relay and SFU. Retain decoded-channel verification; a channel selector is unnecessary for these inputs. |
+| HDR source viewed as SDR | Windows native capture and thumbnails use the existing tone mapper. Physical HDR display acceptance remains open. Browser-owned capture may already have clipped highlights before Piik receives a frame. |
+| End-to-end HDR | Needs intact high-bit-depth capture, a supported HDR codec, color metadata and compatible decoding through every relay/output. Current native output uses 8-bit H.264/VP8. Mixed SDR viewers need a defined conversion owner; signaling an HDR flag cannot provide this. |
+| 5.1/7.1 surround | Needs channel-layout-preserving capture/mixing, multistream encoding, receiver admission and a stereo downmix boundary. Native PCM/Opus and the Browser microphone mix currently use two-channel output; adding a numeric channel count would silently overstate their capability. |
+
+The [W3C HDR interoperability discussion](https://github.com/w3c/webrtc-extensions/issues/253)
+documents Chrome decoding with VP9 profile 2 and color-space RTP metadata, while
+capture controls, interoperability tests and metadata standardization remain
+work areas. This supports a possible experiment, not universal Browser HDR.
+A local Windows Chrome 152 capability query advertised VP9 profile 2; it did
+not exercise HDR capture, encoding, display, Native reception or mixed viewers.
+
+[RFC 7587](https://www.rfc-editor.org/rfc/rfc7587.html#section-7)
+defines ordinary Opus RTP mono/stereo negotiation. Libwebrtc has a separate
+[multiopus implementation](https://webrtc.googlesource.com/src/+/refs/heads/main/modules/audio_coding/codecs/opus/audio_encoder_multi_channel_opus_impl.cc)
+with stream counts and channel mapping. Chromium's
+[SDP handling](https://chromium.googlesource.com/chromium/src/third_party/+/refs/heads/main/blink/renderer/modules/peerconnection/rtc_peer_connection.cc)
+notes that the Browser does not generate multiopus itself. The same local
+capability query offered ordinary Opus with two channels and no multiopus.
+These facts do not establish that manual negotiation is impossible; they rule
+out assuming that an existing Opus connection automatically becomes surround.
+
+Recommendation: retain stereo and HDR-to-SDR for the current candidate. Do not
+reserve speculative wire fields or promise full HDR/surround. Reopen an isolated
+prototype when a concrete source/receiver pair justifies it; first verify actual
+decoded colors or channel separation and a mixed-capability relay path. Reuse
+SDP/RTP format negotiation where it suffices rather than creating a second codec
+negotiation protocol. This assessment adds no feature or new release requirement.
diff --git a/docs/standards/visual-language.md b/docs/standards/visual-language.md
index 3b1bb9062..f84dc8cbb 100644
--- a/docs/standards/visual-language.md
+++ b/docs/standards/visual-language.md
@@ -318,9 +318,18 @@ not need a second mascot or decorative spinner. The header's brand mark remains
 navigation identity. Keep an actionable play symbol or an exact progress value
 when it helps the user proceed or understand the operation.
 
+Review the visible page as a composition, including open tooltips: give it one
+expressive focal illustration, rather than repeating the mascot in a heading,
+card and status. A small navigation mark may coexist with a contextual mascot;
+it is not another focal illustration. Remove decorative duplicates before
+changing the shared character or adding visibility state. This applies the
+[illustration guidance](https://atlassian.design/foundations/illustrations):
+support the task and use lighter icons or copy when another drawing adds noise.
+
 | Context | Illustration and literal content | Playful caption |
 | --- | --- | --- |
 | Page loading, site access check, App preparation | The shared wink mascot with the actual loading operation; no room or media-path claim | The current language's waiting pool |
+| Confirmed App readiness | The same wink mascot with the literal ready state; it does not imply an active share or working media route | None |
 | Source listing/start/switch, room joining, media setup/recovery, waiting for the Host | The corresponding comic with the current status; only the existing state owner can declare waiting | The same waiting pool while the wait exists |
 | Error, limitation, pause, ended room or required user action | The corresponding comic and clear reason/action; settled movement keeps that verdict readable | None |
 | Small controls, tooltips and inline results | Existing action/status icon and contextual guidance when needed; retain direct actions | None |
@@ -514,8 +523,11 @@ pseudo-lettering tied to the same line. Hide that visual cipher from assistive
 technology; the ordinary text sentence remains readable. Switching between text
 and visual mode preserves the selected welcome entry; rotation follows the
 [shared lifecycle](#playful-copy-lifecycle). The line never replaces an action,
-error, loading message or connection progress. Keep it on one line, apart from the actions; primary controls take
-precedence when space is tight.
+error, loading message or connection progress. Keep it on one line, apart from
+the actions; primary controls take precedence when space is tight. A clipped line
+may pan to its end within the shared reading interval; fitting text stays still.
+Pause with the copy's existing visibility owner. Reduced motion keeps the text
+stationary and manually scrollable instead of discarding the hidden words.
 
 ## Ownership And Incremental Review
 
diff --git a/src/client/components/living/AppConnectionButton.tsx b/src/client/components/living/AppConnectionButton.tsx
index df3e97523..845633ee2 100644
--- a/src/client/components/living/AppConnectionButton.tsx
+++ b/src/client/components/living/AppConnectionButton.tsx
@@ -117,7 +117,7 @@ export function AppConnectionButton({ sourcePicker = false, onConnected }: {
   const label = t(state === "ready" ? "client.connect.standby" : state === "incompatible" ? "native.incompatible" :
     state === "unavailable" ? "client.connect.unavailable" : sourcePicker ? "client.connect.captureHint" : "client.connect.action");
   const failed = state === "unavailable" || state === "incompatible";
-  return <><Tooltip kind={state === "unavailable" ? "signal-failed" : state === "incompatible" ? "warning" : "hint-client-site"}
+  return <><Tooltip kind={state === "ready" ? "hint-app-ready" : state === "unavailable" ? "signal-failed" : state === "incompatible" ? "warning" : "hint-client-site"}
     text={vis ? undefined : label} toggleOnClick={state === "ready"} disabled={helpOpen}
     place={sourcePicker ? "above" : "below"} align={sourcePicker ? "center" : "end"}>
     <button ref={trigger} type="button" className={`${sourcePicker ? "lr-source-picker-refresh lr-source-app-connect" : "lr-btn lr-app-connect"}${state === "ready" ? " is-ready" : ""}`}
diff --git a/src/client/components/living/Header.tsx b/src/client/components/living/Header.tsx
index 27919aadd..e296d6663 100644
--- a/src/client/components/living/Header.tsx
+++ b/src/client/components/living/Header.tsx
@@ -130,7 +130,7 @@ export function AppHeader({
   diagnosticControl?: React.ReactNode;
   showAppConnection?: boolean;
 }) {
-  const { t, vis } = useCopy();
+  const { t } = useCopy();
   return (
     <header className="lr-top">
       <a
@@ -138,9 +138,8 @@ export function AppHeader({
         href={withBrowserDebug(homeHref)}
         aria-label={t("brand.home")}
       >
+        <Glyph name="chevron" size={14} className="lr-home-arrow" />
         <BrandMark size={34} motion="once" />
-        {vis && <Glyph name="arrowRight" size={15} className="lr-home-arrow" />}
-        <span className={vis ? "visually-hidden" : "lr-brand-label"}>{t("brand.home.short")}</span>
       </a>
       <span className="lr-top-right">
         {led}
diff --git a/src/client/components/living/LauncherForm.tsx b/src/client/components/living/LauncherForm.tsx
index 9a3204b1c..feba9138f 100644
--- a/src/client/components/living/LauncherForm.tsx
+++ b/src/client/components/living/LauncherForm.tsx
@@ -89,17 +89,14 @@ export function LauncherForm({
   return (
     <form className="lr-client-launch-panel" onSubmit={onSubmit}>
       <header className="lr-client-launch-heading">
-        <BrandMark size={64} motion="once" />
-        <div>
-          <h1 className="lr-client-launch-title">Piik<span className="lr-client-brand-dot">.</span> <small>App</small></h1>
-          <WelcomeLine />
-        </div>
+        <h1 className="lr-client-launch-title">Piik<span className="lr-client-brand-dot">.</span> <small>App</small></h1>
+        <WelcomeLine />
       </header>
 
       {children}
 
       <section className="lr-client-standby" aria-label={t("client.connect.standby")}>
-        <span className="lr-client-standby-icon" aria-hidden="true"><Glyph name="window" size={24} /></span>
+        <span className="lr-client-standby-icon" aria-hidden="true"><BrandMark size={34} motion="loop" /></span>
         <div className="lr-client-standby-copy">
           <strong className={vis ? "visually-hidden" : undefined}>{t("client.connect.standby")}</strong>
           <p className={vis ? "visually-hidden" : undefined}>{t("client.connect.standbyHint")}</p>
diff --git a/src/client/components/living/WelcomeLine.tsx b/src/client/components/living/WelcomeLine.tsx
index f4be66310..68e79adf6 100644
--- a/src/client/components/living/WelcomeLine.tsx
+++ b/src/client/components/living/WelcomeLine.tsx
@@ -3,6 +3,7 @@ import { locales, type WelcomeEntry } from "../../locales";
 import { useCopy } from "../../ui/copy";
 import { Glyph, type GlyphName } from "../../ui/icons";
 import { useRotatingText } from "../../ui/use-text-rotation";
+import { TEXT_ROTATION_INTERVAL_MS } from "../../ui/text-rotation";
 
 // Original 5x5 pseudo-letters; recurring ideas keep the same pixel word.
 const PIXEL_LETTERS = [
@@ -36,7 +37,8 @@ export function WelcomeLine({ still = false }: { still?: boolean }) {
   const element = useRef<HTMLParagraphElement>(null);
   const line = useRotatingText<WelcomeEntry>(locales[lang].playful.welcome, lang, element, still);
   if (!line) return null;
-  return <p ref={element} className={`lr-welcome${vis ? " is-cipher" : ""}`} aria-hidden={vis || undefined}>
-    {vis ? <WelcomeCipher symbols={line.symbols} /> : line.text}
+  return <p ref={element} className={`lr-welcome${vis ? " is-cipher" : ""}${still ? " is-still" : ""}`} aria-hidden={vis || undefined}>
+    {vis ? <WelcomeCipher symbols={line.symbols} /> : <span key={line.text} className="lr-welcome-text"
+      style={{ animationDuration: `${TEXT_ROTATION_INTERVAL_MS}ms` }}>{line.text}</span>}
   </p>;
 }
diff --git a/src/client/components/living/comic-presentation.ts b/src/client/components/living/comic-presentation.ts
index 153a51f94..2aeb2d65f 100644
--- a/src/client/components/living/comic-presentation.ts
+++ b/src/client/components/living/comic-presentation.ts
@@ -61,6 +61,7 @@ export const COMIC_KINDS = Object.keys(STATES) as ComicKind[];
 
 const PRESENTATIONS: Partial<Record<ComicKind | HintKind, ComicPresentation>> = {
   ...STATES,
+  "hint-app-ready": { tone: "live", motion: "still" },
   "hint-admission-code": { tone: "off", motion: "still" },
   "hint-admission-password": { tone: "off", motion: "still" },
   "hint-admission-invite": { tone: "off", motion: "still" },
diff --git a/src/client/components/living/hints/index.tsx b/src/client/components/living/hints/index.tsx
index d080d3b4f..fc643a48c 100644
--- a/src/client/components/living/hints/index.tsx
+++ b/src/client/components/living/hints/index.tsx
@@ -83,6 +83,7 @@ export const HINT_KINDS: readonly HintKind[] = [
   "hint-nat-prediction",
   "hint-nat-unavailable",
   "hint-client-local",
+  "hint-app-ready",
   "hint-client-site",
   "hint-capture-browser",
   "hint-capture-camera",
diff --git a/src/client/components/living/hints/set4.tsx b/src/client/components/living/hints/set4.tsx
index 964701cb3..1a1fea984 100644
--- a/src/client/components/living/hints/set4.tsx
+++ b/src/client/components/living/hints/set4.tsx
@@ -21,6 +21,7 @@ import {
 } from "../Comic";
 import type { ComicTheme } from "../Comic";
 import type { HintScene, Set4Kind } from "../../../ui/visual-kinds";
+import { BrandMark } from "../BrandMark";
 
 const INK = "var(--ink)";
 const WALL2 = "var(--wall-2)";
@@ -493,5 +494,6 @@ export const SET4_SCENES: Record<Set4Kind, HintScene> = {
   "hint-nat-prediction": (props) => <HintNatPrediction {...props} />,
   "hint-nat-unavailable": (props) => <HintNatPrediction {...props} available={false} />,
   "hint-client-local": HintClientLocal,
+  "hint-app-ready": () => <g transform="translate(112 0)" color={INK}><BrandMark size={96} motion="loop" /></g>,
   "hint-client-site": HintClientSite,
 };
diff --git a/src/client/locales/en.ts b/src/client/locales/en.ts
index e5b0d0766..1a811182d 100644
--- a/src/client/locales/en.ts
+++ b/src/client/locales/en.ts
@@ -27,7 +27,6 @@ export const en: Record<CopyKey, string> = {
   "debug.exportHint": "Download browser diagnostics; may include network addresses and device details",
   "debug.exportFailed": "Could not download diagnostics; try again",
   "brand.home": "Piik home",
-  "brand.home.short": "Home",
 
   "common.roomCode": "Room code",
   "host.roomCodePending": "A room code appears when sharing starts",
diff --git a/src/client/locales/zh.ts b/src/client/locales/zh.ts
index 67a9c4346..09e060ac9 100644
--- a/src/client/locales/zh.ts
+++ b/src/client/locales/zh.ts
@@ -27,7 +27,6 @@ export const zh = {
   "debug.exportHint": "下载网页诊断，可能包含网络地址和设备信息",
   "debug.exportFailed": "诊断下载失败，请重试",
   "brand.home": "Piik 首页",
-  "brand.home.short": "首页",
 
   "common.roomCode": "房间号",
   "host.roomCodePending": "开始分享后生成房间号",
diff --git a/src/client/pages/AppLauncherPage.tsx b/src/client/pages/AppLauncherPage.tsx
index 2e757fdde..f20e6f259 100644
--- a/src/client/pages/AppLauncherPage.tsx
+++ b/src/client/pages/AppLauncherPage.tsx
@@ -1,7 +1,6 @@
 import { useEffect, useState, type FormEvent } from "react";
 import { z } from "zod";
 
-import { BrandMark } from "../components/living/BrandMark";
 import { HintComic } from "../components/living/hints";
 import { LoadingStatus } from "../components/living/WaitingStatus";
 import { AppReleaseNotice } from "../components/living/AppReleaseNotice";
@@ -231,7 +230,6 @@ export function AppLauncherPage() {
           <LoadingStatus label={starting ? "client.launch.starting" : "common.loading"} />
         ) : error ? (
           <div className="lr-client-launch-panel">
-            <BrandMark size={68} motion="once" />
             <Pill
               icon="alert"
               tone="bad"
@@ -252,8 +250,7 @@ export function AppLauncherPage() {
           </div>
         ) : requestedSite ? (
           <section className="lr-client-approval">
-            <BrandMark size={68} motion="once" />
-            {vis && <HintComic kind="hint-client-site" />}
+            <HintComic kind="hint-client-site" />
             <h1 className={vis ? "visually-hidden" : undefined}>{t(approvalCurrent ? "client.connect.approved" : "client.connect.approveTitle")}</h1>
             <div className="lr-client-approval-origin">{requestedSite}</div>
             <p className={vis ? "visually-hidden" : undefined}>{t(approvalCurrent ? "client.connect.return" : "client.connect.approveHint")}</p>
diff --git a/src/client/styles.css b/src/client/styles.css
index 6815c3fa1..b259047f3 100644
--- a/src/client/styles.css
+++ b/src/client/styles.css
@@ -129,8 +129,7 @@ ul { margin: 0; padding: 0; list-style: none; }
 }
 .lr-brand:hover { background: var(--wall-2); }
 .lr-brand:active { transform: scale(.92); }
-.lr-brand-label { font-size: 12px; font-weight: 700; white-space: nowrap; }
-.lr-home-arrow { transform: rotate(180deg); }
+.lr-home-arrow { transform: rotate(90deg); color: var(--muted); }
 
 .lr-top-right { display: inline-flex; gap: 10px; align-items: center; }
 .lr-top > .lr-top-right { min-width: 0; flex-wrap: wrap; justify-content: flex-end; }
@@ -1013,7 +1012,8 @@ html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #334
 .lr-btn.is-on { border-color: var(--ink); background: var(--ink); color: var(--paper); }
 .lr-btn .lr-cap { margin-left: 2px; font-size: 12.5px; font-weight: 600; }
 .lr-app-connect { min-width: 40px; height: 40px; }
-.lr-app-connect.is-ready { color: var(--live); cursor: default; }
+.lr-app-connect.is-ready { cursor: default; }
+.lr-app-connect.is-ready > svg { color: var(--live); }
 .lr-app-connect.is-ready:hover { transform: none; }
 .lr-app-connect-help {
   position: fixed; inset: auto; margin: 0; padding: 16px;
@@ -1233,8 +1233,22 @@ html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #334
 @media (pointer: coarse) {
   .lr-invite-url, .lr-quality-number input, .lr-video-size input { font-size: 16px; }
 }
-.lr-welcome { width: 100%; min-width: 0; max-width: 100%; margin: 0; overflow: hidden; color: inherit; font-size: 15px; font-weight: 600; line-height: 1.7; text-align: center; white-space: nowrap; text-overflow: ellipsis; }
-.lr-welcome:not(.is-cipher)::before { content: "✦"; color: #d7982b; margin-right: 8px; }
+.lr-welcome { width: 100%; min-width: 0; max-width: 100%; margin: 0; overflow-x: auto; scrollbar-width: none; color: inherit; font-size: 15px; font-weight: 600; line-height: 1.7; text-align: center; white-space: nowrap; container-type: inline-size; }
+.lr-welcome-text { display: block; width: max-content; min-width: 100%; }
+.lr-welcome-text::before { content: "✦"; color: #d7982b; margin-right: 8px; }
+@media (prefers-reduced-motion: no-preference) {
+  .lr-welcome:not(.is-still, .is-cipher) { overflow: clip; }
+  .lr-welcome:not(.is-still) .lr-welcome-text { animation: lr-welcome-read linear both; }
+  .lr-welcome[data-text-active="false"] .lr-welcome-text { animation-name: none; }
+}
+[data-comic-reduced-motion="true"] .lr-welcome { overflow-x: auto; }
+[data-comic-reduced-motion="true"] .lr-welcome-text { animation: none; }
+/* Fitting lines stay still. Longer lines reveal their end before the shared
+   copy clock advances; the keyed text restarts this CSS motion, not a timer. */
+@keyframes lr-welcome-read {
+  0%, 20% { transform: translateX(0); }
+  75%, 100% { transform: translateX(min(0px, calc(100cqw - 100%))); }
+}
 .lr-welcome-cipher { display: inline-flex; align-items: center; gap: 8px; vertical-align: middle; opacity: .72; white-space: nowrap; }
 .lr-welcome-cipher i { width: 3px; height: 3px; background: #d7982b; transform: rotate(45deg); }
 .lr-tv-overlay > .lr-welcome { position: absolute; top: clamp(20px, 3vw, 32px); left: 18px; right: 18px; width: auto; font-size: clamp(13px, 1.5vw, 16px); }
@@ -1559,12 +1573,10 @@ html[data-theme="dark"] .lr-door-glyph { color: #7d92a8; }
   justify-items: center;
   gap: 20px;
 }
-.lr-client-launch-heading { display: flex; align-items: center; gap: 18px; margin-bottom: 8px; width: min(380px, 100%); }
-.lr-client-launch-heading > div { min-width: 0; }
+.lr-client-launch-heading { display: grid; grid-template-columns: minmax(0, 1fr); gap: 8px; margin-bottom: 8px; width: min(380px, 100%); text-align: center; }
 .lr-client-launch-title { font-size: 36px; line-height: 1.1; letter-spacing: -.04em; }
 .lr-client-launch-title small { margin-left: 6px; color: var(--muted); font-size: 15px; letter-spacing: 0; font-weight: 650; }
 .lr-client-brand-dot { color: #e77d38; }
-.lr-client-launch-heading .lr-welcome { text-align: left; margin-top: 8px; }
 .lr-client-standby { display: flex; align-items: flex-start; gap: 14px; width: 100%; padding: 18px 20px; border: 1px solid color-mix(in srgb, var(--ink) 20%, transparent); border-radius: 22px; background: var(--paper); }
 .lr-client-standby-icon { display: grid; flex: 0 0 44px; height: 44px; place-items: center; border-radius: 14px; background: var(--control-hover); color: var(--ink); }
 .lr-client-standby-copy { display: grid; flex: 1; gap: 6px; min-width: 0; }
diff --git a/src/client/ui/text-rotation.ts b/src/client/ui/text-rotation.ts
index 5b9497e67..7c93cdb74 100644
--- a/src/client/ui/text-rotation.ts
+++ b/src/client/ui/text-rotation.ts
@@ -16,7 +16,7 @@ export function createTextCycle<T>(frames: readonly T[]): () => T | undefined {
 }
 
 /** Hidden surfaces keep their entry and resume with a full reading interval. */
-export function startTextRotation(tick: () => void, element?: Element | null): () => void {
+export function startTextRotation(tick: () => void, element?: Element | null, onActivity?: (active: boolean) => void): () => void {
   const reducedMotion = window.matchMedia("(prefers-reduced-motion: reduce)");
   let inView = !element;
   let retired = false;
@@ -25,7 +25,9 @@ export function startTextRotation(tick: () => void, element?: Element | null): (
     if (retired) return;
     window.clearInterval(timer);
     timer = undefined;
-    if (inView && document.visibilityState === "visible" && !reducedMotion.matches) {
+    const active = inView && document.visibilityState === "visible" && !reducedMotion.matches;
+    onActivity?.(active);
+    if (active) {
       timer = window.setInterval(tick, TEXT_ROTATION_INTERVAL_MS);
     }
   };
@@ -42,6 +44,7 @@ export function startTextRotation(tick: () => void, element?: Element | null): (
   sync();
   return () => {
     retired = true; // An already queued observer notification may still arrive.
+    onActivity?.(false);
     window.clearInterval(timer);
     document.removeEventListener("visibilitychange", sync);
     reducedMotion.removeEventListener("change", sync);
diff --git a/src/client/ui/use-text-rotation.ts b/src/client/ui/use-text-rotation.ts
index 5dc1942c3..cee0cde55 100644
--- a/src/client/ui/use-text-rotation.ts
+++ b/src/client/ui/use-text-rotation.ts
@@ -15,7 +15,10 @@ export function useRotatingText<T>(
   const [selected, select] = useState({ cycle, value: cycle.first });
   useEffect(() => {
     if (frames.length < 2 || still) return;
-    return startTextRotation(() => select({ cycle, value: cycle.next() }), element?.current);
+    const surface = element?.current;
+    const stop = startTextRotation(() => select({ cycle, value: cycle.next() }), surface,
+      active => surface?.setAttribute("data-text-active", String(active)));
+    return () => { stop(); surface?.removeAttribute("data-text-active"); };
   }, [cycle, frames.length, element, still]);
   // Language/context changes display the new pool immediately, before effects.
   return selected.cycle === cycle ? selected.value : cycle.first;
diff --git a/src/client/ui/visual-kinds.ts b/src/client/ui/visual-kinds.ts
index d8a54d3d5..246d86c22 100644
--- a/src/client/ui/visual-kinds.ts
+++ b/src/client/ui/visual-kinds.ts
@@ -103,6 +103,7 @@ export type Set4Kind =
   | "hint-nat-prediction"
   | "hint-nat-unavailable"
   | "hint-client-local"
+  | "hint-app-ready"
   | "hint-client-site";
 
 export type PlaybackHintKind =
diff --git a/tests/text-rotation.test.ts b/tests/text-rotation.test.ts
index 62e8565a9..1a9c0b211 100644
--- a/tests/text-rotation.test.ts
+++ b/tests/text-rotation.test.ts
@@ -92,20 +92,36 @@ it("honors reduced motion at entry and when the preference changes", () => {
 
 it("pauses offscreen surfaces and releases all listeners at retirement", () => {
   const tick = vi.fn();
+  const activity = vi.fn();
   const show = (visible: boolean) => intersect([
     { isIntersecting: visible, intersectionRatio: visible ? 1 : 0 } as IntersectionObserverEntry,
   ], {} as IntersectionObserver);
-  stop = startTextRotation(tick, {} as Element);
+  stop = startTextRotation(tick, {} as Element, activity);
   expect(vi.getTimerCount()).toBe(0);
+  expect(activity).toHaveBeenLastCalledWith(false);
   intersect([
     { isIntersecting: false, intersectionRatio: 0 } as IntersectionObserverEntry,
     { isIntersecting: true, intersectionRatio: 1 } as IntersectionObserverEntry,
   ], {} as IntersectionObserver); // One notification can contain several queued states.
+  expect(activity).toHaveBeenLastCalledWith(true);
+  page.visibilityState = "hidden";
+  page.dispatchEvent(new Event("visibilitychange"));
+  expect(activity).toHaveBeenLastCalledWith(false);
+  page.visibilityState = "visible";
+  page.dispatchEvent(new Event("visibilitychange"));
+  expect(activity).toHaveBeenLastCalledWith(true);
+  motion.matches = true;
+  motion.dispatchEvent(new Event("change"));
+  expect(activity).toHaveBeenLastCalledWith(false);
+  motion.matches = false;
+  motion.dispatchEvent(new Event("change"));
+  expect(activity).toHaveBeenLastCalledWith(true);
   vi.advanceTimersByTime(4_000);
   show(true); // A repeated observation must not reset the running clock.
   vi.advanceTimersByTime(4_000);
   expect(tick).toHaveBeenCalledTimes(1);
   show(false);
+  expect(activity).toHaveBeenLastCalledWith(false);
   vi.advanceTimersByTime(60_000);
   expect(tick).toHaveBeenCalledTimes(1);
   show(true);
@@ -120,5 +136,6 @@ it("pauses offscreen surfaces and releases all listeners at retirement", () => {
   page.dispatchEvent(new Event("visibilitychange"));
   motion.dispatchEvent(new Event("change"));
   expect(vi.getTimerCount()).toBe(0);
+  expect(activity).toHaveBeenLastCalledWith(false);
   expect(disconnect).toHaveBeenCalled();
 });

From 7cd9a23f60af2bb90c3d81b98491e37cf4c451cf Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Tue, 13 Oct 2026 23:14:18 +0800
Subject: [PATCH 219/262] refactor(ui): center the launcher mascot with its
 title

---
 docs/standards/visual-language.md             | 2 +-
 src/client/components/living/Header.tsx       | 4 ++--
 src/client/components/living/LauncherForm.tsx | 7 +++++--
 src/client/styles.css                         | 5 ++++-
 4 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/docs/standards/visual-language.md b/docs/standards/visual-language.md
index f84dc8cbb..dc40c9182 100644
--- a/docs/standards/visual-language.md
+++ b/docs/standards/visual-language.md
@@ -329,7 +329,7 @@ support the task and use lighter icons or copy when another drawing adds noise.
 | Context | Illustration and literal content | Playful caption |
 | --- | --- | --- |
 | Page loading, site access check, App preparation | The shared wink mascot with the actual loading operation; no room or media-path claim | The current language's waiting pool |
-| Confirmed App readiness | The same wink mascot with the literal ready state; it does not imply an active share or working media route | None |
+| Confirmed App readiness | Wink mascot with literal readiness in dedicated feedback or its tooltip; an inline summary beside an existing main brand uses a status icon. Neither implies an active media route. | None |
 | Source listing/start/switch, room joining, media setup/recovery, waiting for the Host | The corresponding comic with the current status; only the existing state owner can declare waiting | The same waiting pool while the wait exists |
 | Error, limitation, pause, ended room or required user action | The corresponding comic and clear reason/action; settled movement keeps that verdict readable | None |
 | Small controls, tooltips and inline results | Existing action/status icon and contextual guidance when needed; retain direct actions | None |
diff --git a/src/client/components/living/Header.tsx b/src/client/components/living/Header.tsx
index e296d6663..33bac214a 100644
--- a/src/client/components/living/Header.tsx
+++ b/src/client/components/living/Header.tsx
@@ -133,14 +133,14 @@ export function AppHeader({
   const { t } = useCopy();
   return (
     <header className="lr-top">
-      <a
+      {homeHref !== "/client" && <a
         className="lr-brand"
         href={withBrowserDebug(homeHref)}
         aria-label={t("brand.home")}
       >
         <Glyph name="chevron" size={14} className="lr-home-arrow" />
         <BrandMark size={34} motion="once" />
-      </a>
+      </a>}
       <span className="lr-top-right">
         {led}
         {homeHref !== "/client" && showAppConnection && <AppConnectionButton />}
diff --git a/src/client/components/living/LauncherForm.tsx b/src/client/components/living/LauncherForm.tsx
index feba9138f..a9ade65c1 100644
--- a/src/client/components/living/LauncherForm.tsx
+++ b/src/client/components/living/LauncherForm.tsx
@@ -89,14 +89,17 @@ export function LauncherForm({
   return (
     <form className="lr-client-launch-panel" onSubmit={onSubmit}>
       <header className="lr-client-launch-heading">
-        <h1 className="lr-client-launch-title">Piik<span className="lr-client-brand-dot">.</span> <small>App</small></h1>
+        <div className="lr-client-launch-brand">
+          <BrandMark size={52} motion="once" />
+          <h1 className="lr-client-launch-title">Piik<span className="lr-client-brand-dot">.</span> <small>App</small></h1>
+        </div>
         <WelcomeLine />
       </header>
 
       {children}
 
       <section className="lr-client-standby" aria-label={t("client.connect.standby")}>
-        <span className="lr-client-standby-icon" aria-hidden="true"><BrandMark size={34} motion="loop" /></span>
+        <span className="lr-client-standby-icon" aria-hidden="true"><Glyph name="check" size={24} /></span>
         <div className="lr-client-standby-copy">
           <strong className={vis ? "visually-hidden" : undefined}>{t("client.connect.standby")}</strong>
           <p className={vis ? "visually-hidden" : undefined}>{t("client.connect.standbyHint")}</p>
diff --git a/src/client/styles.css b/src/client/styles.css
index b259047f3..b2c1d9880 100644
--- a/src/client/styles.css
+++ b/src/client/styles.css
@@ -132,7 +132,7 @@ ul { margin: 0; padding: 0; list-style: none; }
 .lr-home-arrow { transform: rotate(90deg); color: var(--muted); }
 
 .lr-top-right { display: inline-flex; gap: 10px; align-items: center; }
-.lr-top > .lr-top-right { min-width: 0; flex-wrap: wrap; justify-content: flex-end; }
+.lr-top > .lr-top-right { margin-left: auto; min-width: 0; flex-wrap: wrap; justify-content: flex-end; }
 
 /* LED state strip */
 .lr-leds {
@@ -1574,6 +1574,9 @@ html[data-theme="dark"] .lr-door-glyph { color: #7d92a8; }
   gap: 20px;
 }
 .lr-client-launch-heading { display: grid; grid-template-columns: minmax(0, 1fr); gap: 8px; margin-bottom: 8px; width: min(380px, 100%); text-align: center; }
+.lr-client-launch-brand { display: flex; align-items: baseline; justify-content: center; gap: 14px; }
+/* The mascot's feet sit at y=29 in its 32-unit canvas; align them to the wordmark baseline. */
+.lr-client-launch-brand > svg { translate: 0 9.375%; }
 .lr-client-launch-title { font-size: 36px; line-height: 1.1; letter-spacing: -.04em; }
 .lr-client-launch-title small { margin-left: 6px; color: var(--muted); font-size: 15px; letter-spacing: 0; font-weight: 650; }
 .lr-client-brand-dot { color: #e77d38; }

From 3121f59b3dfd86575e5751c7a1dccfe08a9dd3b1 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 00:08:44 +0800
Subject: [PATCH 220/262] fix(app): isolate room failure and polish setup
 controls

---
 CONTRIBUTING.md                               |  10 ++
 .../adr/0010-cross-platform-client-runtime.md |   8 +-
 docs/todo.md                                  |   8 +-
 internal/app/app.go                           |  36 +++---
 internal/app/app_test.go                      |  27 +++++
 internal/app/launcher/server.go               |  52 +++------
 internal/app/launcher/server_test.go          |  31 +++++
 scripts/network-lab/scenarios.ts              |  13 +++
 .../components/living/CaptureSourcePicker.tsx | 108 +++++++++---------
 src/client/components/living/LauncherForm.tsx |   6 +-
 .../components/living/QualityPresets.tsx      |  38 ++++--
 src/client/locales/en.ts                      |   4 +-
 src/client/locales/zh.ts                      |   4 +-
 src/client/pages/AppLauncherPage.tsx          |  16 +--
 src/client/styles.css                         |   2 +
 tests/quality-controls.test.ts                |  12 +-
 16 files changed, 245 insertions(+), 130 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index d7f3608fc..cfc864c1d 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -21,6 +21,16 @@ PR; maintainers can help identify what still needs verification.
 讨论时请结合实际场景提出建议，尊重不同意见；分享截图或日志前移除隐私内容。
 无法运行的检查请如实说明，便于维护者协助验证。
 
+Review contributions by their practical value, evidence and fit with the product,
+not their line count. A small fix that identifies and resolves a real defect is
+valuable. Duplicate work already independently resolved, personal preferences or
+low-value changes may be declined; merging is not an attribution mechanism.
+Retain authorship for accepted contributions and credit substantive discoveries
+accurately, without attributing independently written code to a PR author.
+评审看实际价值、证据和产品定位，不看代码行数。发现并解决真实问题的小修复同样值得接纳；
+已经独立解决的重复工作、个人偏好或收益很低的改动可以不合并，不为增加贡献者名单而合并。
+保留已接纳贡献的作者信息，如实说明有价值的问题发现；独立编写的代码不应冒记为他人共同编写。
+
 ## Lean Workflow
 
 This is the default for an ordinary scoped implementation or bug fix.
diff --git a/docs/adr/0010-cross-platform-client-runtime.md b/docs/adr/0010-cross-platform-client-runtime.md
index 810af173d..9a36940f8 100644
--- a/docs/adr/0010-cross-platform-client-runtime.md
+++ b/docs/adr/0010-cross-platform-client-runtime.md
@@ -165,8 +165,12 @@ topologies and makes a saved Site unavailable while another room source runs.
 12. Local authority shutdown first ends every in-memory room through the current
     `room-closed` path, then closes signaling and HTTP. The App cancels the
     server context, calls that end-then-close sequence under one bounded
-    timeout, and only then closes the public tunnel and the loopback service. It
-    does not restart a vanished authority.
+    timeout, and only then closes the public tunnel. Interactive room failure
+    leaves the resident App, approved Site sessions and approval UI available;
+    the launcher invalidates the failed room's target and reports its error.
+    Process exit additionally retires the loopback service. Explicit CLI room
+    launches still return their failure to the caller. Neither path restarts a
+    vanished authority.
 13. App assembly consumes the immutable application release from the same full
     Git revision and an explicit supported target. The Go binary embeds that
     release's built Browser assets and the package `REVISION` records the same
diff --git a/docs/todo.md b/docs/todo.md
index 4a22a12fc..b6483960b 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -1,6 +1,6 @@
 # Current TODO Ledger
 
-Last reviewed: 2026-10-13
+Last reviewed: 2026-10-14
 
 The current 2.0 preparation includes independent investigation across this
 ledger. Explicit owner holds remain in force; an investigation does not itself
@@ -29,8 +29,10 @@ Git/PRs own completed history.
 - [ ] **Reconcile open PRs with the final candidate.**
   [#462](https://github.com/TNTcraftHIM/Piik/pull/462)'s 256/320 kbps request and
   [#469](https://github.com/TNTcraftHIM/Piik/pull/469)'s 4K request overlap the
-  numeric-media candidate; neither PR has been merged. Credit their authors and
-  #470's author in the final squash's `Co-authored-by` trailers, and verify GitHub
+  numeric-media candidate; neither PR has been merged. Evaluate their original
+  contribution against work already independently identified, following
+  [contribution review](../CONTRIBUTING.md#ways-to-help); overlap alone does not
+  warrant merging or co-authorship. Retain #470's accepted authorship and verify
   attribution after integration. Preserve the physical-evidence limits below
   and explain the disposition at integration. Keep
   [#459](https://github.com/TNTcraftHIM/Piik/pull/459)'s candidate scope and
diff --git a/internal/app/app.go b/internal/app/app.go
index 8cac1855c..6072011b9 100644
--- a/internal/app/app.go
+++ b/internal/app/app.go
@@ -236,6 +236,7 @@ func runLauncher(
 	configureDiagnostics func(*Options, appconfig.Config) error,
 ) (returnedErr error) {
 	automatic := explicitMode(options)
+	directRoom := automatic && (options.Local || options.Link || config.Site == "")
 	initialOptions := options
 	initialConfig := config
 	mode, err := launcher.LoadMode(configPath)
@@ -304,9 +305,28 @@ func runLauncher(
 		// capabilities immediately; the launcher can start a Local room later.
 		openSite(initialConfig.Site, options)
 	}
+	// An interactive room is a child of the resident App. Its failure must not
+	// retire an unrelated Site's native sessions or its approval page. Explicit
+	// CLI launches still return their outcome to the caller. Register this before
+	// the runtime join so its cleanup and error are complete before we wait.
+	defer func() {
+		if directRoom || returnedErr == nil || ctx.Err() != nil {
+			return
+		}
+		launch.SetResult("", returnedErr)
+		options.console.show(consoleView{state: "setup", entry: launch.URL(), problem: diagnostics.SafeText(returnedErr.Error())})
+		slog.Debug("piik-client", "event", "local-room-stopped", diagnostics.Error(returnedErr))
+		select {
+		case <-ctx.Done():
+		case err := <-control.Done():
+			returnedErr = errors.Join(returnedErr, err)
+		case err := <-launch.Done():
+			returnedErr = errors.Join(returnedErr, err)
+		}
+	}()
 
 	var selection launcher.Selection
-	if automatic && (options.Local || options.Link || initialConfig.Site == "") {
+	if directRoom {
 		selection = launcher.Selection{Mode: launcher.ModeLocal, LocalAccessPassword: initialConfig.LocalAccessPassword}
 		if options.Link {
 			selection.Mode = launcher.ModeLink
@@ -343,20 +363,12 @@ func runLauncher(
 	})
 	if err != nil {
 		err = fmt.Errorf("Piik App configuration could not be saved: %w", err)
-		launch.SetResult("", err)
-		if !automatic {
-			<-launch.Handled()
-		}
 		return err
 	}
 	if err = configureDiagnostics(&options, selectedConfig); err != nil {
-		launch.SetResult("", err)
-		if !automatic {
-			<-launch.Handled()
-		}
 		return err
 	}
-	if !automatic {
+	if !directRoom {
 		options.DisableBrowser = true
 	}
 	ready := make(chan string, 1)
@@ -384,10 +396,6 @@ func runLauncher(
 	case target := <-ready:
 		launch.SetResult(target, nil)
 	case <-runtimeDone:
-		launch.SetResult("", runtimeErr)
-		if !automatic {
-			<-launch.Handled()
-		}
 		return nil
 	case <-ctx.Done():
 		launch.SetResult("", ctx.Err())
diff --git a/internal/app/app_test.go b/internal/app/app_test.go
index 2477c849a..0196130f5 100644
--- a/internal/app/app_test.go
+++ b/internal/app/app_test.go
@@ -260,6 +260,33 @@ func TestLauncherRetainsItsRuntimeFailureDuringCancellation(t *testing.T) {
 				}
 			}
 			resume()
+			if !cancelBeforeFailure {
+				select {
+				case <-requestDone:
+				case <-time.After(2 * time.Second):
+					t.Fatal("launcher did not report its failed room")
+				}
+				response, err := http.Get(strings.TrimSuffix(target, "/client") + "/api/client-launcher")
+				if err != nil {
+					t.Fatalf("room failure retired the App approval UI: %v", err)
+				}
+				var state struct {
+					Target, Detail string
+					Starting       bool
+				}
+				err = json.NewDecoder(response.Body).Decode(&state)
+				response.Body.Close()
+				if err != nil || state.Target != "" || state.Starting || !strings.Contains(state.Detail, "local server port is unavailable") {
+					t.Fatalf("failed room was not reflected in the live launcher: %+v, %v", state, err)
+				}
+				select {
+				case err := <-done:
+					joined = true
+					t.Fatalf("room failure retired the resident App: %v", err)
+				default:
+				}
+				cancel()
+			}
 			select {
 			case err := <-done:
 				joined = true
diff --git a/internal/app/launcher/server.go b/internal/app/launcher/server.go
index 9763bb26f..d7a1a3c0e 100644
--- a/internal/app/launcher/server.go
+++ b/internal/app/launcher/server.go
@@ -77,18 +77,16 @@ type Server struct {
 	enableDebug         func() error
 	selection           chan Selection
 	resultReady         chan struct{}
-	handled             chan struct{}
 	done                chan error
 	ready               chan struct{}
 
-	mu          sync.Mutex
-	selected    bool
-	resultSet   bool
-	target      string
-	resultErr   error
-	closeOnce   sync.Once
-	resultOnce  sync.Once
-	handledOnce sync.Once
+	mu         sync.Mutex
+	selected   bool
+	resultSet  bool
+	target     string
+	resultErr  error
+	closeOnce  sync.Once
+	resultOnce sync.Once
 }
 
 // Start serves the launcher page and its API on a loopback port. assets is the
@@ -130,7 +128,6 @@ func Start(parent context.Context, assets fs.FS, options Options) (*Server, erro
 		enableDebug:         options.EnableDebug,
 		selection:           make(chan Selection, 1),
 		resultReady:         make(chan struct{}),
-		handled:             make(chan struct{}),
 		done:                make(chan error, 1),
 		ready:               make(chan struct{}),
 	}
@@ -156,10 +153,6 @@ func (server *Server) Selection() <-chan Selection {
 	return server.selection
 }
 
-func (server *Server) Handled() <-chan struct{} {
-	return server.handled
-}
-
 func (server *Server) Done() <-chan error {
 	return server.done
 }
@@ -175,17 +168,16 @@ func (server *Server) Begin() bool {
 }
 
 func (server *Server) SetResult(target string, resultErr error) {
-	server.resultOnce.Do(func() {
-		if resultErr == nil && !validTarget(target) {
-			resultErr = errors.New("App target is invalid")
-		}
-		server.mu.Lock()
-		server.resultSet = true
-		server.target = target
-		server.resultErr = resultErr
-		server.mu.Unlock()
-		close(server.resultReady)
-	})
+	if resultErr == nil && !validTarget(target) {
+		resultErr = errors.New("App target is invalid")
+	}
+	server.mu.Lock()
+	server.resultSet = true
+	server.target = target
+	server.resultErr = resultErr
+	server.mu.Unlock()
+	// Readiness completes once; a later room failure invalidates the old target.
+	server.resultOnce.Do(func() { close(server.resultReady) })
 }
 
 func (server *Server) Close() error {
@@ -371,19 +363,15 @@ func (server *Server) handleLaunch(response http.ResponseWriter, request *http.R
 	select {
 	case server.selection <- selection:
 	case <-request.Context().Done():
-		server.markHandled()
 		return
 	case <-server.ctx.Done():
-		server.markHandled()
 		return
 	}
 	select {
 	case <-server.resultReady:
 	case <-request.Context().Done():
-		server.markHandled()
 		return
 	case <-server.ctx.Done():
-		server.markHandled()
 		return
 	}
 	server.mu.Lock()
@@ -393,11 +381,9 @@ func (server *Server) handleLaunch(response http.ResponseWriter, request *http.R
 		writeJSON(response, http.StatusServiceUnavailable, map[string]string{
 			"error": "Piik App could not start", "detail": errorDetail(resultErr),
 		})
-		server.markHandled()
 		return
 	}
 	writeJSON(response, http.StatusOK, map[string]string{"target": target})
-	server.markHandled()
 }
 
 func errorDetail(err error) string {
@@ -412,10 +398,6 @@ func errorDetail(err error) string {
 	return string(detail)
 }
 
-func (server *Server) markHandled() {
-	server.handledOnce.Do(func() { close(server.handled) })
-}
-
 func (server *Server) requestAllowed(request *http.Request) bool {
 	_, port, err := net.SplitHostPort(request.Host)
 	if err != nil {
diff --git a/internal/app/launcher/server_test.go b/internal/app/launcher/server_test.go
index 0f7b657e4..743a68219 100644
--- a/internal/app/launcher/server_test.go
+++ b/internal/app/launcher/server_test.go
@@ -88,6 +88,37 @@ func TestLauncherServesStateAndCompletesOneSelection(t *testing.T) {
 	}
 }
 
+func TestRoomFailureInvalidatesReadyTargetButKeepsSiteApprovalAvailable(t *testing.T) {
+	server := startFixture(t, "https://share.example")
+	server.changeSite = func(site string) (string, error) { return site, nil }
+	origin := strings.TrimSuffix(server.URL(), "/client")
+	server.Begin()
+	server.SetResult("http://localhost:8787/#piik-client=1", nil)
+	server.SetResult("", errors.New("public invitation link stopped"))
+	response, err := http.Get(origin + "/api/client-launcher")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer response.Body.Close()
+	var state struct {
+		Target, Detail, Site string
+		Starting             bool
+	}
+	if json.NewDecoder(response.Body).Decode(&state) != nil || state.Target != "" || state.Starting ||
+		state.Detail != "public invitation link stopped" || state.Site != "https://share.example" {
+		t.Fatalf("failed room state = %+v", state)
+	}
+	response, err = localPost(origin+"/api/client-launcher/site", "application/json",
+		strings.NewReader(`{"site":"","expectedSite":"https://share.example"}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		t.Fatalf("failed room blocked approval revocation: %d", response.StatusCode)
+	}
+}
+
 func TestLauncherIncludesTheInjectedBuildVersionAndRevision(t *testing.T) {
 	const version = "v1.2.3"
 	const revision = "0123456789abcdef0123456789abcdef01234567"
diff --git a/scripts/network-lab/scenarios.ts b/scripts/network-lab/scenarios.ts
index 24c672cb9..129f31aa9 100644
--- a/scripts/network-lab/scenarios.ts
+++ b/scripts/network-lab/scenarios.ts
@@ -71,12 +71,25 @@ export const scenarios: readonly Scenario[] = [
   { ...baseline, id: "sequential-app", host: "app", viewer: "app", nat: ["sequential", "sequential"], expected: "observed", enhancedExpected: "media" },
   { ...baseline, id: "sequential-browser", host: "browser", viewer: "browser", nat: ["sequential", "sequential"], expected: "observed" },
   { ...baseline, id: "sequential-mixed", host: "app", viewer: "browser", nat: ["sequential", "sequential"], expected: "observed" },
+  { ...baseline, id: "sequential-browser-app", host: "browser", viewer: "app", nat: ["sequential", "sequential"], expected: "observed" },
   { ...baseline, id: "ipv6-browser", host: "browser", viewer: "browser", ipv6: true, fault: "ipv4-block" },
   { ...baseline, id: "ipv6-app", host: "app", viewer: "app", ipv6: true, fault: "ipv4-block" },
   { ...baseline, id: "healthy-sibling", host: "browser", viewer: "browser", sibling: true,
     fault: "rate", faultEndpoint: 1, direction: "downlink", duringShare: true },
   { ...baseline, id: "remap-browser", host: "browser", viewer: "browser", fault: "udp-block", duringShare: true, remap: true },
   { ...baseline, id: "remap-app", host: "app", viewer: "app", fault: "udp-block", duringShare: true, remap: true },
+  // Preserve each direction: Browser capture and Native reception have different
+  // owners from Native capture and Browser reception, even on the same network.
+  ...([
+    { host: "app", viewer: "browser" }, { host: "browser", viewer: "app" }, { host: "app", viewer: "app" },
+  ] as const).flatMap(pair => [
+    { ...baseline, ...pair, id: `stun-backup-${pair.host}-${pair.viewer}`, fault: "stun-primary" as const },
+    { ...baseline, ...pair, id: `signaling-outage-${pair.host}-${pair.viewer}`, fault: "signaling" as const, duringShare: true },
+  ]),
+  ...([{ host: "app", viewer: "browser" }, { host: "browser", viewer: "app" }] as const).flatMap(pair => [
+    { ...baseline, ...pair, id: `ipv6-${pair.host}-${pair.viewer}`, ipv6: true, fault: "ipv4-block" as const },
+    { ...baseline, ...pair, id: `remap-${pair.host}-${pair.viewer}`, fault: "udp-block" as const, duringShare: true, remap: true },
+  ]),
 ];
 
 export function selectScenarios(suite: string, names?: string): Scenario[] {
diff --git a/src/client/components/living/CaptureSourcePicker.tsx b/src/client/components/living/CaptureSourcePicker.tsx
index 69d4872bb..24cec432f 100644
--- a/src/client/components/living/CaptureSourcePicker.tsx
+++ b/src/client/components/living/CaptureSourcePicker.tsx
@@ -282,59 +282,6 @@ export function CaptureSourcePicker({
           id={`${pickerId}-panel`}
           aria-labelledby={`${pickerId}-${activeTab}`}
         >
-          {activeTab === "camera" ? <CameraSources {...cameraSources} selected={initialCamera}
-            disabled={selectionDisabled} onSelect={id => onCamera?.(id)} /> : <>
-          <div className="lr-source-picker-list">
-            {browserCapture ? (
-              <button
-                type="button"
-                className="lr-source-option is-browser"
-                aria-label={t("host.sourcePicker.browser")}
-                disabled={selectionDisabled || !tabAvailable(activeTab)}
-                onClick={onBrowser}
-              >
-                <span className="lr-source-option-icon" aria-hidden="true">
-                  <Glyph name={SOURCE_ICONS[activeTab]} size={23} />
-                </span>
-                {vis ? (
-                  <span className="visually-hidden">
-                    {t(`host.sourcePicker.tab.${activeTab}`)}
-                  </span>
-                ) : (
-                  <span className="lr-source-option-copy">
-                    <strong>{t("host.sourcePicker.browser")}</strong>
-                    <small>{t("host.sourcePicker.browserHint")}</small>
-                  </span>
-                )}
-              </button>
-            ) : null}
-
-            {nativeTab && !browserCapture
-              ? sources.map((target) => (
-                  <CaptureSourceOption
-                    key={nativeCaptureTargetKey(target)}
-                    target={target}
-                    disabled={
-                      selectionDisabled || exclusionUnavailable || (audioLocked && shareAudio && !supportsAudio(target))
-                    }
-                    onPreview={onPreview}
-                    onSelect={() =>
-                      onNative(target, shareAudio && supportsAudio(target),
-                        supportsCaptureBorder && showCaptureBorder, target.kind === "display" ? excludeAudio : undefined)
-                    }
-                  />
-                ))
-              : null}
-          </div>
-          </>}
-
-          {onAppConnected && (nativeSources.kind === "browser" || nativeSources.kind === "unavailable") && (
-            <div className="lr-source-app-connection">
-              <AppConnectionButton sourcePicker onConnected={onAppConnected} />
-              {vis ? null : <small>{t("client.connect.captureHint")}</small>}
-            </div>
-          )}
-
           {nativeTab &&
           nativeSources.kind === "ready" &&
           (supportsCaptureBorder || sources.length > 0) ? (
@@ -390,6 +337,61 @@ export function CaptureSourcePicker({
             </div>
           ) : null}
 
+          {activeTab === "camera" ? <CameraSources {...cameraSources} selected={initialCamera}
+            disabled={selectionDisabled} onSelect={id => onCamera?.(id)} /> : <>
+          <div className="lr-source-picker-list">
+            {browserCapture ? (
+              <button
+                type="button"
+                className="lr-source-option is-browser"
+                aria-label={t("host.sourcePicker.browser")}
+                disabled={selectionDisabled || !tabAvailable(activeTab)}
+                onClick={onBrowser}
+              >
+                <span className="lr-source-option-icon" aria-hidden="true">
+                  <Glyph name={SOURCE_ICONS[activeTab]} size={23} />
+                </span>
+                {vis ? (
+                  <span className="visually-hidden">
+                    {t(`host.sourcePicker.tab.${activeTab}`)}
+                  </span>
+                ) : (
+                  <span className="lr-source-option-copy">
+                    <strong>{t("host.sourcePicker.browser")}</strong>
+                    <small>{t("host.sourcePicker.browserHint")}</small>
+                  </span>
+                )}
+              </button>
+            ) : null}
+
+            {nativeTab && !browserCapture
+              ? sources.map((target) => (
+                  <CaptureSourceOption
+                    key={nativeCaptureTargetKey(target)}
+                    target={target}
+                    disabled={
+                      selectionDisabled || exclusionUnavailable || (audioLocked && shareAudio && !supportsAudio(target))
+                    }
+                    onPreview={onPreview}
+                    onSelect={() =>
+                      onNative(target, shareAudio && supportsAudio(target),
+                        supportsCaptureBorder && showCaptureBorder, target.kind === "display" ? excludeAudio : undefined)
+                    }
+                  />
+                ))
+              : null}
+          </div>
+          </>}
+
+          {onAppConnected && (nativeSources.kind === "browser" || nativeSources.kind === "unavailable") && (
+            <div className="lr-source-app-connection">
+              <AppConnectionButton sourcePicker onConnected={onAppConnected} />
+              {vis ? null : <small>{t("client.connect.captureHint")}</small>}
+            </div>
+          )}
+
+
+
           {issueKey ? (
             <Pill icon="alert" label={t(issueKey)} comic="warning" />
           ) : browserCapture || activeTab === "camera" ? null : sources.length === 0 ? (
diff --git a/src/client/components/living/LauncherForm.tsx b/src/client/components/living/LauncherForm.tsx
index a9ade65c1..3e5a76486 100644
--- a/src/client/components/living/LauncherForm.tsx
+++ b/src/client/components/living/LauncherForm.tsx
@@ -47,6 +47,7 @@ export function LauncherForm({
   onSubmit,
   children,
   version,
+  roomError,
 }: {
   mode: AppMode;
   onModeChange: (mode: AppMode) => void;
@@ -66,6 +67,7 @@ export function LauncherForm({
   onSubmit: (event: FormEvent<HTMLFormElement>) => void;
   children?: ReactNode;
   version?: string;
+  roomError?: ReactNode;
 }) {
   const { vis, t } = useCopy();
   const accessHintId = useId();
@@ -111,7 +113,7 @@ export function LauncherForm({
         </div>
       </section>
 
-      {target ? <a className="lr-btn is-primary" href={target} onClick={onOpen} aria-label={t("client.launch.go")}>
+      {roomError ?? (target ? <a className="lr-btn is-primary" href={target} onClick={onOpen} aria-label={t("client.launch.go")}>
         <Glyph name="arrowRight" size={19} />{vis ? null : <span className="lr-cap">{t("client.launch.go")}</span>}
       </a> : <>
       <p className={vis ? "visually-hidden" : "lr-client-launch-section"}>{t("client.launch.room")}</p>
@@ -211,7 +213,7 @@ export function LauncherForm({
         hint={MODES.find((choice) => choice.mode === mode)?.comic}
         disabled={mode === "local" && lan !== undefined && !lan.selected}
       />
-      </>}
+      </>)}
       <div className="lr-client-about">
         {version && <p className="lr-client-version">
           <span className={vis ? "visually-hidden" : undefined}>{t("client.launch.version", { version })}</span>
diff --git a/src/client/components/living/QualityPresets.tsx b/src/client/components/living/QualityPresets.tsx
index 9e3781656..5609c5b03 100644
--- a/src/client/components/living/QualityPresets.tsx
+++ b/src/client/components/living/QualityPresets.tsx
@@ -1,4 +1,4 @@
-import { Fragment, useRef, type CSSProperties, type ReactNode } from "react";
+import { Fragment, useId, useRef, useState, type CSSProperties, type ReactNode } from "react";
 import { MIN_AUDIO_BITRATE } from "../../../shared/protocol";
 import {
   QUALITY_PROFILES, QUALITY_PROFILE_KEYS, QUALITY_RESOLUTIONS, DEGRADATION_PREFERENCE_KEYS, qualityResolutionEqual,
@@ -52,22 +52,26 @@ export function ResolutionControl({ value, limits, disabled, onChange }: {
 }) {
   const { t, vis } = useCopy();
   const controls = useRef<HTMLDivElement>(null);
+  const [invalid, setInvalid] = useState(false);
+  const errorId = useId();
   const axes = ["width", "height"] as const;
   const reset = (container: HTMLElement) => {
+    setInvalid(false);
     for (const axis of axes) container.querySelector<HTMLInputElement>(`input[name="${axis}"]`)!.value = String(value[axis]);
   };
   const apply = (container: HTMLElement) => {
     const width = container.querySelector<HTMLInputElement>('input[name="width"]')!;
     const height = container.querySelector<HTMLInputElement>('input[name="height"]')!;
     if (![width, height].every(input => input.validity.valid && Number.isFinite(input.valueAsNumber))) {
-      reset(container);
+      setInvalid(true);
       return;
     }
     const next = { width: width.valueAsNumber, height: height.valueAsNumber };
     if (captureFramerateCeiling(next, limits) < MIN_VIDEO_FRAMERATE) {
-      reset(container);
+      setInvalid(true);
       return;
     }
+    setInvalid(false);
     if (!qualityResolutionEqual(value, next)) onChange(next);
   };
   return <div className="lr-resolution-controls" ref={controls}
@@ -91,14 +95,20 @@ export function ResolutionControl({ value, limits, disabled, onChange }: {
           role="group" aria-label={t("host.advanced.resolution")}>
           {axes.map((axis, index) => <Fragment key={axis}>
             {index === 1 ? <span aria-hidden="true">×</span> : null}
-            <input type="number" inputMode="numeric" name={axis} defaultValue={value[axis]}
+            <input type="number" inputMode="numeric" name={axis} defaultValue={value[axis]} required
               min={4} max={limits.maxVideoResolution[axis]} step={2} disabled={disabled}
+              aria-invalid={invalid || undefined} aria-describedby={invalid ? errorId : undefined}
+              onInput={() => setInvalid(false)}
               aria-label={t(axis === "width" ? "host.video.width" : "host.video.height")} />
           </Fragment>)}
           <span aria-hidden="true">px</span>
         </span>
       </Tooltip>
     </div>
+    {invalid && <small id={errorId} className="lr-quality-validation" role="alert">{t("host.video.resolutionInvalid", {
+      width: String(limits.maxVideoResolution.width), height: String(limits.maxVideoResolution.height),
+      pixels: limits.maxVideoPixels.toLocaleString("en-US"),
+    })}</small>}
     <div className="lr-row-group" role="group" aria-label={t("host.advanced.resolution")}>
       {Object.entries(QUALITY_RESOLUTIONS).map(([label, resolution]) => <Chip key={label}
         selected={qualityResolutionEqual(value, resolution)}
@@ -131,8 +141,11 @@ function QualityNumberControl({ value, min, max, step, unit, name, label, disabl
   className: string;
   children: (input: ReactNode, select: (value: number) => void) => ReactNode;
 }) {
+  const { t } = useCopy();
+  const [invalid, setInvalid] = useState(false);
+  const errorId = useId();
   const input = useRef<HTMLInputElement>(null);
-  const reset = () => { input.current!.value = String(value); };
+  const reset = () => { input.current!.value = String(value); setInvalid(false); };
   const select = (next: number) => {
     // A preset or slider replaces the draft, including a choice of the current value.
     reset();
@@ -140,7 +153,9 @@ function QualityNumberControl({ value, min, max, step, unit, name, label, disabl
   };
   const number = <label className="lr-input lr-quality-number">
     <input ref={input} type="number" inputMode={step < 1 ? "decimal" : "numeric"} name={name} key={value}
-      defaultValue={value} min={min} max={max} step={step} disabled={disabled} aria-label={label}
+      defaultValue={value} min={min} max={max} step={step} disabled={disabled} required aria-label={label}
+      aria-invalid={invalid || undefined} aria-describedby={invalid ? errorId : undefined}
+      onInput={() => setInvalid(false)}
       onKeyDown={event => {
         if (event.key !== "Enter" && event.key !== "Escape") return;
         event.preventDefault();
@@ -153,9 +168,14 @@ function QualityNumberControl({ value, min, max, step, unit, name, label, disabl
   return <div className={className} onBlur={event => {
     if (event.currentTarget.contains(event.relatedTarget)) return;
     const field = input.current!;
-    if (!field.validity.valid || !Number.isFinite(field.valueAsNumber)) reset();
-    else if (field.valueAsNumber !== value) onChange(field.valueAsNumber);
-  }}>{children(number, select)}</div>;
+    const valid = field.validity.valid && Number.isFinite(field.valueAsNumber);
+    setInvalid(!valid);
+    if (valid && field.valueAsNumber !== value) onChange(field.valueAsNumber);
+  }}>{children(number, select)}
+    {invalid && <small id={errorId} className="lr-quality-validation" role="alert">{t("host.quality.invalidNumber", {
+      min: String(min), max: String(max), step: String(step), unit,
+    })}</small>}
+  </div>;
 }
 
 export function VideoRateControls({ value, limits, disabled, onChange }: {
diff --git a/src/client/locales/en.ts b/src/client/locales/en.ts
index 1a811182d..1e987bb8f 100644
--- a/src/client/locales/en.ts
+++ b/src/client/locales/en.ts
@@ -90,7 +90,7 @@ export const en: Record<CopyKey, string> = {
   "client.launch.localAccessHint": "If set, required to create rooms or join by code. Invite links grant access to their room.",
   "client.launch.go": "Open Piik",
   "client.launch.starting": "Preparing Piik",
-  "client.launch.error": "Piik could not start",
+  "client.launch.error": "Room unavailable",
   "client.launch.reopen": "Check the error above and the terminal, then reopen Piik. Use Debug launch to record logs.",
   "client.launch.debug": "Debug launch",
   "client.launch.debugHint": "Record App diagnostics and logs in pages opened from here. Press D in the terminal to export App logs.",
@@ -388,6 +388,8 @@ export const en: Record<CopyKey, string> = {
   "host.video.returnCommonHint": "Use the nearest common value: {value} {unit}.",
   "host.video.inputHint": "Drag for common values, or enter {min}–{max} {unit} directly.",
   "host.video.resolutionHint": "Width ≤ {width} px; height ≤ {height} px; total ≤ {pixels} pixels. Source proportions are preserved; the FPS limit follows the size.",
+  "host.video.resolutionInvalid": "Use even dimensions from 4 to {width} × {height}, within {pixels} total pixels.",
+  "host.quality.invalidNumber": "Use {min}–{max} {unit}, in steps of {step}.",
   "host.audio.bitrateHint": "Audio bitrate limit: {min}–{max} kbps.",
   "host.advanced.audio.saver": "Standard",
   "host.advanced.audio.music": "Music",
diff --git a/src/client/locales/zh.ts b/src/client/locales/zh.ts
index 09e060ac9..7cbcec62e 100644
--- a/src/client/locales/zh.ts
+++ b/src/client/locales/zh.ts
@@ -90,7 +90,7 @@ export const zh = {
   "client.launch.localAccessHint": "设置后，开房或凭房间号加入需要口令。邀请链接可直接进入对应房间。",
   "client.launch.go": "进入 Piik",
   "client.launch.starting": "正在准备 Piik",
-  "client.launch.error": "Piik 启动失败",
+  "client.launch.error": "房间暂不可用",
   "client.launch.reopen": "查看上方原因和终端详情，重新打开 Piik 后重试。可开启「诊断启动」记录日志。",
   "client.launch.debug": "诊断启动",
   "client.launch.debugHint": "开启 App 诊断，从此页进入的网页也会记录日志。App 日志可在终端按 D 导出。",
@@ -388,6 +388,8 @@ export const zh = {
   "host.video.returnCommonHint": "使用最近的常用档位：{value} {unit}。",
   "host.video.inputHint": "拖动选择常用值，也可直接输入 {min}–{max} {unit}。",
   "host.video.resolutionHint": "宽 ≤ {width}，高 ≤ {height} 像素；总像素 ≤ {pixels}。保留来源比例，帧率上限随尺寸调整。",
+  "host.video.resolutionInvalid": "宽高需为不小于 4 的偶数，上限为 {width} × {height}，总像素不超过 {pixels}。",
+  "host.quality.invalidNumber": "请输入 {min}–{max} {unit}，步长为 {step}。",
   "host.audio.bitrateHint": "音频码率上限：{min}–{max} kbps。",
   "host.advanced.audio.saver": "普通",
   "host.advanced.audio.music": "音乐",
diff --git a/src/client/pages/AppLauncherPage.tsx b/src/client/pages/AppLauncherPage.tsx
index f20e6f259..56b44cc14 100644
--- a/src/client/pages/AppLauncherPage.tsx
+++ b/src/client/pages/AppLauncherPage.tsx
@@ -228,25 +228,22 @@ export function AppLauncherPage() {
         {debugError && <Pill icon="alert" tone="bad" comic="warning" alert label={t("client.launch.debugFailed")} />}
         {loading || (starting && !requestedSite) ? (
           <LoadingStatus label={starting ? "client.launch.starting" : "common.loading"} />
-        ) : error ? (
+        ) : error?.kind === "load" ? (
           <div className="lr-client-launch-panel">
             <Pill
               icon="alert"
               tone="bad"
-              label={t(error.kind === "load" ? "client.launch.loadFailed" : "client.launch.error")}
+              label={t("client.launch.loadFailed")}
               alert
               comic="signal-failed"
             />
-            {error.kind === "launch" ? <>
-              {error.detail && <p className="lr-client-launch-detail">{error.detail}</p>}
-              <p className={vis ? "visually-hidden" : "lr-client-launch-status"}>{t("client.launch.reopen")}</p>
-            </> : <Btn
+            <Btn
               icon="refresh"
               title="common.refresh"
               cap="common.refresh"
               hint="page-refresh"
               onClick={() => window.location.reload()}
-            />}
+            />
           </div>
         ) : requestedSite ? (
           <section className="lr-client-approval">
@@ -267,6 +264,11 @@ export function AppLauncherPage() {
         ) : (
           <LauncherForm
             version={version}
+            roomError={error?.kind === "launch" ? <>
+              <Pill icon="alert" tone="bad" label={t("client.launch.error")} alert comic="signal-failed" />
+              {error.detail && <p className="lr-client-launch-detail">{error.detail}</p>}
+              <p className={vis ? "visually-hidden" : "lr-client-launch-status"}>{t("client.launch.reopen")}</p>
+            </> : undefined}
             mode={mode}
             site={site}
             localAccessPassword={localAccessPassword}
diff --git a/src/client/styles.css b/src/client/styles.css
index b2c1d9880..490c5b5d0 100644
--- a/src/client/styles.css
+++ b/src/client/styles.css
@@ -1212,6 +1212,8 @@ html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #334
 }
 .lr-input:is(.lr-quality-number, .lr-video-size):hover:not(:has(:disabled)) { border-color: var(--ink); background: var(--control-hover); }
 .lr-input:is(.lr-quality-number, .lr-video-size):has(:disabled) { opacity: .55; }
+.lr-input:is(.lr-quality-number, .lr-video-size):has([aria-invalid="true"]) { border-color: var(--danger); }
+.lr-quality-validation { color: var(--danger); font-size: 12px; line-height: 1.5; }
 .lr-input.lr-quality-number { width: 110px; gap: 6px; }
 .lr-quality-number input, .lr-video-size input { font-size: 13px; font-weight: 650; appearance: textfield; }
 .lr-quality-number input { text-align: right; }
diff --git a/tests/quality-controls.test.ts b/tests/quality-controls.test.ts
index fa4a679fa..9234b3eac 100644
--- a/tests/quality-controls.test.ts
+++ b/tests/quality-controls.test.ts
@@ -26,8 +26,10 @@ function editor() {
   const inside = {};
   const container = { contains: (node: unknown) => node === inside };
   const onChange = vi.fn();
+  const setInvalid = vi.fn();
   const render = runInNewContext(executable, {
     exports: {}, require: () => jsxRuntime, useRef: () => ({ current: input }), Number,
+    useState: () => [false, setInvalid], useId: () => "validation", useCopy: () => ({ t: vi.fn() }),
   });
   let choose!: (next: number) => void;
   let key!: (event: unknown) => void;
@@ -42,7 +44,7 @@ function editor() {
   const blur = (relatedTarget: unknown = null) => result.props.onBlur({ currentTarget: container, relatedTarget });
   const press = (value: string) => key({ key: value, currentTarget: { blur: () => blur() },
     preventDefault() {}, stopPropagation() {} });
-  return { input, inside, onChange, choose, blur, press };
+  return { input, inside, onChange, choose, blur, press, setInvalid };
 }
 
 describe("Numeric quality editing group", () => {
@@ -126,12 +128,16 @@ describe("Numeric quality editing group", () => {
     if (key === "Escape") expect(current.input.value).toBe("128");
   });
 
-  it.each(["", "321"])("restores an empty or invalid draft (%s) without applying it", value => {
+  it.each(["", "321"])("marks an invalid draft (%s) without losing or applying it", value => {
     const current = editor();
     current.input.value = value;
     current.input.validity.valid = value === "";
     current.blur();
-    expect(current.input.value).toBe("128");
+    expect(current.input.value).toBe(value);
+    expect(current.setInvalid).toHaveBeenLastCalledWith(true);
     expect(current.onChange).not.toHaveBeenCalled();
+    current.choose(128);
+    expect(current.input.value).toBe("128");
+    expect(current.setInvalid).toHaveBeenLastCalledWith(false);
   });
 });

From ecb47b1adfc16f6afbe54e15812b0d4d5a76afbe Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 00:23:38 +0800
Subject: [PATCH 221/262] test(network): observe sustained recovery after
 address changes

---
 docs/research/network-lab.md                  |  8 ++-
 docs/todo.md                                  |  6 +++
 internal/app/app.go                           | 53 ++++++++-----------
 scripts/network-lab.ts                        | 34 ++++++++----
 scripts/network-lab/endpoint.ts               |  6 ++-
 scripts/network-lab/verify.ts                 |  1 +
 .../components/living/QualityPresets.tsx      |  4 +-
 src/client/styles.css                         |  2 +-
 tests/quality-controls.test.ts                |  1 +
 9 files changed, 70 insertions(+), 45 deletions(-)

diff --git a/docs/research/network-lab.md b/docs/research/network-lab.md
index 8245ea861..1067aa8f7 100644
--- a/docs/research/network-lab.md
+++ b/docs/research/network-lab.md
@@ -110,7 +110,7 @@ reports trial/failure counts and nearest-rank timing summaries for validated
 media trials; unavailable and timed-out attempts never become zero-millisecond
 successes. Small trial counts are observations, not population estimates.
 `--verify` (CI `network_lab: verify`) runs negative controls against the actual
-runner: missing fault, frozen picture, partially failed setup, and cancellation
+runner: missing fault, frozen picture (before and after an impairment), partially failed setup, and cancellation
 during calibration or sharing. Each must fail for its intended reason and leave
 no owned resources; an unrelated process failure is not a passing control.
 Each fault phase replaces its owned qdisc completely: netem's in-place change
@@ -174,7 +174,11 @@ both initial and recovered media windows; a Browser WAN fallback cannot validate
 Native recovery. Rate calibration requires offered traffic above the configured
 ceiling, so a slow test process cannot impersonate a constrained network.
 Recovery timing begins when the impairment is removed, including subsequent
-calibration and sampling time. `firstPictureMs` starts at Viewer navigation and
+calibration and sampling time. Recovery requires a new advancing-picture sample
+followed by a full three-second audio/video continuity window and the current
+Native path where applicable. A buffered burst followed by another stall keeps
+the original 60-second observation deadline; it is not a successful recovery.
+`firstPictureMs` starts at Viewer navigation and
 ends at the first sample with at least 15 decoded frames; sampling is every
 500 ms. Recovery checks poll every second. These are sampled media-admission
 times, not exact first-packet timestamps or one-way media latency.
diff --git a/docs/todo.md b/docs/todo.md
index b6483960b..afc3f6d19 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -10,6 +10,12 @@ Git/PRs own completed history.
 
 ## Now
 
+- [ ] **Mixed-endpoint address-change recovery.** The expanded process laboratory
+  observed a brief picture burst followed by a stall on Browser Host/App Viewer
+  after changing the Host's public UDP address. Observe the full bounded recovery
+  window with Native diagnostics before assigning a product cause; retain audio,
+  advancing-picture, current-path and cleanup assertions.
+
 - [ ] **Intermittent RTP clock-check timeout.** Linux CI intermittently times out
   waiting for the second packet in the existing timestamp/generation checks.
   Local repetitions and explicit source pauses did not reproduce the timeout.
diff --git a/internal/app/app.go b/internal/app/app.go
index 6072011b9..c7c228bf3 100644
--- a/internal/app/app.go
+++ b/internal/app/app.go
@@ -307,23 +307,24 @@ func runLauncher(
 	}
 	// An interactive room is a child of the resident App. Its failure must not
 	// retire an unrelated Site's native sessions or its approval page. Explicit
-	// CLI launches still return their outcome to the caller. Register this before
-	// the runtime join so its cleanup and error are complete before we wait.
-	defer func() {
-		if directRoom || returnedErr == nil || ctx.Err() != nil {
-			return
+	// CLI launches still return their outcome to the caller. Call only after the
+	// room has retired, so neither approval nor process exit depends on its work.
+	finishRoom := func(roomErr error) error {
+		if directRoom || roomErr == nil || ctx.Err() != nil {
+			return roomErr
 		}
-		launch.SetResult("", returnedErr)
-		options.console.show(consoleView{state: "setup", entry: launch.URL(), problem: diagnostics.SafeText(returnedErr.Error())})
-		slog.Debug("piik-client", "event", "local-room-stopped", diagnostics.Error(returnedErr))
+		launch.SetResult("", roomErr)
+		options.console.show(consoleView{state: "setup", entry: launch.URL(), problem: diagnostics.SafeText(roomErr.Error())})
+		slog.Debug("piik-client", "event", "local-room-stopped", diagnostics.Error(roomErr))
 		select {
 		case <-ctx.Done():
 		case err := <-control.Done():
-			returnedErr = errors.Join(returnedErr, err)
+			roomErr = errors.Join(roomErr, err)
 		case err := <-launch.Done():
-			returnedErr = errors.Join(returnedErr, err)
+			roomErr = errors.Join(roomErr, err)
 		}
-	}()
+		return roomErr
+	}
 
 	var selection launcher.Selection
 	if directRoom {
@@ -363,10 +364,10 @@ func runLauncher(
 	})
 	if err != nil {
 		err = fmt.Errorf("Piik App configuration could not be saved: %w", err)
-		return err
+		return finishRoom(err)
 	}
 	if err = configureDiagnostics(&options, selectedConfig); err != nil {
-		return err
+		return finishRoom(err)
 	}
 	if !directRoom {
 		options.DisableBrowser = true
@@ -386,30 +387,22 @@ func runLauncher(
 		runtimeErr = runLocal(runtimeContext, options, selectedConfig, control)
 		close(runtimeDone)
 	}()
-	defer func() {
-		cancelRuntime()
-		<-runtimeDone
-		returnedErr = errors.Join(returnedErr, runtimeErr)
-	}()
-
+	var exitErr error
 	select {
 	case target := <-ready:
 		launch.SetResult(target, nil)
+		select {
+		case <-runtimeDone:
+		case exitErr = <-launch.Done():
+		case <-ctx.Done():
+		}
 	case <-runtimeDone:
-		return nil
 	case <-ctx.Done():
 		launch.SetResult("", ctx.Err())
-		return nil
-	}
-
-	select {
-	case <-runtimeDone:
-		return nil
-	case err = <-launch.Done():
-		return err
-	case <-ctx.Done():
-		return nil
 	}
+	cancelRuntime()
+	<-runtimeDone
+	return finishRoom(errors.Join(exitErr, runtimeErr))
 }
 
 func applyMode(config appconfig.Config, options Options) (appconfig.Config, error) {
diff --git a/scripts/network-lab.ts b/scripts/network-lab.ts
index ae63ec550..97c29df29 100644
--- a/scripts/network-lab.ts
+++ b/scripts/network-lab.ts
@@ -227,6 +227,7 @@ async function runCase(scenario: Scenario, seed: number, prediction: boolean, ou
           if (!await endpoints[0]!.call("signal-probe")) throw new Error("UDP address change interrupted TCP signaling");
         }
         const restoredAt = performance.now();
+        if (values.negative === "frozen-recovery") await endpoints[0]!.call("freeze-picture");
         setFault("none");
         result.restoredCounters = counters();
         const restoredProbe = await endpoints[faultIndex]!.call<ProbeResult>("probe");
@@ -235,21 +236,36 @@ async function runCase(scenario: Scenario, seed: number, prediction: boolean, ou
         if (scenario.remap && restoredProbe.mappings.some(mapping => mapping.address !== network.publicIP(faultIndex))) throw new Error("UDP mappings retained the old public address");
         stage("recovery");
         let recovered = false;
+        let recoveryError = "Media did not resume";
+        let recoveryFirst: MediaSample | undefined, recoveryStart = 0;
         while (performance.now() - restoredAt < 60_000) {
           signal.throwIfAborted();
           const previous = samples.at(-1)!.viewer;
           await delay(1000, undefined, { signal });
           const { viewer } = await sampleAll();
-          if (hasPicture(viewer) && viewer.frames > previous.frames) { recovered = true; break; }
+          if (!recoveryFirst) {
+            if (hasPicture(viewer) && viewer.frames > previous.frames) {
+              recoveryFirst = viewer; recoveryStart = Date.now();
+            }
+            continue;
+          }
+          if (Date.now() - recoveryStart < 3000) continue;
+          try {
+            if (!hasPicture(viewer)) throw new Error("No decoded picture after restoration");
+            checkContinuity(recoveryFirst, viewer);
+            checkAppPaths();
+            recovered = true;
+            break;
+          } catch (error) {
+            recoveryError = error instanceof Error ? error.message : String(error);
+            // A buffered burst is not recovery. Keep the original deadline and
+            // require a complete media window, including Native path ownership.
+            recoveryFirst = undefined;
+          }
         }
         result.recoveryMs = recovered ? performance.now() - restoredAt : null;
-        if (!recovered) throw new Error("Media did not resume within the recovery observation window");
-        const recoveredFirst = samples.at(-1)!.viewer, recoveredStart = Date.now();
-        await delay(3000, undefined, { signal });
-        const { viewer: recoveredNext } = await sampleAll();
-        checkContinuity(recoveredFirst, recoveredNext);
-        checkAppPaths();
-        mediaWindows.push({ name: "recovered", startMs: recoveredStart, endMs: Date.now(), addresses: addresses() });
+        if (!recovered) throw new Error(`Recovery observation expired: ${recoveryError}`);
+        mediaWindows.push({ name: "recovered", startMs: recoveryStart, endMs: Date.now(), addresses: addresses() });
         if (scenario.fault === "signaling" && !await endpoints[0]!.call("signal-probe")) throw new Error("Signaling roundtrip did not recover");
       }
     }
@@ -315,7 +331,7 @@ async function main(): Promise<void> {
   if (values.list) { process.stdout.write(JSON.stringify(selected, null, 2) + "\n"); return; }
   if (process.platform !== "linux" || process.getuid?.() !== 0) throw new Error("Network lab requires an isolated Linux runner and root for owned namespaces");
   if (!process.env.CHROME_PATH) throw new Error("CHROME_PATH is required");
-  if (values.negative && !["missing-fault", "frozen-picture", "partial-setup"].includes(values.negative)) throw new Error("Unknown negative control");
+  if (values.negative && !["missing-fault", "frozen-picture", "frozen-recovery", "partial-setup"].includes(values.negative)) throw new Error("Unknown negative control");
   const repeat = Number(values.repeat), seed = Number(values.seed);
   if (!Number.isInteger(repeat) || repeat < 1 || repeat > 20 || !Number.isInteger(seed) || seed < 1 || seed + repeat - 1 > 0xffff_ffff) throw new Error("Invalid repeat (1..20) or seed (uint32)");
   if (!["on", "off", "compare"].includes(values.prediction!)) throw new Error("Prediction must be on, off or compare");
diff --git a/scripts/network-lab/endpoint.ts b/scripts/network-lab/endpoint.ts
index 3224e401c..02e5e2dc4 100644
--- a/scripts/network-lab/endpoint.ts
+++ b/scripts/network-lab/endpoint.ts
@@ -1,6 +1,6 @@
 import { spawn, type ChildProcessWithoutNullStreams } from "node:child_process";
 import { once } from "node:events";
-import { writeFile } from "node:fs/promises";
+import { readFile, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { CdpConnection, cleanupRun, createPage, evaluate, fetchJsonBefore, launchChrome, reservePort, waitForSample,
@@ -51,7 +51,7 @@ export async function endpointWorker(): Promise<void> {
           await waitForSample(deadline => fetchJsonBefore<{ status: string }>(`${origin}/healthz`, deadline),
             value => value.status === "ok", 10_000);
           if (request.app) {
-            app = spawn(resolve("build/network-lab/bin/piik-app"), ["--site", origin, "--config", join(profile, "app.json")],
+            app = spawn(resolve("build/network-lab/bin/piik-app"), ["--site", origin, "--debug", "--config", join(profile, "app.json")],
               { stdio: "pipe", env: { ...process.env, PIIK_CLIENT_GATE_NO_BROWSER: "true", PIIK_LOG_DIR: join(profile, "logs") } });
             app.stderr.on("data", data => log("app", data));
             await once(app, "spawn");
@@ -101,6 +101,8 @@ export async function endpointWorker(): Promise<void> {
         } else if (request.action === "signal-probe") {
           result = await evaluate(cdp!, page!, "networkLab.signalProbe()", Date.now() + 5000);
         } else if (request.action === "logs") {
+          if (app) logs.app = await readFile(join(profile, "logs", "client.log"), "utf8")
+            .then(text => text.slice(-64_000), error => String(error));
           result = logs;
         } else if (request.action === "stop") {
           await click('button[aria-label="Stop sharing"]'); result = true;
diff --git a/scripts/network-lab/verify.ts b/scripts/network-lab/verify.ts
index 72eeb3ae1..187e8e6a3 100644
--- a/scripts/network-lab/verify.ts
+++ b/scripts/network-lab/verify.ts
@@ -13,6 +13,7 @@ export async function verifyLaboratory(entry: string): Promise<void> {
     { name: "partial-setup", cases: "browser-browser", error: /^Injected partial network setup failure$/ },
     { name: "missing-fault", cases: "stun-backup", error: /^No packets hit the stun-primary rule;/, media: true },
     { name: "frozen-picture", cases: "browser-browser", error: /^(Decoded video did not continue|Rendered synthetic picture did not change)$/, media: true },
+    { name: "frozen-recovery", cases: "bandwidth-recovery", error: /^Recovery observation expired: (Media did not resume|Decoded video did not continue|Rendered synthetic picture did not change|No decoded picture after restoration)$/, media: true },
     { name: "cancel-calibration", cases: "browser-browser,app-app", cancelAt: "calibration" },
     { name: "cancel-sharing", cases: "browser-browser,app-app", cancelAt: "continuity" },
   ];
diff --git a/src/client/components/living/QualityPresets.tsx b/src/client/components/living/QualityPresets.tsx
index 5609c5b03..f6fdcbe92 100644
--- a/src/client/components/living/QualityPresets.tsx
+++ b/src/client/components/living/QualityPresets.tsx
@@ -1,4 +1,4 @@
-import { Fragment, useId, useRef, useState, type CSSProperties, type ReactNode } from "react";
+import { Fragment, useEffect, useId, useRef, useState, type CSSProperties, type ReactNode } from "react";
 import { MIN_AUDIO_BITRATE } from "../../../shared/protocol";
 import {
   QUALITY_PROFILES, QUALITY_PROFILE_KEYS, QUALITY_RESOLUTIONS, DEGRADATION_PREFERENCE_KEYS, qualityResolutionEqual,
@@ -54,6 +54,7 @@ export function ResolutionControl({ value, limits, disabled, onChange }: {
   const controls = useRef<HTMLDivElement>(null);
   const [invalid, setInvalid] = useState(false);
   const errorId = useId();
+  useEffect(() => setInvalid(false), [value.width, value.height]);
   const axes = ["width", "height"] as const;
   const reset = (container: HTMLElement) => {
     setInvalid(false);
@@ -145,6 +146,7 @@ function QualityNumberControl({ value, min, max, step, unit, name, label, disabl
   const [invalid, setInvalid] = useState(false);
   const errorId = useId();
   const input = useRef<HTMLInputElement>(null);
+  useEffect(() => setInvalid(false), [value, min, max, step]);
   const reset = () => { input.current!.value = String(value); setInvalid(false); };
   const select = (next: number) => {
     // A preset or slider replaces the draft, including a choice of the current value.
diff --git a/src/client/styles.css b/src/client/styles.css
index 490c5b5d0..fe779b3f3 100644
--- a/src/client/styles.css
+++ b/src/client/styles.css
@@ -1213,7 +1213,7 @@ html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #334
 .lr-input:is(.lr-quality-number, .lr-video-size):hover:not(:has(:disabled)) { border-color: var(--ink); background: var(--control-hover); }
 .lr-input:is(.lr-quality-number, .lr-video-size):has(:disabled) { opacity: .55; }
 .lr-input:is(.lr-quality-number, .lr-video-size):has([aria-invalid="true"]) { border-color: var(--danger); }
-.lr-quality-validation { color: var(--danger); font-size: 12px; line-height: 1.5; }
+.lr-quality-validation { color: color-mix(in srgb, var(--danger) 70%, var(--ink)); font-size: 12px; line-height: 1.5; }
 .lr-input.lr-quality-number { width: 110px; gap: 6px; }
 .lr-quality-number input, .lr-video-size input { font-size: 13px; font-weight: 650; appearance: textfield; }
 .lr-quality-number input { text-align: right; }
diff --git a/tests/quality-controls.test.ts b/tests/quality-controls.test.ts
index 9234b3eac..d817a3da1 100644
--- a/tests/quality-controls.test.ts
+++ b/tests/quality-controls.test.ts
@@ -30,6 +30,7 @@ function editor() {
   const render = runInNewContext(executable, {
     exports: {}, require: () => jsxRuntime, useRef: () => ({ current: input }), Number,
     useState: () => [false, setInvalid], useId: () => "validation", useCopy: () => ({ t: vi.fn() }),
+    useEffect: (effect: () => void) => effect(),
   });
   let choose!: (next: number) => void;
   let key!: (event: unknown) => void;

From c2be2f06e3c88a5b17159803b657aae7c176d479 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 00:48:41 +0800
Subject: [PATCH 222/262] fix(media): preserve negotiated video retransmission

---
 docs/todo.md                            |   9 +-
 internal/app/mediaedge/engine.go        |  14 ++-
 internal/app/mediaedge/receiver.go      |  18 +++-
 internal/app/mediaedge/receiver_test.go | 109 ++++++++++++++++++++++++
 4 files changed, 143 insertions(+), 7 deletions(-)

diff --git a/docs/todo.md b/docs/todo.md
index afc3f6d19..91d404872 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -11,10 +11,11 @@ Git/PRs own completed history.
 ## Now
 
 - [ ] **Mixed-endpoint address-change recovery.** The expanded process laboratory
-  observed a brief picture burst followed by a stall on Browser Host/App Viewer
-  after changing the Host's public UDP address. Observe the full bounded recovery
-  window with Native diagnostics before assigning a product cause; retain audio,
-  advancing-picture, current-path and cleanup assertions.
+  recovers all four endpoint pairs, but Browser Host/App Viewer took 13..32 seconds
+  and the slow trial repeatedly retransmitted old primary packets. The Native
+  receiver omitted standard RTX registration and codec selection. Verify its
+  repair with the same process cases before claiming a recovery-time improvement;
+  retain audio, advancing-picture, current-path and cleanup assertions.
 
 - [ ] **Intermittent RTP clock-check timeout.** Linux CI intermittently times out
   waiting for the second packet in the existing timestamp/generation checks.
diff --git a/internal/app/mediaedge/engine.go b/internal/app/mediaedge/engine.go
index b71d3cfd8..390f3badb 100644
--- a/internal/app/mediaedge/engine.go
+++ b/internal/app/mediaedge/engine.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"net"
+	"strconv"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -84,7 +85,18 @@ func NewEngine(options EngineOptions) (*Engine, error) {
 
 	mediaEngine := &webrtc.MediaEngine{}
 	for _, codec := range []string{"h264", "vp8"} {
-		if err := mediaEngine.RegisterCodec(videoCodecs[codec], webrtc.RTPCodecTypeVideo); err != nil {
+		primary := videoCodecs[codec]
+		if err := mediaEngine.RegisterCodec(primary, webrtc.RTPCodecTypeVideo); err != nil {
+			return nil, err
+		}
+		// Keep the standard repair stream paired with its media codec. Reusing
+		// old primary sequence numbers cannot repair packets outside SRTP's
+		// replay window after a network outage (RFC 4588).
+		if err := mediaEngine.RegisterCodec(webrtc.RTPCodecParameters{
+			RTPCodecCapability: webrtc.RTPCodecCapability{MimeType: webrtc.MimeTypeRTX,
+				ClockRate: videoClockRate, SDPFmtpLine: "apt=" + strconv.Itoa(int(primary.PayloadType))},
+			PayloadType: primary.PayloadType + 1,
+		}, webrtc.RTPCodecTypeVideo); err != nil {
 			return nil, err
 		}
 	}
diff --git a/internal/app/mediaedge/receiver.go b/internal/app/mediaedge/receiver.go
index 996a9cc99..65a361696 100644
--- a/internal/app/mediaedge/receiver.go
+++ b/internal/app/mediaedge/receiver.go
@@ -454,7 +454,8 @@ func selectReceiverVideoCodec(connection *webrtc.PeerConnection) (string, error)
 		}
 		// Pion may fall back to a MIME-only match. Encoded fanout cannot advertise
 		// Constrained Baseline downstream after accepting a different profile.
-		for _, parameters := range transceiver.Receiver().GetParameters().Codecs {
+		negotiated := transceiver.Receiver().GetParameters().Codecs
+		for _, parameters := range negotiated {
 			name := strings.TrimPrefix(strings.ToLower(parameters.MimeType), "video/")
 			if _, supported := videoCodecs[name]; !supported {
 				continue
@@ -462,7 +463,20 @@ func selectReceiverVideoCodec(connection *webrtc.PeerConnection) (string, error)
 			if name == "h264" && !forwardableH264(parameters.SDPFmtpLine) {
 				continue
 			}
-			if err := transceiver.SetCodecPreferences([]webrtc.RTPCodecParameters{parameters}); err != nil {
+			preferences := []webrtc.RTPCodecParameters{parameters}
+			for _, repair := range negotiated {
+				if !strings.EqualFold(repair.MimeType, webrtc.MimeTypeRTX) {
+					continue
+				}
+				for _, field := range strings.Split(repair.SDPFmtpLine, ";") {
+					key, value, _ := strings.Cut(strings.TrimSpace(field), "=")
+					if key == "apt" && strings.TrimSpace(value) == strconv.Itoa(int(parameters.PayloadType)) {
+						preferences = append(preferences, repair)
+						break
+					}
+				}
+			}
+			if err := transceiver.SetCodecPreferences(preferences); err != nil {
 				return "", err
 			}
 			return name, nil
diff --git a/internal/app/mediaedge/receiver_test.go b/internal/app/mediaedge/receiver_test.go
index e5bc82613..3ca8ae47a 100644
--- a/internal/app/mediaedge/receiver_test.go
+++ b/internal/app/mediaedge/receiver_test.go
@@ -3,6 +3,7 @@ package mediaedge
 import (
 	"fmt"
 	"net"
+	"strconv"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -124,6 +125,114 @@ func TestReceiverAdvertisesLocalStereoPreference(t *testing.T) {
 	}
 }
 
+func TestReceiverRetainsRepairForOnlyTheSelectedCodec(t *testing.T) {
+	for _, name := range []string{"vp8", "h264"} {
+		t.Run(name, func(t *testing.T) {
+			engine, err := NewEngine(EngineOptions{BindAddress: "127.0.0.1:0", IncludeLoopback: true})
+			if err != nil {
+				t.Fatal(err)
+			}
+			t.Cleanup(func() { _ = engine.Close() })
+			// An independent stock peer offers its normal primary/RTX pairs.
+			upstream, err := webrtc.NewPeerConnection(webrtc.Configuration{})
+			if err != nil {
+				t.Fatal(err)
+			}
+			t.Cleanup(func() { _ = upstream.Close() })
+			transceiver, err := upstream.AddTransceiverFromKind(webrtc.RTPCodecTypeVideo,
+				webrtc.RTPTransceiverInit{Direction: webrtc.RTPTransceiverDirectionSendonly})
+			if err != nil {
+				t.Fatal(err)
+			}
+			var preferences []webrtc.RTPCodecParameters
+			for _, codec := range transceiver.Sender().GetParameters().Codecs {
+				if strings.EqualFold(codec.MimeType, "video/"+name) &&
+					(name == "vp8" || strings.Contains(codec.SDPFmtpLine, "profile-level-id=42e01f") &&
+						strings.Contains(codec.SDPFmtpLine, "packetization-mode=1")) || codec.MimeType == webrtc.MimeTypeRTX {
+					preferences = append(preferences, codec)
+				}
+			}
+			if err = transceiver.SetCodecPreferences(preferences); err != nil {
+				t.Fatal(err)
+			}
+			for _, codec := range preferences {
+				if !strings.EqualFold(codec.MimeType, "video/"+name) {
+					continue
+				}
+				track, createErr := webrtc.NewTrackLocalStaticRTP(codec.RTPCodecCapability, "video", "upstream")
+				if createErr != nil {
+					t.Fatal(createErr)
+				}
+				if err = transceiver.Sender().ReplaceTrack(track); err != nil {
+					t.Fatal(err)
+				}
+				break
+			}
+			offer, err := upstream.CreateOffer(nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if err = upstream.SetLocalDescription(offer); err != nil {
+				t.Fatal(err)
+			}
+			receiver, answer, err := engine.NewReceiver(ReceiverOptions{Offer: offer, EdgeCapacity: 1})
+			if err != nil {
+				t.Fatal(err)
+			}
+			t.Cleanup(func() { _ = receiver.Close() })
+			for attempt := 0; attempt < 2; attempt++ {
+				var description sdp.SessionDescription
+				if err = description.UnmarshalString(answer.SDP); err != nil {
+					t.Fatal(err)
+				}
+				var codecs []sdp.Codec
+				all := description.GetCodecMap()
+				for _, media := range description.MediaDescriptions {
+					for _, payload := range media.MediaName.Formats {
+						id, _ := strconv.Atoi(payload)
+						codecs = append(codecs, all[uint8(id)])
+					}
+				}
+				if len(codecs) != 2 || receiver.Codec() != name {
+					t.Fatalf("answer must retain one %s primary and its repair codec: %v", name, codecs)
+				}
+				for _, codec := range codecs {
+					if strings.EqualFold(codec.Name, "rtx") {
+						continue
+					}
+					if !strings.EqualFold(codec.Name, receiver.Codec()) {
+						t.Fatalf("unexpected primary codec: %v", codec)
+					}
+					found := false
+					for _, repair := range codecs {
+						found = found || (strings.EqualFold(repair.Name, "rtx") && repair.Fmtp == fmt.Sprintf("apt=%d", codec.PayloadType))
+					}
+					if !found {
+						t.Fatal("answer retained repair for a different primary")
+					}
+				}
+				if err = upstream.SetRemoteDescription(answer); err != nil {
+					t.Fatal(err)
+				}
+				if attempt == 0 {
+					offer, err = upstream.CreateOffer(&webrtc.OfferOptions{ICERestart: true})
+					if err != nil {
+						t.Fatal(err)
+					}
+					if err = upstream.SetLocalDescription(offer); err != nil {
+						t.Fatal(err)
+					}
+					var reused bool
+					answer, reused, err = receiver.Renegotiate(offer, nil)
+					if err != nil || !reused {
+						t.Fatalf("restart replaced or failed the receiver: %v", err)
+					}
+				}
+			}
+		})
+	}
+}
+
 func TestReceiverCodecMatchesTheSingleNegotiatedAnswer(t *testing.T) {
 	for _, preferVP8 := range []bool{false, true} {
 		engine, err := NewEngine(EngineOptions{BindAddress: "127.0.0.1:0", IncludeLoopback: true})

From 2c6dd65eb07f2fb0aa1629c01dd8d4359af7c5d1 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 01:07:02 +0800
Subject: [PATCH 223/262] fix(media): retain repair streams across receiver
 paths

---
 docs/research/network-lab.md        | 17 +++++++++++++++--
 docs/standards/media-quality.md     |  4 ++++
 docs/todo.md                        | 11 +++++------
 internal/app/mediaedge/receiver.go  | 16 ++--------------
 internal/media/forwarding/codecs.go | 27 +++++++++++++++++++++++++++
 internal/server/sfu/media.go        |  2 +-
 internal/server/sfu/media_test.go   |  6 ++++++
 scripts/network-lab.ts              |  2 +-
 scripts/network-lab/scenarios.ts    |  2 ++
 9 files changed, 63 insertions(+), 24 deletions(-)
 create mode 100644 internal/media/forwarding/codecs.go

diff --git a/docs/research/network-lab.md b/docs/research/network-lab.md
index 1067aa8f7..98201cb5c 100644
--- a/docs/research/network-lab.md
+++ b/docs/research/network-lab.md
@@ -144,6 +144,19 @@ Browser/Browser and App/Browser exhausted their routes with either setting in
 this profile. This establishes one complete product path through sequential
 kernel NAT, not a field success rate or general benefit for Browser participants.
 
+The [mixed-endpoint recovery comparison](https://github.com/TNTcraftHIM/Piik/actions/runs/38433591403)
+passed eighteen trials: three address-change runs per endpoint pair and three
+ordinary Browser/App and App/App connections each. Browser/App recovery took
+about 4.9 seconds, including the three-second continuity window, compared with
+13..32 seconds [before the repair](https://github.com/TNTcraftHIM/Piik/actions/runs/38430143831).
+The Native receiver had removed RTX during codec selection. Packet captures
+showed repeated old primary packets before the fix and negotiated RTX without
+repeated primary sequence numbers afterward. Pion's existing
+[RFC 4588](https://www.rfc-editor.org/rfc/rfc4588) repair handles reception;
+no new recovery timer or relaxed replay check was added. The other endpoint pairs
+retained their prior recovery range. These controlled observations establish a
+media-recovery repair, not a change in NAT reachability or Internet success rate.
+
 App Host checks must use the real H264 Browser-to-App ingress and App WAN sender;
 launching an App alongside a Browser-only VP8 share is not an App-path test.
 
@@ -153,8 +166,8 @@ address before sharing. Preserve, random and sequential SNAT describe observed
 mapping, not every consumer NAT implementation. Sequential cases use nftables'
 number generator and a typed port map: new UDP flows advance through ports
 40000..44095, with the same destination-dependent filter. Calibration must
-observe three consecutive mappings before Piik starts. App/App, Browser/Browser
-and App/Browser cases compare the existing enhancement switch; this switch also
+observe three consecutive mappings before Piik starts. All four endpoint pairs
+compare the existing enhancement switch; this switch also
 changes the retry budget, so aggregate differences do not isolate one mechanism.
 The recorded Native preparation and adoption results distinguish its use from
 ordinary ICE. Address-change cases replace only the isolated router's UDP public
diff --git a/docs/standards/media-quality.md b/docs/standards/media-quality.md
index 4f6a0212a..f1e24c9ff 100644
--- a/docs/standards/media-quality.md
+++ b/docs/standards/media-quality.md
@@ -219,6 +219,10 @@ its resources even when a Browser operation remains pending. The result stays
 fixed for the current share and is reconsidered for a new share.
 ADR-0007 owns probe and negotiation mechanics.
 
+Codec selection preserves the negotiated repair stream associated with the
+selected primary codec. Native and SFU receivers use standard Pion RTX/NACK;
+codec restrictions must not strip recovery or disable SRTP replay protection.
+
 The Browser chooses the concrete encoder implementation. A reported H.264 codec
 does not by itself prove hardware acceleration, and Web content cannot select a
 specific MFT, NVENC, AMF, or QSV implementation.
diff --git a/docs/todo.md b/docs/todo.md
index 91d404872..c6fb17c7a 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -10,12 +10,11 @@ Git/PRs own completed history.
 
 ## Now
 
-- [ ] **Mixed-endpoint address-change recovery.** The expanded process laboratory
-  recovers all four endpoint pairs, but Browser Host/App Viewer took 13..32 seconds
-  and the slow trial repeatedly retransmitted old primary packets. The Native
-  receiver omitted standard RTX registration and codec selection. Verify its
-  repair with the same process cases before claiming a recovery-time improvement;
-  retain audio, advancing-picture, current-path and cleanup assertions.
+- [ ] **Shared receiver repair acceptance.** Native address-change recovery now
+  retains standard RTX and passes the repeated process comparison. The sibling
+  SFU receiver also stripped RTX when selecting its primary codec; verify the
+  shared selection correction through SFU publication, media outage and cleanup
+  before closing this item.
 
 - [ ] **Intermittent RTP clock-check timeout.** Linux CI intermittently times out
   waiting for the second packet in the existing timestamp/generation checks.
diff --git a/internal/app/mediaedge/receiver.go b/internal/app/mediaedge/receiver.go
index 65a361696..0a10b2d0d 100644
--- a/internal/app/mediaedge/receiver.go
+++ b/internal/app/mediaedge/receiver.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/TNTcraftHIM/Piik/internal/app/nativeaudio"
 	"github.com/TNTcraftHIM/Piik/internal/app/nativecapture"
+	"github.com/TNTcraftHIM/Piik/internal/media/forwarding"
 	"github.com/pion/rtcp"
 	"github.com/pion/sdp/v3"
 	"github.com/pion/webrtc/v4"
@@ -463,20 +464,7 @@ func selectReceiverVideoCodec(connection *webrtc.PeerConnection) (string, error)
 			if name == "h264" && !forwardableH264(parameters.SDPFmtpLine) {
 				continue
 			}
-			preferences := []webrtc.RTPCodecParameters{parameters}
-			for _, repair := range negotiated {
-				if !strings.EqualFold(repair.MimeType, webrtc.MimeTypeRTX) {
-					continue
-				}
-				for _, field := range strings.Split(repair.SDPFmtpLine, ";") {
-					key, value, _ := strings.Cut(strings.TrimSpace(field), "=")
-					if key == "apt" && strings.TrimSpace(value) == strconv.Itoa(int(parameters.PayloadType)) {
-						preferences = append(preferences, repair)
-						break
-					}
-				}
-			}
-			if err := transceiver.SetCodecPreferences(preferences); err != nil {
+			if err := transceiver.SetCodecPreferences(forwarding.WithRTX(parameters, negotiated)); err != nil {
 				return "", err
 			}
 			return name, nil
diff --git a/internal/media/forwarding/codecs.go b/internal/media/forwarding/codecs.go
new file mode 100644
index 000000000..6dec44476
--- /dev/null
+++ b/internal/media/forwarding/codecs.go
@@ -0,0 +1,27 @@
+package forwarding
+
+import (
+	"strconv"
+	"strings"
+
+	"github.com/pion/webrtc/v4"
+)
+
+// WithRTX restricts a negotiated offer to one primary codec and its associated
+// repair stream. Selecting a media codec must not discard packet-loss recovery.
+func WithRTX(primary webrtc.RTPCodecParameters, negotiated []webrtc.RTPCodecParameters) []webrtc.RTPCodecParameters {
+	selected := []webrtc.RTPCodecParameters{primary}
+	for _, repair := range negotiated {
+		if !strings.EqualFold(repair.MimeType, webrtc.MimeTypeRTX) {
+			continue
+		}
+		for _, field := range strings.Split(repair.SDPFmtpLine, ";") {
+			key, value, _ := strings.Cut(strings.TrimSpace(field), "=")
+			if key == "apt" && strings.TrimSpace(value) == strconv.Itoa(int(primary.PayloadType)) {
+				selected = append(selected, repair)
+				break
+			}
+		}
+	}
+	return selected
+}
diff --git a/internal/server/sfu/media.go b/internal/server/sfu/media.go
index 4c9a6155a..d63bcb585 100644
--- a/internal/server/sfu/media.go
+++ b/internal/server/sfu/media.go
@@ -348,7 +348,7 @@ func (media *Media) AcceptPublisherOffer(fence ResourceFence, connectionID strin
 		if transceiver.Kind() == webrtc.RTPCodecTypeAudio {
 			selected[0].SDPFmtpLine = "minptime=10;useinbandfec=1;stereo=1;usedtx=0;maxaveragebitrate=" + strconv.Itoa(protocol.MaxAudioBitrate)
 		}
-		if err = transceiver.SetCodecPreferences(selected[:1]); err != nil {
+		if err = transceiver.SetCodecPreferences(forwarding.WithRTX(selected[0], parameters.Codecs)); err != nil {
 			return webrtc.SessionDescription{}, err
 		}
 	}
diff --git a/internal/server/sfu/media_test.go b/internal/server/sfu/media_test.go
index 9fb61e05c..9ad2c1c83 100644
--- a/internal/server/sfu/media_test.go
+++ b/internal/server/sfu/media_test.go
@@ -243,6 +243,12 @@ func runMediaFanout(t *testing.T, codec string, layerCount int) {
 		t.Fatal(ctx.Err())
 	}
 	check(publisher.SetRemoteDescription(*publication.pc.LocalDescription()))
+	parameters := publication.pc.GetTransceivers()[0].Receiver().GetParameters()
+	if len(parameters.Codecs) != 2 || parameters.Codecs[0].MimeType != capability.MimeType ||
+		parameters.Codecs[1].MimeType != webrtc.MimeTypeRTX ||
+		parameters.Codecs[1].SDPFmtpLine != fmt.Sprintf("apt=%d", parameters.Codecs[0].PayloadType) {
+		t.Fatalf("publisher lost its selected codec/repair pair: %v", parameters.Codecs)
+	}
 	mid := publisher.GetTransceivers()[0].Mid()
 	headerExtensions := videoSender.GetParameters().HeaderExtensions
 	stopSamples := make(chan struct{})
diff --git a/scripts/network-lab.ts b/scripts/network-lab.ts
index 97c29df29..7140eab75 100644
--- a/scripts/network-lab.ts
+++ b/scripts/network-lab.ts
@@ -143,7 +143,7 @@ async function runCase(scenario: Scenario, seed: number, prediction: boolean, ou
       cwd: output, stdio: "pipe", env: { ...labEnvironment(), PIIK_ENV: "development", ROOM_DATABASE_PATH: ":memory:",
         LISTEN_HOST: SITE_IP, PORT: "9000", PUBLIC_BASE_URL: SITE_ORIGIN, ALLOWED_ORIGINS: SITE_ORIGIN,
         STUN_URLS: `stun:${SITE_IP}:3478,stun:${SITE_IP}:3479,stun:${SITE_IP}:3480${scenario.ipv6 ? `,stun:[${SITE_IPV6}]:3478` : ""}`, STUN_LISTEN_HOST: SITE_IP,
-        NAT_PREDICTION_ENABLED: "true", ...(scenario.sfu ? { SFU_UDP_PORT: "7882", SFU_LISTEN_HOST: SITE_IP, SFU_PUBLIC_IP: SITE_IP } : {}) },
+        NAT_PREDICTION_ENABLED: "true", ...(scenario.sfu ? { SFU_UDP_PORT: "7882", SFU_LISTEN_HOST: SITE_IP, SFU_PUBLIC_IP: SITE_IP, SFU_ONLY: String(!!scenario.sfuOnly) } : {}) },
     });
     server.stdout.on("data", data => { serverLog = (serverLog + data).slice(-32_000); });
     server.stderr.on("data", data => { serverLog = (serverLog + data).slice(-32_000); });
diff --git a/scripts/network-lab/scenarios.ts b/scripts/network-lab/scenarios.ts
index 129f31aa9..802e27078 100644
--- a/scripts/network-lab/scenarios.ts
+++ b/scripts/network-lab/scenarios.ts
@@ -9,6 +9,7 @@ export interface Scenario {
   nat: readonly [NatMode, NatMode];
   fault: Fault;
   sfu: boolean;
+  sfuOnly?: boolean;
   expected: "media" | "unavailable" | "observed";
   enhancedExpected?: "media" | "unavailable";
   duringShare?: boolean;
@@ -62,6 +63,7 @@ export const scenarios: readonly Scenario[] = [
   { ...baseline, id: "lossy-browser", host: "browser", viewer: "browser", fault: "loss" },
   { ...baseline, id: "stun-backup", host: "browser", viewer: "browser", fault: "stun-primary" },
   { ...baseline, id: "sfu-fallback", host: "browser", viewer: "browser", fault: "peer-block", sfu: true },
+  { ...baseline, id: "sfu-outage", host: "browser", viewer: "browser", fault: "udp-block", sfu: true, sfuOnly: true, duringShare: true },
   { ...baseline, id: "blocked-media", host: "browser", viewer: "browser", fault: "udp-block", expected: "unavailable" },
   { ...baseline, id: "bandwidth-recovery", host: "browser", viewer: "browser", fault: "rate", duringShare: true },
   { ...baseline, id: "media-outage", host: "app", viewer: "app", fault: "udp-block", duringShare: true },

From 4de07bf9e264a315dcddadeb7860fa0416761f94 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 01:29:36 +0800
Subject: [PATCH 224/262] test(network): respect locked NAT controls in SFU
 scenarios

---
 docs/research/network-lab.md    | 10 +++++-----
 scripts/network-lab.ts          |  5 +++--
 scripts/network-lab/endpoint.ts |  9 ++++++---
 3 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/docs/research/network-lab.md b/docs/research/network-lab.md
index 98201cb5c..641f6ec86 100644
--- a/docs/research/network-lab.md
+++ b/docs/research/network-lab.md
@@ -133,15 +133,15 @@ order. All four ordinary App/App trials delivered media; all four random-mapping
 trials exhausted their routes. This validates comparison/reporting and establishes
 no enhancement gain for that random-mapping profile.
 
-The [sequential-mapping comparison](https://github.com/TNTcraftHIM/Piik/actions/runs/38332289068)
-passed twelve trials across two seeds. Both enhanced App/App trials delivered
-1280x720 video and audio after about 23.7 seconds; both disabled controls exhausted
+The [sequential-mapping comparison](https://github.com/TNTcraftHIM/Piik/actions/runs/38433597605)
+passed sixteen trials across two seeds and all four endpoint pairs. Both enhanced
+App/App trials delivered video and audio after about 23.6 seconds; both disabled controls exhausted
 their routes. Both Apps reported step-one observations, successful preparation
 and socket adoption for the same connection. Packet captures confirmed SRTP and
 reverse SRTCP on that tuple. The enhanced App/App case now requires media; its
 disabled control remains observational so an ordinary-ICE improvement can pass.
-Browser/Browser and App/Browser exhausted their routes with either setting in
-this profile. This establishes one complete product path through sequential
+Browser/Browser and both mixed directions exhausted their routes with either
+setting in this profile. This establishes one complete product path through sequential
 kernel NAT, not a field success rate or general benefit for Browser participants.
 
 The [mixed-endpoint recovery comparison](https://github.com/TNTcraftHIM/Piik/actions/runs/38433591403)
diff --git a/scripts/network-lab.ts b/scripts/network-lab.ts
index 7140eab75..e7b5e4628 100644
--- a/scripts/network-lab.ts
+++ b/scripts/network-lab.ts
@@ -160,7 +160,7 @@ async function runCase(scenario: Scenario, seed: number, prediction: boolean, ou
     } }, Date.now() + 5000);
     stage("share");
     await endpoints[0]!.call("navigate", { url: SITE_ORIGIN + (scenario.host === "app" ? "/#piik-client=1" : "/") });
-    const invitation = await endpoints[0]!.call<string>("share", { prediction });
+    const invitation = await endpoints[0]!.call<string>("share", { prediction, predictionLocked: scenario.sfuOnly === true });
     const joinedAt = performance.now();
     await endpoints[1]!.call("navigate", { url: invitation + (scenario.viewer === "app" ? "&piik-client=1" : "") });
     if (scenario.sibling) await endpoints[2]!.call("navigate", { url: invitation });
@@ -347,7 +347,8 @@ async function main(): Promise<void> {
   const interrupted = () => controller.abort(new Error("Laboratory run cancelled"));
   process.once("SIGINT", interrupted); process.once("SIGTERM", interrupted);
   for (let iteration = 0; iteration < repeat; iteration++) for (const scenario of selected) {
-    const variants = values.prediction === "compare" ? (iteration % 2 === 0 ? [false, true] : [true, false]) : [values.prediction === "on"];
+    const variants = scenario.sfuOnly ? [false] : values.prediction === "compare"
+      ? (iteration % 2 === 0 ? [false, true] : [true, false]) : [values.prediction === "on"];
     for (const prediction of variants) {
       if (controller.signal.aborted) break;
       const directory = join(output, `${scenario.id}-${iteration + 1}-${prediction ? "on" : "off"}`); await mkdir(directory);
diff --git a/scripts/network-lab/endpoint.ts b/scripts/network-lab/endpoint.ts
index 02e5e2dc4..1f6ae1e81 100644
--- a/scripts/network-lab/endpoint.ts
+++ b/scripts/network-lab/endpoint.ts
@@ -34,7 +34,7 @@ export async function endpointWorker(): Promise<void> {
   try {
     for await (const line of createInterface({ input: process.stdin })) {
       const request = JSON.parse(line) as { id: number; action: string; origin?: string; app?: boolean;
-        url?: string; output?: string; load?: boolean; ipv6?: boolean; prediction?: boolean; peer?: { address: string; port: number } };
+        url?: string; output?: string; load?: boolean; ipv6?: boolean; prediction?: boolean; predictionLocked?: boolean; peer?: { address: string; port: number } };
       try {
         let result: unknown;
         if (request.action === "probe") {
@@ -76,10 +76,13 @@ export async function endpointWorker(): Promise<void> {
           await click('button[aria-controls="host-advanced-door"]');
           const prediction = 'button[role="switch"][aria-label^="Enhanced NAT traversal"]';
           await waitForSample(deadline => evaluate<boolean>(cdp!, page!,
-            `document.querySelector(${JSON.stringify(prediction)})?.getAttribute('aria-disabled') !== 'true' && Boolean(document.querySelector(${JSON.stringify(prediction)}))`, deadline), Boolean, 10_000);
+            `Boolean(document.querySelector(${JSON.stringify(prediction)})) && (document.querySelector(${JSON.stringify(prediction)}).getAttribute('aria-disabled') === 'true') === ${request.predictionLocked === true}`, deadline), Boolean, 10_000);
           const checked = await evaluate<boolean>(cdp!, page!,
             `document.querySelector(${JSON.stringify(prediction)}).getAttribute('aria-checked') === 'true'`, Date.now() + 5000);
-          if (checked !== request.prediction) await click(prediction);
+          if (checked !== request.prediction) {
+            if (request.predictionLocked) throw new Error("Locked NAT setting disagrees with the scenario");
+            await click(prediction);
+          }
           // Browser-to-App encoded fanout is the production H264 path. VP8
           // deliberately stays in the Browser and must not masquerade as App WAN.
           await click(app ? 'button[aria-label^="H264"]' : 'button[aria-label^="VP8"]');

From 47117bbc3858d2ef3a15090dc48de283e3bc38ab Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 01:33:31 +0800
Subject: [PATCH 225/262] test(network): check the SFU-only policy indicator

---
 scripts/network-lab.ts          |  2 +-
 scripts/network-lab/endpoint.ts | 19 +++++++++++--------
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/scripts/network-lab.ts b/scripts/network-lab.ts
index e7b5e4628..b62efe62e 100644
--- a/scripts/network-lab.ts
+++ b/scripts/network-lab.ts
@@ -160,7 +160,7 @@ async function runCase(scenario: Scenario, seed: number, prediction: boolean, ou
     } }, Date.now() + 5000);
     stage("share");
     await endpoints[0]!.call("navigate", { url: SITE_ORIGIN + (scenario.host === "app" ? "/#piik-client=1" : "/") });
-    const invitation = await endpoints[0]!.call<string>("share", { prediction, predictionLocked: scenario.sfuOnly === true });
+    const invitation = await endpoints[0]!.call<string>("share", { prediction, sfuOnly: scenario.sfuOnly === true });
     const joinedAt = performance.now();
     await endpoints[1]!.call("navigate", { url: invitation + (scenario.viewer === "app" ? "&piik-client=1" : "") });
     if (scenario.sibling) await endpoints[2]!.call("navigate", { url: invitation });
diff --git a/scripts/network-lab/endpoint.ts b/scripts/network-lab/endpoint.ts
index 1f6ae1e81..462e640cb 100644
--- a/scripts/network-lab/endpoint.ts
+++ b/scripts/network-lab/endpoint.ts
@@ -34,7 +34,7 @@ export async function endpointWorker(): Promise<void> {
   try {
     for await (const line of createInterface({ input: process.stdin })) {
       const request = JSON.parse(line) as { id: number; action: string; origin?: string; app?: boolean;
-        url?: string; output?: string; load?: boolean; ipv6?: boolean; prediction?: boolean; predictionLocked?: boolean; peer?: { address: string; port: number } };
+        url?: string; output?: string; load?: boolean; ipv6?: boolean; prediction?: boolean; sfuOnly?: boolean; peer?: { address: string; port: number } };
       try {
         let result: unknown;
         if (request.action === "probe") {
@@ -75,13 +75,16 @@ export async function endpointWorker(): Promise<void> {
         } else if (request.action === "share") {
           await click('button[aria-controls="host-advanced-door"]');
           const prediction = 'button[role="switch"][aria-label^="Enhanced NAT traversal"]';
-          await waitForSample(deadline => evaluate<boolean>(cdp!, page!,
-            `Boolean(document.querySelector(${JSON.stringify(prediction)})) && (document.querySelector(${JSON.stringify(prediction)}).getAttribute('aria-disabled') === 'true') === ${request.predictionLocked === true}`, deadline), Boolean, 10_000);
-          const checked = await evaluate<boolean>(cdp!, page!,
-            `document.querySelector(${JSON.stringify(prediction)}).getAttribute('aria-checked') === 'true'`, Date.now() + 5000);
-          if (checked !== request.prediction) {
-            if (request.predictionLocked) throw new Error("Locked NAT setting disagrees with the scenario");
-            await click(prediction);
+          if (request.sfuOnly) {
+            if (request.prediction) throw new Error("SFU-only cannot request NAT enhancement");
+            await waitForSample(deadline => evaluate<boolean>(cdp!, page!,
+              `Boolean(document.querySelector('button[role="switch"][aria-label^="Server media"][aria-disabled="true"][aria-checked="true"]')) && !document.querySelector(${JSON.stringify(prediction)})`, deadline), Boolean, 10_000);
+          } else {
+            await waitForSample(deadline => evaluate<boolean>(cdp!, page!,
+              `document.querySelector(${JSON.stringify(prediction)})?.getAttribute('aria-disabled') !== 'true' && Boolean(document.querySelector(${JSON.stringify(prediction)}))`, deadline), Boolean, 10_000);
+            const checked = await evaluate<boolean>(cdp!, page!,
+              `document.querySelector(${JSON.stringify(prediction)}).getAttribute('aria-checked') === 'true'`, Date.now() + 5000);
+            if (checked !== request.prediction) await click(prediction);
           }
           // Browser-to-App encoded fanout is the production H264 path. VP8
           // deliberately stays in the Browser and must not masquerade as App WAN.

From f2ab8e2b8062ce2b2c63d5c722f13654bfbdb802 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 01:55:04 +0800
Subject: [PATCH 226/262] docs(network): record recovery acceptance and site
 approval scope

---
 docs/guide/getting-started.md       | 2 ++
 docs/guide/getting-started.zh-CN.md | 1 +
 docs/research/network-lab.md        | 7 +++++++
 docs/todo.md                        | 6 ------
 4 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/docs/guide/getting-started.md b/docs/guide/getting-started.md
index cfb25bc56..2eb755566 100644
--- a/docs/guide/getting-started.md
+++ b/docs/guide/getting-started.md
@@ -119,6 +119,8 @@ in a private window or after clearing site data, connect again. The same exact
 site already approved by App needs no repeat confirmation. The launcher
 shows the approved site; **×** beside its address revokes access. Approving a different site
 replaces the previous one and ends that site's App connections.
+To use your App with a friend's new public-invitation address, connect and approve
+that address again. Sharing-quality settings saved in App survive the address change.
 
 **A page that opens does not guarantee a video connection.** Public invite gives
 your room a temporary web address; picture and sound still travel between
diff --git a/docs/guide/getting-started.zh-CN.md b/docs/guide/getting-started.zh-CN.md
index 5be3bbc8b..33b116abc 100644
--- a/docs/guide/getting-started.zh-CN.md
+++ b/docs/guide/getting-started.zh-CN.md
@@ -104,6 +104,7 @@ Linux 原生采集还需要[系统组件](../../native/capture/linux/README.md)
 选择 **程序 / 窗口** 或 **屏幕**，即可使用正在运行的 App。
 换浏览器、使用无痕窗口或清除站点数据后，重新连接即可；App 已允许的同一站点无需再次确认。
 启动页显示已授权的站点，网址右侧的 **×** 可取消授权；允许新站点会替换旧站点，并结束旧站点的 App 连接。
+如要通过自己的 App 使用朋友的新公网邀请地址，需要重新连接并确认；App 保存的分享画质不受地址变化影响。
 
 **网页能打开，不代表视频一定能连通。** 公网邀请为房间提供临时网页地址，
 画面和声音仍靠参与者之间的连接传输。此模式没有媒体服务器兜底，
diff --git a/docs/research/network-lab.md b/docs/research/network-lab.md
index 641f6ec86..f1aecf2e2 100644
--- a/docs/research/network-lab.md
+++ b/docs/research/network-lab.md
@@ -156,6 +156,13 @@ repeated primary sequence numbers afterward. Pion's existing
 no new recovery timer or relaxed replay check was added. The other endpoint pairs
 retained their prior recovery range. These controlled observations establish a
 media-recovery repair, not a change in NAT reachability or Internet success rate.
+The [shared-receiver acceptance](https://github.com/TNTcraftHIM/Piik/actions/runs/38439642180)
+adds three SFU-only outage trials, three SFU fallback trials and three further
+Browser/App address-change trials. All delivered media and cleaned up their
+resources. SFU outage recovery took about 4.9 seconds; repeated Browser/App
+recovery ranged from 4.9 to 11.1 seconds, so 4.9 seconds is not a guaranteed bound.
+The SFU-only fixture verifies the locked server-media control and disabled
+NAT policy; it does not attempt to enable a hidden P2P setting.
 
 App Host checks must use the real H264 Browser-to-App ingress and App WAN sender;
 launching an App alongside a Browser-only VP8 share is not an App-path test.
diff --git a/docs/todo.md b/docs/todo.md
index c6fb17c7a..b6483960b 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -10,12 +10,6 @@ Git/PRs own completed history.
 
 ## Now
 
-- [ ] **Shared receiver repair acceptance.** Native address-change recovery now
-  retains standard RTX and passes the repeated process comparison. The sibling
-  SFU receiver also stripped RTX when selecting its primary codec; verify the
-  shared selection correction through SFU publication, media outage and cleanup
-  before closing this item.
-
 - [ ] **Intermittent RTP clock-check timeout.** Linux CI intermittently times out
   waiting for the second packet in the existing timestamp/generation checks.
   Local repetitions and explicit source pauses did not reproduce the timeout.

From 282d04b8248665a4705f3cf5b7d1048cc8e1a8bc Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 02:19:53 +0800
Subject: [PATCH 227/262] fix(ui): polish App approval and restore choice press
 feedback

---
 src/client/App.tsx                            |  4 +-
 src/client/components/living/Header.tsx       |  5 ++-
 src/client/components/living/LauncherForm.tsx | 20 ----------
 src/client/locales/en.ts                      |  3 --
 src/client/locales/zh.ts                      |  3 --
 src/client/pages/AppLauncherPage.tsx          | 32 ++++++++++++----
 src/client/pages/ControlsPreview.tsx          |  2 +-
 src/client/pages/HostPage.tsx                 |  1 +
 src/client/styles.css                         | 38 ++++++++++++++-----
 9 files changed, 61 insertions(+), 47 deletions(-)

diff --git a/src/client/App.tsx b/src/client/App.tsx
index 75a622665..7ad215b41 100644
--- a/src/client/App.tsx
+++ b/src/client/App.tsx
@@ -197,7 +197,7 @@ function AppRoute() {
 function RouteLoader() {
   return (
     <div className="lr-app">
-      <AppHeader homeHref={appRoute.kind === "client" ? "/client" : undefined} />
+      <AppHeader atHome={appRoute.kind === "host"} homeHref={appRoute.kind === "client" ? "/client" : undefined} />
       <main className="lr-join">
         <LoadingStatus label="common.loading" />
       </main>
@@ -406,7 +406,7 @@ function SiteAccessGate({
 
   return (
     <div className="lr-app">
-      <AppHeader />
+      <AppHeader atHome={surface === "host"} />
       <main className="lr-join">
         {access.kind === "checking" ? (
           <LoadingStatus label="gate.checking" />
diff --git a/src/client/components/living/Header.tsx b/src/client/components/living/Header.tsx
index 33bac214a..a5d496713 100644
--- a/src/client/components/living/Header.tsx
+++ b/src/client/components/living/Header.tsx
@@ -124,11 +124,13 @@ export function AppHeader({
   homeHref = "/",
   diagnosticControl,
   showAppConnection = true,
+  atHome = false,
 }: {
   led?: React.ReactNode;
   homeHref?: string;
   diagnosticControl?: React.ReactNode;
   showAppConnection?: boolean;
+  atHome?: boolean;
 }) {
   const { t } = useCopy();
   return (
@@ -137,8 +139,9 @@ export function AppHeader({
         className="lr-brand"
         href={withBrowserDebug(homeHref)}
         aria-label={t("brand.home")}
+        aria-current={atHome ? "page" : undefined}
       >
-        <Glyph name="chevron" size={14} className="lr-home-arrow" />
+        {!atHome && <Glyph name="chevron" size={14} className="lr-home-arrow" />}
         <BrandMark size={34} motion="once" />
       </a>}
       <span className="lr-top-right">
diff --git a/src/client/components/living/LauncherForm.tsx b/src/client/components/living/LauncherForm.tsx
index 3e5a76486..4f71b0014 100644
--- a/src/client/components/living/LauncherForm.tsx
+++ b/src/client/components/living/LauncherForm.tsx
@@ -46,7 +46,6 @@ export function LauncherForm({
   lan,
   onSubmit,
   children,
-  version,
   roomError,
 }: {
   mode: AppMode;
@@ -66,7 +65,6 @@ export function LauncherForm({
   };
   onSubmit: (event: FormEvent<HTMLFormElement>) => void;
   children?: ReactNode;
-  version?: string;
   roomError?: ReactNode;
 }) {
   const { vis, t } = useCopy();
@@ -214,24 +212,6 @@ export function LauncherForm({
         disabled={mode === "local" && lan !== undefined && !lan.selected}
       />
       </>)}
-      <div className="lr-client-about">
-        {version && <p className="lr-client-version">
-          <span className={vis ? "visually-hidden" : undefined}>{t("client.launch.version", { version })}</span>
-          {vis && <span aria-hidden="true">{version}</span>}
-        </p>}
-        <p>
-          <span className={vis ? "visually-hidden" : undefined}>{t("client.launch.credit")}</span>
-          {vis && <span aria-hidden="true">TNTcraft & contributors</span>}
-        </p>
-        <div className="lr-client-project-links">
-          <a href="https://piik.tv/" target="_blank" rel="noopener noreferrer" aria-label={t("client.launch.website")}>
-            {vis ? "piik.tv" : t("client.launch.website")}<span aria-hidden="true"> ↗</span>
-          </a>
-          <a href="https://github.com/TNTcraftHIM/Piik" target="_blank" rel="noopener noreferrer" aria-label={t("client.launch.source")}>
-            {vis ? "GitHub" : t("client.launch.source")}<span aria-hidden="true"> ↗</span>
-          </a>
-        </div>
-      </div>
     </form>
   );
 }
diff --git a/src/client/locales/en.ts b/src/client/locales/en.ts
index 1e987bb8f..94ffcb94c 100644
--- a/src/client/locales/en.ts
+++ b/src/client/locales/en.ts
@@ -54,9 +54,6 @@ export const en: Record<CopyKey, string> = {
 
   "client.launch.title": "Open Piik",
   "client.launch.version": "Installed version {version}",
-  "client.launch.credit": "Free and open source · TNTcraft & contributors",
-  "client.launch.website": "Official website",
-  "client.launch.source": "GitHub",
   "client.launch.local": "Local room",
   "client.launch.localHint": "Use on the same local network",
   "client.launch.link": "Public invite",
diff --git a/src/client/locales/zh.ts b/src/client/locales/zh.ts
index 7cbcec62e..ae4034f47 100644
--- a/src/client/locales/zh.ts
+++ b/src/client/locales/zh.ts
@@ -54,9 +54,6 @@ export const zh = {
 
   "client.launch.title": "打开 Piik",
   "client.launch.version": "当前版本 {version}",
-  "client.launch.credit": "免费开源 · TNTcraft 与贡献者",
-  "client.launch.website": "官方网站",
-  "client.launch.source": "GitHub",
   "client.launch.local": "本地房间",
   "client.launch.localHint": "同一局域网内使用",
   "client.launch.link": "公网邀请",
diff --git a/src/client/pages/AppLauncherPage.tsx b/src/client/pages/AppLauncherPage.tsx
index 56b44cc14..42d704efc 100644
--- a/src/client/pages/AppLauncherPage.tsx
+++ b/src/client/pages/AppLauncherPage.tsx
@@ -1,6 +1,7 @@
 import { useEffect, useState, type FormEvent } from "react";
 import { z } from "zod";
 
+import { BrandMark } from "../components/living/BrandMark";
 import { HintComic } from "../components/living/hints";
 import { LoadingStatus } from "../components/living/WaitingStatus";
 import { AppReleaseNotice } from "../components/living/AppReleaseNotice";
@@ -9,6 +10,7 @@ import { LauncherForm, type AppMode } from "../components/living/LauncherForm";
 import { Btn, Pill } from "../components/living/primitives";
 import { hasCopyPreference, useCopy } from "../ui/copy";
 import { consoleLanguage } from "../locales";
+import { Glyph } from "../ui/icons";
 import { currentThemePreference } from "../ui/theme";
 import { clientLaunchURL, type ClientLaunchPresentation } from "../lib/session";
 import {
@@ -246,24 +248,31 @@ export function AppLauncherPage() {
             />
           </div>
         ) : requestedSite ? (
-          <section className="lr-client-approval">
-            <HintComic kind="hint-client-site" />
-            <h1 className={vis ? "visually-hidden" : undefined}>{t(approvalCurrent ? "client.connect.approved" : "client.connect.approveTitle")}</h1>
-            <div className="lr-client-approval-origin">{requestedSite}</div>
-            <p className={vis ? "visually-hidden" : undefined}>{t(approvalCurrent ? "client.connect.return" : "client.connect.approveHint")}</p>
-            {!approvalCurrent && site && site !== requestedSite && <p>{t("client.connect.replace", { site })}</p>}
+          <section className="lr-client-approval" aria-labelledby="site-approval-title">
+            <header className="lr-client-approval-heading">
+              {approvalCurrent ? <BrandMark size={48} motion="once" /> : <HintComic kind="hint-client-site" size={230} />}
+              <h1 id="site-approval-title" className={vis ? "visually-hidden" : undefined}>{t(approvalCurrent ? "client.connect.approved" : "client.connect.approveTitle")}</h1>
+            </header>
+            <div className="lr-client-approval-site">
+              <div className="lr-client-approval-origin">
+                <Glyph name="globe" size={20} />
+                <strong>{requestedSite}</strong>
+                {approvalCurrent && <Glyph name="check" size={20} className="lr-client-approval-check" />}
+              </div>
+              <p className={vis ? "visually-hidden" : undefined}>{t(approvalCurrent ? "client.connect.return" : "client.connect.approveHint")}</p>
+              {!approvalCurrent && site && site !== requestedSite && <p className="lr-client-approval-replace">{t("client.connect.replace", { site })}</p>}
+            </div>
             {!validSite && <Pill icon="alert" tone="bad" label={t("client.connect.invalid")} comic="signal-failed" />}
             {siteError && <p role="alert">{siteError}</p>}
             <div className="lr-client-approval-actions">
               <Btn icon="x" title={approvalCurrent ? "client.connect.close" : "common.cancel"} cap={approvalCurrent ? "client.connect.close" : "common.cancel"}
                 onClick={() => window.close()} />
               {!approvalCurrent && <Btn icon="check" title="client.connect.approve" cap="client.connect.approve" tone="primary"
-                hint="hint-client-site" disabled={!validSite || siteBusy} onClick={() => void changeSite(requestedSite)} />}
+                hint="hint-client-site" busy={siteBusy} disabled={!validSite || siteBusy} onClick={() => void changeSite(requestedSite)} />}
             </div>
           </section>
         ) : (
           <LauncherForm
-            version={version}
             roomError={error?.kind === "launch" ? <>
               <Pill icon="alert" tone="bad" label={t("client.launch.error")} alert comic="signal-failed" />
               {error.detail && <p className="lr-client-launch-detail">{error.detail}</p>}
@@ -286,6 +295,13 @@ export function AppLauncherPage() {
           </LauncherForm>
         )}
       </main>
+      <footer className="lr-client-footer">
+        <a className="lr-btn" href="https://github.com/TNTcraftHIM/Piik" target="_blank" rel="noopener noreferrer">GitHub<span aria-hidden="true"> ↗</span></a>
+        {version && <p className="lr-client-version">
+          <span className={vis ? "visually-hidden" : undefined}>{t("client.launch.version", { version })}</span>
+          {vis && <span aria-hidden="true">{version}</span>}
+        </p>}
+      </footer>
     </div>
   );
 }
diff --git a/src/client/pages/ControlsPreview.tsx b/src/client/pages/ControlsPreview.tsx
index 6b18ed326..1275c4d07 100644
--- a/src/client/pages/ControlsPreview.tsx
+++ b/src/client/pages/ControlsPreview.tsx
@@ -255,7 +255,7 @@ export function ControlsPreview() {
         </button>
       </div>
       <div className="lr-client-launch">
-        <LauncherForm version="2.0 preview" mode={launchMode} onModeChange={setLaunchMode}
+        <LauncherForm mode={launchMode} onModeChange={setLaunchMode}
           site={launchSite} onRemoveSite={() => setLaunchSite("")}
           lan={{ selected: launchLan, onChange: setLaunchLan, addresses: [
             { address: "192.0.2.10", name: "Wi-Fi" },
diff --git a/src/client/pages/HostPage.tsx b/src/client/pages/HostPage.tsx
index ab396df5d..f9cf70066 100644
--- a/src/client/pages/HostPage.tsx
+++ b/src/client/pages/HostPage.tsx
@@ -3568,6 +3568,7 @@ export function HostPage({
   return (
     <div className="lr-app">
       <AppHeader
+        atHome
         showAppConnection={!sourcePickerOpen}
         led={
           <LedStrip
diff --git a/src/client/styles.css b/src/client/styles.css
index fe779b3f3..218e33c02 100644
--- a/src/client/styles.css
+++ b/src/client/styles.css
@@ -1063,7 +1063,7 @@ html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #334
   box-shadow: var(--control-shadow);
   transition: transform 180ms var(--spring), background-color 140ms ease;
 }
-.lr-chip:is(:hover, :focus-visible):not(:disabled):not([aria-disabled="true"]):not(.is-selected) { background: var(--wall-2); transform: translateY(-2px); }
+.lr-chip:is(:hover, :focus-visible):not(:disabled):not([aria-disabled="true"]):where(:not(.is-selected)) { background: var(--wall-2); transform: translateY(-2px); }
 .lr-chip:active:not(:disabled):not([aria-disabled="true"]) { transform: translateY(2px) scale(.97); box-shadow: none; }
 .lr-chip.is-selected { background: var(--ink); color: var(--paper); border-color: var(--ink); animation: lr-pop .2s var(--spring); }
 .lr-chip .lr-cap { font-family: var(--font); letter-spacing: 0; }
@@ -1181,7 +1181,7 @@ html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #334
   box-shadow: var(--control-shadow);
   transition: transform 180ms var(--spring), background-color 140ms ease;
 }
-.lr-tile:is(:hover, :focus-visible):not(:disabled):not([aria-disabled="true"]):not(.is-selected) { background: var(--wall-2); transform: translateY(-2px); }
+.lr-tile:is(:hover, :focus-visible):not(:disabled):not([aria-disabled="true"]):where(:not(.is-selected)) { background: var(--wall-2); transform: translateY(-2px); }
 .lr-tile:active:not(:disabled):not([aria-disabled="true"]) { transform: translateY(2px) scale(.97); box-shadow: none; }
 .lr-tile.is-selected { background: var(--ink); color: var(--paper); animation: lr-pop .2s var(--spring); }
 .lr-tiles .lr-tile small { max-width: 100%; font-family: var(--mono); font-size: 11px; letter-spacing: .02em; color: #5d7086; text-wrap: balance; overflow-wrap: normal; }
@@ -1565,7 +1565,7 @@ html[data-theme="dark"] .lr-door-glyph { color: #7d92a8; }
   display: grid;
   grid-template-columns: minmax(0, 1fr);
   place-items: center;
-  padding: 24px 16px 72px;
+  padding: 24px 16px 40px;
 }
 .lr-client-launch-panel {
   display: grid;
@@ -1591,12 +1591,32 @@ html[data-theme="dark"] .lr-door-glyph { color: #7d92a8; }
 .lr-client-approved-site a { min-width: 0; overflow-wrap: anywhere; color: var(--ink); font: 12px/1.6 var(--mono); text-underline-offset: 3px; }
 .lr-client-approved-site .lr-btn { min-width: 32px; width: 32px; height: 32px; padding: 0; }
 .lr-client-launch-section { justify-self: start; margin: 5px 0 -8px; font-size: 13px; font-weight: 700; color: var(--muted); }
-.lr-client-approval { display: grid; width: min(460px, 100%); justify-items: center; gap: 18px; text-align: center; }
-.lr-client-approval h1 { font-size: 22px; line-height: 1.4; }
-.lr-client-approval p { margin: 0; font-size: 13px; line-height: 1.7; color: var(--muted); }
-.lr-client-approval-origin { width: 100%; padding: 18px; border: 2px solid var(--ink); border-radius: 18px; background: var(--paper); font: 15px/1.6 var(--mono); overflow-wrap: anywhere; }
-.lr-client-approval-actions { display: flex; justify-content: center; flex-wrap: wrap; gap: 12px; }
-.lr-client-about { display: grid; gap: 4px; max-width: 100%; color: var(--muted); font-size: 12px; text-align: center; overflow-wrap: anywhere; }
+.lr-client-approval {
+  display: grid; width: min(480px, 100%); min-width: 0; gap: 20px;
+  padding: clamp(18px, 5vw, 32px); border: 1px solid color-mix(in srgb, var(--ink) 20%, transparent);
+  border-radius: 28px; background: var(--paper); box-shadow: var(--control-shadow);
+}
+.lr-client-approval-heading { display: grid; justify-items: center; gap: 14px; text-align: center; }
+.lr-client-approval-heading > svg { max-width: 100%; }
+.lr-client-approval h1 { font-size: 21px; line-height: 1.45; text-wrap: balance; }
+.lr-client-approval p { margin: 0; font-size: 13px; line-height: 1.7; color: var(--muted); overflow-wrap: anywhere; text-wrap: pretty; }
+.lr-client-approval-site { display: grid; min-width: 0; gap: 12px; }
+.lr-client-approval-origin {
+  display: flex; align-items: center; gap: 12px; min-width: 0;
+  padding: 14px; border-radius: 16px; background: var(--control-hover);
+  font: 14px/1.6 var(--mono); overflow-wrap: anywhere;
+}
+.lr-client-approval-origin > svg { flex: none; }
+.lr-client-approval-origin > strong { flex: 1; min-width: 0; font-weight: 650; }
+.lr-client-approval-origin > .lr-client-approval-check { color: var(--live); }
+.lr-client-approval p.lr-client-approval-replace { padding-top: 12px; border-top: 1px solid color-mix(in srgb, var(--ink) 15%, transparent); font-size: 12px; }
+.lr-client-approval-actions { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 10px; }
+.lr-client-approval-actions > :only-child { grid-column: 1 / -1; }
+.lr-client-approval-actions > .lr-comic-tip-wrap { min-width: 0; }
+.lr-client-approval-actions .lr-btn { width: 100%; min-width: 0; padding: 0 12px; justify-content: center; }
+.lr-client-footer { display: flex; justify-content: space-between; align-items: center; gap: 12px; padding: 8px clamp(16px, 4vw, 44px) 16px; color: var(--muted); font-size: 11.5px; }
+.lr-client-footer .lr-btn { min-width: 44px; height: 36px; padding: 0 10px; border-color: transparent; background: transparent; box-shadow: none; color: inherit; font-size: 12px; text-decoration: none; }
+.lr-client-version { overflow-wrap: anywhere; text-align: right; }
 .lr-client-project-links { display: flex; justify-content: center; flex-wrap: wrap; gap: 0 20px; }
 .lr-client-project-links a { display: inline-flex; align-items: center; gap: 4px; min-height: 36px; color: inherit; text-underline-offset: 3px; }
 .lr-client-project-links a:is(:hover, :focus-visible) { color: var(--ink); }

From ea2c726806ba3ffbeb37c140977d8c32b9eda36e Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 02:27:45 +0800
Subject: [PATCH 228/262] test(media): verify sustained quality recovery
 through SFU

---
 docs/todo.md                     |  8 ++++++++
 scripts/network-lab.ts           | 20 +++++++++++++++++---
 scripts/network-lab/page.ts      |  3 ++-
 scripts/network-lab/scenarios.ts | 22 ++++++++++++++++++++++
 tests/network-lab.test.ts        | 17 ++++++++++++++++-
 5 files changed, 65 insertions(+), 5 deletions(-)

diff --git a/docs/todo.md b/docs/todo.md
index b6483960b..558fa2877 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -10,6 +10,14 @@ Git/PRs own completed history.
 
 ## Now
 
+- [ ] **Self-hosted sustained quality recovery.** A v1.9.2 report describes
+  resolution loss and stutter that clear after Viewer refresh. The report has no
+  paired diagnostics or confirmed media route; server decoding is not part of
+  Piik's forwarding SFU. Compare sustained Browser P2P and SFU uplink/downlink
+  recovery in the existing network laboratory, preserving the original
+  connection. Candidate queue, probe and repair fixes are relevant mechanisms,
+  not an established diagnosis of this report.
+
 - [ ] **Intermittent RTP clock-check timeout.** Linux CI intermittently times out
   waiting for the second packet in the existing timestamp/generation checks.
   Local repetitions and explicit source pauses did not reproduce the timeout.
diff --git a/scripts/network-lab.ts b/scripts/network-lab.ts
index b62efe62e..5a0c9220e 100644
--- a/scripts/network-lab.ts
+++ b/scripts/network-lab.ts
@@ -9,7 +9,7 @@ import { setTimeout as delay } from "node:timers/promises";
 import { cleanupRun, withDeadline } from "./browser-gate-harness";
 import { endpointWorker } from "./network-lab/endpoint";
 import { command, LabNetwork, SITE_IP, SITE_IPV6, SITE_ORIGIN } from "./network-lab/network";
-import { checkAppPath, checkCalibration, checkContinuity, checkFaultHit, checkMapping, hasPicture, selectScenarios, summarizeTrials, type Scenario, type TrialSummary } from "./network-lab/scenarios";
+import { checkAppPath, checkCalibration, checkContinuity, checkFaultHit, checkMapping, checkQualityRecovery, hasPicture, selectScenarios, summarizeTrials, type Scenario, type TrialSummary } from "./network-lab/scenarios";
 import { echoWorker, type ProbeResult } from "./network-lab/udp";
 import type { MediaSample } from "./network-lab/page";
 import { checkMediaFeedback, checkMediaPath, readPacketFlows, type PacketFlow } from "./network-lab/packets";
@@ -87,6 +87,18 @@ async function runCase(scenario: Scenario, seed: number, prediction: boolean, ou
     samples.push(sample); return sample;
   };
   const addresses = () => endpoints.map((_, index) => scenario.ipv6 ? network.ipv6(index) : network.publicIP(index));
+  const observeQuality = async (name: string, durationMs: number, baseline?: MediaSample) => {
+    stage(name);
+    const startMs = Date.now(), observed: MediaSample[] = [];
+    while (Date.now() - startMs < durationMs) {
+      await delay(1000, undefined, { signal });
+      observed.push((await sampleAll()).viewer);
+    }
+    const last = observed.at(-1)!;
+    checkQualityRecovery(baseline ?? last, observed.filter(sample => last.at - sample.at <= 12_000));
+    mediaWindows.push({ name, startMs, endMs: Date.now(), addresses: addresses() });
+    return last;
+  };
   const checkAppPaths = () => {
     const current = samples.at(-1)!;
     if (scenario.host === "app") checkAppPath(current.host, "prepare-edge", network.localAddresses(0));
@@ -152,7 +164,7 @@ async function runCase(scenario: Scenario, seed: number, prediction: boolean, ou
       origin: SITE_ORIGIN, app: index < 2 && (index === 0 ? scenario.host : scenario.viewer) === "app",
     })));
     capture = spawn("ip", ["netns", "exec", network.wan, "tcpdump", "-i", "internet", "-n", "-s", "96", "-U",
-      "-w", pcapPath, "-c", "100000", "udp"], { stdio: "pipe" });
+      "-w", pcapPath, "-c", scenario.qualityRecovery ? "500000" : "100000", "udp"], { stdio: "pipe" });
     capture.stderr.on("data", data => { captureLog = (captureLog + data).slice(-4000); });
     await withDeadline(async () => { while (!captureLog.includes("listening on")) {
       if (capture!.exitCode !== null) throw new Error(`Packet capture failed: ${captureLog}`);
@@ -198,13 +210,14 @@ async function runCase(scenario: Scenario, seed: number, prediction: boolean, ou
         throw new Error("Frozen synthetic picture incorrectly passed");
       }
       if (scenario.sfu && next.route !== "sfu") throw new Error("Expected SFU route, but media used another path");
+      const qualityBaseline = scenario.qualityRecovery ? await observeQuality("quality-baseline", 45_000) : undefined;
       if (scenario.duringShare) {
         stage("impairment");
         setFault(scenario.fault);
         const impairedAt = performance.now();
         let healthyWindow = healthy, healthyAt = impairedAt;
         if (scenario.fault === "signaling" && await endpoints[0]!.call("signal-probe")) throw new Error("Signaling remained reachable during blackhole");
-        while (performance.now() - impairedAt < 8000) {
+        while (performance.now() - impairedAt < (scenario.qualityRecovery ? 30_000 : 8000)) {
           signal.throwIfAborted();
           await sampleAll();
           if (healthyWindow && performance.now() - healthyAt >= 2000) {
@@ -267,6 +280,7 @@ async function runCase(scenario: Scenario, seed: number, prediction: boolean, ou
         if (!recovered) throw new Error(`Recovery observation expired: ${recoveryError}`);
         mediaWindows.push({ name: "recovered", startMs: recoveryStart, endMs: Date.now(), addresses: addresses() });
         if (scenario.fault === "signaling" && !await endpoints[0]!.call("signal-probe")) throw new Error("Signaling roundtrip did not recover");
+        if (qualityBaseline) await observeQuality("quality-restored", 90_000, qualityBaseline);
       }
     }
     await endpoints[1]!.call("screenshot", { output: join(output, "viewer.png") });
diff --git a/scripts/network-lab/page.ts b/scripts/network-lab/page.ts
index e756e199c..617bc01ea 100644
--- a/scripts/network-lab/page.ts
+++ b/scripts/network-lab/page.ts
@@ -73,7 +73,8 @@ export const pageProbe = String.raw`(() => {
         if(row.type==='inbound-rtp'||row.type==='outbound-rtp'||row.type==='remote-inbound-rtp'){
           const selected={type:row.type,kind:row.kind,id:row.id,peerId};
           for(const key of ['framesDecoded','framesReceived','framesEncoded','framesDropped','framesPerSecond',
-            'frameWidth','frameHeight','bytesReceived','bytesSent','packetsLost','packetsReceived','nackCount',
+            'frameWidth','frameHeight','bytesReceived','bytesSent','packetsLost','packetsReceived','nackCount','qpSum',
+            'retransmittedPacketsReceived','retransmittedPacketsSent','freezeCount','totalFreezesDuration',
             'pliCount','totalDecodeTime','jitterBufferDelay','jitterBufferEmittedCount','totalAudioEnergy',
             'totalSamplesDuration','roundTripTime','reportsReceived','qualityLimitationReason','targetBitrate']){
             if(row[key]!==undefined)selected[key]=row[key];
diff --git a/scripts/network-lab/scenarios.ts b/scripts/network-lab/scenarios.ts
index 802e27078..6b8c5e247 100644
--- a/scripts/network-lab/scenarios.ts
+++ b/scripts/network-lab/scenarios.ts
@@ -18,6 +18,7 @@ export interface Scenario {
   direction?: "uplink" | "downlink";
   sibling?: boolean;
   remap?: boolean;
+  qualityRecovery?: boolean;
 }
 
 export interface TrialSummary {
@@ -66,6 +67,14 @@ export const scenarios: readonly Scenario[] = [
   { ...baseline, id: "sfu-outage", host: "browser", viewer: "browser", fault: "udp-block", sfu: true, sfuOnly: true, duringShare: true },
   { ...baseline, id: "blocked-media", host: "browser", viewer: "browser", fault: "udp-block", expected: "unavailable" },
   { ...baseline, id: "bandwidth-recovery", host: "browser", viewer: "browser", fault: "rate", duringShare: true },
+  // Match the same Browser source through direct and SFU paths. A brief return
+  // of decoded frames cannot establish recovery from sustained low quality.
+  ...([
+    { id: "quality-peer", sfu: false, faultEndpoint: 1, direction: "downlink" },
+    { id: "quality-sfu-uplink", sfu: true, sfuOnly: true, faultEndpoint: 0, direction: "uplink" },
+    { id: "quality-sfu-downlink", sfu: true, sfuOnly: true, faultEndpoint: 1, direction: "downlink" },
+  ] as const).map(path => ({ ...baseline, ...path, host: "browser" as const, viewer: "browser" as const,
+    fault: "rate" as const, duringShare: true, qualityRecovery: true })),
   { ...baseline, id: "media-outage", host: "app", viewer: "app", fault: "udp-block", duringShare: true },
   { ...baseline, id: "signaling-outage", host: "browser", viewer: "browser", fault: "signaling", duringShare: true },
   { ...baseline, id: "random-nat", host: "app", viewer: "app", nat: ["random", "random"], expected: "observed" },
@@ -150,6 +159,19 @@ export function checkContinuity(before: MediaSample, after: MediaSample): void {
   if (!audible) throw new Error("Decoded audio energy and sample duration did not advance");
 }
 
+// A fixture acceptance check, never a product quality floor. The source is a
+// fixed moving 720p canvas and the restored laboratory link is unconstrained.
+export function checkQualityRecovery(baseline: MediaSample, samples: readonly MediaSample[]): void {
+  if (baseline.width !== 1280 || baseline.height !== 720) throw new Error("Quality baseline never reached the source resolution");
+  const first = samples[0], last = samples.at(-1);
+  if (!first || !last || last.at - first.at < 10_000) throw new Error("Quality recovery needs a sustained ten-second observation");
+  if (samples.some(sample => sample.width !== baseline.width || sample.height !== baseline.height ||
+    sample.playbackPeerId !== baseline.playbackPeerId || sample.route !== baseline.route)) {
+    throw new Error("Source resolution did not recover on the retained connection");
+  }
+  checkContinuity(first, last);
+}
+
 export function checkCalibration(before: ProbeResult, after: ProbeResult, fault: Fault): void {
   if (before.received !== before.sent || before.mappings.length !== 3 ||
       before.mappings.some(mapping => !mapping.address.startsWith("198.51.100."))) {
diff --git a/tests/network-lab.test.ts b/tests/network-lab.test.ts
index 4c9dd7a3e..6732701ae 100644
--- a/tests/network-lab.test.ts
+++ b/tests/network-lab.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { checkAppPath, checkCalibration, checkContinuity, checkFaultHit, checkMapping, hasPicture, selectScenarios, summarizeTrials } from "../scripts/network-lab/scenarios";
+import { checkAppPath, checkCalibration, checkContinuity, checkFaultHit, checkMapping, checkQualityRecovery, hasPicture, selectScenarios, summarizeTrials } from "../scripts/network-lab/scenarios";
 import { checkMediaFeedback, checkMediaPath, packetFlows, type PacketFlow } from "../scripts/network-lab/packets";
 import type { MediaSample } from "../scripts/network-lab/page";
 import type { ProbeResult } from "../scripts/network-lab/udp";
@@ -104,6 +104,21 @@ describe("network laboratory evidence", () => {
     expect(() => checkContinuity(before, { ...after, pictureHash: 100 })).toThrow();
   });
 
+  it("requires sustained source resolution on the retained path, not one good frame or a refreshed connection", () => {
+    const baseline = { width: 1280, height: 720, at: 0, route: "sfu", playbackPeerId: 0 } as MediaSample;
+    const samples = Array.from({ length: 12 }, (_, index) => ({ ...baseline, at: index * 1000,
+      frames: 50 + index * 30, pictureHash: index, stats: [{ id: "audio", peerId: 0, type: "inbound-rtp", kind: "audio",
+        totalAudioEnergy: index, totalSamplesDuration: index }] }));
+    expect(() => checkQualityRecovery(baseline, samples)).not.toThrow();
+    expect(() => checkQualityRecovery(baseline, samples.slice(-2))).toThrow("sustained");
+    expect(() => checkQualityRecovery({ ...baseline, height: 360 }, samples)).toThrow("baseline");
+    for (const change of [{ height: 360 }, { playbackPeerId: 1 }, { route: "peer" }]) {
+      expect(() => checkQualityRecovery(baseline, samples.map((sample, index) => index === 5 ? { ...sample, ...change } : sample)))
+        .toThrow("retained");
+    }
+    expect(() => checkQualityRecovery(baseline, samples.map(sample => ({ ...sample, pictureHash: 0 })))).toThrow("picture");
+  });
+
   it("requires feedback on the same WAN transport, not a healthy loopback or sibling", () => {
     const media: PacketFlow = { source: "198.51.100.11", destination: "198.51.100.12", sourcePort: 5000,
       destinationPort: 6000, kind: "rtp", packets: 50, bytes: 50_000, firstMs: 1, lastMs: 5000 };

From d16930d8677687dbb09fe0be8d4cab247fb60fcf Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 02:36:35 +0800
Subject: [PATCH 229/262] fix(ui): keep the App approval heading compact on
 mobile

---
 src/client/locales/zh.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/client/locales/zh.ts b/src/client/locales/zh.ts
index ae4034f47..f32a6cd6a 100644
--- a/src/client/locales/zh.ts
+++ b/src/client/locales/zh.ts
@@ -64,7 +64,7 @@ export const zh = {
   "client.connect.standby": "App 已就绪",
   "client.connect.standbyHint": "打开 Piik 站点，点击顶部的 App 即可连接。",
   "client.connect.remove": "取消此站点的 App 授权",
-  "client.connect.approveTitle": "允许此站点使用 Piik App？",
+  "client.connect.approveTitle": "允许使用 Piik App？",
   "client.connect.approveHint": "此站点将可以使用本机的屏幕、窗口和麦克风。请确认你信任这个网址。",
   "client.connect.approve": "允许使用",
   "client.connect.replace": "将替换 {site}，并断开它的 App 连接。",

From 1e99c89da7a1ed052315a88a0f9adf75d4e37f8c Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 02:56:18 +0800
Subject: [PATCH 230/262] test(media): record sustained SFU recovery acceptance

---
 .github/workflows/repository-hygiene.yml |  2 +-
 docs/research/network-lab.md             | 41 ++++++++++++++++++++++++
 docs/todo.md                             | 17 +++++-----
 3 files changed, 51 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/repository-hygiene.yml b/.github/workflows/repository-hygiene.yml
index 9fb39f220..c1e7b6d91 100644
--- a/.github/workflows/repository-hygiene.yml
+++ b/.github/workflows/repository-hygiene.yml
@@ -149,7 +149,7 @@ jobs:
       - name: Run isolated network laboratory
         id: network_lab
         if: github.event_name == 'workflow_dispatch' && inputs.network_lab != 'none' && inputs.network_lab != ''
-        timeout-minutes: 35
+        timeout-minutes: 45
         env:
           CHROME_PATH: /usr/bin/google-chrome
           TC_LIB_DIR: ${{ github.workspace }}/build/network-lab/iproute2/netem
diff --git a/docs/research/network-lab.md b/docs/research/network-lab.md
index f1aecf2e2..f61c93073 100644
--- a/docs/research/network-lab.md
+++ b/docs/research/network-lab.md
@@ -121,6 +121,16 @@ The manual CI workflow's `network_lab` input runs this same entry point and neve
 publishes. Reports and bounded synthetic-traffic captures are under ignored
 `build/network-lab/results/`; CI retains them for seven days.
 
+The `quality-peer`, `quality-sfu-uplink` and `quality-sfu-downlink` cases use the
+same moving 720p Browser source. They establish 45 seconds of baseline, constrain
+one direction to 600 kbps for 30 seconds, then observe 90 seconds beyond resumed media. The
+final observation must retain the original connection and source resolution for
+at least ten seconds, with advancing pictures and audio. This is an
+unconstrained-fixture recovery check, not a product resolution floor or proof of
+game quality. Frame cadence, bitrate, loss, repair, freezes and QP remain separate
+measurements. These longer cases cap captures at 500,000 packets, retaining only
+each packet's first 96 bytes; ordinary cases keep their 100,000-packet bound.
+
 The [full process acceptance](https://github.com/TNTcraftHIM/Piik/actions/runs/38300988699)
 on 2026-10-13 passed all 19 scenarios and five negative controls, including
 resource cleanup and unchanged host networking. Sixteen scenarios produced
@@ -202,3 +212,34 @@ the original 60-second observation deadline; it is not a successful recovery.
 ends at the first sample with at least 15 decoded frames; sampling is every
 500 ms. Recovery checks poll every second. These are sampled media-admission
 times, not exact first-packet timestamps or one-way media latency.
+
+## Sustained Quality Recovery
+
+The [2026-10-14 comparison](https://github.com/TNTcraftHIM/Piik/actions/runs/38446966925)
+passed two trials for each quality case on candidate `ea2c7268`, using Chrome
+154.0.8037.97 and the moving 720p30 VP8 source. All six retained their connection,
+restored source resolution and cleaned up. Times below start at impairment
+removal; resumed media includes the existing three-second continuity check.
+Source-resolution recovery is measured separately from resumed decoding.
+
+| Constrained path | Resumed media | Sustained 720p |
+| --- | --- | --- |
+| Browser P2P downlink | 4.9 s | 45.3–47.2 s |
+| Host-to-SFU uplink | 17.0–19.0 s | 28.1–29.1 s |
+| SFU-to-Viewer downlink | 11.9–13.0 s | 22.0 s |
+
+Final twenty-second windows delivered 29.3–29.4 decoded fps with no new freezes.
+The impaired SFU paths did pause, and the Browser encoder's bitrate/quantization
+recovered gradually after dimensions returned. These results do not establish
+instantaneous or perceptually lossless recovery. The forwarding SFU can pause
+when no received layer fits a child's capacity; it does not create a lower
+encoding for that child.
+
+The v1.9.2 report of persistent self-hosted degradation has no matched trace,
+codec or confirmed route. Piik already forwards encoded video without server
+decoding/transcoding. An opaque UDP relay changes transport feedback and delivery
+semantics; its reported improvement does not isolate CPU, network or an SFU cause.
+The [queue/probe repairs](./node-local-media-design.md#send-queue-recovery) address
+confirmed mechanisms present in v1.9.2, but this run is candidate acceptance,
+not a matched old/new reproduction of that report. It does not measure a cloud
+server's CPU requirement, H264 behavior, multi-Viewer load or hours-long stability.
diff --git a/docs/todo.md b/docs/todo.md
index 558fa2877..1799b24f9 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -10,14 +10,6 @@ Git/PRs own completed history.
 
 ## Now
 
-- [ ] **Self-hosted sustained quality recovery.** A v1.9.2 report describes
-  resolution loss and stutter that clear after Viewer refresh. The report has no
-  paired diagnostics or confirmed media route; server decoding is not part of
-  Piik's forwarding SFU. Compare sustained Browser P2P and SFU uplink/downlink
-  recovery in the existing network laboratory, preserving the original
-  connection. Candidate queue, probe and repair fixes are relevant mechanisms,
-  not an established diagnosis of this report.
-
 - [ ] **Intermittent RTP clock-check timeout.** Linux CI intermittently times out
   waiting for the second packet in the existing timestamp/generation checks.
   Local repetitions and explicit source pauses did not reproduce the timeout.
@@ -73,6 +65,15 @@ These physical checks or reporter diagnoses remain unverified. A local repair or
 successful test is not proof of a reporter's cause; research owns the completed
 experiments and their limits.
 
+- [ ] **Self-hosted sustained quality loss (v1.9.2).** The report describes
+  resolution loss and stutter that clear after Viewer refresh, without paired
+  diagnostics, a confirmed route or codec. Six candidate
+  [sustained recovery trials](./research/network-lab.md#sustained-quality-recovery)
+  restore 720p on retained Browser P2P/SFU connections; recovery still takes
+  tens of seconds. Retest the affected setup with matched Host/Viewer/Server
+  reports before assigning its cause. Existing queue/probe repairs do not
+  establish a diagnosis, server CPU requirements or long-duration stability.
+
 - [ ] **Linux Portal target identity acceptance (#470).** The
   [contributor fix](https://github.com/TNTcraftHIM/Piik/pull/470) is integrated
   with authorship retained. Compilation and headless serial/node-ID targeting

From 8628b5cef1fc29fc11d550ee79d5ab5cc6f2767b Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 03:35:36 +0800
Subject: [PATCH 231/262] fix(app): retain terminal controls for Linux desktop
 entry

PR #475 identified that Terminal=false hides the existing reopen, diagnostics and quit controls. Restore the standard terminal launch without adding another process-control API or desktop-specific tray lifecycle.

Reported-by: AkazaAkali (https://github.com/TNTcraftHIM/Piik/pull/475)
---
 cmd/piik-app/README.md            | 3 ++-
 cmd/piik-app/README.zh-CN.md      | 2 +-
 docs/todo.md                      | 5 +++++
 scripts/app-icons.mjs             | 2 +-
 scripts/package-app-candidate.mjs | 5 +++--
 5 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/cmd/piik-app/README.md b/cmd/piik-app/README.md
index 2e4e8f874..9499a761d 100644
--- a/cmd/piik-app/README.md
+++ b/cmd/piik-app/README.md
@@ -90,7 +90,8 @@ The terminal shows the current mode, entry links and startup state; its language
 follows the launcher and App-enabled pages.
 Press `o` to reopen the Browser, or `q` / Ctrl+C to end Local
 rooms and stop the local server and temporary public link. Plain-text output
-uses Ctrl+C. The App keeps running after a Site tab closes.
+uses Ctrl+C. The Linux desktop entry also opens this terminal. The App keeps
+running after a Site tab closes.
 When launched in its own Windows console, a startup or runtime error leaves the
 error visible until Enter is pressed. Normal shutdown, existing terminals and
 redirected or automated runs exit directly.
diff --git a/cmd/piik-app/README.zh-CN.md b/cmd/piik-app/README.zh-CN.md
index 894159263..7224ae22c 100644
--- a/cmd/piik-app/README.zh-CN.md
+++ b/cmd/piik-app/README.zh-CN.md
@@ -68,7 +68,7 @@ App 配置保存可选的本地站点口令。留空表示本地站点开放进
 
 终端显示当前模式、入口链接与启动状态，语言跟随启动页和已启用 App 的页面。
 按 `o` 重新打开浏览器，按 `q` 或 Ctrl+C 结束本地房间，停止本地服务与临时公网链接。
-纯文本输出时使用 Ctrl+C。关闭站点标签页后，App 仍会继续运行。
+纯文本输出时使用 Ctrl+C。Linux 桌面入口也会打开此终端。关闭站点标签页后，App 仍会继续运行。
 App 在独立 Windows 控制台中启动时，启动或运行错误会保留在窗口中，按 Enter 后退出。
 正常关闭、在已有终端中运行、重定向输出或自动化运行时，会直接退出。
 
diff --git a/docs/todo.md b/docs/todo.md
index 1799b24f9..d296de569 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -37,6 +37,11 @@ Git/PRs own completed history.
   and explain the disposition at integration. Keep
   [#459](https://github.com/TNTcraftHIM/Piik/pull/459)'s candidate scope and
   bilingual upgrade instructions aligned with the accepted result.
+  [#475](https://github.com/TNTcraftHIM/Piik/pull/475) identifies the Linux
+  desktop entry's missing terminal controls. The candidate restores the existing
+  terminal through the desktop entry; tray activation and Browser process-exit
+  authority remain separate, unaccepted additions. Credit the reported defect
+  without attributing this independent packaging correction as co-authored code.
 - [ ] **Gitee mirror workflow activation.** The production verifier passes with
   the original published CI artifacts, GitHub digests and anonymous Gitee downloads.
   After the owner-approved merge, check Actions event dispatch, cross-run artifact
diff --git a/scripts/app-icons.mjs b/scripts/app-icons.mjs
index 5c6af9e43..bee44a9c6 100644
--- a/scripts/app-icons.mjs
+++ b/scripts/app-icons.mjs
@@ -105,7 +105,7 @@ function writeLinuxAssets(packageRoot, entries) {
       "Exec=piik-app",
       "TryExec=piik-app",
       "Icon=piik-app",
-      "Terminal=false",
+      "Terminal=true",
       "Categories=Network;Utility;",
       "StartupNotify=true",
       "",
diff --git a/scripts/package-app-candidate.mjs b/scripts/package-app-candidate.mjs
index 605ad1d8e..16f915f6c 100644
--- a/scripts/package-app-candidate.mjs
+++ b/scripts/package-app-candidate.mjs
@@ -276,8 +276,9 @@ function verifyPlatformAssets(root, target) {
     if (!existsSync(desktop) || !existsSync(icon)) {
       fail("Linux App icon assets are missing");
     }
-    if (!readFileSync(desktop, "utf8").includes("Icon=piik-app\n")) {
-      fail("Linux desktop entry does not name its icon");
+    const entry = readFileSync(desktop, "utf8");
+    if (!entry.includes("Icon=piik-app\n") || !entry.includes("Terminal=true\n")) {
+      fail("Linux desktop entry must retain its icon and interactive terminal");
     }
     if (!readFileSync(icon).subarray(0, 8).equals(Buffer.from([
       0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a,

From 1057ea3f8bd5d04d53f12f4deb6eb285d3dc0ef8 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 04:13:40 +0800
Subject: [PATCH 232/262] fix(deps): apply Go HTTP security updates

Use Go 1.26.9 and x/net 0.60.0 for the October HTTP/TLS fixes. Derive CI toolchains from go.mod and check reachable vulnerabilities at the App and Server entry points.
---
 .github/workflows/repository-hygiene.yml |  8 +++++---
 CONTRIBUTING.md                          |  3 +++
 docs/research/native-client-media.md     |  2 +-
 go.mod                                   | 14 +++++++-------
 go.sum                                   | 12 ++++++++++++
 package.json                             |  1 +
 6 files changed, 29 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/repository-hygiene.yml b/.github/workflows/repository-hygiene.yml
index c1e7b6d91..3045d1157 100644
--- a/.github/workflows/repository-hygiene.yml
+++ b/.github/workflows/repository-hygiene.yml
@@ -110,10 +110,12 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: 1.26.6
+          go-version-file: go.mod
           cache-dependency-path: go.sum
       - name: Check Go core
         run: npm run check:go-core
+      - name: Check reachable Go vulnerabilities
+        run: npm run check:go-vuln
       - name: Check NAT and media ownership with the race detector
         run: npm run check:go-race
       - name: Type-check and test
@@ -203,7 +205,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: 1.26.6
+          go-version-file: go.mod
           cache-dependency-path: go.sum
       - name: Install dependencies
         run: npm ci
@@ -267,7 +269,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: 1.26.6
+          go-version-file: go.mod
           cache-dependency-path: go.sum
       # scripts/assemble-app.mjs runs `npm run build:web` for the Web
       # assets the App binary embeds, so Vite and the license inputs must be
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index cfc864c1d..571d769b0 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -114,6 +114,9 @@ does not establish coverage.
 - `npm run check:go-race` checks port mapping, media-edge ownership and their
   scoped NAT dependencies with Go's race detector. It requires a supported cgo
   toolchain; CI runs it on Linux.
+- `npm run check:go-vuln` checks the App and Server entry points and their
+  dependencies against the Go vulnerability database. CI uses the Go version
+  declared in `go.mod`; update that owner for required toolchain security fixes.
 - `npm run check:native` runs only the current platform's capture compile/probe
   and deterministic native regressions. The Linux App packaging job includes
   its headless GStreamer output-profile and retirement test; this does not
diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 157605b86..88eefc14b 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -119,7 +119,7 @@ The audio adapter uses `github.com/thesyncim/gopus` behind the private
 `nativeaudio` boundary. It accepts fixed 48 kHz stereo PCM16/20 ms frames,
 encodes into a caller-owned Opus buffer, and can be replaced without changing
 the media edge or control wire. The dependency is BSD-3-Clause licensed and
-requires Go 1.25; App CI uses Go 1.26.6.
+requires Go 1.25; App CI follows the toolchain declared in [go.mod](../../go.mod).
 
 ## Current Boundary
 
diff --git a/go.mod b/go.mod
index 8d97a75d7..300e5e2f3 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/TNTcraftHIM/Piik
 
-go 1.26.0
+go 1.26.9
 
 // Scoped NAT-PMP fixes; provenance and removal criteria: internal/thirdparty/README.md.
 replace github.com/netbirdio/go-nat => ./internal/thirdparty/go-nat
@@ -33,11 +33,11 @@ require (
 	github.com/pion/webrtc/v4 v4.2.23
 	github.com/thesyncim/gopus v0.1.1
 	go.uber.org/zap v1.28.0
-	golang.org/x/crypto v0.56.0
-	golang.org/x/mod v0.40.0
-	golang.org/x/net v0.58.0
-	golang.org/x/sync v0.22.0
-	golang.org/x/text v0.41.0
+	golang.org/x/crypto v0.57.0
+	golang.org/x/mod v0.41.0
+	golang.org/x/net v0.60.0
+	golang.org/x/sync v0.23.0
+	golang.org/x/text v0.42.0
 	google.golang.org/protobuf v1.36.11
 	modernc.org/sqlite v1.58.0
 )
@@ -124,7 +124,7 @@ require (
 	go.uber.org/zap/exp v0.3.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/exp v0.0.0-20260727155853-b88d891fe743 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
diff --git a/go.sum b/go.sum
index 00b20a39a..8fa96cfe9 100644
--- a/go.sum
+++ b/go.sum
@@ -341,12 +341,16 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
 golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/exp v0.0.0-20260727155853-b88d891fe743 h1:ex206bKw+v3K0dm3andkrIF+ijyQKJG1pLgwQ2PYdQM=
 golang.org/x/exp v0.0.0-20260727155853-b88d891fe743/go.mod h1:EdfpwwqSu+0Li0mzskwHU6FWDV3t9Q+RZDo3QMUtL3Q=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
 golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
+golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
+golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -364,11 +368,15 @@ golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20220923203811-8be639271d50/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
 golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220923202941-7f9b1623fab7/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
 golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190411185658-b44545bcd369/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -394,6 +402,8 @@ golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -402,6 +412,8 @@ golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
 golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
diff --git a/package.json b/package.json
index c3f4bba17..7524a761b 100644
--- a/package.json
+++ b/package.json
@@ -17,6 +17,7 @@
     "package:app-candidate": "node scripts/package-app-candidate.mjs",
     "check:go": "node scripts/check-go.mjs",
     "check:go-core": "node scripts/check-go.mjs --core",
+    "check:go-vuln": "go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 ./cmd/piik-app ./cmd/piik-server",
     "check:go-race": "node scripts/check-go.mjs --race",
     "check:container": "node scripts/check-container.mjs",
     "check:native": "node scripts/check-go.mjs --capture-only",

From ffd42732db3be5b701ebb01116a16b962aa5c4f5 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 04:27:45 +0800
Subject: [PATCH 233/262] fix(ci): pin the Linux App build environment

Keep native capture on Ubuntu 24.04 for both architectures so the ubuntu-latest migration cannot silently raise system-library requirements.
---
 .github/workflows/repository-hygiene.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/repository-hygiene.yml b/.github/workflows/repository-hygiene.yml
index 3045d1157..2d787dc7d 100644
--- a/.github/workflows/repository-hygiene.yml
+++ b/.github/workflows/repository-hygiene.yml
@@ -246,8 +246,10 @@ jobs:
         include:
           - target: windows-amd64
             runner: windows-latest
+          # Native Linux capture links system libraries; keep both architectures
+          # on the same explicit build baseline instead of following latest.
           - target: linux-amd64
-            runner: ubuntu-latest
+            runner: ubuntu-24.04
           - target: linux-arm64
             runner: ubuntu-24.04-arm
           - target: darwin-arm64

From 1a1f2255547fd83f3b2ffa8f5c18920aa67a90cf Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 04:38:02 +0800
Subject: [PATCH 234/262] fix(protocol): validate interaction sender roles
 consistently

---
 internal/server/protocol/contract_test.go | 6 ++++++
 internal/server/protocol/interactions.go  | 3 +++
 tests/protocol.test.ts                    | 4 ++++
 3 files changed, 13 insertions(+)

diff --git a/internal/server/protocol/contract_test.go b/internal/server/protocol/contract_test.go
index 9f37b1be7..120492790 100644
--- a/internal/server/protocol/contract_test.go
+++ b/internal/server/protocol/contract_test.go
@@ -158,6 +158,12 @@ func assertServerMessage(t *testing.T, name string, data []byte, want bool) {
 }
 
 func TestFutureReactionEventsKeepPayloadAndAuthorityBounds(t *testing.T) {
+	for _, role := range []string{"host", "viewer", "", "HOST", "admin"} {
+		assertServerMessage(t, "sender role "+role, []byte(
+			`{"type":"room-interaction","id":"event_future_1234","requestId":"request_future_1234","occurredAt":1,`+
+				`"sender":{"peerId":"sender_peer_1234","role":"`+role+`","displayName":"Friend"},"payload":{"kind":"reaction","reaction":"future-effect"}}`),
+			role == RoleHost || role == RoleViewer)
+	}
 	for _, payload := range []string{
 		`{"kind":"reaction","reaction":""}`,
 		`{"kind":"reaction","reaction":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}`,
diff --git a/internal/server/protocol/interactions.go b/internal/server/protocol/interactions.go
index 737b78658..4ed2ad28e 100644
--- a/internal/server/protocol/interactions.go
+++ b/internal/server/protocol/interactions.go
@@ -125,6 +125,9 @@ func (sender *InteractionSender) UnmarshalJSON(data []byte) error {
 	if !ValidOpaqueID(value.PeerID) {
 		return errors.New("invalid sender peerId")
 	}
+	if !enumOf(value.Role, RoleHost, RoleViewer) {
+		return errors.New("invalid sender role")
+	}
 	*sender = InteractionSender(value)
 	return nil
 }
diff --git a/tests/protocol.test.ts b/tests/protocol.test.ts
index 516301079..c1e15cd8a 100644
--- a/tests/protocol.test.ts
+++ b/tests/protocol.test.ts
@@ -33,6 +33,10 @@ it("accepts bounded future reaction events while keeping commands and known prop
     sender: { peerId: "sender_peer_1234", role: "viewer", displayName: "Friend" },
     payload: { kind: "reaction", reaction: "future-effect", targetPeerId: "target_peer_1234" } };
   expect(serverMessageSchema.safeParse(event).success).toBe(true);
+  for (const role of ["host", "viewer", "", "HOST", "admin"]) {
+    expect(serverMessageSchema.safeParse({ ...event, sender: { ...event.sender, role } }).success)
+      .toBe(role === "host" || role === "viewer");
+  }
   expect(clientMessageSchema.safeParse({ type: "send-room-interaction", requestId: event.requestId, payload: event.payload }).success).toBe(false);
   for (const payload of [
     { kind: "reaction", reaction: "" }, { kind: "reaction", reaction: "a".repeat(33) },

From bbf170d8cbc16b752d4565c4adcc6370e07ab21f Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 05:09:35 +0800
Subject: [PATCH 235/262] fix(media): handle reserved transport feedback
 symbols safely

---
 internal/thirdparty/README.md                 |   5 +
 .../sendsidebwe/congestion_detector.go        |   9 +-
 .../sendsidebwe/congestion_detector_test.go   | 114 ++++++++++++++++++
 3 files changed, 126 insertions(+), 2 deletions(-)
 create mode 100644 internal/thirdparty/livekit/sendsidebwe/congestion_detector_test.go

diff --git a/internal/thirdparty/README.md b/internal/thirdparty/README.md
index 5be024b0a..a7b01a390 100644
--- a/internal/thirdparty/README.md
+++ b/internal/thirdparty/README.md
@@ -47,3 +47,8 @@ notice through the other compiled LiveKit packages. When a maintained upstream
 version covers both corrections and the same regressions pass, remove this
 directory and restore the upstream imports. Review dependency bumps against the
 named baseline; do not evolve a separate congestion-control algorithm here.
+
+The retained detector also includes [upstream #4935](https://github.com/livekit/livekit/pull/4935)
+and its regression from v1.13.9, adapted to standard Go assertions. Reserved
+TWCC symbols carry no receive delta: skip their measurement rather than consuming
+the next packet's delta or indexing past the feedback array.
diff --git a/internal/thirdparty/livekit/sendsidebwe/congestion_detector.go b/internal/thirdparty/livekit/sendsidebwe/congestion_detector.go
index 32fb6bf68..c6c63a1fc 100644
--- a/internal/thirdparty/livekit/sendsidebwe/congestion_detector.go
+++ b/internal/thirdparty/livekit/sendsidebwe/congestion_detector.go
@@ -14,6 +14,7 @@
 
 // Modified by Piik: finalize probes from valid acknowledged measurements,
 // not the detector's retained initial capacity.
+// Includes upstream #4935: consume deltas only for TWCC symbols carrying one.
 package sendsidebwe
 
 import (
@@ -691,13 +692,17 @@ func (c *congestionDetector) HandleTWCCFeedback(report *rtcp.TransportLayerCC) {
 	processSymbol := func(symbol uint16) {
 		recvTime := int64(0)
 		isLost := false
-		if symbol != rtcp.TypeTCCPacketNotReceived {
+		if symbol == rtcp.TypeTCCPacketNotReceived {
+			isLost = true
+		} else if (symbol == rtcp.TypeTCCPacketReceivedSmallDelta || symbol == rtcp.TypeTCCPacketReceivedLargeDelta) && deltaIdx < len(report.RecvDeltas) {
 			recvRefTime += report.RecvDeltas[deltaIdx].Delta
 			deltaIdx++
 
 			recvTime = recvRefTime
 		} else {
-			isLost = true
+			// The reserved symbol carries no receive delta, nothing to record.
+			sequenceNumber++
+			return
 		}
 		pi, sendDelta, recvDelta := c.packetTracker.RecordPacketIndicationFromRemote(sequenceNumber, recvTime)
 		if pi.sendTime != 0 {
diff --git a/internal/thirdparty/livekit/sendsidebwe/congestion_detector_test.go b/internal/thirdparty/livekit/sendsidebwe/congestion_detector_test.go
new file mode 100644
index 000000000..c144bfcf8
--- /dev/null
+++ b/internal/thirdparty/livekit/sendsidebwe/congestion_detector_test.go
@@ -0,0 +1,114 @@
+// Copyright 2026 LiveKit, Inc.
+// Adapted from LiveKit v1.13.9 to use Go's standard testing package.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package sendsidebwe
+
+import (
+	"testing"
+
+	"github.com/pion/rtcp"
+
+	"github.com/livekit/protocol/logger"
+	"github.com/livekit/protocol/utils/mono"
+
+	"github.com/livekit/livekit-server/pkg/sfu/ccutils"
+)
+
+// the reserved symbol has no receive delta, so its packet is neither acked nor lost,
+// and the next received packet uses the next delta
+func TestHandleTWCCFeedbackReservedSymbol(t *testing.T) {
+	// small delta, reserved, reserved, small delta, not received
+	for name, chunks := range map[string][]rtcp.PacketStatusChunk{
+		"status vector": {
+			&rtcp.StatusVectorChunk{
+				SymbolSize: rtcp.TypeTCCSymbolSizeTwoBit,
+				SymbolList: []uint16{
+					rtcp.TypeTCCPacketReceivedSmallDelta,
+					rtcp.TypeTCCPacketReceivedWithoutDelta,
+					rtcp.TypeTCCPacketReceivedWithoutDelta,
+					rtcp.TypeTCCPacketReceivedSmallDelta,
+					rtcp.TypeTCCPacketNotReceived,
+					rtcp.TypeTCCPacketNotReceived,
+					rtcp.TypeTCCPacketNotReceived,
+				},
+			},
+		},
+		"run length": {
+			&rtcp.RunLengthChunk{PacketStatusSymbol: rtcp.TypeTCCPacketReceivedSmallDelta, RunLength: 1},
+			&rtcp.RunLengthChunk{PacketStatusSymbol: rtcp.TypeTCCPacketReceivedWithoutDelta, RunLength: 2},
+			&rtcp.RunLengthChunk{PacketStatusSymbol: rtcp.TypeTCCPacketReceivedSmallDelta, RunLength: 1},
+			&rtcp.RunLengthChunk{PacketStatusSymbol: rtcp.TypeTCCPacketNotReceived, RunLength: 1},
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			c := newCongestionDetector(congestionDetectorParams{
+				Config: defaultCongestionDetectorConfig,
+				Logger: logger.GetLogger(),
+			})
+			// the first packet sent is the send time base and never joins a group, so keep it out of the report
+			now := mono.UnixMicro()
+			c.RecordPacketSendAndGetSequenceNumber(now, 1200, false, ccutils.ProbeClusterIdInvalid, false)
+			sns := make([]uint16, 5)
+			for i := range sns {
+				sns[i] = c.RecordPacketSendAndGetSequenceNumber(now+int64(i+1)*1000, 1200, false, ccutils.ProbeClusterIdInvalid, false)
+			}
+
+			fb := &rtcp.TransportLayerCC{
+				Header: rtcp.Header{
+					Count: rtcp.FormatTCC,
+					Type:  rtcp.TypeTransportSpecificFeedback,
+				},
+				MediaSSRC:          1,
+				BaseSequenceNumber: sns[0],
+				PacketStatusCount:  uint16(len(sns)),
+				ReferenceTime:      100,
+				FbPktCount:         1,
+				PacketChunks:       chunks,
+				RecvDeltas: []*rtcp.RecvDelta{
+					{Type: rtcp.TypeTCCPacketReceivedSmallDelta, Delta: 1000},
+					{Type: rtcp.TypeTCCPacketReceivedSmallDelta, Delta: 2000},
+				},
+			}
+			fb.Header.Padding = fb.MarshalSize()%4 != 0
+			fb.Header.Length = uint16(fb.MarshalSize()/4 - 1)
+
+			// round trip so the report is exactly what a remote peer can deliver
+			raw, err := fb.Marshal()
+			if err != nil {
+				t.Fatal(err)
+			}
+			pkts, err := rtcp.Unmarshal(raw)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			c.HandleTWCCFeedback(pkts[0].(*rtcp.TransportLayerCC))
+
+			// receive time is relative to the first received packet
+			if got := c.packetTracker.getPacketInfoExisting(sns[3]).recvTime; got != 2000 {
+				t.Fatalf("receive time after reserved symbols = %d, want 2000", got)
+			}
+
+			acked, lost := 0, 0
+			for _, pg := range c.packetGroups {
+				acked += pg.acked.numPackets()
+				lost += pg.lost.numPackets()
+			}
+			if acked != 2 || lost != 1 {
+				t.Fatalf("feedback counts: acked=%d lost=%d, want 2 and 1", acked, lost)
+			}
+		})
+	}
+}

From bfa69c1a1939aa78d34e17fc86e1c6945dc93300 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 05:31:06 +0800
Subject: [PATCH 236/262] fix(media): preserve repaired RTP identity and safe
 VP8 recovery

---
 docs/research/realtime-quality-adaptation.md |   6 +-
 go.mod                                       |  49 +++---
 go.sum                                       |  58 +++++++
 internal/app/mediaedge/receiver.go           |   4 +-
 internal/media/forwarding/codecs.go          |  14 ++
 internal/media/forwarding/rtp_test.go        | 172 +++++++++++++++++++
 internal/media/forwarding/temporal_test.go   |  46 +++++
 internal/server/sfu/media.go                 |   2 +-
 internal/thirdparty/README.md                |  12 ++
 9 files changed, 334 insertions(+), 29 deletions(-)
 create mode 100644 internal/media/forwarding/rtp_test.go

diff --git a/docs/research/realtime-quality-adaptation.md b/docs/research/realtime-quality-adaptation.md
index 0278558be..ed567676d 100644
--- a/docs/research/realtime-quality-adaptation.md
+++ b/docs/research/realtime-quality-adaptation.md
@@ -354,9 +354,9 @@ settings remained at 30 fps; the server process, kernel queues, and network
 device reported no contemporaneous resource or drop pressure. The deployed
 LiveKit Server 1.13.5 also predates the upstream simulcast RTX pairing repair:
 under the affected Pion integration, repair streams were not paired and
-retransmissions were silently dropped. LiveKit Server 1.13.6 is therefore the
-accepted patch baseline. This repairs loss recovery; it does not claim to
-prevent loss on the Host-to-SFU UDP path.
+retransmissions were silently dropped. LiveKit Server 1.13.6 established the
+RTX-repair baseline; `go.mod` owns the current dependency pin. This repairs loss
+recovery; it does not claim to prevent loss on the Host-to-SFU UDP path.
 
 The same later room also contained a separate interval in which the native
 bandwidth estimate stayed near 13 Mbps while the sender media-source cadence
diff --git a/go.mod b/go.mod
index 300e5e2f3..1df8f2876 100644
--- a/go.mod
+++ b/go.mod
@@ -16,9 +16,9 @@ require (
 	github.com/charmbracelet/x/term v0.2.2
 	github.com/coder/websocket v1.8.15
 	github.com/go-logr/logr v1.4.4
-	github.com/livekit/livekit-server v1.13.6
+	github.com/livekit/livekit-server v1.13.9
 	github.com/livekit/mediatransportutil v0.0.0-20260821083140-f234b534b095
-	github.com/livekit/protocol v1.50.5-0.20260821144838-17c16cf496fd
+	github.com/livekit/protocol v1.52.2-0.20261007103317-a935cd67c29a
 	github.com/livekit/server-sdk-go/v2 v2.14.0
 	github.com/netbirdio/go-nat v0.0.0-20260821095157-6b2c8c5c74e8
 	github.com/pion/ice/v4 v4.4.7
@@ -38,15 +38,16 @@ require (
 	golang.org/x/net v0.60.0
 	golang.org/x/sync v0.23.0
 	golang.org/x/text v0.42.0
-	google.golang.org/protobuf v1.36.11
+	google.golang.org/protobuf v1.36.12
 	modernc.org/sqlite v1.58.0
 )
 
 require (
-	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260709200747-435963d16310.1 // indirect
-	buf.build/go/protovalidate v1.2.0 // indirect
+	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-20260825204119-511051f7f437.2 // indirect
+	buf.build/go/protovalidate v1.4.0 // indirect
 	buf.build/go/protoyaml v0.7.0 // indirect
-	cel.dev/expr v0.25.2 // indirect
+	cel.dev/cel-go v0.32.0 // indirect
+	cel.dev/expr v0.25.3 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
 	github.com/benbjohnson/clock v1.3.5 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
@@ -76,26 +77,27 @@ require (
 	github.com/jellydator/ttlcache/v3 v3.4.1 // indirect
 	github.com/josharian/native v1.1.0 // indirect
 	github.com/jxskiss/base62 v1.1.0 // indirect
-	github.com/klauspost/compress v1.19.1 // indirect
+	github.com/klauspost/compress v1.20.1 // indirect
 	github.com/klauspost/cpuid/v2 v2.4.0 // indirect
 	github.com/koron/go-ssdp v0.0.4 // indirect
 	github.com/libp2p/go-netroute v0.2.1 // indirect
-	github.com/lithammer/shortuuid/v4 v4.2.0 // indirect
+	github.com/lithammer/shortuuid/v4 v4.3.0 // indirect
 	github.com/livekit/mageutil v0.0.0-20250511045019-0f1ff63f7731 // indirect
-	github.com/livekit/psrpc v0.7.3 // indirect
+	github.com/livekit/psrpc v0.8.2 // indirect
 	github.com/lucasb-eyer/go-colorful v1.4.1 // indirect
 	github.com/mackerelio/go-osstat v0.2.8 // indirect
+	github.com/magefile/mage v1.17.2 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/mattn/go-runewidth v0.0.24 // indirect
 	github.com/mdlayher/netlink v1.11.2 // indirect
 	github.com/mdlayher/socket v0.6.1 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/nats-io/nats.go v1.52.0 // indirect
+	github.com/nats-io/nats.go v1.53.1 // indirect
 	github.com/nats-io/nkeys v0.4.16 // indirect
 	github.com/nats-io/nuid v1.0.1 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
-	github.com/petermattis/goid v0.0.0-20260725062400-500c67a39b75 // indirect
+	github.com/petermattis/goid v0.0.0-20260918085751-abfca077860b // indirect
 	github.com/pion/datachannel v1.6.3 // indirect
 	github.com/pion/dtls/v3 v3.1.10 // indirect
 	github.com/pion/mdns/v2 v2.2.2 // indirect
@@ -104,9 +106,9 @@ require (
 	github.com/pion/srtp/v3 v3.1.3 // indirect
 	github.com/pion/transport/v4 v4.1.1 // indirect
 	github.com/prometheus/client_golang v1.24.1 // indirect
-	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.70.1 // indirect
-	github.com/prometheus/procfs v0.21.1 // indirect
+	github.com/prometheus/client_model v0.6.3 // indirect
+	github.com/prometheus/common v0.72.0 // indirect
+	github.com/prometheus/procfs v0.22.0 // indirect
 	github.com/puzpuzpuz/xsync/v4 v4.5.0 // indirect
 	github.com/redis/go-redis/v9 v9.22.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
@@ -116,19 +118,20 @@ require (
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/zeebo/xxh3 v1.1.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/otel v1.45.0 // indirect
-	go.opentelemetry.io/otel/metric v1.45.0 // indirect
-	go.opentelemetry.io/otel/trace v1.45.0 // indirect
-	go.uber.org/atomic v1.11.0 // indirect
+	go.opentelemetry.io/otel v1.47.0 // indirect
+	go.opentelemetry.io/otel/log v1.47.0 // indirect
+	go.opentelemetry.io/otel/metric v1.47.0 // indirect
+	go.opentelemetry.io/otel/trace v1.47.0 // indirect
+	go.uber.org/atomic v1.12.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap/exp v0.3.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/exp v0.0.0-20260727155853-b88d891fe743 // indirect
+	golang.org/x/exp v0.0.0-20261005173118-76772065c9b0 // indirect
 	golang.org/x/sys v0.48.0 // indirect
-	golang.org/x/time v0.15.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
-	google.golang.org/grpc v1.83.2 // indirect
+	golang.org/x/time v0.16.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20261005182115-fad411399dd8 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20261005182115-fad411399dd8 // indirect
+	google.golang.org/grpc v1.84.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	modernc.org/libc v1.75.6 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
diff --git a/go.sum b/go.sum
index 8fa96cfe9..5cfedc398 100644
--- a/go.sum
+++ b/go.sum
@@ -1,11 +1,19 @@
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260709200747-435963d16310.1 h1:fXh8CsdNpjRr8R5vFdqtIxPt/Lno2IIJlYOdZBIZn0w=
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260709200747-435963d16310.1/go.mod h1:tvtbpgaVXZX4g6Pn+AnzFycuRK3MOz5HJfEGeEllXYM=
+buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-20260825204119-511051f7f437.2 h1:NbnlmV26O7oZ1iM5tsCI+GEx+3ZSdrhvnKQ/eWSrLiY=
+buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-20260825204119-511051f7f437.2/go.mod h1:TCt1lluMFnctISJXvkIQ4x3ABrPuUKCWKyjKdkJNBpw=
 buf.build/go/protovalidate v1.2.0 h1:DQVrUWkmGTBij+kOYv/x2LLxwcLaGKMdzShj1/6/3H0=
 buf.build/go/protovalidate v1.2.0/go.mod h1:7rYiQEhqvAipoazpVNBBH2S2f8bjG4huMVy1V2Yofn4=
+buf.build/go/protovalidate v1.4.0 h1:UjLrYbt5VX7+TMOs2+pG5FhZhIG1mSfK4EIopbb4LcM=
+buf.build/go/protovalidate v1.4.0/go.mod h1:8vJfzNT6NIG2qm3uFsJDXMlRmG+bQJzbcIn1Aa0vPGs=
 buf.build/go/protoyaml v0.7.0 h1:z4oVoFicbpPefhT7WAykxUdfp0yEQlhMQ2mCZOY5V38=
 buf.build/go/protoyaml v0.7.0/go.mod h1:+a0cavd0uMvirb87xdu2ZMMmjlIQoiH/N2Ich5MGSQ0=
+cel.dev/cel-go v0.32.0 h1:irvpFKr5EuGPyxeME03ERh0rii1TX+BDAnB9eL3IvNk=
+cel.dev/cel-go v0.32.0/go.mod h1:DnVip7tpJSsgZymwfT+m1tnEVy3ivAjSMXPx12YrMkU=
 cel.dev/expr v0.25.2 h1:K6j46C81hXtZQfuX60cVWQFBJahKSE2gfRbNuvr5bFs=
 cel.dev/expr v0.25.2/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
+cel.dev/expr v0.25.3 h1:A2jO8jwOugrrovveCWfj0KEZOfqiLgAcwjpHPhzIGw0=
+cel.dev/expr v0.25.3/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
 charm.land/bubbletea/v2 v2.0.9 h1:DpJCMWKgzQK8SJv4zbKKFHAI10ymWy/evClPFk0k0f8=
 charm.land/bubbletea/v2 v2.0.9/go.mod h1:2SkdgoTXluXJHOUwAoRlRXF/28vklb1rFl6GcgV1/ss=
 charm.land/lipgloss/v2 v2.0.6 h1:EaGKeuA8FvF+v2BT5VmZd2LoYLaMZJXA5n34th8nCIQ=
@@ -79,6 +87,7 @@ github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
 github.com/florianl/go-tc v0.4.8 h1:hgmakUX1Nm0Ba1I0ZkbUl9CH6HbRwqSiwipnpmYp3Es=
 github.com/florianl/go-tc v0.4.8/go.mod h1:B8GeOEnmrbOnxZtaCvsYJcgIzzmM8c/AIhtfCZsDj3Q=
 github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
@@ -151,6 +160,8 @@ github.com/jxskiss/base62 v1.1.0 h1:A5zbF8v8WXx2xixnAKD2w+abC+sIzYJX+nxmhA6HWFw=
 github.com/jxskiss/base62 v1.1.0/go.mod h1:HhWAlUXvxKThfOlZbcuFzsqwtF5TcqS9ru3y5GfjWAc=
 github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=
 github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.20.1 h1:T7kKElXUMXrUJ2E9QhQhxFtcK5rPyLdsGZvdbLMPdiQ=
+github.com/klauspost/compress v1.20.1/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
 github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
 github.com/koron/go-ssdp v0.0.4 h1:1IDwrghSKYM7yLf7XCzbByg2sJ/JcNOZRXS2jczTwz0=
@@ -168,22 +179,32 @@ github.com/libp2p/go-netroute v0.2.1 h1:V8kVrpD8GK0Riv15/7VN6RbUQ3URNZVosw7H2v9t
 github.com/libp2p/go-netroute v0.2.1/go.mod h1:hraioZr0fhBjG0ZRXJJ6Zj2IVEVNx6tDTFQfSmcq7mQ=
 github.com/lithammer/shortuuid/v4 v4.2.0 h1:LMFOzVB3996a7b8aBuEXxqOBflbfPQAiVzkIcHO0h8c=
 github.com/lithammer/shortuuid/v4 v4.2.0/go.mod h1:D5noHZ2oFw/YaKCfGy0YxyE7M0wMbezmMjPdhyEFe6Y=
+github.com/lithammer/shortuuid/v4 v4.3.0 h1:XRr80OYPOlqxgnCv2/iuElkl/ZtXtPtLKk2AvpXGdWA=
+github.com/lithammer/shortuuid/v4 v4.3.0/go.mod h1:D5noHZ2oFw/YaKCfGy0YxyE7M0wMbezmMjPdhyEFe6Y=
 github.com/livekit/livekit-server v1.13.6 h1:vvLufsmzMG9ueZ6BqSahasC8rUH1toSv4979fOY9uQI=
 github.com/livekit/livekit-server v1.13.6/go.mod h1:Dxd+bHclL+F08/T8TlZkxjSRYXCHObLo+ujPRc7h7MM=
+github.com/livekit/livekit-server v1.13.9 h1:HPKsWMDF+fXWX7mrXD4Cul5L9X8dSZ6KOjXlBm1m4tk=
+github.com/livekit/livekit-server v1.13.9/go.mod h1:yF0PoK9MxarCECGVj/MWKsEbH9t4SQmn1CL0dEXQ3Ks=
 github.com/livekit/mageutil v0.0.0-20250511045019-0f1ff63f7731 h1:9x+U2HGLrSw5ATTo469PQPkqzdoU7be46ryiCDO3boc=
 github.com/livekit/mageutil v0.0.0-20250511045019-0f1ff63f7731/go.mod h1:Rs3MhFwutWhGwmY1VQsygw28z5bWcnEYmS1OG9OxjOQ=
 github.com/livekit/mediatransportutil v0.0.0-20260821083140-f234b534b095 h1:BcliKAXoMhl/nWmzQweQ5kmh4Qqagxl4s3Z5pvM/7AY=
 github.com/livekit/mediatransportutil v0.0.0-20260821083140-f234b534b095/go.mod h1:o8CFmAdrVwzJNOCsQCLUzXRjokkufNshnQHOe4fRaqU=
 github.com/livekit/protocol v1.50.5-0.20260821144838-17c16cf496fd h1:pGWIR9fw1eC699v2njRX/7Y+baEXB7p6k9CvDg2uVrQ=
 github.com/livekit/protocol v1.50.5-0.20260821144838-17c16cf496fd/go.mod h1:h4wP4IBPkT5aew7SZSGViHSmanKAiKWsHij/5YfL4BE=
+github.com/livekit/protocol v1.52.2-0.20261007103317-a935cd67c29a h1:Sa9+0Kr+MVIabmJaBFtX8Yl3NYewkv02/mMDvLEKYiQ=
+github.com/livekit/protocol v1.52.2-0.20261007103317-a935cd67c29a/go.mod h1:k7v95/DNhMkslMeBxdQ+lQ6gKc8hMNGYB7t0+6sEGU4=
 github.com/livekit/psrpc v0.7.3 h1:bekuZt/ZQzg8+/M8G6G5jq7bvV9fAKdPHSOZeTwrIIc=
 github.com/livekit/psrpc v0.7.3/go.mod h1:rAI+m2+/cb4x9RXhLRtUx5ZwdfjjXOl4zi46IjEetaw=
+github.com/livekit/psrpc v0.8.2 h1:7tbkhBJoYlK5Csfkdv1XYbZjyAQeaEZgupvIXNCv7Dc=
+github.com/livekit/psrpc v0.8.2/go.mod h1:6KnU8vULoizX0Er9NNfeKJDV8ug87j3fuo19M0bhj6Q=
 github.com/livekit/server-sdk-go/v2 v2.14.0 h1:yy7LsR1+64DHC2i4DxZe1xX4ScVq+S3CvgpvHRruEec=
 github.com/livekit/server-sdk-go/v2 v2.14.0/go.mod h1:+HCKTpzV21b/jvBtu+OmWbquUxaL74kHLI9ZwKmdhKU=
 github.com/lucasb-eyer/go-colorful v1.4.1 h1:1EO+WB73+EH8EVbzlrG3KLAfEypQWVHIBqlTf+2hNss=
 github.com/lucasb-eyer/go-colorful v1.4.1/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/mackerelio/go-osstat v0.2.8 h1:I2duicTaCGWoM53XwAwA9OIe1inu0xnVs8/pqOWWVr4=
 github.com/mackerelio/go-osstat v0.2.8/go.mod h1:SyS3XxKdoSKJnTGTkN5Yrh6VUQVuAURACfE6y+2DN4k=
+github.com/magefile/mage v1.17.2 h1:fyXVu1eadI8Ap1HCCNgEhJ5McIWiYhLR8uol64ZZc40=
+github.com/magefile/mage v1.17.2/go.mod h1:Yj51kqllmsgFpvvSzgrZPK9WtluG3kUhFaBUVLo4feA=
 github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
 github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
@@ -213,14 +234,18 @@ github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3N
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/moby/api v1.55.0 h1:2/sexvQyqIWS8pRSCFddBfpW2qE7vR7FCL+vN8pxwMc=
 github.com/moby/moby/api v1.55.0/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
+github.com/moby/moby/api v1.56.0 h1:GQzua3NA599ASSIICx0iFgiJeO9YkdDARvQsm23ZZuQ=
 github.com/moby/moby/client v0.5.1 h1:tYNaJno4c0HXz12y5BiqEDy0rVTYkWzI26lGvnTMiJw=
 github.com/moby/moby/client v0.5.1/go.mod h1:odLstlZ6uSnfvAgVxMpvgmb8SUdd+siH2T0GBuxVAlM=
+github.com/moby/moby/client v0.6.0 h1:AJjEB21QPbXSXjDsZorFBoDZPhMrfbpaPLgSMAW9Bgs=
 github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
 github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/nats-io/nats.go v1.52.0 h1:n3avV4VBsCgsdwh71TppsTwtv+QdPs7ntSKM8qJLGsc=
 github.com/nats-io/nats.go v1.52.0/go.mod h1:26HypzazeOkyO3/mqd1zZd53STJN0EjCYF9Uy2ZOBno=
+github.com/nats-io/nats.go v1.53.1 h1:Otsq3uLc/kLdjmkNHkXH0jBqwUquwdKFoe3fq6/3/Xo=
+github.com/nats-io/nats.go v1.53.1/go.mod h1:26HypzazeOkyO3/mqd1zZd53STJN0EjCYF9Uy2ZOBno=
 github.com/nats-io/nkeys v0.4.16 h1:rd5oAuLOb8mnAycB0xleuEBNS1pVVnN0fv/FF34Eypg=
 github.com/nats-io/nkeys v0.4.16/go.mod h1:llLgWoI0o4z/Q57q2R1kHfmocyhGV6VG/U18Glg1Afs=
 github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
@@ -235,6 +260,8 @@ github.com/ory/dockertest/v4 v4.0.0 h1:i19aFsO/VXE0VrMk4ifnKW4G/KIJ93PCjLOslxXoP
 github.com/ory/dockertest/v4 v4.0.0/go.mod h1:b5Ofu8VIxWNhXFvQcLu17pRNQdoUBKtXBW74G4Ygzx8=
 github.com/petermattis/goid v0.0.0-20260725062400-500c67a39b75 h1:VmZ6mKVkxavKEhEy4ZYyV7BwBYBFBP0TwIqmLk84fpU=
 github.com/petermattis/goid v0.0.0-20260725062400-500c67a39b75/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
+github.com/petermattis/goid v0.0.0-20260918085751-abfca077860b h1:OzNsuVdSWGwXvWKTtChx9ve89k4cFJ6NxYM4Aw4/f+E=
+github.com/petermattis/goid v0.0.0-20260918085751-abfca077860b/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
 github.com/pion/datachannel v1.6.3 h1:HZAYLpunVI0xi057ZiANl558d0uSpomcWw4UEPz3qXs=
 github.com/pion/datachannel v1.6.3/go.mod h1:oRmkXVVXxkUbqa8MatgdNHW29kvtQY3HUdjJQsfv2GE=
 github.com/pion/dtls/v3 v3.1.10 h1:HWC+QCZitP/ApADS/6+g7UIw2YmLgoK3CsynnjPJgMo=
@@ -275,10 +302,16 @@ github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59u
 github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/client_model v0.6.3 h1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=
+github.com/prometheus/client_model v0.6.3/go.mod h1:gpN5P9S7Rr6Yr92PiQ+Ixvhf6JZEkF1dnxsYL2aPBEM=
 github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY=
 github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc=
+github.com/prometheus/common v0.72.0 h1:tAYsE+sPJxIncDAobm4H5aQjmox9ZxEIIqPbiffa8G4=
+github.com/prometheus/common v0.72.0/go.mod h1:77NWqAQ2tXT7BIK40qjJdw5Acrsrg1TlHAnsQi3i6mk=
 github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
 github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
+github.com/prometheus/procfs v0.22.0 h1:6q9+/JL9IKAPbCmBrv9n5O5Ty3NKnciV5X7YGw0oics=
+github.com/prometheus/procfs v0.22.0/go.mod h1:CvmFr/GVhIjIvWJZW3tgkODBQMRIf0EyWMQLHCHab58=
 github.com/puzpuzpuz/xsync/v4 v4.5.0 h1:vOSWu6b57/emh+L/Cw0BeQfvxa/cogFywXHeGUxQxAg=
 github.com/puzpuzpuz/xsync/v4 v4.5.0/go.mod h1:VJDmTCJMBt8igNxnkQd86r+8KUeN1quSfNKu5bLYFQo=
 github.com/redis/go-redis/v9 v9.22.0 h1:laDvpYXTJtZLloinw1fA5Kqd6HAEH2XKxOkG/PDq2F0=
@@ -312,18 +345,30 @@ go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI=
 go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
 go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
+go.opentelemetry.io/otel v1.47.0 h1:j7ALJ/zgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM=
+go.opentelemetry.io/otel v1.47.0/go.mod h1:8wS9O2qfXrYrzp6hIF/HOYJJf/wIhFPhR2xLuP+iXQU=
+go.opentelemetry.io/otel/log v1.47.0 h1:cOTS1CcLbSQeZKanGJ+0JpF/+t4PELi3O3bbl2lqCcI=
+go.opentelemetry.io/otel/log v1.47.0/go.mod h1:9byitSQ5pLC6PpqwGXjqdMKya6ZTswHRZh2vvXT33nw=
 go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
 go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
+go.opentelemetry.io/otel/metric v1.47.0 h1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY=
+go.opentelemetry.io/otel/metric v1.47.0/go.mod h1:ADGSXxRrXM6bjbvLo535EstVFlPpPYZm4LBKixjDHwU=
 go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
 go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
+go.opentelemetry.io/otel/sdk v1.46.0 h1:h5CNQQjEbuQXY/JfZtgt3i7HVFV3aHPO2OAwO2eTYPI=
 go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
 go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
 go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
 go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
+go.opentelemetry.io/otel/trace v1.47.0 h1:JOjX/Oci8K94QHddo+bbfya/Ai/nf6/dt9ZfrFNWSrM=
+go.opentelemetry.io/otel/trace v1.47.0/go.mod h1:jNaSLa2PZEYFG6fRjJABAu+bw4FS08uDmPg28lTghu0=
 go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
 go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
+go.uber.org/atomic v1.12.0 h1:BvcXdFKuviU4fTL/f+SxdQ5qJX/Jix8pAkgdUcb3XOE=
+go.uber.org/atomic v1.12.0/go.mod h1:I6c4cg+6HCxRjfjSsYtApoFILnpc0CGUdGkXVqbYVNk=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
@@ -345,6 +390,8 @@ golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
 golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/exp v0.0.0-20260727155853-b88d891fe743 h1:ex206bKw+v3K0dm3andkrIF+ijyQKJG1pLgwQ2PYdQM=
 golang.org/x/exp v0.0.0-20260727155853-b88d891fe743/go.mod h1:EdfpwwqSu+0Li0mzskwHU6FWDV3t9Q+RZDo3QMUtL3Q=
+golang.org/x/exp v0.0.0-20261005173118-76772065c9b0 h1:qUp3i6M39kccSm3OMMIE3tvs7YQWO9rFeCKdk1sSaFk=
+golang.org/x/exp v0.0.0-20261005173118-76772065c9b0/go.mod h1:SRjTzy5WcYqRRqquLUvHeeovSwLO0CZ3xcltZNO4Fck=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
@@ -416,10 +463,13 @@ golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
 golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+golang.org/x/time v0.16.0 h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE=
+golang.org/x/time v0.16.0/go.mod h1:rVKOqvZeKvrDKTQiAHJ7wmwP0RzleSphoEA9RcdLA0s=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
 golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
+golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -427,12 +477,20 @@ gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d h1:FarXi840EJWSHYTN3ERkADbPWjl307+FGrA22KAVjjc=
 google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d/go.mod h1:K/+WGbmBY7aNW1HDw1fJnKYo10i0DkAX6pows00dLig=
+google.golang.org/genproto/googleapis/api v0.0.0-20261005182115-fad411399dd8 h1:cFbkNigDInw+wVTXc+CyhUsoHGJCw0BR6mlNoRVfre0=
+google.golang.org/genproto/googleapis/api v0.0.0-20261005182115-fad411399dd8/go.mod h1:QK6p7IgD7IZEZJBhhSUCib5X2vMOzlrGCGUw2XyVDh0=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d h1:IL4hdHzcUv2l/gcg98/Rj3FbtE6axwqslOW8SW0C+S0=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20261005182115-fad411399dd8 h1:0SXBqli5dnuCKMjI/X3FM226zEaEa0GUcSCJtN1vL2o=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20261005182115-fad411399dd8/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc=
 google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
 google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
+google.golang.org/grpc v1.84.0 h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=
+google.golang.org/grpc v1.84.0/go.mod h1:ljCht0DrxQrXBDRTZp52Qxh3Ffk8CdYm2sj4O2QN2C0=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
diff --git a/internal/app/mediaedge/receiver.go b/internal/app/mediaedge/receiver.go
index 0a10b2d0d..5ca835811 100644
--- a/internal/app/mediaedge/receiver.go
+++ b/internal/app/mediaedge/receiver.go
@@ -372,7 +372,7 @@ func (receiver *Receiver) consumeTrack(track *webrtc.TrackRemote, _ *webrtc.RTPR
 		receiver.videoSSRC = track.SSRC()
 		receiver.mu.Unlock()
 		for {
-			packet, _, err := track.ReadRTP()
+			packet, _, err := forwarding.ReadRTP(track)
 			if err != nil {
 				if !errors.Is(err, io.EOF) {
 					return
@@ -386,7 +386,7 @@ func (receiver *Receiver) consumeTrack(track *webrtc.TrackRemote, _ *webrtc.RTPR
 	if track.Kind() == webrtc.RTPCodecTypeAudio && receiver.audioSource != nil &&
 		strings.EqualFold(track.Codec().MimeType, webrtc.MimeTypeOpus) {
 		for {
-			packet, _, err := track.ReadRTP()
+			packet, _, err := forwarding.ReadRTP(track)
 			if err != nil {
 				return
 			}
diff --git a/internal/media/forwarding/codecs.go b/internal/media/forwarding/codecs.go
index 6dec44476..803852c86 100644
--- a/internal/media/forwarding/codecs.go
+++ b/internal/media/forwarding/codecs.go
@@ -4,9 +4,23 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/pion/interceptor"
+	"github.com/pion/rtp"
 	"github.com/pion/webrtc/v4"
 )
 
+// ReadRTP restores repaired packets using the negotiated codec. Pion v4.2.23
+// can queue RTX before a RID track's first primary read initializes PayloadType,
+// even though Codec is already known. Do not rewrite ordinary packets: their
+// payload type still has to match the source's negotiated identity.
+func ReadRTP(track *webrtc.TrackRemote) (*rtp.Packet, interceptor.Attributes, error) {
+	packet, attributes, err := track.ReadRTP()
+	if err == nil && attributes.Get(webrtc.AttributeRtxPayloadType) != nil {
+		packet.PayloadType = uint8(track.Codec().PayloadType)
+	}
+	return packet, attributes, err
+}
+
 // WithRTX restricts a negotiated offer to one primary codec and its associated
 // repair stream. Selecting a media codec must not discard packet-loss recovery.
 func WithRTX(primary webrtc.RTPCodecParameters, negotiated []webrtc.RTPCodecParameters) []webrtc.RTPCodecParameters {
diff --git a/internal/media/forwarding/rtp_test.go b/internal/media/forwarding/rtp_test.go
new file mode 100644
index 000000000..932342b87
--- /dev/null
+++ b/internal/media/forwarding/rtp_test.go
@@ -0,0 +1,172 @@
+package forwarding
+
+import (
+	"bytes"
+	"context"
+	"net"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/pion/interceptor"
+	"github.com/pion/rtcp"
+	"github.com/pion/rtp"
+	"github.com/pion/webrtc/v4"
+)
+
+// The second repair read begins only after Pion has queued the first repair.
+// This fences the startup race without sleeping or accessing library internals.
+type queuedRepair struct {
+	interceptor.NoOp
+	queued chan struct{}
+	once   sync.Once
+}
+
+func (observer *queuedRepair) NewInterceptor(string) (interceptor.Interceptor, error) {
+	return observer, nil
+}
+
+// Raw Pion tracks leave simulcast extensions to their sender. Mirror a Browser's
+// repaired RID so the receiver binds the retransmission to the original layer.
+func (*queuedRepair) BindLocalStream(info *interceptor.StreamInfo, writer interceptor.RTPWriter) interceptor.RTPWriter {
+	var rid, repaired uint8
+	for _, extension := range info.RTPHeaderExtensions {
+		if extension.URI == publicationRIDExtension {
+			rid = uint8(extension.ID)
+		} else if extension.URI == "urn:ietf:params:rtp-hdrext:sdes:repaired-rtp-stream-id" {
+			repaired = uint8(extension.ID)
+		}
+	}
+	return interceptor.RTPWriterFunc(func(header *rtp.Header, payload []byte, attributes interceptor.Attributes) (int, error) {
+		if header.SSRC == info.SSRCRetransmission && rid != 0 && repaired != 0 {
+			repairedHeader := header.Clone()
+			value := repairedHeader.GetExtension(rid)
+			if err := repairedHeader.DelExtension(rid); err != nil {
+				return 0, err
+			}
+			if err := repairedHeader.SetExtension(repaired, value); err != nil {
+				return 0, err
+			}
+			header = &repairedHeader
+		}
+		return writer.Write(header, payload, attributes)
+	})
+}
+
+func (observer *queuedRepair) BindRemoteStream(info *interceptor.StreamInfo, reader interceptor.RTPReader) interceptor.RTPReader {
+	if !strings.EqualFold(info.MimeType, webrtc.MimeTypeRTX) {
+		return reader
+	}
+	read := false
+	return interceptor.RTPReaderFunc(func(data []byte, attributes interceptor.Attributes) (int, interceptor.Attributes, error) {
+		if read {
+			observer.once.Do(func() { close(observer.queued) })
+		}
+		read = true
+		return reader.Read(data, attributes)
+	})
+}
+
+func TestReadRTPEarlySimulcastRepairRetainsNegotiatedIdentity(t *testing.T) {
+	ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
+	defer cancel()
+	check := func(err error) {
+		t.Helper()
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	observer := &queuedRepair{queued: make(chan struct{})}
+	newPeer := func() *webrtc.PeerConnection {
+		engine := &webrtc.MediaEngine{}
+		check(engine.RegisterDefaultCodecs())
+		registry := &interceptor.Registry{}
+		registry.Add(observer)
+		check(webrtc.RegisterDefaultInterceptors(engine, registry))
+		settings := webrtc.SettingEngine{}
+		settings.SetNetworkTypes([]webrtc.NetworkType{webrtc.NetworkTypeUDP4})
+		settings.SetIncludeLoopbackCandidate(true)
+		settings.SetIPFilter(func(ip net.IP) bool { return ip.IsLoopback() })
+		peer, err := webrtc.NewAPI(webrtc.WithMediaEngine(engine), webrtc.WithInterceptorRegistry(registry),
+			webrtc.WithSettingEngine(settings)).NewPeerConnection(webrtc.Configuration{})
+		check(err)
+		t.Cleanup(func() { _ = peer.Close() })
+		return peer
+	}
+	publisher, subscriber := newPeer(), newPeer()
+	codec := webrtc.RTPCodecCapability{MimeType: webrtc.MimeTypeVP8, ClockRate: 90_000}
+	low, err := webrtc.NewTrackLocalStaticRTP(codec, "screen", "repair", webrtc.WithRTPStreamID("q"))
+	check(err)
+	high, err := webrtc.NewTrackLocalStaticRTP(codec, "screen", "repair", webrtc.WithRTPStreamID("h"))
+	check(err)
+	sender, err := publisher.AddTrack(low)
+	check(err)
+	check(sender.AddEncoding(high))
+	go func() {
+		for {
+			if _, _, err := sender.ReadRTCP(); err != nil {
+				return
+			}
+		}
+	}()
+	tracks := make(chan *webrtc.TrackRemote, 1)
+	subscriber.OnTrack(func(track *webrtc.TrackRemote, _ *webrtc.RTPReceiver) { tracks <- track })
+	negotiate := func(from, to *webrtc.PeerConnection, description webrtc.SessionDescription) {
+		gathered := webrtc.GatheringCompletePromise(from)
+		check(from.SetLocalDescription(description))
+		select {
+		case <-gathered:
+		case <-ctx.Done():
+			t.Fatal(ctx.Err())
+		}
+		check(to.SetRemoteDescription(*from.LocalDescription()))
+	}
+	offer, err := publisher.CreateOffer(nil)
+	check(err)
+	negotiate(publisher, subscriber, offer)
+	answer, err := subscriber.CreateAnswer(nil)
+	check(err)
+	negotiate(subscriber, publisher, answer)
+	packet := &rtp.Packet{Header: rtp.Header{Version: 2, Marker: true, SequenceNumber: 1, Timestamp: 3000}, Payload: []byte{0x10, 0x00}}
+	for _, extension := range sender.GetParameters().HeaderExtensions {
+		switch extension.URI {
+		case "urn:ietf:params:rtp-hdrext:sdes:mid":
+			check(packet.SetExtension(uint8(extension.ID), []byte(publisher.GetTransceivers()[0].Mid())))
+		case publicationRIDExtension:
+			check(packet.SetExtension(uint8(extension.ID), []byte("q")))
+		}
+	}
+	ticker := time.NewTicker(10 * time.Millisecond)
+	defer ticker.Stop()
+	var remote *webrtc.TrackRemote
+	for remote == nil {
+		select {
+		case remote = <-tracks:
+		case <-ticker.C:
+			check(low.WriteRTP(packet))
+		case <-ctx.Done():
+			t.Fatal(ctx.Err())
+		}
+	}
+	check(subscriber.WriteRTCP([]rtcp.Packet{&rtcp.TransportLayerNack{
+		MediaSSRC: uint32(remote.SSRC()), Nacks: []rtcp.NackPair{{PacketID: 1}},
+	}}))
+	select {
+	case <-observer.queued:
+	case <-ctx.Done():
+		t.Fatal("early repair was not queued:", ctx.Err())
+	}
+	check(remote.SetReadDeadline(time.Now().Add(time.Second)))
+	for {
+		received, attributes, err := ReadRTP(remote)
+		check(err)
+		if received.PayloadType != uint8(remote.Codec().PayloadType) || received.SSRC != uint32(remote.SSRC()) ||
+			received.SequenceNumber != packet.SequenceNumber || !bytes.Equal(received.Payload, packet.Payload) {
+			t.Fatalf("repaired packet lost its negotiated identity: payload type=%d, codec=%d", received.PayloadType, remote.Codec().PayloadType)
+		}
+		if attributes.Get(webrtc.AttributeRtxPayloadType) != nil {
+			break
+		}
+	}
+}
diff --git a/internal/media/forwarding/temporal_test.go b/internal/media/forwarding/temporal_test.go
index 3fba1ad85..28ae13564 100644
--- a/internal/media/forwarding/temporal_test.go
+++ b/internal/media/forwarding/temporal_test.go
@@ -8,11 +8,57 @@ import (
 	"time"
 
 	"github.com/livekit/livekit-server/pkg/sfu"
+	"github.com/livekit/livekit-server/pkg/sfu/buffer"
+	"github.com/livekit/mediatransportutil/pkg/codec"
+	"github.com/livekit/protocol/livekit"
+	"github.com/livekit/protocol/logger"
 	"github.com/pion/rtp"
 	"github.com/pion/rtp/codecs"
 	"github.com/pion/webrtc/v4"
 )
 
+// A recovered budget must not admit VP8 frames referencing discarded temporal
+// layers. Exercise the same library forwarder used by Native and SFU DownTracks.
+func TestVP8TemporalRecoveryRequiresDecodableFrames(t *testing.T) {
+	forwarder := sfu.NewForwarder(webrtc.RTPCodecTypeVideo, logger.GetLogger(), true, true, true, nil)
+	forwarder.DetermineCodec(webrtc.RTPCodecCapability{MimeType: webrtc.MimeTypeVP8, ClockRate: 90_000}, nil,
+		livekit.VideoLayer_MODE_UNUSED)
+	forwarder.SetMaxSpatialLayer(0)
+	forwarder.SetMaxPublishedLayer(0)
+	forwarder.SetMaxTemporalLayerSeen(2)
+	for index, step := range []struct {
+		name              string
+		target, tid, want int32
+		key, sync         bool
+	}{
+		{"start at base layer", 0, 0, 0, true, false},
+		{"dependent frame cannot raise layer", 2, 1, 0, false, false},
+		{"sync cannot skip an intermediate layer", 2, 2, 0, false, true},
+		{"first sync restores middle layer", 2, 1, 1, false, true},
+		{"highest dependent frame still waits", 2, 2, 1, false, false},
+		{"next sync restores highest layer", 2, 2, 2, false, true},
+		{"reduce at frame boundary", 0, 2, 0, false, false},
+		{"keyframe restores all layers without sync bit", 2, 0, 2, true, false},
+	} {
+		forwarder.SetMaxTemporalLayer(step.target)
+		forwarder.AllocateOptimal([]int32{0}, sfu.Bitrates{{100_000, 200_000, 300_000}}, false, false)
+		sequence := uint64(index + 1)
+		packet := &buffer.ExtPacket{
+			VideoLayer:        buffer.VideoLayer{Spatial: 0, Temporal: step.tid},
+			ExtSequenceNumber: sequence, ExtTimestamp: sequence * 3000, IsKeyFrame: step.key,
+			Packet: &rtp.Packet{Header: rtp.Header{Version: 2, Marker: true, SSRC: 1000,
+				SequenceNumber: uint16(sequence), Timestamp: uint32(sequence * 3000)}, Payload: []byte{0x10, 0}},
+			Payload: codec.VP8{S: true, T: true, TID: uint8(step.tid), Y: step.sync, IsKeyFrame: step.key},
+		}
+		if _, err := forwarder.GetTranslationParams(packet, 0); err != nil {
+			t.Fatalf("%s: %v", step.name, err)
+		}
+		if got := forwarder.CurrentLayer().Temporal; got != step.want {
+			t.Fatalf("%s: temporal layer %d, want %d", step.name, got, step.want)
+		}
+	}
+}
+
 // Browser VP8 can produce L1T3 even with only one spatial encoding. Both
 // forwarding owners must retain its enhancement frames, not silently cap T0.
 // This exercises RTP forwarding; the Browser gate separately checks decoding.
diff --git a/internal/server/sfu/media.go b/internal/server/sfu/media.go
index d63bcb585..98616192b 100644
--- a/internal/server/sfu/media.go
+++ b/internal/server/sfu/media.go
@@ -454,7 +454,7 @@ func (publication *mediaPublication) consumeTrack(track *webrtc.TrackRemote, rec
 	go publication.readRTCP(track, receiver, source, layer)
 	defer publication.readers.Done()
 	for {
-		packet, _, err := track.ReadRTP()
+		packet, _, err := forwarding.ReadRTP(track)
 		if err != nil {
 			return
 		}
diff --git a/internal/thirdparty/README.md b/internal/thirdparty/README.md
index a7b01a390..28778519c 100644
--- a/internal/thirdparty/README.md
+++ b/internal/thirdparty/README.md
@@ -52,3 +52,15 @@ The retained detector also includes [upstream #4935](https://github.com/livekit/
 and its regression from v1.13.9, adapted to standard Go assertions. Reserved
 TWCC symbols carry no receive delta: skip their measurement rather than consuming
 the next packet's delta or indexing past the feedback array.
+
+## Pion Repaired-Packet Identity
+
+The shared [RTP receive adapter](../media/forwarding/codecs.go) uses the negotiated
+primary codec for packets Pion identifies as repaired. In Pion v4.2.23,
+[`receiveForRid`](https://github.com/pion/webrtc/blob/v4.2.23/rtpreceiver.go)
+initializes the codec before the first primary read initializes `PayloadType`;
+an earlier RTX packet can therefore be queued with payload type zero.
+Ordinary packet validation remains unchanged. A real simulcast/NACK regression
+fences that ordering without sleeps and fails when the correction is removed.
+Remove the adapter when a maintained upstream version passes that same control
+without it; no Pion source fork or second retransmission handler is retained.

From 5ded6f7a9f864a58d56801fb27c9b4ee0fa7e4a3 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 06:23:33 +0800
Subject: [PATCH 237/262] fix(app): retire interrupted control handshakes
 without protocol errors

---
 internal/app/loopback/server.go | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/internal/app/loopback/server.go b/internal/app/loopback/server.go
index a31db0dfc..7b2de1f61 100644
--- a/internal/app/loopback/server.go
+++ b/internal/app/loopback/server.go
@@ -419,7 +419,10 @@ func (server *Server) handleControl(response http.ResponseWriter, request *http.
 	helloContext, cancelHello := context.WithTimeout(claim.ctx, helloTimeout)
 	messageType, payload, err := connection.Read(helloContext)
 	cancelHello()
-	if err != nil || messageType != websocket.MessageText {
+	if err != nil {
+		return
+	}
+	if messageType != websocket.MessageText {
 		closeControl(connection, "hello frame required")
 		return
 	}
@@ -512,13 +515,15 @@ func (server *Server) handleControl(response http.ResponseWriter, request *http.
 		}
 		if message.Type == "ping" {
 			strict, strictErr := decodeRequest(payload)
-			if strictErr != nil || validatePing(strict) != nil ||
-				write(controlContext, controlMessage{
-					Version: ProtocolVersion, ID: message.ID, Type: "pong",
-				}) != nil {
+			if strictErr != nil || validatePing(strict) != nil {
 				closeControl(connection, "invalid control message")
 				return
 			}
+			if write(controlContext, controlMessage{
+				Version: ProtocolVersion, ID: message.ID, Type: "pong",
+			}) != nil {
+				return
+			}
 			continue
 		}
 		if extension == nil {

From 1bad49d920903b1cb945127d7140c41289d52a25 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 06:26:26 +0800
Subject: [PATCH 238/262] fix(audio): bound native Opus packet peaks with the
 upstream encoder

---
 docs/research/browser-screen-audio-quality.md | 11 +++-
 docs/standards/media-quality.md               |  7 ++-
 go.mod                                        |  4 +-
 go.sum                                        |  4 +-
 internal/app/nativeaudio/encoder.go           | 14 ++---
 internal/app/nativeaudio/encoder_test.go      | 52 +++++++++++++++++++
 6 files changed, 79 insertions(+), 13 deletions(-)

diff --git a/docs/research/browser-screen-audio-quality.md b/docs/research/browser-screen-audio-quality.md
index 59cefb5e4..3c056316d 100644
--- a/docs/research/browser-screen-audio-quality.md
+++ b/docs/research/browser-screen-audio-quality.md
@@ -92,10 +92,19 @@ Two controls constrain the replacement design:
 - With native 20 ms frames, the tone/noise check produced maximum Opus payloads
   of 641 bytes at 256 kbps and 801 at 320 kbps. At 510 kbps, all 150 frames
   produced RTP packets larger than a 1200-byte packetizer budget. Pinned
-  [Pion's Opus payloader](https://github.com/pion/rtp/blob/v1.10.2/codecs/opus_packet.go)
+  [Pion's Opus payloader](https://github.com/pion/rtp/blob/v1.10.5/codecs/opus_packet.go)
   keeps each Opus payload intact. This is a packet-size result, not measured
   network loss; accepting the codec's maximum requires a transport/packet-duration
   decision. Do not equate the codec range with every route's safe operating range.
+- Silence/tone/noise/impulse transitions expose a separate peak: the former
+  gopus v0.1.1 encoder produces a 1234-byte payload at 320 kbps. Its single-stream
+  CELT path also ignores the output budget and fails with a smaller buffer.
+  [gopus v0.2.2](https://github.com/thesyncim/gopus/tree/v0.2.2) honors that budget;
+  the adapter now reserves packet overhead at the encoding boundary using
+  [Opus's instantaneous size limit](https://opus-codec.org/docs/opus_api-1.6/group__opus__encoder.html).
+  The retained regression decodes complete 20 ms frames across transients and
+  live bitrate changes. This does not diagnose any field interruption or change
+  the average bitrate controls, stereo format or route model.
 
 The [media extension proposal](./native-client-media.md#audio-and-ui-proposal)
 owns the UI and contract rationale. The candidate enforces a Browser sender's
diff --git a/docs/standards/media-quality.md b/docs/standards/media-quality.md
index f1e24c9ff..2cfc89bf3 100644
--- a/docs/standards/media-quality.md
+++ b/docs/standards/media-quality.md
@@ -408,8 +408,11 @@ Display audio uses `contentHint = "music"`. The 2.0 candidate keeps 64/128/192 k
 shortcuts and the 128 kbps default, with a custom numeric ceiling in the same
 sound settings. Current Browser/native senders support 6..320 kbps; the numeric
 wire format uses Opus's 6..510 kbps bounds independently of those shortcuts.
-The current native 20 ms sender ceiling leaves packet-size headroom; a larger
-codec-valid request fails that operation without retiring native control.
+The native 20 ms encoder also bounds each Opus payload to 1152 bytes, leaving
+48 bytes for RTP/extensions/SRTP within a 1200-byte datagram. An average bitrate
+ceiling alone does not bound VBR peaks; Opus RTP keeps each encoded frame intact.
+A request above the current sender's bitrate ceiling fails that operation
+without retiring native control.
 An audio-only update retains capture, media connections and video startup state.
 
 Browser, Native and SFU receive answers request Opus stereo and the full Opus
diff --git a/go.mod b/go.mod
index 1df8f2876..5fba68043 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/TNTcraftHIM/Piik
 
-go 1.26.9
+go 1.27.2
 
 // Scoped NAT-PMP fixes; provenance and removal criteria: internal/thirdparty/README.md.
 replace github.com/netbirdio/go-nat => ./internal/thirdparty/go-nat
@@ -31,7 +31,7 @@ require (
 	github.com/pion/transport/v5 v5.1.1
 	github.com/pion/turn/v5 v5.1.2
 	github.com/pion/webrtc/v4 v4.2.23
-	github.com/thesyncim/gopus v0.1.1
+	github.com/thesyncim/gopus v0.2.2
 	go.uber.org/zap v1.28.0
 	golang.org/x/crypto v0.57.0
 	golang.org/x/mod v0.41.0
diff --git a/go.sum b/go.sum
index 5cfedc398..99d433e09 100644
--- a/go.sum
+++ b/go.sum
@@ -329,8 +329,8 @@ github.com/shoenig/test v1.7.0 h1:eWcHtTXa6QLnBvm0jgEabMRN/uJ4DMV3M8xUGgRkZmk=
 github.com/shoenig/test v1.7.0/go.mod h1:UxJ6u/x2v/TNs/LoLxBNJRV9DiwBBKYxXSyczsBHFoI=
 github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
 github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
-github.com/thesyncim/gopus v0.1.1 h1:SM58S7VZGnEZ3ZR0pX5AoC33//LBxJhKkvm15MbBmik=
-github.com/thesyncim/gopus v0.1.1/go.mod h1:orRqwrGs5gqYRRnhqwI0Y3liqQTeDkreUpra+Kv9bQc=
+github.com/thesyncim/gopus v0.2.2 h1:Ib8mmsLBon6ylXVk6p7fLxuZNnBzfPA4wT4GBzfWqCI=
+github.com/thesyncim/gopus v0.2.2/go.mod h1:uENpqeR6V8WrMhH5vLJARzFgpMgXJBl5M0cg54LgoA0=
 github.com/twitchtv/twirp v8.1.3+incompatible h1:+F4TdErPgSUbMZMwp13Q/KgDVuI7HJXP61mNV3/7iuU=
 github.com/twitchtv/twirp v8.1.3+incompatible/go.mod h1:RRJoFSAmTEh2weEqWtpPE3vFK5YBhA6bqp2l1kfCC5A=
 github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU=
diff --git a/internal/app/nativeaudio/encoder.go b/internal/app/nativeaudio/encoder.go
index 08fad30df..0f17e4dde 100644
--- a/internal/app/nativeaudio/encoder.go
+++ b/internal/app/nativeaudio/encoder.go
@@ -8,15 +8,17 @@ import (
 )
 
 const (
-	SampleRate     = 48_000
-	Channels       = 2
-	FrameSamples   = 960
-	FrameBytes     = FrameSamples * Channels * 2
-	MaxPacketBytes = 4_000
+	SampleRate   = 48_000
+	Channels     = 2
+	FrameSamples = 960
+	FrameBytes   = FrameSamples * Channels * 2
+	// Opus RTP keeps each frame intact. Bound VBR peaks at the encoder, reserving
+	// 48 bytes for RTP, header extensions and SRTP within a 1200-byte datagram.
+	MaxPacketBytes = 1_152
 	DefaultBitrate = 128_000
 	MinBitrate     = 6_000
 	MaxBitrate     = 510_000
-	// The 20 ms sender leaves RTP/SRTP headroom within an ordinary 1200-byte packet.
+	// Keep the 20 ms target below the per-packet ceiling, including VBR headroom.
 	MaxSendBitrate    = 320_000
 	defaultComplexity = 5
 )
diff --git a/internal/app/nativeaudio/encoder_test.go b/internal/app/nativeaudio/encoder_test.go
index fb8008aad..091d75aaf 100644
--- a/internal/app/nativeaudio/encoder_test.go
+++ b/internal/app/nativeaudio/encoder_test.go
@@ -3,6 +3,7 @@ package nativeaudio
 import (
 	"encoding/binary"
 	"math"
+	"math/rand/v2"
 	"testing"
 
 	gopus "github.com/thesyncim/gopus"
@@ -200,3 +201,54 @@ func TestEncodeSteadyStateAllocationIsBounded(t *testing.T) {
 		t.Fatalf("steady-state Opus encoding allocated %.1f objects", allocations)
 	}
 }
+
+func TestEncodeBoundsTransientPacketsAcrossBitrateChanges(t *testing.T) {
+	encoder, err := NewEncoder(DefaultBitrate)
+	if err != nil {
+		t.Fatal(err)
+	}
+	decoder, err := gopus.NewDecoder(gopus.DefaultDecoderConfig(SampleRate, Channels))
+	if err != nil {
+		t.Fatal(err)
+	}
+	pcm := make([]byte, FrameBytes)
+	decoded := make([]int16, FrameSamples*Channels)
+	random := rand.New(rand.NewPCG(472, 20261014))
+	for _, bitrate := range []int{DefaultBitrate, MaxSendBitrate, MinBitrate, 12_345, MaxSendBitrate} {
+		if err := encoder.SetBitrate(bitrate); err != nil {
+			t.Fatal(err)
+		}
+		for block := range 100 {
+			for frame := range FrameSamples {
+				for channel := range Channels {
+					sample := 0.0
+					switch (block / 10) % 5 {
+					case 1:
+						sample = 26_000 * math.Sin(2*math.Pi*float64(500+channel*1000)*float64(block*FrameSamples+frame)/SampleRate)
+					case 2:
+						sample = 32_767 * (random.Float64()*2 - 1)
+					case 3:
+						if frame < 10 {
+							sample = 32_767
+						}
+					case 4:
+						sample = float64(32_767 - 65_535*(frame%2))
+					}
+					binary.LittleEndian.PutUint16(pcm[(frame*Channels+channel)*2:], uint16(int16(sample)))
+				}
+			}
+			packet, err := encoder.Encode(pcm)
+			if err != nil {
+				t.Fatalf("encode %d bps block %d: %v", bitrate, block, err)
+			}
+			// Opus RTP cannot fragment a frame. Reserve RTP/extensions/SRTP space.
+			if len(packet)+48 > 1200 {
+				t.Fatalf("%d bps block %d exceeded packet budget: %d payload bytes", bitrate, block, len(packet))
+			}
+			count, err := decoder.DecodeInt16(packet, decoded)
+			if err != nil || count != FrameSamples {
+				t.Fatalf("decode %d bps block %d: %d samples, %v", bitrate, block, count, err)
+			}
+		}
+	}
+}

From f74a4fee7b4ea9f60ce45b151a3fab9fc72c5be6 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 06:32:37 +0800
Subject: [PATCH 239/262] docs: align toolchain guidance and pending media
 acceptance

---
 docs/README.md                       | 2 +-
 docs/deployment.md                   | 3 ++-
 docs/research/native-client-media.md | 4 ++--
 docs/todo.md                         | 8 ++++++++
 4 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/docs/README.md b/docs/README.md
index 1e43eed6d..2fcd189f3 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -34,7 +34,7 @@ Technical references keep one shared version.
 
 You can try the Browser application locally with Node from
 [.node-version](../.node-version), npm from
-[package.json](../package.json), and Go 1.26 from [go.mod](../go.mod).
+[package.json](../package.json), and Go from [go.mod](../go.mod).
 Run these commands from the repository root.
 
 Start the web UI:
diff --git a/docs/deployment.md b/docs/deployment.md
index c1019f099..9d523c9d7 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -33,7 +33,8 @@ backup; Git and immutable artifacts own history.
 
 ## Build Host
 
-Start from a clean exact revision with Node.js 24, npm 11, and Go 1.26:
+Start from a clean exact revision using Node from [`.node-version`](../.node-version),
+npm from [`package.json`](../package.json), and Go from [`go.mod`](../go.mod):
 
 ```sh
 npm ci
diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 88eefc14b..6f69a8a16 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -118,8 +118,8 @@ congestion behavior or a paired no-Site Browser media session.
 The audio adapter uses `github.com/thesyncim/gopus` behind the private
 `nativeaudio` boundary. It accepts fixed 48 kHz stereo PCM16/20 ms frames,
 encodes into a caller-owned Opus buffer, and can be replaced without changing
-the media edge or control wire. The dependency is BSD-3-Clause licensed and
-requires Go 1.25; App CI follows the toolchain declared in [go.mod](../../go.mod).
+the media edge or control wire. The dependency is BSD-3-Clause licensed;
+App CI follows the toolchain declared in [go.mod](../../go.mod).
 
 ## Current Boundary
 
diff --git a/docs/todo.md b/docs/todo.md
index d296de569..ac78ed696 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -16,6 +16,14 @@ Git/PRs own completed history.
   Retain the assertions and correlate input-buffer, forwarder and egress
   diagnostics on recurrence before assigning a product cause or changing forwarding.
 
+- [ ] **Windows native media acceptance on the current desktop.** The default
+  720p SFU gate misses its sustained-frame threshold on both the previous and
+  current audio dependencies. A capture-only WGC control also receives about
+  3.8 fps from the same animated window, before encoding or transport. The
+  smaller-picture gate passes live audio changes and recovery; it does not
+  replace this throughput check. Retest with a normally presenting capture
+  source before assigning a product regression or relaxing the assertion.
+
 - [ ] **2.0 candidate preparation and acceptance.** The owner reopened investigation,
   useful improvements and outstanding acceptance on 2026-10-07, and on 2026-10-09
   chose to hold the maintenance changes for 2.0 rather than publish them separately.

From a00aff3b9ef4e9d42f4050c9d274fa5a3d70bf3a Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 07:08:35 +0800
Subject: [PATCH 240/262] docs: clarify native capture acceptance boundary

---
 docs/todo.md | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/docs/todo.md b/docs/todo.md
index ac78ed696..59529db00 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -18,11 +18,12 @@ Git/PRs own completed history.
 
 - [ ] **Windows native media acceptance on the current desktop.** The default
   720p SFU gate misses its sustained-frame threshold on both the previous and
-  current audio dependencies. A capture-only WGC control also receives about
-  3.8 fps from the same animated window, before encoding or transport. The
-  smaller-picture gate passes live audio changes and recovery; it does not
-  replace this throughput check. Retest with a normally presenting capture
-  source before assigning a product regression or relaxing the assertion.
+  current audio dependencies. Capture-only WGC controls receive about 3.8 fps,
+  including an independent window repainting at about 40 fps, before encoding
+  or transport. This desktop currently exposes only a virtual display; its
+  capture slowdown has no confirmed driver cause. Retest the unchanged gate on
+  a physical display. The smaller-picture gate passes live audio changes and
+  recovery but does not replace this throughput check.
 
 - [ ] **2.0 candidate preparation and acceptance.** The owner reopened investigation,
   useful improvements and outstanding acceptance on 2026-10-07, and on 2026-10-09

From b9d6aba2ac8eda74edabb0e82bcc9ace46041cc2 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 07:31:37 +0800
Subject: [PATCH 241/262] test: preserve RTP timeout diagnostics for sparse
 layers

---
 internal/app/mediaedge/edge_test.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/internal/app/mediaedge/edge_test.go b/internal/app/mediaedge/edge_test.go
index 87f65ddb7..b9ad9494e 100644
--- a/internal/app/mediaedge/edge_test.go
+++ b/internal/app/mediaedge/edge_test.go
@@ -926,7 +926,9 @@ func waitPacket(t *testing.T, packets <-chan *rtp.Packet, edges ...*Edge) *rtp.P
 				edge.transport.Output.State(), edge.transport.Egress(), edge.source.media.DebugInfo())
 			t.Logf("forwarder=%+v", edge.transport.Output.DebugInfo())
 			for index, input := range edge.source.media.GetAllBuffers() {
-				t.Logf("input=%d stats=%+v", index, input.GetStats())
+				if input != nil {
+					t.Logf("input=%d stats=%+v", index, input.GetStats())
+				}
 			}
 		}
 		t.Fatal("timed out waiting for RTP")

From 81f44a4126c7d3dc875511e55de87f4378af2fa8 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 07:42:53 +0800
Subject: [PATCH 242/262] fix(app): retain accepted launch after page
 cancellation

---
 internal/app/launcher/server.go      | 10 +++-------
 internal/app/launcher/server_test.go | 29 ++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+), 7 deletions(-)

diff --git a/internal/app/launcher/server.go b/internal/app/launcher/server.go
index d7a1a3c0e..028f8ed3f 100644
--- a/internal/app/launcher/server.go
+++ b/internal/app/launcher/server.go
@@ -360,13 +360,9 @@ func (server *Server) handleLaunch(response http.ResponseWriter, request *http.R
 		return
 	}
 
-	select {
-	case server.selection <- selection:
-	case <-request.Context().Done():
-		return
-	case <-server.ctx.Done():
-		return
-	}
+	// Begin commits this one selection to the App, independently of the page.
+	// The single-slot queue cannot block: only the accepted request writes it.
+	server.selection <- selection
 	select {
 	case <-server.resultReady:
 	case <-request.Context().Done():
diff --git a/internal/app/launcher/server_test.go b/internal/app/launcher/server_test.go
index 743a68219..96cb227ee 100644
--- a/internal/app/launcher/server_test.go
+++ b/internal/app/launcher/server_test.go
@@ -2,11 +2,13 @@ package launcher
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"errors"
 	"io"
 	"io/fs"
 	"net/http"
+	"net/http/httptest"
 	"net/url"
 	"runtime"
 	"strings"
@@ -119,6 +121,33 @@ func TestRoomFailureInvalidatesReadyTargetButKeepsSiteApprovalAvailable(t *testi
 	}
 }
 
+func TestLauncherRetainsAcceptedSelectionAfterRequestCancellation(t *testing.T) {
+	// Cancellation may race the handoff, but cannot discard an accepted launch.
+	for range 32 {
+		server := &Server{
+			ctx:         t.Context(),
+			selection:   make(chan Selection, 1),
+			resultReady: make(chan struct{}),
+		}
+		ctx, cancel := context.WithCancel(t.Context())
+		request := httptest.NewRequestWithContext(ctx, http.MethodPost, "/api/client-launcher/launch",
+			strings.NewReader(`{"mode":"link","language":"en"}`))
+		cancel()
+		server.handleLaunch(httptest.NewRecorder(), request)
+		select {
+		case selection := <-server.Selection():
+			if selection != (Selection{Mode: ModeLink, Language: "en"}) {
+				t.Fatalf("selection = %+v", selection)
+			}
+		default:
+			t.Fatal("cancelled Browser request left the App starting without a selection")
+		}
+		if server.Begin() {
+			t.Fatal("cancelled Browser request allowed a second launch")
+		}
+	}
+}
+
 func TestLauncherIncludesTheInjectedBuildVersionAndRevision(t *testing.T) {
 	const version = "v1.2.3"
 	const revision = "0123456789abcdef0123456789abcdef01234567"

From abb45797fe3219bf3bc2b75b6babf41851ce3772 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 07:56:46 +0800
Subject: [PATCH 243/262] fix(sfu): admit supported publisher bitrate ceilings

---
 internal/server/sfu/media.go      |  3 ++-
 internal/server/sfu/media_test.go | 34 ++++++++++++++++++++++++++++++-
 2 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/internal/server/sfu/media.go b/internal/server/sfu/media.go
index 98616192b..6c4a0184f 100644
--- a/internal/server/sfu/media.go
+++ b/internal/server/sfu/media.go
@@ -128,8 +128,9 @@ func validPublicationMedia(metadata PublicationMedia) bool {
 	}
 	for index, format := range metadata.Formats {
 		// These are this SFU's admission bounds, not the descriptive wire format.
+		// Forward the full current Browser/Native bitrate range without transcoding.
 		if format.Width == 0 || format.Width > 8192 || format.Height == 0 || format.Height > 8192 ||
-			format.Bitrate == 0 || format.Bitrate > 100_000_000 ||
+			format.Bitrate == 0 || format.Bitrate > 240_000_000 ||
 			len(metadata.RIDs[index]) > 16 ||
 			(metadata.RIDs[index] == "" && len(metadata.RIDs) != 1) ||
 			slices.Contains(metadata.RIDs[:index], metadata.RIDs[index]) {
diff --git a/internal/server/sfu/media_test.go b/internal/server/sfu/media_test.go
index 9ad2c1c83..5ef40aee5 100644
--- a/internal/server/sfu/media_test.go
+++ b/internal/server/sfu/media_test.go
@@ -36,7 +36,7 @@ func TestUnsupportedPublicationDescriptionDoesNotAllocate(t *testing.T) {
 	fence := ResourceFence{RoomID: "1234", ShareGeneration: "share_12345678", PublicationGeneration: "publication_12345678"}
 	for _, format := range []forwarding.LayerFormat{
 		{Width: 32768, Height: 32768, Bitrate: 5_000_000},
-		{Width: 1920, Height: 1080, Bitrate: 200_000_000},
+		{Width: 1920, Height: 1080, Bitrate: 240_000_001},
 		{Width: 0xffff_ffff, Height: 0xffff_ffff, Bitrate: 0xffff_ffff},
 	} {
 		metadata := PublicationMedia{Codec: "vp8", RIDs: []string{""}, Formats: []forwarding.LayerFormat{format}}
@@ -49,6 +49,38 @@ func TestUnsupportedPublicationDescriptionDoesNotAllocate(t *testing.T) {
 	}
 }
 
+func TestPublicationAdmitsSupportedBitrateCeilings(t *testing.T) {
+	service := NewMedia(MediaOptions{})
+	defer service.Close()
+	fence := ResourceFence{RoomID: "1234", ShareGeneration: "share_12345678", PublicationGeneration: "publication_12345678"}
+	metadata := PublicationMedia{Codec: "h264", RIDs: []string{""},
+		Formats: []forwarding.LayerFormat{{Width: 1920, Height: 1080, Bitrate: 240_000_000}}}
+	if err := service.PreparePublication(fence, "publisher_12345678", metadata); err != nil {
+		t.Fatalf("prepare supported publisher: %v", err)
+	}
+	publication, err := service.publication(fence, "publisher_12345678")
+	if err != nil {
+		t.Fatal(err)
+	}
+	pc := publication.pc
+	for _, bitrate := range []uint32{5_000_000, 100_000_001, 240_000_000} {
+		metadata.Formats[0].Bitrate = bitrate
+		if err := service.UpdatePublication(fence, "publisher_12345678", metadata); err != nil {
+			t.Fatalf("update supported ceiling %d: %v", bitrate, err)
+		}
+		if publication.pc != pc || publication.metadata.Formats[0].Bitrate != bitrate {
+			t.Fatal("quality update replaced the publication or lost its bitrate ceiling")
+		}
+	}
+	metadata.Formats[0].Bitrate++
+	if err := service.UpdatePublication(fence, "publisher_12345678", metadata); err == nil {
+		t.Fatal("unsupported update was admitted")
+	}
+	if publication.pc != pc || publication.metadata.Formats[0].Bitrate != 240_000_000 {
+		t.Fatal("rejected update changed the existing publication")
+	}
+}
+
 func TestMediaDemandBootstrapsWaitingSubscriberAndStopsAfterExactClose(t *testing.T) {
 	ctx, cancel := context.WithTimeout(t.Context(), 3*time.Second)
 	defer cancel()

From 8008a76281735fff0765e1d80b14fcf9a77ec234 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 08:14:19 +0800
Subject: [PATCH 244/262] fix(web): retire abandoned room replacements

---
 src/client/pages/HostPage.tsx        |  9 ++++-
 tests/host-quality-ownership.test.ts | 57 ++++++++++++++++++++++++++++
 2 files changed, 65 insertions(+), 1 deletion(-)

diff --git a/src/client/pages/HostPage.tsx b/src/client/pages/HostPage.tsx
index f9cf70066..bdef4e604 100644
--- a/src/client/pages/HostPage.tsx
+++ b/src/client/pages/HostPage.tsx
@@ -1048,6 +1048,10 @@ export function HostPage({
         profile.roomPassword,
       );
       const replacement = hostRoomFromCreated(response);
+      if (roomMutationRef.current !== mutation) {
+        closeAbandonedRoom(replacement);
+        return;
+      }
       if (wasSharing) {
         endSharing({ key: "host.roomReplaced" }, false, "share-ended", "off", false);
       } else if (signalRef.current) {
@@ -1058,6 +1062,7 @@ export function HostPage({
         replacement,
         () => roomMutationRef.current === mutation,
       ))) {
+        closeAbandonedRoom(replacement);
         throw new Error("Host room is already open in another tab");
       }
       writePreferredRoom(replacement.roomId);
@@ -1072,6 +1077,7 @@ export function HostPage({
       }
       setPhase(wasSharing ? "ended" : "idle");
     } catch (error) {
+      if (roomMutationRef.current !== mutation) return;
       if (error instanceof ApiError && error.status === 404) {
         if (!wasSharing) {
           // A memory-only room can disappear after a server restart.
@@ -1098,6 +1104,7 @@ export function HostPage({
               replacement,
               () => roomMutationRef.current === mutation,
             ))) {
+              closeAbandonedRoom(replacement);
               throw new Error("Host room is already open in another tab");
             }
             writePreferredRoom(replacement.roomId);
@@ -1111,7 +1118,7 @@ export function HostPage({
             setPhase("idle");
             return;
           } catch (replacementError) {
-            setNoticeError(replacementError, "room");
+            if (roomMutationRef.current === mutation) setNoticeError(replacementError, "room");
             return;
           }
         }
diff --git a/tests/host-quality-ownership.test.ts b/tests/host-quality-ownership.test.ts
index add2c70f6..d02366ccd 100644
--- a/tests/host-quality-ownership.test.ts
+++ b/tests/host-quality-ownership.test.ts
@@ -376,6 +376,63 @@ describe("Host room ownership", () => {
     expect(current.roomMutationRef.current).toBeNull();
   });
 
+  it.each(["replace", "missing-room"] as const)("retires an unclaimed %s result after page exit", async path => {
+    for (const stage of ["response", "claim", "accepted"] as const) {
+      const current = roomFixture();
+      current.context.phase = "idle";
+      current.activeGenerationRef.current = null;
+      const replacement = { ...current.room, roomId: "5678", hostToken: "replacement-token" };
+      const response = deferred<typeof replacement>();
+      const claim = deferred<void>();
+      const writeHostRoom = vi.fn(async (_room: unknown, owns: () => boolean) => {
+        await claim.promise;
+        return owns();
+      });
+      const closeAbandonedRoom = vi.fn();
+      const request = vi.fn(() => response.promise);
+      Object.assign(current.context, {
+        replaceOwnedRoom: path === "replace" ? request : async () => { throw new ApiError("Room not found", 404); },
+        createRoom: request, hostRoomFromCreated: (room: unknown) => room,
+        replaceViewerInvite: vi.fn(), writeHostRoom, closeAbandonedRoom,
+      });
+      const replacing = current.context.replaceCurrentRoom();
+      await vi.waitFor(() => expect(request).toHaveBeenCalledOnce());
+      if (stage === "response") current.roomMutationRef.current = null;
+      response.resolve(replacement);
+      if (stage === "claim") {
+        await vi.waitFor(() => expect(writeHostRoom).toHaveBeenCalledOnce());
+        current.roomMutationRef.current = null;
+      }
+      claim.resolve();
+      await replacing;
+      if (stage === "accepted") {
+        expect(closeAbandonedRoom).not.toHaveBeenCalled();
+        expect(current.roomRef.current).toBe(replacement);
+        expect(current.setRoom).toHaveBeenCalledWith(replacement);
+      } else {
+        expect(closeAbandonedRoom).toHaveBeenCalledExactlyOnceWith(replacement);
+        expect(current.roomRef.current).toBe(current.room);
+        expect(current.setRoom).not.toHaveBeenCalled();
+        expect(current.setNoticeError).not.toHaveBeenCalled();
+        if (stage === "response") expect(writeHostRoom).not.toHaveBeenCalled();
+      }
+    }
+  });
+
+  it("does not recreate a missing room after its replacement operation was retired", async () => {
+    const current = roomFixture();
+    current.context.phase = "idle";
+    current.activeGenerationRef.current = null;
+    const response = deferred<never>();
+    current.context.replaceOwnedRoom = () => response.promise;
+    const replacing = current.context.replaceCurrentRoom();
+    current.roomMutationRef.current = null;
+    response.reject(new ApiError("Room not found", 404));
+    await replacing;
+    expect(current.createRoom).not.toHaveBeenCalled();
+    expect(current.setNoticeError).not.toHaveBeenCalled();
+  });
+
   it("ignores an old room's failed access update after another room owns the session", () => {
     const current = roomFixture();
     useRealResourceDisposal(current);

From 6241a4ea43147e154e93758b639032d7e754d053 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 08:45:03 +0800
Subject: [PATCH 245/262] fix(media): retain available layers during discovery

---
 docs/todo.md                             |  6 ------
 internal/media/forwarding/output.go      |  5 +++++
 internal/media/forwarding/output_test.go | 10 ++++++++--
 3 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/docs/todo.md b/docs/todo.md
index 59529db00..49e45dc7e 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -10,12 +10,6 @@ Git/PRs own completed history.
 
 ## Now
 
-- [ ] **Intermittent RTP clock-check timeout.** Linux CI intermittently times out
-  waiting for the second packet in the existing timestamp/generation checks.
-  Local repetitions and explicit source pauses did not reproduce the timeout.
-  Retain the assertions and correlate input-buffer, forwarder and egress
-  diagnostics on recurrence before assigning a product cause or changing forwarding.
-
 - [ ] **Windows native media acceptance on the current desktop.** The default
   720p SFU gate misses its sustained-frame threshold on both the previous and
   current audio dependencies. Capture-only WGC controls receive about 3.8 fps,
diff --git a/internal/media/forwarding/output.go b/internal/media/forwarding/output.go
index dd440926a..91cec7a7d 100644
--- a/internal/media/forwarding/output.go
+++ b/internal/media/forwarding/output.go
@@ -72,6 +72,11 @@ func (output *Output) reconcileLocked() {
 		return
 	}
 	available, rates := output.Receiver().GetLayeredBitrate()
+	if len(available) > 0 {
+		// Availability can precede LiveKit's asynchronous discovery notification.
+		// Apply that observed layer before allocation can invalidate its target.
+		output.DownTrack.UpTrackMaxPublishedLayerChange(slices.Max(available))
+	}
 	measured := false
 	for _, layer := range available {
 		if rates[layer][0] > 0 {
diff --git a/internal/media/forwarding/output_test.go b/internal/media/forwarding/output_test.go
index f4d897555..825f6494a 100644
--- a/internal/media/forwarding/output_test.go
+++ b/internal/media/forwarding/output_test.go
@@ -68,12 +68,18 @@ func TestOutputUsesLibraryAllocationAndExactLifetime(t *testing.T) {
 	defer output.Close()
 	output.SetMaxSpatialLayer(2)
 	output.SetMaxTemporalLayer(0)
-	output.UpTrackMaxPublishedLayerChange(2)
-	output.UpTrackMaxTemporalLayerSeenChange(0)
 	if state := output.State(); state.Target != -1 || state.Current != -1 {
 		t.Fatalf("unmeasured source pretended to have a target: %+v", state)
 	}
+	// LiveKit publishes layer discovery asynchronously. Availability can arrive
+	// first; allocation must use that observation without waiting for its notice.
 	receiver.available = []int32{0}
+	output.UpTrackLayersChange()
+	if state := output.State(); state.Target != 0 || state.Paused {
+		t.Fatalf("available source waited for its discovery notification: %+v", state)
+	}
+	output.UpTrackMaxPublishedLayerChange(2)
+	output.UpTrackMaxTemporalLayerSeenChange(0)
 	output.SetBudget(0)
 	if state := output.State(); !state.Paused || state.Prepare != -1 || state.VideoBudget != 0 {
 		t.Fatalf("bootstrap ignored an exhausted video budget: %+v", state)

From 409d975e1817fcc9c3382f6668def8fb16e45afb Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 09:28:18 +0800
Subject: [PATCH 246/262] fix(server): serialize storage shutdown with room
 writes

---
 .github/workflows/repository-hygiene.yml |   2 +-
 CONTRIBUTING.md                          |   6 +-
 internal/server/app/app.go               |   6 +-
 internal/server/app/shutdown_test.go     | 120 +++++++++++++++++++++++
 internal/server/signal/server.go         |   8 ++
 scripts/check-go.mjs                     |   1 +
 6 files changed, 138 insertions(+), 5 deletions(-)
 create mode 100644 internal/server/app/shutdown_test.go

diff --git a/.github/workflows/repository-hygiene.yml b/.github/workflows/repository-hygiene.yml
index 2d787dc7d..cccd3e960 100644
--- a/.github/workflows/repository-hygiene.yml
+++ b/.github/workflows/repository-hygiene.yml
@@ -116,7 +116,7 @@ jobs:
         run: npm run check:go-core
       - name: Check reachable Go vulnerabilities
         run: npm run check:go-vuln
-      - name: Check NAT and media ownership with the race detector
+      - name: Check concurrent resource ownership with the race detector
         run: npm run check:go-race
       - name: Type-check and test
         run: npm run typecheck && npm test
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 571d769b0..71b8cf2b8 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -111,9 +111,9 @@ does not establish coverage.
   The server core is Go, so its acceptance runs here. It builds the Web UI first when
   that output is missing, because both binaries embed it. CI invokes these same
   package commands rather than rebuilding their steps in YAML.
-- `npm run check:go-race` checks port mapping, media-edge ownership and their
-  scoped NAT dependencies with Go's race detector. It requires a supported cgo
-  toolchain; CI runs it on Linux.
+- `npm run check:go-race` checks port mapping, media-edge ownership, service
+  storage shutdown and scoped NAT dependencies with Go's race detector. It
+  requires a supported cgo toolchain; CI runs it on Linux.
 - `npm run check:go-vuln` checks the App and Server entry points and their
   dependencies against the Go vulnerability database. CI uses the Go version
   declared in `go.mod`; update that owner for required toolchain security fixes.
diff --git a/internal/server/app/app.go b/internal/server/app/app.go
index 7a7ae1d4c..f507d2725 100644
--- a/internal/server/app/app.go
+++ b/internal/server/app/app.go
@@ -384,7 +384,11 @@ func (s *Server) runShutdown(ctx context.Context, endRooms bool) error {
 	// The signaling server must be closed before the listener: its connections
 	// live on it.
 	failures = append(failures, s.stopServing(ctx))
-	failures = append(failures, s.store.Close())
+	if signaling != nil {
+		failures = append(failures, signaling.CloseStorage())
+	} else {
+		failures = append(failures, s.store.Close())
+	}
 	if joined := errors.Join(failures...); joined != nil {
 		return fmt.Errorf("Piik server shutdown failed: %w", joined)
 	}
diff --git a/internal/server/app/shutdown_test.go b/internal/server/app/shutdown_test.go
new file mode 100644
index 000000000..be9457884
--- /dev/null
+++ b/internal/server/app/shutdown_test.go
@@ -0,0 +1,120 @@
+package app
+
+import (
+	"context"
+	"crypto/rand"
+	"errors"
+	"io"
+	"net/http"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/TNTcraftHIM/Piik/internal/server/room"
+)
+
+type admittedBody struct {
+	io.ReadCloser
+	beforeRead func()
+}
+
+func (body *admittedBody) Read(p []byte) (int, error) {
+	if before := body.beforeRead; before != nil {
+		body.beforeRead = nil
+		before()
+	}
+	return body.ReadCloser.Read(p)
+}
+
+func TestShutdownDoesNotCloseStorageDuringAnAdmittedRoomWrite(t *testing.T) {
+	admitted, readBody := make(chan struct{}), make(chan struct{})
+	mutating, finishMutation := make(chan struct{}), make(chan struct{})
+	for _, gate := range []chan struct{}{readBody, finishMutation} {
+		defer func() {
+			select {
+			case <-gate:
+			default:
+				close(gate)
+			}
+		}()
+	}
+	database, err := room.NewDatabase(filepath.Join(t.TempDir(), "rooms.sqlite"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	store, err := room.New(room.Options{
+		MaxRooms: room.Capacity, MaxViewersPerRoom: 20, Database: database,
+		Random: func(size int) []byte {
+			// Hold an actual creation inside the signaling-owned store mutation.
+			if size == 32 {
+				close(mutating)
+				<-finishMutation
+			}
+			value := make([]byte, size)
+			_, _ = rand.Read(value)
+			return value
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	configuration := testConfig(t)
+	configuration.SiteAccessPassword = ""
+	server := newServer(t, Options{Config: configuration, RoomStore: store})
+	server.httpServer.Handler = http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		request.Body = &admittedBody{ReadCloser: request.Body, beforeRead: func() {
+			close(admitted)
+			<-readBody
+		}}
+		server.ServeHTTP(writer, request)
+	})
+	port, err := server.Listen(t.Context())
+	if err != nil {
+		t.Fatal(err)
+	}
+	h := &harness{Server: server, t: t, baseURL: baseURL(port), client: testClient(t)}
+	response := make(chan reply, 1)
+	go func() { response <- h.createRoom(roomRequest{codeEntryPolicy: "open"}) }()
+	<-admitted
+
+	// HTTP draining starts after signaling closes. An already admitted body
+	// can still finish and enter a store mutation during that drain.
+	draining := make(chan struct{})
+	server.httpServer.RegisterOnShutdown(func() { close(draining) })
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	closed := make(chan error, 1)
+	go func() { closed <- server.Close(ctx) }()
+	<-draining
+	close(readBody)
+	<-mutating
+	cancel()
+	var closeErr error
+	returned := false
+	select {
+	case closeErr = <-closed:
+		returned = true
+	case <-time.After(100 * time.Millisecond):
+	}
+	close(finishMutation)
+	result := <-response
+	if !returned {
+		closeErr = <-closed
+	}
+	if returned {
+		t.Error("shutdown closed room storage while an admitted mutation still owned it")
+	}
+	if !errors.Is(closeErr, context.Canceled) {
+		t.Fatalf("shutdown error = %v, want the HTTP drain cancellation", closeErr)
+	}
+	result.expectStatus(http.StatusCreated)
+
+	restored, err := database.Initialize()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer database.Close()
+	if len(restored) != 1 || restored[0].RoomID != result.room().RoomID {
+		t.Fatalf("the accepted write was not restored: got %d rooms", len(restored))
+	}
+}
diff --git a/internal/server/signal/server.go b/internal/server/signal/server.go
index bb68f3fb0..34803f5a0 100644
--- a/internal/server/signal/server.go
+++ b/internal/server/signal/server.go
@@ -475,6 +475,14 @@ func (s *Server) Close(ctx context.Context) error {
 	return routeCloseError
 }
 
+// CloseStorage follows HTTP draining. A timed-out drain can leave admitted
+// mutations running, so database closure still takes the store's owning lock.
+func (s *Server) CloseStorage() error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.store.Close()
+}
+
 // EndAllRooms closes rooms in store order.
 func (s *Server) EndAllRooms() error {
 	s.mu.Lock()
diff --git a/scripts/check-go.mjs b/scripts/check-go.mjs
index efcccaf25..b757add8a 100644
--- a/scripts/check-go.mjs
+++ b/scripts/check-go.mjs
@@ -221,6 +221,7 @@ if (mode === "--race") {
   buildWebAssets();
   runGoTests(process.env.PIIK_GO?.trim() || "go", [
     "./internal/app/portmapping", "./internal/app/mediaedge",
+    "./internal/server/app",
     "github.com/netbirdio/go-nat/...", "github.com/jackpal/go-nat-pmp",
   ], ["-race", "-count=1", "-timeout=2m"]);
 } else {

From a5e89805812f3ccc049672cce11f71cd83d7a2a0 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 09:43:11 +0800
Subject: [PATCH 247/262] docs(sfu): clarify resource ownership and retirement

---
 internal/server/sfu/admission.go | 37 +++++++++++---------------------
 1 file changed, 13 insertions(+), 24 deletions(-)

diff --git a/internal/server/sfu/admission.go b/internal/server/sfu/admission.go
index 943057dea..b96e061ce 100644
--- a/internal/server/sfu/admission.go
+++ b/internal/server/sfu/admission.go
@@ -8,36 +8,30 @@ import (
 	"github.com/TNTcraftHIM/Piik/internal/server/protocol"
 )
 
-// ResourceFence is SfuResourceFence. It is a comparable value, so the
-// TypeScript cloneFence/sameFence helpers are a plain copy and `==`.
+// ResourceFence identifies one publication generation within a room share.
 type ResourceFence struct {
 	RoomID                string
 	ShareGeneration       string
 	PublicationGeneration string
 }
 
-// SubscriptionFence is SfuSubscriptionFence, which extends SfuResourceFence.
-// The embedded value is the `{ ...fence, viewerPeerId }` spread the router
-// uses to derive one from a publication fence.
+// SubscriptionFence identifies one Viewer's connection to that publication.
 type SubscriptionFence struct {
 	ResourceFence
 	ViewerPeerID string
 	ConnectionID string
 }
 
-// Usage is SfuResourceUsage.
 type Usage struct {
 	Ingress int
 	Egress  int
 }
 
-// AdmissionOptions is SfuResourceAdmissionOptions.
 type AdmissionOptions struct {
 	IngressCapacity int
 	EgressCapacity  int
 }
 
-// resourceState is the TypeScript ResourceState union.
 type resourceState string
 
 const (
@@ -54,21 +48,19 @@ type subscriptionEntry struct {
 type publicationEntry struct {
 	fence ResourceFence
 	state resourceState
-	// Ordering site: subscriptions are only counted, looked up by viewer and
-	// state-scanned, so their iteration order is never observable. A plain map
-	// is enough here; the two maps above it are ordered.
+	// Subscriptions are counted and looked up by exact connection; their
+	// iteration order does not affect drain order.
 	subscriptions map[string]*subscriptionEntry
 }
 
-// roomPublications is RoomResources.publications. Ordering site: commitPublication
-// returns the drained generations and beginDrainRoom returns every generation in
-// insertion order, both of which the router turns into drain tasks.
+// Publication insertion order determines the router's physical drain order.
 type roomPublications = ordered.Map[string, *publicationEntry]
 
-// Admission is SfuResourceAdmission: the ingress/egress ledger for the embedded SFU. It is not safe for concurrent use; the signaling server calls it
-// under its global mutex, exactly as Node's single thread did.
+// Admission tracks reserved, committed and draining SFU capacity. The signaling
+// server serializes access under its mutex; capacity stays charged until physical
+// retirement is confirmed through CompleteDrain or CompleteSubscriptionDrain.
 type Admission struct {
-	// Ordering site: beginDrainAll walks the rooms in insertion order.
+	// BeginDrainAll also preserves room insertion order.
 	rooms           ordered.Map[string, *roomPublications]
 	ingressCapacity int
 	egressCapacity  int
@@ -76,9 +68,7 @@ type Admission struct {
 	egressInUse     int
 }
 
-// NewAdmission mirrors the SfuResourceAdmission constructor. An invalid
-// capacity panics where the TypeScript throws: the capacities come from a
-// constant and from validated configuration, so this is an assertion.
+// NewAdmission requires capacities from validated configuration.
 func NewAdmission(options AdmissionOptions) *Admission {
 	assertPositiveSafeInteger(options.IngressCapacity, "SFU ingress capacity")
 	assertPositiveSafeInteger(options.EgressCapacity, "SFU egress capacity")
@@ -145,8 +135,9 @@ func (admission *Admission) ReserveSubscription(fence SubscriptionFence) bool {
 	return true
 }
 
-// CommitPublication returns false as its second result where TypeScript returns
-// null; an empty slice with true is its empty array.
+// CommitPublication promotes the reserved publication and subscriptions and
+// returns older committed publications for physical retirement. The boolean
+// reports acceptance; a repeated commit succeeds without scheduling another drain.
 func (admission *Admission) CommitPublication(fence ResourceFence) ([]ResourceFence, bool) {
 	assertFence(fence)
 	room, _ := admission.rooms.Get(fence.RoomID)
@@ -366,8 +357,6 @@ func assertSubscriptionFence(fence SubscriptionFence) {
 	}
 }
 
-// Go's int makes the Number.isSafeInteger fractional case unrepresentable; only the
-// range checks survive.
 func assertPositiveSafeInteger(value int, name string) {
 	if value <= 0 || int64(value) > protocol.MaxSafeInteger {
 		panic(name + " must be a positive safe integer")

From ca075d95f032ded5937ead262dad68b439144a43 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 11:22:24 +0800
Subject: [PATCH 248/262] docs: clarify Windows encoding performance checks

---
 docs/guide/troubleshooting.md                | 10 +++++++++-
 docs/guide/troubleshooting.zh-CN.md          |  7 ++++++-
 docs/research/realtime-quality-adaptation.md | 13 ++++++++++++-
 3 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/docs/guide/troubleshooting.md b/docs/guide/troubleshooting.md
index dfb8dbfd9..3cc9d9c5e 100644
--- a/docs/guide/troubleshooting.md
+++ b/docs/guide/troubleshooting.md
@@ -241,7 +241,15 @@ If it recurs or never recovers, compare the following:
    rate under **Settings → Picture**, and check CPU/GPU load while the game runs.
    An affected viewer can compare another browser or a phone hotspot. Increasing
    bitrate does not necessarily help.
-3. **Save reports from the affected period.** Enable diagnostics on the host and
+3. **Check the actual codec.** Open the host's **Show connection details** and
+   read **Video codec**. On Windows, Auto may select VP8 when H264 is unavailable,
+   its check cannot finish, or it cannot sustain the selected frame rate.
+   Software encoding competes with the game for CPU time. For **Browser** capture,
+   follow the [graphics checks](#h264-sharing-fails-on-windows), or compare the App's
+   window/screen capture. The App tries available hardware encoders independently.
+   VP8 alone does not establish a GPU fault; forcing H264 after a failed check may
+   make performance worse.
+4. **Save reports from the affected period.** Enable diagnostics on the host and
    affected viewer pages before reproducing; App capture also needs an App report.
    Try **Reconnect** if the picture does not recover. Export before refreshing.
 
diff --git a/docs/guide/troubleshooting.zh-CN.md b/docs/guide/troubleshooting.zh-CN.md
index 0c0cc40de..ed19e6c89 100644
--- a/docs/guide/troubleshooting.zh-CN.md
+++ b/docs/guide/troubleshooting.zh-CN.md
@@ -203,7 +203,12 @@ App 的 **公网邀请** 通过 Cloudflare Tunnel 提供临时网页地址。
 2. **一次调整一项。** 房主可在 **设置 → 画面** 中先试较低的分辨率或帧率，
    检查游戏运行时 CPU／GPU 是否接近满载；受影响的观众可用另一浏览器或手机热点对照。
    将码率调高不一定有帮助。
-3. **保留问题发生时的报告。** 在房主和受影响的观众页面开启诊断后重现，
+3. **查看实际编码。** 展开房主的 **显示连接详情**，查看 **视频编码**。Windows 上，
+   「自动」选择 VP8 可能是 H264 不可用、未能完成检测，或检测未达到所选帧率；
+   软件编码会与游戏争用 CPU。使用「浏览器」选源时，可按[显卡排查](#windows-上-h264-分享失败)
+   检查图形设置，或对照 App 的窗口／屏幕采集。App 会独立尝试可用的硬件编码器。
+   不要仅凭 VP8 判断显卡故障，也不必强制使用检测未通过的 H264。
+4. **保留问题发生时的报告。** 在房主和受影响的观众页面开启诊断后重现，
    App 采集还需 App 报告。画面持续不恢复时可尝试 **重新连接**；请先导出报告再刷新页面。
 
 如果分享已自动停止，查看电视下方的具体原因，并按[分享启动排查](#选源后无法开始分享)操作；
diff --git a/docs/research/realtime-quality-adaptation.md b/docs/research/realtime-quality-adaptation.md
index ed567676d..f987f8aa3 100644
--- a/docs/research/realtime-quality-adaptation.md
+++ b/docs/research/realtime-quality-adaptation.md
@@ -175,11 +175,13 @@ This isolates the observed AMD failure to outer bitrate-control/frame-drop
 interaction, not a fixed MFT throughput ceiling. The page cannot enable the
 process feature, override Chromium's AMD workaround, or select a different MFT.
 
-Upstream status checked on 2026-09-28: Chromium main's
+Upstream status checked on 2026-10-14: Chromium main's
 [driver bug list](https://raw.githubusercontent.com/chromium/chromium/main/gpu/config/gpu_driver_bug_list.json)
 entry 449 still disables H.264 software bitrate control on AMD Windows without
 a driver-version exception
 ([crbug 417752242](https://issues.chromium.org/issues/417752242)).
+The [AMD override](https://raw.githubusercontent.com/chromium/chromium/main/media/gpu/windows/mf_video_encoder_switches.cc)
+also remains disabled by default in main and Chrome 154.0.8037.98.
 This source establishes the Browser workaround, not the state of every AMD
 driver or native device. The earlier measured low-cadence output supports keeping
 an actual-output gate rather than inferring compatibility from a device name.
@@ -187,6 +189,15 @@ Windows native Auto likewise measures through its live pipeline, including the
 untrusted rate controller and frame dropper. Matching native AMD physical
 evidence remains pending.
 
+Chromium's separate [2026-10-06 MFVEA repair](https://chromium.googlesource.com/chromium/src/+/b12ee1f641ce7de36d6c5c97b1b3ee5d3f6090c9)
+recreates software rate control when the encoded dimensions change; its stated
+trigger is a VP9 rate controller failing when resolution increases. It neither
+removes the AMD H264 workaround above nor establishes restored cadence on the
+affected devices. Browser GPU preference can change the chosen hardware path,
+but integrated versus discrete GPU is not a reliable encoder-quality rule.
+Native selection already tries available adapter/encoder candidates; changing
+Chrome's preference does not select the App's capture device.
+
 Later exact Browser cohorts demonstrated why runtime evidence is useful:
 
 | Path | Actual encoder | Source / encoded / decoded | Result |

From 3198de25470ee405385e1758bfb4085750211eba Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 11:49:52 +0800
Subject: [PATCH 249/262] docs(network): record full candidate laboratory
 validation

---
 docs/research/network-lab.md | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/docs/research/network-lab.md b/docs/research/network-lab.md
index f61c93073..37beb91f6 100644
--- a/docs/research/network-lab.md
+++ b/docs/research/network-lab.md
@@ -131,11 +131,13 @@ game quality. Frame cadence, bitrate, loss, repair, freezes and QP remain separa
 measurements. These longer cases cap captures at 500,000 packets, retaining only
 each packet's first 96 bytes; ordinary cases keep their 100,000-packet bound.
 
-The [full process acceptance](https://github.com/TNTcraftHIM/Piik/actions/runs/38300988699)
-on 2026-10-13 passed all 19 scenarios and five negative controls, including
-resource cleanup and unchanged host networking. Sixteen scenarios produced
-advancing decoded audio/video; blocked UDP and the two random-mapping profiles
-produced bounded unavailability. A passing failure observation is not a
+The [full process acceptance](https://github.com/TNTcraftHIM/Piik/actions/runs/38505151190)
+on 2026-10-14 passed all 37 scenarios and six negative controls on candidate
+`a5e89805`, including resource cleanup and unchanged host networking. Thirty-one
+scenarios produced advancing decoded audio/video. Blocked UDP, the two
+random-mapping profiles and the three Browser-containing sequential-mapping
+cases produced bounded unavailability; there were no observation timeouts.
+A passing failure observation is not a
 successful connection or an Internet success-rate measurement.
 The [paired comparison](https://github.com/TNTcraftHIM/Piik/actions/runs/38301455274)
 also passed eight trials across two seeds with alternating enhancement on/off

From 8a578a906bc1e27458bf233876e7b8364df6c51a Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 16:25:30 +0800
Subject: [PATCH 250/262] fix(capture): stop failed cadence probes early

---
 docs/standards/media-quality.md               |  6 ++-
 native/capture/windows/main.cpp               |  6 ++-
 native/capture/windows/output_worker.test.cpp | 37 ++++++++++++-------
 3 files changed, 32 insertions(+), 17 deletions(-)

diff --git a/docs/standards/media-quality.md b/docs/standards/media-quality.md
index 2cfc89bf3..9249c19d9 100644
--- a/docs/standards/media-quality.md
+++ b/docs/standards/media-quality.md
@@ -240,8 +240,10 @@ dropper, with the Browser probe's warmup, one-second sample and 100 ms lag
 allowance. Cold-start lag is excluded from the measured window; the selection
 deadline still bounds warmup and hardware input/output waits. A candidate whose
 measured delivery falls outside that allowance is rejected and the next candidate
-is tried within the four-second budget. The probe retires before the live encoder
-is prepared and proved, so selection requires only one hardware session at a time.
+is tried within the four-second budget. A measured frame deficit beyond that
+allowance ends the probe immediately: remaining frames cannot change its result.
+The probe retires before the live encoder is prepared and proved, so selection
+requires only one hardware session at a time.
 Without a sustaining candidate, Auto starts the ordinary VP8 path directly, as manual VP8 does. A
 faster software encode never replaces a sustaining H264 encoder. Encoder readiness
 uses Media Foundation events rather than timer-based polling.
diff --git a/native/capture/windows/main.cpp b/native/capture/windows/main.cpp
index 7f650f23b..2a49b017e 100644
--- a/native/capture/windows/main.cpp
+++ b/native/capture/windows/main.cpp
@@ -1270,7 +1270,11 @@ bool SustainsEncodedCadence(const AdaptiveEncoder::Factory& create, ID3D11Device
         profile.bit_rate, deadline);
     RequireEncoderTime(deadline);
     if (frame >= warmup_frames && EncoderClock::now() > due + interval * lag) return false;
-    if (frame >= warmup_frames && output && !output->access_unit.bytes.empty()) ++delivered;
+    if (frame >= warmup_frames) {
+      if (output && !output->access_unit.bytes.empty()) ++delivered;
+      // Even perfect delivery of the remaining frames cannot recover this deficit.
+      if (frame - warmup_frames + 1 - delivered > lag) return false;
+    }
   }
   return delivered > 0 && delivered + lag >= sample_frames;
 }
diff --git a/native/capture/windows/output_worker.test.cpp b/native/capture/windows/output_worker.test.cpp
index a5316e7f0..9c2072c28 100644
--- a/native/capture/windows/output_worker.test.cpp
+++ b/native/capture/windows/output_worker.test.cpp
@@ -227,9 +227,10 @@ void CheckEncoderCandidates() {
 
 class CadenceFixtureEncoder final : public VideoEncoder {
  public:
-  CadenceFixtureEncoder(std::chrono::milliseconds latency, bool dropped, bool cold_only)
+  CadenceFixtureEncoder(std::chrono::milliseconds latency, UINT32 dropped, bool cold_only,
+                        UINT32& calls)
       : VideoEncoder(OutputKind::h264, "cadence-fixture", "cadence-fixture"),
-        latency_(latency), dropped_(dropped), cold_only_(cold_only) {}
+        latency_(latency), dropped_(dropped), cold_only_(cold_only), calls_(calls) {}
 
   EncodedAccessUnit Encode(ID3D11Texture2D*, UINT64 timestamp, bool key,
       EncoderClock::time_point deadline) override {
@@ -237,15 +238,15 @@ class CadenceFixtureEncoder final : public VideoEncoder {
     ++calls_;
     RequireEncoderTime(deadline);
     // An empty unit stands for an input the pipeline did not encode.
-    return dropped_ ? EncodedAccessUnit{timestamp, key, {}} : EncodedAccessUnit{timestamp, key, {1, 2, 3}};
+    return calls_ <= dropped_ ? EncodedAccessUnit{timestamp, key, {}} : EncodedAccessUnit{timestamp, key, {1, 2, 3}};
   }
   void SetBitrate(UINT32) override {}
 
  private:
   std::chrono::milliseconds latency_;
-  bool dropped_;
+  UINT32 dropped_;
   bool cold_only_;
-  unsigned calls_ = 0;
+  UINT32& calls_;
 };
 
 void CheckAutoCadenceProbe(ID3D11Device* device) {
@@ -255,25 +256,33 @@ void CheckAutoCadenceProbe(ID3D11Device* device) {
   VideoProfile profile;
   profile.width = 64;
   profile.height = 64;
-  auto probe = [&](std::chrono::milliseconds latency, bool dropped,
+  UINT32 calls = 0;
+  auto probe = [&](std::chrono::milliseconds latency, UINT32 dropped,
                    EncoderClock::time_point deadline, bool cold_only = false) {
-    return SustainsEncodedCadence([=](const VideoProfile&) -> std::unique_ptr<VideoEncoder> {
-      return std::make_unique<CadenceFixtureEncoder>(latency, dropped, cold_only);
+    calls = 0;
+    return SustainsEncodedCadence([=, &calls](const VideoProfile&) -> std::unique_ptr<VideoEncoder> {
+      return std::make_unique<CadenceFixtureEncoder>(latency, dropped, cold_only, calls);
     }, device, profile, deadline);
   };
   const auto deadline = EncoderClock::now() + std::chrono::seconds(30);
   // Valid output at a fraction of the source rate is the driver defect Auto rejects.
-  assert(!probe(std::chrono::milliseconds(0), true, deadline));
+  assert(!probe(std::chrono::milliseconds(0), UINT32_MAX, deadline));
+  const UINT32 warmup = (profile.frame_rate + 1) / 2;
+  // Once missing frames exceed the allowance, even perfect remaining frames cannot pass.
+  assert(calls == warmup + CadenceLagFrames(profile.frame_rate) + 1);
+  // Exactly the allowed loss must still complete and pass the original measurement.
+  assert(probe(std::chrono::milliseconds(0), warmup + CadenceLagFrames(profile.frame_rate), deadline));
+  assert(calls == warmup + profile.frame_rate);
   // Cold startup must not reject an encoder that sustains the measured cadence.
-  assert(probe(std::chrono::milliseconds(220), false, deadline, true));
+  assert(probe(std::chrono::milliseconds(220), 0, deadline, true));
   // Sustained slow encoding still fails after warmup.
-  assert(!probe(std::chrono::milliseconds(300), false, deadline));
+  assert(!probe(std::chrono::milliseconds(300), 0, deadline));
   profile.frame_rate = 1;
-  assert(!probe(std::chrono::milliseconds(0), true, deadline));
-  assert(probe(std::chrono::milliseconds(0), false, deadline));
+  assert(!probe(std::chrono::milliseconds(0), UINT32_MAX, deadline));
+  assert(probe(std::chrono::milliseconds(0), 0, deadline));
   bool expired = false;
   try {
-    probe(std::chrono::milliseconds(0), false, EncoderClock::time_point::min());
+    probe(std::chrono::milliseconds(0), 0, EncoderClock::time_point::min());
   } catch (const GateFailure& error) {
     expired = error.stage() == "codec-probe-timeout";
   }

From b9b4ccdc9bab10b5c27adf84ea936ae564c6f8b4 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 16:41:50 +0800
Subject: [PATCH 251/262] docs: align candidate acceptance with owner review

---
 docs/status.md |  7 ++++---
 docs/todo.md   | 15 ++++++++-------
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/docs/status.md b/docs/status.md
index 148341c7e..29aea5f07 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -1,6 +1,6 @@
 # Current Status
 
-Last updated: 2026-10-13
+Last updated: 2026-10-14
 
 This is the compact execution/deployment index. Product modules own behavior,
 [verification status](./verification-status.md) owns unresolved physical limits,
@@ -88,8 +88,9 @@ An independent bounded Native UDP preparation now augments existing retries
 under ADR-0009. Actual App process checks cover socket adoption, decoded media
 and reverse feedback through sequential kernel NAT, as well as ineligible
 preparation continuing ordinary ICE. The [network laboratory](./research/network-lab.md)
-owns paired outcomes and evidence limits. The owner's field beta remains open;
-this does not establish a public success rate or remove Browser-only operation.
+owns paired outcomes and evidence limits. A separate field beta is not required
+for the owner's final review; local acceptance does not establish a public
+success rate or remove Browser-only operation.
 The original candidate packages pass their identity/checksum checks; Windows
 Local startup/retirement, saved Site approval/revocation and explicit 1.x
 rejection have packaged acceptance evidence. Publication remains subject to
diff --git a/docs/todo.md b/docs/todo.md
index 49e45dc7e..826fbaa10 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -14,8 +14,8 @@ Git/PRs own completed history.
   720p SFU gate misses its sustained-frame threshold on both the previous and
   current audio dependencies. Capture-only WGC controls receive about 3.8 fps,
   including an independent window repainting at about 40 fps, before encoding
-  or transport. This desktop currently exposes only a virtual display; its
-  capture slowdown has no confirmed driver cause. Retest the unchanged gate on
+  or transport. The current capture session exposes only a virtual display;
+  its slowdown has no confirmed driver cause. Retest the unchanged gate on
   a physical display. The smaller-picture gate passes live audio changes and
   recovery but does not replace this throughput check.
 
@@ -25,9 +25,10 @@ Git/PRs own completed history.
   Present the frozen candidate and its bilingual release notes for owner review
   before publication. Packaged Windows Local startup/retirement, saved Site
   approval/revocation and both directions of 1.x compatibility rejection have
-  passed. Broader device coverage below does not override the owner's platform
-  deferrals or require a
-  statistical NAT campaign. The retired Magicsock package is not the current
+  passed. The owner chose local acceptance followed by final review; a separate
+  field beta is not required. Broader device coverage below does not override
+  the owner's platform deferrals or require a statistical NAT campaign.
+  The retired Magicsock package is not the current
   candidate; preserve the existing product model in independent transport experiments.
 - [ ] **Reconcile open PRs with the final candidate.**
   [#462](https://github.com/TNTcraftHIM/Piik/pull/462)'s 256/320 kbps request and
@@ -215,8 +216,8 @@ experiments and their limits.
   networks and decoded-picture continuity on that path, following the
   [assessment](./research/nat-traversal.md#coordinated-native-punching-assessment).
   Preserve the first ordinary attempt, immediate Browser decline and fixed
-  operation deadlines. The owner will arrange a small difficult-network beta
-  after packaging; compare the same peers with the share's enhancement switch
+  operation deadlines. Future field comparisons should use the same peers with
+  the share's enhancement switch
   enabled/disabled, including mixed stable/sequential observations in both
   directions. Local coverage does not establish their field benefit. Random-port
   overlap remains separate and unproven.

From fdfb27dca19e6c8301e32a712a409026b3e6ef96 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 16:59:39 +0800
Subject: [PATCH 252/262] docs: close local native media acceptance gap

---
 docs/research/native-client-media.md | 9 +++++++++
 docs/todo.md                         | 9 ---------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/docs/research/native-client-media.md b/docs/research/native-client-media.md
index 6f69a8a16..82c694bc2 100644
--- a/docs/research/native-client-media.md
+++ b/docs/research/native-client-media.md
@@ -391,6 +391,15 @@ all owned processes, profiles and ports were released. This closes that local
 throughput acceptance gap. It does not isolate the virtual driver's cause or
 establish physical HDR, game-load or other-device performance.
 
+The same capture-delivery limit recurred during the October 14 audio checks.
+At final local acceptance, the unchanged capture-only probe delivered about
+144 fps, and the default 720p Native VP8 and H.264 SFU gates passed their original
+throughput requirement, live audio/video changes, subscription and page-reload
+recovery, publication retirement and cleanup. The VP8 two-room check also kept
+the second room's picture and audio after the first stopped. No product or
+gate-threshold change was needed to clear this local acceptance failure; the
+intermittent platform cause and physical-device limits remain unproven.
+
 ## Native H.264 Motion Quality
 
 Issue [#432](https://github.com/TNTcraftHIM/Piik/issues/432) reports more visible
diff --git a/docs/todo.md b/docs/todo.md
index 826fbaa10..068c49f95 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -10,15 +10,6 @@ Git/PRs own completed history.
 
 ## Now
 
-- [ ] **Windows native media acceptance on the current desktop.** The default
-  720p SFU gate misses its sustained-frame threshold on both the previous and
-  current audio dependencies. Capture-only WGC controls receive about 3.8 fps,
-  including an independent window repainting at about 40 fps, before encoding
-  or transport. The current capture session exposes only a virtual display;
-  its slowdown has no confirmed driver cause. Retest the unchanged gate on
-  a physical display. The smaller-picture gate passes live audio changes and
-  recovery but does not replace this throughput check.
-
 - [ ] **2.0 candidate preparation and acceptance.** The owner reopened investigation,
   useful improvements and outstanding acceptance on 2026-10-07, and on 2026-10-09
   chose to hold the maintenance changes for 2.0 rather than publish them separately.

From 07702228b4b57253cb797768c7776389ea07004f Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 17:17:09 +0800
Subject: [PATCH 253/262] fix(ui): keep option selection motion continuous

---
 src/client/styles.css | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/src/client/styles.css b/src/client/styles.css
index 218e33c02..170e922f9 100644
--- a/src/client/styles.css
+++ b/src/client/styles.css
@@ -1061,11 +1061,16 @@ html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #334
   font-weight: 700;
   letter-spacing: .1em;
   box-shadow: var(--control-shadow);
-  transition: transform 180ms var(--spring), background-color 140ms ease;
 }
-.lr-chip:is(:hover, :focus-visible):not(:disabled):not([aria-disabled="true"]):where(:not(.is-selected)) { background: var(--wall-2); transform: translateY(-2px); }
-.lr-chip:active:not(:disabled):not([aria-disabled="true"]) { transform: translateY(2px) scale(.97); box-shadow: none; }
-.lr-chip.is-selected { background: var(--ink); color: var(--paper); border-color: var(--ink); animation: lr-pop .2s var(--spring); }
+/* Selection keeps the same press/release transition. A separate transform
+   animation would jump away from the held pose when the selection changes. */
+.lr-chip, .lr-tile {
+  transition: transform 180ms var(--spring), background-color 140ms ease, color 140ms ease, border-color 140ms ease, box-shadow 140ms ease;
+}
+:is(.lr-chip, .lr-tile):is(:hover, :focus-visible):not(:disabled):not([aria-disabled="true"]):where(:not(.is-selected)) { background: var(--wall-2); transform: translateY(-2px); }
+:is(.lr-chip, .lr-tile):active:not(:disabled):not([aria-disabled="true"]) { transform: translateY(2px) scale(.97); box-shadow: none; }
+:is(.lr-chip, .lr-tile).is-selected { background: var(--ink); color: var(--paper); }
+.lr-chip.is-selected { border-color: var(--ink); }
 .lr-chip .lr-cap { font-family: var(--font); letter-spacing: 0; }
 .lr-chip small { margin-left: 5px; font-size: 10.5px; opacity: .6; }
 .lr-chip .lr-audio-rate {
@@ -1179,11 +1184,7 @@ html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #334
   background: var(--paper);
   color: var(--ink);
   box-shadow: var(--control-shadow);
-  transition: transform 180ms var(--spring), background-color 140ms ease;
 }
-.lr-tile:is(:hover, :focus-visible):not(:disabled):not([aria-disabled="true"]):where(:not(.is-selected)) { background: var(--wall-2); transform: translateY(-2px); }
-.lr-tile:active:not(:disabled):not([aria-disabled="true"]) { transform: translateY(2px) scale(.97); box-shadow: none; }
-.lr-tile.is-selected { background: var(--ink); color: var(--paper); animation: lr-pop .2s var(--spring); }
 .lr-tiles .lr-tile small { max-width: 100%; font-family: var(--mono); font-size: 11px; letter-spacing: .02em; color: #5d7086; text-wrap: balance; overflow-wrap: normal; }
 .lr-tiles .lr-tile.is-selected small { color: var(--paper); opacity: .75; }
 

From ae898817620e929d80271eaaff90faa578ceae75 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 17:32:40 +0800
Subject: [PATCH 254/262] docs: clarify 2.0 upgrades and future compatibility

---
 docs/research/room-interactions.md    | 20 ++++++++++++++++++++
 docs/standards/public-introduction.md |  2 +-
 docs/standards/versioning.md          |  7 +++++++
 docs/todo.md                          |  4 ++++
 site/index.html                       |  4 ++--
 5 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/docs/research/room-interactions.md b/docs/research/room-interactions.md
index 82a56df1d..cc61dd8b8 100644
--- a/docs/research/room-interactions.md
+++ b/docs/research/room-interactions.md
@@ -236,6 +236,26 @@ Bidirectional room voice is not part of the product plan.
 Text, reactions and danmaku introduce no microphone capture, voice
 admission or additional media peers.
 
+## Detached Chat Window Assessment
+
+[Document Picture-in-Picture](https://developer.chrome.com/docs/web-platform/document-picture-in-picture)
+can place arbitrary HTML in an always-on-top window without installing a PWA or
+implementing an App window. This is a possible presentation enhancement, not an
+implemented feature. Reuse the existing room session and chat content; detaching
+must not reconnect signaling, duplicate participants or reset drafts/history.
+The current panel assumes the main document for visibility, focus, positioning
+and tooltips, so moving its DOM alone is insufficient. A prototype should check
+those owners, returning content on close, theme/language changes and coexistence
+with the existing video PiP. The browser owns window movement and sizing.
+
+The [specification](https://wicg.github.io/document-picture-in-picture/) requires
+a secure context and user activation; closing or navigating the opener closes
+the PiP window. Local API checks opened and closed a same-origin window, but do
+not establish full chat integration or placement over exclusive-fullscreen games.
+[Browser support](https://developer.mozilla.org/en-US/docs/Web/API/DocumentPictureInPicture#browser_compatibility)
+is incomplete, so unsupported pages would retain the existing in-page panel.
+This needs no new room protocol or major version; adoption remains a scope decision.
+
 ## Primary References And Rationale
 
 - [LiveKit media and data](https://docs.livekit.io/frontends/build/media-data/)
diff --git a/docs/standards/public-introduction.md b/docs/standards/public-introduction.md
index b05691b36..ae7a8464e 100644
--- a/docs/standards/public-introduction.md
+++ b/docs/standards/public-introduction.md
@@ -14,7 +14,7 @@ understand what Piik does, choose an entry and complete the first useful action.
 | --- | --- | --- |
 | README, English and Chinese | What is this, and how do I start? | Brand introduction and interface preview, features, getting started, self-hosting, contribution and license |
 | `site/`, for GitHub Pages | What does using it feel like, and how do I start? | Room illustration and primary download link, illustrated steps, online/App/existing-site walkthroughs, FAQ, platform downloads, self-hosting and documentation |
-| Getting-started guides | Which button or mode do I use? | Browser invitation, sharing, App setup and three mode choices |
+| Getting-started guides | Which button or mode do I use? | Browser invitation, sharing, App setup, room creation and Site approval |
 | Self-hosting guides | How do I put my own site online? | Run the binary, set the domain and HTTPS proxy, open ports and verify; service management remains a separate reference |
 | Developer and operations docs | How do I build or host it? | Existing configuration, deployment, architecture and diagnostic owners |
 
diff --git a/docs/standards/versioning.md b/docs/standards/versioning.md
index 42ae5e1e5..236445709 100644
--- a/docs/standards/versioning.md
+++ b/docs/standards/versioning.md
@@ -61,6 +61,13 @@ baseline contract; introduce a small optional capability only for a concrete
 new feature. Do not add a version-range solver, general adapter framework,
 parallel authority writers or blanket old-client fallback paths.
 
+Keep the 2.x baseline long-lived. Substantial new functionality can remain a
+minor release when older peers retain established behavior and new behavior is
+explicitly opted into. A small feature can still be breaking if it unconditionally
+changes a strict message, existing semantics or durable authority. Review those
+boundaries before choosing the version; neither feature count nor a desire to
+avoid a major justifies mislabeling an incompatible release.
+
 ## Extending Interfaces
 
 Command/event JSON objects still reject unknown keys, and required fields reject
diff --git a/docs/todo.md b/docs/todo.md
index 068c49f95..3ecfc3b79 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -280,3 +280,7 @@ restore reverse feedback. Keep standard ICE recovery while that boundary remains
     identifies pairing/revocation and native decoded-input ownership beyond the
     device selector. Reopen for a concrete use case that justifies this boundary
     and physical latency/echo/background checks. This does not reopen room voice.
+11. **Detached chat window.** The [Document PiP assessment](./research/room-interactions.md#detached-chat-window-assessment)
+    supports a presentation-only prototype using the current room session.
+    Implementation is not yet accepted; verify document-scoped focus, visibility,
+    tooltip and close behavior before adding it to a release.
diff --git a/site/index.html b/site/index.html
index ec020b336..cb7d0a53d 100644
--- a/site/index.html
+++ b/site/index.html
@@ -732,8 +732,8 @@ <h2 id="download-title"><span lang="en">Get Piik App.</span><span lang="zh-CN">
           </p>
         </div>
         <p class="release-note" id="download-status">
-          <span lang="en">Choose your system, then download and extract.<br />For a major upgrade, <a href="./docs/getting-started.html?lang=en#upgrading">check compatibility before updating</a>.</span>
-          <span lang="zh-CN">选择对应系统，下载后解压。<br />跨大版本升级前，请先查看<a href="./docs/zh/getting-started.html#版本升级">兼容性说明</a>。</span>
+          <span lang="en">Choose your system, then download and extract.<br /><strong>2.0 and 1.x are incompatible.</strong> Update the App and its Site together, then refresh your browser. <a href="./docs/getting-started.html?lang=en#upgrading">Upgrade guide</a></span>
+          <span lang="zh-CN">选择对应系统，下载后解压。<br /><strong>2.0 与 1.x 不兼容。</strong>App 与所用站点需要一起升级，随后刷新网页。<a href="./docs/zh/getting-started.html#版本升级">升级说明</a></span>
         </p>
         <div class="download-cards">
           <article class="download-card" aria-labelledby="download-windows">

From d0ba50e0d6218cf267917cc9e6a7ba67089d7d8b Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 18:12:29 +0800
Subject: [PATCH 255/262] feat(ui): add always-on-top chat window

---
 docs/guide/getting-started.md                 |   6 +
 docs/guide/getting-started.zh-CN.md           |   4 +
 docs/research/room-interactions.md            |  29 ++--
 docs/standards/presentation-lifecycle.md      |   7 +
 docs/standards/visual-language.md             |   4 +
 docs/todo.md                                  |   4 -
 site/styles.css                               |   7 +-
 .../components/living/FloatingPanel.tsx       | 139 +++++++++++++-----
 .../components/living/RoomInteractions.tsx    |  47 ++++--
 src/client/components/living/Tooltip.tsx      |  60 +++++---
 .../components/living/floating-panel.css      |   7 +
 .../components/living/hints/interactions.tsx  |  19 +++
 src/client/locales/en.ts                      |   4 +
 src/client/locales/zh.ts                      |   4 +
 src/client/pages/ControlsPreview.tsx          |   2 +-
 src/client/ui/panel-window.ts                 |  71 +++++++++
 src/client/ui/visual-kinds.ts                 |   2 +
 tests/panel-window.test.ts                    |  45 ++++++
 18 files changed, 366 insertions(+), 95 deletions(-)
 create mode 100644 src/client/ui/panel-window.ts
 create mode 100644 tests/panel-window.test.ts

diff --git a/docs/guide/getting-started.md b/docs/guide/getting-started.md
index 2eb755566..c92ca7f39 100644
--- a/docs/guide/getting-started.md
+++ b/docs/guide/getting-started.md
@@ -248,6 +248,12 @@ sofa to send messages. Select a person on the sofa to open their reaction menu:
 your own reactions appear above you; reactions sent to a friend fly towards them.
 The chat window can be moved and resized without rearranging the page.
 
+Supported desktop browsers show **Always-on-top chat** in the window's top-right
+corner, so you can read messages while playing. Keep the Piik page open; closing
+the small window returns chat to the page. Use a windowed or borderless game;
+exclusive fullscreen may cover the chat. The window cannot show the game through
+its background or let mouse clicks pass through.
+
 **On screen**, beside the message box or in the viewer's playback bar, shows new
 messages over the picture. It is off by default and only changes your own view.
 Open **Chat settings** in the chat window to adjust text size and opacity.
diff --git a/docs/guide/getting-started.zh-CN.md b/docs/guide/getting-started.zh-CN.md
index 33b116abc..27da28b3b 100644
--- a/docs/guide/getting-started.zh-CN.md
+++ b/docs/guide/getting-started.zh-CN.md
@@ -205,6 +205,10 @@ Windows 10 是否支持取决于系统更新与实际检测；未显示此选项
 点击沙发上的人物可打开表情菜单：给自己发的表情出现在头顶，送给朋友的表情会飞向对方。
 聊天窗口可以移动和缩放，不会挤动页面。
 
+支持的桌面浏览器会在窗口右上角显示 **置顶聊天窗口**，方便切到游戏时看消息。
+保持 Piik 页面打开；关闭小窗会把聊天收回页面。建议游戏使用窗口或无边框模式，
+独占全屏不保证显示置顶窗。小窗目前不支持透出游戏画面或鼠标穿透。
+
 输入框旁和观众播放控制栏中的 **弹幕** 可以把新消息显示在画面上，默认关闭，只影响自己的观看。
 打开聊天窗口中的 **聊天设置**，可以调整弹幕字号和不透明度。
 系统视频全屏和画中画无法显示弹幕。
diff --git a/docs/research/room-interactions.md b/docs/research/room-interactions.md
index cc61dd8b8..4e03c6ff5 100644
--- a/docs/research/room-interactions.md
+++ b/docs/research/room-interactions.md
@@ -236,25 +236,28 @@ Bidirectional room voice is not part of the product plan.
 Text, reactions and danmaku introduce no microphone capture, voice
 admission or additional media peers.
 
-## Detached Chat Window Assessment
+## Detached Chat Window
 
 [Document Picture-in-Picture](https://developer.chrome.com/docs/web-platform/document-picture-in-picture)
-can place arbitrary HTML in an always-on-top window without installing a PWA or
-implementing an App window. This is a possible presentation enhancement, not an
-implemented feature. Reuse the existing room session and chat content; detaching
-must not reconnect signaling, duplicate participants or reset drafts/history.
-The current panel assumes the main document for visibility, focus, positioning
-and tooltips, so moving its DOM alone is insufficient. A prototype should check
-those owners, returning content on close, theme/language changes and coexistence
-with the existing video PiP. The browser owns window movement and sizing.
+places the current chat panel in an always-on-top window without installing a
+PWA or implementing an App window. The candidate adopts one stable React portal:
+the same session, DOM, draft, reading position and controls remain in use.
+Visibility, focus, tooltip placement and dismissal follow the displaying document.
+Theme and language follow the opener. The browser owns window movement and sizing;
+closing the window returns the panel to the page. Room retirement disposes it,
+including a window request that completes after retirement.
 
 The [specification](https://wicg.github.io/document-picture-in-picture/) requires
 a secure context and user activation; closing or navigating the opener closes
-the PiP window. Local API checks opened and closed a same-origin window, but do
-not establish full chat integration or placement over exclusive-fullscreen games.
+the PiP window. It is useful for reading chat beside a windowed or borderless game;
+placement above exclusive fullscreen is not guaranteed. Transparent desktop
+backgrounds and mouse passthrough remain an
+[upstream request](https://github.com/WICG/document-picture-in-picture/issues/99),
+so CSS opacity is not offered as a misleading game-transparency control.
 [Browser support](https://developer.mozilla.org/en-US/docs/Web/API/DocumentPictureInPicture#browser_compatibility)
-is incomplete, so unsupported pages would retain the existing in-page panel.
-This needs no new room protocol or major version; adoption remains a scope decision.
+is incomplete, so unsupported pages retain the in-page panel. Video PiP and chat
+PiP may replace each other under the browser's single-window policy; no media
+or room owner changes. This needs no new room protocol or major version.
 
 ## Primary References And Rationale
 
diff --git a/docs/standards/presentation-lifecycle.md b/docs/standards/presentation-lifecycle.md
index 182696160..e57f0790a 100644
--- a/docs/standards/presentation-lifecycle.md
+++ b/docs/standards/presentation-lifecycle.md
@@ -34,6 +34,13 @@ is absent, provided the room service and their admitted sessions remain availabl
 [Rooms and access](./rooms-access.md#room-interactions) owns interaction authority
 and retention; [status](../status.md#accepted-interaction-phase) owns release readiness.
 
+On capable desktop browsers, chat can move to a Document Picture-in-Picture
+window. It remains one presentation of the admitted room session, with the same
+draft and history. Read visibility and guidance follow its current document.
+Closing the window returns chat to the page; room retirement or opener teardown
+closes it, including a late asynchronous open. Browser window support does not
+promise game-overlay transparency, click-through or exclusive-fullscreen coverage.
+
 Piik App opens this same application in the system Browser. Its startup surface
 offers Local and temporary public invitation; the running App is already
 available to its approved Site before either mode starts. A Site's explicit App
diff --git a/docs/standards/visual-language.md b/docs/standards/visual-language.md
index dc40c9182..15a7a16b4 100644
--- a/docs/standards/visual-language.md
+++ b/docs/standards/visual-language.md
@@ -67,6 +67,10 @@ participant, stays open after sending and keeps its position when retargeted.
 One-shot settings and guidance retain their existing disclosures. Escape closes
 inner guidance first, then the most recently opened floating panel, then theater
 mode; an IME composition must not dismiss these surfaces.
+Detached chat uses the same content in the browser's own always-on-top frame.
+Its compact header offers return-to-page; in-page drag and resize controls yield
+to that frame instead of competing with it. Keep messages and text contrast
+primary; do not simulate transparent desktop content with a washed-out panel.
 
 Keep the application language control's segmented Chinese, English and visual
 shortcuts. When additional catalogs exist, insert one language menu
diff --git a/docs/todo.md b/docs/todo.md
index 3ecfc3b79..068c49f95 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -280,7 +280,3 @@ restore reverse feedback. Keep standard ICE recovery while that boundary remains
     identifies pairing/revocation and native decoded-input ownership beyond the
     device selector. Reopen for a concrete use case that justifies this boundary
     and physical latency/echo/background checks. This does not reopen room voice.
-11. **Detached chat window.** The [Document PiP assessment](./research/room-interactions.md#detached-chat-window-assessment)
-    supports a presentation-only prototype using the current room session.
-    Implementation is not yet accepted; verify document-scoped focus, visibility,
-    tooltip and close behavior before adding it to a release.
diff --git a/site/styles.css b/site/styles.css
index a895abaff..e1e8639ae 100644
--- a/site/styles.css
+++ b/site/styles.css
@@ -70,10 +70,9 @@ h1 { font-size: clamp(49px, 5.7vw, 76px); line-height: 1.06; margin-block: 22px
 .hero-actions { display: flex; align-items: center; flex-wrap: wrap; gap: 16px 24px; }
 .text-link { display: inline-flex; align-items: center; min-height: 44px; font-size: 13px; font-weight: 650; }
 .button { display: inline-flex; justify-content: center; align-items: center; gap: 29px; min-height: 54px; padding: 12px 25px; border: 2px solid var(--ink); border-radius: 999px; text-decoration: none; font-size: 14px; font-weight: 700; transition: transform .22s cubic-bezier(.2, .9, .3, 1.4); }
-.button svg { width: 22px; height: 22px; transition: transform .22s cubic-bezier(.2, .9, .3, 1.4); }
+.button svg { width: 22px; height: 22px; }
 .primary { background: var(--ink); color: var(--button-ink); box-shadow: 0 4px 0 color-mix(in srgb, var(--ink) 18%, transparent); }
 .button:not(:disabled):is(:hover, :focus-visible) { transform: translateY(-3px); box-shadow: 0 7px 0 color-mix(in srgb, var(--ink) 18%, transparent); }
-.button:not(:disabled):is(:hover, :focus-visible) svg { transform: translateY(3px); }
 .button:not(:disabled):active { transform: translateY(2px); box-shadow: 0 1px 0 color-mix(in srgb, var(--ink) 18%, transparent); }
 .hero-note { color: var(--muted); font-size: 12px; line-height: 1.7; margin-top: 18px; }
 .film-actions { display:flex; align-items:center; flex-wrap:wrap; gap:0 20px; margin-top:18px; }
@@ -342,8 +341,8 @@ html[lang="zh-CN"] .eyebrow { letter-spacing: .13em; }
 @media (prefers-reduced-motion: reduce) {
   html { scroll-behavior: auto; }
   *, *::before, *::after { transition: none !important; }
-  .button:not(:disabled):is(:hover, :focus-visible, :active), .button:not(:disabled):is(:hover, :focus-visible) svg, .download-architecture input:enabled:is(:hover, :focus-visible, :active) + span { transform: none; }
+  .button:not(:disabled):is(:hover, :focus-visible, :active), .download-architecture input:enabled:is(:hover, :focus-visible, :active) + span { transform: none; }
 }
 html[data-reduced-motion] { scroll-behavior: auto; }
 html[data-reduced-motion] *, html[data-reduced-motion] *::before, html[data-reduced-motion] *::after { animation: none !important; transition: none !important; }
-html[data-reduced-motion] :is(.button, .button svg, .film-play, .project-tv, .download-architecture label > span) { transform: none !important; }
+html[data-reduced-motion] :is(.button, .film-play, .project-tv, .download-architecture label > span) { transform: none !important; }
diff --git a/src/client/components/living/FloatingPanel.tsx b/src/client/components/living/FloatingPanel.tsx
index 29c215e2a..3c29866a0 100644
--- a/src/client/components/living/FloatingPanel.tsx
+++ b/src/client/components/living/FloatingPanel.tsx
@@ -1,6 +1,9 @@
 import { useLayoutEffect, useRef, useState, type PointerEvent, type ReactNode, type RefObject } from "react";
+import { createPortal } from "react-dom";
 import { useCopy } from "../../ui/copy";
 import { Glyph, type GlyphName } from "../../ui/icons";
+import { openPanelWindow, panelWindowAPI, SurfaceDocument } from "../../ui/panel-window";
+import { Tooltip } from "./Tooltip";
 import "./floating-panel.css";
 
 const PANEL_SIZES = { default: { width: 420, height: 560 }, large: { width: 560, height: 680 } };
@@ -9,13 +12,26 @@ type PanelGesture = "move" | "nw" | "se";
 type PanelChange = { x: number; y: number } | { rect: DOMRect; corner: "nw" | "se"; dx: number; dy: number };
 
 /** Native visibility owns the shell; content owns its session, draft and reading position. */
-export function FloatingPanel({ id, trigger, title, icon, compact = false, anchorOnOpen = false, className = "", children, onOpenChange }: {
+export function FloatingPanel({ id, trigger, title, icon, compact = false, anchorOnOpen = false, detachable = false, className = "", children, onOpenChange }: {
   id: string; trigger: string | RefObject<HTMLElement | null>; title: string; icon: GlyphName; compact?: boolean; className?: string;
   anchorOnOpen?: boolean;
-  children: ReactNode; onOpenChange?: (open: boolean) => void;
+  detachable?: boolean;
+  children: ReactNode; onOpenChange?: (open: boolean, ownerDocument: Document) => void;
 }) {
   const { t, vis } = useCopy();
   const [open, setOpen] = useState(false);
+  const [surfaceDocument, setSurfaceDocument] = useState<Document | null>(null);
+  const detached = Boolean(surfaceDocument && surfaceDocument !== document);
+  const [openingWindow, setOpeningWindow] = useState(false);
+  const [windowFailed, setWindowFailed] = useState(false);
+  const [container] = useState(() => {
+    if (!detachable || typeof document === "undefined") return null;
+    const node = document.createElement("div");
+    node.style.display = "contents";
+    return node;
+  });
+  const slot = useRef<HTMLSpanElement>(null);
+  const lifetime = useRef<AbortController | null>(null);
   const panelRef = useRef<HTMLElement>(null);
   const positionMenu = useRef<HTMLDetailsElement>(null);
   const sizes = compact ? COMPACT_SIZES : PANEL_SIZES;
@@ -30,6 +46,58 @@ export function FloatingPanel({ id, trigger, title, icon, compact = false, ancho
     if (element?.isConnected) element.focus({ preventScroll: true });
   };
 
+  useLayoutEffect(() => {
+    if (!container || !slot.current) return;
+    slot.current.append(container);
+    return () => { lifetime.current?.abort(); container.remove(); };
+  }, [container]);
+
+  useLayoutEffect(() => {
+    if (!surfaceDocument) return;
+    // Adoption removes native popovers from the old document's top layer.
+    panelRef.current?.showPopover();
+    if (surfaceDocument !== document) surfaceDocument.title = `${title} · Piik`;
+  }, [surfaceDocument, title]);
+
+  async function detach() {
+    if (!container || openingWindow) return;
+    const controller = new AbortController();
+    lifetime.current = controller;
+    const { signal } = controller;
+    setOpeningWindow(true);
+    setWindowFailed(false);
+    if (positionMenu.current) positionMenu.current.open = false;
+    try {
+      await openPanelWindow(container, signal, owner => {
+        setSurfaceDocument(owner);
+        onOpenChange?.(true, owner);
+      });
+    } catch { if (!signal.aborted) setWindowFailed(true); }
+    finally { if (!signal.aborted) setOpeningWindow(false); }
+  }
+
+  useLayoutEffect(() => {
+    const panel = panelRef.current;
+    if (!open || !panel) return;
+    const owner = panel.ownerDocument;
+    const hideOnEscape = (event: KeyboardEvent) => {
+      // Inner guidance/disclosures consume Escape before the containing window.
+      if (event.key !== "Escape" || event.defaultPrevented || event.isComposing ||
+        owner.querySelector('[popover="auto"]:popover-open, dialog:modal')) return;
+      const panels = [...owner.querySelectorAll<HTMLElement>(".lr-floating-panel:popover-open")];
+      if (!panels.length) return;
+      const topmost = panels.reduce((top, next) => Number(next.dataset.openedAt) >= Number(top.dataset.openedAt) ? next : top);
+      if (topmost !== panel) return;
+      event.preventDefault();
+      if (owner !== document) { owner.defaultView?.close(); return; }
+      const restoreFocus = panel.contains(owner.activeElement);
+      panel.hidePopover();
+      if (restoreFocus) focusTrigger();
+    };
+    owner.addEventListener("keydown", hideOnEscape);
+    return () => owner.removeEventListener("keydown", hideOnEscape);
+  }, [open, surfaceDocument]);
+
   function startGesture(event: PointerEvent<HTMLElement>, kind: PanelGesture) {
     if (!event.isPrimary || event.button !== 0 || !panelRef.current) return;
     if (kind === "move" && (event.target as Element).closest("button, .lr-floating-positions")) return;
@@ -43,7 +111,7 @@ export function FloatingPanel({ id, trigger, title, icon, compact = false, ancho
   }
   useLayoutEffect(() => {
     const panel = panelRef.current;
-    if (!open || !panel) return;
+    if (!open || !panel || detached) return;
     // The visual viewport keeps the composer above a phone's keyboard without
     // resizing the living room or taking ownership of scrolling/focus.
     const viewport = window.visualViewport;
@@ -79,21 +147,6 @@ export function FloatingPanel({ id, trigger, title, icon, compact = false, ancho
       panel.style.inset = `${top + freeY * position.current.y}px auto auto ${left + freeX * position.current.x}px`;
     };
     const resize = () => place();
-    const hideOnEscape = (event: KeyboardEvent) => {
-      // Inner native surfaces consume Escape first, even after focus moves out.
-      if (event.key !== "Escape" || event.defaultPrevented || event.isComposing ||
-        document.querySelector('[popover="auto"]:popover-open, dialog:modal')) return;
-      // Native top-layer order follows opening, not DOM order. Consume one
-      // close request even when chat and the reaction palette are both open.
-      const panels = [...document.querySelectorAll<HTMLElement>(".lr-floating-panel:popover-open")];
-      if (!panels.length) return;
-      const topmost = panels.reduce((top, next) => Number(next.dataset.openedAt) >= Number(top.dataset.openedAt) ? next : top);
-      if (topmost !== panel) return;
-      event.preventDefault();
-      const restoreFocus = panel.contains(document.activeElement);
-      panel.hidePopover();
-      if (restoreFocus) focusTrigger();
-    };
     placePanel.current = place;
     place();
     // Contextual palettes start beside their invoker, then use the same free
@@ -113,7 +166,6 @@ export function FloatingPanel({ id, trigger, title, icon, compact = false, ancho
     // Content-sized palettes still fit after a target, language or status change.
     const observer = new ResizeObserver(resize);
     observer.observe(panel);
-    document.addEventListener("keydown", hideOnEscape);
     return () => {
       placePanel.current = null;
       gesture.current = null;
@@ -121,11 +173,11 @@ export function FloatingPanel({ id, trigger, title, icon, compact = false, ancho
       viewport?.removeEventListener("scroll", resize);
       window.removeEventListener("resize", resize);
       observer.disconnect();
-      document.removeEventListener("keydown", hideOnEscape);
     };
-  }, [open, trigger, compact, anchorOnOpen]);
+  }, [open, trigger, compact, anchorOnOpen, detached]);
 
-  return (<section id={id} ref={panelRef} popover="manual" role="dialog" tabIndex={-1} className={`lr-floating-surface lr-floating-panel ${className}`}
+  const panel = <SurfaceDocument.Provider value={surfaceDocument}>
+    <section id={id} ref={panelRef} popover="manual" role="dialog" tabIndex={-1} className={`lr-floating-surface lr-floating-panel ${className}`}
       style={sizes.default}
       aria-label={title}
       onPointerDownCapture={() => { suppressDragClick.current = false; }}
@@ -148,32 +200,37 @@ export function FloatingPanel({ id, trigger, title, icon, compact = false, ancho
         // React delivers nested details/popover toggles to this handler too.
         // Only this panel's native visibility owns its positioning lifetime.
         if (event.target !== event.currentTarget) return;
-        const open = event.newState === "open";
+        const owner = event.currentTarget.ownerDocument;
+        // The adopted panel remains open; an old-document close is not a user action.
+        const open = event.currentTarget.matches(":popover-open") || owner !== document;
         setOpen(open);
-        onOpenChange?.(open);
+        onOpenChange?.(open, owner);
         if (open) {
           event.currentTarget.dataset.openedAt = String(performance.now());
           // Opening to read must not summon a phone's keyboard.
           event.currentTarget.focus({ preventScroll: true });
         } else {
+          lifetime.current?.abort();
+          setOpeningWindow(false);
+          setWindowFailed(false);
           if (positionMenu.current) positionMenu.current.open = false;
           if (event.currentTarget.contains(document.activeElement)) focusTrigger();
         }
       }}>
-      <header className="lr-floating-header" role="group" tabIndex={0} aria-label={t("floating.move")}
-          aria-describedby={`${id}-move-hint`}
-          onPointerDown={event => startGesture(event, "move")}
+      <header className="lr-floating-header" role="group" tabIndex={detached ? undefined : 0} aria-label={detached ? title : t("floating.move")}
+          aria-describedby={detached ? undefined : `${id}-move-hint`}
+          onPointerDown={detached ? undefined : event => startGesture(event, "move")}
           onKeyDown={event => {
-            if (event.target !== event.currentTarget || !event.key.startsWith("Arrow") || !panelRef.current) return;
+            if (detached || event.target !== event.currentTarget || !event.key.startsWith("Arrow") || !panelRef.current) return;
             event.preventDefault();
             const rect = panelRef.current.getBoundingClientRect();
             placePanel.current?.({ x: rect.left + (event.key === "ArrowLeft" ? -24 : event.key === "ArrowRight" ? 24 : 0),
               y: rect.top + (event.key === "ArrowUp" ? -24 : event.key === "ArrowDown" ? 24 : 0) });
           }}>
-        <span className="lr-floating-title"><Glyph name="grip" size={17} />
+        <span className="lr-floating-title">{!detached && <Glyph name="grip" size={17} />}
           {vis ? <Glyph name={icon} size={18} /> : <b>{title}</b>}</span>
         <span id={`${id}-move-hint`} className="visually-hidden">{t("floating.moveHint")}</span>
-        <details ref={positionMenu} className="lr-floating-position"
+        {!detached && <details ref={positionMenu} className="lr-floating-position"
           onBlur={event => { if (!event.currentTarget.contains(event.relatedTarget as Node)) event.currentTarget.open = false; }}
           onKeyDown={event => {
             if (event.key !== "Escape" || event.defaultPrevented || event.nativeEvent.isComposing || !event.currentTarget.open) return;
@@ -202,13 +259,23 @@ export function FloatingPanel({ id, trigger, title, icon, compact = false, ancho
               <Glyph name={size === "large" ? "expand" : "contract"} size={18} />{!vis && <span>{t(`floating.size.${size}`)}</span>}
             </button>)}
           </div>
-        </details>
-        <button type="button" className="lr-popover-close" aria-label={t("common.close")} onClick={() => {
+        </details>}
+        {detachable && (detached || panelWindowAPI(typeof window === "undefined" ? null : window)) &&
+          <Tooltip kind={detached ? "hint-chat-attach" : "hint-chat-detach"} place="below"
+            text={vis ? undefined : t(detached ? "floating.attach" : "floating.detach")}>
+            <button type="button" className="lr-popover-close" disabled={openingWindow}
+              aria-label={t(detached ? "floating.attach" : "floating.detach")}
+              onClick={() => { if (detached) surfaceDocument?.defaultView?.close(); else void detach(); }}>
+              <Glyph name={detached ? "pipExit" : "pip"} size={18} />
+            </button>
+          </Tooltip>}
+        {!detached && <button type="button" className="lr-popover-close" aria-label={t("common.close")} onClick={() => {
           panelRef.current?.hidePopover(); focusTrigger();
-        }}><Glyph name="x" size={16} /></button>
+        }}><Glyph name="x" size={16} /></button>}
       </header>
+      {windowFailed && <p className="lr-floating-error" role="status">{t("floating.detachFailed")}</p>}
       {children}
-      {(["nw", "se"] as const).map(corner => <span key={corner} className={`lr-floating-resize is-${corner}`}
+      {!detached && (["nw", "se"] as const).map(corner => <span key={corner} className={`lr-floating-resize is-${corner}`}
         role="group" tabIndex={0} aria-label={t("floating.resize")} aria-describedby={`${id}-resize-hint`}
         onPointerDown={event => startGesture(event, corner)} onKeyDown={event => {
           if (!event.key.startsWith("Arrow") || !panelRef.current) return;
@@ -218,5 +285,7 @@ export function FloatingPanel({ id, trigger, title, icon, compact = false, ancho
             dy: event.key === "ArrowUp" ? -24 : event.key === "ArrowDown" ? 24 : 0 });
         }}><svg viewBox="0 0 16 16" width="14" height="14" aria-hidden="true"><path d="M3 12 12 3M8 12l4-4" fill="none" stroke="currentColor" strokeWidth="1.5" strokeLinecap="round" /></svg></span>)}
       <span id={`${id}-resize-hint`} className="visually-hidden">{t("floating.resizeHint")}</span>
-    </section>);
+    </section></SurfaceDocument.Provider>;
+  // The stable portal target moves between documents without remounting content.
+  return container ? <span ref={slot} style={{ display: "contents" }}>{createPortal(panel, container)}</span> : panel;
 }
diff --git a/src/client/components/living/RoomInteractions.tsx b/src/client/components/living/RoomInteractions.tsx
index 4be3b3e25..cefb692b0 100644
--- a/src/client/components/living/RoomInteractions.tsx
+++ b/src/client/components/living/RoomInteractions.tsx
@@ -23,7 +23,8 @@ export function RoomInteractions(props: Props) {
 type ConnectedProps = Props & { session: RoomInteractionSession };
 function ConnectedRoomInteractions(props: ConnectedProps) {
   const state = useSyncExternalStore(props.session.subscribe, props.session.getSnapshot);
-  return <InteractionPanel {...props} state={state} />;
+  // Disconnect retains admission; retirement clears it and disposes every chat surface.
+  return state.peerId ? <InteractionPanel {...props} state={state} /> : <Couch {...props} />;
 }
 
 function InteractionPanel({ session, state, ...couch }: ConnectedProps & {
@@ -31,6 +32,8 @@ function InteractionPanel({ session, state, ...couch }: ConnectedProps & {
 }) {
   const { t, vis } = useCopy();
   const [chatOpen, setChatOpen] = useState(false);
+  const [chatDocument, setChatDocument] = useState<Document | null>(null);
+  const detached = Boolean(chatDocument && chatDocument !== document);
   const [settingsOpen, setSettingsOpen] = useState(false);
   const [effects, setEffects] = useState(true);
   const [target, setTarget] = useState<string | null>(null);
@@ -41,6 +44,7 @@ function InteractionPanel({ session, state, ...couch }: ConnectedProps & {
   const area = useRef<HTMLDivElement>(null);
   const anchor = useRef<HTMLButtonElement | null>(null);
   const log = useRef<HTMLDivElement>(null);
+  const readingPosition = useRef(0);
   const id = useId();
   const menuId = `${id}-person`;
   const participants: Participant[] = [
@@ -77,31 +81,39 @@ function InteractionPanel({ session, state, ...couch }: ConnectedProps & {
     anchor.current = trigger;
     setTarget(key);
   }
+  useLayoutEffect(() => {
+    // Moving a popover between documents resets its native scroll offset.
+    // Content owns reading position; following the latest message remains below.
+    if (log.current) log.current.scrollTop = readingPosition.current;
+  }, [chatDocument]);
   useEffect(() => {
     if (!chatOpen || !log.current) return;
+    const owner = log.current.ownerDocument;
+    const view = owner.defaultView;
+    if (!view) return;
     let active = true;
     let inView = false;
-    const sync = () => { if (active) setVisible(inView && document.visibilityState === "visible"); };
-    const observer = new IntersectionObserver(entries => {
+    const sync = () => { if (active) setVisible(inView && owner.visibilityState === "visible"); };
+    const observer = new view.IntersectionObserver(entries => {
       const entry = entries.at(-1);
       inView = Boolean(entry?.isIntersecting && entry.intersectionRatio > 0);
       sync();
     });
     observer.observe(log.current);
-    document.addEventListener("visibilitychange", sync);
+    owner.addEventListener("visibilitychange", sync);
     return () => {
       active = false;
       observer.disconnect();
-      document.removeEventListener("visibilitychange", sync);
+      owner.removeEventListener("visibilitychange", sync);
       setVisible(false);
     };
-  }, [chatOpen]);
+  }, [chatOpen, chatDocument]);
   useEffect(() => {
-    if (!chatOpen || !visible || !following || document.visibilityState !== "visible" ||
+    if (!chatOpen || !visible || !following || log.current?.ownerDocument.visibilityState !== "visible" ||
       !log.current?.getClientRects().length) return;
     setLastSeen(latest);
     log.current.scrollTop = log.current.scrollHeight;
-  }, [latest, chatOpen, visible, following]);
+  }, [latest, chatOpen, visible, following, chatDocument]);
 
   return <div className="lr-room-interactions">
     <div className="visually-hidden" role="log" aria-label={t("interaction.reactions")}
@@ -114,12 +126,17 @@ function InteractionPanel({ session, state, ...couch }: ConnectedProps & {
         })}
       </p>)}
     </div>
-    <FloatingPanel id={id} trigger={`${id}-toggle`} icon="chat" className="lr-interaction-panel"
-      title={t(settingsOpen ? "interaction.settings" : "interaction.title")} onOpenChange={setChatOpen}>
+    <FloatingPanel id={id} trigger={`${id}-toggle`} icon="chat" className="lr-interaction-panel" detachable
+      title={t(settingsOpen ? "interaction.settings" : "interaction.title")}
+      onOpenChange={(open, owner) => { setChatOpen(open); setChatDocument(owner); }}>
       {settingsOpen && <RoomChatSettings session={session} />}
       <div className="lr-chat-history" hidden={settingsOpen}>
       <div className="lr-chat-log" role="log" aria-label={t("interaction.title")} aria-live="polite" aria-relevant="additions" tabIndex={0} ref={log}
-        onScroll={event => { const node = event.currentTarget; setFollowing(node.scrollHeight - node.scrollTop - node.clientHeight < 40); }}>
+        onScroll={event => {
+          const node = event.currentTarget;
+          readingPosition.current = node.scrollTop;
+          setFollowing(node.scrollHeight - node.scrollTop - node.clientHeight < 40);
+        }}>
         {state.messages.length === 0 ? <div className="lr-chat-empty">
           <span className="lr-chat-welcome" aria-hidden="true">{participants.slice(0, 2).map(person =>
             <PawnSvg key={person.peerId} identity={person.peerId} color={participantColor(person.peerId)} host={person.peerId === couch.host?.key} />)}
@@ -175,9 +192,11 @@ function InteractionPanel({ session, state, ...couch }: ConnectedProps & {
     <div className="lr-interaction-couch" ref={area}>
       <Couch {...couch} participantAction={{ open: openReactions, target, controls: menuId }}
         footerAction={<span className="lr-interaction-chat-toggle">
-          <Btn id={`${id}-toggle`} icon="chat" title={chatOpen ? "interaction.close" : "interaction.open"} cap="interaction.open" expanded={chatOpen} controls={id}
-            hint={chatOpen ? "hint-close" : "hint-chat-open"}
-            tone={chatOpen ? "on" : undefined} popoverTarget={id} />
+          <Btn id={`${id}-toggle`} icon="chat" title={detached ? "interaction.focus" : chatOpen ? "interaction.close" : "interaction.open"}
+            cap="interaction.open" expanded={chatOpen} controls={detached ? undefined : id}
+            hint={detached ? "hint-chat-detach" : chatOpen ? "hint-close" : "hint-chat-open"}
+            tone={chatOpen ? "on" : undefined} popoverTarget={detached ? undefined : id}
+            onClick={detached ? () => chatDocument?.defaultView?.focus() : undefined} />
           {unread > 0 && <span className="lr-interaction-unread" aria-label={t("interaction.unread", { count: String(unread) })}>{unread}</span>}
         </span>} />
       {effects && state.reactions.map((reaction, index) => {
diff --git a/src/client/components/living/Tooltip.tsx b/src/client/components/living/Tooltip.tsx
index 26bc595b1..783d39b3b 100644
--- a/src/client/components/living/Tooltip.tsx
+++ b/src/client/components/living/Tooltip.tsx
@@ -30,6 +30,7 @@ import { Comic, type ComicKind } from "./Comic";
 import { HintComic, isHintKind, type HintKind } from "./hints";
 import { isCopyKey, say } from "../../ui/copy";
 import { replaySvgAnimations } from "../../ui/animation";
+import { useSurfaceDocument } from "../../ui/panel-window";
 import { comicStyle, getComicPresentation, type ComicTone, type ComicMotion } from "./comic-presentation";
 
 const LONG_PRESS_MS = 500;
@@ -76,6 +77,7 @@ export function Tooltip({
   disabled?: boolean;
   children: ReactNode;
 }) {
+  const ownerDocument = useSurfaceDocument();
   const defaults = getComicPresentation(kind);
   const resolvedTone = tone ?? defaults.tone;
   const resolvedMotion = motion ?? defaults.motion;
@@ -136,9 +138,16 @@ export function Tooltip({
     const observer = new ResizeObserver(measure);
     observer.observe(element);
     // Font loading can change scrollWidth without changing the clipped box.
-    void document.fonts?.ready.then(measure);
+    void element.ownerDocument.fonts?.ready.then(measure);
     return () => { disposed = true; observer.disconnect(); };
-  }, [overflow?.selector, overflow?.text, trigger?.type, trigger?.key]);
+  }, [overflow?.selector, overflow?.text, trigger?.type, trigger?.key, ownerDocument]);
+
+  useLayoutEffect(() => {
+    // A hover/hold from the old window cannot pin guidance in the new one.
+    dismissPanel();
+    setPanelMounted(false);
+    pressPoint.current = null;
+  }, [ownerDocument]);
 
   useEffect(() => {
     if (enabled) return;
@@ -165,10 +174,12 @@ export function Tooltip({
   const pickAlign = () => {
     const wrap = wrapRef.current;
     if (!wrap) return;
-    const viewport = window.visualViewport;
-    const vw = viewport?.width ?? window.innerWidth;
+    const view = wrap.ownerDocument.defaultView;
+    if (!view) return;
+    const viewport = view.visualViewport;
+    const vw = viewport?.width ?? view.innerWidth;
     if (!vw) return; // no layout (SSR/test): keep the prop alignment
-    const vh = viewport?.height ?? window.innerHeight;
+    const vh = viewport?.height ?? view.innerHeight;
     const x = viewport?.offsetLeft ?? 0, y = viewport?.offsetTop ?? 0;
     const right = x + vw, bottom = y + vh;
     tipRef.current?.style.setProperty("--tooltip-max-width", `${Math.max(0, vw - EDGE_MARGIN * 2)}px`);
@@ -245,7 +256,7 @@ export function Tooltip({
       top = sideTop;
       caret = Math.max(14, Math.min(centerY - top, panelHeight - 14));
     }
-    const border = tipRef.current ? parseFloat(getComputedStyle(tipRef.current).borderLeftWidth) || 0 : 0;
+    const border = tipRef.current ? parseFloat(view.getComputedStyle(tipRef.current).borderLeftWidth) || 0 : 0;
     setPosition({
       left,
       top,
@@ -272,26 +283,27 @@ export function Tooltip({
     }
   }, [panelMounted, caption, kind]);
   useEffect(() => {
-    if (!interactionOpen || !panelMounted) return;
+    const view = ownerDocument?.defaultView;
+    if (!interactionOpen || !panelMounted || !view) return;
     let frame = 0;
     const schedulePick = () => {
-      window.cancelAnimationFrame(frame);
-      frame = window.requestAnimationFrame(() => pickAlignRef.current());
+      view.cancelAnimationFrame(frame);
+      frame = view.requestAnimationFrame(() => pickAlignRef.current());
     };
     schedulePick();
-    const viewport = window.visualViewport;
+    const viewport = view.visualViewport;
     viewport?.addEventListener("resize", schedulePick);
     viewport?.addEventListener("scroll", schedulePick);
-    window.addEventListener("resize", schedulePick);
-    window.addEventListener("scroll", schedulePick, true);
+    view.addEventListener("resize", schedulePick);
+    view.addEventListener("scroll", schedulePick, true);
     return () => {
-      window.cancelAnimationFrame(frame);
+      view.cancelAnimationFrame(frame);
       viewport?.removeEventListener("resize", schedulePick);
       viewport?.removeEventListener("scroll", schedulePick);
-      window.removeEventListener("resize", schedulePick);
-      window.removeEventListener("scroll", schedulePick, true);
+      view.removeEventListener("resize", schedulePick);
+      view.removeEventListener("scroll", schedulePick, true);
     };
-  }, [panelMounted, interactionOpen, caption, kind]);
+  }, [panelMounted, interactionOpen, caption, kind, ownerDocument]);
 
   useEffect(() => {
     if (!interactionOpen) return;
@@ -300,15 +312,15 @@ export function Tooltip({
       if (event.key !== "Escape" || event.isComposing) return;
       // Close every hint channel, including a hover panel suppressed by a
       // focused neighbour. Only visible guidance consumes the outer action.
-      const style = tipRef.current && getComputedStyle(tipRef.current);
+      const style = tipRef.current && ownerDocument?.defaultView?.getComputedStyle(tipRef.current);
       if (style?.visibility === "visible" && style.pointerEvents !== "none") event.preventDefault();
       dismissPanel();
     };
     // Guidance consumes Escape before its containing window, regardless of
     // which surface mounted first. Outer handlers respect defaultPrevented.
-    document.addEventListener("keydown", dismiss, true);
-    return () => document.removeEventListener("keydown", dismiss, true);
-  }, [interactionOpen]);
+    ownerDocument?.addEventListener("keydown", dismiss, true);
+    return () => ownerDocument?.removeEventListener("keydown", dismiss, true);
+  }, [interactionOpen, ownerDocument]);
 
   useEffect(() => {
     if (interactionOpen || !panelMounted) return;
@@ -344,9 +356,9 @@ export function Tooltip({
         dismissPanel();
       }
     };
-    document.addEventListener("pointerdown", dismiss);
-    return () => document.removeEventListener("pointerdown", dismiss);
-  }, [interactionOpen]);
+    ownerDocument?.addEventListener("pointerdown", dismiss);
+    return () => ownerDocument?.removeEventListener("pointerdown", dismiss);
+  }, [interactionOpen, ownerDocument]);
 
   const cancelPress = () => {
     if (pressTimer.current !== null) {
@@ -504,7 +516,7 @@ export function Tooltip({
           // This click only clears guidance; never pass it to a covered action.
           event.stopPropagation();
           // Dragging to select a caption or full nickname is still reading.
-          const selection = window.getSelection();
+          const selection = ownerDocument?.getSelection();
           if (!selection?.isCollapsed && tipRef.current.contains(selection?.anchorNode ?? null)) return;
           dismissPanel();
         } else if (!toggleOnClick && event.detail !== 0) {
diff --git a/src/client/components/living/floating-panel.css b/src/client/components/living/floating-panel.css
index b17fa8011..131b162a7 100644
--- a/src/client/components/living/floating-panel.css
+++ b/src/client/components/living/floating-panel.css
@@ -25,6 +25,13 @@
 @keyframes lr-floating-enter { from { opacity: 0; transform: translateY(8px) scale(.97); } to { opacity: 1; transform: none; } }
 .lr-popover-close { display: grid; place-items: center; width: 36px; height: 36px; flex: none; background: transparent; color: var(--muted); border: 0; border-radius: 12px; cursor: pointer; }
 .lr-popover-close:is(:hover, :focus-visible) { background: var(--control-hover); color: var(--ink); }
+.lr-floating-error { padding: 8px 0; color: var(--danger); font-size: 12px; }
+/* The browser owns the detached frame, movement and resizing. */
+.lr-panel-window { background: var(--paper); }
+.lr-panel-window .lr-floating-panel { inset: 0 !important; width: 100% !important; height: 100dvh !important; max-width: none; max-height: none !important; padding: 12px; border: 0; border-radius: 0; box-shadow: none; animation: none; }
+.lr-panel-window .lr-floating-header { min-height: 40px; margin: -12px -12px 0; padding: 2px 8px 2px 14px; border-radius: 0; cursor: default; touch-action: auto; }
+.lr-panel-window .lr-chat-log { padding-block: 12px; }
+.lr-panel-window .lr-chat-footer { padding-right: 0; }
 [data-comic-reduced-motion] .lr-floating-panel:popover-open { animation: none; }
 @media (prefers-reduced-motion: reduce) { .lr-floating-panel:popover-open { animation: none; } }
 @media (max-width: 420px) {
diff --git a/src/client/components/living/hints/interactions.tsx b/src/client/components/living/hints/interactions.tsx
index b5580b729..bf0c94d48 100644
--- a/src/client/components/living/hints/interactions.tsx
+++ b/src/client/components/living/hints/interactions.tsx
@@ -65,6 +65,23 @@ function ChatSettingsHint({ theme }: { theme: ComicTheme }) {
   </g>)}</>;
 }
 
+function ChatWindowHint({ theme, detach }: { theme: ComicTheme; detach: boolean }) {
+  return <><InteractionMotion />{[0, 160].map((x, index) => {
+    const floating = index ? detach : !detach;
+    return <g key={x}>
+      <Frame x={x + 4} w={152} theme={theme} result={Boolean(index)} />
+      <MiniTv x={x + 20} y={19} w={100} h={56} />
+      <path d={`M${x + 29} 62l20-20 17 14 18-21 26 27Z`} fill={SKY} opacity={.5} />
+      <g className={index ? "vls-talk-bubble" : undefined}>
+        <rect x={x + (floating ? 88 : 76)} y={floating ? 9 : 28} width={floating ? 48 : 34} height={floating ? 58 : 38}
+          rx={5} fill="var(--paper)" stroke={YOU} strokeWidth={2} />
+        <path d={`M${x + (floating ? 96 : 82)} ${floating ? 19 : 36}h${floating ? 22 : 18}`} stroke={FAINT} strokeWidth={2} strokeLinecap="round" />
+        <g transform={`translate(${x + (floating ? 96 : 81)} ${floating ? 29 : 42}) scale(${floating ? .85 : .65})`}><Bubble x={0} y={0} /></g>
+      </g>
+    </g>;
+  })}</>;
+}
+
 function ChatExportHint({ theme }: { theme: ComicTheme }) {
   return <><InteractionMotion />{[0, 160].map((x, index) => <g key={x}>
     <Frame x={x + 4} w={152} theme={theme} result={Boolean(index)} />
@@ -83,6 +100,8 @@ export const INTERACTION_SCENES: Record<InteractionHintKind, HintScene> = {
   "hint-chat-send": props => <ChatHint {...props} send />,
   "hint-chat-settings": props => <ChatSettingsHint {...props} />,
   "hint-chat-export": props => <ChatExportHint {...props} />,
+  "hint-chat-detach": props => <ChatWindowHint {...props} detach />,
+  "hint-chat-attach": props => <ChatWindowHint {...props} detach={false} />,
   "hint-chat-overlay-show": props => <OverlayHint {...props} show />,
   "hint-chat-overlay-hide": props => <OverlayHint {...props} show={false} />,
 };
diff --git a/src/client/locales/en.ts b/src/client/locales/en.ts
index 94ffcb94c..17dfef83a 100644
--- a/src/client/locales/en.ts
+++ b/src/client/locales/en.ts
@@ -155,6 +155,10 @@ export const en: Record<CopyKey, string> = {
   "interaction.exportHint": "Save messages received on this page as a text file.",
   "interaction.exportLimit": "Exports up to the latest {count} messages kept on this page.",
   "interaction.close": "Hide chat window",
+  "interaction.focus": "Show chat window",
+  "floating.detach": "Always-on-top chat",
+  "floating.attach": "Return chat to page",
+  "floating.detachFailed": "Could not open the chat window. Try again.",
   "floating.move": "Move window",
   "floating.moveHint": "Drag the title bar, use arrow keys to adjust, or choose a corner under Position.",
   "floating.position": "Position",
diff --git a/src/client/locales/zh.ts b/src/client/locales/zh.ts
index f32a6cd6a..7f8662761 100644
--- a/src/client/locales/zh.ts
+++ b/src/client/locales/zh.ts
@@ -155,6 +155,10 @@ export const zh = {
   "interaction.exportHint": "将本页收到的聊天记录保存为文本文件。",
   "interaction.exportLimit": "导出本页保留的最近 {count} 条消息。",
   "interaction.close": "收起聊天窗口",
+  "interaction.focus": "显示聊天窗口",
+  "floating.detach": "置顶聊天窗口",
+  "floating.attach": "收回页面",
+  "floating.detachFailed": "未能打开聊天窗口，请重试。",
   "floating.move": "移动窗口",
   "floating.moveHint": "拖动标题栏移动窗口；方向键可微调，也可以从「位置」选择角落。",
   "floating.position": "位置",
diff --git a/src/client/pages/ControlsPreview.tsx b/src/client/pages/ControlsPreview.tsx
index 1275c4d07..132c0ffd9 100644
--- a/src/client/pages/ControlsPreview.tsx
+++ b/src/client/pages/ControlsPreview.tsx
@@ -272,7 +272,7 @@ export function ControlsPreview() {
     </section>
     <section id="interaction-preview" className="cp-section">
       <header className="cp-section-head"><span className="cp-number">09</span><div><h2>{en ? "A little company" : "聊两句，丢个番茄。"}</h2>
-        <p>{en ? "Click a person for reactions. Drag or resize either window." : "点小人发表情；聊天与表情窗都能拖动、缩放。"}</p></div></header>
+        <p>{en ? "Click a person for reactions. Move or resize either panel; supported browsers can pop chat out into an always-on-top window." : "点小人发表情；聊天与表情窗都能拖动、缩放。支持的浏览器还可将聊天弹出为置顶小窗。"}</p></div></header>
       <InteractionControlsPreview />
     </section>
   </>;
diff --git a/src/client/ui/panel-window.ts b/src/client/ui/panel-window.ts
new file mode 100644
index 000000000..cccdd194c
--- /dev/null
+++ b/src/client/ui/panel-window.ts
@@ -0,0 +1,71 @@
+import { createContext, useContext } from "react";
+
+// Geometry, focus and visibility follow the document displaying a surface.
+// Its React tree and domain state continue to belong to the original page.
+export const SurfaceDocument = createContext<Document | null>(null);
+export const useSurfaceDocument = () => useContext(SurfaceDocument) ?? (typeof document === "undefined" ? null : document);
+
+type PictureInPicture = { requestWindow(options: { width: number; height: number }): Promise<Window> };
+export function panelWindowAPI(view: Window | null) {
+  return view && view === view.top && view.isSecureContext
+    ? (view as Window & { documentPictureInPicture?: PictureInPicture }).documentPictureInPicture
+    : undefined;
+}
+
+/** Adopt one stable portal, then return it on close. No second React root/session. */
+export async function openPanelWindow(container: HTMLElement, signal: AbortSignal, onDocument: (document: Document) => void) {
+  const home = container.ownerDocument;
+  const parent = container.parentElement;
+  const api = panelWindowAPI(home.defaultView);
+  if (!api || !parent || signal.aborted) return;
+  const pip = await api.requestWindow({ width: 360, height: 480 });
+  // Room retirement can beat the browser's permission/window creation work.
+  if (signal.aborted || !container.isConnected) { pip.close(); return; }
+  let returned = false;
+  const observer = new MutationObserver(() => copyAttributes());
+  const attributes = ["lang", "dir", "data-theme", "data-comic-reduced-motion"];
+  function copyAttributes() {
+    for (const name of attributes) {
+      const value = home.documentElement.getAttribute(name);
+      if (value === null) pip.document.documentElement.removeAttribute(name);
+      else pip.document.documentElement.setAttribute(name, value);
+    }
+  }
+  function restore() {
+    if (returned) return;
+    returned = true;
+    observer.disconnect();
+    pip.removeEventListener("pagehide", restore);
+    signal.removeEventListener("abort", retire);
+    parent!.append(container);
+    if (!signal.aborted) onDocument(home);
+  }
+  function retire() { restore(); pip.close(); }
+  pip.addEventListener("pagehide", restore);
+  signal.addEventListener("abort", retire, { once: true });
+  try {
+    const base = pip.document.createElement("base");
+    base.href = home.baseURI;
+    pip.document.head.append(base);
+    // Loaded same-origin rules avoid a second stylesheet fetch/unstyled frame.
+    // Cross-origin sheets keep their original link when CSSOM access is denied.
+    for (const sheet of home.styleSheets) {
+      if (sheet.ownerNode && !home.head.contains(sheet.ownerNode)) continue;
+      try {
+        const style = pip.document.createElement("style");
+        style.textContent = [...sheet.cssRules].map(rule => rule.cssText).join("\n");
+        pip.document.head.append(style);
+      } catch {
+        if (sheet.ownerNode) pip.document.head.append(sheet.ownerNode.cloneNode(true));
+      }
+    }
+    copyAttributes();
+    observer.observe(home.documentElement, { attributes: true, attributeFilter: attributes });
+    pip.document.body.className = "lr-panel-window";
+    pip.document.body.append(container);
+    onDocument(pip.document);
+  } catch (error) {
+    retire();
+    throw error;
+  }
+}
diff --git a/src/client/ui/visual-kinds.ts b/src/client/ui/visual-kinds.ts
index 246d86c22..f6662be13 100644
--- a/src/client/ui/visual-kinds.ts
+++ b/src/client/ui/visual-kinds.ts
@@ -150,6 +150,8 @@ export type InteractionHintKind =
   | "hint-chat-send"
   | "hint-chat-settings"
   | "hint-chat-export"
+  | "hint-chat-detach"
+  | "hint-chat-attach"
   | "hint-chat-overlay-show"
   | "hint-chat-overlay-hide";
 
diff --git a/tests/panel-window.test.ts b/tests/panel-window.test.ts
new file mode 100644
index 000000000..4671da2c9
--- /dev/null
+++ b/tests/panel-window.test.ts
@@ -0,0 +1,45 @@
+import { expect, test, vi } from "vitest";
+import { openPanelWindow, panelWindowAPI } from "../src/client/ui/panel-window";
+
+function setup() {
+  let finish!: (view: Window) => void;
+  const requestWindow = vi.fn(() => new Promise<Window>(resolve => { finish = resolve; }));
+  const view = { isSecureContext: true, documentPictureInPicture: { requestWindow } } as unknown as Window;
+  Object.defineProperty(view, "top", { value: view });
+  const container = { ownerDocument: { defaultView: view }, parentElement: {}, isConnected: true } as HTMLElement;
+  return { container, view, requestWindow, finish: (window: Window) => finish(window) };
+}
+
+test("a room retired while the browser opens PiP closes the late window without moving its UI", async () => {
+  const { container, finish } = setup();
+  const controller = new AbortController();
+  const changed = vi.fn();
+  const close = vi.fn();
+  const opening = openPanelWindow(container, controller.signal, changed);
+  controller.abort();
+  finish({ close } as unknown as Window);
+  await opening;
+  expect(close).toHaveBeenCalledOnce();
+  expect(changed).not.toHaveBeenCalled();
+});
+
+test("an already retired surface does not ask the browser for another window", async () => {
+  const { container, requestWindow } = setup();
+  await openPanelWindow(container, AbortSignal.abort(), vi.fn());
+  expect(requestWindow).not.toHaveBeenCalled();
+});
+
+test("browser refusal leaves the current surface untouched and reports failure to its caller", async () => {
+  const { container, requestWindow } = setup();
+  requestWindow.mockRejectedValueOnce(new Error("NotAllowedError"));
+  const changed = vi.fn();
+  await expect(openPanelWindow(container, new AbortController().signal, changed)).rejects.toThrow("NotAllowedError");
+  expect(changed).not.toHaveBeenCalled();
+});
+
+test("unavailable or embedded browsers retain the in-page panel", () => {
+  expect(panelWindowAPI(null)).toBeUndefined();
+  const { view } = setup();
+  expect(panelWindowAPI(view)).toBeDefined();
+  expect(panelWindowAPI({ ...view, top: view } as Window)).toBeUndefined();
+});

From 398ad80ad13d57891c3543ba9d631892234e6ebe Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 18:42:02 +0800
Subject: [PATCH 256/262] refactor(ui): use native detached chat window
 controls

---
 docs/standards/visual-language.md                   |  4 ++--
 src/client/components/living/FloatingPanel.tsx      | 10 ++++------
 src/client/components/living/hints/interactions.tsx |  7 +++----
 src/client/locales/en.ts                            |  1 -
 src/client/locales/zh.ts                            |  1 -
 src/client/ui/visual-kinds.ts                       |  1 -
 6 files changed, 9 insertions(+), 15 deletions(-)

diff --git a/docs/standards/visual-language.md b/docs/standards/visual-language.md
index 15a7a16b4..4c77db7e5 100644
--- a/docs/standards/visual-language.md
+++ b/docs/standards/visual-language.md
@@ -68,8 +68,8 @@ One-shot settings and guidance retain their existing disclosures. Escape closes
 inner guidance first, then the most recently opened floating panel, then theater
 mode; an IME composition must not dismiss these surfaces.
 Detached chat uses the same content in the browser's own always-on-top frame.
-Its compact header offers return-to-page; in-page drag and resize controls yield
-to that frame instead of competing with it. Keep messages and text contrast
+Close, return-to-tab, movement and resizing belong to that frame; do not duplicate
+its controls in the compact chat header. Keep messages and text contrast
 primary; do not simulate transparent desktop content with a washed-out panel.
 
 Keep the application language control's segmented Chinese, English and visual
diff --git a/src/client/components/living/FloatingPanel.tsx b/src/client/components/living/FloatingPanel.tsx
index 3c29866a0..da6760176 100644
--- a/src/client/components/living/FloatingPanel.tsx
+++ b/src/client/components/living/FloatingPanel.tsx
@@ -260,13 +260,11 @@ export function FloatingPanel({ id, trigger, title, icon, compact = false, ancho
             </button>)}
           </div>
         </details>}
-        {detachable && (detached || panelWindowAPI(typeof window === "undefined" ? null : window)) &&
-          <Tooltip kind={detached ? "hint-chat-attach" : "hint-chat-detach"} place="below"
-            text={vis ? undefined : t(detached ? "floating.attach" : "floating.detach")}>
+        {detachable && !detached && panelWindowAPI(typeof window === "undefined" ? null : window) &&
+          <Tooltip kind="hint-chat-detach" place="below" text={vis ? undefined : t("floating.detach")}>
             <button type="button" className="lr-popover-close" disabled={openingWindow}
-              aria-label={t(detached ? "floating.attach" : "floating.detach")}
-              onClick={() => { if (detached) surfaceDocument?.defaultView?.close(); else void detach(); }}>
-              <Glyph name={detached ? "pipExit" : "pip"} size={18} />
+              aria-label={t("floating.detach")} onClick={() => { void detach(); }}>
+              <Glyph name="pip" size={18} />
             </button>
           </Tooltip>}
         {!detached && <button type="button" className="lr-popover-close" aria-label={t("common.close")} onClick={() => {
diff --git a/src/client/components/living/hints/interactions.tsx b/src/client/components/living/hints/interactions.tsx
index bf0c94d48..92c24c9fd 100644
--- a/src/client/components/living/hints/interactions.tsx
+++ b/src/client/components/living/hints/interactions.tsx
@@ -65,9 +65,9 @@ function ChatSettingsHint({ theme }: { theme: ComicTheme }) {
   </g>)}</>;
 }
 
-function ChatWindowHint({ theme, detach }: { theme: ComicTheme; detach: boolean }) {
+function ChatWindowHint({ theme }: { theme: ComicTheme }) {
   return <><InteractionMotion />{[0, 160].map((x, index) => {
-    const floating = index ? detach : !detach;
+    const floating = Boolean(index);
     return <g key={x}>
       <Frame x={x + 4} w={152} theme={theme} result={Boolean(index)} />
       <MiniTv x={x + 20} y={19} w={100} h={56} />
@@ -100,8 +100,7 @@ export const INTERACTION_SCENES: Record<InteractionHintKind, HintScene> = {
   "hint-chat-send": props => <ChatHint {...props} send />,
   "hint-chat-settings": props => <ChatSettingsHint {...props} />,
   "hint-chat-export": props => <ChatExportHint {...props} />,
-  "hint-chat-detach": props => <ChatWindowHint {...props} detach />,
-  "hint-chat-attach": props => <ChatWindowHint {...props} detach={false} />,
+  "hint-chat-detach": props => <ChatWindowHint {...props} />,
   "hint-chat-overlay-show": props => <OverlayHint {...props} show />,
   "hint-chat-overlay-hide": props => <OverlayHint {...props} show={false} />,
 };
diff --git a/src/client/locales/en.ts b/src/client/locales/en.ts
index 17dfef83a..1e1f212f5 100644
--- a/src/client/locales/en.ts
+++ b/src/client/locales/en.ts
@@ -157,7 +157,6 @@ export const en: Record<CopyKey, string> = {
   "interaction.close": "Hide chat window",
   "interaction.focus": "Show chat window",
   "floating.detach": "Always-on-top chat",
-  "floating.attach": "Return chat to page",
   "floating.detachFailed": "Could not open the chat window. Try again.",
   "floating.move": "Move window",
   "floating.moveHint": "Drag the title bar, use arrow keys to adjust, or choose a corner under Position.",
diff --git a/src/client/locales/zh.ts b/src/client/locales/zh.ts
index 7f8662761..bff6cb4a6 100644
--- a/src/client/locales/zh.ts
+++ b/src/client/locales/zh.ts
@@ -157,7 +157,6 @@ export const zh = {
   "interaction.close": "收起聊天窗口",
   "interaction.focus": "显示聊天窗口",
   "floating.detach": "置顶聊天窗口",
-  "floating.attach": "收回页面",
   "floating.detachFailed": "未能打开聊天窗口，请重试。",
   "floating.move": "移动窗口",
   "floating.moveHint": "拖动标题栏移动窗口；方向键可微调，也可以从「位置」选择角落。",
diff --git a/src/client/ui/visual-kinds.ts b/src/client/ui/visual-kinds.ts
index f6662be13..733dc7a80 100644
--- a/src/client/ui/visual-kinds.ts
+++ b/src/client/ui/visual-kinds.ts
@@ -151,7 +151,6 @@ export type InteractionHintKind =
   | "hint-chat-settings"
   | "hint-chat-export"
   | "hint-chat-detach"
-  | "hint-chat-attach"
   | "hint-chat-overlay-show"
   | "hint-chat-overlay-hide";
 

From 87b71ea1c6bec26c301431823fee90eeb72cbda8 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 18:59:53 +0800
Subject: [PATCH 257/262] fix(ui): keep playful copy quiet between real waits

---
 docs/standards/visual-language.md             | 51 +++++++++++--------
 site/main.js                                  | 15 ++----
 src/client/components/living/Stage.tsx        |  2 +-
 .../components/living/WaitingStatus.tsx       | 10 ++--
 src/client/components/living/WelcomeLine.tsx  |  6 +--
 src/client/pages/AppLauncherPage.tsx          |  2 +-
 src/client/pages/StatusPreviewPage.tsx        |  9 ++--
 src/client/pages/TooltipPreviewPage.tsx       |  2 +-
 src/client/styles.css                         |  6 +--
 src/client/ui/document-title.ts               |  3 +-
 src/client/ui/text-rotation.ts                |  6 +--
 src/client/ui/use-text-rotation.ts            | 13 +++--
 tests/text-rotation.test.ts                   | 29 +++++++----
 tests/waiting-status.test.ts                  | 14 ++---
 14 files changed, 90 insertions(+), 78 deletions(-)

diff --git a/docs/standards/visual-language.md b/docs/standards/visual-language.md
index 4c77db7e5..d3e2f0ece 100644
--- a/docs/standards/visual-language.md
+++ b/docs/standards/visual-language.md
@@ -332,14 +332,15 @@ support the task and use lighter icons or copy when another drawing adds noise.
 
 | Context | Illustration and literal content | Playful caption |
 | --- | --- | --- |
-| Page loading, site access check, App preparation | The shared wink mascot with the actual loading operation; no room or media-path claim | The current language's waiting pool |
+| Page loading or site access check | The shared wink mascot with the actual loading operation; no room or media-path claim | None |
+| App room startup | The shared wink mascot with the actual operation | One secondary waiting caption |
 | Confirmed App readiness | Wink mascot with literal readiness in dedicated feedback or its tooltip; an inline summary beside an existing main brand uses a status icon. Neither implies an active media route. | None |
 | Source listing/start/switch, room joining, media setup/recovery, waiting for the Host | The corresponding comic with the current status; only the existing state owner can declare waiting | The same waiting pool while the wait exists |
 | Error, limitation, pause, ended room or required user action | The corresponding comic and clear reason/action; settled movement keeps that verdict readable | None |
 | Small controls, tooltips and inline results | Existing action/status icon and contextual guidance when needed; retain direct actions | None |
 
 The shared `LoadingStatus`, `StageOverlay` and `WaitingCaption` apply this
-composition; source selection reuses the caption beside its existing comic.
+composition. Routine loading does not opt into playful copy automatically.
 Do not infer waiting from a chosen drawing, mascot visibility or animation flag.
 Healthy playback stays visible during control reconnection; this rule does not
 create another overlay. An idle room awaiting a new share differs from a closed
@@ -351,20 +352,26 @@ hidden captions; viewport size does not become product state.
 
 ### Playful Copy Lifecycle
 
-The shared [rotation owner](../../src/client/ui/text-rotation.ts) supplies the
-clock and visibility policy; its React adapter and the static website consume
-the same rule. Locale files own the independent pools.
-
-Website/App welcome lines, waiting captions and playful title variations share
-one lifecycle. Show an entry immediately, then change it every eight seconds
-while visible. Draw without replacement until the current pool is exhausted.
-An ordinary rerender or metric update does not restart the cycle. A new semantic
-context or language starts from that context's current-language pool; never
-reuse a cross-language array index. Hidden surfaces stop advancing. On return,
-keep the current line for a full interval; reduced motion retains a static line.
-Unmount or an ended context retires timers and listeners. Empty pools omit the
-decoration; one-entry pools stay static. Real completion never waits for copy
-or an animation to finish. This cadence is a product choice, not measured progress.
+Locale files own independent pools; the shared
+[selection and rotation owner](../../src/client/ui/text-rotation.ts) and its
+React adapter provide selection, timing and visibility. Keep one secondary
+playful line in an operational page's main content, with no duplicates in
+subpanels. Review the whole composition before adding another caption.
+
+Website/App welcomes select one entry immediately and keep it during that visit.
+Tab titles retain one variation per actual activity, without a timer. Ordinary
+rerenders and metric updates do not draw another entry. A welcome's text/visual
+switch preserves its selected entry. Language changes use that language's pool,
+never a cross-language array index.
+
+Only App room startup and media waits rotate their secondary caption: show one
+immediately, then change it every fifteen visible seconds. Changes of the literal
+status within a continuous wait do not redraw the caption or reset its clock.
+Draw without replacement until the pool is exhausted. Hidden surfaces stop
+advancing; on return, keep the line for a full interval. Reduced motion retains
+a static line. Unmount or an ended wait retires timers and listeners. Empty pools
+omit the decoration; one-entry pools stay static. Real completion never waits
+for copy or animation. This cadence is a product choice, not measured progress.
 
 Each language maintains independent contextual pools without equal counts,
 paired translation keys or a fixed total. Contributors can add a locally natural
@@ -382,9 +389,9 @@ review; this copy policy does not require a mascot or a new tooltip everywhere.
 
 | Existing surface | Copy coverage |
 | --- | --- |
-| Website welcome, App launcher, sharing entry | The current language's welcome pool; the App's visual mode renders that entry's cipher. |
-| Loading, source selection and media waiting | A secondary waiting caption according to [feedback composition](#feedback-composition). |
-| Browser tab | Sharing, watching, starting, ready-to-share, not-started and waiting states may append their own variations; room identity, literal activity and warnings remain visible. |
+| Website welcome, App launcher, sharing entry | One welcome per entry; the App's visual mode renders that entry's cipher. |
+| App room startup and media waiting | One slowly rotating caption according to [feedback composition](#feedback-composition). Ordinary page loading and access checks use literal status only. |
+| Browser tab | Sharing, watching, starting, ready-to-share, not-started and waiting states may append one stable variation; room identity, literal activity and warnings remain visible. |
 | Error, pause, ended state, required action, tooltip, small control | Keep the existing literal message and contextual graphic; no rotating caption is added. |
 
 ## Panel Composition
@@ -525,11 +532,11 @@ Entry screens may carry one quiet, original welcome line in Chinese or English
 text mode. Pure-visual mode pairs familiar pictograms with static pixel
 pseudo-lettering tied to the same line. Hide that visual cipher from assistive
 technology; the ordinary text sentence remains readable. Switching between text
-and visual mode preserves the selected welcome entry; rotation follows the
+and visual mode preserves the selected welcome entry; selection follows the
 [shared lifecycle](#playful-copy-lifecycle). The line never replaces an action,
 error, loading message or connection progress. Keep it on one line, apart from
 the actions; primary controls take precedence when space is tight. A clipped line
-may pan to its end within the shared reading interval; fitting text stays still.
+may pan once to reveal its end; fitting text stays still.
 Pause with the copy's existing visibility owner. Reduced motion keeps the text
 stationary and manually scrollable instead of discarding the hidden words.
 
@@ -571,5 +578,5 @@ moving the pointer away.
 
 [Carbon loading guidance](https://carbondesignsystem.com/components/loading/usage/)
 supports avoiding competing indicators and keeping required user actions distinct
-from passive loading. Piik's immediate captions and eight-second cadence are its
+from passive loading. Piik's selected waiting captions and fifteen-second cadence are its
 own presentation choice.
diff --git a/site/main.js b/site/main.js
index 3d2f5dac4..2b38cc433 100644
--- a/site/main.js
+++ b/site/main.js
@@ -1,6 +1,6 @@
 import { mountBrands } from './assets/brand.js';
 import { initialLanguage, rememberLanguage } from './assets/language.js';
-import { createTextCycle, startTextRotation } from '../src/client/ui/text-rotation.ts';
+import { createTextCycle } from '../src/client/ui/text-rotation.ts';
 import { DEFAULT_RELEASE_API_URL, parseReleaseMetadata } from '../src/client/lib/release-update.ts';
 mountBrands();
 const architecturePickers = document.querySelectorAll('.download-architecture');
@@ -57,21 +57,13 @@ const film = document.getElementById('film-preview');
 const filmFrame = document.getElementById('website-film');
 const filmLink = document.querySelector('[data-film-link]');
 const welcomeLines = document.getElementById('welcome-lines')?.content.children;
-let stopWelcome = () => {};
-let syncWelcomeMotion = () => {};
 function syncWelcome() {
   if (!welcomeLines) return;
   const element = document.getElementById('welcome-line');
   const pool = Array.from(welcomeLines).filter(line => line.lang === root.lang);
-  const next = createTextCycle(pool);
-  const show = () => element.replaceChildren(...(pool.length ? [next().cloneNode(true)] : []));
+  const line = createTextCycle(pool)();
   element.hidden = pool.length === 0;
-  show();
-  syncWelcomeMotion = () => {
-    stopWelcome();
-    stopWelcome = pool.length > 1 && !reducedMotion() ? startTextRotation(show, element) : () => {};
-  };
-  syncWelcomeMotion();
+  element.replaceChildren(...(line ? [line.cloneNode(true)] : []));
 }
 function syncFilmPreferences() {
   const target = new URL(filmLink.href);
@@ -197,7 +189,6 @@ function syncMotionPreference() {
     button.disabled = still;
   });
   roomIllustration.src = './assets/living-room.svg' + (still ? '#still' : '');
-  syncWelcomeMotion();
 }
 motionControl.addEventListener('change', () => {
   preferStill = motionControl.checked;
diff --git a/src/client/components/living/Stage.tsx b/src/client/components/living/Stage.tsx
index 1cd055968..15a5ee55a 100644
--- a/src/client/components/living/Stage.tsx
+++ b/src/client/components/living/Stage.tsx
@@ -78,7 +78,7 @@ export function StageOverlay({
           </span>
         ) : <span className="lr-tv-msg">{message}</span>}
       </span>
-      {isWaiting && <WaitingCaption context={comic ?? "media"} still={still} />}
+      {isWaiting && <WaitingCaption still={still} />}
     </>
   );
   if (onActivate) {
diff --git a/src/client/components/living/WaitingStatus.tsx b/src/client/components/living/WaitingStatus.tsx
index df40dd977..bbca95c28 100644
--- a/src/client/components/living/WaitingStatus.tsx
+++ b/src/client/components/living/WaitingStatus.tsx
@@ -7,22 +7,24 @@ import { BrandLoader } from "./BrandMark";
 const NO_CAPTIONS: readonly string[] = [];
 
 /** Decoration beside a literal status; it never describes operation progress. */
-export function WaitingCaption({ context, still = false }: { context: string; still?: boolean }) {
+export function WaitingCaption({ still = false }: { still?: boolean }) {
   const { lang, vis } = useCopy();
   const captionRef = useRef<HTMLSpanElement>(null);
   const line = useRotatingText(vis ? NO_CAPTIONS : locales[lang].playful.waiting,
-    `${lang}:${context}`, captionRef, still);
+    lang, { element: captionRef, still });
   if (!line) return null;
   return <span className="lr-waiting-caption" ref={captionRef} aria-hidden="true">
     <span key={line}>{line}</span>
   </span>;
 }
 
-export function LoadingStatus({ label, still = false }: { label: CopyKey; still?: boolean }) {
+export function LoadingStatus({ label, still = false, waitingCaption = false }: {
+  label: CopyKey; still?: boolean; waitingCaption?: boolean;
+}) {
   const { t, vis } = useCopy();
   return <div className="lr-loading" role="status" aria-label={t(label)}>
     <BrandLoader still={still} />
     {vis ? null : <span>{t(label)}</span>}
-    <WaitingCaption context={label} still={still} />
+    {waitingCaption && <WaitingCaption still={still} />}
   </div>;
 }
diff --git a/src/client/components/living/WelcomeLine.tsx b/src/client/components/living/WelcomeLine.tsx
index 68e79adf6..30c6ae7a6 100644
--- a/src/client/components/living/WelcomeLine.tsx
+++ b/src/client/components/living/WelcomeLine.tsx
@@ -3,7 +3,6 @@ import { locales, type WelcomeEntry } from "../../locales";
 import { useCopy } from "../../ui/copy";
 import { Glyph, type GlyphName } from "../../ui/icons";
 import { useRotatingText } from "../../ui/use-text-rotation";
-import { TEXT_ROTATION_INTERVAL_MS } from "../../ui/text-rotation";
 
 // Original 5x5 pseudo-letters; recurring ideas keep the same pixel word.
 const PIXEL_LETTERS = [
@@ -35,10 +34,9 @@ export function WelcomeCipher({ symbols }: Pick<WelcomeEntry, "symbols">) {
 export function WelcomeLine({ still = false }: { still?: boolean }) {
   const { lang, vis } = useCopy();
   const element = useRef<HTMLParagraphElement>(null);
-  const line = useRotatingText<WelcomeEntry>(locales[lang].playful.welcome, lang, element, still);
+  const line = useRotatingText<WelcomeEntry>(locales[lang].playful.welcome, lang, { element, still, rotate: false });
   if (!line) return null;
   return <p ref={element} className={`lr-welcome${vis ? " is-cipher" : ""}${still ? " is-still" : ""}`} aria-hidden={vis || undefined}>
-    {vis ? <WelcomeCipher symbols={line.symbols} /> : <span key={line.text} className="lr-welcome-text"
-      style={{ animationDuration: `${TEXT_ROTATION_INTERVAL_MS}ms` }}>{line.text}</span>}
+    {vis ? <WelcomeCipher symbols={line.symbols} /> : <span key={line.text} className="lr-welcome-text">{line.text}</span>}
   </p>;
 }
diff --git a/src/client/pages/AppLauncherPage.tsx b/src/client/pages/AppLauncherPage.tsx
index 42d704efc..a58a27f3a 100644
--- a/src/client/pages/AppLauncherPage.tsx
+++ b/src/client/pages/AppLauncherPage.tsx
@@ -229,7 +229,7 @@ export function AppLauncherPage() {
       <main className="lr-client-launch">
         {debugError && <Pill icon="alert" tone="bad" comic="warning" alert label={t("client.launch.debugFailed")} />}
         {loading || (starting && !requestedSite) ? (
-          <LoadingStatus label={starting ? "client.launch.starting" : "common.loading"} />
+          <LoadingStatus label={starting ? "client.launch.starting" : "common.loading"} waitingCaption={starting} />
         ) : error?.kind === "load" ? (
           <div className="lr-client-launch-panel">
             <Pill
diff --git a/src/client/pages/StatusPreviewPage.tsx b/src/client/pages/StatusPreviewPage.tsx
index 7c8e4fce6..e62ea20a3 100644
--- a/src/client/pages/StatusPreviewPage.tsx
+++ b/src/client/pages/StatusPreviewPage.tsx
@@ -47,7 +47,7 @@ export function StatusPreviewPage() {
   const waitingParticipant = deriveParticipantStatus({ upstream: { kind: "none" } }, sourceActive);
   const titleContent = titleFrames(status.titleFrameKey);
   const title = useDocumentTitle(["6020", titleContent.label, status.titleMarker], titleContent.variations,
-    `${lang}:${vis}:${status.titleFrameKey}`, reducedMotion);
+    `${lang}:${vis}:${status.titleFrameKey}`);
   const waitingLines = locales[lang].playful.waiting;
 
   function choose(id: string) {
@@ -186,7 +186,7 @@ export function StatusPreviewPage() {
         </section>
         <section className="sp-catalog" id="waiting-preview">
           <header><h2>加载与等待</h2>
-            <p>通用加载用 mascot，具体媒体状态用对应漫画；文字模式保留真实状态与等待短句。短句立即出现，每 8 秒轮换，隐藏时暂停。切换上方场景可比较等待、错误和操作提示。</p>
+            <p>页面加载与站点检查只显示真实状态。App 启动与媒体等待保留一句次要短句，每 15 秒轮换，隐藏时暂停；连续等待中的状态变化不会重新抽句。</p>
           </header>
           <label>入口状态 <select value={loadingLabel} onChange={event => setLoadingLabel(event.target.value as CopyKey | "")}>
             <option value="common.loading">页面加载</option>
@@ -195,7 +195,8 @@ export function StatusPreviewPage() {
             <option value="">结束等待</option>
           </select></label>
           <div className="sp-loading-preview">
-            {loadingLabel ? <LoadingStatus label={loadingLabel} still={reducedMotion} /> : <span>等待组件已卸载。</span>}
+            {loadingLabel ? <LoadingStatus label={loadingLabel} still={reducedMotion}
+              waitingCaption={loadingLabel === "client.launch.starting"} /> : <span>等待组件已卸载。</span>}
           </div>
           <details className="sp-title-catalog"><summary>等待短句 · {waitingLines.length} 条</summary>
             <ol>{waitingLines.map(line => <li key={line}>{line}</li>)}</ol>
@@ -203,7 +204,7 @@ export function StatusPreviewPage() {
         </section>
         <section className="sp-catalog">
           <header><h2>标题彩蛋词库</h2>
-            <p>真实状态与提醒始终保留。六类状态附带独立的彩蛋词库，立即显示、每 8 秒轮换，本轮抽完再重复。暂停、结束和操作提示保持固定。各语言可分别增补短句，不要求数量相同。</p>
+            <p>真实状态与提醒始终保留。六类状态各随机选一句彩蛋，同一状态内不轮播。暂停、结束和操作提示保持固定。各语言可分别增补短句，不要求数量相同。</p>
           </header>
           {(Object.keys(locales.zh.titleFrames) as TitleFrameKey[]).map(key => {
             const frames = titleFrames(key);
diff --git a/src/client/pages/TooltipPreviewPage.tsx b/src/client/pages/TooltipPreviewPage.tsx
index b9622e04a..dbbb91f31 100644
--- a/src/client/pages/TooltipPreviewPage.tsx
+++ b/src/client/pages/TooltipPreviewPage.tsx
@@ -87,7 +87,7 @@ export function TooltipPreviewPage() {
         <WelcomeLine still={reducedMotion} />
         <details id="welcome-preview" className="lr-welcome-catalog" open>
           <summary>{locales[lang].playful.welcome.length} {en ? "opening lines" : "句开场白"}</summary>
-          <p>{en ? "A line appears immediately, then changes every eight seconds while visible. Each language has its own pool. Pure visual mode uses that entry's pictograms and pixel lettering; switching modes keeps the same entry." : "短句立即出现，可见时每 8 秒换一条。各语言独立维护词库；纯视觉模式显示当前语句对应的图形与像素暗号，切换模式仍是同一句。"}</p>
+          <p>{en ? "One random line per entry, with no automatic rotation. Each language has its own pool. Pure visual mode uses that entry's pictograms and pixel lettering; switching modes keeps the same entry." : "每次进入随机一句，停留时不轮播。各语言独立维护词库；纯视觉模式显示当前语句对应的图形与像素暗号，切换模式仍是同一句。"}</p>
           <ol>{locales[lang].playful.welcome.map(({ text, symbols }) => <li key={text}><span>{text}</span><WelcomeCipher symbols={symbols} /></li>)}</ol>
         </details>
         <h2 id="comic-preview">语义规则 / Semantic grammar</h2>
diff --git a/src/client/styles.css b/src/client/styles.css
index 170e922f9..8e8910796 100644
--- a/src/client/styles.css
+++ b/src/client/styles.css
@@ -1241,13 +1241,13 @@ html[data-theme="dark"] .lr-invite-url { background: #1a2634; border-color: #334
 .lr-welcome-text::before { content: "✦"; color: #d7982b; margin-right: 8px; }
 @media (prefers-reduced-motion: no-preference) {
   .lr-welcome:not(.is-still, .is-cipher) { overflow: clip; }
-  .lr-welcome:not(.is-still) .lr-welcome-text { animation: lr-welcome-read linear both; }
+  .lr-welcome:not(.is-still) .lr-welcome-text { animation: lr-welcome-read 8s linear both; }
   .lr-welcome[data-text-active="false"] .lr-welcome-text { animation-name: none; }
 }
 [data-comic-reduced-motion="true"] .lr-welcome { overflow-x: auto; }
 [data-comic-reduced-motion="true"] .lr-welcome-text { animation: none; }
-/* Fitting lines stay still. Longer lines reveal their end before the shared
-   copy clock advances; the keyed text restarts this CSS motion, not a timer. */
+/* Fitting lines stay still. Longer lines pan once to reveal their end;
+   changing language restarts this CSS motion, not a copy-rotation timer. */
 @keyframes lr-welcome-read {
   0%, 20% { transform: translateX(0); }
   75%, 100% { transform: translateX(min(0px, calc(100cqw - 100%))); }
diff --git a/src/client/ui/document-title.ts b/src/client/ui/document-title.ts
index e397f210e..d36449c7b 100644
--- a/src/client/ui/document-title.ts
+++ b/src/client/ui/document-title.ts
@@ -16,9 +16,8 @@ export function useDocumentTitle(
   parts: Array<string | null | undefined>,
   variations: readonly string[],
   context: string,
-  still = false,
 ): string {
-  const decoration = useRotatingText(variations, context, undefined, still);
+  const decoration = useRotatingText(variations, context, { rotate: false });
   const title = composeDocumentTitle(...parts, decoration);
   useEffect(() => {
     document.title = title;
diff --git a/src/client/ui/text-rotation.ts b/src/client/ui/text-rotation.ts
index 7c93cdb74..3841ec506 100644
--- a/src/client/ui/text-rotation.ts
+++ b/src/client/ui/text-rotation.ts
@@ -1,4 +1,4 @@
-export const TEXT_ROTATION_INTERVAL_MS = 8_000;
+export const TEXT_ROTATION_INTERVAL_MS = 15_000;
 
 /** A local decoration cycle; changing product state creates a new cycle. */
 export function createTextCycle<T>(frames: readonly T[]): () => T | undefined {
@@ -16,7 +16,7 @@ export function createTextCycle<T>(frames: readonly T[]): () => T | undefined {
 }
 
 /** Hidden surfaces keep their entry and resume with a full reading interval. */
-export function startTextRotation(tick: () => void, element?: Element | null, onActivity?: (active: boolean) => void): () => void {
+export function startTextRotation(tick: (() => void) | undefined, element?: Element | null, onActivity?: (active: boolean) => void): () => void {
   const reducedMotion = window.matchMedia("(prefers-reduced-motion: reduce)");
   let inView = !element;
   let retired = false;
@@ -27,7 +27,7 @@ export function startTextRotation(tick: () => void, element?: Element | null, on
     timer = undefined;
     const active = inView && document.visibilityState === "visible" && !reducedMotion.matches;
     onActivity?.(active);
-    if (active) {
+    if (active && tick) {
       timer = window.setInterval(tick, TEXT_ROTATION_INTERVAL_MS);
     }
   };
diff --git a/src/client/ui/use-text-rotation.ts b/src/client/ui/use-text-rotation.ts
index cee0cde55..72b2e8e88 100644
--- a/src/client/ui/use-text-rotation.ts
+++ b/src/client/ui/use-text-rotation.ts
@@ -5,8 +5,9 @@ import { createTextCycle, startTextRotation } from "./text-rotation";
 export function useRotatingText<T>(
   frames: readonly T[],
   context: string,
-  element?: RefObject<HTMLElement | null>,
-  still = false,
+  { element, still = false, rotate = true }: {
+    element?: RefObject<HTMLElement | null>; still?: boolean; rotate?: boolean;
+  } = {},
 ): T | undefined {
   const cycle = useMemo(() => {
     const next = createTextCycle(frames);
@@ -14,12 +15,14 @@ export function useRotatingText<T>(
   }, [frames, context]);
   const [selected, select] = useState({ cycle, value: cycle.first });
   useEffect(() => {
-    if (frames.length < 2 || still) return;
+    if (still) return;
     const surface = element?.current;
-    const stop = startTextRotation(() => select({ cycle, value: cycle.next() }), surface,
+    const tick = rotate && frames.length > 1 ? () => select({ cycle, value: cycle.next() }) : undefined;
+    if (!tick && !surface) return;
+    const stop = startTextRotation(tick, surface,
       active => surface?.setAttribute("data-text-active", String(active)));
     return () => { stop(); surface?.removeAttribute("data-text-active"); };
-  }, [cycle, frames.length, element, still]);
+  }, [cycle, frames.length, element, still, rotate]);
   // Language/context changes display the new pool immediately, before effects.
   return selected.cycle === cycle ? selected.value : cycle.first;
 }
diff --git a/tests/text-rotation.test.ts b/tests/text-rotation.test.ts
index 1a9c0b211..fd312f7bd 100644
--- a/tests/text-rotation.test.ts
+++ b/tests/text-rotation.test.ts
@@ -42,14 +42,14 @@ it("exhausts each pool before repeating and avoids repeating across a round boun
   expect([single(), single()]).toEqual(["Only", "Only"]);
 });
 
-it("advances on the shared eight-second cadence", () => {
+it("advances on the shared fifteen-second waiting cadence", () => {
   const tick = vi.fn();
   stop = startTextRotation(tick);
-  vi.advanceTimersByTime(7_999);
+  vi.advanceTimersByTime(14_999);
   expect(tick).not.toHaveBeenCalled();
   vi.advanceTimersByTime(1);
   expect(tick).toHaveBeenCalledTimes(1);
-  vi.advanceTimersByTime(16_000);
+  vi.advanceTimersByTime(30_000);
   expect(tick).toHaveBeenCalledTimes(3);
 });
 
@@ -63,7 +63,7 @@ it("does not consume hidden entries and resumes with a full reading interval", (
   vi.advanceTimersByTime(60_000);
   page.visibilityState = "visible";
   page.dispatchEvent(new Event("visibilitychange"));
-  vi.advanceTimersByTime(7_999);
+  vi.advanceTimersByTime(14_999);
   expect(tick).not.toHaveBeenCalled();
   vi.advanceTimersByTime(1);
   expect(tick).toHaveBeenCalledTimes(1);
@@ -76,7 +76,7 @@ it("honors reduced motion at entry and when the preference changes", () => {
   expect(vi.getTimerCount()).toBe(0);
   motion.matches = false;
   motion.dispatchEvent(new Event("change"));
-  vi.advanceTimersByTime(8_000);
+  vi.advanceTimersByTime(15_000);
   expect(tick).toHaveBeenCalledTimes(1);
   motion.matches = true;
   motion.dispatchEvent(new Event("change"));
@@ -84,7 +84,7 @@ it("honors reduced motion at entry and when the preference changes", () => {
   expect(tick).toHaveBeenCalledTimes(1);
   motion.matches = false;
   motion.dispatchEvent(new Event("change"));
-  vi.advanceTimersByTime(7_999);
+  vi.advanceTimersByTime(14_999);
   expect(tick).toHaveBeenCalledTimes(1);
   vi.advanceTimersByTime(1);
   expect(tick).toHaveBeenCalledTimes(2);
@@ -116,16 +116,16 @@ it("pauses offscreen surfaces and releases all listeners at retirement", () => {
   motion.matches = false;
   motion.dispatchEvent(new Event("change"));
   expect(activity).toHaveBeenLastCalledWith(true);
-  vi.advanceTimersByTime(4_000);
+  vi.advanceTimersByTime(7_000);
   show(true); // A repeated observation must not reset the running clock.
-  vi.advanceTimersByTime(4_000);
+  vi.advanceTimersByTime(8_000);
   expect(tick).toHaveBeenCalledTimes(1);
   show(false);
   expect(activity).toHaveBeenLastCalledWith(false);
   vi.advanceTimersByTime(60_000);
   expect(tick).toHaveBeenCalledTimes(1);
   show(true);
-  vi.advanceTimersByTime(7_999);
+  vi.advanceTimersByTime(14_999);
   expect(tick).toHaveBeenCalledTimes(1);
   vi.advanceTimersByTime(1);
   expect(tick).toHaveBeenCalledTimes(2);
@@ -139,3 +139,14 @@ it("pauses offscreen surfaces and releases all listeners at retirement", () => {
   expect(activity).toHaveBeenLastCalledWith(false);
   expect(disconnect).toHaveBeenCalled();
 });
+
+it("observes a static welcome's visibility without running a rotation timer", () => {
+  const activity = vi.fn();
+  stop = startTextRotation(undefined, {} as Element, activity);
+  intersect([{ isIntersecting: true, intersectionRatio: 1 } as IntersectionObserverEntry], {} as IntersectionObserver);
+  expect(activity).toHaveBeenLastCalledWith(true);
+  expect(vi.getTimerCount()).toBe(0);
+  page.visibilityState = "hidden";
+  page.dispatchEvent(new Event("visibilitychange"));
+  expect(activity).toHaveBeenLastCalledWith(false);
+});
diff --git a/tests/waiting-status.test.ts b/tests/waiting-status.test.ts
index d659f8b33..a3874fb4b 100644
--- a/tests/waiting-status.test.ts
+++ b/tests/waiting-status.test.ts
@@ -18,7 +18,7 @@ afterEach(() => {
 it.each(["zh", "en"] as const)("keeps %s waiting copy secondary to the actual operation", lang => {
   setCopy({ lang, vis: false });
   vi.spyOn(Math, "random").mockReturnValue(0);
-  const html = renderToStaticMarkup(createElement(LoadingStatus, { label: "client.launch.starting" }));
+  const html = renderToStaticMarkup(createElement(LoadingStatus, { label: "client.launch.starting", waitingCaption: true }));
   expect(html).toContain(`aria-label="${t(lang, "client.launch.starting")}"`);
   expect(html).toContain('class="lr-brand-loader"');
   expect(html).not.toContain("data-comic-motion");
@@ -26,12 +26,12 @@ it.each(["zh", "en"] as const)("keeps %s waiting copy secondary to the actual op
   expect(html).toContain(locales[lang].playful.waiting[0]);
 });
 
-it("uses the generic loading composition for site access checks", () => {
+it.each(["common.loading", "gate.checking"] as const)("keeps routine %s feedback literal", label => {
   setCopy({ lang: "en", vis: false });
-  const html = renderToStaticMarkup(createElement(LoadingStatus, { label: "viewer.msg.joining" }));
+  const html = renderToStaticMarkup(createElement(LoadingStatus, { label }));
   expect(html).toContain('class="lr-brand-loader"');
-  expect(html).toContain(t("en", "viewer.msg.joining"));
-  expect(html).toContain('class="lr-waiting-caption"');
+  expect(html).toContain(t("en", label));
+  expect(html).not.toContain('class="lr-waiting-caption"');
   expect(html).not.toContain('data-comic-motion="progress"');
 });
 
@@ -74,7 +74,7 @@ it("keeps a required action usable even if waiting was requested", () => {
 
 it("keeps the mascot in visual-mode loading without adding a network claim", () => {
   setCopy({ vis: true });
-  const html = renderToStaticMarkup(createElement(LoadingStatus, { label: "common.loading" }));
+  const html = renderToStaticMarkup(createElement(LoadingStatus, { label: "client.launch.starting", waitingCaption: true }));
   expect(html).toContain('class="lr-brand-loader"');
   expect(html).not.toContain("data-comic-motion");
   expect(html).not.toContain('class="lr-waiting-caption"');
@@ -114,7 +114,7 @@ it("omits an empty language pool without hiding the real status or filling from
   try {
     setCopy({ lang: "zh", vis: false });
     expect(renderToStaticMarkup(createElement(WelcomeLine))).toBe("");
-    const loading = renderToStaticMarkup(createElement(LoadingStatus, { label: "common.loading" }));
+    const loading = renderToStaticMarkup(createElement(LoadingStatus, { label: "common.loading", waitingCaption: true }));
     expect(loading).toContain(t("zh", "common.loading"));
     expect(loading).not.toContain("lr-waiting-caption");
   } finally {

From 24a28738241b9012c0476386356a515aab21f1a5 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 19:16:55 +0800
Subject: [PATCH 258/262] fix(app): serialize control completion and launcher
 refreshes

---
 docs/operations/self-hosting.md             |  2 +-
 docs/operations/self-hosting.zh-CN.md       |  2 +-
 docs/operations/service-management.md       |  2 +-
 docs/operations/service-management.zh-CN.md |  2 +-
 internal/app/loopback/server.go             |  6 ++
 internal/app/loopback/server_test.go        | 11 ++-
 internal/app/nativecontrol/punch.go         | 39 ++++++++-
 internal/app/nativecontrol/punch_test.go    | 62 ++++++++++++++
 internal/app/nativecontrol/session.go       | 33 +++-----
 internal/app/nativecontrol/session_test.go  | 16 ++++
 src/client/pages/AppLauncherPage.tsx        | 36 ++++++--
 tests/app-launcher-recovery.test.ts         | 94 ++++++++++++++++++---
 12 files changed, 259 insertions(+), 46 deletions(-)

diff --git a/docs/operations/self-hosting.md b/docs/operations/self-hosting.md
index ce2ea916a..5078b43cb 100644
--- a/docs/operations/self-hosting.md
+++ b/docs/operations/self-hosting.md
@@ -1,6 +1,6 @@
 # Deploy Piik Server
 
-English · [简体中文](./self-hosting.zh-CN.md) · [Documentation](../README.md)
+English · [简体中文](./self-hosting.zh-CN.md) · [Documentation](../guide/README.md)
 
 Piik Server packages the web interface, room management and optional media
 forwarding in **one server binary**. Extract and run it; room data is stored in SQLite.
diff --git a/docs/operations/self-hosting.zh-CN.md b/docs/operations/self-hosting.zh-CN.md
index 1e8a05977..ef3116945 100644
--- a/docs/operations/self-hosting.zh-CN.md
+++ b/docs/operations/self-hosting.zh-CN.md
@@ -1,6 +1,6 @@
 # 部署 Piik Server
 
-[English](./self-hosting.md) · 简体中文 · [文档导航](../README.md)
+[English](./self-hosting.md) · 简体中文 · [文档导航](../guide/README.zh-CN.md)
 
 Piik Server 将网页、房间管理和可选的媒体转发打包在**一个服务端程序**中。
 解压后即可运行，房间数据保存在 SQLite 中。
diff --git a/docs/operations/service-management.md b/docs/operations/service-management.md
index b3560cf81..7b28ddcc1 100644
--- a/docs/operations/service-management.md
+++ b/docs/operations/service-management.md
@@ -1,6 +1,6 @@
 # Service Management
 
-English · [简体中文](./service-management.zh-CN.md) · [Documentation](../README.md)
+English · [简体中文](./service-management.zh-CN.md) · [Documentation](../guide/README.md)
 
 For first installation, use the [short self-hosting guide](./self-hosting.md).
 This reference covers a persistent Linux service and container maintenance.
diff --git a/docs/operations/service-management.zh-CN.md b/docs/operations/service-management.zh-CN.md
index 0adc90ae9..752aeef0f 100644
--- a/docs/operations/service-management.zh-CN.md
+++ b/docs/operations/service-management.zh-CN.md
@@ -1,6 +1,6 @@
 # 服务管理
 
-[English](./service-management.md) · 简体中文 · [文档导航](../README.md)
+[English](./service-management.md) · 简体中文 · [文档导航](../guide/README.zh-CN.md)
 
 首次安装请从[部署指南](./self-hosting.zh-CN.md)开始。本页介绍 Linux 常驻服务与容器维护。
 
diff --git a/internal/app/loopback/server.go b/internal/app/loopback/server.go
index 7b2de1f61..20f48e0f1 100644
--- a/internal/app/loopback/server.go
+++ b/internal/app/loopback/server.go
@@ -54,6 +54,9 @@ type ControlSession interface {
 type ControlEvent struct {
 	Value   any
 	Current func() bool
+	// BeforeWrite releases an operation's admission before its ACK can trigger
+	// the next command. It must not block on I/O or send another event.
+	BeforeWrite func()
 }
 
 type Endpoint struct {
@@ -443,6 +446,9 @@ func (server *Server) handleControl(response http.ResponseWriter, request *http.
 			if event.Current != nil && !event.Current() {
 				return nil
 			}
+			if event.BeforeWrite != nil {
+				event.BeforeWrite()
+			}
 			value = event.Value
 		}
 		encoded, encodeErr := encodeMessage(value)
diff --git a/internal/app/loopback/server_test.go b/internal/app/loopback/server_test.go
index 198b26567..37e0c60f5 100644
--- a/internal/app/loopback/server_test.go
+++ b/internal/app/loopback/server_test.go
@@ -251,15 +251,22 @@ func TestControlSessionSharesOneBoundedSocketForResponsesAndEvents(t *testing.T)
 		Current: func() bool { return current }}
 	current = false
 	extension.events <- retired
+	prepared := make(chan struct{})
 	extension.events <- ControlEvent{
-		Value:   controlMessage{Version: ProtocolVersion, Type: "current-event"},
-		Current: func() bool { return true },
+		Value:       controlMessage{Version: ProtocolVersion, Type: "current-event"},
+		Current:     func() bool { return true },
+		BeforeWrite: func() { close(prepared) },
 	}
 	var currentEvent controlMessage
 	readControl(t, connection, &currentEvent)
 	if currentEvent.Type != "current-event" {
 		t.Fatalf("retired event escaped the delivery fence: %+v", currentEvent)
 	}
+	select {
+	case <-prepared:
+	default:
+		t.Fatal("response was visible before its operation released admission")
+	}
 	extension.events <- controlMessage{
 		Version: ProtocolVersion, ID: "event_123456", Type: "extension-event",
 	}
diff --git a/internal/app/nativecontrol/punch.go b/internal/app/nativecontrol/punch.go
index 77d70cf6f..ef52ac527 100644
--- a/internal/app/nativecontrol/punch.go
+++ b/internal/app/nativecontrol/punch.go
@@ -35,7 +35,16 @@ type punchCompleteResponse struct {
 	Connected bool `json:"connected"`
 }
 
-func (session *Session) handlePunch(envelope requestEnvelope, payload []byte, complete func(any, error)) (any, error) {
+func (session *Session) handlePunch(envelope requestEnvelope, payload []byte, complete func(any, error)) (value any, returnedErr error) {
+	var done chan struct{}
+	defer func() {
+		if done != nil && returnedErr != nil {
+			session.mu.Lock()
+			session.punchDone = nil
+			close(done)
+			session.mu.Unlock()
+		}
+	}()
 	switch envelope.Type {
 	case "prepare-punch":
 		var request preparePunchRequest
@@ -52,6 +61,10 @@ func (session *Session) handlePunch(envelope requestEnvelope, payload []byte, co
 		if err != nil {
 			return nil, err
 		}
+		done, err = session.beginPunchOperation()
+		if err != nil {
+			return nil, err
+		}
 		var preparation *mediaedge.PunchPreparation
 		if request.EdgeCapacity != nil {
 			// Only a receiving request may establish a Viewer role. A late sender
@@ -77,7 +90,8 @@ func (session *Session) handlePunch(envelope requestEnvelope, payload []byte, co
 			prediction, err := preparation.Prepare()
 			result := punchPreparedResponse{response(envelope, "punch-prepared"), prediction}
 			complete(result, err)
-			session.emit(result)
+			session.mu.Lock()
+			session.finishOperation(&session.punchDone, done, result)
 		}()
 		return nil, nil
 	case "run-punch":
@@ -97,10 +111,16 @@ func (session *Session) handlePunch(envelope requestEnvelope, payload []byte, co
 		if preparation == nil {
 			return nil, errors.New("connection preparation was retired")
 		}
+		var err error
+		done, err = session.beginPunchOperation()
+		if err != nil {
+			return nil, err
+		}
 		go func() {
 			result := punchCompleteResponse{response(envelope, "punch-complete"), preparation.Run(prediction)}
 			complete(result, nil)
-			session.emit(result)
+			session.mu.Lock()
+			session.finishOperation(&session.punchDone, done, result)
 		}()
 		return nil, nil
 	case "close-punch":
@@ -115,3 +135,16 @@ func (session *Session) handlePunch(envelope requestEnvelope, payload []byte, co
 	}
 	return nil, protocolViolation("unknown connection preparation request")
 }
+
+// Bound response workers as well as socket work. Keep this slot through response
+// delivery, independently of capture mutations; close-punch remains synchronous.
+func (session *Session) beginPunchOperation() (chan struct{}, error) {
+	session.mu.Lock()
+	defer session.mu.Unlock()
+	if session.closed || session.punchDone != nil {
+		return nil, errors.New("connection preparation is unavailable or already active")
+	}
+	done := make(chan struct{})
+	session.punchDone = done
+	return done, nil
+}
diff --git a/internal/app/nativecontrol/punch_test.go b/internal/app/nativecontrol/punch_test.go
index a0f9b5139..57c90654c 100644
--- a/internal/app/nativecontrol/punch_test.go
+++ b/internal/app/nativecontrol/punch_test.go
@@ -4,10 +4,72 @@ import (
 	"encoding/json"
 	"strings"
 	"testing"
+	"time"
 
+	"github.com/TNTcraftHIM/Piik/internal/app/loopback"
 	"github.com/TNTcraftHIM/Piik/internal/app/nativecapture"
 )
 
+func TestPunchResponseBackpressureBoundsWorkers(t *testing.T) {
+	session := New("", nativecapture.Capabilities{}, false)
+	t.Cleanup(func() { _ = session.Close() })
+	viewer, err := session.ensureViewer("review_share", 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := viewer.BeginPunch("review_connection", "", nil, strings.Repeat("42", 32)); err != nil {
+		t.Fatal(err)
+	}
+	for i := 0; i < cap(session.events); i++ {
+		session.events <- struct{}{}
+	}
+	const run = `{"version":10,"id":"run_request","type":"run-punch","shareId":"review_share","connectionId":"review_connection","prediction":{"address":"198.51.100.1","port":5000,"step":0}}`
+	if value, err := session.Handle(t.Context(), []byte(run)); err != nil || value != nil {
+		t.Fatalf("first probe was not admitted: %#v, %v", value, err)
+	}
+	session.mu.Lock()
+	done := session.punchDone
+	session.mu.Unlock()
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("ineligible probe did not finish")
+	}
+	for i := 0; i < 512; i++ {
+		value, err := session.Handle(t.Context(), []byte(run))
+		if _, failed := value.(requestFailedResponse); err != nil || !failed {
+			t.Fatalf("duplicate probe escaped response admission: %#v, %v", value, err)
+		}
+	}
+	if _, err := session.Handle(t.Context(), []byte(`{"version":10,"id":"close_request","type":"close-punch","shareId":"review_share","connectionId":"review_connection"}`)); err != nil {
+		t.Fatal(err)
+	}
+	if viewer.Punch("review_connection") != nil {
+		t.Fatal("response backpressure blocked preparation retirement")
+	}
+	// Draining the response permits the next phase/attempt; it is not a session failure.
+	for i := 0; i < cap(session.events); i++ {
+		<-session.events
+	}
+	var completion loopback.ControlEvent
+	select {
+	case event := <-session.events:
+		completion = event.(loopback.ControlEvent)
+		deliveredControlValue(completion)
+	case <-time.After(time.Second):
+		t.Fatal("probe completion was not delivered")
+	}
+	if value, err := session.Handle(t.Context(), []byte(`{"version":10,"id":"prepare_request","type":"prepare-punch","shareId":"review_share","connectionId":"next_connection","iceServers":[],"secret":"`+strings.Repeat("42", 32)+`","edgeCapacity":1}`)); err != nil || value != nil {
+		t.Fatalf("next preparation was not admitted: %#v, %v", value, err)
+	}
+	completion.BeforeWrite()
+	session.mu.Lock()
+	defer session.mu.Unlock()
+	if session.punchDone == nil {
+		t.Fatal("old completion released its successor's admission")
+	}
+}
+
 func TestPunchPreparationPreservesMediaRole(t *testing.T) {
 	for _, sourceID := range []string{"", "retired_receiver"} {
 		t.Run("sender/"+sourceID, func(t *testing.T) {
diff --git a/internal/app/nativecontrol/session.go b/internal/app/nativecontrol/session.go
index 6d2fae807..76bfa6c95 100644
--- a/internal/app/nativecontrol/session.go
+++ b/internal/app/nativecontrol/session.go
@@ -52,6 +52,7 @@ type Session struct {
 	viewer      *nativeviewer.Session
 	closed      bool
 	updateDone  chan struct{}
+	punchDone   chan struct{}
 	startID     string
 	startCancel context.CancelFunc
 }
@@ -499,7 +500,7 @@ func (session *Session) runHostOperation(host *nativehost.Session, request reque
 			result = operationFailure(request, err)
 		}
 		complete(result, err)
-		session.finishHostOperation(done, result)
+		session.finishOperation(&session.updateDone, done, result)
 	}()
 	return nil
 }
@@ -525,34 +526,28 @@ func (session *Session) beginShare(ctx context.Context, envelope requestEnvelope
 		complete(result, err)
 		session.mu.Lock()
 		session.startID, session.startCancel = "", nil
-		session.finishHostOperation(done, result)
+		session.finishOperation(&session.updateDone, done, result)
 	}()
 	return nil
 }
 
-// Caller holds mu. Release admission before an ACK can trigger the next
-// mutation; a backed-up event writer must never hold the stop mutex.
-func (session *Session) finishHostOperation(done chan struct{}, result any) {
+// Caller holds mu. Queue capacity and worker admission share the response
+// lifetime; the writer releases admission before the ACK can trigger a successor.
+func (session *Session) finishOperation(slot *chan struct{}, done chan struct{}, result any) {
 	close(done)
 	if session.closed {
-		session.updateDone = nil
+		*slot = nil
 		session.mu.Unlock()
 		return
 	}
-	select {
-	case session.events <- result:
-		session.updateDone = nil
-		session.mu.Unlock()
-		return
-	default:
-		session.mu.Unlock()
-	}
-	session.emit(result)
-	session.mu.Lock()
-	if session.updateDone == done {
-		session.updateDone = nil
-	}
 	session.mu.Unlock()
+	session.emit(loopback.ControlEvent{Value: result, BeforeWrite: func() {
+		session.mu.Lock()
+		if *slot == done {
+			*slot = nil
+		}
+		session.mu.Unlock()
+	}})
 }
 
 func (session *Session) validateAudioExclusion(source nativecapture.CaptureTarget, audio bool, excluded *nativecapture.CaptureTarget) error {
diff --git a/internal/app/nativecontrol/session_test.go b/internal/app/nativecontrol/session_test.go
index 8b0ea67e3..388dce0e7 100644
--- a/internal/app/nativecontrol/session_test.go
+++ b/internal/app/nativecontrol/session_test.go
@@ -24,6 +24,19 @@ import (
 
 // Production responses may arrive through Events while the command loop keeps
 // processing ICE, ping and stop. Tests wait only for this exact request ID.
+func deliveredControlValue(value any) any {
+	if event, ok := value.(loopback.ControlEvent); ok {
+		if event.Current != nil && !event.Current() {
+			return nil
+		}
+		if event.BeforeWrite != nil {
+			event.BeforeWrite()
+		}
+		return event.Value
+	}
+	return value
+}
+
 func awaitControlResponse(t *testing.T, session *Session, payload []byte) (any, error) {
 	t.Helper()
 	value, err := session.Handle(t.Context(), payload)
@@ -39,6 +52,7 @@ func awaitControlResponse(t *testing.T, session *Session, payload []byte) (any,
 	for {
 		select {
 		case value := <-session.Events():
+			value = deliveredControlValue(value)
 			encoded, _ := json.Marshal(value)
 			var envelope responseEnvelope
 			_ = json.Unmarshal(encoded, &envelope)
@@ -279,6 +293,7 @@ func TestMicrophoneOptInPreservesLegacyAndOrdersStateBeforeCompletion(t *testing
 			for {
 				select {
 				case event := <-session.Events():
+					event = deliveredControlValue(event)
 					switch value := event.(type) {
 					case audioStateEvent:
 						stateSeen = value.Microphone && !value.SourceAudio
@@ -498,6 +513,7 @@ func TestQuietHostUpdatePreservesControlAndCancelsCleanly(t *testing.T) {
 				for {
 					select {
 					case value := <-session.Events():
+						value = deliveredControlValue(value)
 						if response, ok := value.(shareUpdatedResponse); ok && response.ID == id {
 							return value
 						}
diff --git a/src/client/pages/AppLauncherPage.tsx b/src/client/pages/AppLauncherPage.tsx
index a58a27f3a..ba33b4ac1 100644
--- a/src/client/pages/AppLauncherPage.tsx
+++ b/src/client/pages/AppLauncherPage.tsx
@@ -1,4 +1,4 @@
-import { useEffect, useState, type FormEvent } from "react";
+import { useEffect, useRef, useState, type FormEvent } from "react";
 import { z } from "zod";
 
 import { BrandMark } from "../components/living/BrandMark";
@@ -56,6 +56,8 @@ export function AppLauncherPage() {
   const [target, setTarget] = useState<string>();
   const [siteBusy, setSiteBusy] = useState(false);
   const [siteError, setSiteError] = useState<string>();
+  // Background reads cannot replace a newer command's result or optimistic state.
+  const stateChanges = useRef({ revision: 0, pending: 0 });
   const requestedSite = new URLSearchParams(window.location.search).get("site");
   const validSite = requestedSite && (() => {
     try {
@@ -79,15 +81,21 @@ export function AppLauncherPage() {
     let reading = false;
     const readState = () => {
       if (reading || !current) return;
-      reading = true;
       clearTimeout(timer);
+      if (stateChanges.current.pending) {
+        timer = setTimeout(readState, 750);
+        return;
+      }
+      reading = true;
+      const revision = stateChanges.current.revision;
+      const fresh = () => current && revision === stateChanges.current.revision && !stateChanges.current.pending;
       void fetch("/api/client-launcher", { cache: "no-store" })
       .then(async (response) => {
         if (!response.ok) throw new Error();
         return launcherStateSchema.parse(await response.json());
       })
       .then((state) => {
-        if (!current) return;
+        if (!fresh()) return;
         if (!restoredSettings) {
           setMode(state.defaultMode);
           setLocalAccessPassword(state.localAccessPassword);
@@ -116,11 +124,14 @@ export function AppLauncherPage() {
           .catch(() => undefined);
       })
       .catch(() => {
-        if (!current) return;
+        if (!fresh()) return;
         setError({ kind: "load" });
         setStarting(false);
         setLoading(false);
-      }).finally(() => { reading = false; });
+      }).finally(() => {
+        reading = false;
+        if (current && !fresh()) timer = setTimeout(readState, 750);
+      });
     };
     void readState();
     const refresh = () => { void readState(); };
@@ -132,8 +143,15 @@ export function AppLauncherPage() {
     };
   }, [reload]);
 
+  function beginStateChange(): () => void {
+    stateChanges.current.revision++;
+    stateChanges.current.pending++;
+    return () => { stateChanges.current.pending--; };
+  }
+
   async function enableDebug(): Promise<void> {
     if (debugBusy) return;
+    const finish = beginStateChange();
     setDebugBusy(true);
     setDebugError(false);
     try {
@@ -144,7 +162,7 @@ export function AppLauncherPage() {
       setAppDebug(true);
       setDebug(true);
     } catch { setDebugError(true); }
-    finally { setDebugBusy(false); }
+    finally { finish(); setDebugBusy(false); }
   }
 
   function launchURL(target: string): string {
@@ -163,6 +181,7 @@ export function AppLauncherPage() {
     event.preventDefault();
     if (starting ||
       (mode === "local" && lan !== undefined && !lan.selected)) return;
+    const finish = beginStateChange();
     setStarting(true);
     setError(null);
     try {
@@ -193,11 +212,12 @@ export function AppLauncherPage() {
     } catch {
       setError({ kind: "launch" });
       setStarting(false);
-    }
+    } finally { finish(); }
   }
 
   async function changeSite(nextSite: string): Promise<void> {
     if (siteBusy) return;
+    const finish = beginStateChange();
     setSiteBusy(true);
     setSiteError(undefined);
     try {
@@ -215,7 +235,7 @@ export function AppLauncherPage() {
       setSite(result.data.site);
     } catch {
       setSiteError(t("client.connect.saveFailed"));
-    } finally { setSiteBusy(false); }
+    } finally { finish(); setSiteBusy(false); }
   }
 
   return (
diff --git a/tests/app-launcher-recovery.test.ts b/tests/app-launcher-recovery.test.ts
index 10cbd855c..717c42cc1 100644
--- a/tests/app-launcher-recovery.test.ts
+++ b/tests/app-launcher-recovery.test.ts
@@ -8,11 +8,14 @@ import { z } from "zod";
 const source = ts.createSourceFile("AppLauncherPage.tsx", readFileSync(
   new URL("../src/client/pages/AppLauncherPage.tsx", import.meta.url), "utf8",
 ), ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
-let schema: string | undefined;
+const declarations: string[] = [];
 let effect: string | undefined;
 function collect(node: ts.Node): void {
-  if (ts.isVariableDeclaration(node) && node.name.getText(source) === "launcherStateSchema") {
-    schema = `const ${node.getText(source)};`;
+  if (ts.isVariableDeclaration(node) && /^launcher.*Schema$/.test(node.name.getText(source))) {
+    declarations.push(`const ${node.getText(source)};`);
+  }
+  if (ts.isFunctionDeclaration(node) && ["beginStateChange", "changeSite", "enableDebug", "launch"].includes(node.name?.text ?? "")) {
+    declarations.push(node.getText(source));
   }
   if (ts.isCallExpression(node) && node.expression.getText(source) === "useEffect"
     && node.arguments[1]?.getText(source) === "[reload]") {
@@ -21,8 +24,8 @@ function collect(node: ts.Node): void {
   ts.forEachChild(node, collect);
 }
 collect(source);
-if (!schema || !effect) throw new Error("Missing App launcher state-read owner");
-const executable = ts.transpileModule(`${schema}\n(${effect})();`, {
+if (!effect) throw new Error("Missing App launcher state-read owner");
+const executable = ts.transpileModule(`${declarations.join("\n")}\n({cleanup: (${effect})(), changeSite, enableDebug, launch});`, {
   compilerOptions: { target: ts.ScriptTarget.ES2022 },
 }).outputText;
 const settle = () => new Promise<void>(resolve => setImmediate(resolve));
@@ -38,15 +41,35 @@ function mount(fetch: ReturnType<typeof vi.fn>) {
   const setters = Object.fromEntries([
     "Mode", "LocalAccessPassword", "Lan", "Version", "Target", "Starting", "Site",
     "AppDebug", "Debug", "Error", "Loading", "Update",
+    "SiteBusy", "SiteError", "DebugBusy", "DebugError", "Reload",
   ].map(name => [`set${name}`, vi.fn((value: unknown) => {
     state[name] = typeof value === "function" ? value(state[name]) : value;
   })]));
-  const window = new EventTarget();
+  const window = Object.assign(new EventTarget(), { location: { replace: vi.fn() } });
   const checkReleaseUpdate = vi.fn(async () => null);
-  const cleanup = runInNewContext(executable, {
-    ...setters, z, fetch, window, checkReleaseUpdate, setTimeout, clearTimeout,
-  }) as () => void;
-  return { state, setters, cleanup, checkReleaseUpdate, focus: () => window.dispatchEvent(new Event("focus")) };
+  const timers = new Map<number, () => void>();
+  let nextTimer = 0;
+  const actions = runInNewContext(executable, {
+    ...setters, z, fetch, window, checkReleaseUpdate,
+    stateChanges: { current: { revision: 0, pending: 0 } },
+    siteBusy: false, debugBusy: false, starting: false, site: saved.site,
+    mode: "link", lang: "en", vis: false, debug: false, appDebug: false, localAccessPassword: "",
+    consoleLanguage: () => "en", launchURL: (target: string) => target, t: (key: string) => key,
+    setTimeout: (callback: () => void, delay: number) => {
+      expect(delay).toBe(750);
+      timers.set(++nextTimer, callback);
+      return nextTimer;
+    },
+    clearTimeout: (id: number) => timers.delete(id),
+  }) as { cleanup(): void; changeSite(site: string): Promise<void>; enableDebug(): Promise<void>; launch(event: { preventDefault(): void }): Promise<void> };
+  return { state, setters, ...actions, checkReleaseUpdate, focus: () => window.dispatchEvent(new Event("focus")),
+    retry: () => {
+      expect(timers.size).toBe(1);
+      const [id, callback] = [...timers][0]!;
+      timers.delete(id);
+      callback();
+    },
+  };
 }
 
 describe("App launcher state recovery", () => {
@@ -98,4 +121,55 @@ describe("App launcher state recovery", () => {
     expect(page.checkReleaseUpdate).not.toHaveBeenCalled();
     for (const setter of Object.values(page.setters)) expect(setter).not.toHaveBeenCalled();
   });
+
+  it.each(["site", "debug", "launch"] as const)("rejects stale read success and failure around a %s command", async (operation) => {
+    for (const failedRead of [false, true]) {
+      let resolveRead!: (value: ReturnType<typeof response>) => void;
+      let rejectRead!: (error: Error) => void;
+      const fetch = vi.fn(async (_url: string, options?: { method?: string }) => options?.method === "POST"
+        ? { ok: true, status: 200, json: async () => ({ site: "", target: "https://room.example" }) }
+        : response());
+      const page = mount(fetch);
+      await settle();
+      fetch.mockImplementationOnce(() => new Promise((resolve, reject) => { resolveRead = resolve; rejectRead = reject; }));
+      page.focus();
+      if (operation === "site") await page.changeSite("");
+      if (operation === "debug") await page.enableDebug();
+      if (operation === "launch") await page.launch({ preventDefault() {} });
+      const committed = { ...page.state };
+      if (failedRead) rejectRead(new Error("old read failed"));
+      else resolveRead(response());
+      await settle();
+      expect(page.state).toEqual(committed);
+      // One existing poll recovers the current App fact without restoring user edits.
+      page.state.LocalAccessPassword = "unsaved";
+      fetch.mockResolvedValueOnce(response({ ...saved, site: "", debug: true }));
+      page.retry();
+      await settle();
+      expect(page.state).toMatchObject({ Site: "", Debug: true, LocalAccessPassword: "unsaved" });
+      page.cleanup();
+    }
+  });
+
+  it("waits for all overlapping commands before reading again", async () => {
+    const pending: Array<(value: unknown) => void> = [];
+    const fetch = vi.fn((_url: string, options?: { method?: string }) => options?.method === "POST"
+      ? new Promise(resolve => pending.push(resolve)) : Promise.resolve(response()));
+    const page = mount(fetch);
+    await settle();
+    const approve = page.changeSite("");
+    const debug = page.enableDebug();
+    page.focus();
+    expect(fetch).toHaveBeenCalledTimes(3);
+    pending[0]!({ ok: true, status: 200, json: async () => ({ site: "" }) });
+    await approve;
+    page.retry();
+    expect(fetch).toHaveBeenCalledTimes(3);
+    pending[1]!({ ok: true });
+    await debug;
+    page.retry();
+    await settle();
+    expect(fetch).toHaveBeenCalledTimes(4);
+    page.cleanup();
+  });
 });

From ba97bd0fce09a9e1f4a458f10556bf57e865e870 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 19:39:39 +0800
Subject: [PATCH 259/262] test(app): cover control delivery with the race
 detector

---
 CONTRIBUTING.md      | 4 ++--
 scripts/check-go.mjs | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 71b8cf2b8..937ea45e8 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -111,8 +111,8 @@ does not establish coverage.
   The server core is Go, so its acceptance runs here. It builds the Web UI first when
   that output is missing, because both binaries embed it. CI invokes these same
   package commands rather than rebuilding their steps in YAML.
-- `npm run check:go-race` checks port mapping, media-edge ownership, service
-  storage shutdown and scoped NAT dependencies with Go's race detector. It
+- `npm run check:go-race` checks port mapping, media-edge and native-control
+  ownership, loopback delivery, service storage shutdown and scoped NAT dependencies with Go's race detector. It
   requires a supported cgo toolchain; CI runs it on Linux.
 - `npm run check:go-vuln` checks the App and Server entry points and their
   dependencies against the Go vulnerability database. CI uses the Go version
diff --git a/scripts/check-go.mjs b/scripts/check-go.mjs
index b757add8a..2d39b6570 100644
--- a/scripts/check-go.mjs
+++ b/scripts/check-go.mjs
@@ -221,6 +221,7 @@ if (mode === "--race") {
   buildWebAssets();
   runGoTests(process.env.PIIK_GO?.trim() || "go", [
     "./internal/app/portmapping", "./internal/app/mediaedge",
+    "./internal/app/nativecontrol", "./internal/app/loopback",
     "./internal/server/app",
     "github.com/netbirdio/go-nat/...", "github.com/jackpal/go-nat-pmp",
   ], ["-race", "-count=1", "-timeout=2m"]);

From 759f6974b631fd1731c67b41e169698e6ccdfda1 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 19:48:31 +0800
Subject: [PATCH 260/262] docs(site): align staged screens with current App
 navigation

---
 docs/assets/room-en-dark.png  | Bin 93546 -> 77504 bytes
 docs/assets/room-en-light.png | Bin 92709 -> 77213 bytes
 docs/assets/room-zh-dark.png  | Bin 94658 -> 78592 bytes
 docs/assets/room-zh-light.png | Bin 93784 -> 78205 bytes
 site/film/ui/main.tsx         |   3 +++
 5 files changed, 3 insertions(+)

diff --git a/docs/assets/room-en-dark.png b/docs/assets/room-en-dark.png
index 7d6deaf5b1b0df90dc7a93826a37b27188b4d3e1..6512a77953bd81a5608ba1a1a5718588a6b31a95 100644
GIT binary patch
literal 77504
zcmcG#cT`hf&^8)GL8VzhKomp}kPe}@C{;kD_YwpWq$|CJs0b)kdXwIy3jvWD5b3=I
zLNC&LuSxE~-}k=vu66(Z!eXtgvvy|Bo;`c^%=66oqVY<J;^zIEAP|T``Gvd|2z2!`
z@PF(272pYp&v6Y1bPJ>`|6IrO+r|`W`a^3k_6v{B)#al?cimzO<v4Cy>^%~OD`UBI
zLsxG6`CxyAmCQ;Mdgr(7O|1Qk-&#>U@VilT<qV&hS+5cYg2MCT-o^e1urI{g>K`5r
zb;WEadTl>^m?Dv<eoFB574q1cbQhBFz%P5vEXTHuI#>fr0H1!yW8!~b-Z#kd|MzVL
zd=>oPBN@5>yN{yjFXuTK+-Yy8sP)*Mtae$*RkOns(LbaQlV|BhmM3m(Om6)B`<JW_
zg4~&HVn5zYPD{1~)jtU>o#?&%ZKJxG$Ec~t<h!<1X&*YB{V~f3$WEh2!#e_wJYD}*
z_vIMhzbV@nIaP$;6G}=-r^)JD6Ud!J>j-JWMPdgS?1Ivfw7|=`{Vt0f7_rlHny#=}
z4li^ZLrBj+Bqh&V_<VO=($1Ag`VrURfUsG^b<wX}Y<i`PP!Sn1F}j<93E;nEr}B>l
zq=gYj-HCVE!_%bReRP{~sG2%zI7TB6*G4LE-Kaj9oksr|!a&4D;-9swZ%2Fa4F}<p
zjuY=jbPtvi!PfYtQo>miDU;RI@)-E17PR-Z(|^V<rDtH6Ks1NdmQ)AwIwUgmU)%bS
zmo|O;_bwO=E|Qcvn4_v+Rda&FS<mO=@rPw?jMn|_snVkLxaFD71uWtiv1o}r62Lqx
zk+kGGoPBU4^>24~!e0oTb?Q&M4-F3ICt|VD?CL4fK91gSiNqI6WY?C+GtA!tf4=s<
z78WCChwH6zB==<SW0o_xEr0CGK)2q4*g||;+Qn{3p~t{c9$_oBbn;l2q{nkVdHQ4;
z>O<x5;AHhf#KknzH%Vl;TexxWm`c4=5aLP`IS4fQY*g64AbCZNWa}~a9R+1-1@CCL
zrryF*zvkrWKT1gH{caQ~C8Lzf61R*0NFlrX=47>HkY-{B?H;styTKoVd%FH9Oy6X;
z147szDb$A$ev_r0g`lOp59rpb7Q5o6JQpYq798s=n)epF7Rn5;MEN>v7Xcw{5lj%z
z9c){guZ4FFfhK{+ScGuogm29aW9a)PzW-t7te7^O$vS0r8rXy5-q(a@mj^&8i$C`%
z=M;G77E5YJOg}3|yb8UhTQz;AHJ-k)yTcM8HfP&lxUgW!SA7ca1XbYr<sfGf+rB}S
zLAEd?ZWW!ObM&_XM_5qDS8NY;IM(b2)^649EAZ9i=SQ6FMle+qk_oRMSJn$(2<=7A
zoKG>hL)EbxxNQXV+zm|itt?i;kMca2`k_%P;DO(Qf~{=JzH<hLpCv4>w9b?i*ws9`
z4->-t6h$8v`#1`c_)G81dLR$_r$Z$fjQXn(C+(3s5^AxDhwGyep<&X;8>k`*<Ze8{
zu4{>h+D7KW2boSygMrwMmYk-{;CrCnZG0t$sG1I{oCs5&2`*@v*FvjhTdF#1bdmZB
z(Z$wr19IeObK<9Cz3p=NIU4VVA#wU2C7JxOd4!{(LOr#O87R&ze!X-CvAk}kzg`c-
z8V1*q66%|ut)^QS5}(bzq&8$&xqm!vSE80PNN}IgUmZ`Wo(v$PRZo?0YYC)S#}wNw
z*Br?);rsjQHmp;Ta{)6r|A+(8*!nYFkBdGC?hRRF5p@e{bjEFYxW(q|ivi){WI!o@
zs|qn8!b!0?RU2RV$I{w9=T%Cx-$JdqV)eT8wpZWQRIN>|Afo<Udi%7U$?wy2Epi6$
zvMeEvx(fnrXwz`U(9oX{Gv$r%{b-$l9&#2)^$TysqxWcP9$2M*eaWW&O{&^!2wqbX
zOZ<U0)#+>;_jAJ0hfqq8aJaxL;eC)yaUKl|TZD_k?bj*KT1IHmCkhA7Js<FDW|^OT
zPTB_~q321P6IE$qeis2t+L`QqV=9|z%`$&$&07~RTMDDdeTJF8=TCoVvieM|n<-5k
zPrCGpqE9JEKp>oXZn<AW4OM-f-F>^K$(wa&YoiTEug23m{o6|3ffF~X_m@kjt1WS7
zhuYfOw0t7RLx?@?wEGVpTpY|y?e8>0;5fPbjfWnDE9>9wO0f!+7-EQY`<a!yyGTm!
zq-XP%!^BU-sw&iW%~IO8RnK<+!4Wfr681MhFc=1Gs>WgWB>T>8SjFKq;leCi5cJ+}
zK!>JM5SeL@*+^&wVoKMxcRY6omDGu;dN^rT5^-7~>a>$bU1s-_R>isc!euDdpFZle
zPDLE?;rB`n2z5)k9<Bv?dV%HiIY~0%HojZ^8B?RsDx0BP*@m5iA@zw1j=r?ASR<Jr
zTnC>ief}dwLhPoA3M_tO2JHk@=u7LHbfF>!z26#gD^BPG@02~`kl*cIYAUT=KNQ`>
zx*V*Ol}>Fh>g&wB9bNxvkG(jtj6f{-)lRWB9Bw*AgooqtOn6Nu{YbMa_f6~VQ)7&9
zL2mu}6xw~sekQ4F8|yNpL|CE9_dZI}M~^QBo%{_g9{w%9p)R;z<AGk5jwLF($AUIR
z*V?lqPNa_~{XI!Q{SLObS?F-#y+q=46)u0r#^|8Y$8$=IuTvEvk4%RLsm|LYm{JpM
zCN*(x9#abWp`9?qOW0rinSEZ2S`<gaxheWW33<T|9Jsk0Qm-~${Q+Wp*!i}TXB`rV
zq&=z44U4<x@Ek$TfB{^?l78cunsUzu?QabUV$cekWxXJ`-jdIS&<`-y{+L2k&_&J6
zsR*w_ihF-xxi$8V2G>sIyF5V=fnEsLAHWe)NwuFXEBH8$y9|XDbvb%<gp{JU#&Hm@
z;KLiz?bO{{zZNJZo4O&uQG)l)-81o8#IPt)g5&p{`B7JNB@avbCQ%7n?RdnwS0k_y
z;X~Bfg8co7k4P9uQKq9Na>t~UN5#bQd;<~6w3P=eqIKUNGSXvFZ3Yde=a948>uI%H
zzC7z+YRx>Xnf&Rc+tH^4+^DqAQGc@xL{y(Jd(=1PaWT(lg0dSWl{sNvl0E91!}!kn
zGhO^`gY=5}9ZpRZW85S1{1e6Vi*TBs59aC|6$#7<L?G9Ik}Q)YukF)HsLyE^)DK7^
zAh;E!^#|~8H)?v<N+jz2ngg4fnt&S+Y`yVHz`L&&xwt&NhoYc5kLM#yNT;2WF7Y2&
z4pK>qNT@(gI_|QsJ@E3ce$*d*eq=pi@Z%(yOQdd<qBJk;yy56@p-ue<Td_&meC}3!
zml$W#K(j0r<vOYN*VT-M*T;tkKOiUO^><)o*7i?SVCqa_8hcA4>P#yW<wQN@NXqlX
zcz^6xup<*s?eaEce-$k}zK$gErzZl{JOkI})K0O>oaT?Hs;;CaO6^NBoj5GH9k4`%
zhY`?(b8L`=QCi0S^O!Z79ufOrAGg#~rCK(scLS$lI%UqR3EHJTxi>OT&YAE|>QZIf
zPkj(aGUvx>W>t<UTHJoCQ1k^s=2*Qbc_k<(#OSPP9Xh-<SslGaB{S4_=<8JX&I3n`
zUxX4iQ~S(R(4%HPJxqi-CHyfIc?Mzh{pu9N@_L-mo)v-oizW>COdoPVjxlM)gvAD2
z3c*}0xFwT%O>lKXjtbH}{)|fa8rXYmofHM{GYHQdWryGeI3ssKdPZDXYgkF-?$!hp
zk(bgZ7qJ#3voj$l=byvA=7d{vx(pQEFZ+BqqSL(B^4HieklxFD_zUBi@*iKnyM!V{
z0H=5$<Ga!x*{p9?9V?PxSN$}>wAyXmv=rHlgA&Fgo7Kpfr)Dnd1VNw`f#gNOr_`TI
z8R?Bg8AAieRwsYwuMYn$GWtF$Xl33r*7)Z$T}<W2C@IPKZ}$APS=a@hocwNf_l>dJ
zUla{#>4v)3NKju!TICQ&8{%+v);k%1ZFiJhb878IM@T6zVzwXzb?A4gsE^p$+4m`Z
zUgy9?YCmb<@`CbeNln4JbjfN^J-){7l*+8FRV{f1Z?GS7+JG;SEUi5nFHdn@b#fs5
z&ChG_BZzMLaxzjH%jpxKgjUgY_Od-bkCE_uAF&0xcaue(Ugd$6!XG+VOAFvN_Jiuf
zFRi*awv1n$HdT!kknlNug`dWU+gzNq;Xl1fa6&A9fDl5^6{pOAz2NmHPpU5FC8wFY
z_GXYvDBr%Bi_IC_&@zOu5Oge9^-hgHOXujr%&9plzv$YBXBxLYS(K%(13~6}>W}>x
z)qMNY5xdcPi{&xQmwt2B`1W2IQLnx8zE=;$^6wQc*X$NzJ}E8uCYNLS17S@~JKZR2
zTf`T5MAhWkV7%7c3(etD<fa`IKZ?u{h3*DVoYWRIibzTxucGmgiPG`iGtoNc$QRT!
zFd!F&dwchckNCPWEq*(0AdHfdlCDPg@46;%GtB)xpCRC-k;fhv`wzr@Kk*V#J@hVd
z6?%lICLDBa2g}P=^gu?8r_Wq4LHnhu3>VQ5#O$h_yQ$pvys)%P-PfP1ptB21gvMzK
zWWO7n1N|)X$<L|*H+@_mF|7bS_COMjPZhjGl9ypZc)76f@cvZmG@n51(2lRc&&e0^
zL*StzdL7?chS802*d)@I)~<P^wj^Ah1^ZIu*4NQuLsf+@N2)j7c9`M_vu;I(sK7*|
zWYLqhh_rOpw=Iiu^iNX<7|+wJvg-ZqVt?aLRSC{hZnZz{r+;r?f4w8NyA#{xZdQqK
z^|X4#h_;<La{ow={C?VOretT$J;%qiGniNz{n&6Mo+e55L#JPEfqW$&hBbNlEs7%+
zaoj`@)6@!>`0<)}Q=WhQ9#`xX;m}<llHUKMi%9bh_1U7fz<|`fkj;kI9vsv%&MP~U
z7bcvsd#x+?L7*Vi-R|#tiuv~Qxjh#>I~uNwVabUcaCp?0yV|jB+M8V}hH>pHpv_Vv
zQoExQl^FMuN$)2P8jt4W&Q-eJP`|<t@ew*LBcxla5);jOp<-3eBb{Hqj8K~^wzWQv
z<beHL?21RPEG2stJqEJr!D?(v!<CEuc+MVk-Q)hz%r^(yGZ$<GN)ISntQXnR8SBbA
z^Rq!&!n`k4n!3BdZy5&t9va&j+QxI|?6j&L;SLX!`AYav(RMaSAuPqjF*Jw}jI_d`
zEYC%1kQ-mxN~g<Q?0q+A_z3ij-6tolOcy&rzL3p1-D_sA(`)XU4h#}?7d=Pp$f2$G
zyLSI=R%kd~d>7aSm*~<`Y|`+%_w}*w5!1<gMXn6ZmuIn1d=ByiO*lDDJ4GWef|y<(
z6&bu<?=s|wtv^{xu5z5>RIzw*)6`>1xZ3w9QpwoF=sjfk;&o|O4>(SXo~BcVpng0k
z?NF9Y(EA@OV5n#5QL98};M2YR=p)Gah6`65U!Hb+?*ujnbL7#mq?>j!mNwX$ubqcq
zbHW43@ri?<BN~W|7v05G_z@_f2kCq4LxIlhaT#MXW0Leexi!+s5xeQL*D-iJ*gJzy
znZeeKoG6`jL?9=5C>W-0cT2=}UQe+t_3N?2IF0S3I3dpml$dxBv^nKfgpbU0<Qksm
zt)dOP*goH--vMOpKox9i&5}S-%#defxXM^la=*dibR|xA#2@?T#Ymsrc_Ar^ErL%$
zAXG(BQVn{tj9hBrFjHKpWT|P$aHamD_|$b^SMPQ3-dJl`GDn0aCy;PT=EN&8;daYm
zT^xj+aoW;1VWGT!PO;jf90i7pd<{WYq7LWkS``8Wy>BF<t19qt#Q2~sBO=<#=X`<-
zy}#}bg&qZX3Wqj$t@E!h&%5-Qx$di~kbO}LJ+gO|x!P0NyBBc9E-)nnO4xNU&N@61
zQ{;@7#-BvX$;r7!cDf`5Xst9h&VOy6fbKf4U-8(_Rm1qzP~wYcE+~?9$?(l23_N>^
z3Q};99CO6u;Kymqn51Iks=Cc(WcZbdQS@$4rQPWG>8%<+OTY!nE->+Ro<q4kb8p+n
zm5~oUCjHKPL}z?=X2Dd1leSgYKw<y?{2%~~A-5#`F4(HXZ)DBag0hpr3rwFjO9WQ7
zslc+GO&o>p*Dtp4Elu1l)T>`RnlMncPi+?2Wel}iC#}+zp4Cn}`4g+}m_tEZIY67Z
zpjjR2)?0J9?u5o2>DSHE9Ps_vFm=LXMbWrTr@SyFzl)Xb?(P(i>C+Mqv?OB$0Q0<k
zZ_fSTJ~#U8#vj>?rnRAOf6^yMa4?Q*h{c(P%mhmT4nK|ShGiD8M~}2I-rMKX$3Dm%
zQXR2O^5#;*eD0%3RO_z>>r}6$4J_D|Jg1zi%0$_4rQfA5jGV#ii?x&rtU^sQ3>nL!
z6cK|kl}Kpd;QM3fv*KsldA%@(&e}Tnsm3nU+Le{Bp{ECm8JA4%==X4*`+b^O-Fm#T
zVzB5TBP6DC6ri%}%!FV*gQ?7jNMAXiXY2M^58^q`EO9^IEX}st&0l@WNv#p^{OP@?
zd74Hj%7o<Ptfba$-xUw*Tx%8f44S=b<I3Baoy5kRwc>3w`t~Qykdt~3{QML#+jzRD
z4g2~P&KOPdTx0C})=~6UuU%>VQX2Yz@8S0R+qvH@2#D8O0IeB^3FB9-{DTa+pkv6P
z4satDa=hCWsCp1#U1Sw*xF}GZK}&`y77*l*eY@Iyal$U6dv9YEx(lE(U6>9NotP@z
zyyWSPm%5ds=u;l|PME0{yX&sb5-;!fgoon3C(&sqVl+K(YH^v^YM15I$tovz$F2Ne
zT|PZ-r~p`Uf71zZu6hu%6I<$e-iO`{WN^G5)O^4YKm>ZGe?zwUu`+W?*OT(Oj4lfU
zfs{V>0;sCZwH({rL0cg*o1+sgUo9*X?l@xS23#jQQ)Qs$u=TC5-N$>7Jsu}qHL&24
z1Ivg9GUW~vM<aI&^EnlmgENQMp#+kjI^*S(S=svQg~kh1r^zu$4%%IAYc)UB9IYZ{
z*i5zNRfdO8ak8;R`7jJsEo>idMrEb?WgxDmeor|=gPepo!~6#}(@;snewMZzsOeFh
z_O4Cdhb4u@T*KC>VA&RJb?KDe?6$Fl!?HX!_5IrsU=+&tS(X|zs`nYh6W6>Fm2`(C
z?V>el6#oFMHsp*okyHSmjX@E|e1s}09KIfU5tXtqv?_!O^LtREnc%frTt(+^?<V4P
z)D2_`{`d5*&DzIt7>ilvQyzK2V}5(y@oD3m#vPDC<aak7!j<kd3`yiZ1QJc1yIHif
zD^EzgU2NfO(H$`u5beD?>JLwB7CR=nlb3%yq^^<KdCqcwSb5u{e(unhBP%3M*riRQ
zl@g8`%2Ow_q!GMEJP>=)X%#=wyNBni0A7>Me)ahqvEny#!v`BK(OgcG+$tf>(!-g8
z9tRhb18ZTuQP#_WBHV>FXqL8k!zw>%-QXh8rz5`0#xq8h&NMJqPKn)=n93ro#k~SH
zTz40=!F|fx+wg2PFN~HV3~RzQv*Uc1Yjs+a29nTlldwig#rRh_f_Cymz?!Y^Vuy4F
zZQDi(r+VnyLZcspSdN9R*d0%`b$3|m7-Wg2A@Ljt&GFo1HxTYkD{ECwipY(ykA`f~
zlq5l<B&2&o?h|nL{>s{tTsv$hE@!bcmMc`CP;a?)pO$w|x(@b{W^;qDQP}(_IGd>s
z{~G0jD$FWuQ&eOJ_Z$*V&TunDBd(E|_w8CwLuf^cpffxCcHuzU%0-yhPUAp~#`S~{
z-%q5V<ux%^%ak3OZERFEa|X9$w=w$EE$S$?c4J|vFt)==uU0>x*gFG?J$U`i{xH8#
zJ<}@8>XgjomgsPx<}sI9tD#(_xVN@uj5=ceZnuNUQ0zb_Jcx>E%iU7(GTmoM5SCyQ
z7WV<NQ^A1*{d=DSE;E~rzf`HpsU_1Z+~VSQ?}x@5?zi{k+N#k3>5LW%3{=m7RUB4N
zDsu_PNWzC>)}s9~Um+HS`!eB?M;gkuR<57&$^$)d1r<C>SVkEx`=CvoR$V{9$e$Zr
zRH87)r+G}cH&|{#iCI;`g~D`uBxCeyetzfD6J23)xQmNRb93{8<-!o|I@}efqF<In
z_H6e_hKdr{%ww|>0~3nX_Vb?2<8neisjX{=k8o_HGsPud9tk#fcKvAKLiWCjv4k=N
z-vh{N_Jon+v(c&3KMe@?`=$*$zi(jbmLt$Vy!KmlI1zipHW(7W-$Tu2gdcHz1`UnG
zx~-1L!<3xOy_ww*bYq;i$hbWF<`jCzy+&aF+eOEqWvvrI-RvS$+7%v`S|K7la?!jb
zK3Rl3yIA(B^|hnQ5ghL@X;)iM&}4Mc<hcU?XLl8pwHdf!x%Xo7iP^#6jsc!RS^ojw
z$8wc|DzGFY@Q@lr5<6UD)x+qNadmHf+o!Y#7b{1k>NDeVd@(f>8*a(!7FU?7Zg3>d
zbsU3W&w&n{$?AcXOV&Khj%>Ob`Z}G;H(bW$m*sH8xw*U=YEA$$&FoV;!q)Bnmd^*P
z%D~It6H1hL7?@+&!fU7T_;mUh`F3b)%5uT7DtR>|F@yzLJFK1t{ki91$g`bf8kgi}
z0LRZBQu)lCE+21TQC>rAoL9?aGAvfP{FY#Dlqc0yczamZ1(n~dsOk*4((gJ7^98=+
zqA3`i$|YDngU{PLH4((>Ira4{-GuWA8Htr(!5G;9!9oi|iQ0|#*i-*4Rga%V6$6i*
zI8+qCg_df%RGWyC<(Zn`-;Ai9ON%l=>f#;II7ze%VYJ~@tkC#d%i>TM?MvLb^p1jY
z&-dZXBryTqN>WRnn4%57J5#@R`za{;f;zOV9c#W6L!CUrG1}@793K>4HAC1z+Ig}*
zJo*!TzJ@5sOZA)JYe4n(_Th1PtA2j3@rO=+s*6F(WT%}}RsMt@2mYgwP}$p4+mr8T
z?3#BM*zp%goD-&iJ$0<j`}-oF$86ri&q5a&OH@7&ds55dsC;+i^bRsPvBI_PyYE6P
zhWy$t3fLX!*WX7VH`F;Y2FPw&_kPQvrB;DTdXAQwd6xwqO&|?Fpu8xn;OiKNV^k^B
zYf(?8v^(ckw|%u=)l`l?5Fu$knp5`(#eUePUo2OYqgPLnh<ugTrl_P}nws9F1aH0s
zVQK_CGMS?N49+4~NlTG`qt8QQoSV1SjkgE`4L~rG!k^p~opNPaZ>XmtjNzr~!?Q?F
zN%rqVLN?qg-nKgDTod>QxHQ(hk7(hUa#?Ag>pe26xWrt@#uuyXXBu#>gj6U(bp00o
z1`#NoLEg{;bkqw}yKfKLHOI#)E3zxAb^!&f0BnRw93t8lFXVZu3hg{wUZ1(}z}!7X
zW>t%8rnE5q1%j7v!$4hr__s10E<0q0pk%{g3h4$P!Z8}>@=F+fw&n3q+&RG!a|U<(
zyBLi1>(tzSJ*r)~el~S}TxF)4M}_S3nMR#lsv-IP)yGWwouTx(*QdU_{ir?@pQ%bo
zcauZlm?Lb6v{YB$mTK`pSHmMBHu>AS1|nWUJewDoJZC=u=ovtYIS}xh+dpJ7iuT49
z)Hhb02LPP$oJ$X~_Qd;Z;_iD<zi%nNtx^B*fa-oPyCmtLiMh<hY%VW}1kJDG=m?9E
zOE4e6pQ-FR9E06Pw{t1Z$TzbkL7+D;ZnhgSHg%7#Jow>aknuGwCB<uLw&|gyN5kKx
zWVAa$G{Iwl>c#Ov^Wc9<p#e&68%a3#FmW3J=&8f9Ywa^L``8i^u<nq|K9<mR7Q|@g
z{ngsqdX>n@^GE6bqMYLJZCu|r;@Ib2nTQ7K`OCrqN)X8Y&Q(pytFabLapWZI>1c!m
zsXgPj4mcC?qKwD5$`M=cHCj?g<(es)LOc+m2r<tv$Yv6Wu9URi2!Wo=pCfTNC&Fpf
zkw8L<1R^PzAAOjNZmRK@IZZ^Vy~M1Ed3z?FYD`E?vjd1HruQ{6DpRg2A#ZcWNvF3r
zMN$cQ^Ga5jZXsJY?z~r5`)Hc53t+W9PQG{Z$wBF&p6I<Z>7J%&R>QczY-W6VG{O%k
z*=eH~M4iSf-Ys-!=Z$apY&|Q~SFhVW^cZM8X1bUj9&S0U_EM`lR9{%lOY;LDky-%$
zc9qzl%#bTm50@s?J-Y6DSloNo)<+mZKyec5X`<-Wuu?=%;U#ZXi#~sy%rqYakXBvG
zKOi?2)_;N_bJr?-wyN{=FlPrdeo1}GS+)!SY~!a9n_0j??%VtlrpEpG4+RyKQdSvl
z{ffe<84|%6i{I04n6Jo}+@xb-^65&Rc@WW-Iu1a3N=!XggZumYN01AE>^P5x2xEwR
zW{{_0SxOOQc&}y2Ex)!Ybfd&F69l;pnVJY;q^s1xEj!^m6Cw|N(C4*OGAHRcs)HkX
z<9whp4XT3*a4CFQXF;Ca9`~H_u?sA5vF<}}xs_(s(3heFfD2n(Gv?}Zd6rvgUx}M?
zZDDb;8Mi`OzS|0jiB;HIj4Y`o_oYC#!#J;w&`%!(iuTiNMm8%kdao$el=SrWuGKga
zz;!#n$y^QV5a&k#r{Q;e4$%lk_~b0C5<^mwlKggi_$(ZTgf_L2`1oVQp<NO3@jyEh
zZjLE5Jap1yMqlQ*x=;A9j8Vpts}cwkU(p}wTX;H+(yEuiZg*&r@sIe)p;tjGEYGuD
z*#uJNXsd$;X38FrkJ~gG(4;T~7sx*zSZIUJ>euLRPe!Wb@tOQ;pR@;@a^~c$_G8l{
z(*eKjTE*vZN57v2_BHWS)Ac^bb#JJiBwq)|{tp&_;z<@o9{bE#<6JgQmytWoOvMIe
z7ClKLMY<6DE?_&LX713&**Cwy11Q8???e5E0Ov|Ll4P<{+gk%Ht-btX=ERYM1qAv<
zHqs-cpm5l28T#|2eAt<lOBf)pBdGdGn3xqAlp+{?P9l{i#a@KkngAr`62OZNi7??5
z81i)lBVYW8D>ABHD}~@h3-wF=oM-TaU3TPn>61Jj(J9YnQ=pv8q@5ZbR?=jx1&B<%
z6<VJs(+I2Nx9#Bs(CD#s(}d~c6v>(SUz~g?|8bc&KLX7EuMZ`5B)XykF#{$_2393H
zZ1?4~C9FNISnq!sY+X__HaiPWyFn7VYTGBZzwyDJwC~%h^@7Z~UTNxBr3*WBJzs+x
zzv2TCJE|*Ve8-k-^UL!cf}!-+d^8fj9Mf}27pmi0pa5t>U*(G}XK<?f;5QkjZ*S1x
z>m_xMOY%{yN(%bz?#b=~DV5CmNwm5cbD75A$>z*Om>Pqq7Uy}R6AnYx7J(A+oCOG<
zdY3WCzkY(o!y>LJ4KddtH6Qnl$&TZ`?%q@>ueA+;CISz2$O}T>c3S-Z*mFgtQ@k}L
zqwmFT+n%^(ao#J_0j;SG<V6S5c8xc!1M+Np>$DRAh4qJCp6hL#u;pA1K+Np`Y_NZv
z9W2Mhqg8KhQGDa>e@zJ2FxLeHrGzRr3mzJmOx`K{-YTXoks{;$cO}C*EfH!k>mwm^
zwtmT+CQl#0$32&@*65QQ<mSR1Yu<9}KDEo>xAm*@`<1CnPd~C|vP@Z61EL32@9Vz*
z+72SFEB$6^X2~hkDNW+XGe8@BKi#A*qhkUuT@A1hh<?@A)1wBh^E~>tn|8=+I=Zy9
z?2LV|UNPZVyNLk8{Mv{jDP^!VmDJAcG4dd*L0!rv9U!;=PuIgj<VJTQ7`Z=+oYJxO
zO*U}_7S|=d;qc$$9%gcAF+aZVW`|{tR@RPuzP@ySecN}LuO3G`EmI@3v(bS#r;^#<
zC|gd0fW6>wM@*V{Sk%~9`^uVd;bo9@Y10+mXh_`#?j+niZNo`*AC6`HeigtWdcURg
zp}F)ukY^Zo$AE#*{V$)jxVW+pQ*${J?M0${Icy{DJ@A<VAiH;Mg-07UCC@XFQb%K!
zz(N{Dx6o;apVluM86ZLRq?e5hASo_7@&MTn&mM7fm9r}6Shk+2jtcAQ(kMK=M|SF4
zrqPb_qhqA6eto=^BI)5cSz*(YB%H;P^?zDUu+`X(jt<&XB!0HZALvUNEsdiIm$u{*
z|NG$R&i^*yxH#S<1*QUlc5eLdv;WJDIsdQt#OKF01qC*oQ|n2&tM`XoQ&umR4Qlkd
zdZtd@O_0}&T0z!W_rtEkP34te>IMgEWlI57FYuXc<Y0bN(<ziIs3&x!AsfB;o|W`#
ze+_9<5f?{je!!I$L6Xa1v(7qjj(dBqz;$_(<Y~6RiqKUQ<q$_S&7K=eqT_H7(dD3T
zg=bH=Ocx6b6>`Q6`Q;UaNK*WjP|?As4|2*Cm6&5M2fYVCcdNzS&~n2^)bM`h>+qC}
zd|T$Uob#@uOp$+6rM^3D;bCICN3OuXTg1}Oize1l=&&A)&l5zgKGyozi{#ll-?Evr
zHSbFFGQP=GpgSG#$xW>o3z_7SH^_*W|A}$M2Jo7a47Ko^-T}X%`e<mpviLz(r1?@&
zkZ&mO7fn&SyB`hLL%m?}If6y>6qnB%oL8?T@P>9V@IC|I>Ne7Ew^mi;&m8!-u_s~X
zFmMfjZkHuVu`Iuxra)Tl#S<ccTn9co8LEIHUN31o$c;XlV{SGC3jvh@u-ZGWkwve|
z4OIbQA9Vidr9s0RYwT~15h{qwFE|tg-S@j32;yJ=oxmGAAdS8z=+BlPAlqSF{F29K
zq;L9{U0-gQE^*V>Z~FbU|0JC8v8o2t3A*rl&6X{r_np*#<eCC{k--fq`QHTcH#kZX
zPYCJuz_db~gl0bP()w-wTsQlv{5<8~62EN@qn07Kfl|>!=A8Jpxi=;;tRz2~6NK{;
z`YJ_ik1+b%HTzrAHJ_HkF7=wFlr=*yFU)x3tCcZz&-kgY2hfkPDFnp{{OB?G_S~sv
z`Y_OAdT%eSKK#oI*uP&emcPYy{rqDY*{q&sp*HB2Qch1iajQEiJ-=Ykw>ne{8)Al_
z`DdQD8N$i&l~FyercuNnKb!fx18RJ5P8|PRPM-X;)C*T@_OCSzWD-(t$ZRU*wjry{
z^hD)OZX!15`oz_Ogfh1JW&hIGm$QO+J(j0@45E#Gc^-kUqS#iFFvGjsINazub2rz&
z$wr5s%w5`INhZ4^#5zrm-|l0s@p4=-o@u?rsN<guskxeXhjNeE`5fnt7O+sDIflHa
z(=u$`yz~sq@Xzz!>vO!U^7vBgnqTyKcbe@{g79-E`0Eu@ANz*Pe<Efn)lBC_+;+*Y
z!>0s)+P?pHFg&mGzN-a}l<`OA#Q)EO2>YtPG!>-RE`O-r^u+P_5x|9mJclw|suQyX
zQ?yh(!rK<hh!VHjNZ$f`H~Yv_3vhs)nAL3O6O$6|2vcvT&d;_%J)6aazhArofha#L
zTL7ZA({+w^24Z^rpQ0a%EYLeRfwzGo1^Vw=l*+W_3{lGVln+-5^YI49nigdP-3bnP
z<(w_xb@M-9AoYBHS=8=)?9@?=v|lv%yj&KQ;@qM5IZ-oAc0BR)aX>}l-yEW^zWl6d
z(XFEVE4M-EK0D-OfO^+*qB{!|%Z)<4$F*KaLZU^ttoL)$;*fAVqx%K6Akfr%b3pxB
z@1WkrqT63$Iz>vql*MU$TR4vCS6N70{Bau4FMJi0zVM?_2sk<GZmhAfnfC6RaZRyV
z8Ai~pxvYG-C(%PdC93xC2HMiQ|5YNYlbd3JzMLNPEYJKF(6RZx)^M@h=thB>udiis
zWEgq<10s+F5zS?%ByF<UTGosFQ1<VR>3wxxY87j>p)EzxH-U8f=%3+#C5(iY`Q(R&
zDE*bdh5~r4&p(rygqBKSa-N66Y+>N69GPJFEQx5*3@*^rV?dhtE#tpnPrE>aa*Xfd
zUdpuATJ)ptX{6DkQhQ0R-v7TNs^-;h`)Ko`bSOS>BoTosZd_hWjZ@xwybHE8Jw;eY
zpz-R;KUq~0zPzIg&h+}iH+$19NWwkfa~s%GlxrX88|nI`gFJKj{-zaVveFTKo@#YY
z_nsxg;?k}vzOVEn+60U^mB1E2GWksMKkdJK)EKEYLwv$Bfj~UX8dm{JRQ>)c3p!`j
zB=2~w93!OGbI&EIL;%FzbXNi}pm9r9Z$Sc)SWobWMLQ)-(E}s#`wSu1_>38)Q`Gyi
zt$TUCL8LvrIfZ*bXB7VyvFcp#>X^(6v8uKpbBC%NpJ8FjSttlnih5$RT<~y0&ynFv
z_^<@qz2E_dsg)XO{YjyeByrcd{w7r4N=+~5?CL)$834&d*Coz}|CZK~mevCXDUDa2
ztxc_a1TD5Sh^@*lP5!RV|2r(}&TQOWki_}LS%{84l$<w$FO4qs^VQ!AyJg1neASLU
zZtAJy#~anw^v@vwc2#V^*9^)bw%g*9E%>%*V5Pk{*(rt2tYt>Zd3R-QKZt#~Z<xTr
zndD&XwV1oBR;F<PGj^=Eu*b>uLB6%K(LHmz>`(!Tg;<ioSYvh9vddRv1ZCc<lC4C9
zb%{*>Jfw+w^RiA#<WOp)VQJ9CU1n!^<7o{~2t>i{Cs(V8#w(w$*<eyCM1;HGdq&w>
zU%>v>)nDH^a!QIM=DRe`xm3$7JCmm`|16z6D%h;j=H&X`vdwrljg&f0@6mxLs;D8)
z6SpsRRw7(YsX8)%${oI6u1207^ly6~SjlYnPZLvU(+Am;)K__(E~QoP!72oj6Kl8G
zq0-K~Z&Lhceyo>BY$J{)U5=%3Bl5h;6ID)VhvpS;l76m#C+U@dIMj8iPB1w?G|T>I
zCz6_Y<qK>VR^{aL#GyOe8vSlI8I@?LH$k!Pp-!&;l3Z<Ad`WhGUX&6qnP%xeaimYF
z6iD|>{XcVGp-JlP=IZw9?fbi#C+H}V^C<bbQ=NTRv1=OF5~JtV2Uli?WjRL^bS<8U
zEb)|-Qu@2C?X#P}2vz$3k@0(OD*}}L`EYpP>J(7lbI0TuuQ$EGl3U)-nD~C>r@cA7
z!^P}M#1fbcXpVY^qi~)1@kTK>N*f||#^SeAGNKQDzx6LUT7jg#)(a0X7&UO%T1{;O
zcbZmGE=7jkgl!f*4m*YS>+WiVk``O{N&EPo0g#Ln$I}=?p2Kx9-?{dIkhTQ+<&Vzq
ziCpQu$AQptK%WzD7SqMc=S%OD6#Z`gc1K;j*DE{rFS?m&c2c}qK{Bq*y<bvXOIOG5
zvL9o`Q}e{^&XpOM4*zzrS8>lgi1F7it?`~&1zMhycjRx(!iJP#5;@(heDxeMa5F{+
zV;VSUmM(|zqBgsCM<Ml(L~@&ow6D-%;Cc}KvpmyEXUQqT!A8@|jNJ$A44g}`YUFC)
zOvQ`|SxYD~pvta5EdF#T1TOODRe-~K-c=Cv&PdWSJoR&-LQ*8l-oJDI{aqcr_9nO8
zElaeNFY93x*8+LEi%2;1_DwoDBvp!})$+-pGj=d_3M%>b=Nu`cpg-2!)4XRVspC|c
zq+b|t6*IZWP_r~gUxQALTus>tTR50i=)K?5lz`Yy&fOP5Na17YSONT}XdV9a+Y)c4
zRwQcB33X!0Hg#VQC`QKl_wGHS2!Su(rTy+G@_^n*^5?xK@|v6Kk)Tv9u2@5t7e&&p
zxHcu;*k1eRQp79ugYQD~L&ve^OP_RF=>yJ)sC&{a^(acR&pWEYMHC_-aO<UB4gO?)
z^y6ojH>al(j5ABBHMvf=b{Krbu*;n_h)8KAPWVODubZ<#*K@@1(60MMS`Tx6XvQ0o
zhcvf{n>8)x=XKUHQx>?|1e|q*EJZX-9Z73#rDS?RH8=VqK+~FWoqFMc_kT|3Hp1Z|
z3;f<N1aqlztWein4#i7V;+0>kC6yW#sL}ty0&s6%6?X$zpljzd*Y{4{*2@fxzH(EG
z*{k&w6X3nl$2aGnain%zF1oJV17dvyM@p`2KzWayMUk@VQ{F#aZ(`$J6XHnv-@zOp
zE3nACaJCg)8cb^vTrs2DAgjpO^qw(hlaYN^8kX3pq7nJ*lT$VsHZUz)uR7FNT4<Nm
z?pF8UX-i4O+_OJ7;dkZk=7eNO+myl}&mIDs$M`x-!Ja2Jb{-~F!%=h?TzgpgwFgww
zWJHp5$4H73o94DO_5$AYM)8e`O|FC_5~HFK^=Owu!Qt!CQyF2gMn$q)3eXGDC&3mS
z$3JUbSy?~QS5T>kgUsH3cgZiJhM~@OL-qS^_0=ieT6vWxxv$7jA(vO&BCWa&Q$42@
zrGv=xo!i5l)+Hd5Cvu{Mbe0qAfw1IiZQ2thn<ae#s-3Js;q);5mzj&EzGL$hLQ6YR
zB>neqT4Ih8qc*bF@6X)2rU~0jJ*8j(t9<-*;C5IrL-kAv*!W-5%-~16o0PeNWD(YF
zY(u(y=O<BbJa0@Y$mb5(HN?2Fen8tyUL6R1UBi3xkKgq{JEyVJXZ059DOCJdl5=ms
zJuQ<G7rT92{BIQGCYKGs?0I?A2xp<l_o(ho{vPtAy-MO^{i!tVo4za$uG5ZKr1U+@
z2pKd@VPjJN<{Kp}3k`6hj#1^)*7{O3NB81=?yS+xM#+=97~YI_{X$nD7aLan`6sgH
zfx;bEP8H>trmNlxiEaEW-d_%*yDWfSo9^Ea@3xQ_z8bowE4pT%r0J67kRl?);w<>~
zqkxp=GxqE~<pu$2#+OS`hg5#^e;Y)HDdFycj|TPU7*;NbOaqpcK%)zbf|Am76MrDc
z;@4rGG<AHTldx>QtcxeR4w|%y$N{-BY8k!|3&qHu?*#%ZKQ%qG9w);$UV~<3v9coC
z-HODKyB}cD`xJ44h1x<WZC;ixlDGk!3EXUi-<+<dy${_$RM(hfirLhGBVr5O#2aL9
z`}1ZE-@aA(BfG`QK|?Qy_~sM|v8@T_anwC(VeCwP5v7W`4um||TYiw1sXkrej*d;U
z=YbUu>spjLdpXgs!P9{K?v4C6%d_m`>)mCx?FL3?vU^vESJ-sAL3Qbc{&ZbvjKO#3
zVsK!lA?@|0&+;`L9|gExiWtEkiMvKMx?-=FFJ;xlywSDf&rV+nbu19bq0kiuu_t{?
zo)q(IsTruuc*X&>|6v6!K4Nrl6`=e?qDOhZY2#pn6_}*1;^wSlkZK&?dSbzdICams
z(v3%tR&HyC@L^m+ZRuh?WTP1QmqM9i53f9VT_COa1gNidv=}JA6T_cJ*~UIrv2~EU
ztG^Pn0A@dF{Yj%gF5Xbl#A5C8U;z_rylOTwd>7S5|4bB!#lOs`;PJ5nv=Y&r$Hz~e
z)I4l?|Md;I+Jl>P%Jz@a6|H#Qguaj`d3#mHHwHj2!75#HL{E6_Ub_r)tY3u+H;)DD
zkfcOEwF-arFe~g~q5GJ4gR@XpigO~zbxHP;%rH4xN-j>egy$ZYQ;lWduVol1fJsF9
zEB#&wc3Q9y!9I`vkyn#_-c7;!f&Ng)C2st)=1c9TC}q|4vdZ_IFFtdDip4#b=xdmQ
z$xUmQk^)Kh?>)jKi*&(6izXi4kS{8|)~^f1kCJ~$>CZnrLRREo?{@RU!^1=9>m^)?
zhT<n*@(0^UTm!3&W-+s5Yc^5}G5x?r_wa|`mRR?lzlaP`va#%=@lnidrigI*d98i#
z!(uJKQiS<0rzZCNLef8fd-=KxZL%_Fz5Tgn?%Es0m*CoO10?(^v|FvW#Dp37o9S9P
zyr~0(IQ=NEhB_u{D(C!8dL!w1&YYaVe|>6aXCI<hk;!qLZ|Y(&kknWKT;n7bu1WnT
z-Vx|99SrDZ>4S8FYN(pX8(YpKU2iF%j8?t~+Y9aVEBY&b;pVnkY2M<BY5N`Ziv4|A
z0#OR+s5RePGI<~((3##<t|Z}ndXA~T_0LX$zCFULdBJO7<7F6ISkBg%-+B3on8U?R
zdjvH_skkiPWi&E|whCb8mTlmVhnf{buDgkSmk%Rhyf4SNFP*583%91NQD9XoN$#&p
z>S<jN)S`Fo+t=ok@|(XgK2|f|8Hf!%?r}2U^%>FiFcE0@Aj0T1R~C(82Xdp?Yfhl5
zq*t7}q<3W_z9@RQc?*twykkK(EU$q2EH9e7D*Ng#wW&r0C(FaC#Mqpmi0rz9`=lfS
zvQ?Xsl@N|=C8j<+Fq9_;-aiZS(&}y{C4PM9c=S{!YalY-^t3$IpX-eeAs?r%Ces4)
zz6R7x`kna_Q~U`((6X)H9%n@d31nQ)C*R0mb>fZ6rA+FPEqEp8(-Hfw?-Tvm^Hy91
zE9jt$rHyGJ?4CZA`o-j-6INUk6@<r*FVK~my7csI`f;hlA{dbu0;pT0{b0|Mt8a-|
z0-tg_eJYEpkE(Dcr$NblRj{mH{_&Y6ErZAP@c>V2#YeWkI+3<-a<&&O36l*XvzL*y
zGu=8>s@h2gwbSXqNA==^vFJ=WV)4k|no7n4uhC2uBmZt9cvHW0y2DuV-pKrM#Kq2O
z{xbbDr@7TTjny0xJb(G9EW_XVu_66L`g~j4Eu-$;ifl`d{+P)~t*dM8rPf_YeN21z
zJ`=`s#iTcE*B;33^hoMG?AOMs|5O``)LSi_&;SL;Wvb0L?YjSEHQM@)bzZdgexjFx
z@kI(}$lhC5&(lWdf*%fa6OTed_*@yQ-yTHLGWJk|fmDAd^v0|PtzZ(Eg<cs(1I-cq
zu*&=;KwkHExn;kwtGmJz9?k(S!7ERMbUofl0iC`7GBu{b(*uuGg!yLsc%lBb0i;HT
z<65anS%Bk3y$*%8o7x@uf`VAYEZI;S()%dSdbv;Fy$n#wzkR??+xg2fS{SO5ZKqVj
zw%^_LH#0p*KGf(_>P=Oh1l|3DgrTdVtze)!`Z(m0w+dutxr6ip6}oa<*P2d7<-Ll8
zzS`8dJK`tvtB2aG!}*4{Xs`4$00AM~g?V9x{H?v9DdBxkM6MKnnLKsqox}lC1tnI0
znd{2;M{LLn5{mEj8B7fIambYM7CC)5>}=FrLhYZc6Fxb{bSh@D5YKrUguloHYJidi
z)ukv@qBzMc9U#0{FwMh}oL`Z@_pdg#wNk3e8ueMTy#H#h<wL=h()8?WPvZ0gir8$Q
z?1s*$v(uy&*#}n4`NBEUa?fu+e^`U}9v_MfwSLY?+&1Wj5Rq0DC7Cq`#8L{1Lv@}6
zi5O+;=viO2d=d{wea%*qSNqeb@b-=bk6ctz&RU{3_Oa-}b_n4vYW|i&WlLDhZ##<s
z7u0|pP0!-*5V9d-rZGPpMX?MBH2!H>1C*B@UqZX*T_riI-C+Cr5QXvPui;AWc&s2O
z{m7QQG4ipF^xeZy&U=+frf-Unj+PY}^v!QwGL61Fr<W8YJ=#$g-3<RKukH)HlF<l$
z`d+*LuzyKd69dyZG!nP1GiY$;wp#W)Z>BADRuv&*nA*A3(YVU`oayUG9h()6@`zh(
zW_+$)tJ;u`<w|i`o2w1AV~GL%!peL3OriHTGC7LE8N?l?G!6n1=S>uo)kIJ9BRJ`Q
z4gBf<^Jj+>&g<O@dO*^b2MTY57CL6cjZg<0v?7!@3tvgufujsVWx|Mi9R}b>9QtKK
z^kPic_;rVFDrAl2aB`at2Pd^l_~+HOh;n2Uhik8zCH2{miJNBEvEAG^EchXC=2R$t
zcH4{GWUckEmOYTYw>J$D#hmbAVfG76I>CGBO0B)v<C&%7-OpAq*-pzPL|e_FdLH!|
zQ403XBUW2Y!{&LbS%aAPn+j^0BeG2#A+Zfz2D_m)r{ORZXJGUE&LCt`n0Sf9?nB4N
z`(K|Zj9BG|K*!7WY?#xkD|#BKgH631xTxzl)IdLg$Pdhj;@3=3wxDj7Nch9K%hYd!
z<>s_`4e*0XTDsCuo#1Qr--pkG=;K_Kbx^^>wT0#>PZeSvxx2oH-V?%n5_Iey@}vWA
zNB$`&^tB?1w^@?DbN|_0pb9_hUdzPj`rfi+61ShTk>*{0esBs}?x5AFp}FY}<+ySE
z<=2sKoJMvjhoL2_r**QTDsSe#zTADeXF?J7+rZ+cR}syZrvr6Lvczw$e58Mt7R$Rc
zZq)TB&}cn>>|HNFcs#O8&>?vx_nJFJSEq7yl+5ab0*t5F#Av0cjUxkwQmDBm=gfNN
z)-}FAbn@k|=5B-u^f1dkK)cWSk<97<PLIHBz6+&PhINOg>o9IO4TSQR&l3s1hjlh8
z-&7Ee)}_ulyu)jH+G@p<b&%nxSMXJT<sKy|N2-8m){CFi?CIc>1?3TNOfP7yai8)T
zBsR=)<K(^Ea<*WJC~9@>vvx6gKKVD+WZgR*vXTIV09{sOXCVDHU2P%|+ZkWU`7Sd5
z?qe;(_<my5jCi7F6yFnw4zyRrT6@=YQ0KjCP6OQVQ1d@^f^WaN>UF?Fisa-`Ici3$
zNUm@TO|{&ECeIhQOx<Z@PVMWJoILp@r0D1wgN>X74FuEpYjk`05{|!cBT;u?C|@J!
zPa^dekS=fwi(Oy*4wO$o@n&CwH#y(uXk!C+M{*<|K1m3W=lKMfQ;Wm);Y-*z?jJw0
zmxl4yV6~A!tgI9Uqiq;5!nvdYn)u;PE>I+cKZ%i1VSlC0a2ySWDJ_9pFQh|lu73Yy
zPU1&P!P6V?Il$j-+L(zj=31gr1CB0r?$C87x6}<hN=XxLWzv$ebfbM=(wP`gt_4;O
zD7KJh6O`s;iT!}G+Bbcg5G0?w<~=~PzE49|aA(j8`>^>+VJ}x!!n@7zN^+y}*PCKf
z+8=iRtR|LUxi3AO@jY;{7u5ME;X_;OV#%36ks2%wwH9w6Ld}KPpUZlx=U)jDg5ty(
zW7mZ2v!&uXzlSHi(o;QFbi&+j;vAfnQYka$yQlH)*LQIX2LWA8)7#wzx#bjgt)3O{
z-4o{G%CWA7tM+Tzzm_<c8v?KQ(_V+q-j;f&d9Pd~f#F+HuZR@<-QlvKWwNZ%qEF()
zfoD?UpMzUT3;z4puME|?Sg2ef3pRQVj#d=<?qm#Id~`NGwQa}u%N+*JF7KVEf*Xo-
z<z1uh0jU5nfU8<4u(B^qplDn6j^D2T-E00@yraceoHd5Y>K=&-wx21O6UARel{?dG
z8H)DH8DXeD-Hh!54x0+Fe6kafz~@Szo^<mPvj+z*%03^dC^1RU8hClnHK(*IN#Qq<
zzAKD-{q%zlMtXG1;M`w{(%5MUd?gqT0y>%+GdTQrR}DVDo*wFY7b>X7L!5U<;q}``
zzrJ#>Om)C<6!5tp4=8Ib6IUBbjYNc#Pnz!b4Yc-6{z72i5IDa{Kd-KGea7;CWIeyt
zn!aEKC_)<j<elduqy}F4f3ScU7205x<@K6Yj^8r6Az1_F9Dl>f$P30|8f@HKx816{
znO}$Q&9z|vg!kAPhz>Lx-|xP}b<J;lq(8XJl=PXOWNP8(qC=Aht1{hvau`ZQqL3fc
zF?#!tUrY$`^QU(xUu><OMxuRN+UA<BuQPQjAjoYFM$!=Y?qQRtn;u2U9Jsh%q2@P=
zATmJW{oe_F4yH74>A#q`x3l2L&kt^Poz^9F&`1iGm$k7YA3X|aCaNkj((BsMK<Y*2
zN-19B!bE-f6~n#KAzQns8En<+At=~b6FRsJYvOK}6(9kTH<5djG*cJWoW}_R%&C=M
zd2v-!5$ehH_gfijj;t>i*`CJhlPOecyj3F8Q;xe*{vtpSo078I#g?Ec5Ohctp{SOj
zBO>rfn^RJ1$erI#m|mpo1v)2-e&~vEAiFJy_#?e5?VbT*y)~<$6K?F2(wX2W1Zgbw
zeH;DuMP_pD>S<;Hrx9;yr8}j^VO=~-Iqq6P)BuS~arq56Lf)<5p7X#njc@!uPX}5t
zWsP%*kL_X)N8*otxu4`F5*gg;PUrgCwy|$4vM%7-Ng97gf%#69;pZ01qVI2l3uwq}
zHAgn7Ty-Q7N6D{W##m{_UDZ68<)6dHbs6ysynRZ;z|6y&qE>0}rv4Xow>N)Bk6Q%z
zS>L0C=j?|2ZC~4x=A-Qu7t2#4EUgqvC27&=RObAxH#;r<Y`A>4d8sQLkeQTgQ&93o
zI4f!VRmaP8D-M;+N17zjp{2YDbgrZ$`Jt^0J=8rMftqx+_7MWPWyKxvR3{A8?Az<`
zexi2EO#rE#6E*YNo*v4}MRkW@!jv4RL{u2G$!suk!MvIFBxbU)oWU<YH0E$QcS2)&
zbX4Bdlw}O4i3%oaQTrzeB<YVHmWTcvD;^FtIzaE{zEgMOuMzlgqr`x2yzgYVob#MC
z8^e}-ShP<H8vbBTQY^=~{;Sr>@Vq}Gu|5c%usm7gV4sNH3XOQTxLZWZ99E)4mUQcn
zEqvBgu|V+32uw4$;Ek7ItF{XQR=<~G-f0GOA?Alx3Z$1=r$7p1+k8QkP2@&Rd0&|$
z+=#Ey)f^j$)WRm{Vy~(m?|5R8zs3#yNnZ&k@c^YnjsDR2lq@71_;%eOz1L@gzW>()
zIeMbAn@!|N{x2}ZF+G?FB`NS?s206?a-~jSg=@*zj;d+1qR`A63Z~@O>H4qxWe70m
zz2?s35;n1{ake#lGMzEtC*rd-HebrnEkL}&cNP2tcuhV2BnC`HZdV6*G_11xtcLpk
zq3OE=+4|o9qh{?9BdFG_JrcY2uDvTZkr-7~RB5SA5qrkoGxRN}QdOgrh`n_gwX1fE
zqQBdIe&2tSd(S=hoaa2}xzF=@z0M>wK@#i?Qc1HQ^)IFHWy-&ASZq|=Iw0k!C{WvC
zDy1n*ym^NN=7DZZKZ}7L&o`hNhTa}v7c8x-qWW%FISkggT53#CcfPE-uE4y?_8C9Q
zK4nQ$56eq4hd28Z&cB@TveVXJyFnp9h~lLYPvAZs9LSi0v-ZQ9$yaUe)M5>Pb0>*g
zAtOk&-C+ArD}*OAmDcO@OPQ)#cAc$y>(7M8g{rw{pHvhT32jsD{n4nTEC5#`-*uzA
z2{3U=EogOVw5D8}<(OdB=g?u>SsAgomKNcJNO7voOHxPv@w<)7B)^FCort-c{BRIb
z*;(PZfUEx+m9a@UsXLXcAJZ1P5%h#5=nFSmcN!nJ-N!!m0=0H+qV5hJf9C(2(RG($
zo(w3g1V2)n<pX+HR>32jYrAec(kK-wTkCU!N#bjHi>bK3!v<Z4R&Cybz9#!Mj@RHw
zh^PjiKSNQ-sWP2sbrozq^rXKwE{A0YUYxt~u<^CmWmTogWRI|YiUk~Uhudf>CX=Th
z$-F?V6l)G=C}g|jgOBUq&WEgWSadnEMmu%y|HgI4wvhP%miof&$189&ewAKZMy3D$
zpA9Yo|Ky3P=5PObMVVUf%YE4nRfVt@t<}bQ7LQjM1Jx$^u!=NA&e@TbJYGmg7yl&B
zz%w_Pa7k14{^-qn4{S%2@OA&eJsZ3w`O4Vk$s;jePbyb=B=!nKh4xG(H=WBVzE08@
z&Y-VYhRGw_?akz#Saa11dda?IyV0s`2A+TK8?@_D(Yg)4lZF+Ioyg~iZJQeK4O$pF
z+gSIX!ZOvpT5=j>UB$&Z-dYMw5U2nU33|xJxkWt<l?74EoUNT%o<hly?w-{RYPhY9
zrezdRqCI-a#flGNE8n@Q>)ZV){s0SOvb`DC*M1Et7PFF5Cz62j9<Qp(53?R}wtB*n
zuzjIX<z3w!-LP6(@AwM!XNaV~^@Ed*^W#=0{#7aT4-<ej{&ooMEUVIaID50`b;@H~
zPrdT5U0as=7Jk&-g@<{m*5gqV_r(_*b05XIE2i>rPM(#gY=dWQ9cxKT;1sCm)4!V%
zf9^<vKN@2Y+o|Jt(@b;bq#s*VH4YfP5?CR5XCaf$Y=;*z`bV*1VcE00()#x^XB%y}
zviJ}k!R{gj)_l$THM3UhFPA4mxQla(@5wlgjez9zMO+>Go+8D{zD5PSjDAmY|80`X
zjpKw|DfZI44?}0TX6>xo3D3b5PHMPsi8;jhGIl@qV^AdKoxDPNRuki*7=M!ZMO95r
zyV51&G_Jjirv7!{gNwr(c_qzyddBXQr6r=n4Nk1)a4g_hicu&FK{j@$S4tS0K{pt6
zH%&rEt{Dk)A8US32HU&dSI@7j6jy|u<U}rn@EieQMf0oA2ir|1SG$O_GAhR(*U6)n
z)xv+M9<;ywc#-;GM}SNt)GnbTC3UKVoSqO;@oQ>Gaq`E*J@fmgSAiEhl_BawYv7KJ
z=KcbmxmLpDwUXlwPkB)b<BT<HN43H+qkBp2%7Qsrj3h3;9`fMiigYUNN)d@-;(+Kz
zD!A2PsVPcxhHuv3c$?W@>0U_2XmkM?P-I`H3f+1W1Z)hg9c^}h%TyAobQW;_EU~bL
zM=v2qN}OW>M%8#5VY?DWi2rrrjmpV@VRB+~QAX-G;-9M7<_i~RaoE_KmA{`^i;FNr
zMNKNxhb$ShD11vg1<Zvti&GTOxdyu1@P2tS9+aV4B|;RaFKy4yeD}gsXS@!3vU}(8
zO{PdL5e8SKBIGnK6_vHr2_BO+s?HJHs)Du2`pVsYhg=INT7gS1zCRm)*?7v9vo8+I
zcE%^5LgU>JPSyArjjGex7AQu|#-j@o`pfIfC3W7do+?Lm3Ey~RYMNE|J4tTj361V5
z(L(dRQmZ#aycO!26evfXcQvwDHW%f4?j)=D33_cPijH3n)|nM2eILN<)7iI8hkRvr
zIIY#s)?2IlX&i7vdxpil-P;lJBCaMDwV`=xI)Il-QmPX(wQA5bI@-<P^8^N-F{yH@
z)?R!Vbgnyrjz}cMa)v6XP)C=F&fWvJt;2-Kk}@9?R|UnUlC|E-4Yqb-5k$0F0K8Gz
zm!6lug=joC+z$sXy}M?6Iv-JpZ1wKV6Qxqc7sxmb!zi_pC}RjZ4)NH)J@b7dJotVg
zv0(n=azvL=gqm|uP({sqXsw}a+&1Lc){ONKJY=Z_B_0s$FjMRJ&ePnY!jkDmmovP*
z#LFcmM&ku|g_16UV6&wWGJj5Mht}Sk_GSBovPAjJU60DIS;QPlPoY`x8tTCSmc$t)
zx?1qhV_>4a2fltYFh26b%v_63#*7)AAl(pZw6rwj2z{lDyY4v8Ia(P~xl+mOx#+SV
zzi4l=m2diHV#`W>{|h{iJlC(T<gOr!3sZHRdZ_{VW%|nkF65|F9<3wOQg^9=m#^zV
zC_3!>3a>J5+20bJflPTIn{g0iOUAn#OfA9Y;Ueeee2%w{8=Q-ilbwyNA}D*r4GbW2
zOGSXHHUj*apM?^(8I4bkT~5A=c3!`6DVF&tYYq3K5@(L0X=uO3zVl>DwD3ebW5w_l
zJ+;<0r`lG%cW0TEI0y7_9(w-=<m=a$-UEcj^Cp`DpBRlIMqBY51gOy2m=C7!*6~Ll
z$5u{ZS{3k`SE8g8y?&Dd#WnF#<z^+<wuNxB=!ho5h{or;fszGy1am+0v3=?I3S&J|
z`M6!B3TNKq{KBWM>>K5oJ&+0>E0M_?rR<oP*F1nfq!U4N#}iH8TlmbtJpv$~I!oU5
zv5Fzra9q_;Dyy;6C7s(jqtRT(T#!#4I;r?~MUBV8EV98pclmL)d)o(fQ#5yRoaJ`X
z)+Lm-D#arx>4ttVWmg%;?p}Wx>Ju#NKUAVrW<SUl86%B;d@M-<d*a`_uic2Xf8{4V
zonsle#lc3^U!Jb;3w!Xs`OA};94#rfRH}YQOItFzmoAq~*JYlt6E>>w=j;BLwzGuf
z5>IF6TTUf^fMi12cnRYe!jcm<D{_1+3Ka=2eMqh*=Zr0n<IZi*)ucq)d$wb1`|%xd
z>C5XfxWdVWx6f|xbs>#Xn&C<;1%<y(>E+G9t`qB{B>GMPt2C<mzbyE7`TRX3o1-JS
zJ7}n>*=3{?Jle65X31UEJEAWW6YyvuH$uLo33Z7R7Rt_;CwD8iJ*(V&p>}K7I@nJ`
zxOx9!m5Xe7!q?Aj$I`hmk%!Jo-p8501S78ZMKRz}*x=5G&$pyucu$Fs`vSM;M)bvI
z$5)5}gkx&<@ET>mlI`yAggPqH^5Qu1jg%~w_iX8G;jm1a04)uFArja<+jk-JX78v>
z^6C}*EyWSEh}-#vd86jCI|pvfHqwInE4>=lzdp%4Q_GGe<B3ocvG53Lz;3%Wcgdl=
zv%RsU>@Rc>9gVD%DDH+-2^J}l?tEznpf+O0cBCJs&GmMEQs$;6HL-6eE+RQMVO^X8
z^<%ZgazKATYJfMr9FNTIpQ+gymD?G11NI}@<o@*9kXg;K`~we<TVGZ@)oKa0ev1Yq
z>J*sVM`w*@Y9j2d($Ug$7LUsp-j;FnOSQdJjWuTr|6o&IFF8ITMo;+kUZFunAE0S{
zf7q9D4nVAK<QvY7q2Asc*W<g($(8Uv(^NQXnE8`3zYsg^07Ct)*W0;IAwK8tFZ^e3
z4OEY*YCXfcB>6z_HpPN3T$o@2w>)*!U>14iqUI>XQV_V$GKqOaa(zIStFoO6LfuU#
z$vgr)*1qq$NS4*(1$iCa>|xR4-5dFYX@w=rp|ME>5u6i}Jed`&;$(<S?5GzXk0KHR
zr<bRd2nH<iWa++K-Upaxvs@i!N=ItKBD@r?lHe+iu;v;tv%Y5?!?efLGlacE0^YSw
zT$tS=w}jmVtxzmOIZ+obMIs6Ms;S{G4=ey*%lZ_kbw44Zc^Gf1p3*g>lQ9BS<{GgP
zrl%*4FjeBhZ)Dk<4Xq{Q%`VE6G;)Zw%jldLOI}SU`Fvh4JR7ZyBB+vd&F7lp*4gN6
zbVi{M$*dVVA^}|>dd*T0DQwnEhp~RMXY;M4wa_i{O&0jm3@;BIOBh>N-DdAsCPf&f
z>j0bf=NB$IjEH0eQY<id7ekxK{C~NCMD9?ca2h?2QNV{?Gd4zIEAZd;{UGjGWe2(3
z6QnePUs!G8fgo4a_T2~{QhpPNk%bJ?l#ErSW#!f}nYQH7Xi)x_ezaVNl?OvixLXJU
z#~0g+6CIbk1wPD#XlX1PrSqB5YuENEjI<GQ1GmoejX{)Nb#;PuuIsI3XL7U;O2fqK
zFz=-Y5V;ekX(uLy@B8UHKqXVD<D8^Dge}fuygdL;d(UfLh(Tq-e%ndIR&s{WE(0?1
zGj|1_#)AjIytxxI@|U$WSXS1x$R-w9eo0DuBDk~#>pN8C3)4Xss#cX`6@7Ysj0$1U
zYyEPi%F;GBs><{mO^o2N<9VA-sl8BLg3h1(+ewc)*xav2c@c6%wGtc#l$rdstz_(k
zaI`{3rrCHwt6;Vj7SOSSr-r7)2O!e*mnN5W7WJRBT7xz&8^X>@pE3~$pOBK`Ra>h1
zt~y-x!B$44vA84|pYfndCs>Cz+s*RrIx_{t`Q%$4e=fp`p0+^Vjygw-gqb8U8;r>+
zaSp2^TS8q6uD=A6!D(})j07^56rl<uaU|;0B>kW_-!+P_wnyY2et{^AT%?Rj7@g?Q
z{UWRJyWd4|>u`>EGmBKQ2kk#Hj{<>A?|Dk-g2$gy_Yg`87Q&ktU*@*g*bfjesH6nc
zvF79F>aY&zdUFi8e82^*J@xU8VU?(6PM%>|{o!^_zD{trho$p#$c};7=xx{`8v^?)
z;>8>>Rm^bRgG84RFa-&pLU_$A^gN$t5Smf1^!8}^zm5U_MI>5lj2y3+e}IoTJB(29
zn7tUg@ZWmCn*cC!JUC1|Y??Z9=n0&73=NyeNmEkk>Q;Y0%QNknc@MeRR<)%+?cB?v
zm8}L-e^{byZ?Q>VQJA+!sejbUXonwZ-_-X&1x*E8!rlzl3~;QgsTF++XcnT`6K<Y{
z>)3pkZ$5>eHX7(Vl9gnbSKAg(xb+df>b#x(#4F0!AQmy^D7~6%He8va;Yto77jzJL
zar}r(s|_w<jbOB;yOpajalY0^u(Fp<PODeVYg%g=dbWwFH)pO-ULpP+WI4QXbRh?F
zD6-%m@gRmsUsWtpMExiMy%%W$hB~2lUNa75le824c$I-`%;)p$nYx^@>8t=r2T>2<
zQGx19La&o}g6^j$q;s_~|H=5XGn=^fyAp{VcEoXg?2N~}qpb;Np^g?TC5_^S4;-<9
zKmiOXZYNG{GWl^3^6$#heVTb~OzZ)~;vNP4fY_JV<Eu@}!L6p)DS{V`K}oc!APZXB
zdeDL$F-})khRQOWy<ooEFI}Fj!!Y9U?WQw;>?_nv^L_~zY)*-jKCiKRl@u&fqz>$7
z3NPN6WB9pF`g3m!zgSE9bBJ^hDcKVg-Z)g~;LkA3)Z#6{$ca`1D9#5RPxiI~tETp3
zG(U@>WHmLSV(AG5y-Bs+o`U7%V?1A^oGMpx)86}O{n9RfG&f}_mNT+WFt@!$U&3xH
z$wo`oqz49pq#KNdSC8aRIiGdV>m!+W9BR>0TpJhPD+8^qduSG@w>2gGN$v#<yu>>s
z9qx*-P&PMD2`0DaDIC1id&g6YW}%GMT$WsuzIR+h0t)Y{m#IZJhOC&?ez)41lsl6h
z^WJbr2MuW2dY)kGP7HQ6yW8jq=VP{mW7?=G(&u|aeh?`gF&0yvBMRYi<cy(gPN^j-
zy4f`PFA5E$Mx{|EA%5d;qFWf!-%!;U5~L(T<N3I%e%E1f>8)n!R0u^6cC4TnFBm#f
zLDh`8Mu(`Befj8-U6Ep;YIl8r!`QlCz!a+uA7^~OYXnF~;TotLDQp1;@;B+slYpd+
zmDo>OxV{G)XbTAFF2BuN>Oj74S|*5D4Rpq--i~}|)<mH8fUARrN@Mz#oyYT|`~ZA3
z9GR$VA-wZlWTNuA7=ZKq`9kN3ZkW2{4u^XclxwIn?}PkPF6<GM`81)?6Jwa?Lj<SQ
zEnD{0(vZ*vfo_WA+s+<XTH_5plBhhqJ)bXrZo~F0=>YPeJ9Ok#P)bBfVJ^~9SHg%p
zOTDtJ44e_~24zSZ(BMW0umgDOKSDR&&(Bz*mPw^&1@ooK4ZiW|yMF-y=;XA9NL`7l
zWDJ5;d2ilrVAN%UDK}!>qBC4z7|P$`A?-!`48Zg{1#KSIBHtDmm>i(#e7tQG5gu>$
z9C)I>B*b1bHb7bm9vKN6eEchOWg;*k^7S29`z{}gxP7OZjI@=uJ~?PVW^w@;3a1}@
z;hxkbj%<$eY6~Q}2XtPBd=}rSTu#ua#nu|5O^jGlM?#F}S^^YhWRUM++Cl*RVP72B
zzrREEb!RF1xXNF?2{y`<aCR7WMDP?eFsLm7A&>G}OH9S3bfna0jj#|m*pgt8k%<XE
z;|oCDw&*dgWka{6IH_cXA^0fI=F&U140D@1_avFPI{S<}s}iSwzZR`2OKc#3c;6gz
z7W^K-a_==QJ~wU0j_?mFmR(WH2?JV@zodyD0+Yo+UWMCJd6pJjh`~c2H1a2TlU3r{
zsr#GV{M6?j0}HIkci}rus#<#eb7z&K|Hb61t0fwsgDWkTIxlhHfTZBXGfd|Q7n+7U
zUmX*m7`ois9v}>`1G+DbvkBseWc8Rg=U?eidBN0?a0#rF3ZbCF`#>wMWSeD&UL~Zd
zc_+(E_V;XakSC>hh9Q6L)9m5p_kezjoXE0#wf(@vFAH}Z<bQY1DKsp9&|F_RNPepR
zLd>eINHMR3W|r%!c9FBo<`M?rNi9t?S1v9-U3|jU1%A&0Xabv3SCOq#jmfVS;b~nD
zz$2X`J=iy#@~z%4d7bQ=>g-x3Y?XjT6`Fa_bVDpNtF!|$TNJC`9^&(K+g0(wlTsz1
zC$u6TkJ}&!v4a=rGK|UbyA5=lg0Gn8j?>HXqNl<LwiuC)iK)~BH!x5|(p@3GwFL_(
z*Rq~zD;nuquN%ax-&T2|d2<WRpFtI)@!Z+jH2Ywh612pAI|q+6_872X4n-)x8I4fs
zozY}{U?bIA5KZUmMyrXbvrbAZib7YH!Vw>zHoQ>vJXD%}dAqjQkOeUJaLTigWS=Na
z&50Myj+p@3`WMvEq`2Wq{1|o2NYd={$hMDeeR@_|R+q~bLb(2t?O+Hs*YIe3THQDE
zeXmB7DJMIpYh*VtOADu@=~Ii(GwYo2<$GbDgWe9DFR|nzX2p`dPJ0ygWwL(Sg&tF}
zZ)%1vc%x9L4x9Jp(;$$sF00;Sfkz6_NAEN}ZVIEGFL$?>J|>guxQ1-DieePVR~M`G
z?kX|-%fsyr;%4f;u|8Gn+DcnbRC|76zI1rKvdJ_z;^V#_2H~Ew@W@XwF#!X({j-=U
zR8G5c)}vf+vQ|;IOf72&dhlBQ+={Izmpf?5wx4~+CG&?|Z@zzAuewp^Q5@{IRJO(+
zI#o5vqZs@GGBZ*3<<`fqU2^6S*zNoY8f{ojrsVIbZ_G)M9n;&EMmIP)T|rCUNdA`^
zyC>HZ_0Qg1^Z2lhYHZAna9<KVj>$02b3lp8ug6;slzObYTe6h@F0HYDta^PY@hAv}
zX=&Wi)J)#FP6DdL_gcNh#;oMV$@@Ea?sJpCoN72f%)j)Kuf!oTifqfcv|*~vc-LWa
ziTgkMsE|n90#J}zc5!bgBLXdnG;j49K5cq3=RGhlUyN4_<K#UhiNu7N>1;n*{sQA=
z8!qu!_dhGsX){$5{oE&qPw;HF4|Iv30oE81=y(td=}R`Q#O^|UAn!MaL<9w+oYzBX
z;a%V7-4^RJtj(m4#3&I;QDSacYZ3ir7@6cp|1C=V&R}I(iT{L~SdL)pRRXE8no*Z4
zS<9f?X&tnr_K8Sfd-XCsKnt;Sbw7S4Bz)oMqUfg4{+6h{dauih2O%>c<(IiYIJA{z
zq2>9jKpCII1A&oqmfkEkagOkGD#yux1{S2`pAix46k6pbELgPyDk{5cVky<EBWb&U
zot4-5qE`HH$4e!@ryhv&3!fajZZ|PCJL)58$fXqByumGW%rHr|KkM#E+H0!}?YyMY
zTtoZU=z@x@q*u!!J7`3UIV5aO!_|>?FhVUApqs>*3g1B)-##MCPr{lQx!+Wj_TPCW
zMJ65x498C=-BM0%xu=v%*OOYM@e{>q-$Sl3Ojid@pnv_5^Z{PS(W~SpeS`jDZ*TAE
zsXXEuKx=swESe=V15Nt%RY%qzs8a0RnYrLWDU~)=vZ&3Tb5&lt1^cZ6E4;n$Ty6c{
z=AUId>j}|&(;B$JJJQ+72+<qw<t@$cT4cIHF`R5{ZU93?_G=Y183%dG681~%KIAn^
zBt$xJtJWo3U2KD%aFO6T@2pj23!ldp#TW<_J+g)*(TY5~r&vfCqtSC~R+bdxL6tR}
zd#|OllOAXS$WRWVe#EQ;#FX8#^ZCP`TXYV{iQ#!(i60X8$$R-TuKx{)f;Pv|?s((_
z@pF7Lg!su{`SVS2JmUU`-po&RU2Qg^s7ad=GEj-Oj_}Ttb}Vm0!^m39<gNr?lJ~kJ
z0Db_4W{(EBlhA_HB+P_YLnY1=@%AAH+_S=6ou<|6+r0Vh;B~+Njxlw03x)!WNx+8Y
zL1u!y0pF@dTEo1$l)mF9QZM(apS{ISXnsusO3;c3X2mcyjv9|xXFx(WGmg_#q~6{O
z{h|3>gl<B&5?c4@>qy{irtMsc?rhR(PU3waE6B+bMea+gZ3c{l<cpIkB9M2f2<L5T
z*NPCU&_8P;bW(^y?)Z}sm(pjyjK72qv%A6Cx;bItqiQchJS_gEtU#kxbvHKsCKzt#
zJ5{x==53dFXt#3tYdA1?14FVIet)iHoM;!n@jEOHSduKE5;<11t^oon3+M=rzt3lW
z`LL(c1SDs=6|-4p;g~=M^2OmQCenOPjHK*7zCpdBh_N9&cti?V$(zR?*>LbShqwet
zfJW(NB&!n<s2hlfH75wnKo*;50bBnU*{N-2Dn$(Pz<P5c?ohpGU7B~xYaglI5=}sj
z0v5|Ui257_peGZ`zyNV>dgkj2T_vvTc;DmZ|NiF%{tpNKPpxV{%uxoZg`EfpVUF;h
z^6+d4C?6n+Eis6?5%=$czg*V5x!no$@mY!y>Qg>m9z4QHOJ(?bv;igQ-<yZ#+Rv-!
z0k{kS4hVp#TDQHGW5c=MY$f))pjajwY^T6(tH9!V1KHAFJoH96JwgQV%nUfVuKgQ<
z7uuDj%_L}7kncN8JGv_Pr#4GJk?LaYqJe?k0s7TP6OS*6ZXwdE9S4HMx*C#4LU`29
z2j0KM?r}zaB-?w6!rK%;?-u*!LSOv_(f9L?I2@GelZ8e&uR9$-9g6!Jv<7^%n4Znw
zviZMUfZ}}?W_&6h5HGn7U@Z5`V<4-@+R~;0V*Y$DryeHue3>6B47^2VdaHZFiC!V`
z+m<?&G!HkLfU2M+fs?9-uqTOaBGp5V^W&m>nm|i;^c6El4-c*l$Pb+#e0Kw&J|||M
zpp0{(M+&foGP(jy02hpd`#btukys3u81M;o18P@bZ4qG|>KC!Be?DvT_T;u3aRd|(
zu^1QS10>;9-lhvzVMIJc#Y?T(LNRK#z)NO91NeH2h`>QU0}oeGiDamy?zl~_1y~-B
z!_-C<snOI?fM*?*)FY4I19{{}L1YfvwcZPQSnu2Y&F`r>I5m}a5+1L52=3ZbpnQiK
z3=9gmi>%6&V%JZ{AM}6#)YFD%N70x_z%ZYi49BZK5tfF--x8=h%DsT}Ul0q2wQdd!
zRIDZ$HGC`IDuxR^PTb?H2R2I~-K?;0%$2A)i|qYs*?fRf$uslr_81VaEyjy(1q&&U
z^+xrlAq{n&RT!&n(B0OQj1rc_HG$0`$2x-3%i3l{AqF$Y-i@gv!X3{&MGMj&oEO_j
zGips>IlQZ&2I36zInF&cE<q47xyT%VS!49V9e_GL73B1Bjb;W}YNv?;xa@lE+A1<B
zTfuzp+{Y})&sFA_%2e7>kM@Ax=ENt&03d+aS_yH*@%4oznKBctF5h*NLC}M{?vw%b
z=Z!3Qq`fF-F3LBa=f6NxVLMf+UR&)gTQS$cCwADoB1>woX+d_Us;iDH<JPqL8%&q>
z%M1?=N^^M3sL#ng3d?HZ-PFzQU(I?n*bmsUkFZV87bOi7`$b(h!*NoOaQ<3!QYoHl
z$)iK)&zi@-N{8QX#hHtg9Yg4|?E<LGG0ng``3Dj0P6x!k+@D`al`R;fUYpvn{vf+2
z`Bc(O@=lIvah~XZUo`AOHk(Z4IVoL%nM(8v=EvZ-T5sQMwHIH_dq4y=r+4b|x4K01
zE_=v-^3mFQZ7*IpjP!ad$G_tVR}FlftN%(q*Y~n+`6ny44MSqr(~k)cZ+3KplmK?V
zZIh1@{>}NmKKsp0J<o<(D=MMbgQS!A+DSRxIf<^uyAv;}%N<d$mj1XeiT!yyU~*8l
zYnm6b{rp1<@OZ_p5)6k0q||a?QBs9*XPUQNN&a-PJ}c~x(0PUo%_`ds0A!%(y!G`A
z`Dan6`hdpK&hDX@$LYn;(CuW&kBzX~PcPkY<GVqz8jxdcK1LeFhw@C}c6=5z&t+QR
zK>PFg6PQ{wqzCILY%oOY6;~s4m=H04|0QY=Wz-|DvjLctPZJAX&`xS~`Up$<IoW;l
zh$xghVWqqK7IAnsIKith7-<iv7&lr_<@K*>;=aHCDpPCuwm2Dxi+AH=h_U|D-X1fl
zhl}+eQb)dPwiC{PvVCHJ(LEUiGsI|)?K8)-7T2bp`2g*S=3s5NNN3{$7Si*SA48Qv
z1B!B83^CBn@}3B8Jc=4*TPB$FOe;o*)#hW(rYx@G>6%zc(?n!LSbwq+vfbX+Y<q^-
zz+z#&L2SL=Rbv`FD`Y8M{@Y5E+YOcvl;{E9??I(4p<UThDJ1;aQ~1G7N3h95tFXsn
zP9FR3y*X1GuQ+-KJtBSk=`*w*?bvK$sJ45K#8gI(lm_J3)Ks;2n|w)_*oka!pZtED
zl*{w}!Es8?nwpXdfwOjb8fQ%7`pv8^s-;Yn42(zZbs$&l$lXUrHz3o#i3{yX5vzbP
zGFe(#fLE<6sH<vFY&%;e{^caPm2z1^I%i1^QhIW{);EeKYD#1?CaPg4T{lIdO0~#B
zSt&@!;$qoAE!=FGTSHEBzhRf26}L!ao>W6o2ru~J-R5Ea+68)2Sl4AX$Gu(E!sCx#
z^|IVq?G%xaY0V)6A+MM+b5k_;i;gd@ai4rXDx$hP6umAY3z~2kLBiT*vJv%AnV=!{
zsyBHxJ;|e>*C+heMBz*%EQw_1TaGX5T*FSw5O$%ymg4nCUq-8N$!MVl{p@}Z>F#E7
z9Gt%b%Gy&YoM|ER*3>jXTgJ(>MquC*O7!X0$#7G@&{v&^2Z8F>$+Y0<n?-)?#GA#-
z%Px0&rzF(KwRqKy+%blGILyd$BB3V(|Jvu*hdr9}7!`Ut$kg}<3GTU)-`<zIWClOF
zkTk@<y0eHxg>&y>O-*Z620HaDP6{SEhjWF*hg?lrG`a6)k3S)L`oIIIBX6ta%Y&9y
zCQ1Y;Y6B#y*n$zKJh1aBu>JJSciG{hw6xKc=}v0^>gwk6)hxOjdFoqeOf41*la=QL
zun)}4GC5X<+La#VZCUO$3E7o)#-)pJc|o$MbWz??bqQ)(8eN`Knd{>&6MDDk=`CtC
zem&0#MxFBH=+AK2Y<{anX4~+wC0a@7x!M5xDupry0CoT(ev6J#T)T#VU4S!JM#Y!b
zwQ*^&jPiVq9#O{ZD55mFIM8M+cLg-O@%rH8pf6v(NEIw5S*{8P7eqAPMV?rTiM%j2
zL6(+qCXsDE>>QP9%ex_Q0aq-y4Ez_V(nn(UOu?m2wp)f~?zEwcG%>v9k~V_J0noNG
zk0EfVHaB}V4+G?YT9LMvx`do(8T1*t@E3u<+x=2OIJ2MmO&_aJmO`*OWX^X6dYjIb
zIu8BLsV;d@=}X)JbuD2A2#mDmjx7a>@y8v{tf<Jy;>?HKREiOAt1M2?J`?|O#*@*H
zmS{$&r7-|{1e+KSKD{=3$06oSjjogUsh__?<ipG%?(Q?VvZL6a2I*>PqMX@wcI~5H
z2AgL=v7@Ixe`BiSLl+(^U+;In^$#KdS?FdA^$s~6)gH;7MAFMG`h@I3T4neC{(qbl
zlAz57U%je)mZ>As7!BK|`S;_Yzhj{5>3}6U3j0sr(lG;Ts4IZeqap&sSdU(>>~2HM
zG2}p?SX{LgZz-NH0&R=eLEr>$PsMjpcT{{3%Mu4O3vto7I`g)~*12WkNr)Pdpz~Pq
zA7`gJPpu^c>(a(4y)I>HcUkedtIt;K*sGu$hGH4Wct_?+NrB<Qum{uZp9VYNYIbs5
z3NnRA<!H-wAo0R=&vN=Krl72&b=6gplRaH$a;u{3xH>*e<)yIKb4jku|BfNjLR^U-
z$jKled1C$+U(+fMSeOC}m93f8Q4U=IwU>@?GhEPrxB`me%}Q%`R<*$J#rK4Z4r@pX
zw#qs-300CxFUrdldaCNuY``?nj<ZDud^#U<yj>Wc<Xl{NMiz<55lWDiE4GsPCC2EW
zPdlio$-89<or@E4C$pMhNk3bT`0oXde4h8k%J{gcJQ(22=@G%9&(2AYUpLm+Hq}go
zN|x(*kM#x)?`xwZvPQ^$`_`)6HB65V7bT1Id*^s*Uk8Q!0*@Kz9iU|izw^wJpln}D
z_y*b<ltm&Dv+h572Jg1?|6(J7N!aPFe=5SWTo;v<RC}pkg}YmIvdph+G?TG)F|PLF
zWT;<@+i5zRj!cuNLbIAGrdKnnk7rh#+?QCr#Q9dgcJP0K(PSj&m2gvZYSp-oS!EKQ
z?vYt3dcj674_LzFG^!*K>A6~W(O1=K0vwkqg)-onl@aq^p_@#D<?La5z2Bx`PNB&Q
zQ!~JRhyh5o!PdeSg5ck<i<br(X{M5V)#kNaPbN1uPo}+%<D-A?o1nPMO@+&o?9G6T
zGPGmx#RqbP)RWE^v>;AxoI3KL){3!TZ+~(MTenkJW@c+4{kDcp^JbFidb$P#W&yv9
zsesFUlr$GIgc9cpCak|o3=3<;geh{3NtP4p=?O|Ag+s8MI_2AT^pz1kr6J-uqZP+R
zIiom**7_ba-jy59nUEb8-?<WxtDc+aU+nHSmB`U050{OR?h(wKDKZnd9_e;WEPdrL
z9O2BzSnY?Y+R*{ZMT02ttmRD2e_MI0vsX9_e(~X{3*kBwX$P#%rR)}m@~#lN-Ou$^
z)mCPoOwz<xT-spLI~(HNiIE2#I(H?e^OLei!Br^pfD#5RQh`a4z~d!0jujdXvWK7K
zkLM?X)!pcB79mIM<b2SnALg~`G$oI!T+@n-3*M-?<!dbaO0p5$Cfn^z+zTgQ(wB$3
zlk!1z@dq3aa*(jDW<OPV5(hN(dvaa|f*`SPQfwNQS{tV)J=!MJ0I_OaLYfTfNKX+K
z^Stc4IXoY1;T<Qopv5PS<Q5o63%UmR$v|gb5|`U9)*g7?dT_6to#-QaR`Fe1b6u)+
zTjlLgN|kG`X6@5Oav)L8ZCyb#CIS}6dPOGSQG!fYZjU{*xchODT(ErBqhk>smYWo@
z8VlZ4Hk+UILC5dK;y;VUXU=?JfhMk+k@KF;ZEFQ^(Y_~V1HIPWn(vPdDix*okSsTZ
z>g$+?Tm2z*$#g>34ZD)YnsZKJFiV67sIGf*_o3^rn)D2xy&JHoJ+s|oB(ytVK*QuV
z-64q>{u?OlcbAKYEWv`Y6Q5ms;)1X7^UnkkS;{<nTXR_$Z4x#yhm{(5@A!6c(AK2T
z81rUJ6gnv}!?h)`l(05HM1kmvG*EuX$iJbIM7EN)Cb#EYsP;~1D|>7WilJ8iiu<wS
z__4-Rts>t_u6aFu2J%5K4oEB2mESBS=Q%zPRuaD(v`=JTUZ?@TgHA<!D;7vF7&uiB
z*bI45G5U3y6!ET`)n%$)TaFjGC5kDadLL;>LDA9F_j;lldgUGx?V>R|9S&fjtd+G6
zM4U`5wa1tftnAw5-?!ecFF-~5*i*YfW7O1WonzZom(qLlui>=bk$$)Q_DrJ7g@32U
zRNk;nbY>K{)%ep}dSLvC|Bpjctu7ns^E}f}wq3{D-i43QtW2cOL6Pv37>&}P5J`H#
z)BC0%gD0Nz0ZwqIs6RVqM8c$4kC0$UgP&0uzt|GW;=jgq(^}I7hzkx$vnJX6#X1s(
znKx0?1<N}X<Vc_tUpPC$s7NvAU&Ne9V*X?I&qSvlA0utt(V4wsq3h?fB&HvJ1_K6G
zxXLm((1F=E<JC<$kv*oOEY;2fpl;<n_BVqBOIdk&{HH1#QMYEHN*kb9<2bEcfESEi
z!|4k+?SF};J&&KnXe?69X-G3tkX87yNzgt8_GI^dM34QK+-ZDBl%pnP9B--VJm;s}
z$vfvQqC>7Nzuz97dFZ^dl&+Ua2Jo^xZ`cU2lE1LGdl@tZ*#NNwu90L1KH{kIP|?g*
zv^g9)Q8IC}5?7ll_wfSduZ<ULY)o0GfGHP>RWuvwuK@^rKG8RAe<&?``3v36^dVf-
zV+3Tt`T+wK5*?(&I=<{Ho-=}Mw!Mw|MOh|EzteAEG3%kjHRhG{H&tgfX)3iN3rp*d
zRR85rLv(6yfnbGipfXR29$H`;^M&|Vdl=!GbyfTp?QRL$eLWFDrdmozB!E+=A_4L&
zn-?0d-ZjLXN3N){{9O9KTmYPpv691T4A7@-nt!^X^AyK{CSNN$wrH{q&-@|E@xey%
z1w-?2hcJ86giv(58>n%rcfS8>RPcUWp`}h|4j#IoA?&cf%xsJ?Y*cFtl9s0bAo*;r
z&#LePDe>gIUH~^{?AL$Qo#p$px4;C-%rU<Ol&TUN{c4l51S`Ix3~uarA=4ZvYQI>T
z)^}^br#um+=w6m4=on7od*ct<;TsNPDVy&Vl>5OPQ|A@$mi(k2B%U?oe$-zYp(i;1
zSv$0(-q&R#G@UP*R(H}<DDB6VA0e4hQky5OlVQy7)zcj+9pWs#*K>b#f+n!XBRJxk
zaGeF}D7H5d+X!yFn~NbIv2QU859Zkialb%w%r70ub*k+Up4GmlL>e>4!a@_efxafe
zfiG{EBQZ|zU3+|OjH`|o3QP>#2{vDh60~aR87mLr;yDsvufT?i55nx(+PaN(3g9fM
z$fjnuyH(9RoXL8Ojvgfco>C7y<;oD*-U)3>buqQ$$wG8In)%Qj;~TueYpKY=g??XN
z8X!=7@JNX_0swabs2-{qdvQBOVli;KD+2^Ee-VC_Ergz+Nm2%Vs$bZ0Bdj4<6~d~Z
zR#O{HS2unmoOlW|_=ql#KU4G&p18p|%Ys;_)~FK3+(#%Q>8WEj0mQ$#XhIp!^$u9Q
z+qn8MD`$chVuG#XDd@E=RT^OzXzfldA){XJwuOSjuV?ji`HWjikr)o{+%vG%SXtVw
z&xgS=jJ5)H$9DHZjh!|47%AeunU0^fl?ZwPK(P(Km=3CdNRI1~9@3Gee>50kk7<@r
z+(tIp0An}U`8!XJ9zi(ixn?jlYb)=^MmyVxxmA+*z6Q7b#vAIZ-izd`iOC1IxS)*e
z{pkfOaqM|~2|cNt*YU_PI8JoP4>*5hDk^mhd2|K<bo(w`?`0q{31vDi($U#m06V-l
z0J<LElt}PSG>L%%gJQnlvocYrox&E0*;$gHrXDCGEUV>`+7uL>w`!OPfi3GQf@{$_
zq#1g8>HI=$nZ!xw5Ocpo9YjF6Zuknk$yxg2J#fJKW12cNDM3l62Tc_IyOm|AQz|fR
z!6$KV#&Q7NT7l85SqKSQ@NM|z<*`Edpqrm6vwU3RrRYG}Kwy(zzpwJWl6#w$+K;~`
zS`pQSlUDeemX$D5v`qS%IBU$?Q$7F+SXP;lO`LfXqh?2!3E8w-8xJJ)9*G);QL;5q
zEHO7|L&wk#ZhFWn=WZbf|J9v)lSvAWpwL(ciXQ6iQb{Js1iFFXvYn1HfHWdR$q)WK
z?`vaOe#)Gx1!qZOh)?Gmwxsy}ZAKw<fZ{Wc4oXZ|TezHg#5}K<qvrSq^1pDyV1mc0
zhPD|Qh$~VL<qv#`<)n@#I&wXgNH|vXyp{7o8fM2=zAGty_?bM+-I+CpleZco0T=su
zR$5b4r=!7}P{$GGF%V)gGXH({CHYgYsy}GPTt2<BVBRvdVDyQp8tr&e6C12*zAket
z$kZa?v~a?q%<Q5<nnn7@wTMyFLy&JWOP=^sp>!!&7C%#SVDfQ@@G6<BIteVFY=xUl
z9H6>2l;3x))3-9x>QG=SSivxSkzO@odSL3xL}-(^feMvfWweuQ%Qc>%JJ*!FTh^qW
zM!?)#22%qZ77<UBLmH2*x*0l;y{fV`<!YT+04^IV>`LPSdZ?L&ZdM3MJG9{``OTdr
z)vP`T9A3jkWhlp(LdLt9wPy@aU6_^B@1{T6tIr@{MaUWwi4ipSh0BGsd8;vhTxham
z-89w8{)|Wq+zraRwjVRg135B{qf0C-Iwd3;=*fYv4^b~*8*QYc{V>m#6Ua*v(K1-0
zS*{tie(9JW@m|ta2M?*7%Q=NH>V!d;_2P8&L_Fwulpd-{wU+R)L1nwdTOj2<V{J(3
z3n`%-29ie}lAP*^A##0ATxuqFtDN^I>){<$95<}MR^>0MYEibZtLcI%j@L{T+BiP;
zCj)=LeOfI$p#9ctUd*onap=cBR!oWogq1=M!8>7Dm1?-gmdlg2q$c{}YaQ@`M>g&r
zDL7ar6;bE?uF4a|%RF;xBJ&K(mdNVCvMw5_mu4W1p@EaE8kI{?_4sOm1f%q<2c8Qb
z-K|fFMPn?v6|%(L{F129Tr9NsCYwQp;p=L5d|OGDOqEur&volKDrI@GTRNJ|!X08)
z55F&sSOt7}79(dbHMc$udD%OW?fiotOZuKwm(G^Ph9GwI&OqzAJBh@r`GkH7r)y)b
zY+)3jpSRMjaKPZGHmH0rnY)T5>pKXN%(s}tg#1#}xWly8q-RQdD?J!Ut%QqQ@6_U7
z*<u6P69d4E%c4^i?-LiMOYw?r$Y;NHSHOImxg<)=;zhxfrmd-tBFH7NzvUXxxWfxK
zD;IOPJ3vV5=tq=>sFy}(kFY#mFC+)(vVyl_G@&!sAwd9z1h_bWiU)4>^Nj@5Q22hj
zAZ40wxQ`~Wi@t}pwip<l&!K6nmJNL8vZY3<LttbVpub9EAVs<~EDP{84BWz0$==aa
z(=@`Ar}0bM=+U-@42}<v15>;J4_(vQajlR703ZN5BivYnufDQY0}?9{$daNMVmJ3#
zdxF^rHpet$X;iKH?9&}B=SVFnLq<1vW)N3~mLbQH!apsyO=>(MN?(M@S?T7G4J-y4
zyPW7CK%sH#7D?`)el}tjjntO0l2K&8-#OMaK#)uNhT<&APa7Rb)hn-V8VtILXfAD9
z@PtEUPdlLL6O(KZYCMq52PEK_nc8b-&bBHzjr0ag|7%`GwkCVGYYkj54CM)Dx}3Vc
zd!dtBR%aX4hxR~;%9Tr8(OgI0mg$<Nej9OuC;@apfpIWRu7)nMnL-1~lj^u>(y*mf
zlt{L&&5*?Qdg<p5f#<wg>O22L#+IPg!Xg$dlZP6H<Ex}n19{&v^ai|Na*nv1@`R85
z>rgj;t2rFQa5p{DPbIkE6_tjl#K2~ki{6n5U-LUZ>AsZ-kn_Kji^H{%wcl5UVrnho
zkvn9bcVsz}X<|;FD@fCGyi0$$k+Bi^RI#S&EWcGFFN_DGSqfw|BY`p-2o#I6%yt~K
z06sP+pHX^h4u6QVmZ-w*FOk5SF(+nLnzjHg*MtW`i3E*9|BZc3I^LM`wN0>%3afor
z@V%`fyf>;HJXw_@a*%Xf&BZ<u$xA3V6(kN11o*<h`NoAKmO6o5E7|zM%n?S`YF2UM
z9NH(Myw#49SCSu@o=Q~6*a>QChJgNZe*w9@`#&uflD%rtrhIpPR;0bbE+>CKRPaQ0
zf+zEA%h9FWDxm4V^+C{*lTjtEbZyn@>*MpK(n-1D^@=6|%{;~b(%Q8w?q`;ol7UYC
z4dJP!uK7aG-mZ~7cERyoOzObi4X(+*!8OoF5XZlXxTqno#iHdjY?~3RX27rc|9%ar
z{ssJMplJ(4r2pQZ`rrHCyzY6e5_jOLY5~VoY1qD&=O<k~^QZIb>3`1s_PQq!J8J=>
zn-}x1lT_d#vcz7SM_y`$xWJ#cvc&kP;@zacnHt<u-k%H}(>C6m{5G!U9rEbGPRL<_
zO)dh(-%!upu+Wr99Rme<0Gw4|m3%nR)A^+?rd;Bf;G%4RY)O--2{4dEyje?qwbuXU
z><!+!wJLhHGIjR*ytZ(fQH(TDKK<W0$747i$O8*u4vS>Fy=|nh$ds*~h@EzWXg*w#
zc~UZv0R$i{fu-9WrOykg*F#o(tQ9T3S6_uY?E4<mQumd43{_3XRVQ=1LApZdAPEq?
z91y>z=Jan~gDBUU)U`!FPXWOAM*<)6++tc<nWRvAZxnxiql!<wekVy&Fn_DG|C+6s
zm=+Z6KoV~JKLyNd!pSj~)+|FdNq-IR-t*Y2D(LWGljQxaH+2OWuR<>An;T-b+}Pew
zfNuQHBz%zNECwekSyDjSd6fa(N=-|m|3T{2g@c)rNPRxgu~s~CL<bt%ln5Fp{kH^t
ztZt__sZ`<;r`ki*kzxQHR+`?e@U&4d>%n~Mr>D)cB+at};$?u1e7^NpXx5j55;1(p
z^VzEs8fiJ8e7*|Hszvj_d8G0U35zDk5Jkx6R6KAl!auwC^xl|{_t6RNCl`3AOtTc<
z$adpKkBu)%_}Ot9tdhKiekfNVkRgp4)IkZbDFG?q(yQ+Ngs7>?hXeZN3;h{X0mbma
zl*YGZQMIBI+tWBx(``#(-pX3<!+<jBtX4_iG?(u@pyPik;o(zOf!%<7o|ps&-a}~1
zDtDBB^l+wIUnU>#Ee^LHK0GjZz;-7e-*q7ocPh&R<nnI*GZ{@8D;|;Z7#;Jz`zfJ2
zcD%$o8|Nn<2kN-8O^Of(A~OEX)hTko;c<H~zJsg}H9k7OjAB|Q*G~ay!FpkvJiH!M
zYB(=Kj|}t{*gk>9Ccmo%RiH;}tweOMEOlGNxi|cNY^Mv?))N^)S*m5cU%1iM*cyAs
zdY9Fl>So&D-fr~Y);=2`jnw&w|G)OBZz`=0PQQ|ScRL?Ac6I+y-VTqd<ft@&JrSzN
zlD*h;7UmVJhGLD$K%xJecM69jw=8KZ2s=&fndk$m^n$`W{P>7E-9X+7_(R-iHEzS^
zh<*rEviEOV&aoeW{jgCuAZ%s-`xYX;uJ49eA*E-wti=NEaTN0J@TSWUBUp*Lx&L>4
zRZL(a3m%c?QSjKdPr)<$r>5=iTI}&N57{j4bfWO`e`bDc`_;frwv}a4Fu!ucpGI?W
zvGC)079MzPcf`MDo_-KZLl3iNV$P1$2y7xYER&6$kE&;cDh#(=XInMcE1?}$m-{T{
z3+1XR2-v@t5&!(sapW5wc&(e_*j^No0$94^V|9jKkZ<qye`ETK3fZ;nlNIA?4VHm`
zbNhR9N`Xt#EudF@|LzUQdBzLJXqc69JTM%qZYWeLlHr)#9GtXjP|!yPARf17<HrLS
zKm`E#70`9HQ(_wO7N+rZr&X5mUw3U#@T{!2{c8bFgt8a_p=Do{zm6?@bTybjoF>Ya
z8k~iNZ&ieB?|T;xa91v%DLvBV->lBIK4y<=DZqn3_C)`hMW7|Cpw*ANAHoF%r;;E{
z1V6$iX_+;R=WR#%H!g^?*IMWFS7yXbz70Q;XG?VNms_vW15exk=bFN4_kY%CQ{G#D
z+hp`8@t0>yfztDJ|Kc<D2c1Ws9|{_IARROb&w`%|zYRQE`raP=bZ#GK6Zj)jki72s
z#AK>9C2-h;(m%1+60zs`dOF-<V2>Z?5l?8YlUX{3T@!Hj|G!)S2fG8>uET5ktEH8~
z=_#OfW&NyBnhFrS4*I8su9kSgGSq<|b)5xdmX}=qxsTYsvBIw%p_PSww5rdp8Xk7g
zreV9BOHS^i@u>p+*T6&GjXX4<C7pj4f6usiNlS-%a`|26@yf#7pWWKu?+&FO6aeQ1
z{<$ce!wCe-q&K{CJsEcNYyk;<hEU>}hU0?%(5Wn7Wt56`@5p}0YYR~ddIS`1L7)Cb
zQr$IC2fzDnDu>PG17gi%j&{M+bPuuo#`oLi;T*EY<4HJpWo0AxKxo&v{>RH~GvQ}z
zV&$sJnTkPz{U8wMzex`_V_U71?3KfMvrI-akxPV})vE%hteFEzeepgmoO$Pw?!$dc
z9gceskG#3aKq>!xvklq>m~NkUzn1TPeT`(c8d5ooe+bw8vDk6=W6o)ApNS{^BrOX+
z*uT}=TW6$64eH+dw+5(@3+RiX;?R88`G|Clg;6mPmBXuhEX<)^;thg%WnKwo`suGx
z{Uw6p;=;Redb0jMSLCkNi$4ftr!+W@?qLv_l{nsr)*Z*^V#J_-nq{E<8%9&bU!I)L
zrzK(xiw?7@w(II9l4JuNm8F9H0#(vhb+fCWe*2p-Z5MOT>YtC=HGbV+zqi}5)ge;I
zGQ=Y##m)rvRL-BZ(KS;l=lB|Etk-M~3HF1&KDq~Z^6ndd``zutb+z0iakYv#3yI?}
z`~EpB(&ydztDLT#jfXDDr8|n1xTZCz6NC49*@49`fr_T*HF`)109-2$u%SU9mBTd&
zrL)3^Dt#U6dw<S!d%};C<-QWmg)=195BmeUQYD0$L?kX7tD^yM%|{~m5MQR6AR7g#
zjc!(Ki({GPtB{Z;`@6s)vO8%&kBt8HNTTcat~*dm{wa13YuhABpBjZT{53$9RuLW%
zc(+Gw>HC=wJpGloy?duYHsMl>l3iEqxutkc*uHK`*t!27yz1_svx{F3zq}1TI!9tR
z66*2@-=-EK%W6YRoI}oHDg@oDM~ISKw|X#Iv48IV(Iqb@a2^lZ*Gp$9KT`Z}h34-X
zfc`b>C8{mUE2q8C^oJ=aw10-;zWh1N`825bZF|?wr_<-d%Zv4}jfc;d@25Qf_U=pn
z(-*=Bsx5EDdtJGH-XCeZqyYK>JcblE^;nbrjh}nXv%VW|s-?3+pX_;GJa{rX;_fO{
zN2U+h5C6ZnW-U_iwVny+x>ODOBj@vZ>h)Tvg-`p|qSJZ%o2vt-AJw}zm7hnSP+pq)
z*BSzhjj-IT@p*GSJ0?Y@r0e}5X+D*@*|bjrwDmr=i}_UIin;Xfw*4qgvR5y)<KtvQ
z$7!26gFwmucCs$ti$U<$`M3A&K3G7W>?AgB^oU|c$8JOW)=#?|%QP1H&oayEj6%V5
zo=uTl6O17#kTJ@s4Rd6c^hTUC0LW&X%*3N!IkCc(ecsCD0~r79ap%`L_w9&5Eo5UB
zz`#A?HewT{JUi>pn_P^y!rm!c{;#!A0u0Y#2CrRsn@`!H?`HHA=6sQScW{g~yE|o~
zs+-k<Urwf__B^qGRC_Ic3JLV)WAFY?2jnaJ*D>#l;t`qnO`VUElR>XgI|e^vB6Aiw
zSTY-LXSch(TC=pCS@G39Dx!N5;HTG|ftN4bvh3r$@#85G6R6~`Kq+WR9f(4+(nZZg
z$)H=6BR(?#_8SU_)*PfvJyy<;_^)x9+h`#KDVu{)4UDd|@!hWQ*RX{P-+{eGRp<z>
z9+GO$1rTM7fVzAB&DNdM8f{0OW{L&u>xb_$ZK+W)u5SzsRDWhfrR=E&O`Y8NW#85u
z5O&MA*45gwgM&b#POq(Q=jA^6D8Zbt2CZ|Aw(;y^4tVMFnrCSKB7QZL&eO_#!RRAL
z7@GzVz;HxjL};S%9}w@O81CP(8q9txhZ&Oul-%pthvb*v-^HU2%_B`SXQLq6xF;9q
zdlFp-bl=}y;6GjszxjfCD|gH3yrC{2Ob{Uo)<^kcr}TN@m0fWyv*vI<&Jw|4z(E46
zA|Wgmsg1=QTR{dEKM?0Le-xbH?j;J}nT~fOb6~xFdu!~!&LFiWo&N7(S0{gdhdFip
zdEEB-JU-<j%!=-`e(dVV>9SAN>D9(fw6e7lRW?a;*`$v{V`)>5;LMs|AqNJonr;Pb
zxvVB{O$VDM{HxhxTgrHlj9dTn02#IhNFq3ULL3AX4uFMDh*E68-B|2Q(m3+Zo!X0S
z@L1|BsQZjv3!3p?rrrC>$h%Fp`$1RVzPZ2Kw^}@1eDZvM@m^Pj-|iM3prtxwju4y$
z$n~S(PvW3Zf9chP31EE-XN@%fl;#-HXVy{{+ldj88~?d5G7x$?f8F{{1*zN2|D)-v
z1EOlazn4~03_7HwbCE7Vx};gUc4?4q38lNc8y1jO8j)IdNkJE+lm_XRc(2dz{r-D*
zZ_S)LbLPw^OeW?pQIB65JS|FsZ4v+(!<ScnzI<V5U<3#R{48{huxp=%=0*2R)Yzjs
zq%-p@L7-b}))cpnk6HL-<<<nV^X_mH?`p5FUlHr@`ic9(#Qo1MwoqNpd~1C+Z^<lv
zCg&!oE+Iblh7LsDah+3}Zfw&i@Qj;<IvI}G6#Si?p9Fg$_<JJ#iGpeDEZzPOS&k?2
zme0vz6r9SXK;kLePK^1+-GLu4JTbx`?R#e3>3*vAZFv-e^%mnVDkxPPK$FJnf5@nf
zIMNMSQfuTWt)~t%53atF(4&18XBXOBjLiK&4bhT7T(<NFyqm;bWGh(oytN`ovMBOQ
zfbfP<3O^#6;!YlA5%9~EV_V=#)?((I|Eu~@Hb+8SQyAagV2u}ULM@cp(z93lJv&t)
zdLO|_rh^{bmL1T2p=u>a6Q{u6Kq$618SUX&h_q>U&awdI18dW|-$!wBN?0NFP3DZ8
z?EtVjLVyf^wi9{K;Xtrx=nN1Z+h*p8Prcc!v-|C`Tt3V4XOC98zr+(h=SoQrUYxS*
zm>QCAvtkk-@X0xXPx6%=31?>`&dD>rD??Y`Jf|Z5Ap5B+bZ(X-HvhB8urO{3DefeW
z??%|T3~*B(d&v~a)Sj?pCBU4;k<gexjl8q1uZ2swgv}vGYmJ>Opkuy?g@$m_SuGLj
z{?t3olc&KUc3HWX5mL_N<mtv~vqT{t#HH2i_MkQ&f&D7(!<vN>F&<QRq)0st;R|u%
zBcqFA2zjLmpo%v2A_S4jSRrIB^rM&<*6+0R)3R!CGwaU@OpPsavK`enPhfnzeuMC*
z>3F|^BKr_-DIm{-D0@<E!;{)5n-i2DZ(|c7zop;fb7Hssb{LVQpMiL-^#ErrgbNU^
z+U{5a<-5ZiTo%^*_x8S74H9}Fi&Oy=SEsL1X@H6yKy$Issbr*NjVh_HIo2LjWA|=M
z4wAuN%O<@^>%j%90<}7*jv6~*M0x*VNQncEyq<1;jJ>>`&JG!gINc~!6R=>3XrV7m
z5$bj(PiKZImoY0)6BZFvsR%tHV4V>?$!Lv%&4~;}L-n*NbHe_KBEL#}BUDQ5`Ze(b
zE~wR0D1}>~G8@tl|1oRPCWwOnIIze-mBpyMVmA{i))0Ch|JhzbC1+evy)?y0Yv!rC
zj$VEWwchM;7|gTpK=GV3>$!3m{|is6>@F7;=*N<eO#G5Qx3z%0ttQ+|$eqnO4hHAS
z(UZ@PC!gWFCY}FaF~|K>`sXxFZ>BHPJ2M$;ieC>vEIBUihGEAP<xL#PNT5Egk!-*1
z;p4S!JLPcqqjFS3m$8&Dqnsm~=oA%`S(3xR;20f3_svszmc4kpqrO_~wwTIz2zMr%
zpH5p?mUaf!?))h39@+X8TOm7kU%ubhSU~8t)~|&UW&*2Oh!rOw66yngt7r7z-XZbF
zC7j6@*x<;HB=%l0(cYF#S$zlJ!x+0OuCQmxI}MBVaSrKt7oZ3cOpxMWV-jLM+9uhq
z>yF<@<VzFU_wCUrICpG<n^`de*RWF3>+lfy6LZ<DyX5=(oER7#CucG`job@i?dQf1
zjaD#vjES5xk4YZSlDU8-rppH|?CCd@+Dd*Rrbmrr#K63U_zSW-PI=PC{ux;;S~Xh@
zfuDu*aJuMKz{zyqr5F{S_i4W<@r8xAn^nA&`bvr;2%_IXR1E?W3JmF^6SnTwH44Md
zbe~(UPsn?Y>n`q(CmJ>WnqLHlx+<lJh&;~D(Ug}3jGgA7v~f1vE1w;YdOU;Cg`j=Q
zc-YzzoDAP-4kOC~_Yc7C%FtynzOG1*g%i#tgXUhH-Wo1z+Z$P{&bHN8ynH$d3M^j$
zFs__tCQ2Llv5VwhU@$yx^n2Zd`?WB)XJ?s(S6>k8*3to+oDk}#dfa5`B_)%$cUTia
z=dtFC_cL-grmpY)oP~x6rmD?A^QXGrJr{aJ)X1~t%8Yf$QH%2cjK}!`982z1zFq72
z$a*&6IS3^SJXG};#FI+$U?Oqu_vqnXk9V%+t)|vPt>Z6$n`W0;KAU_r0g|X*NRG?P
zRp%<>4X{@ulBWRI7cTV#CE<aOSEX-jd4qpTd%G;iR>!C46;~amd2RhT@~Sm>hCgIH
z$SB`n^-3!P(~v)P6xt-pfw>J^h^txdn_bZF-9L8(Y<=kqva{(C3i|OxP2)gWV2h*H
zZYV=P%`C|8T7~PMPkXTmE-gb`!@_u9ftq{&U4QWTA6_v13PYXhpx{?9h<E!HGt(yQ
zF+sKydi)UiZL7HQ@;sA-^?tvaXZ&05-OkxT;4X@3pb_CiG{pF%ly(FbWdoAbndk3C
z7C*7|Q~onVOPxK@wVIJQFD)X*_qC5s7g@xO2g7u#&YC+)irAqH5k7s9!f(B9*D8>n
z{PRcC+B_$&27Tq9b|+d2{OI7nsh?jL5Ad?aCk~k(rTp<(>ZzT>i1zg6q9ejFzDMPv
z%ADGa;m5Nm?^vJ&s8v}w+(z`o%Zgft02sEcIpmBKBg7dCFg_XN(jHQ`8FN{;;lX)6
zyLi0wm5>nTCOhGUu$u&ze!O4%8LC4-PUfz#5cB5nbnx3Zrxf}w``e~7$6>iwqgz`%
z_$h2u7fsA#(|b-kq4ZMLLG#PL6V4d(oDWL}8q>$9dpVq%KL=8#jeznVRuhU50EPfo
z>}5D?#a<i*M?^qdZtg;&;WxXu>%Po+2>pW+eF~b2+_Q}YPIN-b#ocu9Exh$MdHJ1W
zt@B0wS@5~R{djxt$*rx_jk)>QUbOs|Rf~|9SU`=d53q$R>SW73@*SGzDT1K6^hREs
zP~w8dXBw1X*%Z`b;sXxA-v9pJxp$6#;~PHL-}NuF!ROojW{a&A3_$N(@mPlRP-=W~
z%vhj9YHaXU_%tS!BX9AMZ$xrDNMq(gX($@g7%bJ2M6AIoAYZ;+Nu>gH^+%l%k(2`3
z`hclsdp5#GnTkG!Xo2qd15mMA(FC@)bn>ZwMMc|!##fUB-X;J{!ABtF*ROPy^c~p9
zij4(QHP?@!btkn=U$XLbhqQ!B#f)!%<CU)ZGQYk+(!B;sg3<s0`EG0Ek)oL-K$6@d
z$5Uw1#+rJxm_af;^I2BNTn%;-Q!^*_;~jJDJ%cWNY^2=O+vjA&DkY0Utaj}WKp@~D
zH2;uK`fl%yoZ2JBu(ryD7Pz%Jb{&{G<+r08^gWIF1&XSS<_txRP|tuR$6BmIoqUP&
zV|jiy)&39~;t>o;%w)#5uLIMt=s1H>fK}}asF;diYTChPchKp-9r@v;MR@aE$vA5k
z&9sN&vDz~-%(@+l-@O0<sEN1$Q{gtx_xjU6%=jwnDeF$+_peHr@lXBO4yGjk*l_n(
z$%BA>E(=@@OK9_4MpZ=zT82%f9E=MxT{+Z><u0|6m#+t<8a4nmCy<ODpjgSZ@e@2Z
zKcavS>ojnc-zF?-?xGs?CjmkLv?IfZ#oA=_zU9%xBq?^0&ZAK=oPWoufSrj=2hoD!
zY$=&s;2=w`^0RbIphyW41PXi_-!&wx+43<2qc{0qHwkG)tMS*`z*)9JNI)xq=+Fvr
z*UJY@lrk4BXpG+8KV<n>rDOn|_$BZQRbBe{WF2XdRGiV?(|?_1hZjcqNsXW!yi`XT
z`vxoR74z=@9S4e`pEMoI!CbOL7XLfA^%NWYww6rAHp?A1L}`v47$QKEfYR2ART_%N
zrrdEThO;CGMe<4rYgv|gH_hn<P$mTa;RgJ}g<RklR`wg60jgwFpX;PcBhwp3fDcv=
zyeF@nw;@v#<t2uSO@0^<g&;}5m5HujJnUzqkgEsqQ}zI@n49-=DhQC$z5>dY|JOwR
zxc!6@>!CC1gpRL;Jm6sR&6I7LMO^FEP{R+Q&Qbrn7LZk%&3yZ)VAFi3QqipE@f}?)
zimMJh-hZ#TMSu-Hd~O3aC~Bf0u~-m-bHv-G&B2}1#`a`@Hvr;pgC*kMGjRjvEv~Xc
z9?7r845<3H)O+|F37;UTR{RK);p)yABfjZ?Jrk$}pbtpIHn@8a&v)g&XU{FiN83mZ
z6d3?d)vPmwJBw1u4K(~su^oa)ED@s?3*!TlnMZL(*dWlR-O+_u2q#5tUOq8e;u3Mx
ziUo**niX@P`?OD+B6#QMhcCZ^dEYpRd;a1&;jc;L9*gBJ6W~ZDB1}j~sC&&}4P#bi
zhNVWM$+RiM8>^EPgn@z~XzMxfej+wtR^x6#!y}}2I(%G2p(gz(KD0`cwE);0X@?E-
z94i4(shH4M!heyM2UOns|N06wi&nVJ_EF#pp2z7u0q6dvrloQOP)B0nAF1SMy6e`@
z>9Umc@v+DOBGxFtx-$Q0E?gQzIg6q=jd_`q{9jICR2|1*-{UYF#Q{+)QUMxq9N=$V
zhTnEjLcuk;#md&M|K(~y^-i{Eks;Oh6xNpao_8|oaHjdakVNlTVxO(A=ukUs&MB-A
zfV&zBB#;6AMr|{4^hBot5j>TE66LG7`ua<uKV0hOx(dw*XzlHkOz*l<1W=s@BqXu?
zM~7%|@~x5P;hvyF4xlB-|L*28<em`@^6larh~e-{6I#7ycBE&_zBtSgodY=4|4b~G
z?KyHS-I|xGQa^2(3h)0IF@Dc?Ap76nSRwJj9K)PuHRVjr7$K}hS9q7njpv?2bEAp4
z*Tk!<x^wOUBr!IIX>oF{BqY>a+a$Uj%Q^mHtBIuJpcOpeJJ2D?BSs@(wYWnRGCpt8
z;jIa=Q8qM;*_-LyHI|!lTOZ|E$BjmbKz)FMO<(Vx@T8*9`-I=&O|Qy7vs%_Zlsf5l
zdht@+qo-9VBdK*XDn@C83~Tnk)}|A4OVIv_W(VpXZz%x*N%Lm341Fr9sJZIRoGi24
zlfb$2*8)<RaiO(_u?|^86huJQ_ir0#KOE?koZIk9Ey4E*cExWZ%1b^c#2LNj@F)#6
z{K}CtOOLYi!ne!{zy<vSUc4J77k2ao;zIUsPQF%z(vT%1rJ*Cm@l;&v5I;~@Y;nK_
zeeZvx0O}+<<u4*NnsX8kBs5u@#Gn^36Err`@YjN<!#y7{0afHrq`;nhXcHPy)y7ye
zD;*aD14e#0tkx#V1_(tC!q-e`h|8=YXKMY%7(GG0C{oZ*fI4F_H3JS6FCn4|J;aFL
zOaUbEaHUF-cSnZYIoW^6VpTAb2@!7q9pU%0kROlUQ(*LU1Em)-fSwI#ZqiPD`5|8@
z++X=P+e&}bQ1!6@Rlwz9ytvSd83+ll!h!Q{WIOj-#iqv$Vc#%t8c(BW(Gl=1{vD@*
zfnEwO5C!)w|B>W#AT=t=g**3mC4Rt+so|Sf7k(wYJQ!!7h%`_-9hA=gELW6Rd>==>
z%o&AA%P81BFWzDyA|dsZ4p4a<nfE{;jO|&S^Rj~LJ*7jIfxQxwjnJ85A19QML|hX(
zd3%O%#T`Y42$TZ0!jO@I@l7f9j;EDJh05S%q4S)B=}g(o&#0}Sjb(vgydYd~gjeeG
zC<T+>{pvOwg=%FhFR~6wO-n`+AIZNX{8Os#(axrVIc;hRyqXT-0$*4DFdt_+={)*x
z2cTz#9Np$x%w0fx{mzW32ly33!V+|=)SyLR)O<5OUNZv>LW_WNlFCaxwiCZplGg$U
zQ@(TB@d3Xz^y0gqJ@#FS!X8<l`{!qFC*_toXUEBUHPc^C5W2r$>QYXz8xsA^?Jp;A
zFDU%M>_(7Sfj`crJb<m{j4NI1alqCjAxmS-ExPGX_r^K*LL7^S%VI>hM^P-$?g-P7
zD9?cq!1qU|j{MeyO^(@veG%?ZJrq2Y-{}0B_jiJ#K*jF^Xms)pa=2Qn28@|=M87VC
za8&pJev)ewAvOyC;+LdHU)wU7s;l7VbWmK8>w82}{MQSHLG+LaP-h`5!Z#Ca1`I)p
zNOK&zw>D)d8M8U7@+zwENz7mKtC-dd70qn9l}BdJ?uoLD2n>RiGnkpaOi?S?rTP*j
zd?rgDMBqc`?f{292ffjp8)is{mTV~%m4c|OEwIg`Yug+kg)4Y%qBB4qWXv`O)3$5h
z5{w<>O~=e49e4`mPvn>QL0mFpPH3&N9!m*>stcv$u*D8ZYC7+Ks`~v$vIf>%?@;$f
zA1|n_8(6B+0$bv5@=^O&hVJtddnD$kw#9@j0+B1}yz=Zhv%E1DL-#`x9B;WjZtRK;
zyPQ}hDV5#(Mr>2E=aJ4|@*<nivMxD37>(Y?RdeO_akQFHGRG(;7GPmu_XMENse5;9
zmfCG-s(YEAS{4HnTH;n%zCacPQ-^S{q=w=B73OU&|NTyE`FqLN{WSROcyVR0p_gCs
zV%o9%u5aY>X=m)f>4QuPQKq6~F^V<PudCrHh^nEWHpJ<xUDf9Wuf~8b-Dw0Dk;;R6
z8>IuMBF7Y%QqFS5V>Vhpxw(FAEQz4NWr@2Am9I0@HhF^mO30n6yaiPJm(GV0BHdM&
z`I~~eLI7dy_2tL9B4Wdmq3!9k-ETlUCKh{_ppL$weNwcd{MA3G&e;#jNu_6C1Z*?K
zl#&TU!&*B1${B6<x@n1zr#YTR{|#BGVKRoG+;=arU}Ra_4=lN~uOT#LDn@*dR$5=q
zsk3g95JhG}-cwXd3E8-uw9KK&o}cMt-zw?<vG!8}b2tIDY^e))v6pJR+~g~4F5s3#
zz%51iMG`DF{LUkJuj}4KD9!1qW=<*KmP+f&TY_lItBuT1>nB{!J<2$O{#v6|l{f$a
zq?2DY{>zV-oUZHCo)f7QI6@p1=tAougNlt>-S1)*8XN#exI}GGthgn```r**(Ja-z
zVT_NDjp}Y0e{<pk*_?kM7eSbZ43Hj0q7R}EYAK=4ZN^Adp!+!V^zd<*;-(}WtR}5<
zD%MZZX51yJluML&g|t)vjSOA2Ct}~K3l*CLycp;HiChX~c@b(t;VxrIkq$skk>+gn
z#Coyu={cF4(YDNRgl{#`ZrK$j5GmH)8F>{YkeZ}H8?fe=!$E-!kq%6;6`u?Una-BO
zr#D<%S**AT#SS?R8!c&9yi$({wJEtD6Dv#R<>}}2ZxwJjdFfYgI1pLwSro$=u4O%c
zzZCrY@c&;ugnJ9~m$6X5ufJssQVQJO0P{a~o#0BAp<&n8rVl4Bwe8J_O<WpTQoNW^
zNWo>;E3G{%^Sk0PYeNV}tr5>|07vJkJgQ;ji4g&gpy%qvGhik(-g}Cg6kE3D3v7JK
z2&tsNdV1m~&%NO;`hov#YYCb-%~eMNAgu^2;>qPx?b|`B7KuM3x^kT)S!<)A%YE7y
zb!gwA$*^T%AcFT~r;rB!KE6N>IcCQ~elo7Y${j<1&8nM@;j1zAwS8dqa5}FAwEN-e
zry$P98ufGMjIrwi1Q++$=I)J;NI<Fjy=8m>u$N*%9s|3x1gHDGyJTd9<i_C74jm7M
zB@a`CxUQ*<GN&@L(<Dr$+K8wXSJeqn;qcYu9+@SSb5M&)t*z+78hhyf9_=l4r&7#q
z`2i8AE;EHB*{c*Fx%jHc?5Nn2G`6{Q&lO|6;!#smF%xSVRx)KMlOebIcC2}-%H@3E
z$pz$=LX@Kvi1d6e$SqvuGt#m;&XFP4(y(;%UsUyP_|LHAe9lDaZmh1xI(zqBcy!7)
z5BM_Vj(L_<TJ=<gV@f*s;Z0&?$DxCy8-Y&7;C_rB{-+^nDD{Uw)BAXXpo2q%F?(|(
z)w;lj1+c@Oj+(5Q8aON?nasli$15Ur0M$|gAcOVRM)$2$U1(FLk35b>qq9%`rL+kE
zo?<j=XF@k)VpFI3>mb4A#s&<W{SS+@o&9t0H9+~sI?R&|EpR5QsNg}OP-`Bds3B>}
zng~Fer>THm&p3onk=P3UdKu7zRL8E1B(|K=osb<QEV5_I@k_~XyDXsTiPDO#(@L`v
zN*&#3GOGMeV?4qo)xGvc5KD6`*N*9F!q<{1i;reu{=oPa_=qW7Q0nc`+D-A<zycr?
zZwylhb5aj)-RKStG99-X<0h(C0FE%f3jv7?_FPMuQa~&SLlBT#<1970<$0cEzrphl
zNglz=n9>?zMG@X;B4qut$dR%knwy@GF(`Cm-2>9`u!Q2FB2)6)x&)Op6v8Oz@K5;R
zuf3)w?UVsLe*O8b7clU@OB*l%ie*a7A~fFU=FvbN=}hPK<MDDTZ;V${NN%=7A~Kxb
za)H-PWKZ$0)Lx{HK_RSfn13@pBX2?+kMYVqK@Y~D-#qOt?N{_vAG6W+B*4a8eVe9R
zAF1CedKcKLH*Ufo)%ZAQV)%u#sp!v6pW^}7u9VRB73Jm7vrp&$s|C2#Q&9d85$pSD
zYjKaZzqbL4*PUnydPwD}Dh03uIE|O8w*D{j$6?Je(=O5QG(DEz4^jRzRKp?^{k(RE
z>>lzh;kq28(Qh!gRYXx6c!01+oTBmG?GN*#D7EBi7;lo!4CPal1nvMUO{9t@GT+2t
z-En3nz9ZzYgc7R~U`I*J?7VNkP<jC~R)Ri+<l<8b1C~X4dMVN2vE<{dsnO#V0^|7B
zq5<ksY|Z%vqf<oculh&;l`flUFjz++@ewsA25{3drzbvtRH=vXzn$Y+mJmc;tl)?a
z7njTsG%Ifiy`x5qyb<&e{acO1+Er{fVJW2;s<lDdZmnN?zDOVQhJCZ*mLt6?xyno#
z;h3u$6#Gq4=Yw&He?a;;>HU<i;N$bbF#xuw4Jlu>Y1Wy6{Cl5%WOTyBXWp!<R6x^^
zFmHIn3QDI01@J+=8qAz!;O)Tr&g3{?6}9Ml6`KfygA*E0P3_1qrF3=i2~NUW@?roa
zdaXnVV@&IxAv6@~q#;yVf?jN2Q5g^i#wR1iXU!4AML1D2Ka`>F&ncq6n&ty&n;bo^
zr`p{yHe|JS`e@9ur{w~k*ccW=0?$+!8)X^_zFHqCtu@KWt~2$lcEIBF2ASL?7}4xG
z{D+Uac5o*%Dl4f?m@OOa6&te=xQiy7j($9p=B)FsPe!x+s@p&ENrS}~f9no$7=^5*
z4;D{Bx5reVTMsa0bWfJ|PEXTjS<V3OgMHpiH=*F9X>Ep2v<1H~=G_@Mr@Tz_u_lF=
zMS+oP!w9VwgAau(OPR460ou;hx-*G}cv^E!?gmOi3PKs>4b!jU*fKE;pO%YAOOq4A
zeqm+$Ljp=ohR}QF?tr$DJ**(K(l?|HczI)Asecg&xE(R;D62bmWjGo@AhDXF1i2UG
zc;7fmF+gB)ioE<$dg)#fnLhBk!1$7#LPuZU51PcjW(k?jk3U*Y(8|z#Q#jm^i}^`2
zT=`uBP|;CldE!m=_Cmq_SB=x&E2toBT)`UjW+2;-DN8HPa>**V+x`$&VhXE;Kpq@<
z;?1GjBAAI}NZ!jyZzql%E|j{T40OpkQxVHodGQ1(3E(F`j&?g{wqo5%cVVNXL1KO5
zRx^ax{R7opxyq>VJXenNv-a*`U~;wx)Zus43lNtI+jsj@f?h5zL#6<Lhf1u_kY<lO
z(Z9|L26ia9kF;I!5(y#x2oV$q_8TYV%+#UWEnf}-(&KDD5)CYDdt2Ro24qcpDsA0A
zn=pztR09%kuA;U$U|xOXo*EcyLIxNg!Q;Y4GlcTZbSDlRrLqv6x<lG&?BFWq2rVH_
zRVa`gHM*!&rktEK16T*Tjq-PK<$GnQR0`DAGhiCZck3In1IjD~5AEsHpn;(Rf9uE>
zn|LUnO&SVwb0JxElmS8kln8ptO$a?DB!psbQM7>E9;iUaj^pvOT#RKqs$DLL_dbm{
zTIq7up4Hb+qHn%9@oc8;1K30&i7Y?3mel1F4j72`L@)+MY{8nYRfm+XhNER6vfg&-
zahQg)zYH&cybi^Xj&T`gFw7tJZ*ApC=!&6zPr;GHzg5v+^5!1o6K~<<pg>9Asnja4
zp__(!=liRtY2#8?VOK#YH#c{b900jU5dWs=SLI71ElS<v5<(R@R_QA|YZk-%#FqZD
z(@F3dB9CS?3!UW_B)>qC;Nw_^91^p!wB#wA0Mt|RbdRRJo7nOu9_aE6h$tN5VuM38
znr4Ix|Ea8bz0cInUa(Em(*wM4T=cJDc*Y@RGowyqk_b>&$nZxGNdM3Jb3*zggM?KF
zG6~E|0h!2rMS`Sv04}0H85#}iSQYQxE?M6`AvuySXHUt`3r--hGm-9!cYtmbi~}gC
zHIGqde?H7l)a(5C*3}AfGm-~4YIiqWG51mcYI)KUDA|9H<Mbk4;g(54iB+wp07J!A
zjPBgGLwTvvxX<`du!>bVWnA0#T>oIjlTmCekWYyOEKUP?Et%+64G+`Z5dPQMkv&)4
zHmvDH#0dh!%|J@eZB1TVV?@d6h&L@zlg=LV1=Q#KhOySu>GAi6J@4z|{yRf*hA*9R
z_!C1q+BNFnhs$M9WsQSa{Hr+7z6TEzje3+4w0wM`NPk1|-yLi#UEfJiSWeQ3S3C6`
zRmbt_z-+a%PdZmG3|^!HR6C(G1fO@KTC>iWhPth$dTH0jKLD%g)JHoZ{vVCXFYlgC
zJCzGW@-jOIXA3+<P$6J$rkE=NicgfF>qd^3ZU;-Fk;Evzw*V|Yq~6Yu-`a2nPLzho
zSf`fwlC1Resv5a*DE}0JFlj!XYkFCIa@AGw8U74EWJ0TsaDaTQWhTPypqLU+MUp!q
z32}KvkhI^JipcvJ(P+r^h8ZA{OmzoIiCO)(>^C1#Hztzxod{YQnQ~xB;avmhsdx%}
z`VPIKcV^(M#SZ7VP;nq<@ErTEv~gBoIVIft@_oFSrPn)-X7m$jfYLk!0B|Xm#xwMb
z=!kin{dZ4pC32q;$OHA8P{7$kM>T^X_cIlcqPHKCJ!i}D(jSPRC)R|j6PbUFYtoj8
zNN?nT)zkoh#fKc3{A^R`@UmpoPXZ4lsAEK9IS{w)iaGsgKUN7!lRo0m9s7M!L|qYZ
z>Wc)#@ZRundN~O!9)*|jFC)u=dFH<}Y`}kSk`R+YjmSWknxVVxvALQdEZh}b1rE8-
zPRbm$5?+GI2=8?-78|heKQ*ZO2>E6`ED9$J)!PVqAmZY6Bb1>~wxHX?uR-O5jWw?^
zGW`M3yXw8_(INH3y!T-`7i9hwvgpRq{c)&_kOwW$OZ!ba{Bl$9;{K9H(>tbqBx1e{
z_Ttrqv5MankKkOnM3KYhZL8|~Gl5zu6d;iwS04~MXhh>9kB3rcu`x#Z@wTS_6bPLn
zS}RQfgZH9cDj4`FYNr|88Yim9$nOYF2UrT+U83)1M`3^=#);F5F$`P~u{Y0ZQ*_bO
zA^6_6YF~w9I9_;@03f#n)SL-Cp{D>^;H}7B&i6tN)aJ1VL^$5rj_i7){XIT(Ki^29
z8op`;5Eu;U<(nM!m*x*Yz7a_qg91pMl$TNbbZ&}n3lv`sr;^^EPdcwxxed<hE+&#h
z@2N+_IS{aaQWt~(A`yA^zii9-U$#YJ3qD1;D&FdiB_SkSrG$g5?nG-1?q)XWOC)t!
zeiP(Ob@~z{z2QTG`l^4vY>mraZ^}6kz@lE%8HrO|^Zgc;)1u`K<e-3rQ-DY3{p^>3
zi-MlN8LfnQL_nL6zY%m)AE*Z0KHl|}lCw0Xo=gA|WdRyZa!)77kiyYyG094Txr4pW
zLBm(k1UlLIZ1TetkthKJK+YftsOXRh|I@zyE-sa6!?Sr+90yD$8G?C6LMtN?^n+Fm
z*>*RvRMl{HiD<ojt{^a#JP>1y7wKcL&e`b3-gCMfh%_BUIN_c3c(}y|4&4asT}TN;
zXHSir06Pq62?!vyTyNou(SKQe0L#G;iJ=~YB0H<>06mQdu<>wUkdd^qZM1K(ZTV*2
zip<slTIkxv!Xm^{5)5K>Gx!{LF>Jf!<scRS$h;BW1)uL@eT+Z8yT2@5@BSk){;^pY
z9s3a<@}V2QMTY#1Sa3PFY0GVU?>Qc~b8&b^1{uDmjBtP}+e4-}E`=A$d0#2peoMCA
znQyy&uo`Q!QSC@QeP@|Bv(3C4QTF%e#pg|Aj0G<9cnEp!Mh?vAl2{t)$Gx3!uCJZF
z>Le8K%B&dEf*3EQCiW&x6PjZK_MZ^u4x>y0gv1z=;|#cCZyryVHTjN>qELvENQJ(q
z*Jhna!rLbiX)mhP0{lF>!`MlYAs<TY$jq3lkxrEvqWOzu0y^v*Ty8(qeeM{NB4pdF
zze$edsu-0E$WI}^K7h%{Y6%kXZr8KWj`~5x(%G5g<exnwM>~zW(HcM3V^I|!@>GRV
z$%8!r^}%R`DY*2i_zmA?HMC5?qY1q?ILM;Ui6-Pj-n|RUuI`XbJ2nLbHGnI_w|JI8
zX1u8E>G@Eh*qaZ%6%ctdWe?k26;>P#)d*uhz21X_n;Wa<Zl9c7lE`3XNpjBLw655}
zLYyvkPH#I?s{dj<htk-&N8X*DaHIxuRM^&Wt*l?{@`^HuBeBT{x_`c)de;2<kWQW9
zk8>6EN>-FE@>rlrPfWRkSUM+{xHE6HBUGbMRmpYfbMSI8E>z09v$X8f*VUCr%oZVc
zIRZIl_lbW37N$khs~^O`_Ih5>^>ZcsNSi8rPuqrtm2WT9RHRlOe|Y;l_wZX2&_kKA
zx*JT%@bd2Finhkjs5k@fj1GvhGQ?ZI0@H%3M?2k(h{|}ubQe%*ZVMiHZPe|zQrm_7
z(Kr``-Rx^QAn!}fo<mF8!>Zr`uz?o&Dr`7*d3}_bbv9s)hWN26$H!_0o;ccumj%*g
zx-8Nu36JR~)_7f(hd=Adec^Grnd}>&`SEpTqThQrRLJoXj8a(3bgo?})i&(`oA4e(
z(0&#E!Gu|e4)_u*peEm-t)Z>BV(z=48zPGo=QBMW?_p(Y0fc*GROrNHbA4mMIbkE?
zMPlT@n#|8XuHN#;qMz>HR^I5QT{_G^D?h4pQY}`SejeUr(YZVC^Sv#R{p3P;=ppol
z44*0&CPkRil#{&Pr;WGTg4D_89lb2+e_K%WRivc?sY==qQ<aPUAJa>eG|06IIto#^
zVYZpRzP^Hjf`^BWZ6>9$DW<(@;Vw%rOYxvY!PT`XoHbFtsMk~%(-@N!`74nx;vLQ2
zq3Mhh@Rh%Us2T(~`Z(+>Zm{Yx4PoeHE6wU=6sDHrmAMFUu)W_FFgnD>&{j+RA%w6A
zMLD#RJ$vTkY17)GvK==@0oo|Z6+wj57q74XIBvr0tyE!-{knrXv(|VJ5MHpdXeeux
z2i%d}iJ7VX)m4XWOI;Psig+nwub>{a;6^9ha=ya`x|vhS(D}LvLkHp<A+DD=ptO$|
z8=pRFteEpQ6-?cFmSvt@^c^wZ<=E?*GnY_pt;m*ols+y1HZnGzUl5(ej*5Nv7m;|l
zdJPz21SEGknM+Xfl_?XR+`9N&5GD;Xt`WJ78}`z!?>>ySb(7<Z&6P41RVECg-TO#n
zC^*v{Qf4;AwVW;(Pmw>q4>Yci%0-2syWv#EB3@c=I|(f^Y@VO&EXUWpC?zAeTy4~$
zk!+0|27@X~czBCH3(3M?zEad>wz|^RFWkps`G})g%EvZ)#&FK#FW<T(8ZSBji6Lvy
zbgM4&JYIxxx&(4-mM;6{;wxLLfca-6P2p_{!YCK-lafL6;!OHZ(9aE3ij&~Ctu0<k
zb!skiG}j+#tq*Hbj{4PUP=)h<-2Yb#xUtM!9pPdh-%I+jIKSuJY>oHz&CliQ4uObb
zg3mQ!rH0Qd-A1>4nX(483R56IGU8vidafT7Og-+gd-1F}rYl8v2j}bZ6YDI6xEDLo
zjpg<sV_lbG!<wI6DC7`h+xDnW2X6*OEa~e@x=I)LaS>2$<+0tFuTvkIZp7vnjEony
znn|OGyd6@8_vhRA2iybV3H@N%cM_}xgCyViV>3&olDn2x0A(L}hInT<{pF+4sGI4u
z&v3})n6hnlHL11YUl2FN%%<!#hi>X%57T=`sPdGawT!oh3;Ltw)fJ9@tvZIxd=<yo
z!(PW7N&ohY?zziiD>7Tf%|^Zp#(Y|bb{BZ_1Q%_Qo`SsD_W5<$0S@!B{iqM*nv?I!
z-wHYYa@3e9g+RHzOtDVw1X|bhC1-x<CQnV0i%Bu#8P1%6s<C2GQ0c*v&EKe0EL>4W
z@y_n<?z(Q2`WYbwT=3dP4WnDCHu33K|5l5#--+1Ivj){il*k-}!##1=dn?c%xh_J8
zs61$umkCB>GE;?AHRJAd=g44Tz-T@n)%2@t4}SC038E?hPq@P-5F|bnwnA#mlL*J^
zPOMdymUeeHFUo&^-uL{YYpMih;jCmdTvLO<rGF$Qo-+&*7#?TC;G-|n_96bP?HL;D
z3^T<b<y&{ihw5~8AZlLU{%+Ud+*Qn)8Ct8qni*=l?8H?LZR3GJ(8n{2i;HOV(p3M;
z>d>l>2C0H;zdKkx!{K?`jf%tIuMdGS*#BHL!D&O0)`0jVR33-h6lhC2JNhc}B(+6?
z5zwMmR%)5RefXGcs%}O)G(!p)>`5a1SWNX@o8zt7Z&fyoAP<NYBW~6<HriEh;id1-
z<7Hl7eo(_F(}V1Y2T87#BNJ-Ma0bCmkef%yUo0Z&L54y)io(~?=jfyzp*eJ>fp=tK
z1!HeZd95TRwIG>Don=pLbCcRkRAcGvI$=B6j=+zXn&SGkFDDvQzd#gi4SXswC#BDg
zkS{zlj%yGpk0Pg;{cs8`yqVLkE=&{C#vhTKA}BOpRU?Bp29vA2*CYsCzdoHFC??*m
zc;IiB=2VfQeg~4|-{9~_(w!5XtcK#-bAdTKt3G||3iLHI3tilQ14<(7y1hT8C2eV_
z!4xl%3@F`88+!7r`ID$vI?hm)**b5VD~+>GK6i?lOvGk7jZy(_{Az&Jsj0?1&ALEk
zvv}bBCCb}%zQ8D=6yo9TzCOI}u7Xk5**UOYl7NqGdGSJ-M))(cuPN<f|8Qihz+%{x
zIiL0V5Gl|h*A-2ZL7{9bY`Htm>!hcc)6?04L{xY?(fkw42Vof-fYwQcM<o4LA__J!
zHkMk-vN-ONIfGtW+VD=D1if@Dv$iIZ%*k1NY|iob(75ix531-t^4)K*$|>R!h+Ea(
zYOXiJ1XrLwAXfW@RQ<+5>KhT8&)UDWbIuSfKPipA9zL)mD(nc1r|`=yp(pN?d)L(L
zVX`>RV{2e*Te+~VEz^<nQb10MPk7FgGYg#zi&6B45_*|sALKUp2+8FE-MpT!SYXg+
z(cPeHIn-Ae$dkALy_Wh#bBm`IJIImt&{u-4LD=N6_bB<};RmEd=ulDj9KKB!MoF}S
zc(WLLZnmLy`);%kF?$wnKbKjX(?Wd+!$@O*2jdo`Xa>D5bmUTq;*`F{rAj@`Upe{&
znD=J)IUjW>Ln#Csj(yjq&95uZ#HK$Se99fXFjuYYEPub#NV#siK;8ThbK}c3NUdfO
z>h_~6A#_I>lAtyNYd)+-GPeq>^Ja#B&eV-4Zel}Ar*kh=ED&AkP(cOD=pI^U6x>VS
z`0^eeT&JScszP*OQt-!pUGw=FUyz}R4dPD3?X{{b)b}nmM?d%9b`sE;^XbUIM|f%n
zH&pEf0-1}a=17&1?aCKx{EpI@2*%uOEvaf`njvS1pQvOC>Kib6IP2FAz<fGTXZe{=
z*98)XX?u1_Gt(n%qsY;zt<?nsPd*4TC(BUGF#0_}BXtG#^bydFuSOVZsP9EnJ6?pk
z#)zbn>;powCx52HHK8!JOnG;QY|O{Ms*>hrtRHNa^#eX%h7GV7Er#4|ylP~NA%6(^
zrI#^27<U|oPCyFHn9LzF2*p$LjBq`6s%5uI$<5Yd?G!tFm@649!yK(LC`>=aIKgnQ
z(C2EAkntl0UO2_`hb@Zd+!@e`HycS$*PHk*QV<qoWb73XXQA9h7atLtV^v(}hdn{g
zK_Q2%vxc5p?S%VlmQZJIxw~X)0mS2(v4^TcoMXac26|K}x(c6>NJC+n$8Y_){%E*j
zv*x0aZ<`>O?vNBgE8UQXXZ5DOi3*ZLS|3kK9?K(MmZ~)6h?}I1KaSHGLnh8*F-J0s
zp}8opZyvM<=H(eh*i6|*im{cF&OU-0JZPpcds_~%{zb%Dq;Kzy4SsGf=w*y(!dpTi
zyluQiI^z&9Wi1{8kA{U`XWBe+(>uo3mwaX09^XW?xQS?@&0fS<G9;rON0XH)1MDg0
z)CwNGEYU+7N}+(tT4R>HtIiRU<*2DrkygU$p<d%9&RX{T*>A~J3P!3%ieZ<@pb8zs
z$LxoN$GQtY7ytZ{C3R!2jw6;%!R#kgdXZe{1T^8E+NECQK$$=={TR@BZVr^wOUYI$
z4O1QK)^B0ESL!gZSp(>NHR>B5{P}yG@n4a;8Lxo_MaogW6YPZelG3r+=t&;xi?Eg8
zfE0E-MJQi_px^F^(1W#?&+I6xpVl#2?<xJ%RxIa*CXh^EPnLs!L6FIa6aZVPB=tu_
z)pDcnuUrc1F<QBFv~#4Al!;F%gXv{k(uM!~I~~RFwmxb5!sP^fQ;v_X6X_m$t-+gl
zDkC%E<tqPLFsHMS1IwnsJi1YsLmzHDVp+M=_4?Ab*=Fm6>F0NeRsoA7u2=VGyj5B@
z&*4ELMVM3EeA8u+@sb1+>2aUi^#ZqyB5}{5Yd#<L*Q1%Jrf22N3_v*0$Bjk-ZC&o2
z8MqvPN<|@;Hx;u2KIaKOa?M~0W!d>SJ+s~`>>GDyTeP)tM(ftN^$@G^Xk?_Pf$!2>
zwa{QGa&eqamu9NTjqOv6=do2Q#wbDpja*w75XIIkq?c)GI*nJ6ygwXL_xsxX>UlcL
z%Q>2)uZ&$gEis$nm8m7MH+&Zz!0kX;hR+MwdHjVQbzCcX!zDflx&0Igx0(Fr?AF1Q
zBe0Nc-^zT=?HVB^-F4gUTSCeNV#cAJP)N5~*CF1)tLDP_=*9#^!<Bo7|D3<pMcVsR
ze;N6uiR6`VK6cOUC1Q%Fz<BOOVJI`!Vhp|+9d-&A_p^k0o+Uqi08>)`OzGYEkZOuZ
zE0bj+RkA+^@?xN%Ud&)jKe4&`z(ymnyn4(Sh{Pw?yb}4O3r=(N9-hhcQt49wQs+yy
zgnbR&j}B*#hNJEw<}9grmHRn{x`plS7%$epLcyw+YWI}$X!JQe4BlrhJeutau2e4+
z4T|V0;9gid=uD_k%c+Q@_q)Lew~^tK!%s1SOjim7^gu5m5c$}E`2G6eR*&WPbhg0t
zwV=&E<MxPczfVpG6PWXWZ%V2Jt*|ZJ-7j}8Sy=TFsI0epqa(lnUTk)~$T7I5zEje1
z8kM?*R2Gu|sQZ3e-@Er~tb6&>b*J#sajLH^_*MWnPpy|QU$P_NYqK411dKq88p6sS
zQ0O|^)1WwQv0OQSc^7c}*Y)Doco5A(ZsNO*L%y>*x=^v?Ii`u_v+ea%f*;Mr{s@VL
z_RaY`8H(?`>>_aYaCacy3qEXAy!f+h{?h++n^UunMzp5-^HuRM{X$bvE>+Hh+zFyV
zKifR^UV7g>t!MNC1o=GelJ>a*M(zOFDo`IyaJ`hS)$vt}uheV!V9{ATV37q4U!>Gx
zjYkCcK-w25d*4w(T?Zb=o}lY*_Y)%x;(m6V-7YWs>og<_OwOXO3h#gZ9hx_gO9(zo
zzegP2o810k*Qprm3&nc*{r1vGa{VIsaK;k4t|@i$LoRW#64du#ef^pF)t8s+0}(zx
zKH-G|OxEb?v5CtwXJJ|~Pnp3&8xmS+=IHHizx+u|E%l+@WH%yMXeR&j+ZyH=C4o^-
z!+`N-gp@;0eGxXxDEG|L2@%T^@r6#Y+y%TF&dq$EDZfoqIOB5`t}98$`O^cF3#Mnn
zV(Fv!)3v4FJCbq@g050KR@lcBGi;VqsMMk?U}TR+j|Fg-D#s@fIU+7yv&)fk_U~Tl
z1ew~uyW5J1(PC0aOV1!%vyne$#&Y=MUGphf*ZVG85vSQcm9@9mt2U;ZC$m$Pg{8Li
zc`t`2#|&3OSl7csSHJt~9<SyR@ks-@eYxPG=CO!xQEt;~)tRQ=@|Id|%bl3psx~la
zzTd`Gd^{1rlG+#V>FLqvNgYa{ykGlGGCJ~%bK=ul6X%`xME-GSiPhSUfjMJ32H#{k
zc~DJR+1`2QyT2O?4UvWJ{au3wfjcJxw+$}0*)d?+NKa;hy<t2R?dzpx-PeBhTMe)8
ztUh=ZIM(;*|5D7t&FJs8BCL-jREAobX*PH)xm@0nuoR&3go09g{mG0ey&e0LrH%%M
z>-tQa5Wi^4NS|OgGg~JMd}!SSbd>sjIW})nAI`GrIyt;Pa>Tn_YzQ*7GHghGJUcEf
zce`fLtIMx#BIvI&o0Sq5VZ)W}Y%oURPw+*P3GFn!r>UtsQDgJ_%zt-h_ky<Ok0&wB
z-6D^HoV7Is0<l1DR~8!U>(>)lr3`!e=1SlHP<~Q*PTOm-`uMg=t`%>+eQceBo7=eM
z^7870?2q)v1Kx|JYEa*EXgPGIV%+!Fb|jt}RJNj;#?)^f(Y&tZb>_w4;;GYp_e*gl
zuo-(YSoM1trW>c)e#%idmDy0n2QEoI3(^MBan=I2?51x+H7^MkuU+~^I~FBpe7gnq
zk|RC;=Fs^k{@jgTQ~u)NC&BN8V&hj6Hu*Mi{P#{VC|tl)aHdt@DmhmGqDCdG!eK1X
zxPo;6M=fQmu$T&-C|u@{_*Xgyulj4+cB^o>+Y~o7xu3^TQZFsjyvS9?*^89EtRM_L
z8vBlo*BthRF?Z3-z(+~gd~a`$O?Qx`yj*}rqGv$b%<9KDZBIrw@YRgDb}sU~Y)P*y
zV86J#H4oMUS>$zf1zrUmuDlA;@xBNcELaKCvrzHVHF=*sE_C}W+&|x|LPrO4tCura
z<DL20x~9S<+dcb`Br6sDRi&-#Xuz5a>QBO{Zp(vQ{h{~uDb+>pg<MIa3ng1&ES9?j
za<BNn$@NiTkcr{Qz%G$RI=`ryKg5AuTl@$$W)~b4o5y|3{-Xynx&+@4HdI%BEBr4#
zwK-FDy=73^%Iq=B_MF+<)qYwm&#t`T_4OH{TF;(|pU+mYZ4;7Be*0OL%Zr<siAA8U
z9{=p_DDjtd*xdhW0aE_=pB|>_=f6uJbVdJi)GX2DUg&yx?yL&3m<$u2oN3dT&%2DU
z?J${J?(Pp#WlrfTV>i&;ZFs)1fOG8cb(%uUm^t>OVxf}Z8m<1_d5KD^OLP-?G9kGe
z_RB=kr9%B2)nWQRSXnIP%=sOAuHpyB*M+VXNrb>$^+7Xm^@L$~*C<=VB`8;fSVLLi
zeXoATwUa2*FJB%Di9hIO+o3qh_dwxzt&#6{fS1X6uCc$ysK^QO!~iZ~y^z2iE-&A{
zd`(U{^W(?c@8)*^CD1~oR6z4%l@Z5_rp}ucvGfFs<L_Rt)H3^+x%?!SNDhQZ8ia-A
zFw=Q;ygDT`+7DV=y-3~^jUD=^{n{P;>ard-wG99%nVgsAW;P?41x*EG{dk`%NrvNu
zcjICTOWxfj5D>)rOWGW#ZL21TSC_X!e|J)kOWoegHuSVOFKi^5pH|Bg0LFQstoZ$1
ziQ{@+E4DAaSy}tX>Ala}pu2x_+b?%?bKAREaT+`C-?}!~(*-g=^mkABl)k#Wok5jD
z_hbvTY;|OAK6KB?Ik2)D{KXI(OkuxMR$61juMCasjOC=sO=)Ade){vzUp@C4I2>L}
zk3_pg-X<athyp>s8oIZgCY@40v{p2&+&xO}qg>m9yQKQn#Jy%AetuWLEMe&4UH{W5
z#R_6AXKSknQO=g7*(#_GFx^Wp?d=N*(-fKkd^jtV5h?IzqiIJ{vj~Ip<6z%UrgWKO
zw|xWj8}-$xK}1w6(axgNWrumqJXvDU>kaNvpD6ADx?d-g+n#?r{7!CNZ`Ng!eX+sJ
zU(8+qcGF#sHoT+E>lv3mLH?!xBf86_-`d1I+nK56^v29frrdp#{!5T=s)|s@Ng^c}
z=H%<jXUougHs?4~fnww0xZ6_XwRdny39T54a9#+CbUM3?<+*#Uqf<&pFOn9pk-e#z
z$L9w`1c{{gvZ$@e%EtwQ*qE5u7?zP)+JxWsr}j$6hN_XZwS}=AZ8Vf47lmImhOPQS
ze$CHVD1{n|SiI!g__vBG9O>%8jahA|_)}Yq6PB%#$DaD6QOt(nQjFw~7Zfaevfi?`
zkl$Z)*d29w?9*~-*$}sUJOACQAufl|b*W9y=h0({cWhKt7d;(8r)f3uzrkiI^ZUnm
zcU$x>e)pH<v3gBYi|c<oY&?l7<W`-Hg?sPjbD(1eL=6<|(x&<OiBkT(acP~WmoYKP
zz^6(gd3sQHhgB6zMjwor)-g6RrVHL7{mhPb`f?e~%5@cWGim>hP?_0r|E*Ui<IYd`
z`Up<2lAR212a9D9{g>AT0du=y<Cb^+mr}ANv#G-++r(o07}X6P6CE-v8N3x8-TO=i
zsyp_lTjYAL&d!bRQ?e>5DHwZ*NzLz;4yC(fva!L{DL66K9l?Q=)#6UN{EX<m)}d|=
zQ3!3oNoCN)uLnNt;D%<ug}=e`)0>zxtLs0Qy3ajjfV3tMXNQkGz3uvI5A^21rMvoj
z)-ZkWn|Ie5S6ihQk~fFFe-q6AUQ=Cdx4pYezaLxvdW&DTt-uHwE8<yvk~bM;tHfDX
z*Yo)JaCJa#iL<ftd-(gav}>)0MdmUiou0nb{>!`CRH=L$(M=7+rfj><k{){}pkd2s
z7t+@3JRl;!WmPDeQ=*oAqBQKTRoYe?s%eXAi%cxU*bn8SK3oIg$bQBjMA{5871lXC
z5y>_7xsh`HviWxmW_FKVz^0RJ=L5;3)61e9Y`2I&SvLR3bE#ZdUh3`Dg^4V;UR=9g
z{A$apPOVP^Z|Rc32k)7`g3A&+t~)M-dpq6HlmX}a5B=h|SAw>1PRJSzy(84<zsF{U
z`(fnt+_da1Uvvx^c?Ldvp13){`7weiy|HI;CV0am^Bf@|fD*MWXh`_lcA2buK3RI9
zD01}e4ez@xPg#%7^x**mWBgy7e4~OdU-ljk&EIr&VF4sf8j<JL#559@OBvki+$ePv
ziby>kaeA#kWM#;yO0?gW&wXHC_;TlG+%!w~{?7j;;_sE9IoQn=JgT~A<cn}V$BMLZ
ziCbZ*Q~ExztD?3`&c?8MmM-k9aIU~I^AGD+{I>yJ*Rtp1MPq*-O(f~>-+nLbJq~xQ
z@3>Jd?Ab#c>cDJl=xQX{W@;}xk1`6CPNz{+UIFr^Gz2E5{*yuS{<pRX@)WE>e<v7I
z5r%7Zc)yK=0}d9|4|?wt{LB)MD_=*KroK>{Wvz@Poc4cyWXoYS$pzJe*D1BO3(89!
z<)vzBxh1WRjEs-Bq2WB4wXJpPQoz2Pv5Q8+qRYjnMOxE*Q`1EbvKI-|?LnIwIC2o$
z@bjC|IW_Z%(Eq;%0>{Mj5st#9yc0Kp$^W2Uq}4iZGGtvK43c-6iC|7S%N)Kg1!}3p
z_6&bHXY$3SJDCVChJwFyOW4;_30!TNw5)tWOzBx(FQ?*<E_Kf~^j@i4-tk3fTue1g
zyq@0VJ)1Ai{2(-9l&w3;m|)ZINz3)Pe=+p+*dqFm(=N?h0ppC{rR3%{jNr8IPeg+#
zcME!dZ05-X4Qg<2WSaS&eg4i=D8kzNhCu+knJtSUi-oYCYhB(8k-e~vufyNGP%7cW
zU13uHuAy0-BepguGT;C~2&mMQaN4^pkFsKE=B;YlrF~EGZN!JcW-dOIkBHmvC9d(e
zi}xhEM=_GX5`H>C1w!{YwBGKXquf`d-Wn8fW}0ns4q^9mX<SNSP3v~5o)<8oV3yk1
zvko?YWX-iYmII#sD*vomhqP?}z~vz?FKhbzyD}wrpls^Hwa6vfP{Zxczfx(m{^pTk
zF6NoB_--@1dBRsCEerk~E^0Tkqx_zM@eG0p==Sq3`!YW*JKKcM_nHplDNyqe<>}pp
zDE=4KaPr#^9U){t5ske5KG?{i-J=eqDVwUgS;N?RdPnvw;=)|JBwH$JjyY@A%Wyt_
zwL*E?oid){H!DUpmkhq$@!DsI&=n_^1{W{fZ^ZO9CIur&HS&#im7w2=)+vDA?K2SD
z<;`Vr{jA0ymGdME5hhPD!JIoQ<l`fXX2*!Lyh}w)V>mJ>lOjQvN<svH<AX_rS=bo#
zAs}3Fyorm1E%IoZ5&&DNA@>}{U1w_jzk5Hl%W4DokIOd=)0FE1r_;4287sPEm!-*R
z<IK72py+k)lOsn)7ZL{1Q6L!rgzO<YneH8US;&@kK;m9AOG)E8rcg=6wiRUqe(u)Q
z!$a{92K&`nCG5zY4V-YgacY<Yh%z;Q{6nE`#3N^dGtd8`ht%2}3)bwC8QCKf^5G~6
zfsC}s0KAYuvL39ffYaaDFAkA4iULFnMsqf^vW5`W<M$>o*>8NQK-EUZ4g&ZDJwW|X
zi0cMkF}NtCgc9_e{VjtAh{2}j9j~*3ZJa&lWWp5ldK1V`GJo-Q=*)#&nNFsci#R|*
zYd<8_FSSMexp}NIKx}x9-6^o$!<ElZ#WMMPQg>Yd1xuIYjGg&^+<j$ORNwdSpaLo=
z3epk^h%^k{Dk2~y4N?-rNOuga64KqJfOHOBgVIBa<WNI5j4<>N_wfDxe$T!CH}}53
z=LOF*oU_l_d+oK?UVFu7jbR8Fd89^O5<O%@lxQo0k9t4W$Q~_xFjtKERrOxp0vW(l
z<iYlJex2xpiaK|d{@H*uL9JP?fyK8nCRbL4m%ZL?lzSfsZZm_Ze+HB|o^%W%-JW+4
z0#@C-cdH&nJB8bI%Qy7%Hkv*QWOF9qC$Ej4*x3hA@Jv50C^(a!!FxW@x^XJM2Fm2#
zw?tX35D6Q7?4{xn6faIl$fk~s6>Yk>ZOrW~0zP;sp+BiJxv;(OfqKb6jLj-!k>$^~
z{zmi{?<;HZz~bKf^*g_bnPX8lj!2~b9IEgE!{f=XNp)9EZXN4S@tJAK+;PKxTW^~T
z_meNxzJ7VpfV7$QJs`Cp+Q}w*!1!d_tvFC9A}DSX;;pWy9aMAng(mRYnm$Z+EWv9d
zBFoR5!n*>#8OW1_+J1Dkq?k`b=7xJHnhL&gM@EQ0k<+_rfFepTI&I5iAw-9KG3Wz@
z@z6O|ZPP;jsYx$n|E2v$@h*oIF#btO^Ebj=k|xZJFXsF=drXfB&B&eAIlPV*#_sN!
z_pv?Bdq53!PYRtoib&%xnT@khR->@i$=ASpW}%aLd1iLt)BQdiwUywcm&{MGO-;>i
zYJ~pru^|1mGW#{ly9J^2LwhY2H}mW4>bmu#m4gUL<&GtOp)5jjrw@vgdy#JD7Vq8d
zW?L2_j>o=<fHz2Z)Dz)FmUm+;?Jd<o!1XjP&bZ(K^?RS|AO61pUInfXyq~XOS3y+a
z*T_;J5CPLQcIN-Q&8WAc%1{OZ$=@-sB?Cp5<Xz4SoVH-3x2!L#jPO9w{lKgImxVTS
zoR@`B#GvR=V5aYd$>M?f<>06`KX1=m>F>ag&lzhUAM|H`FqysqB8&5QBXkpl{jes=
zUYp)#ayMqLe%2_eTe{~B0jP_1j5UZ{sr)yS{+#$X5U6V%rB#dCb_<qy0@egxP%{-t
z>`4y#S;Cw)Y{CSh%7^NReq5uz$&@Vn%L+Pu!=JeV=p4|t06-Zv1-<}ymGBF@-g8ov
zCpl4rk~RCh2#+qHbU+{|F>BKR99!~$k3!qUCX!gkJ?RE0nS@dR=vwrwMc{RR%~+H1
z{7>b-+hC)zG(n(|3bOv}*SukoV^)U{erO%=JjfQn_6sl%)^kfE&o*HzPR)C8uY6);
zc)UntgcuZ_DD5Kx<c2DBn<57Xs&sE#44c4Ym4)Ep{hat9UK*emO7d<A3Xm^9pVAVu
z4gRsB0488P@M8HTQ}R9aH`=uWgMt0Pr1;ary*R~@cfY*irETutehj~!xNql$N^Vi)
z1YsY9nBjYB#XwQn7pZZErs}8%!-kjd6dJ~@s$AV&gEsSrvma#$-vEIa1p}rUYIMQi
zssb%yx?h|G<}%f&ox!p)sR?1G1mHW2kb}8~gxL>r7SDWmueT#1Z=ZE2WSSq$lGczh
zYgFb0aEkvUNTsgL<s4;0s0;DKep3Y@Wi-nmxN62Ose9$f!&@2={YC{q+I_JPKhZ4}
zLPyP7R6TrZ8U>-Dgjd2_fPR3!KIjArErUS3RM)6}AQ17JYiM2&=nEkFf$Qf7AOi)s
z{y(^Fp#zLAqEw`Kaaxfez2xY~b(TSZ9mwq_1PTWJeAhrL)+F`uHjPnP+kb5V(#qJX
zCLm52biHMQzJ6+)o(RtRwt~vI3;YYno(Fx6Xp}D5!f>-Cu>tRq1{N`+P@|hrkj?Ms
zh2a2`gBGr-$VUc$$pkQ%Ki>7P%F*JN*CuPwS0I27^g!{~JsQi7+n^T#*Xx(c8fKw0
z1iF5>$KjJD=ta1~a5zOc2=uyBU0YE3S}1_RWi;OWk16RAwE*$Tcfuk&$%rf>kXZsx
z^WmIL0z;W`mKtjBTO8}orA)@D@R`3Kal88zTdNv&*Iw+<y4N)$S{lBO6@oy+OON?M
zU#DPUeX3ddZZq*u$y+wRL};~p(LXQbG)vYYXtd_~WJ4i=7wuw%`g3y9*hpw3oeQ)B
zVv}DyDl-t;jANkIOU1nV@>IdbSTUz~0GyZo&JM6kA)4P3?AH5?6r5)lEd=t|7bJdg
z+vwFZ=Vz`tqgXRGDmq<q#ytWtg8vaeAl_&#XGQxKr?W!mw}it+e3NtS%4B&Ih!d+C
zNgYFv1#?NK%ku^Bo89-0o?2!yIuHdl6Qjf%v5C#fiAvmJUM4U@#p9!!baz3#4}d6Z
z-U<dIfy-<ba(0ScAJ3)2HO)u{<4N?b318@8O_qoPUg4r~IsM6StJFJ?f5mzNVDhKd
zONU{`_{|b}2@bZa##jgQm>yuAIP~i#cC{%2zappQ=3eh>tAqS6)%XBpQ{|E##9{A7
z!jH<C?<G=`CxeKLmB8KTV?<q!mv?8u@=mT}R^O4g`>I9$QgpZbeEG~~%BBPNz&Z`Y
zy_k7fdz{97p|Nau+7Lo0dCFa0IyxnW^!=!^dik(6PeL*2t<&5%=R_tcW<kPUE@-CO
z++F|e`<;YfE?5Tp_|d4l&uJ89xa1)S0EoZo|9cs9WoRt+thP`Ihao!5%u8=E6!gJ}
z`7Y)<VkOx{XD4E?=Fs)d8usF?&)aSZnvKo1I*nbeQ-Za_X(KFJU`((UTq(?2p{p#)
z+@8V0R!gC;rL?W4iF4WTh|jfFfl#wVL8$4x4l^pi?DGxZ-{X4vKOP%NIuA~IlUtW5
zYwdo)H+fcZ&%So3L>swEV%uQv1`SC0@bb;^n$xsqtOMJ$GhN)cON8_`@{Z^yWmvxG
z{q(G=%9-)(*l4xsg)>90q&c_(9_Z|w&KuC}g~ljV5y+d6P{BgA`eX9otgh)qOGo|E
zA4tv6nD;2ZCW7Z&<Mp;Gkc?gV&&4EO2~)o%&o%}v?_B^P7XpdzRgJ=gt&5hvwa1#v
zs@$w=56$k6VWA#s9r*?V$pJg;Pqm;mR9Vxv&3;)X%@UY?RXQdz()_KeMr3I-Dt18~
z`2m=_?xPv`yqR72kh=&`i4nw(Yi`@Gc0hC)sd3X~-vou>rh?eh*x6P-Q?+LdvJW14
zv!cviS%w~)8n->-!UK_p0Ahln(fsAFC>5SGQJ;V@8k~x?p?Gf#7wVzP_96Rp#qvj{
z<9E;_yE@6X5J?Kb=>yp+*V&v2w+P4L-;^cTM#<i-%EzczjV(th)P#={b2nx?h^H5l
z7eqO_o=54}7A<)5gVtZVpMvK3Ep@xNDC7OC)L!~3e43@V?Ee~i>|pf4Lse&sC_>Kl
z@`*6SyeCB2u4?2V)vn#9&E<T7ww05{o1pZ`Y9aAHNjWRXVD0Mo#TflWOi|3lv}Q}`
z;qSSh$+NqQZmOjHn*P+aGO#ctt@51ReqLN%<_!>_nZMx7ign%!T+s-|xjn$%HA621
z=Xo(t_||U?Y!#z@TU%J$d;DkOW1g@IiO%vPYB3ENf;>B$1v?wdG6c(c;l!eqmUKtU
zo{`?t<A^#tjP;NZW_rQ#^sWzGge&2AIjZSwV|V<G<jXYHs)016;Wp;!@4h+6G?h8e
zeF9BT^bsI9|IFe$@3%IT<Yz_Ae3nR?&08!VSSqe_Y4n<E-N2Is7dB)dsQ1LY2I>CX
z^fV`})NTG0s^_k+;jS20TspS3cl>u@Z|ZSMuhn6rmv*9zf~jJM5E%)9UGV;!xVkj@
zMB#7E_sBuH!h?J_qsPtN{}wIXy(vu87rGr;Uv2g%^Fp?FtcuV$CPpJB#^;UYP++c{
z`Kk+SCO;{hI&Q40*b2E@t2I_^{@1fEKHSqZoJpFWX-G}r$9B&Earv}{07Tb9Es<Ws
z?vS$&jI)%*h;!U;aBex9{LyJT)XQCxzTU%8q01SWZjd&cDeYwAw#QrCuA@w2VV#yy
z**cjjpkv8D<o2=h{gl3EXfc+fN-TZun8bwxB(DSP-W%4Z@#*E>%k3)dr9#$@ux-HC
z{<j)JAZ8d%hdw=(^EvMw_&HaB=_Iy)n>Z+KB~klgje+#1lN`OPD`x|>JjB%ZP2H*Z
zRl(u%t~;e0%m*5Ys&aPflY=Z%-txrtu+t}M8RTiCBySdE>`rDul~Z4vWbVAX|G8SI
z#-l~@Pzz~6m}<x{%K8hR9K=ZfvG+EkvNBEL!;ilTAP{Jw2V93fa-^f{ed<G5e9oef
z2ryDx$8JY~>8RgE&aJEyC?#MT`NO)orM6@Idu(uFZM%`Z7)<dG<!%3JAoe;s58<t@
zR?bI_N@36Bgk=DdDn^Md4%xx35DstBksTLPdlnaxuo2-TFfcf2Y-LL%tryfOIpX*M
zo+Bi~GJ^b+H+3I}*f>M*;V~-zj(_+<3|Or%(UJ4}p+t-BpHnQjY_)9l=4u`8{1$3P
zN!ez-Wgnp%yr9>Q5I10;A_6x`$HYBmHAThe|DH10tFi3I90cv&HC9KNd+jKo#JeVG
zHQ{_iZtHs<H}g|0AuypbdjdvDKoiK#Sb)_sWEhRRd%x5(ktpMs4RiH~>$E)tifAwx
zSUplm>aE77R>_Ckxd*D$s&gnNYUV-o4Is6(5{f!;tW78{O=t16eGC0`jqTt>sD0YU
zaxEm1bNah%jnI))u<c+$KXlICdh3WCB+m-)f#sS;Sl9tepC=n9SG6u+Le4cZ;jlk)
zh0Vh^F84T5v+$hl<jNtjY&90H!n6T*5lM=%g_=!Yn!eJ^Q|j3)q@{6sig(KnL_w&k
zHqup~*B(;o!X7+g-B&5bin3N6oT}xt_6jW3W8vqw35F+B3k2wfJAGY_*vz#YAOi9I
zqmzReZ6BFWUtXj<e1f5oEPRV6=j_F0cqwn8m8n!L-k`#&c-N~=EBLYB!YnRLJa+r8
z2Z;BP%OxITOG$EUj{jE_=iFmO_wO}K=qXutMdrC8&>tY?|AnWh<*V8oA3U42@N#JZ
zL=FM4#1O^)HW*~VWUmEl2Pgo5OMxuSR|`&z3W?c<iaBSE^wU^#2GUR~EJ7WW_PQWT
z7KF|=9!Mj_z%KMcLRF@0>x+}*wrx)WI?)vUBi*Lc7W{$BP6KHf)_3V3r;4pAz4XPh
zPW!MzlwIqeO=oCqBi%nI%IOu&vXr|=#PE(UxZ1cTinr7{9<{^g-b~ZHnN01oEyW*?
zT&UGf2<UI6>!m$HaUoq2@Ih1n+B?waypDMi$rg?h_s?H8_{x};c9uv`T@30-898{V
z54UMv_lX~l8{f^%ZB0*)jvZK;+y3HL1G`1XjT}~z4fK$N=+*tR)D#={gfrm5K&YCP
zQCDUHDoqZRs<|(pxbyq3FeiwalmQ0%BQJ}Hu^nne(@ePQh%g&=%O~0#g(aSsmVHGi
z)9?Q6tjg`N;Bi&)7!u8%(i+VJw_F&n>+Zseo76Wg!@%xCPNS2Y3J%K4%v1LxeA;ik
z_<YUKG1)flN7$!m+Hv!&$=T>MKEHf$U5`e}Gn7r$$mPH}1;o_4sjGQZv~n<x(xiWC
z`Edi<a56Kak~c@J-E>pYo@K)A<2)?|h%{<Y8h9ONuq^eHsTLDu`llqC&nRr!N0y)L
zzkq1dHpxj%h@Msm3l}ZwWUwBGL|VrFZdCT};NPf~$(gGFeE=$@fI5=IN0AZ_V+k9h
zT!uafMY&jzJWa6Ne*vopGq8C}qD43S#nC$vVx$6|PMI6Y@OHgTb&C>g?xx#q5ZkqO
zzqdj&MPDj0!#{bkQU8ZE{NBofzCj)bcgvJuUYEu){dUrlk^8W<p&3cjK(eTYtN1Pd
zcmPP-UnEo^;}-;BDyy_<_z7{SoIMwZ`&3*qyYx<`0;Pv&7c3bO&t(m1(44)G$C&W@
zl+eF=_3+rEY;1dGt;fL}0)?zV`usx!lehakX`O!PniOrN-K#Xnvvo!N_-K*2l~#(O
zADc(2$&9QHlpHRLwbXKkX`}?9YGt5xRaG@PRXG|2Qr?%}gqc9OPXNZMrf6nbcWh`{
z&TpwIMDVdn3%6GPUZDCDY+jU^Xf`;~9#nuzt7+F8Uk-UWKeNIv`B6IBen)flL(vZ4
zyQ&!#uBi)<cL$)DEF<&6K@UD}i_p(#jf{^L1^uLJa&}T03$>}@w;(+1A4%Q23Ds+1
z71}DE(rTVC%vEZanEu}Uec6^A44i4N_vy~=Rk>MNulDclT)}B$A7Ey6GTVY0twj1}
z6PDfDBL`Q*%L7*XUC&tDJa=%jf$E<%RzJk<yqkNwAEd5E(=kl}ihTsE_xB>Up1V*A
z%A$3_G2#1Vb`)6dZKXe~M*U6d0y5}u6^Jd?yxJ428UEO5jm{<IsamqRc)V~-bAsl<
zvMq<b5kANg0O(>ojNo?iK3p~x)OAWmZ-h5~2~D1;S5g<4-VAm0`@-kf_VVMAxv;0H
z-h9#V@~8)aGb7__e+6CdH1t6YU=+mm>g(dYC<0VTd7mV%$5uPpKM)Gk0~y&mF`*08
z)?daqYU*J8TH7vOJ6xH%Qr}_3rs9v!rlIThCLmtmwCMjxM{ijK^5-4yg}uEc(e8ve
z>2d+Hsg_Y4yl`^wdGQEsAM0a*_Bt8Z5^+l%35-ZbUEpT)CO}8^nLRSok=LbFH8M|R
z8=A-8sB+?h4?F<&2>oDDuiN5idI*?sMu03BdB-Zb&gaRluif?7H4byAWL7ui_<|l&
zs3x%{iuPJorsZ~fx7W3QM2lR6jL}kql){LVZpu3@y)_%T!9JB2&L{ULjG=gc)N@~R
zyS^on!2YgLkiKjyUDsv=S+Ot}luQ9kM<~Z&r1A(Ts;@LU8_cD4+$j2uo8)C1tG0c*
zZc7Z_&uXB{{w_(75J%BbQ?+i9BM!h2*0sk9`bwm@_s%POt5fPS8vF@)L`9i2I2bt~
zDlZdb>A0rXsJTsCSIapxx2Qz{ss3lZ90EXH{`Eb{ts@sN8vqeaP6YR|<?p_~Cydpn
z-{|+PXA+X+lkXSj=zBD4=*w)~9kd%Gxch48g=KG^gt|!|yne+!uQSEg6~a#K06|7M
zo$kWL6iaQ%YbnC^*>iqeul~a8<Nn^$rYyx#qW{_gD%ct*In;WYE!l%q`h3g(_<B@T
zwQcqpmT?wy^lkMX$nl^nfEbJF`fYaPppeqo&I6G8Kh;&T%pMai%i)1O+yZ3MYXGfp
z%bvu>&%|u@=q8_(CF|-l?d42x@isgvoL&!{OAss=ERKO$+JA<MYV#nZgZkqsruFz8
z-n4}s)7<jcgj^f8K#Z=Ehn>S#J@j7rr(O9ZMY*Px1zX%1Zo_*_W8coLl?RS@VaC+v
zUx62N4aQT%>G8LR2T&#tv`iOig{Pl2wcG`%CvoLFB;W8KJq!uNxB3{%mtZ+$UsC*h
zFjXyqVJs(gEA8@N^k|EI@&~bCJtadBtS!9%y=A8D_~cW;=c_=vm(iDm26}R)<L2QK
zpg+TgQlJ3m3Y6;zzd}l{0P0J*=wm~_gC>&dWb;JAy+s_;5ca}L`H{utan>}Uu(d^6
z%wO|+z2fqCpr-(SpuYqC%<uJxZ$nrdy|=?aad{SOT<;Sf5ha)JW(w3R;&H%t=^;rT
z*$L1#qHeRL%N;w%G)2j<3M1v!kUklX8n>NcZv7(H8yYvp%AuzHL+p&DaGk~Cjj8<H
z%e$ZlcmU}Guv3vap4z{~QE)8XIW|~)cOCarcpNb|H9mzNIlAYBw{P<aYJ?k~CZgmf
z#!AF^n3x%Aj<mu{1(y{!6NE{xKX{70H55<3o0eg^IR8tgw3LhebJC*_MAX@05`uF&
z<h;k9o~eq=yQ&<42gk%6OpUfnf0y!p;DmSNNeCQkWy%5hIat;{YgNH5a%@0OB;%d=
z(Q9W~k1}oi3*W<HZo+nnsO5+T>?(tp$6p*8m)T)SZoQwLU#44@4O1{VIDQ`7?l{=6
zhIsNcIZ%zs%Uu#~)9C~wko?<(o}<~pk}w!$CM7X|{qC>O-2zzxuxOyy3&V2sqQ1z*
zhAIo+zrXJ1kHESaE*aaiaNE$s7Ays4blc}L*#oQ3&so5RuyuW{+pvk7Br`li%^xo%
zP-OQdqPSgV{$jKGsHmfXDEh+_ygnMf+%=V};Y*`8-$M8ETh9eg4hf~%>utu2<67%`
zk%NiN3)^m&s}ptWJ;UxMoBMg;BqcLOir*$olh#JvH((0=-hzUHi6jiZE70<7L8)c1
zarKEVwFssedq@QfByX3iuB+*L#&z>opaHU2#}Kx1g`0C<F)EzteYz>W1iq+2U-+un
zMK=4R=iKy7YhQrmB?0yB>pi)krO||97u3SZQe>8xtJOR=N|avO_w(R;b%{G=q6h9t
z+X8)&<=ek`^x(M@3}S9bQq;}FPrbeDs5?hH)LF1Z-ylh^BA%9QG8u_tE>iUAZq2^F
z8;T{hw=de~0>LBG>I9T_$>NhCNaQl+CcBmSa`ip^VNW|rAN|!fswzQxym#;-RcE{-
z$7YP7g*VIdOd({Z*I1IMf!C|l;0`PN*1`LCmsaY3O-V|=MJuqW)Y{B(5)$PeP^O0+
zY~Qlmgv=dRdLmn~gI%untt>a4_#Kk^+jjiUm#z%2;%*WiZ}r-usk8Xq%Wi;(sR8?;
z>FS)<Wsx;e?3>WAu$xO;_s8CHy@Hk+L9GHCilyO1+?6IfTjfYQN4?Vul(R*jzb^p_
zn|NDIOYlu+9CyXK;n9%qt}`NukF%ricM}HuH@|5&7Hp=X5~=i!Kg#H>S$Cwk$KUAf
zy}l~LqY%}%^D!~@t*3c!zqP$G&N}>*=VL;VS7LA{Tm5Bhg4bq|#){yURjd)^FW8%M
z#*h-Y1q4~}x&b#R{^NiZ|7U-H$vkSKrvJ*Ln_&f?!%s^a%5|s9DJfw2-j;BW^|)vQ
zr5=s?b6oG3@s9YCcG^z9bc0If%PzkSBIDaAQc@5v<F#HFv`wa?gSn3y`LbQaohq$*
zmj=ukm^2@%?dQIcVTt4~N1R!eL#K5#MsTVOmYRk7($6f0CUvs*u4GS#amOu2T{4#z
zPWOUITKBqWO)}RSpqUBhRo<PUi?O6^Q|rB2Z4!seWTdPVTv9^Op)%Y`Ely0{g9wi2
zeCERn8>;(%w?&<w`o(LG<*u@wzU?&?v)FoDg3y8TX2?VEBWR@oZ_FZ~KQeX-x^!%x
z)ygn$$m+0XH(I|Sy=e~h)GOF!F;$$1Sza3*QHlFY-HfA0_Wd5Cx?qmQW4^OJRfCPF
zDOa?K`<qu4pp-*e+>)~-+=`Gbl7wc$68lvGh@3APUDek|1Z7g_kgmUKq$H!nmTe}Z
ze~X^&k@ywJAjZ*PlIB4`j=s|w`<(UKu2){NWKGT2{KcOQ=OHOFi>@Wl$Q0OI59q=5
zsgTVM+M+?t^&9WYb`OCHl;&^QZ6u;TpmA@B^<XoU$=Ax-nx((TuF*W|1<8Y(2x2x#
z$+PufXI8Q;6%A(A5*Q?ccpIf*E6*Wf_%T*sf1{75TwIfOp{;p=RXX8mEPbNG{z#Sq
zrLH?q%Ry|o+GTb&Cq;s;I~taMxm9!pDZ80QYz~D+(TQ`{%NOW>=#|&I{Y#aD3DdGx
z4vu;PHSlGwDD(ig1DeTV?>{E+7n^63=jTJ5+?rnwQ>1rPjxG_b+RH%Xs2Nk1@5+^a
z+&n#&<!YV&-C0-iM`Le472L3O<t9v8n?Tt5S$fRht|TZLhWaRI?%q0g5LNg75h#}%
zuobJ%q|(XsQgy5JXesQ*>p|3%{bq6{5}r3Uc`HEF17M4l-8hv8J7E~rl1$bhg5y{v
z5vGL<aFu3f+XHkD=!5S+v{cQ(2HNgeRSaer=EkOUW^?1@T@FKuR=X`!#hi9*cRuxf
z#i#A~_a)i{lK*alLedQ`N-CG{qU?I~b?173y_p8ksWzL|B7W8R(-?iY>gru!w={I$
zsE%RLQ<Kci{vA`HcR2%<E*8%shB?hL8hQII!^&FwUn?KC`kWQ~8c0Q1FiW%$U=<0`
ziMq7C`c$CUK(2gV$0S`mkc@!4=jQZGcjSQf7x+o?!vu1C9-AT!<eQ^;9x-3@>L@FF
zJ6dB?1|6;aKVHEJjs(Yx?a68h#%k%1pu^`4$1|rt8t}i^fUPpA@9<O**a{U7*lpQt
zz5C*X4ZCNL`A)~=KMLS3L{rpGh#AsjW`@-!p5Ijr+YiM;bWT3AFwwbLJEv_q6r<8K
z0qc3oe0@x7<9V`K{v(pb1=9W*?&G$Nb{?rh_Pr{J4oZg1$}P2_sUhwZff`*D-O)=z
ze#il!$~fJ#Fo)=JCYD7OV8>?5g(d4NweVihT$_z8m#a4#j3q@wXD=4_V`thr4g*X`
z;m0!uXaO4+QsH?4e!b=zFB0<jM-;>jpN#)lT3gwQJd&l>wt}cOCn*`eyYcfKVAae`
z8kUXhqgc%Xv$39=i=H-|{s_DuY>4-jE`MZ99X&b+elg=|qK}ibuipOAP6FBha77vE
zv?xR)v!VsPG{@`J<s98qh2`(jWo8@>-ouHphI2P8FRR^s;eEc-=_7tbzl*t7Zz0F(
z!+S$s24J4sCY>dJFzLc&+0SM0zGmEvm=%_&z@|hT-UT@b0AlZ8Yesg3Rb?<u67li1
zqm7s?;h&Mqpuu|#0*L0C!(TPQfE(qydS}4M+@DcvB^BSPLllVk28Isw^)6-dKW^p!
zi%-wrp~Ou;ISq8y?nMa72GB129Ue#Ki1pU#(cOJ<%L4;?p}Bn*aB-#0?)LOJd8PNZ
z=CBEq```XMhv#4Lm+cPdrh~bKm}cHvwf3NUX}pf6W669g?HqTB?t=L>+*AgBZd76{
z>0H0%lr%K`T-lke9@??7FQ5KXk6W4IB57)Tueq<db9^7vK>_sDUqBE#*NjgDq(_tQ
z%+wTH7%STv8frK@>*yrC@_rN{UgJHUpe=XgukrR(vF~Bx)Bp)P=*85vJ7S8O-)&oO
zEq!Es3SqL;wIeR|?rW<FKQ~9lQDp(Wdev@Oi~adaJkXz;%G7{SiPN~!=`5VOc%u0g
zvm#Ytf^1rEM^8hNd(GoqI|7j9XFz|-4Ld*oTs0(_Uo~>t?>xlD9LmLH-)8B4Z2N1{
zsA*&V4DBwsQwvRsOukB(2|e{;*m86$xti81bVLB|K#9ga;CRnixZM`UQ&cLg#I9J8
zUCDvV1M9f=eUES#gDY}Scz0%Md4C+qnwcH&Vc;NnEV=a*A0&TM0CEdxSp#no#2I_p
zmcBAwi8L5>&y{3q-Ot^!tyO~5cs0JKk@9HUat!o7Nk&0;J(pB~hOV0ZAjU&3<4Snd
zhypwRYwd-A=q1}o0|iL$maE(7+u?qzzPqA&`H<uisq4o9-jjDU>x#^fG9%!kiXcV!
zohPR1(6~!#2wb`pGqEn;G76K?&MJ8gJZ$;T!_W-p!A-&P=Tsd_+qZp!C#K<Rt%P%p
zH7@)3feEZZu=)}yy^y=0=s&=*FS>WNKMg%Tr80CvuxT?j?4CO@Yl!WN5VW@MXU~jR
zdp8EZ64a6N@gqqBRCmY0W*E@0@t=kioCftKOK<R(s>cGvYKFEPU4=YbGHbusPc*x=
zBXsQ7Z6+VCF2G4CIduVNWMP;QFr$!rv_d5X6<?iFDuEFgitQ}53<^|DRu!o<`u^<p
zOsCs-ppH(cKZw^b4;&vK2iS%^+mryrX5H2iBJRGU&Kuv<bojeVy69yLVQ>3kMaf&e
z??8vLuR8=U>IyGJ>EwK<?#fUdYrP^NXMuf{;C0Z@{!#J{AdcEKar6MLx7yl#r1b4*
z*6V)rVVbYkM~PIWXJmack)A<~V*kEQq?;I|u5I%2rG|6WXHognVhB1F;0tFt?q2rv
z-^XVbvE5>6Zq;KYwljw=-|)@+|3^Q-{QOOgjgORM7PT+NaVv7Ns{ic)z%$pb;V*!5
z62v?ujJO=5^@CM~&Xwr#Lx)mDq2ncg<4V!>j_qB_w8C~kKnnA9jZsEX??t$x6b$tP
zFrA+&`(CYNdR=)Ap&x-jNWe@2TIYivm1yOcaXx?Uu@oW9;IVE30mt^{-gX<PLy#dm
zgfGqsQl#2G2tfz8G2Tn5f8gpqRXHty-f}V9&5fuiD%uRm&%9hIw^IXwI<D2$dH#};
zZMY&2?C<wrcO9K90AV`?nqF(xO&CVWwYj<Lx$z^(`UpdE_>C`&r(wR|3`nc!>lmxV
zt@xd<hH$Y<xjeMF=!$r#!lThEvkV22=8UhV#_}^7)$c__x`~R4#;#|=c47FS7xBQ%
zfwGGDw7ibC4O>>psV^~o#YsHIp8E={lBWkFr?69orju;rxyOxG@mX18YAvvx!9=w%
z3KfG2^C>d@IUUF91^M2y-}iu;%m1k(&;dybkQh<g*VP=L)Zx_k+z(;xec@wxaZh-z
z+V_Hh8gZIuT=4uJ2Umh-9uU;S36S{bn#09HZ0urNc3WOoUI<xNO?CD2Fj>;~va+3R
zfkbDp-@DMOzj074-wi%Rp334#I`P`VTQQn>)*pQ?v}DQpwK@9+k@r;~i^UV(8oqwp
zi$p8#ZrZETyQhkldWC%(=WDH3*!<QRES9z`OB@=RsV?mKSkP*@lhSu|*P$ob-Umwq
zn<v-t0fgU!d)GaJu9X?uH=mBzm7jWA>wBrF9MQSYvE13Ao$!`yU+~!baTNrc-{<kM
zAER>hxG)pG+JPj!jlMl3K>N;8A>_Plu8B3e*E2=h-pJP%K`g&3wimF(l8le$_`VxD
z<n1{dBu}e*1N0jJ;Rk)|&WVyln6w9_r_azac+WdExM9lX4hF?%RiLhinY>Z&u~B}b
zJi7Jg0sM&5AD@lSk19PAZa1RO=lL8r{VTtJUpOa{&Kr{H8$f38LyzhZSV^CWP>ABy
znxb((5(%4D4T3PQ0YOs)*QT3wK9lp41dhbMpUHe$s?yjJ;&29OBi~>W3%bLt3CS8n
z)j_aMe+sWoAyjKdfxT&CP54$6s@_pUlZ)!+CJ93sX$}XAV<2a03+~cl#d=K-<0N*N
zY?Kk`Qtkd6h-SKu()xSawpRA%raE^VTKMujXxi7WiCA7U?x)){gB`%OcUX;UtDBGB
zInVXLM&Mfd124&Wer0g<{teZF7U+6lT8^QE$!hPl&!mmdz2`eB((KPV&7!0qI-P0g
zl!%<>k`)yfLre|%fRb_@K$0uyo6C1j5ucsOy-(rseClFx{m<GPgWRfP%(|45MXf&*
zH>BQgIRKIn3q@ijo(00K5r-LgUO!2E<xlQh9wd3?sb&ee4?bo~lf*8Yc`p0QR$M+C
z97N_}NkBj60c{6VWWO8Rm~sx_WccFXsI~ID<o!mM*sGQj(v_j(8C+o>cY;k`AH+wM
zpXj%b&?O)sm|#=(K5JfCm&=e(cI2|QhCBR2lI32I?Uh1kCXhM#`4&I*9Kse?pq6vs
zk>cAK3i&ig14O+f{wT3Zy#dP2W-xZYh-hsVjb(EMX@u-Yl=}&`QI3b@f)xzZ1>yq6
zjonXEbKxScgr<yocG4%8$AE%Eel6GvUgyETk4XCEnjZk~0T72kjKc&v+(eW0jw4x^
z2H}1F0U%)MpJ*IQ18ga#KUFXesDB_YseLV^4Gj%bQc~D!a&6h;wAeT_@j&W;MH!IB
zfPP`}^3$ug(f{Xv$G?9e3`$5~%e|$S0DlGeFJ%Eo2O~raGbiaZDjyinSgfvH0QBNH
z(2Lv>y6L(oT5;_sEImc><V7G58vvgKVk@q#t*xwdTnyN|tDvH7YNnC%zqbpBJ)*(w
zs6_Aj&SIK<^Y`nG3}{qnb1`kdwz~38K+y_*X3kRPhvNczZ}`vt8zph@`%X7Qess0@
zA@Z#z$UolVI<ygJT3lGkC*Att?0}kKd!{hjMw?T=)?M{btQP``-Yfw0qfM`)l>93A
z<8JyU`6q=v>~Z9*#i{@a=ztg~d7>t_-S_b2$<J+VEndfL%r_MvIdYL6^9Wp1Qxib_
zvFovO^$cDd*-ozwq>1NQ5!=!X*muGqf%q^0dgXm8K%jd7J24u{3r$x$E)}RT>6GZs
zO-*^$e}DPQ`<V)r-;o}4dsgG(_f3*_95?+B{&fn1Hq84cD*?4aMc*116hT{uIeGEx
zF>~xdrXYtf&st0{{S<&S36L3p`Ud3|iegs*Sy53?@evSVf;cN+zfDa|YifKx%&cNz
zVPW#}R|Om%lk+B$RvaMw-hl7~Kt5Z5eA3tCv;H3%Dl@aZ<~#XEA-_n2Na!Tq0ppI`
znYOmJ21a5C3>Ub5elP%bYvB6-H#F}55%XuEgUl%?__#gkn8PlYltjYA&OJCVFyJ5p
zC<s6unXw(0+L{_cA%VwYE)M9-mL|6y8yg!<g|_SSdWyb^-EMk=GjuRrOH;EMI+S^n
zkYs#(Oi)Ourmjvr1JGE3>#gYH$n^B|?CdrZ2!y;nSVvo1NJz+Ls@f4ScI?>N_Rc8L
z_2<5JI}c&yHuB!iQ^wfMHA0Set^R2pL(QLOwYkj34;}QlIGh-7K8L3eeO$d~!614X
z59v!PH^g=6Z;jW~)Bt`5Amq`=&TjC$!I_fl{mD$#5aM8ws5ic!s{c(SjqA7`w640g
z<-E6889Bm!JwAU+atiVckD1u><{3G9SiJ>W3i405TCdV-e+n){)n~J&#=g1PQ&|U^
ze;rZj|0K?#(skOcc))G1lT!GxoruG{KbXuJziLSZs9+i8y?jYXKZP(0{^#Ljz|i}<
z%&<wP?7d~>`(w?t0umxJe0~K85d~*6=2!66=H@?C?s%zay%m|!l$hZZI$$TPD#WkI
zo5l|<8|`IIa0Cib0N<_O+}xgNXgV8B;1HV<SNfATT%`12xj=2r?;s~i`tlJFRS1NF
z-jF|t20i6_-S!oXr=i);-EaV(7)Shq0b!0H5NX~IfJ&u10ZUPSTLZ!g!{O!0KFiA*
z@83@g+06i2HV~Nli8)A~Dn>p#+`@sEgPr|-t@mkPc{3pGfO`wf;quHeAF_!d4jNq$
z4(-v=ZFHk++CL)=*xKB#p0-KQN&xbXwYvD=ripQBO&)ud_NDsy*R6jtk}5DK%S)(T
z->Y@lTa1j{Jr=eHbVeXT`a%9kN>)-<TAJBBWMI2j1ej~jm6{3iY&B8OgAmro!hn9~
zXx2?ZNjvj^f^Ycu?|SEnGT<=K+<cZG>2(amd4iZ{R!j9G#ohKeigh@?P*L=UdWX7W
zg!&R{2g>122aqIh?+rFqj$Dd6lbxN;s{<L>6ji^?Q%a-eHG4mFRj>zeh>m_os-$9E
z^Y-c6oR>-3LM3cVqlF{jDtN8kblHPXBdX$uL0jd3YF+Z`E%0|+6q==FY}{%qo^%LA
z)yfxyF02gh?g9x)&zY#S`DnF7&wl>;a`$2VvKgfU7mEY7lQPryY@>U;)XU88o@;_8
zuj%qSz^G*gur6eN$*38^?NBH5F45Idlph=D**mEco8_LEm6a7178ZQ`Qxr-MfSX|n
z7+Kj~U$?Qd11diM{Vo%1Wo31LY@E%R*P-&KgH6g;2D3Wu5LQz4@p9oj`&Wv3V*-$X
zAp^&iH2d-#wk7{u?PpCJo+mBt!ZR*QuJ$dRA+SQr%k$0&?<L#_w0~UK&$X|d!Eccb
z|0g4pTzImWYi~yg+1-6?f~7!RwGA3!hF#?n#2s@mB|HE7LBI$JRGQP|N)|re1>%Up
zKj`w}fWygY7LNX-m6iIsF=S=EY4_v{ec~&WPB}vT$=IxSAH&TbRejPp(Lv#xr1qQf
zNaxjlYDueH1RL%akV+<A;pca;(5|dJu(PwHlCQxM(7w=vM6z*mKIdX9q~gnVIw<(5
zvNq=<xHVCZZf0>zn&BHV{j@L%ekk2#XBZe5$j~z1Y&?5H1i97z8FlP;(pq<M={Co{
zV2InX-<*@m)pkR652?$O_~CF&jdn-pL_C)V&@OKQ&_-bqe6xNja?Hzvj*bq4z+EQV
z>K|i-SIxgfzX>l$23zijQ;)!_suKK!R}yrLis#7CtE{WWoV<_qpDnV+=qGiw@pxYr
zZTTLw_TCP{ulkQ7r1#w~Ax92<*q!NwBF}1wrU>6K1IX?^cVRE-eVUM!L*m28xBOzV
zxxqR9>MM@czPZ8ff&gObyw-12@9;?~`uwQz(CM*Ur<@ZP1yv*$*<M_7=@zZ=)g}qz
zN)i~RCqx3W0oO6|QU2}+%|ux3K1Q<+hVe-F92?fL<wjiKj+HaS%(m<AfC0W)P{uSD
zgE}-$D@@k1{C0Cg5W=(8<*k=LzmPD9d^p-ITqZ{x9*Gr?fjtjCil$4Lw4L0<kyO{z
z6;CR3b>3*Nggo^nt#A!lN_>oK!wzvUQNcc01_*n(sj@y$mA*)Rl^T;!HY5-?;J-`#
zkc=Nn&u_iT7ssmn*icVTTRk=|E~mc~z!2O0yU^lwWHVdqvy|s9Wa}x{*&VRAG$er)
z2%dHPJO2xs<@cmv>Sd`Bb~BR1joa9>7f6qkzT69=_c;gwjvC)gpA=FO5qBqsoP?mq
zAtIksU=e_ZMpB}G9P}#nPRYSf3lQ;OK@5|swCx!DM}B-_VnOcH;mWtZZ=$5^kfaTI
z#(pOaYsMbH&T~9AS}>UchV1J>)46YA5Ur;nteKh$@@`63o*1;Mxb0ZDrN)r>@wObj
zmv>+EP`K)+{}5ua(lrI|SAR3$qd5Rga45=rN}!)4_W!uDw&Jrok|nm)KXN#*Dd{!m
z>owbiv7Iw)+4}u`s<xJ@?&531%uM>eNjs4EEpB!;3d62yYiS#~Ea2~Bdvc=C7x~h_
zepU1&P6p%2iWv|_`|h<~X(5%|)WxT!C^?f^otK>&gPhJq5-9#dg@thl>9rd4lGSgy
zqulU<eAZ}h1Dfe`j?AC)IhIV&WER`CnQn2O*rhb~RInRN=DRom&i)3K2HC6dAFNlK
ziN>ubfBLL$Gamvl5|-?NZu<uYJyN0l6X>hUa+#VMcF)2(-47zQN*$_7wcOYWz{X;A
zy1kO*hnd32v+K8<B@|0tbsEnc6z3{Je2|<y;XT_uO2`r<aj#9$6OqGF^7~Cov&X{u
ze^fI2!}??Tlln7g;^PheT|dxu{Uq46iuuDEmo{PGGK>#)z?R!z47*M!b}IaMkV2Qj
zmLf=<h>B0q`T{?Qj|&F;p%NavhbkH|qOqs34I@dv!r$KI`FDlz$CvhLUfXuWm<u?8
z6I)r?C2+pRR(5B-V|#0%Z1K)Q!@}(Ws-y`1*7$NAwPyUTP<|-s=&Kr_Z2wzRus^5Y
zayjbl>3?RLpw2Y~2uK5|cR+bs4f5gEtyfp--*!wrz+b>=VrjC|d3%89(7Nnn_+ceC
z4K@b5Z}z0WdA{-=9;Kcchg?_vmd6KX=k@I8y~eD$3XYmoo+CM+C)%ge0=?UECk2HX
z&!XrB;SE0^hp9SRo3RaXuz1mg(+Kl30loi-nW@sg>x_cvgMIA&^{x?r)eMg>Pr#2$
z8Cy$3Zuh<Vy8Og>^<?UG%U)L+``89-6f6Gi;J>Yl{@Yp#yP>)vMWu1l48QE*+yanU
zo)C-d^*m%+{$M31*WGwXt6B8##}gXvOGDoONAi%Jjzd%ox;Y_`RSTZh#q-nrjCb#h
zOx;DAjqG*w<p#!QRndEx0qb$OLrwHacSKHp6bVdc=~ufSZjMWT!cILV#q&H}L&|kG
znVO6r3+JK;>)WuAaycnw)t2^JyV&1<>Kz+(v98#iS;u)U0HnH-pwB19{QL~?3RMvP
z2U@vT-b0e?TmUwb7oc>B=-ob^z50nrP36^4$q<u0-L%0JA22#Me)uJkvXy#)YgbCN
z3&RgmoJ>qfN)om*AG&{**@Byzo+ei}4A4&!RpV1sj_u`c-OwlPfBWWMlIAlrW_-xX
zN_dv=4!^Lk^Vk|s<R)rc@4le<eykL%eWL9Autp;?BOxJ+sl5BR|9)`uD_F+9732oF
z_&`l?U2~(#k76<vBe$KaOHJRcG%d64KIPNW=uj1D+k|~%Sutf5t}W}evRN>0vnTtu
z*<#0?eXqXSQg$~fM-<DD#Az}RY5=B|%=av7|JrSe*CyYeC~ChuLwJcD()aVJx`eG?
z`t?x-YElBrT}88BedH9~X!>U{MeO|G>FL@@RA~{a)@#YRyzn`Ym*i!*o6}Y8-WWwc
zk`-lyLy6|o+t&n&P%xG|pMTz9^*uj;UU_7N26eBvxw-nCNN5)`amWlEej+&<-wmCJ
zi47r&)I019JBvhLb~UNa9jQWY6dQZn^-u1xW;Pq3<3DX0GCa>MfGDcQprfQu<KLQr
zaU43FNwSXJ8SaO|%BL0Z&*$f>iHTH4J8nxu_Q{ggt3eTILN+re$Ug22N$YW8#33Do
z2AmIW1y2BZ3RYXMRLG(_Zv-SIb77a`RBf!R8ZV+Gv+e+~0uA9XFT*qXYGtw*8^b(V
z-mvnjAu+SvbWw5l-LpQ)<D%EpLT()arz0-6Hm$aFaXn!}voODxdV9S?h9Vaor(mh_
z`VU<SL<A4}=X}ord*k0at9LXcV@<Pmr&~J%T(nvGxWz1nO`9zdT&n7To@08ri@8YG
zU}z&zhRm3taJrZ4{Hmq#*(AJgD2_e-R!_#(;^ecnKKBa`TpH$ioSw_foqSGXNX^t|
zIRbb}d>{9Pi)v^8l4I-N?Ko>=z0&A&i$RIJ>grt2p-hp((>=hTmqb!|)_6v1*KFAm
zqKb`1B?Z3I(qkhsAIbY|KNQ0x$L{C+jGPGo9O}jyV@}g%;x(TMCm?&y2a|=gR$E%>
z;*)tO7)kF;f^9E(UK^_DTz;?+KjR=RwE9`vR~^ffj1)$1<Y%PD#5|;mo1ZlEO&DQa
zB?sW32Fh*fF|6*-(Z~;nBp3Ut<V$i%S`pEye+t;lv`i(Bw!Db?6yK;k#$vK&5ME}g
zRROHN$Hzq*WXmi_2Q^qBO{$}F-lkicZE#v`D|vb3My|oLR{NH7!d|6N#kWbN5=$BP
zwrFTJzjRYlkoRE#EQ_3H+(*jIwtcHXXATUyb&{u(9SAdh;qwFgO~10#4Az?r7rR)w
zS@+Ass|HiG%&E%*YU2|~0rdO~lclFucqG-b*sK3)wlwi_+jwGd@E*-@?a@(~Th`@d
zV9v_W9Bi%*qqA-{u7oByJ(_-e^N8!#9gC_n5(_|w-p9QN9~4_p=nVkytM6EFBywG3
z@%ZqGueEngZ;h8<jk_Z#B_amf!Iv$^bFC+BQDPZo=<_4@A&KMW(9Hhw?QiQa61Hby
zvKHRsF);LcF~b|rMaK#w#WxK1uNC|a*<tI4KZ;cS_Tf*;_M&g-kG`W=nrL-9w9GFX
z-CFTOoSYUF6|rV|o+Y(5LL7z?lezeV4z>yHQccprN5)BI_)vcdOs;24{kth}8q;M{
zl05G*yX&i+HekAA*)cghML}iUWbN1fODy9vf#Xzic}`?wQ1-%)r8SkfG=>r{<2EDB
zp}%#QtGo#+m;!(pum%wia(P^A)zty-4b99ionz?nwS3z8?S-$s?(v($vW%N527+!g
zd{t|!Yioe{RQ_%p>**pEP*Eb!pFps0;s=T<)<g|T2OA>@H|JCkBRMj$feyQ(&@FsY
zb<0A`x+<WfTlD~toT>(HNLHREfjPN5hej%zUhST~ht0tP9i3167RV4n=`CcIf7?P{
zqnlHu2rA#3sqkDK9UTRXbuG0(LU(~&{`-`^2cI7@vAcN5OFnxKoCPiih0EBuXg3#@
zlE03On+8Sj1`*6ODskw2NolU32TmuV5~n|SyvqPMn1Tv<IzuHQrQc|e*`A8Bva%mP
zTxaSlJ)6C2dMc)OjH*`0D2+S|Cm0fV3>$<`6mFPlzFSb~N_QVb!6!K4cBZuG&WX>)
zdS56i_T40r<RnpZoOf($p)aTBe$I6_oPpok3AKJ#P**5zXIb(3AccR%%#E}ZpYy!h
z)4vjmzYPQpGI3~-)Qt)OAV^T1y4|+QrW_7lr$5<d`{(=|JT_}*&)w96voT1EX|#uq
zZ`!g_)swTfB7X0y^s6|+T&cXHbFZ;A`w4g8=hdByuejFZVX8+po|N6Y(o1fEz7b_5
z@#rRZOsK;dA5>|OVFFvph$>mE@11#g+QdNH-*hrKZ67DI3jRGj_fW)$w%H4?g8Fo7
z8Q)f7>&#kMSqTipzdAqmyEYXc`1<>@`w$xu9L%ZC|1I(r3U2qE(p$TK;_0S?QJ15T
zm&ZRn-ES%^)VrtbSE$tcIz}#LK9C}a^ZDtW8BQ)XHMKw3;x)<K@0=8pOW<!qB_n}g
zN%g2G?@#^df*L|;^PT%kR~O&klKd*JnV?ZkR?B(QOUrdG0Pmx3Z#k;BOPLxOlB%=W
zV7r#(2-NWK6En?&T$^GIJ;pluLaTERv$I5C#=&2QDEMg|w!o#!Wyuk=!b1Ebb^7SZ
z(aGYF9O52j$r-eV+G>7xR-+Tlt=1m;inM2@p~_tgbN{}|CnfR+>AeSG!@-KG#;#Tf
zKaJ?MbP1Sg4>bCYIUGHAL`Y8P+H_o3S8cJf*7J9nrK+s{bQ;rq@W#z(H`_UpLMvVt
zXG6BCJk)zAnb2u9(1W}iUMK$edcQYTKS{Emb(#OtV)d?TAmiE4xAR$#QJb)8nFgG%
zQ?OkYwaw_k9qJTB&CKu&!dm7jQ1BJuP<ehJhO${~qmCVC&P@5sTs=9WOx77Q9-?zG
zJh5Go&t^71_wCMSd|?CP5p^}yJXVqYb9Z{F!3hiXI@fcfp`|j!4l;o(O2RP9B9X1Q
z|H{_0pjIe5WKHXqx}JY{49$B@*D9m#D2U(t#khUUw4wKcoNJir6BDJUDT5Z-aHneT
z1LSuy@<*EhToS|8{1uWOb~q;qHV|x7zYKU>J0ZSBI{g%;6@34c;+5W26D8_Wwc^Q9
z65X?edzI59v+N3qnf;hwGQkJ(bjpzV?{f4BCN2G{;;t)5)=VmsB^Jq6)XS{77GlrJ
zTcH6he{}Tqr_T;)xwOM(Xl<+B=*@CybB<sSzg%6!>|@Bbnr=)heOMEzw@guS@g$1(
z0UI9Ok&<!JwY2O33ZmoP@Ok|WGt#>?Y%P}w8)?F%pT|TMFm==2;8^cWGB&C_c+_%s
zkagQP?H1wSd~3ZeE;2Sddw%TfJdB51^3=ScFdw5OKZ>10hi%mG%GjxGt{<2Cn(V(B
zsp4evb8J^N7kw<^@x0=}vScwy-mS|rsc_N<%^j~0vC)fl5Q65b%hjqO+&UYB=tk3o
zFOF6E0!74gp#wN!e~ls$Mz}A<3ZFzCjok&CTi?OT9h(306Z?yL+8!gJ<;PRgIueUZ
zd&X<T&>BZs<v1b^0K7zh!S|fjkdwlDYC|qMKMr}1r0HkIrh5(QdFmD!kx1_+YyLFP
zC03lGcF(mCv{3qyDYES0n(HKpO{Rvwl&AOl`(5sBXjqiAuR^&rYhn4fZ;bV^&s4Rv
zwP~nww(P+cr|=)YGzi*~eF+S$tnDlllb*z=XEM{vR&Bc1VbHZr9v!@Fw#aFV)jys4
zOiSYW(<D1Z)KYeunnM;<)6DT3Cgl@b+uPdOVUaIPJ34yFctn@b6Zf8(SgcwM=~Z?t
zlqc5+*4X*@<j|Cun8}4_N~n-b?1=uo+^o}jC4aW*1xF=e&MM=F?OG&OzMwj;^kB>0
z6~o=eewSQmqWjwFP<=h>-C^Uai{bn@pXc^R<U<m$K>MDo@-vlpjx*iQRyTgl$R?ee
zZ(N{#5cws?3mOKv?&7RgF!_`j@pIO0_nF*Mu56zqxE|9PwedqOUVYDA<bEgh$@?*M
z65L+cEEOZ6deK?f+7_H}FAneGdDFlp)_5lO*zxd(^q1D{L;419j-hlunIbD^i-CA(
zB5OQy9C4`4T>h5lR?CZ5v6PIh8JFfFB78~^a4Y(3Rd7G&yl=t5$A@vG7an1f!zS74
zIVVGNV0uT7EN=EUkN0j-(nK>L=9=dG?tD@deqC#Bt{6SWMH}m#(tFcu2Mu6zJ-O=n
zg^|Us^_AsH9dq)2k`iOw(>e+|JYr&ES>U*O_M}iL_<TUW4uIi#6?x~e%kSkv6_H&L
zNlqTE8^~vV+wrq<sEm6hQZQRFLV_b}$UNY4ZLCEgCi?F4M3>w!bGeKuWmyip!wtok
z7V-$&tihBSPex`eO#SSOOZVGtz#WYp96!}L5f6&cKCkUJdZQDWhz_Qu8U42YKASmO
z+2=mr>!#1dsP|{M921(7Oo#KmFp9yb<-!|0T3OCi$wrp}0WC&&2+W>{r1D=Il`JV`
zlI`L`pm<00#vv8TZe{xQcpLxFYfbFqYayN68kzDsW6atp0dF?7^2ZOYQ+@LB)2NEx
zp3APSV0TwnWKZI%c8EHdGe%*q5j?Y1F8@Ama{Tx22OrV8(Z-C(w|S%XhqFz`JsdH7
z`x~qpZ`G4N>(65dGGDGKoPy(cs8Vz@Uw3vZ`uS9sofXV-A~l=PDEfMo0qq8>X8ZTX
zh#|!ODie>C53beEZEg(x{(R4#>wJ>muUS=?DIPpk-=Hz}&HG?#D01((W8Kkf4u{c~
zQP5bjQ01Un)z4RlP1l%&y}ivAS?H3OKi6~-PF}ogur=Lf<09zrUt55)VpmY=o7ge-
zl-2M{PuyRvKj&nx$13HFmT1s9nR836YEQM`Kf*2)O4m@C|Es<83~Op@(=dvN1wlbX
z1>q>50ty00IVvF@1r$M%E+B*!kQSN{N=O7$6qL|Hk!Atugd)8}q=!HhgaCmcHS`in
zAayo=&Np+-%r$e(zxgrwn`CG0wby#zto7c{vo_slK4#0U+Y)^=FE@Zin}VH;=fmbp
zg$i-5P|{VkHnED0sB%rg?d}Au=V0M?bY5Y8AHS*YUEK`>GO!<I0C1hvy4&QQ_L%R$
z0(Q!JTSX8d;&IYgUszcTXOT=>j+%kex|R`USL|QO)}M`5ma1Kd3#{8yT}I^Qlu#M-
zarnSABQ@84!m<^!a6|kG1rfRY+RprfiuokS<gRd>d2dsx0ed1HcZa7}t+uuX+A++m
z#OZEmZ^Eg>wESC%5`57uvha=%af|NwcpbwhePpzQs?KBYEt6JV`CjqDqoKP|idDiN
zGBitr+p{sZ_A*X0wt&A)QFTY+!8Kbh`)-@2x^;xuVf6~K6UBTuSDomLNPq#qkL^1-
zT<?M{ylIW0QG3Rk!ovfUPfLjpe7M<A>`tzjh32<)hKP<H5#ffHrJvn;BVqVcNb8}Z
zZqf}`%K&aG>uy+><=^`$7J044&siTs`0w7F-}r3!IASt){mMs39>SF0I#1$h9MOF{
zH2Ri*2<`)z$h_|}#z*DH&93{iqZ7@rF;vo_^Xq30AYNq_PinO3We8We&2|XqoJ>JD
zou8sI{fMpGo#yz_W&{1v(XE`LVqzJz81#(WS(HI&Dgtz8JT}EJH13-$gh#~?w)bWt
zr*@YYsQkh}e>ngIO$iaVGIX;g!D`Y9AM2}qo64|@BXw&m52l4h5GXzDy7VHd!jHsZ
zqWYONH_&VbrKIefzQqi)rc16pqweu1mX_$7vWCr$tNDS7u6{Oc>0%t#yOW{Hs^_4L
zgZ*iXi?wQAZ+<*`Ji<v;(i_3m8dS=w53xNO;2jHEhSh<z5?8c~r+>53=x9T!_xKEk
zs4mww7JA>tsGbZ`TwEI_kFJf@0*q$f4^)6%E^e!T&23gokhg>100z4+qorz=uj;Tj
zZdLx|X`=RdIYoTOl2swiN|Vz*OA3kG3R?VoleWZ6fo7{0mz}9ScmydzWr$maJ8w;T
z*G}@}HH{r_R^Cd=F1@jKDcC4VRsrSyK&mwXDvEd<a9)DLOIBHC-@8=R@_}h1pqO|_
z%9_J=#f=OPv&dvv+^EZgb#pz&0BR*Ft@)z4is3`gYr(2#Mhi;^J5}O^^J&ZGbK1rD
z(W7@Gib_=zlVjvWu*fNsT<T1ZD>fRda5{u{4`W-F_8ehx5AQXv28&&FUv$r!Yg!F)
z5-h0t873BZGQc8Wu%2VL1-r5?evcSr)4vy?+=yPR)q0Mw4dy<<(jxP@?zgO)@-PY;
zBAY{bO_99`Cl1dfw4!L#`qCEdAj-$HSvLoxpVTdHnEzQN>d@ZbLq`j;bJt^I#Bw1n
zHgy-W&{harEUqVi<#^Ir1qFqz`U@>;+XAGPTlLPfyQ`1~J1fH?2v02&on`4)9cia>
z$p_N?S*x_x6y@L=0qzQS<1+|z^z&>QT=tLW65zF@^Y~N3tpMgBukYQXbFLj7_1q94
zuBHe<e~)t?ExDB*0IYZn4+BPX?@FL6sxw5sDe#rUq;wf^q5e@O8^R9*vN^=76YhNg
z!7MpdxOl`5t?ah&QbbAP9@vGuIY(XMT+%3)kes9!)y1N@GrDC7iWQ8LI(cE&=@e8`
zT9}6JJ#im`Ozud>m$CZt`3$61i&6V@<V@4(kvsYan})T_*ql5j81+O-vJzq2cky=j
zt^B$bFnCZhug~sT1*tOkd$sMgaeZ4~+QpPOBWn#eYIg{+r-1DL4p_)UPni6<ZWh!o
zB071neEBNRHQzlm*noQSMIj*xojynntvq;#!b;Lw^D+5zw0Wutp>Ie+Nx=+#OQ-|T
zbMJC<b+n|5%1dnmskag`HJ(X`)VOC8f>0s?u#$C9KtWDUPW?xA0)(shZ63p|A*VQQ
z(_ix=zG6{baD%%e$Mu(2_$o8!vVhFBNpTSA=}HYvOrj*m4W6*JR%|2jro=5Ay{ml1
zzs-V+`MKyhg`Z-B+&@2YE+PeKa+;s5iiC2<KWH5+;?5G8LBee9gQ?!Rx@Y8123O`p
zE9q^=J+ygfJ+Mtp7ym0!k3uT-86M5}wvliny7!Hw^wlKc?2A4F#VRR%fs|@$Dk>e@
z_U;SW)Z<x=<y)qd|4InIly{JN`H@GH@`q2$j7b$?NhL;bj`F%_X0n6ptCif{Q@uCB
zLACkxcHKh`q%XGvi><dSNPpJgFY?xWE4)1?E$!1eeZjiw!C66vA9n<*e3MOk;EA}v
zuKer_zqu+e`>cIuZRNfZZ)1myM^_E_R9DGl&bNH7P(UR=oqJ@T1rfyk!119~o=kZw
ze;eH|qRyE#VhE^VJnbFtX)s+gB*55gFA{|g_GhjpN(b2dt+QG%r5o{r8MVIf2q$}(
zAoB=gwvk#eJ~!v`*HLHeyb(IXXGsmLiWq(z*)qNn=vuMFA#vHrmsVurR{Phl2Syd*
z@BUnZSLAN#Mn-{NoUfvyA21%3y4^`f1v9yX^fWPJ<$1b=i=5MPI>_YXZFKHQaf3@i
zL8zsdENeFE^Maei%AT^Hx2kE2TYx>Ueww<hf2IcCBS9i?$9G5K4bVb^B2O0vQ~kfL
z((08&_!$EGV1re5Eh+)RBNgXp9^=aPt@7O6vmT-SS0KIy4I3Yah;ahP(8g!4pGmZ)
zd2JhT0!B-GoG=;IPiPxQrb`TbIq&J-7EGlaL0HMwP15%=9JI4vAA&T&c6_kVY$S(W
z^R{UizoYuqrqpWI!gQte6A?Ts_aGj_z!%Qb_ej+(i_&=Ee4HW#noj>bCQjSP;<a4~
z(v&KmVT$nz?SDc&d|c$OXGi>nr<6ixjgr3hVyF$4#waB{q50KXU)RczJQoXWevp=;
zq~)}j2HiZZ?Xwt!;o%vq_u}>&iE3cYt@0*aPk6{3Rb~Gro81QH77}+ItaHMkst-Z=
z_#)@~4eM(ywDiD>z`no38#>*%F~bT!s?DB;jLKi{I}PsPO{1>|*Uma~fP&ciwsWIL
z4Nt&)2fRy@tMwo-?T?d`Ul9#*iCpaUacK_@m%^)|8FyIp{6n3q3ROO=X#EeY!2(iJ
zbYj8&ZE8GMpb|o1xngd_iFFmcy&N#-<<lym`rRwjEHF2-euWw?jd*d&14ptL%?uly
znVnE#G>WBjnsBAwWyCFfmh?GvU$4ZFiBYZVPZ;l{PItq!k!qr%pTkyEt^aWPMQjn5
ziiSmQ+C2`w_vn%|3DP_7vOHWbccjtnMolkEvj<XBMpZ00c^&!XRb*ta!e?l)`<o9W
zU_+4@zDPq7aqP77iY8&cTsYC_Hk})D1%LpM!?CiepY(%Eh@u)dhu8!C?;&jqg_WcZ
zeb2VnhE6$!fce>N&vVD}xUPqFEDmZMsWU_N1|6r#gjD<)6aD-h>tH5s|6B1Cd^iS^
z5N~X@Y!H*Y=)sA9YB7jgu7yP1npgb^b#C`Q7|_G*%qKlUjJ?bed^T^Y^DAe*Y&iqt
zvX@_Aw0?AXxLb{wWN^oy#?1!zTAL+qiXOPhr}{mg+5FQbtXn3e)gUA#7@ip99&T6_
z?f%zf?_RO^Gw)S>Mit67*pYeMKKbxVncau|V}DYP@H3bVL-s8zv|q#Nf@hWH3nAw0
zEPWXqJ?8l=H;FIK%%2-3q&=|t*R<vI*6M@|tiv+*{d=$Gmj@!X(gGN>KyiKZMx_+Z
zI2JD%%<{sL)F3S_T4L6o93!GSvyq?o5!Yz?4l>j%l~VJfG&B%|iy-$4&miUMer8+M
zJHBD9(~Z4zZqD`SMp<QsYSc`@J=?B^tcKVeb9_6>TB3(|h-{xpxjJ!tkg{HT`7m|2
z2X)^eAdUgFAwJ1y5``GqP~*@XpL6)4BnZiulT;5ito^(wIuVq3!9q|C6xa!Yp#F$3
zI;YR<X-lv|TBDe|7P|_CM%J_Mq<c1+pMz|T5bx&R8~t%g{q7qD|F`Anx`9e5)~?{y
zC~jJve}cfmXbE+?v*DwXR|1cSn8eytEpoUr@a#lJ-D1WqT>K#84d`~Y>CF7ALk{1)
z&ZU+jFn!lnd}~0G^n*l=>P<}Ffew#pf<1COGQ(tf(5J--j5T}?J0{B;lYu?6R5w94
z!C)ZV=}I;C16I8n0BU<o$wH=fR$qNJGvalWZERyG_M7OM@iDXPv<jEj&$(CtdZNvJ
z>#E}~dDtwPv2AQ?YrExK$59Lx7Z+b<^g@n$eopd8Hae?cvq4hhj(>uH*n~1X%4#;h
zsE#F)!O(lxCZ>~zVy}%<a#xE`T&hNOwRa26!+Nb;2{n~(S@Cu}x@eoPrW0NK2)yrF
z^~U0JFs<{_V_ulmSn$L=gxyHzUy27y#x}@FGbZNL^TtBjrYM`!wP96~>uadM9PgoL
zxoyP0Q@(rR_N|WwNk+;~^8u2c*9!z|=~K4@$Iz+9e4TBKlaY6O$T(lKuZGDqwZ}hZ
z^Udh5E3G-aw}!6W{dUGR>-7H98yn%W(S#&rP*r$Q=Gogz!BeGkbAayzq2a<F^P}u6
z6|bL9myK)i-@jX_Xl|!0>dflFC8HnZ>YYl4fR;}mf|U#h&@)6Y?eQ8?iFv}PcrjAv
z8+jiZQe-3z9(=g7$#^l;9Pi@cyio-jIhFP%d=6f>O_>)`H)Aht{;iJIOe5nE^+&so
zWt0^-tX~?mjNK<A4ab$SpM$|w0bPO69Q+9p?+C;qDU-9=$k^i>FZIpnSna)CdjprY
z#T08+LVL~9-tKO^@D0{B^`rqn$tH#32hBKIM;zaVh0g(H$b+=C+plv5aNrM0ZX;Gk
z@7OncvQ(0dk|D|SVeE|k>MvV%3mB+Z=%I0kx{Gb0h6juqw3!WY&Q^bm-SB3fi(U=f
zovgBQJ}JDR0lEUke!MpLP^-c>`B>uxD0``ln{P+0u9b|Iy1d6jgZ6=y^Dt;>i9d`P
zv8U(Tguc35qn_Voj?XCjI{eTu-^*>SzS)Z7YJRUNy@Bd(apw|y%bkc6Ibb9u|9Lf*
zUH65r>Is}Ycc%@eqd9Gi?0i(4%7)*SoU+^XVkhxbEM8AXah?NZ5RnjNI(X$>Ltvq)
zrR6z$#k!xYFUOOuC9@8n2rf#CxEvhwnzOX{c)4nA39N-IEs1d3c@QUfWGaI%Uq-7l
zw#=Q<IY5Ds3Do}c9j;X6_u^l7dYJDkJ^xj&f6;r1Vseogpz5d>w1Y(O#vDI3b|U?g
ztdBenS_Gv4yKqB5r&*;|5HdKdR_-wOX&-7^BD=G%(hN=Jc(ws?X}*}biOe$9mRG$P
zd}8nA^E(Aas0q(g88|(IGfbf%zwU2K^I|y5ceP*WeBHUg|M5Tq56_`A9nHUuJ8$j-
zXB{2iBuT0pTPCKZf#BV4m^lYY=zS;>TGaFep1xCXj+{@BGk5Lmcc=A2AdxE8`Zwft
zb&kMx>Xy7uGf6!|jC@Ok*~HeIS%bQL>l4fs;P8$F=nY56v9C{i;eJnGBXjdS&SPKs
zb}IPs+yA)+|BEG1YFMY?I8*by3?^WGw=keAf2iFJPryGVR1uIeLbD5V!$4ja{B&%R
zn&HV3#?&}0{j;I^sTx2#?K?GDn&rO9BEQgvQ}B_E1s`G}2E$pe;p%SJBop2dJ`oBC
zr3C+HXm7vk04}TsTldWcWC|_P+QvD?GHbFv=Xn27za7igkNZtad>E-A>=>lwPB`JJ
zbezfn3SR3#hR4~mv#L43^z}AIZ*06rtb9qh*sy8PnV9~;FeY6o`8F`{NAF0+3jS`G
zfZe<b;B&&0d33*g&AkaT9BoPp$qkb0FYp>3P*yQw)TtzQJvK_7nOTSr%k==TrLm?%
zP2ob|#m^@4<?Rw3h>qb7b$lwGrA^C;|IKMRd0Hm!-{GD6hP_BuB<}j&5&el%IPQoV
zcH82>XSaCs=o8g!I<7bP5?(-?5?UfQa<APLTfgL8>!_Eqqb|ucKD~CvXXnndqX^E=
z4E=w@aPQr$9GiTBEA!O@9F0eP`I2e|=LayB8@yY*w{t0F)Wu3tJ(Ds$QVTzoSLp7l
z8l;Qffq-bX_Ia({NgBSCx@sUB1hS;j8c1Lys>frkuci+T^`GU<hajhbdbmZgO}aq#
z7uh<8Wldrv0XXR7<1bD{NWbrQ&%Xe2;~{`ZI(hPBWMrg+O>_Hqrt7ABril4$;EgN1
zd;$@giI7nSnYo1ex!!Af5il0pBffo=o>~SRv491$hS!wTIn8ln*fXczCnO}i76@1G
z>vXlgy1F$n83eknM*W3G&42DS?NGKq5e<+xbAEoE>Urn0D8DH@<-r=g=QfVkfa*$K
zF<qM1hpH%(lqLSJzaN4y8}XuA(Nuk=mCGC@RRemOzhf{^Sy@2bgC7P$;=G^~rPhhq
z?@m^O1v>S9f*b2yzFZlPIcm0Cg#12xZLE1>l57RjV6qM}=~54Lpv^BMrgZgBXdtRO
z7h~;POIz!$(Z9%|e}!Huevw6l9X@<*nh`pP$2h5T26zw5YMRzaMt9xVRZ=V`ICwU<
zI<>pC_0#yc-L^K0k?Vv8`IR8rAdFRX{U&1`kP_y_Ht%m!`VP{R(imPDa>c6s$#7ZN
zL48~v7~20H1W6uN)3!U%{%cQs4-{L+czcuUaPT^Hq0GSsAn-g2f}vba@PS!dfB-Z@
zZCHR<DV83tFqkRN_?IcaTC1J9W_Ne@A{p-B=n#*=L`i}eN%oHZ>HuCXC@+$7-Dz{s
zDebB)%YSP5Gy|uEU0R20_74mU4EANc_~YLpaiR-VvTY43thHY#A`tCo7k%fa-ei6g
z8ayQha`^!){-FLnnR4_II{f*%XRi_pTrdnj(FJTlt|||G<6WH;zVBpe`l-b(cM!+@
z_P(Z$RTn!xzB<v`A$bFKA7%zO%TH!(omBo{*H{M}3)SF4o74dW7y!dz9qhhX;ZB}Z
z#F9kv>*F#lf1^vvmWk7ze@%C#Fh>)ujkSy8P3{?KZ~d3RD020AHZE`jb0BwV+LGf>
zlT+AOnaW@fr-M?h_cf=DjGe#GPV{t`NdfTFd+F-ch=<7ygTp<gPRk9vOgag8KtFx}
zfqY5NIPAor)_(*@Ls^L6#D%wRBQ?GNY93rh9vt~GEKE*N|77)#rnU_f<`);Qd=yKi
z=ZmA>{{mYHqGk=-n>AlzwNUrLi$8V<I}nRfD-Nq!t*N90TAdc{%D`>C^+2E)uLl{^
zSlIRk(Cb+|GIx<kBtWMBoG$JuRkqKc<VnuGb~mP8@2YiKkeRQ0u$7I2tEDB2aYi@d
z_aqjs_SNZzT=G}~cnE_Njm0*8t>#X?PZ)|*MVF#=HT=FiX|Qv@+>=WKvDfYA`|JNU
zdy{Jm%yeL?J*uX?zVTjf7~luFi&9)e9$^J(X=$*MK9V1OK~Y{_LCVz7_|b!h(TOQ>
zG0C=-vN`h?63KldeIrBtl;IzUs*?9h4+=H9K<|K9pH+UDLRwTN{~KR>aGKcJjrU)O
zxgCE*;GiQ=uTMh~2)CtBH&5?w^i|DNcY!_y^r@wj?}D)Ppt6`W;j0nDW8hVga;)9&
z8M4RC$|)T=6twJSfkURLgxZE5_FEhZm~+ln(A4(pRjXfH`X{knv@;shf%VuLp2xnU
zvVrxNiiCMGaDuD3U;e%17o8KE^;Jdpo!}qzQ<T?!xAN6+jl6<_6l&cTdbmm6aoh*8
zHLifI?{;=H$dv#wnnj{gKtY>TCH6pkJQ@qRb!(#As`iT8zzS{7Y;!?2cGo9+_+Kgu
zf?SkeK47c7FaPd7ENLQvYX!^3s$MgzWO=-W2?+eA7TdlQx)PG|CZeoZ;bdgCfStpo
z>r2l>wBO_f0{%9?0RQ9EAEFAIi}^_Ch70ttw9x4SNF@wlo~x^$r0+N~f4THeI(}hy
z@7LKU)05Lt63X824ar|32<?ZZ{@*F}L6jisDX2u4_()N}_LNrSv17-)ihlh7?+&$p
zrcv_*zC9v&W?^C7zpjmtw4+q`_5D}ncC&Kg{n*jcfHIZ%)sY`{fG%P?0C0`zGTtHZ
zqi+b`+M)Xmv{kjZ@6qbC75r4EcGPh|u>^qsr)8er5s10;LGR1YPp>U>b#<G@USRS~
zmj<fy6+#jt_;)UlejqZU8$>0vNd-S4R}|v+=p7+6hw$=WFr6<ox<6Q5`_>I0?0Nn`
z%3#vqo5`-E22SfxIbMPwOlVG@b4eLN&f!J*1tr{^-A#bc@f>yq@bhSk<V+P_rE?>R
zuR@b)PGwP>QIU!bIe>-%Fz5k%nt6Ea0M%<UHQlFw0<GbaZjtP`W1*zy2nZvb(tQ1N
zUCDrYVd%#IU{emr3?2h*ysr+^L0T_Kqtzdkd1R=Z@G&8L269{_1yPonISEX5kIKQh
zx%ssF|B!pkOifQ;Ft3|gP$do&BiX^+?aJmuPz}d|B)+4fqNh;fuOh{yYMpy)Qz~JD
z!2hfr6XzQafRy;{wE#RJS=AcFF2AgV8-6@K?f*&8(c-_;%NXhG425_9qgp2Rk0ic3
zyWIa5ik&}wUKJ!d9B|y}h3MFVUp;5DqiO?Q|D7%U|G)iTy7m8mxBQ>%mIW>_f4JPl
j{RqIYooDaPLXDS)cTN&)_dM)Zkkrw-uUT}{CiGtbQn<lB

literal 93546
zcmcG#cT`i|6E=#XfP$dX1cYEgkX{6&MnQV-pj4?!lU_p*1f(O<5kl`py0k<@dI?29
zYUrW&nvmoke81nlYu*39td+IS+9x@C_UxHwW}ew6TvJ`))=kEnL_|clloVfS6A@ke
z41Af%t^y-XE6Y|yM7N2QUcJ=y{<bxHBk=x&5$~3cpPm;|`q6+LgHn<ePm<_lRn1=`
z$FSe(f#2C4U%Pt4`05P#rw{FS&l(^6WV>N;i~er?3)W9B6c=wVesVDVO#Nog>P@vn
zUwmEEGe74#101TDvF>$^=joC5EKZuU!QS`1yij@Sj_;-fTH;{uOqv7`1^ARd68!JN
z?&&q5e^-HYvi!vVuIvQ<FAt?&0p@vOu(7*~z+*P4?mz!9Ihc_y>dbQg{xb^M+t<d`
ze(^t3bF;BoJz5_{N+0$ww1<Jb=RY<!ijfQ%|N7r5W|w0oT6gNFotpPMnHadyc<e4>
zv!Z$D;sVX^qJ}l)au)Y54e(<H)LDTj<*i#C&eD7H+3m65{eB_jH))8CuTAKC1>Ki#
zXFqX%(q+HTcz>qFXLK+_g37pxfZ3$%+)c~O#4m#(2TLG=1j&#$na!nwOcs*fIGwM1
z!QJ|jcxnm1sWk%DEBK(ebT9fyIg(`Md~H7H`amUodmM*7_c<umDa2nq0-g67z<)71
zPkUBdj;;>0x3^2RN~M*sxmi8U_nNM9o1FRc=TGWrA<S>*EF7I_`Ca<I$uf4O5C>c+
zY%8iSNAX01a8c|$OK>Ey_gRP*ZCMWs;E%C|o%h=Y?0P|yg*)em=8q>(AI9_yPEU@j
zPZBba(wMbJRFZq!sp||R!Y}{r@S2rnuH`Ov`_#l|Os|%JhVBnTvHb|4qE06Gsb2u5
zaPFl<tQ2O=4~lEGWgo1@^jHb<K|8pdfACK_+jyQdqSe2Nxq159q-|)`FFgiUFt-0p
zFF$Q=Xnv?b&2qZInd$z$&#2>V>@EQ_0Z&7s8FX*7Q4kSjMGq^zxpx~pl}-I)Cyn{f
zoog@iYK&jfuwg29md1IftComCn4u(|H<?la7r`J*uB8UZvRp(^(7&DB^uzp5T8Vn+
z>F*Y@;)!=VBFUc*Yq(`=K8FUx!{^(>U}q;@a3Nu-f!B_w6|;z=3W6NfDxmr~T!q*0
zMCZoByvGD&!rrXZUVIyjKckLik@m+NF^p%5IM2D$;&M%^U?)7&7$o5=R+dV-JB#t3
z`W?f68P1=(_hkiZN>W>gI~hr7mTzf*4{Q^9S-kg#uycfF9+<jkJ9!0S>15jM=oeE7
zrU<)(-9<tdz-w>Jc@mZL=dkt&SDXjw({$XH1k?uSQ6ph`ius}Gx%GGS6tel|>sOsJ
zoYqFbKDpTszf)ei#KB7ozNf3Id>qXWn429)m+{bK;<UwSGjrmW_rmCD@fkz%@L$Zu
z0tmmbGu!-h<YJ?e5W3k^=27pAI;nsW&OyL)>zyY1OKLqf$KRM9_huw-d!M8(9ZquF
z-|;0vVCpJ&ryIO>=cEjbT{_Ux4Hez{1)_+RH2aF|jAr<O8L9=F8S}192Gu=WnAuBz
zQ-ZJA;V_9O*D{?Fe8LgjTWigajYfIz?#%j8GQY<E>X}C2V;Ts{5|mQjWR`EP5M><>
z88s*WdB?8F=OVdedB3moOmFkjl==M5`(VKS8bEQPZ_;~rytnO91UPC+8}gV-6z;Lf
z+<@@(^~J2)W?GaVqEJnQPA1bA3l84iXPJIG7Q)%Oz#65+b#N2N3+$*y!@=~sI5+el
z?75F?*NGzlBJv`o#@OpM!K9Vg5VMO801#qA9Nvjwy9wAsiJc#oqkjvW{g={hk>hUf
zp8zn_cg{lF``Rb;)&NbcPPwDu5>La-fe;v5Q+sH?iz^47T{V8b-+)`2hAujmvAojq
zAC5Ft4Ee3V0*R_4lbgv^h@Hhx?dDh=&+IQDrLo+lBg~b4Qe(Y~x*`I@z0kDK-WAt`
z0nhE0sA?ne44;kST#E6LfVQZv@;DRv#-*5P#D28%@5CzLgCfk6R!Dd=Z$ppxz?cxe
znI2&O#T65JB}rx<Q(V>85yAc>1^=C%#$GzD-)?hk9c6yCC~k<Vx~U0M!u2M7z{bYr
zX2>F7k50%;DHsL~t=O=nGWD7*b!trX6qiWsi0D|H3=ii5AkL>R>HOR$L3R93k}N~9
z=1GXeuK#48nTSYzxRcwtzeWKXB)w0i%OT-+($9y$CV%M#T)6!jJodGbSB``Jc1q_Z
zwidrVxkSLTSbR#|;HDD-2e_AI*%gj-HFfp652{OF6=IB`d-DLQGEe&~e^KDPC{lfL
zxY_{MOIo?KG-k0Nm!~D^9ft$;X7x+ivSIhTEWTHtto166@i+baFxzI|x2u}3EehY0
zb60Ws=46!6w@Vm@CL=Q?-E4xi@8=6!xdTpOW^wOF{Xkaa(=_@0vR}c3rAV{;jEug!
z&Uk%tgD-PcmRK|VIjkylUvih7(1nzQZqV3&p`Y_^#|CVQ78VwoVbdmb&mOoiby{|1
z;<wPvrJwd@E1NA(cTDU?emqHKo4d4duZv{~eSfd+MO`|1t!>&$|FLR?j$o!cNI)~p
z=e+X#o)Q>_IK8^~N4ws$n;eN+jb$OlQ5V0b0}_Pqj%5T~bOjtW1YmJxa%&6uq&@^Z
z<R}nzevYj4xtJd^pSe$fJ3}Hp7%)jsQ-&L$D9CBQDw5yu<w&s6(?rOEI-XjC_IrMp
zalrYGss=KfR=?r7H?B?1(sG~u{BM^uus=joH_a+3A`?AY&$_bWdu$qJJ(*@N!&A+8
z<9;ZUo#idhQ8hkk?``2Q7T=UQGO2Ew{<SNWk5f#bQqUJH(2MZ22`;ADA0M6A2QzH9
zL*dq#&dMKe!BS*ikae&TF~zN08XAYBp2*Brg;*Ag?We<STk~z39GV$YeyfFqE{zG(
zEzCWFBw{~(H($f!b35ZQ5z&zPRjOi&=NP5iW5Pj3P$(f<%V>2I)shYv%#JsYeZ<6U
zfFF4<gH$(S?~w47<%92E^y;cU_^hO~qF`Eq3S?7<`O<K~KN~PF3+<k|4Os$&erc!4
zkDVo8q2QyBR1~+UT6c~s35f(8!pN@#;u7`bx%VFH?A-Y|Uzr=(!;mUjssl++g_=yj
z<%u?eDs4ktjSBs`G;n{w0S8|Zm`wy6V{!EL`zpp`!VD@kdzmO4a~rl;cAc1=nSm9U
zw!d#U&U{}0!02aMP=pOJ?s5-b2Cy<#(So;1|JFnNoXvLox3<<tZ4HH;nvatb=j5)}
z{s<kXTVpD8hOu1p<uJ6=<h0aUkE$!TBCXl<;g^um3JbTOV)6a#q#)|}77%Rv(N5Cb
zj`Us|mDb*8(J5P#K==Rxla6RU&*!uDs9Qz0e<UVdJK0;(_&(ma5Gt(QTZmsVbH-In
zt4uee4oj2X;qatj<EdCG?5;B;eJ4A3;%w8YjO|*%Xz{dD>+x!G%cpXU3(YPnEGGb?
zFB_0jUO{?GfSUbJn*$aU<}TXz)1d?^g5sMNjgQ;AgdJxQhZ(~jbmMATDfpZUL|8-<
za9wklq>&87898CIk8pmy2{zX}LOQa4q*V&iX*`>b1w}NaXJ+Pr{nIO4^6c(D_T^YA
zs1j(B@*`oE0Q^Kn&ye@)Gq##{Szi8%O7BdEGob<E(D$8Q`t}SX&5*}ZBPyV^X(tQ8
zbcmDdF(PMbNrfZFVXivW<11Iik6)j~zm74(Y@U>hr0rK{NUWcvZeY6+_?YR+*3~pQ
zFZl6*Gw(L|Xs;dCd`Mn)m9*kV(AdU87$_UDLJFP7auVW*v6W{d$t9VZq5#zSoes*t
z&;C?dq6a6W?YRPqmck&k=^}?_ABFTXM}h3g5=6jiM8zCb-=pnXyhn!=XvUNfgU*J+
zK#sF-oe%`S-9k_bAK+r(vptaB*@L5PP|Hc$S$0t_Jz|*+MZkgM*4KR|no-QCLsAgF
zT?2|S+i5;E9e0|_;<BuJtdxW1MtV$ep90DEV`H{TYnmhx<3^7QT2c~T(5Np3yY1k8
zG05VkhN`shFRx^z$0Gx$QB2fG*r^l4h_Ck7*m7?%1fZiLt7p%jZTaBQ(%4B2LSNz9
zfC1dq!cPC`_ksR?0Qzw2aGXI4z8N8rKG2joF+D0FC0u8{x!N8^MHqA@h^%~r;ZtGT
z+uQjXGF_t<)&1=~6Y!I|SbT@sZy35bS7W$m|H~tdk^L1YHnw$}okBJjccud&P+gd>
zw=W@*Jr_0b-MO*Gkg>6&iqS%KAYjZL$G|Yf1}%%UwHl;DXg&zJ3gVy(1eL_!Bqb$X
z8=OovnpNz8u4^C;GmeCZP}ouge$z#(<JmR>myT${rlYtaWV46AzsA<|mYpAd7Zcws
z_iQol*+<7fFF<&gu9$7qA!cGYoq%sdg24EhH>iVliIQSh<NDm3VAMV}816uXT?Rup
zrtB-HTJ1$k`>m55ZS`_oCqLq_q!_H9U@8uKQqG>zL3O-Z_p7s;3}hxMB{WcSbPAhi
z6D*0<TIYt_F3vPI?_hc{wrN^fC6YQk!q1*}m(W15`?6XJ3B5b5r*r5`3Dc&q2v>LZ
zAS0n6p#oOTqq~y6F~))*@eFlm6x?xXZB3{vGZkrFb9netf#T{FqQD&*5_?jil0+@e
zY4>*ZCuBzj(s3-1Hr^@GLbt=dvAUuYJ!K;{cdA)fdDp(mu>I+ZA8#S^&BwJ>Dt&e|
z>H%Ah-~a;dv<u6v%twtLjERYMnyO8`+CM)OXOYKI<M{XcLI|I)*8S4%0Z~MPwq^?m
zig#UMaG3O4+s&~%0-2r3T+o`*4>+*9)4f#a#OCwGQ~m%7si!GCxL)vSBQj|bRjphc
zHDm!k>J%MN)fgr1L~+mRU`i)y0U$DWZ<3T6?TuMx5{c4v{i{IOsC;K>eIxqqNGxJo
zfq-$w@9=?7M0c?RDD%W@<-4UM`PKA@H95Z%<3YaV(h=baW9zBQEMRHm>b|Vh4}InJ
z_3iv=W09`+GR0d!IVHx@b@s^ld;uu$*eD$~_br_veN?!gr%0qNbT=53BV%oRB^L|x
zUR3f`3=0h_Vw49L?YA``R>weRt*Gpbuk0H59tAwgFJRqd|5L?83#L99<$nmfm{fpY
zn3<UzI!7UJXW52@+1U#y9D<N6_vl`+zI^dk8z~D1czz6ZY~uc6rexn4Sj$wth9!_w
zE@UqlAXbH^>m8dnRm?Es`Q$H;s3<Oeo<a%f0cT+zvvH3X;8;8siQm$Q1^dmM3OF(X
z5&6$lTbY;t=l9kwoRQ(xe-Um=$MOA+|KkFFRt#GQ8~IwDQ$K0~zlmMy)1t_YAO6^V
z8JAoHIC*nB>K=(7=DJ(uX*1=FZfaXZ9Q?IT-p-ShFLv04LlR8k$K_agd3g@jj=IVp
zIl{NCneIYY4-jcNuZu5eQL<Nxj}}}6qHkJH^VL4&s6-@6JNgL6!n;M`>uP{I(zmX4
z9IYgl*m5)WcB8EGl*1C?e3*+P2Gg^g<OKS=r3~ARoycH|Ju=6%C-!%=XmmF3bvD`}
zcSP|+RNCg)nGCbPO&<1aAeonudZ7oMYND-H6N7#3YJ9UwE0YE&S1!3apn6A~!m&3)
zHqr`yQ+Zr`uawa{V|1@y`W}JnPKSECyAy|0l~y!G$Wiw%zKrrOm_*I`0yXR<`sQ1X
zPs$<^db{yBEM03d{-v|;e&iAk$ayMF8$mrAi_YKxj`3Y*LTDi-S0SeJhGQ`m9#49*
zHQOHh4z_c?P2b<y5RLNPEPvDBknj69$NZ$it95gQ4{B7UDH(8aHZ;U)GMUr&z!_Tw
zl9&i3mj>dnE)bVqBNq>4IyA@TRy63?)ZVS(A`_@s^UhvA_!MCo@o+R9j2rao?9%)*
zd@G<r)w+ruHa{79cQ93`@adoyXS4t5iu=zm?65p$I^ow@QS?w&xjJujv84tN#*Y+3
z%5nZX<j06q6kqZ0_Q!0U69|0s`X*3jbKm^rvhV2WR4@4`wc{a#jfQg8E_%1EEj!=r
ze2<^N$l|lS@H~;{ZZdXFc5V;ioW+B07IB<Zg%utR@M2Wn*ma#SBhEJw`o1;(F-EiH
z&l2{Jy=L$kq@asS7(A|Q&KMhOJVaAT9mR2wNqFu2>DAvHL?0@|ut)(RbF84cbAg#&
zfu8dt04c-Uq0vlBM|$tiv;z8lx2781{K=6&siZFU_z>s`C&(BVbjNn?T^_Hr-w<*G
z48$Bzz){r?%~jtyCe*<=0@DWufk2h-V~m*Pn5Dhf7+IW_SfW(w%=jhzJcA+<g@lBt
z_>AfwrVprn%Q(vg<Cm}q52&*<k`#PIN=%GPu>;7eZB@e>#YI|2cH0f&^#ci$QP1kW
zWHtY36A_(ZoQD|PSh9Gl0gpg^W>3-j62U3w9-Ww|HWU$?x92$^Jdp(5(ouj-HG82}
z)zXVOg@vSO6`p!#*XoHoB#Ol5?}zQDyWqoXjNctFWhB&a@?d(4Z#Muzv9uB%degek
zMo3?zuIy-FXReN`g0z}Eyh`xb#%{q?$}!QRK%F<u7sp5e@}NNc#xczRM-E|m8g+s|
z9d5$T3ZWItXC)&v5Q$n7$e12q>v=)j$B&w18Zha@u}VnBj+Jon_gCw_ym}EFw_eu|
zaK2!080M}vKw&tWq@X*Ofo#>=c3q%ueRDG(%7^s$hjVVOzG?XDeZi9#{z=-C?NnfG
z4!Y34w@dZzhpuOvZ`Ru)=Rkhbu{C<77Ko$1-IzCM9ldgs*TVH?{C@azH27kHiVs_X
zz)mCZ!Bh}_mLJchq;M*`m=1tgi?X~%6nMh+`B&O##3~GyDdy^XbiMhNj|J_0)V@t@
zMmogz?c@^q*U32^*}gfm<Ry9rRDHSb{9CP(^AUQ)a}jZQhV_X#?A)1p@9X@@w`{s<
zzUN$~RUZCKCf^HvX=Y_tDkowCPPrbImHBm5F9xqWhZ9bK<fBWevSr>A^Jm@JA7_u{
z+Igr*y8E}va@auK#U4F48yrl$pK&C%^in@GTgxIEKWCdMCJ%kO-Q^+Dgsy>|Q$Xzf
z<EKL;xL$#&N<l9SD%KzS*?ssvWq#5qf%vXH+7U~T^%zYZgu!Oukm<Cr#MPAO=;(km
zSr7+wV#kD>n9=C^d%M|vAayx8IciyE<EwTAARJ-h#%W3KYu;ZbTwIyLS48|?!#P&i
zNQ<9~{`z++1l9!cVY<Ab^K>Yk`k00C374|u=l!(OioBvu#y~iPPKw51mLnFoJPmy~
zM+l}OEacE#9N9=G+jm(PP`Aby)vbkRNrq~P$Z`@B1=c?y`<2$UtTFKI3`0##C8_hR
zzsaZcxfpo=XAL|2#Czv_<;_oPSb8m*-fX_mPd|-ce|vw$rl3&m@U0BTSQ<xDKey7`
z$ltjPPv?GAcr7ah@W9@id7*G>`V8V{ZZKS#!8p6au#`$+zTVq)1NFA35(`~wE<*3p
zV+L#n3cvlM+4B4f;i3l`0sbV-#3rwwDhy>&hs8`OIytTUDo3(_2gkPo95G#(G6EQm
z`=xV2U9gOl=Uy9s)~VTHwwt%XfA-tq5tEH#ojS&2D+NHUu@VfV#$J$fF7QFFv)=?C
zBCP%mV$;+2aCR4SK7z5K%~?BM1qF;I6AsC1Av-8(lae3+BeHv*;+y@qg(rrZ*Y1f|
z|3aRp8KC508{-D8)$zegmteoKHVVThCj(mrJ_ZLg)efh-v)juu|K$Y%#f9bP9GWtZ
zFJCq+zs6?r7rGHQ%a571_oV4^<?7O%ah<Sb`ft6`+l<%q^S{9s2ZNwB47{Q5`Yn`v
zcCkPbv&h%mB@nOoix%=r4(7Hl6$y_&KvW&kC#ETNCIzfSQW|1BcySMt0~FcT&=$wU
znUK{~Cg&Cx^k4?63DGGMyy<ne-(_|lkzDEelM4UylqbXFqz`dKzT&(Q%F=Mf7+dL=
zGtxoQn<3_QG9*j&CMmUV?C(>7dZE{CTa$HkG3k=fnD^!BBGJrZz6pBVrsioImRr9L
ztl6lk(J0I#=YZv^u8ryhBcI%kO6U@kfvHPigiU@@R9_P|(+|2v+Q}LF;nP0@EUUPz
zGN$H^cf3&NjYuG1oh&)qcfB^ExTIoP8?RO6RPn$!kzi3Vv;7<-cS*1{laJ)HUuj^f
zFrec04@cu1m}5ZDop$IEdzn58e?nXq4u=rD4Aod5Wt3l@{8uU!W`ZH@(Pi;>GFJv+
z5(**J+K;hc8usoQNmg#{g7;$qYOaz$5r`R&oc;UW7=R1hf9?|Iuurp7<qnV5h0O4k
zmH6#0LbiLq#>H}n%3XKpc{Ar7DE3J6JIUV~+g&IXsw+nwQ|4IrlAkHp8}b=o_1z!5
zyzM>A{j=MDex+JCOi=oE`Kmj>u<8`+I^w|Nu~*x1DEuJ6j|U3RNuACZoMyWu=8~qe
zy!TwNFze{~iljXV0pNHbT~rT#ak@d>vx7M>FwD4E<h!W6%o7j%VkA9k<MVqs6;RJ1
z*dx{<*)~QS-;xcs7HYO(w|+{gGuG0tRa&N!Qb$C0S%`>g8MKn_y|4z~aC39pzj@`7
z{x9>8hN7Y03(hX+;Xhxq2gI#kfxY3n-&EnZ^;cl3apRZvlJGoN3a;IEBC+B(J;EJu
z5%h$iNeAk=6xrqC&n~%)-R9G|;^N{H=C1C$Ed4B!N4IC;OU%w7CML_x7a)8L%%2n}
z8|`Fu*^S(6?zp$~LMe8dHhG&M$Bqrv<Bf!AR6(@xy~I9B9wW)()J0OUfS(4o(}Q0%
z_7-9cjH{qld7V|Bx-Zi0`lni;dkf&E<7Ov5M-Q{KDEJCjjsWbxrL#JH)@axsVSpNi
zv-F+;G+_%4D7PiNXA#ho8W658HVF|~tuGDhTcN9z8X5hX?Im^mr)oqBFypxZQnSdV
zHd(5GElZH~CB-4Hz5KJ&uCqcOOiat-gGPf1gFq(*V8ZxX_Cx9FiOx$A=gmycKRyaa
zp?#pZ258soFcwqaIDn&DzhZW1-c@C5YYPJVpG6RpnqK^(4>&pWs&<k=3C@l*Xi#01
zqM^`_I})?my#Rr6Oo)9`W&PxY78yAF?T?FxkrzA3ty?RRa|*>#(zO3H7sT2dvC(*|
zafG4=s9KJMG|%^87lj)5ek8s>Jz$OW&At9hCx|61KO!8WOAPbNIRSrwo?H~`lzFTz
zSP#pZEbQA<oy`-YCR@=5v&~*69%G3f>ji)5*3$ExCta8^Cj)c?eh&1PeXAsIQh<!z
zn}1mXsj|yl;WF)+kcLKVyw%`w5^J*V8!xSFEHLDjKIncVr1kW$KQ&y|c($MvF!|a~
zyNz(Pz?xt@w~8yRT8|}Al@RK!`;x$f$XNWeEk2`e@Urk)BGNH~62hSuXDDb;-QfQk
zIxZW3ig*3mnK&<Q8^wz_+@Ec52Kq@W!-RDhSkH$(?xfD=u;7ezp2-Y5^;JXK2S4*E
zOfJ-5oTaU72B@K6W?p+uiJaz^mX^D?0aO<8V5Zce6bdJG+0+SUP4`Hj(q?E}NqRF!
zknm^z?uFk%g8VS|>@%8dYmy49XPZ5t%NjmNj2U*!4A*N=Vi)}vg@P&PI|r<*R6hT}
z3PTb$ZSfG->S*>?<?pPl&agluN-(v5DU1q*8*rwJ3~3y%8*(7mE^+=;7dyTCV@b`~
zpL)Axw_(ofWNR{?bV%boo0O_`U(I=AeLXwFIu=lwosL$!`<>at=1*lsH2sEZnUIso
zg@pykOlD=k_U5hkAqL@LECE)YHaj7r;}-DLT`crW0eVnL81H2?=S;+a2`E2O5)$dd
zRHXmK5~y;+a^37fhH{3akE@-x_fltcv!|)2=i9d#T*mBlW4&<nab>Qq=f&B6C4K@L
z@)Dr;m_i=}C)OG9_n}>zPmS?au>o7@sI$(9uI0moE?$KHDLeRFY04Jx3g%b0pJpg=
zTRrbsH$QUbF5M7scA0ZSN&!C6+3I%+<e!n%4E7m?G0e>X&WlpSI!solj%~~VttRj;
z7D(@XKi9>uk`d4ZY&6%&E_7>H0eYScP1OqzunlG%@>ohOgvHcMCX!Zk)89lhj@nm+
zR5WcUD_fV8XmetL{7vz+ABhyBwCSnH#)S%A_N%j-jONdaGCl6i(V10DU%dhJ4564W
z;OT1XK4O5gL}8%~e>cX-MO)@E5&-Kj$5&S2>xqI8aOZp%q!9A5{3896IWuhHCIA$G
z^#P$4`7NW!#ZX@|>x<{2Ky*~)&hZfhh0(XAu)oj1@c*{I>MU9S;wO)p;%(XOAO@g8
z!$iImx%UyY{YlH~tsP$wt2Ueb{F1I5ylZ2lnpr}6FPlnB#P8&6pDJK2_O%3xTOPdw
z2z8y5(ikB9>u)iM<mo)+Bu<`F0S|=8EL@x`VS=bY0gKb9^T9ty&+O{}>m-ac<LRYR
z5_<nnw{YCz!-u#Ho7x(HyP=;wx~r%4j<DYa^FG>JIN2tv27IM-4J7=!vfm|x07uWU
z!~Ek<c>2DjrdnuT`PVxSRG0UtImMk|D_S-<r<{FYot`wO=6M-iERdsC1b!~f-g-rO
zk~>kbq8S}c>-#@00Ds+OJ*vNdQ2KNxT*!7%9jS`07Mpg77qd&PV6`im8l4t;_PqAp
z=--p=X%bSBMK7&vfUbb+aHmlemnr}M8^$UU8j}0VVBBHh>mR?3nEux>{y+!_sJ{S=
zdi6Bm)XNB$(D^JL4xfWyskY`?B{Gz1PISBJW0)mQmZ`(g=$d`0du@h1|E;RxLmyAW
z#gPQ6(YlY0uA_!;_IRZddbpFMA*qt3%Xxf|Ja@4%?G*iJ^8Ylwi%Wz8R-jsD&M-}p
zcsB=Xf>4V^J5fiy>gz9wO|eep<RwdunQ!{(ZP2R)gD|jL5~1;Ijx_~2xTH|}`oHy<
zESEduh5@!BT2@weKb=a_dkx^fB@g?B3N>J<nW+M5HPeg%+6Mv@mUbUL9ImPXRjuTQ
z4m@CY_Yn3#C-E!cs3#VBv1{0_82@K<REIOegNQR>#Z?SMu4F)UnG6wSZO-gBP0V^u
zJBrSEKMG!%ff8_DvmO%}FoLB0O{4gc_1ZRU)}O)$wuje0I%_}SqLF-6{rbUwCk%@5
zcwjOF{^v*H<n5V8pTpI*wwEQ$Y;Ie|OPV2Z8=rtW7Z5ezB-NG@Bz^Idn5y=@YeLEU
zv;xkEhkeyF!W&jfv<GYw{>Ve)i8{wF7YCBfU~{1K1wKP>d(;;GT@jgF{U<6QY{%{X
z|At=wOXYy;|4T!vHbdSP_s%luNv@!tPu-BE`*&s}@bR4#*3U8*FxH4#rD|0_3Py^y
zvX5668)<s{QI`KC3#UIwyE;Y{bRfZ|RN(!jH-h6~w(!j$BU#P6hxgN+?p^-qMSAYn
zH>U5t^F-KImuRV5YC3zXZbn5|Ral-^G#{Bf;Jd{aWky3ccZo$riV6Ht>N?l!`)_c8
z$X9*hb2v(3HjE$-QpUd8zp1dSJTlGRqAR}KN}{_;92tcb?!T1f$fjuYbe?6r%wSC!
zQ@S^$f5(y@2n#?1Li6QAGJiFVL^-h{=8ag7+h>_Z{f`na@4Ya{rZyM9MLD!q!E(EQ
zyzkJsk300`Pv8!4fT!bEuZBCLDto)Ta=$qQxE;bv^*pJ^R`H*R?q8}GA}tgPe;1{f
zQwL3o@A+6OUM4(5L&qQ9wm6a5)Yb4rnP0mcnP2;zq8`ie=Vn`(e1&87H0kBwiyIj%
zqe_CoX@Im3U&}Ssnlf<KU)~@x{v!*r?0x^yT%Ua6DdKLR2h+b{I%D4wibNUy(zIPa
zcw|7<zrnsN9cvIXV=22(QM{MSZA%_^+1BG*qFWL_>Y&fd?Obn@T<Mg#l=p>7_*KUo
zd%wf4=j@bHgcYQJmmsq~m$*d|#kJ@Svi2qHJzZ|HtEF+4!VLG;aUWsclQG1WMLPff
zn{$2ZEY}vl;tUs)NVOIo9+k@ZTr<bXnxYprg3y7KGQ7MEN0*DX&g=PIV*qDdN;brD
zmG5lOASU2scela<BB(cNt!Jqz@N`V{SJvAK$1saAh|SzVO#_Snxzm$uHL}b9)ZThY
zQ@_PH`NLwqiZs)D>?>{JOThR`UVJGFb)9?@usY7=G}U(bOQNZv&~0K%%i!36<|YSu
z+rjFRn^!rhFSQf2+c?I{3F+Ic@LRAy`FGYSu)fZvFL3?_l0`~qOd&kyvGU#EUh`fZ
z+F#_6D|*knJ<WfhX~7>HKllCHuA#xTPbVuVuUi>2`tBdzk#eaS5Vw`x%!ifV%pIp{
z!L2-Of?Ue*0!vN%Mcs)@tlGUK%3PoJcPQs4dd#q{w!r45#_kW-gi8w}a{t6k+KC|@
zv1jqDdQ11V@t@kVO9G-$$Fib=s-Blq2F5(7HXzJLCxT36g$|uU&Gke04asma*M)2P
zPND@a9}`GfZHb(E^h>$0H~*_`(Wm~bw+kJT^`1}5Y+qbv6hKaq=ha;_UlgLV689iQ
z?+R^={1@R*rk8itI3f!8?I=El$=~3gyhB73pSQNx!}64N!s<$v=kpH7``2pZ+o*Ve
z4HzG;8Si<=K4{4%D|MhK&obB@`s88Wl^1ol`x#099qGx{yc_vwvU)dT(5JQoOEW_0
zr1Bv13en>$|6(^fOZQ}@eexz%!6$jrNB`e=n4w7GtrO0Yhc@m?Jdvg`)XO|zXH2b5
zge_LyqX}@Ep_|_L>wu)!RCE~Rs)rw_B_=-&8O})k^Goane68cb_H<XIO04iRm&cEo
zN>cRYR8@$H?CxJisX+A)Yp<$mH5%>xb4?>mOLN<MWv70Z$yz__dSl0+9i{v}Kln6e
z{Y{weZy}<<rhkXt?EF@Eq&O0{QD1-qCZFoL*mOA4dzt{vKg~?MFJ?a+`tBVOkw;je
zF7Wtz1J2}f_Qb>?b_V7@Yll(J&ytvLFleZ}Dc*lXMD&N~pH^C#rR+N*6UW#R6PdR3
z)~H9et9K!5ufE{l1Gs)1c!};qbIOUO`_ba|L?!9vy5bV9<1!+|L`CHP)*vEZSN+3S
z-lP0xGvrU8v{*hovD)YYP{>c;f9Kk2tI)ZwMt?$w&7*%~gB;X&(g$`RoUslhMBml_
zJGkT^h)frtJb7BS&ymQ3rPtz2=d>@TiZiU7IXq~X*=u+2BZ~iT2TeL6qdL@RjC6*~
zo{87?qdZ(mm>IKgS=DB;w1!=IeD~i*Hb-;`h!h&@3;r$TW*$;Jzn#l)g=n1k-(pP?
zrvkn|$<a+xQc~INvXdtYJbrO`(9F(&y^uLVsZV6tuBa{3I%nRUrHvw<*BPyj%;<S7
zMiM6(y-`XI*yF7_O<wz*=beU6*mM}(TU0uE>G%`w+}$lzKnxPa-~2a8v~c-$S6YEU
z!W|-WX5cP><2-6|xO+yC+!6y6I4}{>`_PEXbn%T~Mi$%BJp+rWm&zT&W{Mn23D1mj
zr&;%SkO#!Z3V~Mt4#C+OsO@x-4S9;3IQ^YMSX-jjG~aWS=l7x#YsiH{*2B-k(Y7#H
zzlK1d{yz&*6rZ+rx;;|961Fd8`tvBN_cgoO5yJ~@Eu*boHG?gNS&0-z!}Syv9<}NE
zwtXhA8U93=wBY`-r7epsQTe}c9%nqNpW-E(#7`}Bl9Log)Z;R?%2mk(F5>dNC|IY_
zKxU+Js}7_e7FeEtWLK)rzK4@XDcV@M5o}C`Lxp5Tx0}|d$|s~h91Kz0!pw=v|5;Jo
zE9#D)>Q-8uW=Bs7908T;f|}o*s-<H^fWwX+JAa4W6f_1hOmVsOx1x6^zuTg_t>5wB
zs%J&bL~3#A$eFLgH56Hm{}PJ$koQ_T`Z78Uw7r?qCdTWnIzGsuS4V`vq#q8;)dnVb
zWurx$3{0BPAIwfQKx3Q4@+7jF-nhE9J$(IZZL}oVA6LIwPvwXb|8b1<L+vF#GLsT>
zi@);hPNq13eDQ2mb%M&)8uyU^HTI=u{BV>qZB_Pgn`!oN1Ja<)=|;SZi19z}Q-D`H
za4sptY`;0d_gws;2N6a@V<2BogpHbUKkYrEx2%ZNK3zIc9ILGx9QH%Z+8Dl8p4t1h
z+h)kWS!B!ie1)$tV{&oJmIc$VgN`kC-GdLembRRR*J$9U+hIMEVp9kY6wfqigFv9o
zKVwjg==p}`|Hwv_U#%z4&nq*zH5C4^n&DZOBC?yu&s0uA_hIv46`v}75??|GAOWK?
zRScDr$x4db<e`@|CZw#RW|9YMDjc_AOQiPkpKN68g&DTC#^dI~?mCh_gJqJ59R+SI
zm(Nu3n&l?zKiF!{JX4<IEeimolN#QJk5Q!yp?7@``U2*;;$06b((k>{`Ono^tW(0&
zX@r`7Gln0G^|+0zj+gUi4u1g@Im%PYVqJqSWF{F>oN#V-l0}kj`!5wc57OBhfW03J
zwOE^zZySrW<RaJJ;O2W~tRztmZiLlRQL`Q*#($Y_)^QR1Rm1y7SccU|)0X|4e-Ast
z8PZP-l<iy|=RTUKF`Wc<YPg1u*e<Fz4IXeIPNzoU=eaQ{9LvX-upO;zTPoqZQ(VXn
zvyjA_Xygl#44K;{Qvu-iR@XQuT6iQ!<n+kq9Z$7t1dO8S;MYvO|8V8f;&8%1J!P?7
z7FG0zl~v*()@v4LKf_7KB~#+{eD3AOc@p-WE6=r#QoW+Lbghp|)C{E0E*=1D1duIb
zYq?e^!|eGq*Q>8m@`48+<U3_#iNX(-U$yrsmr^L?H8I%d`N4V-%Lf#hZdp5v_=wny
zfU@~ADN<L$nyFIDbKSq1N3FSjv8wltaJe>-ZW`aDs-X_Mb5*TmHbZuoQ-nX91j61(
z>S=!Ifvl8Z$TQ;}5<4-Bl%soNl(tc^^tk`gEot!f7Q-mR3ml+cS%WjGv9txwdQp}x
z4l-_I!`QcG*W04@uS6?6O*!6>O2>-AG9?Cx7)jWzh%!P4_oV&ocCza**~1nJgRjk`
zzqO(bSu#e6UKh2<hK>fBb$V+v*cU(QGhx4K7+X%f<nAXeDpsS9q^frOFm3M3I@S6^
zdERcfvkE>e4EB5|A>ceXI(RnpoY?O1HKD*58JEbQ@#<a1Ej{_LXH#}z^{UGH)&lsr
z=b6HoG$|tPO)DS%!;O}DcfHM6VVb7E7ZAq{Q0}x&O(Cb)+2U5U3bcKED;*>u+(&M0
z*=k9V^#y?2EH`d7YnoP$aBFStZ*577JX732z!nqAie=vT(nUHZ*OjMt$8Cg&@zaLl
zN`79;`mhJJK6{UnHFqz}uhU)f>kAW(_z}=?Gprv5ka*$;)eFqS6`IO67Dt_#(aF%w
zGh9bqK~V-W0}-?h8l(^il$YTrUc2q?)WDG#?fh(9vOTxSXeKV&gzQ}`tX}_p_hn3u
zrt^AbysoUQ#}O~wRH{%{WaqhEPeW|jVA{$)m&!9(>GQ#ujymOb^@qmO9mw7?qlwgN
zzgSb^HGy2~1JBGW&q#t8UW9SL3S?|OuwGV%iHmU};zh$fGpd6oQ-TsZYmntKxf_nC
zq8LHOpBOb0@lPoM>zU6p(TH&3l9Grzwpu&wRK2dG(_<Mqp=&}#y~ooPT-&e=2|r)F
zYD;CQe2b3z1c&F1pzosZ=YDV`-=O#8ykV0c|5{mCxy=FDDJ6yJNS-29m+U4Q2ZC{y
zWNc^A|F{5Z&Bm?nkaMQG{A$;H!PhfAj_d2pAfeQyB^D|m$4b9a7S?F2LLq&vYHfJ;
zz#JAooZm~$h#QnQ(2JKaOUNwS%e#{3*H*u&f>k)q%{PB?gFJdy3K|VNX=OUyh>(|9
z5F8Vf&a6_{ofLMR9Q|5auCYxL(DLXeJ=FKqp~c^gP%x5CX7fGZ(j~H<m1bTYs~GTT
zW@T=;A?7n^?Ac}%VS6f_Sm+>sBl@N7oofMNMphOr?Pu$XiiN_9A)+B6sf-rxQsP$o
zxZ%8LZ}zCz@Lh7g`Xb6)DoPbBy)>`1?af@vbA>P&fAp{BGsfz&N97}>ABGu+7-S=4
z86ztY36zoa9DV6?oLq@)q<UmsVY(!msiSVT%2*>VgDI-^5VQMAG&u6&cScBLrtx{k
z#d#N1&{unp+h0OLuD;Qv+dc5CxacD`1b<V%QY$51#pU6_gfb)~26c)ux(A&d9d_hT
za%cYa9NnR)Hfp||Yxw(6?_LP+M<sFrZkilst<O0+v@qAks+W<{(v)U0lVN0ikh9lN
zwR`z>tm^ivWLN3P=y&pX<{M=6%>1s>aN0ja76$Sb2Wv^H%zJl?siE)mXWfMP9Ub<~
zIs1`MaJ#3PX6rXU{?b6+H3*t+wK!EKy`TDg(VOy3Vg+~9x7yjr0Xc;4(I!P!#RuN&
zLnq2BK;m1@D@B|X5vHKM?l7rx00aUvS09r0ukpd0CX&8dM3&^jyjm3b{4rKCD@Ghz
zIWye|*LM$mLR9Ge!{0JhmS5*?x|MrDw|%X}s!LpTI$to*x5tQ_y4CkMvn<gBH_!eg
zrs8gY<~Q&7@_d8cXs-iGap((TfZ3>R&~A+K>ID5Ue5AFms`q>3Z^=RB$7+Vv^tx-b
zKl0X+uBO~W^pu)9q#o(@3T3FwSMekyVNZO_BTF3dG7d}5n3w5^6XHafY+1aj6Wrn*
z32BV$3}V7wzQ@7H{tRhY`pl4!YftO&(B`OHA^V|@15dkDJNL%G8tD(ltG7O(6#`Fe
zrpWp3HrI>fPB2)5OZs?Pq2g#Y3&;jZF2#e$?1!OEG<kVh3MW`SgxS6y4VZ^Cl*Uf`
z#V+lV(d!RSeGRQ1=ynXn{c=BAJC>s|hb`JJDrhW|K0}o0V`xbNOH{3p!`lULwZ!`^
zKe*|5DT)GI7Zuq+ECil?6xq;o!0fjjIgv}6OC$oka+3~|h|T4w_N)pHmEQu~JlIy{
zp-SJ@YK`z9?Nk<9{%hZlvq?1<-$j$wti4=)nar|WyF4o8j(9wOr$UIBR;cK!j#gL9
zep`7{%Zc5WN7M?AqKrFt2<i&O+|Dbp8BpJW*zGYtc|XyS!9$_KdoLa>oZrc6?Jzl*
zFjj1WCpikp$kpTo+Y>fr#9q?oJbtpTtPZ;i2*SB){>Ma!>?)ti`@6K`S4;Bb2sg<s
zQe4xbzSTRm+tFO}aP{BtZgD&B?3<8$P8Q6LWM1)eNzdg-)e~%vl5^b8Mb3j@(t|{d
zz#AG_(H$>8Zy2a?C3gru^_fIe{RzFsses0$(d6a0s=+pF6F9<^TH;4P&T>x0xo0~m
ziACe1eQ9H<AW<@DhOuQcdOSCEIQ8?xnw~b<81IUIKYzj21!}z4PM7%__U(Dos)ACE
zdq)BBep~733aKGj5`6Wtkf{d+L)3VZJCb<PEYghFIGmo!WT{vf$7Q?WYH8NUslTzV
zTYcQmjwOE(O+U(!S8hABlqmq&HN+V-Di%nY9A?P4-IsPtal#(W+1H!4uC~>5G%k%I
zht=<uN1XjRx4d5XeO19kG+;>c47t598piM<_|m`yN>YTg8J4PnX@@6*hokzay{)+^
zEnD9Y<z9Q*(?wI@$u4NBnj6<iFtVNtkwZUXk<IRfj`Q}|=yJ8+w9z!9o^(s7v_pqX
zJKtA422OB)DSGvUEHTD%W~k<45W~`qz5UchZelxrASjFIe+WuS=zF{2DjPraw&MN@
zuNsAp_7Huvt}&VAy{y0CYpNP|&JZ3?HcnHLif=M@zs)C%&&CbJ^=93HLoTK(cD2WS
z*DI1MeD>T%kppzAc4*_1nbgLbQV@6eVxK3f|4hYk0gr|QSq6~UWkstsxUXe#@(CSO
z1V$Jobmc4>K2z0N)uYkvY>MFESEJB&9cmYyo7cKCj&J>3V^pZ##<=lCAm$F^16%a2
z&nnB*<R9=!No%F?;n^d!cXnC)q;<nqtM&8tWWHwfx*s!@V^}r=P&Q2IN!on}$}LL<
z%ha9sqvtyrHu5WXWTS3AA@30AXV~<VksQ}r3^wrT(Otdam<YQW!OPsJDFIOs-5%r*
z?0hb`|3?-HR+UJ0{)_9Csx$-;3CUb1B@tuGm5rG$Jw<s=?ooDfxuSeLZw}ncRvN0K
z%Ze6mWO&3K>9rlncsk4@OA}1nJ$!Sbsr!OIFOt)V)whq$tAx9C`Jlg5V@2X!)02EP
zAa_KG2Ou6kB^5ELvRztX;5j@lgny~4?qhk^eDc*c_7fM?+k2{1aQ{;kQF-!YDgTWH
zQW*F*QJUQ4OE^VQn|~8Q{(Yw=T||tX<bNA|G_=`dzZyoSc=DSW8iO`flq_*P=_li=
z@jsuzhul))WfHv_Y!$6FZ)llED1s#=`xT_f3_q;L#yq?sA!=7Z-JhN@l%D?HTGp_c
zf^m1bU&$!G%U8kgI1^%ty^j=wr5m4gw`A0`tRUAa=3I}xwh=tJhgWyK)TI?y1WEeN
zE1{6@2f?(r+Echf(8_@#abB|EWsCj;*-Cc?lSGoSq<q0eZxiv1Eg1-RoaXmW9`nM_
zo>IJ84ZTV`G&3Kc`gy`hC7P-P2q)7`?xDIQ14reyyD+{%RLiD~T!QnQ$0&Rl5{A4l
z?ds$LaTxq&cJwixW0!f>ZLEM8r)96u<puZI%Cyu%C<NO48fAOoIw>7%Ra>>(L*E*{
z&iTHZ`Nh1^^DN!Yr4OHNSTsQ`I%K<Z>weku*Zj$ODO~at-8MhY<=U2i9aW$1s7c^t
znMso241VJ0y4XE=UL(5o!v(z;v(P`(#|NEM@q{m*{n;O#6#6>Z<6}Q}NKfL+kuw6@
zU|MIGoI&_>4S6aV{}?*|(`b1LLV(TM?%D!Wjjd|nr!)={Pwg%Nt#aT{zTCL*V*y>G
zB1Qk0+fb%#3Px7mto8W$vmol5b0NGB{5p@yWjQ-)ioZ?p?nfQmYl6He)qJ^C!M-yk
z{(Yr)fVBRWlg{JwgXrdWk*G~f1&Ab`br=^Zy*F8G3zC4G^<Nl~3_S!wM)=ZohhAlO
zPQOL(fc(==bPV&Te#}D#Jt18In&DlRG#M-Z^6SD@6|7VKL_!3;9J3<(hWrAzIo&yx
zfMbeciun2SNuAnbCP?xvvw9EnO*=x-J+)Qc$NBz@wV-R%hqfAn(i+9w_AB>Zr~n}L
zm^{CFG-Nr`LyJ?wXYln3k+}86!NOKKsqeH@de1|h5TY*>uVtcM_t`zDkz2hM#H5Gh
z*!x}jQA@_p^_SqbdB%-s={K_zGWS8+m2y<_iWDW8%)a;sQ+7}ep_E}?ccbK2!&Lr#
zb*}nO1<(74?gE4ltI-qkfVa)q{X0=edam{J;qggsQ|6S14EiCVbO7wGDSVlP&xhtP
z8GrNh)S=>2>JYB&X)&-+Wa1gz%q;a844ilLAJf~n&5AOp^se_(?cyAXGaNl<n7a2O
z=yFNjR)cQwO<R8OH9g_VGUl4ppE7F8t-IE*1QjWiEr;hjf8Mz!k;jFjN7ZS{Ht#*L
z7E-p`4|ve~?wuYDQf*p8O2cO>9$9Rkk9@(fyIkvbR92UXVS;2ra>ZW*JZ%|irtFpY
zpuy<DRow8)Xg1{UC=*#K`CglrmD9N1sgE*WR4F)81Ok`uT$esorId-hq5l2in6ioT
zuG!6O&|+Jl7iB(E^7UW&#oTu>(ycJQyeDK=aq%PiZpUTO0RvZv;(@LV>z%dN$Fl4Z
z%_5?nPVzGikG{q$km@#-FUxwrxiAWIGE!ShXWaQhZ7Les#k=vA)jY&bQN)Ns=&jxP
z{%;|=YYCO!S93Fd781gAHOL>)`-Q!p8-dyTLPh*ss_pJ0b+vxjsAhoTYzFrFzu7j~
z(+qJ$-LkfNC1}UzC$h6XEM$uw%*+J06Wt}bl!Y>5KKB|Ig^F-`&jC5wU-Rv7F2er1
zLQmdfJvsw%?<eT-`#s74e@KY$6AB-&iMaj#Ze^lC;I&*1IbmKf*;zU0xwMc}Td@wB
zGIQxy+z9h_;p3!UvUH&qm)RDE{^{)P!(|(v2RJ(N9R6<$8ah3Q`K#Z{q?q_nGl=z~
z0Gc+6yJSF6IxcWCo%PG*sk2kE^A(~rNf^>iHPber4M<!0@e;mfFtU&<qf6l*Fr{Rp
zLS#bW@$>~sPLaFUyn?>TblyiYHWATxJB8!G$Ts@Tb_?=0HcDkD+x$s*Hg{z8ZS7+9
zEjXu}MGUkLt}^}W6yE=0c;^w9s`eRGPSV?IM&+Btfs6p3Qfq3=YhR?7^vM*e=Afo9
zc<@puyw~O``K_lzY=D71RDQd^D%Qpc&eh$bB}U!+&FY~2BInuaFrCSdJ8W87*Nl>^
zl=41zizl1h-g;OQd3BrLP~ClCH=a~MCG0h)>gl7rE4o*JwRRL`>Anw@-+!0?F=VqA
zvuLUIV$xwVE-kJ~<84Ckvphk?6jn0F39pQwE?hiDT>ir|fg3iaLtFi~&pvLCGBomq
z2jxUWC^M9gl89<U%AUtc>XT>Mkjr?+v)9fo#5pk#m0iD_CKKjq7_3!ZcEh?#7~q`Q
zELMz+$UMY!1^n;C|E7}Z+Gh?k=rK$@>-ffc`*$RHhA;zUAHFiJp2evv`_;~JJ65Kn
zpJBL*zr!O}!L^!Ilb>mZ=5e;~NnIgay+Mqt3m}Pwyso_7vI0&q&_nc{*^#MAiq_m1
z^@$oyZ4<>7w0G7`yW=Z2-bw_(=V>A`-)zpP_u8c0?&jIHpw@0go{(SfdN#{yw`*24
zDYUqJBd^*w$J_HHg$6lf&l6##XdPz=pk}$Qbj+9K0daN?WosAq&QH&M>k}VwvVCM|
zx$@|}bsWu6jbW`f6U&6jZfySV8Y7N6OqT>js<n^YsK+eE%;x>oo0c>^@o^yWyKHk?
zd4a#lzu%>>zGjzStdcGuZaS-8a-Z+H&!DnmdD*hnpUf&bp#d4SS8x0k=|=M?bQ;XG
zO-0GCMh<KEM7o7+UbC1F&ta__D-*g&A!Peo&n6+-X>C+k&cHgL^w7emwmndwZ`Go&
z`fS^H@LM0<J22es%hqF%@3ce^xfM|#z<k@W9gbu}{6nfnJI0dfOJ8017(T2k@qj-O
zFae_6wJHZx?S}vQt2@Ov>FFTKHavqine=~?Z1cuMN~FpYdO2dFDNj#M!<yof|HlQ?
z1w=T!?YJTgk7g-)FqN9lC++2%=0wjN<v{ZN?lqw`)A+~TIUK`J_NVP&W~f9TwC%@z
zQ`=!isi2?KccH-uhS|`d+lY?q!;57u8k_tS^mq{2!mpBYZeP(u;$H^%8{UX@)~Or!
zq5DJdgOv_>Qe8dTQf0g2*R)M8PY&l;#vNJ~NP&&uk699ZdqYr<0v9Lta+CPW_F2S6
zg9=~V*0SI%{Zq@WS+R&}L&vq@<^n#swyka<>c|q?gn<#9wD>wPcaS+rM$}@`!^ntN
z4X*Be6VqSvIRe8s8O+^!B1JV^T)ay&y`CXPn!U$1Wn}v9Y0D?;-+1T#A)#xdk>5S|
znZ?uX{AW)ShC=V$?L1^U7E<yMN;VUC4-p{`Iyq}Soc$5yb|b<{mkW4vo(5^^y(idf
zLyboF?Scv4YAqzH8Gf?e?$4su92&8DSQ3$^SQ~y6Iz?%pnfdLt-%pF;P<f7&V)`d`
z#ntoP*-O`Ys4OFCGO|)f`)LG*G<k!U7n0o=4}+E1-uBv%%L(aGo;ulnFUc?7O2fSo
z@T`hi{I%qU)JWXP<~L5E=Fhs5bw7xq7Q`8(MWLf-^flj3A--cZW2J%4`g?t(g-WXD
z*I))>MOI(V!&dn^UfoYa)>^|3d9b?AtT(G?NDu)oG8_n7?6^f<b<;H5y1RPzpvlOB
zl9=%dFTgG<6+W#lP<-#tb;zG|A%5>MDek-Zn4sblwM0o#yP-h&o3FIHU;8mA<f1n{
z*Lr^dFQHn5J-lWg67;U{R<sANuQ_@(GXLC$CcHc-ZbxC5!W?MTJ*K=~nNYB&W<Vil
zbM>uZp+N0wMrn`CXI847SF|;{%DglXl(S+$ywO^nQ(9_8U(+~=BRFZ0*FJzVSMmge
z@=x(J#Row$nEN@7Vw~2vKtqP#6!?jM0I+}eW3TzU2#XTs21e(F5S?}P@qU-6weu@V
z1tX&w4-8{=pC5xpIYb;Nr(Z)Wv);v*^vE!o>PLPhwy)5>m-|WN*J~TsCn^n3W$o>r
z-)COWcn&t>Oq;w8pL-@RboDo|r`Bt166M85SL25D%GEGW+cCmE9`7#9U;ZjC;phvJ
zOJA922zy{QQnt?VUi-1ml&uXq$0e%#eY+xGNJ6in+6L{<rzukS{&yH<Q|ySnVLP{p
z-%qz|N^P{yh$!1A($o_3qbjT^*vd<{y`}2l80}vFVe45de?@Dx$2o6F!WGyG5_m`5
za+fgmn^;pwfL(fO^jfj8)?>MRHHY)5alNX@WdAyx6p4LC&*aR>fZjxZ{c+#d4%Xc=
z(Toh(!0`5oT6<X=U9`=S@%aD4(^m&H^@sfe0!m4@l=SG7PDhM}5u<B#{E*Qp2uk<p
z8r=;_DM<H70RaIi5s@yzdwlPG@BiYy=X~pVK6OSvzrd^p=6F&8ledlsN_!}TC}YS$
zh)w2tuAIgMY5N$8udaNxrm}_dw&GRijtUoM?!14!{nC}JUZ6;9uRoIuull(@C~c>`
zR!6`T+G#jRqlz0uP{9ei5HBrbQHF5$lN;E)@5LG4E{@k~<hqvvYl=KF0jMORQf}d>
zCeaNFieV&}vZa2^f!omSRCkE^(|;;XoKV>kH<jEyoO<e)9X9UD&*<N`w|wHnRaMtV
zF%-Mg|GdtWJLYGAFWE07I%w8x`3uOWh}e6X6`p_18+I|gt>J#&j5~Ls!RS~MKKCdb
z=ZS-ESS;^F*+nS6{ZRmB+h`{!m*MN;&l+?v181~r(@dy6ES?&(1iE`ye0Y|;Ye+u(
zWA$xeXbKxFolOrV!x7_-ejKJ%ke03{C_Hoa^<dOCqtDIkc#wM8Mj0frY2P%&FI@Ht
z2Iw%Jhx!riJvJeVpq(eO5I@p#4&i1k8+WQP$p9MpZRH=jIxU6X!Ec0}yrIe^d>$2w
z@>9Lkw-gHzK=Fk&=FI#1-~k>wvt%Gt@|;GtjNo~gZ3V^9M*2R_!SC1maUjV_W5Yo=
zv%<X2)=~U5ga0B?X5;d~d3d>VwPDV1vIJU8TL43~O#dVtt-{{S_-InbW$9!&zPInV
z$Hu$wm6HgAXTCQJXfMikgfoYwP?3{ltIFxmU+U=*?gG*cNA%y%$+L9#GjEFz)gcPf
ze;%BMVCQC^!kDh*K9XMd1hb(&Z3vtMDW$}%FXK$_S=ttOj7#qtrzS=lY^k|q3vsXB
zrgK(2GwLb#dB6xaWX@7NqEP=iP4kFW`PVxkK0a0SPJYMH`?Hw=JI-9uM_t)mzC(x6
zN#|t;=}k^u0gSWe<399sIhD4%xDlY|S&GACHxvSvXkfe%#}FsqC4PPCev_sMYlo5k
z_VpbCO=mF8afXgVO@Z5D>l714BR&9%gH4TbgY;!P$8?|9bVxr<ysSu9)p3xnLa0>5
z+d3XhR%&n_<A1&$d?>OGf~xSCw(l&4C0K0zwjRRh#J5Ot8r+(7=a6j4tv0m_?AEc|
zY4cMy1-;*Fg$>R*i%5s@5@=*&{yPWo5f<(8aKcNv{U2!E7e@?qOya*}5cML>v}MgF
zo0LJJ?@(XtDqDq+C-;J$%ivt&*=G$NER!eMeE4*+4l`nv<|<39G_4u<OIho)JXf_o
zRnFZyW74lJPAFEXe1X^Z3Rt$JS}Bi%;(J^9Q7;!M((Ts+Ruh8~H9LY1+%BN)@7VCp
zMO5gIx-1p&_~?GA(Yl9ZKHx~HQ&RSMt`@9gEO-U?4U>f)IZuj}Pg8cYC_{}xq@;~2
zpJz1f{`&!7e){P4c>|c;OHJ2ms-^V~evX~2cO_|dY}dB*roS5QOUS5b22;R(rco==
zvA3Xh2Igj62%J5bzeG5x(X8U+Pha9l4}4p@G}xq@tDn}Mxa-0-k_pT0h!pwoV>fFs
zU*6P&KMvXdxd;~nTf}5pVTk6J7B@}X7k#~M+Md|q7Ftk#o5lsNhcHa8!A%wl(-%<*
z8?vTWGVSxNsVjwHdZrY`06gnxw{D}7&;Yl`YPG%ScHU0mB!OKv+%mt1Sw_gpZZFAy
z-BTkz>73{(=saE9D(u_iP@0)urkAd@cXCJ4a(zi+2sz;Am5N$iLX@pkQoJU`xGR61
z@8;@rR>X2vOnfKyi0@tDs}&kkrt5K_=I!cFR;j4=Wqzj#O`a@L#?cfEK@b0IzJxB&
z%~g0?nvw>#4GPSqkL7_LX^u;WrH`bJ2;lIHTRq+7QFu9C+tsThjX3-u(>O?)h>5_)
z7U3cXH>dQ91_rT_<1nsxtVqAabI-?VJ&Nt{*&F(R(ok>c6>2E1awF~Zo%vXrs?zZb
zpJfsdX4nH_@qOdR44hAJL`W=3o5hW9=;k<^*C|;uTQRe_{9B9`bUX$Juv-@JB0dRB
zfYI*gE|lRN7UODgp(Q~#S3CGh*IqfFXaz5V_9aS9{A=za#mi=K66zTz&M60qdTsL&
zV+{i&sekn$jh@-QT+Pfeh0pZb`>@ri9_5o0pS;h$XY0keD4o^dxM*oA-VP^e4donF
z&IY+Tc16<PE=2i}E^J23D{}fU`WoK^=T!ooi4W4Z)cTM<B5k;<vqP6)VpG0!*zbvQ
zwd!U~hZ1Xt4+RYF=YiHij5y-B$<QYbp8^f&3`a$A<Oz=|1j=TH#+@?PnTA{ZW0#7P
z!Uo5vjBW_aB;BCz?AlNbo4Y-cVjZ_!2TN}|E{=k}e_eB9KqYe!+4GA(-OLbOjj>9q
zDkX`2o~DfBBeMTQj;Zh6!?k-uwOF~`oI|qSeG0`#)a_UE1%q*0zT-b=T@+WTXjJ>G
zEcB)K*Ko3&5SB)kYQ<OI%)4t2s=J*VGd*DBgW1KR5&TbyL%0L(_s&UhZ9XY=icts=
zDvzHk$qm?L&nEBPlppCS6!Rpca=HCj+Bn~uoYu)rk}a(B{ck()`EvV1&)MR9o*3mv
z^{Ssg(7DcgLwpUP_FEp~HL_etb1BZr7Ys?pvu;a>H3c#>0rpD%c-*H5YHP@Ut2HhO
z2dU&|z;fe^>pfVIz%Sa#m(S5811pytZDkW1F1Stm`Kz66e;T5m9RRu_9PAc;_PDK~
z*MtkB*IYy8Mc((r+73FJ*){3#t=s8#8@oKu5oaEhF=^-S-pP<5AaOq9FtR~(eeKhb
ze`Fz$m-~WxtqQL{VKvaQwdCq+_t~cyx2f~yMVCzLhG)lR`m2EtW$jnTC1&{6<TvE$
zGh0v<ge3Uxs_>Sqh6jvvDj^e!W28zOa~kYEhWTSgi^K0CDBqbh*V+xZY8p#d|9-j1
zCm|*m$6j%!N}y*rsS7Xp`CQCmrqs=0ST7;z^|_nC6Z8=U04UcU&JbK%>$toZ08=NJ
z7!0KR{KYz#@r-sdYil%tj4uCtt}3j@w7x?OLi*HGaZvh6S9idF%BH&Lnx|2+yDhKN
z5r@5)ot&O`0pkJ^q3F%Y-2=yR`I4EVc2c|hzx?UF5NR(Z9zWY(Ph8n<eP^R{#BurN
zcyqwRRfv9B1+p2>>Z3ScHMnPKb2XTA3*dWASVn~3vJbgh1rpU*PFBUY>FgzOkYg(v
zd_U!8JSSNV{uJdZ>47d!HBES=ifQ!LdeK6^v)Q?^BU_7_J9RC<DZ)^|1ERQkJ1*=V
z+n;r)LR4<vi`39q!E_XjX$Sj_rP6d-7L$NLltnKCG3~?-mW-d(kuS}d80<&0@IcVK
z6mdA|Q$>6duN5*Of>pJkoaYCiLf3SC!}VQI;P2+l#BW)-0-=X9EpBU;x6Kd44?AH7
zO;PLx_0{(WqDR5swhL>1E7vcJtd}4xV#!g<Oz3%HIl%(U6uw~*_oVtCu=c%TEBSf6
z2v|oE`F_H^><M#y`3Fvjky{AY3Yv;~#&qGNA^ZB3S-Y#WT*gSXslo^6Yr3LP1p&2M
zlF4uSH|2)%23}J+r5Hxlxf#+@7tF5DVaTAMTMC$v7I~S7S~D|6twQ4?UX~tlb&7q_
zm3OH$J3_smf^m4e7{}kfOfx1J#9r7kQnLDfZr)o>d=j#OPu7EUAXh_WEiO3OGKS%m
z#8s4U=d_P|G7v{H7CSs~uu%ABNB!cm%(dQaewX|z&$MOSii5qTxd@a=SdI7^Ua<J=
zt%tx+>ih7^{n4M3L2oOghon*taf4rWO`6>{i!0*DuDn4N>50$TcV+-a^bvhfkp0%L
zgzS^DZJNW`%M#P*lv!w<6P4EZxsWDK>f6&Sh9`{paGnwkaC%>SB|#y_I3Y2mD2~OQ
zk-huoiXV+>Jrk$sxG(QH>1!9}EFTFlvYqfE!;i@&alv5Ox*=8QyCy_`XF+@G3@qSz
z6EG(bB^vAK$Cy*}#uvD2^F`mIFM`KUH3RuQr^^JDsZ7uDzx$tW+3!Oj#&7Tiw1Wo8
zy;XPXs$@SeWn@m(Gxh{L4@05nCXi(8+-V1TVw25WMKGIpXzt`E9#HnrUk1zevxjuK
zW2$gvBP$_uyV{@iPyFwg16Rzy5cB^UmR9ul3KN`L&Hif{K|&n(?A<zkzaYfPLkL8Z
zECgt#|8I6+6}vYxA=~2!7$^NisrY#X&$Ewus#njlEx9uio;sIAW<0GZ4Wx5F2@Oyy
z@mJ~dEK7<tlfEqb?*6&zyWb|UvXLl5tbKk{B7O+9$GY#c!maFj<MVSRM}v^t-?P$H
z@!~nlMh)dRhI*74;ubAhbFIAOk@`hZ=5qP*`q`g!?>~f(*+R)hP<VDyg?!Pf<znU=
z<Jp5bd-4WqX(oG*o%Kj&bCk?v$RjP;36K_zYuyLeS=qQ6!0YGebbB9AnS@Ubv|_1z
z(hc#|_UU6r0x5O2&T6^Ye)&87nqOB^z-e<^L0dP@cy4_<)WqHaT~0nL)*+z$<@$~7
znuBvXg6(d%yQ})kfUmY1L!v`a!xF6}pK%}pk&tA%=))E$dwl8n%il%KS$VSyPG#1H
zWGCTl5nS(TRO8+=tGvws*%4fszc2J*0#n@y@Ybnc03-{A7N}g(UCI*o$J4&rM@07V
z36E%-z|^G2a>6b9jQDoj^cVWIrXM9r^>z}-Ry3z3sY4tWUKz;9CxG$zBn{^GFL;f=
zwFxiARF1veV93{T(652F-06fI0C!8`)!sx^$sF<JAuIjd_C0Pxaeh`<DtMvA{XS@0
zF{$=IRI6fANFORy;vY?rH-p{1jS_fYJTvL&0$hjwTAB&F@uOH{wxi12HN$Edm&;ML
zQJ7_vvC^l+7r!$#=T7jE8iTE<?JZ&J7s`T%T*8!N(Lr-LW2W{8%tM_O|D+=;nv1}w
z>4@kd2J@*i-_WA6b3eZi86k@03;innYwBbMQ?{t!EvK|_svhy1C{E5K>0U8MEg+Xf
z1YwakXR=NG!YqdFM4!7le;K*cxwf7{NY_W4O&<&8^6v8Cr==v<C$OV1v`{=u6fff8
zlit|pim-mE<r;mbkASr}1qHt^*~vLKjZ9vIlT1jd4(YxiZu18np%mkZwBS3qL6j?8
zSy~fP83Q7>Qo!x#_w4JJ>V=wn=2{(tUHfe<MK>L@wkyrNNr>m=!RL}}_f|bjtxO$c
zwWEE|U%6G0-1gpO{pMPGdv<uK`|7U7(ih)wEV}te#C9yxcA-}Zrt_4eGh0Hjv9kkW
z;+Uy1v7enS)Kv}i{xEYziLQbhzSW0YFOp)nHwlQ$uWsQ%<ET<SOhG)wA6<<h<<`EZ
zc{{ZW8j+x&!uNa7noj9iybwpkok`je^vYEK$D~?7Eybwqq`6NZC5nrVbjj=4QlgS6
zeXS8T-gi}-2_paEc%Ov#K94B}&MSQ$NB3aXveEHY&#K&6l2Gt+GXDC)zDK-<*H?R_
zp4#YBDqq%KerixZ@5Z|L9crW$cJRQEon0#}<lZ28^>a#j&s4a!DO&{N?$Xn)&fsVw
zIW)w+%ug&};Xn-BL%#q8ZA(y0T{BI8CQ&sp`*cQgrUdN4&Z3v)+^OXw(bfAongN9B
zghjZ`T$g2t6`I2)3wh5K$uu3c&nCl9Bdr(Lxsu#z57NpOKTh#M;3dkY8u~CiD-a*M
z?0s-kYA<sLciAX|B3BkV8{)0PasKnmfT?Q3D<awI7(NTn9B`fDZY?)bCS7J5mqk(P
z8{VX^`ShjWE;h30Hj7#%fOmgihC|RWm1xYm+V*#I7B9;4v4RDdT3TPZhkKg%Re737
z9crhj&dyOm(A7>^wkqNN;0^DlzFZftNA`%RRt6Z9pD*L6f8ln)dJxCNB%UL=p-F<n
zS|)K8`UOqhWv@Ql_JeT&IFhG!bSz~9y>9~N22KfhmtX45`$V=2K6xfLk@Cff97`sN
zZ+>_nQN|lZN0ZN?&#jrk9j}hyLFLOT7|i(GypGp4BYA_fI!RfV2fvehZc48#=&Avf
zlXO3hgiM)2ZK3>enNQ;qJm+DyfchH>&dX{ymgKN(x&>NkYps{Y>5;8DJW~0cp+Y^@
z_QKUDsKr!U_ZBO;pXWq;X6BTN$m;DyN{In6M~jD%Hp$@oXqBqfl6NYb@x<PUM;nea
z3`!i=!MikP+fgG@l|4nz)pN$)a-6aad9sT(KX#Jrq-z$W=d%Y7PiFhBx4KgcNF6=y
ztG%CT1M-<L!P+x|_vCQC)1{VJMC8Cumsrbk{#%Y;5)xxMT=_-^qoP)=J&9et;0lj}
zbcj5DZQws={9;1_Z%-k}S+(LRdohk0J2uC_+04Gx%2h};>I0*WGsU7HPZ8_jq|Ben
zaa%`1qtbDnz}9(vQ3NDr(N~4=k(%J^L0Rn=myTRnJE$rrj&f8RF?Nf1+Ty}VN^hw}
zv5X{qNE$%s1>bpb_tLc;G_0!^{s=WrxDx-MUSh+AVlzd$npy%zz*6!T%Ekzb`nt0V
zpi&>765?s<E=_VaN4_LfcEmjjk|_wN-_w<yJd-{D>gkG}5Rx-V@%__oL1s#k^?dHQ
zwsI^Lq#pbHgn@QJFkGBU2TcD<>qb$Ovd(FTufyQ+0fG>_#dkJy@dfcEo4r0v{YF9s
zl-X3e(k6K^aPsFzj{>7?wtMJRupIw8&jRNz<l2xHD|YY8a!ox0Ll>)fE=wh;DF>vn
z3{X$40Vn!NghPxwraomT7B7zq#jHO&AE*SKuooZ~EzM!6Cd4~tCnu1I=f2dQGn@IG
z?>j#`Ajf=8^ZC^j1_Oj_@S*kJLQ9`%29x9QHIYoL4E<;2qHGn-uH*cSHDeq%$ZVr6
zjIyh}+~|1D1avRPl#%7s!Z6()vU<|fE~Qw(R$iT2Kk5Tx5}$IoUm0QD`;~Z{JyKXy
zXT?;WJR}uIffkeF6Cr$*nK>iFh^{QyMH^~=Z(Sr<RubcV7wE4`qv20XtVcnio?i8v
za%~L36W2U)mc=_4C5tT>&JWgk8sePL&iteq9MtPX?M7IqLxtUP+34I@A#d0C5)_r)
z*ZZ<Um`Zh64xRyMVs1;YtkcZ)GUuS#;+^I2F1cgsK5|n&>hCuhje_wFZ!P}(jmp({
z8fRYHZ~2AXACtF#i{}76pQ=&QCX)nC(X8`(gfZs8`6UJH=c`cX<`cnOT|EXBdoZk^
z)-IUszUJt>Ku3L~#ZnQ9$LaP_rTC1s%gH<OyOtdv#df;Su0k7MZMmg{p=|IH!-PRr
zYX-*djz~=5GhJ3{Wus%mh=9$aZ+;;+d;Qn0>;W?ahp+GQbLbpUcNlZ$tcBQjM)d*C
zQNv)(q9O8}?Nhhi**et@{x#*jLm3~O6Q&0v`^~V;C{3fkuGUy#pb8Ns!%c5JigjEC
z{70i+FE<jjalu}jVcm)t+C)onj2edDCzT;r19l9u55qfMuczP2*-DJvVs~S4ycCKb
zTxeX>q$JN8C_yr-qxtUX(22}172`sWQ9-CH)IBc7JV8%6@nxx#w`{@8E<Q5BN5Txh
zj~BfU_YeLYUd(Y-Sk+pOI30&KL1G;M$Yiq6*+{8kMG?`j#pQ9*alLB!O%;dYLHjmL
z?fCq2bO%8(xq=?mmg^ZhoJ&eNUI+gs)8_6MKGR^*9w$=&*&ND1i#t#{@Ns0$2x)>v
zHx^l$h`?>iZ>mtI>*;q%#oRna1MJaQYo`hP)7UnxtTSbVoxe#klB0CHb?x|>nz>ZK
z_Ct^kbVb)SC&d@`<MQpYN?-OT=pFpqbF46f_=tsmxi!91TLc1QiwdKa(8819$4;El
zYJDM}$r*V3L=f4FLo$&X7pmUwPNRD$<XqteA)g?V>#F^l18zw(a3GJM&A+=TOFNK=
z0fUnb%PIBvQ*Wj}_b0uC$`XWFg6t43zs{Oz<9@(--)T5e2Gd56cp_YA)>Qt217Zus
zAYw#%r2;Gu?a2Ci%|iYHL-x~bf#;r5%o@R>$TzJ<1cAS^TCchLt<=tBios#mNz{MU
zV}3d0^FPp%Yb@cG5-j0h%dN#?Vtg7C1=Ahq%sEK@3htZAL9Y7BCa%y%z?AeDS9`q_
zJknYWGhV<va>-pE7OJ;EeQxz8e^V9}&2h|VVt0og&0>XF==h>56*v2je+xV2QA}*P
zKG+-_5pZj~Yxt>}c>^QYvySJ`42ZYTZ%v0s4YzSsl5)qo5xS76T9xzm8Y%sKAfWuB
zW}cW((~O`W@Eq8b>%$K1VeSkkiK=s&v2rG?dy~=%IF*WP@ZISj&w|HGuuP{~Wts5m
zHh~vhnV=8*dQ)OCB!sLyb=h-28<Zk!+{Gby@#_o8{j^^s(2<{<x2e#Fm*#y`NlG=t
zclAQE#ySNn(Qg=1<heGa>5jSaY?m!c6b*_{Q@b?i-DiBHw6L?*)4J@3s)X_kl&v)W
zd9HBqF^UJPHR`1CqyPJj!A0Q+-CKcn!7rXRFCMJUIiK1SViYax#(6l`74@d;cOFS7
zL5!W~;j#hiE*oRH?S;P=TaO6)c)eC?jHu*!+Q6$xuV|GEM(a(eavQ2_hl27|4{^HC
zOiToi8<b%-ld;FeZslC~IxfL)A2w1N!s@71x8MYgKuY(ornF^p18^r>&(8oQ8N99P
zll2puk~1Yb3)Mp*=*m8hl%o_O-J?EU*a}Yu0FACVk=Tt|H@rIi8moaE%<KaN7$vB%
z57j(68>2CL?2+drw;ly4|MXT4BvZw$XKEmbAi}_)+xreZ`Nb*%>_Q;@va>9Cu?bI$
zB+$U!SF$&OIg4E_sH{1)oqm|6MCQYoXp3P4?ck&8cs;%NrNL*M3N5F*1hDhpT>$pC
z6J<)bR(;N-1SH1Iqk$_MB3sFWNTpu%SL%AzeYM-8%pf&J`h&QSmwQDhV~~$_wUWth
zhe}IiTjRd->7dYC51AJOG=prgtimCGNStyG$_Yq)1AI5NpE-X?wgncu`K0eVm0+zf
zJbv-Kpf87Hf=tnQ+LX2|^YX{A37^zj#a7n#3dJygVo4-6@aN7s&=+X|I9dh)lv;yZ
zfc;H3;|3M9SL|I=D%>fU4|L8yQq@2Ff8!oqmU7{DRzC(+nMg5~tTxNsa$zc2$F>8B
zAu$+IOnRKao~G(cdB5OyG3{Y)itEma*fCe9oa(yuG!hI9qb1q6;)e7wz^@Q%&ts8M
zekW2D)p8gtdh5Uekd<;#tr7(mlIyD<&BaSTEoP>cn6Y*Iin3m`O&@Oeq|sgB%gBCu
z{A#nMF=SY%zBfJFJ-0o<ap)=O3xClPhm&fEm?#M4EWD@=*y}7I&@P+4O#rhO(1IhT
zl&fk_Un_Yj#d&g<4ra8LIG#>bCt2rB0<i%Un<TTHL=iBa7_3#P*#@>Cu5SmDbBKG?
z_B2JlL{i4jl{{PbxL6y)&iLcIa#*QW`b!A#L~~)NcW(f967?kY8i3qqZYbNh0Y*en
z)Izvidv~h1&|!L#kNJ7W9M#3^ykFmbB{uS6w=9x=L2k+^Yi-G6!W#`*c4yfZg|rJq
z@;%;fJ?44x=aaD3N~H%CyXb96Nj@#toW%cP0f6DKv2s)OCO3WT@_3~2_MdkV-&q9a
zXS-s#^9Fm3p$m9`@pz(h`}hGqY{iQviPWYk@N{HNEkBXP;92lA4;i>PcnJLzNTKrZ
znNB%4y(l>>7#jnunLw9y^j*^R;&3o2AJB&jZv@X#*|$tZTQAZn_f)-(?@N8t|D~j2
zPrB`;5t;0LHsLq@?!V=S04_G>P+ffpRUp?>c!aSpwG&B0pECxj3|9#o&sh+Ojbr+7
zc+K!wwJLC^NEuiu3ObP0FNF^3r|0$$Uv6X$5$C~I=LfMytdhAzz6pZ+;)*0$LRxbr
zCkf5*oa(?Zy{5|y#(mx0*UfL=2Z{^XO;2>y475lSYw0R=IUkcmYQOPLbPy4RkLwB)
z+8}AJm<kVmHpQ`XPQxe}Z_Z0sOYoN5`YPM`cfN?bH^WN9RRnuUF^cGA0)@?18mckv
zdg7nD&{~*=*xQ-UDT^PfnIPJ#ps*G3*}_W3M;57LTc)sXlv)&{)Q(JWHP0!icHpdA
ziA7!-h*h1Eei{nkG*YmyPleVi)Kq9=+ORx{n#I}zIlAv=WB!{FBALihMGm;r;|{QC
znHQ@qvRB3P%Nb_;Gp~KRzE=5Y!aFgkJv}|W+&&2y9LZ&kjQCx5nTN`@KDgI7w&;BI
z#$T>IW6l!On13d(r-95))Y%bUJaEy53ynGW$wzv7Su4`yICzD6h)c`wNnED@4qDN&
zb|yaBf%o%2d_*Ad9d$CPM-i|zw|$L@R(l_b`z^aYlZq1P<-kesWEJn_d1;&*ZWA+M
ztb><_uXt{*pM`lfHpV`QI?cfQCn4-Ljv|CkKV_acOeQbRZ>}3H4p0|c*;R+r2fqD#
zs59{eAk<}<a}^~Sr}3jcd{|bJ+Y4go?Z?JYc)?{@h<itdpv~7`{$WKN>%f59SG!38
z`zkz}St%ax$0+qe$k;iozdU=iv!<cm<iq=g;Q@qf2?e}GK<+ip%(v$oSFdiq2Kz4Z
zQYiu3%l+rTe7{Dp(ioim{GwK0lqY0)2GAqZ#m#<M+zjPbCz3}EZpX!RG7s?A-u(fr
z9v8zRw}gjGz3*#dYLhIP8{ch9oGsr3$ej?%19tkOSnUK8(XM#*Y0#eAIowXvj#E+4
zwU+3f)<SF1)(e0Ht@XU}*j1d@_A2$>sy9`)`%{JSt~Eyo?58UOwzvPd$9bn5_wb|4
zN#-kl0G?JYgE8^Qp3zP>2D2U~->b4XTV=D)SaU?_iwnhUT6}hT-V6S!8ENxv@?8=?
z1~x%ysUp$oXm&$N<3I@N4^rS(M6!dFy%{cx7-Klf5T@gI`NSSPJ-+h_0q#>P6XlCp
zGRMTQhMj2gNzJLv!w+9UMa`TehJstB!iw;K_YkGSNB_%CUFqW2d;LN#ib|uv`eMI~
zEvhI{UlyI}*!}l1NeiypriQ1!zXv&Mncj=TQs~M0o3)m_4Gs`vYV0oD0T>u2qvlW{
zjTPRcSBR9rGC%g;^G{uX1At3C*K`O~z{G0<iKJOd*O|p(`M3J)HoD0TNlkD)@l*3F
zuuMT2NVv=}76zMzIRat|+~SCUoaz7`i=+a9&XB6_<&er}(RN~x*>Yr4Gt2yF6N1F9
z%Rg`y%t~ScZZa9!-F27tI?}<k_K|al^<@G{vHOzPvCsT1vHRxY(V_MYLY+SLV-?*y
zny3|6(nID>Xf5f0#+TX9xv4_rU@AzDppWZ<M!_%CyZw9l@wb|fWBmXe00<E1%GUYw
zKUU*Od*kXXz;N(ZLGX|&F6UChGLG6Z_HMhy7ugXhkt-C=J~b`fPF*VI$@M!@aKv6X
z#&m)N1KHMUZWNj{%^%PZbZ~l_J_ht{=us!`MneuS_KldTt&Hs+!WE_nn6XLc1bF@2
z^b0vs9~NaWPUi9aa4y;nS7RBii7`&lFF3L1ttWm6LwsPsNad(IJkbtdG;1XsV%Mv4
z``F!%>;6VN848OJif7NR{`R=`j3vt_N;Nay&dp}9)=r;R8C`n_*P4D6Q5^qVJrnvF
z|FS;{ao=AWWm^o8&uPC>*#5L)uw_0UrS_#kBz;e^djn{P7Ad!cLnI-piPWND)vlan
z%`~wN7UNf+{Z0NN*4JkIMz6~v0Be71GeMq1(}<FakBB|skvEc*b<9CC&!bv?zm&C;
z95pwl>m&glP))6?AiH+;*V!0S2~FrGP^87vHDP15@07R5f72(Z6>5mJ3>16WT=81e
zdD$pCsfXDsP;Bxa$xjHOp1Qj-#V7y|+<@>9@5Vh?d!B(Dpj;aBruIH>P%yt#wqgPH
zVXz1&#W_1_qkL9k2wW8p2Di_polOmVT|df25NQEX6m;)Wzf{4}0Ka4y=d{g9#y>3Y
z#>fQ)8LY|9lm1d-udlB>Eb6=ddk|dd1T5YB*=mZvp)hz{D8F=~ka)h|w(ZLN&p${s
zDR8C`DWv@T@<C>;IZ=VrEkDqio=Q>hFt{e(u5{z<+Bl@qn3iFdj&$1pkL#*oDUYA{
zq1ET2LtV6H8hFeUieI7xGk<OdbnXngftlZ=2W?q0`fnY8Vq7KQ=fk#0t-*{slzmSR
z(Y%z|ulb=JprmegL0Q&Re^(s!U-jTSoiCr3FA=5iB0J2w`Jc5ytW4$Prv=8Qav9m1
zGKPfoU*(Pp{E<2@vxgv}lq@OO@0C0~fGzqF@J<a+?ZGN4|3fbU{NkO#7_b6I9F71e
z`;5<h^nI#6W&)Y%P_l4mX|-(|OG5vbfz~5`%tMX<=_0-on}n2lRs!lchi-y*UBA;l
zIz8JykAkW^zM}gRvvhTjf+e#8sVa*{=XuLEK&_O`?8lTXCj?*j`j534X7(9Raj&MB
z-HyAM6yJejnycc3A)wfubj^EH&625T%cOh5J)rg(<)koOq=#}_Lo5Gsz(bl91pa5L
zITm)qtWw>W@ypMxi;FrCNDBi>)ue;#q=Ev+d{p$!4Ny@7x58Vu#YK_{Yohcvr_Z%>
zV#R+|muBH9wplwkP<D+PnF>AHx<BFi)`uFSD`o6XEhbR=1wle!E)RdVv8E|ibU#_@
z?j`};eV<2o!f!`_-QIz^{bH@MJl~+VAG`W`#{CBK72r@NvHKuM$k#%1EeBLWruTCp
z71A6TdTeIXs0J@_jS;MNT|VrVr*Ahj!;vL2DoyUn8>a-B%Zcu$`R%`@Fcjv3w+akk
zH5d6OOY*s_R_B04)GBOSbj;yA>l<Ms1E6Z3S54v&45#F+F6Og^A&-lJXj@$|e3sTK
zNSuySp`1nV?agy|b<XzkK)hCAsipS?cZRI5@OaUhbt0`oh&>>0F{(fO(w?0v0!&A>
zVi`;4<bK_=5w&bkK`axo;<F7WXzwXW$T!U?_kmL-V3NvLb1$C?IWYn1+KbngH;s%)
zclxSUX6E%r3Md@K2oC55Ih@#Nk+<`va!5?bJ#&M6xMjhZF*c0`+#D@#T;e7!=N3;~
zLDPx{*q3e<1_>8Gd%3NM5*=y*|3Osobn3~g7gmVlUXlsZeV|TUz8g1Yv_)?z^WrBb
zl8bt~7fTc82c2n|&6GA-e4~@cP<Sr!uck@mdy?90?M$|-n}I7-U)6f8n`Rtbb{(t2
z?2ZlSnV<S5aM6rCIkcDdrLjfhV1&oEcAK{YSA%ddsTzG>mHpe2t&7R5t7ZQ#RY4HV
z;y5cmzY7*d?a_B=N*hI4GiTx+EVqax4h1s<PW50w1*9bI+KOJ+hJ7J39lQA5kB8CN
zt}4KXxf7>l;Z@qB597r<JF(UR$V<%S+G3CODxvVe-;Fu67@tg$iId~GL_gi%KPhX@
zpbKTAm9^!{VFyn3j`y#+sh4XN0bOX|Nl5p<-{1V6{$ZbS*mWJ-0s<#G^4gI2fB$q}
zgL}jwA-tVQSG6|@$fx*3hcpV!NlV}N4A}DT)iU^Zjx&6F(;UZ~yTAYzj<<Uw1(_eK
z!@w97?J)0jLU7*3(B2))4RXBbYLKRwBzs!-y;CD^k|tE-5W9--2ai24zwXm#f1W;Q
zJ^kFcbEq*bVBCV5f7wx@ykgxz*05_Xa8lZQ$(NpCCWTKyh67Ofy5e2jpd6Omx;fWN
z`Ya1vpJ;R3nFoj6iSM=j=6>}|PIYnt=4HkY1Fc$S9PGrGT-oWZQ*Tsk+&K28?4=#A
zH-gb+3EDWcKr#p{6Xm8-Cc=wrCGt<pt?P$+x4DCXQB(E3I||Ft{2S^GQmB;9#ff5w
zE7eCO!;KV_V<DMnjnsYOuohRJ*?m*a2YvB5@b|)))ANjR8ik&ie`zC#k^?+N9lQe|
zbUDG$LN}3|Zeiw2R5B7Mk1YJl`E*>-6m5bYT^s7`&1Kq}fZLNVSpk^9gyv;{Q@%C8
zj}|k+F&HmWWP?s%6y0T=xqOQq<jpNaMyrIlFYpwewHY-*;H_Y;g0>)yr0NMjTiQlD
zfS&B~A6vd|JONaeLM9qtqe&xaiWS*tKWkv*un;Ow6PPa<+dl-?gKQzj&Z<Z-7&(Xg
zS1WHk+mX|okj^dGEnFYgecbi)&zXMpi+v{iG6z`(Uqg_cA@W)AD9J=PJ(G6NSvv#J
zOra3%_z*Y{FBFR@8qd2eNn7;Vjb~(<K#@cONfE7Y`eQ?^cdO4?89rle$13YZ$ZtFm
z>no&r6`kF?J17#)_DLNBfVmuv6R*|-_P>Je6FaF4M+F-Q=^zwfaKE>(!u^K=AS`nG
z_68=_$Rj&fVM_;(j)*x`Dv2j7y$eEy*<8r7NV9(5Q)b=1N}8G59;CYGx~?TR73QGT
z#`;F)rJDR65xv(-Rx0d-1umEO@4>F5-yr6SUrs#k3{}GtYOLXjAi8kG-{p<OEt-**
zNw&Pt`b3R?_DYE9hjW7;7nE{>wKB4oLi-_&;IDWiVRdc-F+I&P&8irxX!Wt^Yt-g2
zVUe8qi$;s3cG-_^RgTlOx5n}Pk76C-=HYGNK<Mx=E=We=97m+a<VNApOC*GMATa50
zE-4lU7=-#xA*}S=1+sy{t8EJ{t{s&?J16?cNkWfAlt|tg<8UXi7aq{Qjnl`zcPs{2
zF1anhf;@XI7u6sjv*%-xSi|y%@P`n<_OB!uxsblKJj#7G0Bu?|k_nm&eMCf4EGcSX
zY!94yD>sVP*#HL+_Z$YKO~Gm#R15R?1m828Y@irpc^8t$AY26>sHQBIaN@GqX+z)J
zxKm8mKdY$w2i0it6v0J>JUeP5`Bt`+)10L^gs|qPnq^maqnhCxX5Js-7v`~E;xB9P
zGf^%|X&Q(M*(8{JPL}i)G6`t3*28ZJFcJwA99CJ(#pgdf4)XQjcWeL>ViWe`pH9mE
z^A}bB(~Ol^C)_VW{uc|NTAJB!w`9?}GN1H&{BvtjtIFcB_>3&Y#IMkyf)Vk%QR*tf
z9L*)5?*|@^4u&-2>VyiJ9faoqFtUqTIHBa$WYCNHz<0@0=Nye{mRu8E9u8$!R6By4
zZ#fIk9LimSEy|(ot&*W_v#FOq#$SXSREdl@h!yetBqRey<f2zy+*Il1{%jUV64?p4
z<c>zW=M6YjZ1A5i6EI1?ch~4v#yk+aBl=e;<QT~+KT>fLRwMz)#J@Bc&?I~~&fG~P
zWt_|*cjh3ptP>s7U%ke?Z!DMpD=n=fr`tWZ{;>AkQpY+Vz{3573hwNo4qS*;vuC$@
zQ$S8C%FQTa|2xq(4LMOC;bM(U=^%jltQ5Bz`P!eKT~5RpYy`v_@<JfDb7|{M>J7yw
z@vpwMnWbB>a-Ap}(5gU|d~h)q2$YRlzn(6}Y1Flt51}yqLu7}7r|b_o-q}j6@o;)B
z*l%2EdbcUY!o*A*U%Z4_Zv1Q&rf3&Qjde4st4SUs1AMnX8bpHwmc1r`Jd_302x5}T
zXX)M7_x{np;%3MY3o`Ih8jSe?FPSBaqwe7Qo#rni3NH73nx#<WLFT|fLK^YsMw5}c
zR|<+x*WOTG$eJCg-;FqA#5tA-s)=KZI8pTGIF3Xxn=Xia_k8?EO!&VwG24v2sPdzj
z2$F;&vX`%k{}kP~j&0Mrlfw$PfJldn>{TkFtoZ{ZrYP+_v|`o-N>}7iGr_~7cV`^;
ztlmtI;a&6ELk*JHA2JeXp=feA_q#^0%5uzsH=xpJ_c709k(KB>FGSi)`Wj1<8IyY?
zGl4}Y?rMqphy!Kk_BR#Wn77urZQC(CPeN9LS6I-wt<xJ@&Th-p6B(Tj84TZA`h|y|
z=t0O|Iy~tYE7>ZrxfpQ!ua~4?df^nIsqS|5E*?bNsyjA9!<{~k;lf!jCTT#jq~@{E
zx(3@lh6E@j3DgD%mvNa&Eu>9UmDbxyC$^1Y!Y)#Wbq!tr@aNgeE=8A{I_;}R{1mWn
z87}uW*>HouI0l5jL*rWX3WAXkJ;Jkt)Ew$S#cwyo#{ubme~Ln<n_WXO|HNdu{5O$Q
z{{d|{%+S+{H%RK-Ni&sIyB}o`wa^PFK4`UQ4l{fcMz~TGU7d3ZAjOk}pE^gH)pGaR
ztlcRgocHyWM*rE&2<qn`9bzc3L(y)t%tL~eXXEu|qVtvj>DRox>al*>RwA<2zTy(a
zm1+ZYx4?)f^~kn`CiY0(Y=%8832V$DRQf&ri%u#$aFI^2l6HOM^h-SwaOi4<MlSB}
zxu@zZ;}EHQb!#*6@XP1psr8_MX@|)&Y^6dTHP;?Cd`-2oAWHUPWs&`H0jieGF?j8T
zpDk|%(NxQjuD#yU&i@r#@A9^-r~tMFz(UYpr1cF-N#(uv$tPr(*!(RSY#ixdPZZU<
z?~7hzA?R7I70|$v4VmLm=gL$ZS4&MFwTDuEcEbD-J~i@)iXzvazu@vse1|WkIz<_x
z+?Xsa2nDX1I5VPuc+t?_CyCKhP9IJ8v36tN@lV?SDc+4Ds^CX}QSCkRlK>iT*|!zV
z%=YTF@pWm(QLW2*s;Xd8ioiA~SE;&*9DWYBX+PIzYW_#zfh1rS_ey9kh$>&@BLe*)
ztdP|x)d*0o&Gw*@zs7~PTl|;507~$7*=K*a&@(JWKn&C4Ce?=C8bFzW57XWBSLesN
zz|+SB+iH7&i@i;dkYTCAeZx0+`WTg{Qa>Ka)e@|J35B5!-K%5i=tT3lo@8r!f-+{7
zIWXK~t&Y{u-XENn*K_X6T*|SPKJvVyd?RltLMY3}cHPVb7M?Tb>!8?~p&}27L1KNV
zAC0c(WxygQUJv?de+lR!EzG2pL9PZsMKX4Vm23IQJgGxLlSbWTJ&Ao`Msr#uAeTGE
z#VHmvMzixIf#sbo$66W$NS_paQ$7ln7ve*|0usm{k)nRZ(OQ`ViN<`=S4pbo2psjF
z_9GZH%p@T>lx(XdMQEXY9;SQ7gn%+&)_1Qs2B67023y{{jT8|9NC87NK>mW`gkjI6
z0|X0FC}498tF~I-C0>8VLQ{zv&O>2Hp--eg)Kg0lphzh0jBW&1sXmBZRE})G!tUq*
zUvI5)gE9j@qJRrhg-GIM@2t`xxsD1();$w?^m>w8QFxlT5>j53iW-6P076DUUI2V4
z2;#Ul*GO7bTL%n)bcu*7DI0mndCu*JNl66+sB#I8ySRwkq0Ob|PTe_Y4E4Y=ky0t_
zlKG=FxY6ktqLFMdRq0M|V%@vix1|$}&s+<B5%jFD#HotN`M|Ww0@GxIQ%-IOFw2?+
z&H3O{Ae-cFPbDN<tUX8vZrI??K=gyY$EEuU;9?l$Pk=bwwSRz#AYoj&nP`u1wi-vQ
zEhxYEjRTe0?`M#cTD6l20>T9Tal?B$3|(zQLkQfo`K>r6f-zRDvwlXUAvkfn3+=vx
zr$rdRHU|ovq|jF}T_D>)bJ`CoEfO2$MrNid3#c2618z_@l>p5QcF@~qpLb*$u@OK)
z(PCisW24*e$zevDG<M6>UZ<Q6+$dM}G1_Ms8vDZm<(#d^b6R>F6);`4^h()4S1NL4
zzcWSM(H`e81G6<=Q_MBn%J%G!lTa2{DNaq|Goj$(ie{y3w$Uo6j!1>dQmxajxo4XQ
zrpA`6yb0FtDECSUj`3F3*o)x%GJmRuc1^qld?$)&DUM>jV!}E(DS-Tb+rl7k)yU9c
zA<h3InngX;naZL=Oeepc0sD2DFhyX1H3nte%2vhAAPy<mIQ(VNDS>-*y)G|sQe0s%
zF7OjML-~K4y=-e<(livSG#Xm5K~s+NOH8@6Jd#O)XBgF+a%iNYp2&dD@}oa~8^RG?
ziE(w}MB%a=5;~U*2CR7x552AL*=+7jS1SA<$x~g7`43<{v_~FM#%kY{H)o-$5iYJU
z4)<D0^B26r9c{}KNx0wC$ngD+Ue}-LgFcrEhuf#_gTdt4LsvJ#1qHxqK7+M@r!QXf
zJ;2CX3A9$iMd$iBQLCY_W|H6uwp?57=%8?59vr;ooGoC=I$$`tYgSndzAH;sxhqp>
zb8ALnl;6~Ep7~wCqCzVwttwSKgmAgJ2Mcfh`C;}(5X!3Bvm39@))h;e69M3?=?}B0
zR>ztFEWY5w+yP<66z}SJ4^^;g`lRNrx^r2t9SG#dzo#osKf&cZ5uhQnrbcS0M~lH`
zIlr%?&D|f)Q%QE_Q!rB*yL(ei{X73Zb?X$kWX2EoOxyQ|U%=jNyVvJOlU$1AbfGiK
zS}7(-aOa4cP`t;17Lsj;rOrH{7BwRl=5l%x_A$wDx4cK$__UXGE@6KqY`9PF_B)}}
zlL*)_C?|2D(MQ}&;a#-YSTh`^^{bT0`|GDyf6~_@tg<7HhACU#bj)E(0SJj)u+V1y
zGDea43i+)}%2hYXK~kw2HF+kJIiYhe(@a`p>3+3K>-e!mS+kN?g7`^`%eNQIOkg3+
zWQo^fwldM^u%nxK8skrkXPfCoKUV$ToYI77<1zp`B#|gZCm2Ke7{4xs9PJk*`)a#v
z!}3Pa(RDP(i+!Ic)Kd2W%(Ag6?Bq*UM4K*K`pdjuoSBM<-UzZs;o>Zh-9AyaWz>L!
zXG*wS(9V(;v=gOw-2YtzKo5jqjjJ7ppd+U1zuivPie^c6#8T!M_QQxSe#uw%cUWQF
zD24|IX-gC;O!f9^=j`d{<cFApu;3(*N1+as_pFbjZWcI<C}O9+BMPD-Mwl?=HnQYF
zSoFf_o9?FszUTP`ZNGv7#m&xLG@K|#J=UdLr)r<X04!s++fv06-eQdZV|!Ni@oIN7
ztpcCjAQstbq8w+Hlz5O`YnoV(<#wu-=Bn9s#el?+J?aog1(e?(FC2c!@}_o)T%<sE
zGhTR2?XXHSxRFgbgD+G(5zACzdhz6G#!~n7*Mh0jo4>gXs~~mw*()av*DxCyi{F$g
zcvcfC=~-+8p7>~vb~}dn2dyoPAy4(Z;cIzDf@Qj-(I0=aY(`|{M%e9n@}g*;2QBQ}
z?|DC!{cm_G*KzNs8;<cTcanwJdfW$l20+8F9K|5FtF@aUvL2PUm3=5t3+s<Av$#>R
zOX@z#eB2^YCsf+}5~Xnvtr)|*KsDKn$y|OHtddP(l+Nj2%sa=a?n=S6wX)LuIEuh9
zvyzVdbY&&#xh9QjyI`k?xkT#8nxOgg`1?aCnGC)w+AR<jI3j|~zq#^BG4lYJ;Xy8C
zP&!ynOdtp^_~rAzbEKceWTyS9Rt`=r1<+3xj4VH{&wSovA$Ft+wddH)?>?f;Pp+_1
zoRDUe-CtGFzjuy`wX00>A<ol8a0G@}tCwBE#k==0Y94FNLBU@BpSf!!S?TGQ{wSw`
zS1Kh`sE_uIx^y#n671%Yt;FS@%g^e0pU~gVIHC@)`(_T3imPb4p3I0>%87n^7YNVi
zr=lElQMqxjd6m)n+lrk(eHj(ro;>fLPN;0d(u(Ki99YtjJ<Y?DRkbc^^^UJwFo!>o
zDajm7t)Hx{gD3Sc8pl}Zbkg~$m~D5q@OvT~-A)7W{n@b+WJbh*()gt)yhp=L`5z*s
znaVYi`u#@TZ8U4W^YsF;#nK!?*$6t^?mm1;Pdm*9b8>oI^*=Cavyjzq2+Xz2D?WW=
zYWhsSc={TH5Hah?VX>W0EvDs&F~hOX-8@Vg7_3)WO9qDj)|_66Y95N&dS+MKx#zpo
zW+B}$(hp*Cf^6o^W~VXOraLh#3Aop~55i?3a9(`pSkN51sbNYfwpH+3A0=RD=NdJx
zw!L5QdQN#1r}Yu2+UlGmlXm!HMde<vKyf#xuHbv6jQD;Nb5S$+GgjdH#teKevJ*wz
zT=8Bi_(>89^k}Tt`0!VQk&k>>?P|Mp7lZ5VcD%i7!ZO=wrYiH7H#5iHCT=e$dP-aF
zX|?RJOd>SXtOAyxFhh333^dt4Uekxy!l24UXIi(`RjoNab&hUO1XLiIc)ZjSSk8s2
z7xzU{@9^MTd(rTi^dd=(>4w#Y(?QN5&VQ(0L{710E52}wBA!thNWQWV{R0VeuhK<M
zosYk|lWkZrYSJ|+S$)eIZD9JiTv#5&v#bZQ%bz0dNA1i4S64lng9pF7$nR<1tPd|f
z*+Ke`AOzONC@U2*)n1Z)ymM-scBiG2(4%z3e*YCYzClRzv&SMlV;19ycIWs1?J9k!
z6<~K2jusWA0!$RnbjoaxoS2ka6=0s-3NSDebLn|J64J4K9DttC<2Spffxy!kGRMrP
z_fjUb&;K;xo&?KVookIRh=J$WKqW#>Vb{h#?a$3t(rj?%oDYQ-+eq1$i)K&<P$_S7
zN7;OON|-32x?xUA7}s5fY50K1@IG?(xe~*l|HT4~Z-fBeomy=1tyC&oOlYX+Q}0oX
zmH1yRp*rc25M?B)vP!d%tsTC@QdsEi=6Yf0mZIge_+;o`xujuM!T%J>0xCi~7dX$s
zaoFKpS)q%+{xe$IL|9O<7waPUx}Ne(b}*#i-{X1~3~y%-J}xxw%8D<KiRKvBs)Z22
z(<K4{_4t>PK%4iK9MOvL2`Uv%G6~L|wMEK83b}e%jH9iw!~C(R^r>?YB-fXV(EEer
zQj@X#y9(jS<5H-Dbb)hc`C7ckggeWV{$O-*vI`9;zg5u5?0WbxxcjwEQY9D4S;|sX
zR>W9a*DyhRTI|`9uf>x0QestbC?8YL+Lvgi@jpGYgO^vW0v0Q<IDDrQnbyAe2*vmd
z_9xE;lB&8P$nQ9u0D)>da%;}AV|<ccS24>iJ6B$kUS*#?J{7o5x2@<F;{s>6Sn)Kq
z?6vj_D0YMWD@<ui+Yoed`>j0KE%gettZDk(#gu$Y!aZWfZO2e_^ZY9sZ1lcL!A$=S
z$2Yug-67WOyzcMHdI`^$t#LE*0`*JCva1j9A@&&VYSv0goagTiv3bEpbJ=owE=%=z
zir@BLwYX}d+Drd~993f2nR@hoW6r31qka4ehm(RP|3b(~8E7otM9{jo?`ESlmy1O1
zcIx>|Z{w4ozz11;@+FD~VHvS@F0E?ss!`UnH}<eZjVkOOD$EuAk=foE<AAqGPCspd
za;e%~#!vM3y_>I;NllCKUYYRH#aWa`A+(*N^SWSs6#-tK@v3UN2lga`R)({;&-%!_
zc8}1AG<)?_qBTJoP`;2AVF(AdaOae-lzOT^W8A~LBgrKu44UKLEazQ@wc08fVir2|
zD&=(o1O5e><5~@pRx9cK2U8GusgoY)u+zbzjXUQl66K)^JP<^WZAG7Z&?|U&NBOSP
z`!<_5CKlM((NuhlS~#M)nKS!Czh(n%_qHyCq8>=JTvkssFg{fu|L(ii^<~fhRZ`<s
zn=hG|F+F`&mTn9m+id;nTs3j^Xzpc466C}{`h_6C(gIQ#;}Txm{Z=7)-GFhWB|rC%
z^oz13`m{{VmFVnFHDaZM&?xP%lo@3r1$$BiKa0kxA`S)5i6MV0W6Oc#@|}MSmXqfz
zuJeG1O+(VrN<oj(pjKbTE}9zqCgIey$bhm(0(^m%Gi@T@UAF_|rp{KMKJ<mh4L_fw
zDp!tmEMR(%IK0V+s+4SH@y1p2jzam;2N#0)#`Fr4p`fEXIjbj=KK=r#(?rVMpjOP=
zr5!Kc97UC4P3tUq+?mVL<cm%v5J^;QVKk1SXnd<jsY$Lp-W!|b=}9yXn(i%-&K-?|
z*I+<Yk#sH+jtgK78c$F~RwkINPx>W_KZL50PI|ApN#%^3Ww3GU(WC(Ywo8@~vwAA2
zO|W&ia+K(c>hb_aTqs){^An1G`!O56W%5W$OetKP1V)_+r~&)-q|Xha8S!|2G@vHw
zt7hZk*J@qsITz~~hTO5zfpc|nal)A)GJ)6mWi|kv()fHGrTabM+4hT&F=xwfb5z(+
z^%8xuHI9mimwP+u-E5#Z^;XuHZaEG$pAhxkvownJFl4Xm^bS|09z<Eql~QVFOOY31
zr<X#m<AlKwrLWS!SstQTxm%`USf#c&M{Df3?-T6;2O!M*Mg?mFmv0CUkR7@)GrgXo
zt}T-Vhe~YAXlAmOXj29k#2yn-3eoJj4r0V*DHGcu-dYXcm<>T#B<;1S#N$w3S4n)t
z81uB(BfA!rjCm{=Xy&#8nW4Zci7zkTO5W|Vq(E09RsKe0r7fzF=~xqlv2`lK35&?l
zEg=m&_A*8by7n-A{cOv?RBMJl(K833kGnPnG}_g#H*l2OeJq-8=p1NjK8PzD>k7F7
zi(OY*k-~ljc{f>+tio0NCfF?)QJ3VgeQQdyw2aNTK8EiR(KyqWwV~4Wd`)*N_5sC}
zdeW7P>;(-d=S)<H(4uppYNc;>gM^mOdPoFV4p|{GaooW&)nhGLrPh-|;ZIdQuFEol
zg`28RbspDh`^ErDgFS{}(=!FL@9rm&zx?&*q1^w6r?>EH@_pZj2NKevbV^A}cPQXs
zbjJu0#^@BJQ9;U$hS52?L`F)fbazOLNJ}>e{BGZ$=llEt_x-x!yv{z4BXRmQZnG1$
zb*0Xe!dK)q;$Z*+1bG){9ubmOFVum^?FcI;yQd?adjIH7$b^<Tp}!dKC^}X<>MXt!
z)D-*x6D4qBK->3=lsP?qFSYpNH?r54v|mFMj#~KJ#w}o?df|$9qe(+L5@xDT3T?-E
zUW(6C08qR4_<z^x>A<WghJ2Ne@3~nm`!v_jz(gM!#<+3?_o3M>d^<t8$oo;Trh|=B
zl^0qm&Z1co7E$3wUiW7_kH5^Sg?HMa1m``FD8qI^ilz%7hh2{(SW3~c5rUV5$CRhJ
z0Ga6AG+(L6^O8|D-Duq4{lky`<V||phg<%K^FR$AiPOb@sCe)&ACcO-+`WVU+&CXH
z-La8iNMDJQ)i5x0pOK<3626YKeLF-jm-o#!>D!-Q^%v<+1`sBq;ECS?X~gK3^l3`)
zcht~X_$$0oYYJ_HCXE(=dpp*lrAqCAuL8rA;*v?&GWiWPyQ8jHa2tuj?{}SC9)}H`
zl7U@!RvvaBF3vE;ZaZ4-in3K!i(cK+B&z~&b-vc~EpEA-jAL25AvQVrQa-ORSLR+7
z0bV%=O?~*l5#RjoTzoX^BT>z9F=!7ElmeI?aXQrar=<fe65Ex(R2q^-O}v`jA9ddt
zqNh_2eN&0tFhp69_OQEOhQ^o8zuGAmLv<%mVb2by?3Y5rM(CohYF^ClD9TX1ZTNif
zj(kA!-gAy$Z~DqyLbOK&)BDS9tb3xpy&0NQbI983c%Ri%XmKk<a?TSOgb8fJHVNS(
z1M3~yCNsG+7G(@{=^9%}3dP^Pay&Of;Nkx|rv}XtfH5zPA(w_eGttRU2E2YHzBJ+c
z&0nt5mj{&^^oEwl5^^I-xJ>)+JNI}pEPH$)Wm<+%D^P;R4O9)`SKYK;RGB}3{?+HO
zKCG&QLhQUb7T>?2GMe!f_aYoF+fqhG49A0n9{i|%_`^cBwBlhxr<r8|@w#8|&XsJz
zm$yB{9=|JH(MP#uYN?Rv@Bbm(=jtXs-#o?1zdDWOPS8bFz>JVDJL`uOSq6AgdHxWt
zBu!K9sLUYwkhQeoif=?lNX$okE?ursW9TqFKwnZ2!V)5J^PB&pwg64$sKpObo@`S;
zD-ujrJMYExOY72vhyBf5{efa|R$GZeP&PYu24Fd%iw->(AK&NB@MALM@;io&oF=A?
zU(97;p3`ceE**sp@N7mk|F^zuuN>pP$=q<Bw6Yyq@a`Z)S+-4M*8G9NWWKc)!Lh{`
zJt*6O5iL(nI_1~CW~OVaS_6{hkJF`jj8vHQ!k_jev`bp*$-ka-x5$UHPp|#&r}BEb
z?1@eYo3U?QG0`>#JR(THiHeeu2u?wsBq>%kcyzlGIY+KKr<1N>w4&*QN)07=f61{2
z4ZqGKJdX_6(qbd}fXYWS#t89op0=hjK#0tm6*+xc@Qfyh5DBz40HhSc^`;x)SyFS{
zknX5CiNcdgFZQfgMRIvPj|#TUzVHTGVQMGyJo~J(Hz<!h+rE0|km)70Ly0Y&!z5L@
zN*y`I#zhqWe&xzTz5S`Q(%$x%k5Azq&~fpPti|NdQG1`fTV9KjOzrL~JM1UGOkjn4
zQsVew^M&*nlQvw85B}qe=D|Q{o`aDoSHAu=REn$rKD@6kuJP&Ls=so?uNMD1ho2AE
zN-HvZv6;q?!b;2^o9dNu#WX6W8*-TPm=^Ouiv_wj{ajg|Sz6@{lKbV5krkf<7<B)r
zCqPe4xlyP`7Z}~6=VcNo87((FjrxKpZc@qeaM3F+Lv>nZ(<JF2mLfquDqahzbUoLX
zr0bLv{h%hsf7BTuK9i(=LeH};n8=oVv^X%{dSe>+m8(=P-x#k=>DqfQs<$QSnF_rb
zcL7025p8%jd2{X-gFw>S`rm$2fh*k{GWsBZlls4vSj!BGAoXTFW3!60qy{o%diIUI
z(jJ;FLzdU?8DqGzOSf2nNzQQ<egX%%U?Cp6Zk#;ctM}AMsd5Z0yc3bkt)vnNiu~`+
zK=f~H!?P~OGYSoihU;YY_0GTk3LlqC8lr&3S)>m=ZA*!$g(es8-hV`C$xIlf87%!x
zTGucPqx0(cb(~5L8HnpYQj5`DE|iPd2x`e(97WEbC4JDJLAA)uoxX8K{aVD;qbaa)
zwNQ~tQtyz@CGb<4jc+%kgv3V~Le&0^Z{4NbWaSVrl-$7)s8Fn*dO#}!(6(QBWKh4;
z{lTkwu=sw*29rG1es>2W^^mHWm*_F_^({_*<&9FhOGcOV(+c0`)<y)L!pYqC-oyXn
zO7N;G(}OODuN3ZMh`NgRpBea1)U|*;$EC#zF58T`1_M5stsH)$8Rp7E$^+;$*#B{@
zJQdr7?<DlEk7!q~c{xIeI!5`{`I>uqh@e*HT#48fio~Gu|M*Ncm6Q6tskBm-3LY3P
z8`ML3LPdM(5nawYhd;n7uSC*gQTbT^T1o!x!mfAdrBMqzO71kPMxCtOn8(Z}i)Co$
zs<rK=Vk_j^$i{};OzFWzTo^QL&E}*7|2^V=8z2|5$@sI7x;SY-b#!|$FcVcq;=p<=
z`f=9o>-c0GRd|u1AQHEmCyQl0a;28;3fndb>v`dS^4%0dLD<Sf@8$VnuXH?169S*j
z%ovhM=W!@2aY!hF@M_kXiWGcIm=p1b|2$5ow3HeWPy^2mi;5O}`J~@Ff{)_YQN|7)
z;<Zvx%p(Ss{qJ^HlHRkX<>H5s50W*Gr0iL8qku+GOyF3?$RPuKR^EkggD~Vdfu<qY
z0_9MA6gMp~-f;O1#fPwS^pCW_l)Y(`ETE-t$+mC~!hXg@RTBd<yk$wI87>QsrG<lZ
z<o-MVn8HgSM^^V9A6KqI6lHPPpRt|Lk0_Fmu@h(#A?}bYfYZ8(YNJFg9vPMul#Z);
zgtr;!>q%I8K)0CsZ4pAf0FV>)9UkzmN5+giA*+@JX%dyJyM`Am6y57d-;xBq$w7|)
zF@}tKC?*qzGHL6Cgnh2LHBc^7gHyB?+3kvv)iCCWzf^^3tic%J{SFl4{jpGQ^TGoA
z?D?FmwAv&6t(QTlZWa&7@hQ36Pe&uHHd`+i>TpyHxPU7;rK2JQ4&1!Of7c)#@c>gR
zU?Z#hRGq-l1bF&d%o)(L4r5h#?7P$Ke*Lu7iwP0KD3FbAOLf*a@5~TxX9nQ{qSG2f
z+h$!UUYWG4XE|9mP;iQ&h1#hDZ<uIbI`N=LaJ2)fDp;G7cM$(=;Y6Q_sJDj}$tVdk
zXd0+G|LYWwjDpKD^>wNfNhI}$FO1i;?*CsdV6{+U)xap#tSH&A%3$69`(%ZM*$w1D
z=*rv51cQ2ebB-X(+Ocy(rg1#+0*AX_J&<m-cUAiVK$)Ymky8Hd0ZXQFJ8Sn-?B@WD
z8ldZICAfd*Q%z()<~x4c&{sN0*1iRuKX;1a{ctbc---b?l*O_drz}I?eXZt$H#dse
z(Z>&VqdKm4!8rc@cN5z{g&tV21^3tsVYUa!7Eb|vhIekiHT0waBS>6q$2U`1tsnR<
zCw+V-qu+Y#Ent4>pT4zv9V_F@Z+0|gYBVN%Y-Iv&{{^E)eS1U;dJd4l{aY4uw9hx{
zIuxgp*fUgoDRkc3Q3EbVTgX}2dA*|nM?6g_#)uRXDa|ZnE{=Z`K?iXaC@m`mbl8c;
ze8@p`IMji_tDOt~mbyYj@8Z$<k{=a+L>|>y{r3o!uD+exZ)@u^P=<C<mg<PR3YhYJ
zcT@W3h&l?jBzqdTSCbP^^cOVqW__b5Uo5{I0+-@Q9UTKMhweV*KSC<;=ka`NALX(i
z8&i?sc&l#bLa2&`msns+MMHJ1)pEv@yr`k^4N*CxN1CW`{FCvFQ%!iz?PQ{<<4R&c
zwz?svOgiuZA?%p&3b=)i|F+AX4yi^om{AmbM!3hNL<F>cEIilu+A4N|rJvn%v)yz4
z@vPouOlYbIbD0U76^nV5#9?Ls)0)vuuDoQdq2BNO)z*+Cs_VLKKh1Wjx_sy7{)@^3
z#uvgMdjPQuSaN97sB3(`rD4Q9{iVkR63@;H?<Q+=-FkmWE;XOf=$?UDoZutdt<>cj
zBZ1eqWqPz*JG$5YsT=t9ni+0VZ`Ukn@$paeJpZ0Xl}G7A9V%?Sm!1|1Q-vRUP6erC
z_nNI_u;Kxm0aAXz-Lc0o0G^`8WgUeRyQ+9pZ5dtCy0c2EOp2V3@b#q9#!1q+gfoz_
z4Bl@9GnxK!HcAb2^sQNt5M4KU%i=`2u?xQr<GT}6M`u2q;C}14;-?Go1ftHRewJuQ
zczToIVo+AiB2^*g>+KJ=LLb8k&-lxzwaLe^Uu;05UjM0U0yM5-EbpcQf4qi~0m24>
z2H1ScH%&Pg^&s?1Nqfv%B+eQsm^8NyS<W8x_9K@<DTlgHQD_1G(9=-S2=S5E*vri{
zzIgt1N!9L5m|=tZn|>1BLQH>{ZbWP*ML3Xa{{QHjM*TgSyP|l@#88d~hBMK%e7uxQ
z+AJ;|wpS0v8Z@8W58k|p;f9Qlv+Yogqt()PaAO{s#0U^5KADI!@SaJ@h8v<ITDT&P
zUq5)9fc1Rme=jn@J+C3cT)$9xLXV=aU`^Pt5SX*_Z2x=ANm!iS*VDnc>Jf`1HGc=u
zx6%FbVBGqRHoQ1{q}tJ>Wy^Y#@ZaM2flvk@?Ge^xe}vjr3Vw{B$mT+gk(TF-yQ|Cz
z45>QlKwxh);RSOB>xdRL+e)@^Y|te6f5c!lx(<B$LHK`Dxe!h9V`3i&q8WWvSSl|v
zCmQ4Gmt2`s$N&Oh?RVRKfa>EEMA#GoJs%+U`~Q7=tn)BmHu)@!PP$q>p`utg9bIFq
z8HQnW6F1YKEpwC#Yq217$d?KCHW%7U#nm-$G4Tvzak(kwdx_vT^5Z!U6D$wK6}7;5
z|NDQOUU)nsCyk2z)J_mX1bW+FS=Vry5In)19;lMcZh_*TH;f((PO(UiY1$3&9_Al5
zrW_x?M?aI;uUvmR9oLT?y!QLCKt!(%C{E))sfaGb3DgyqD}irX)$LNz_aEQ1Y>6a(
zEDa2d<tlY_jI1wHH2wMU%kjv$^N*&@R5d+-sg7hds8E7e0}hqy<&FgY^p8*o1d2vq
z1Gzp&tn%#Kt?<0!7o{#QOR2+ZA4QPqL(IIj(z&krQfn};Tgu-2NpoAaROOiuyaZk-
zK>nsv$yfduu<_&nJ^M+sUcE8tF}2fHIh<ft=$xQlh|Y*NQd60wG8NXtEZ1XX&!A^I
z1<a_2^%aLp3<N2`%0)@@9Ou!%fX@my9%z*NKO?oRd>@)_+y@L&q^>g_gcVeHI&UKK
z&cm$iW!iQdV|JRezn*+9&JJ{SK89$!HT@kn|319VXPDR?C*f=UshJH~^Y1N0P`4R5
zFev)CetoU9m3VjlE=QT?-g^K@0+1yge1oO_M#XMwC+CJ<wzTgL0X*YReYIn4%%L$m
z+jAVAOIq?iXNm9bx|Z4odEJ^1%bWya_lZLuyUp=!)1i4VMQZ6~pIKpvD+eX(&1VaK
z#?v-pDbyUg(^NTefG()D^rr@6uJ-|2C6F}HKWX~bq~j5#X5&zmES<tyo*r*x7+pu8
zN<pl-t157eYqxRC8<e!_Ukk055KhgLxW*fJmZ|1`o470`&^OMrQ-C_tmdj}d`e%g!
z_Qn5gflcc7E>-mN2W3?Wx-=8f8j5rL^_eig*|hd_Bvha0`lLA91_a6iFiruDDRcF^
z6Mz_ZViK22`?|kZZ0Rwvw;LqquM^}(hOqHho6*<1t~INOW}p7i(#g{_-Ph$gZm!^a
zYe2<DgO&S_kOG+HBfC9I;YuZmwpqGysw$dCkzUV#ZQNLLlUI^Cf47?U^`@2CX6iv|
zE<LxVHqx5D!OVQRyE>10$?Fv8_FD6?9iQ8DucE9Yu4WuLcY=!M0(6XWBGg7-Nukml
zln9`=-5&p+JOWO8!dN%j@dy6WU13U#*T&A0`w$vdGJcA`e?9(4<%!8DjzR&XXlLs;
zu;eP<sxO)Kh380g-1t<|@VVSb!(x$b0ZGSpxhq}4t21UFJHQP8dNT)>0nWj3cUI!+
zYQI@}so44K%e$aZLi@sV1WOGk;k%P}PgUVxFX~f_j?%!YT6R}>cq+tf6Q!jUiWt5^
z5|o&FX1|GnXux+AAgOV_|GgaGMhl(0(R6bGZ*MK_MyRhWJdWb~a)M@xnPr;d`o&4@
zZugrl1E#XYZ1ejt30t(A`^+)vKYd=Ym%lY%xw>s~BrOsI%&j72P4O<)zuyAw<$$mN
zl+lMn&GHAg0=i>S;KCZR*1Km_b0TMJ0kNo<JXxxl{$WiEXA*7Q%D=}YWkp*KV277)
zN-ozq?e10uo{5Qy3pY9_1!iQveq4x|Sr&h|ug}wb?g!h?a0SlyUt1gy18~N?JYT#y
znN-B%O<EEgwWD~Q4EN(xv$V{XHo6UtWy-p!J`Z%<;w*4hCg1C6+Xu^Zt0YdljzN&6
zwK{yEwt2~C^t=Q&ueK+p=IkxwI>RGs`_*g#e`#@q=X&{y5O~g{|DJPhGegj8bRZ$r
zqLX~@p!(RS<*2OTPDgKBMBza~8&-9dC7t!)8>N|*!wM;uXfeh@3_aOd*L6}qlML_P
z^@_0&;G+D;T4(Y5`0ngr<Mxz%n#OKq<lRZ4Pi)MIt}Lul$#2lhe8QW5=KSwt)XP-u
zPh8k8C$<dZh*|TWWe8<6IqEM@$sC3#iZRh0fjHcS7!@r{wM2_voKOlAXbxc60(eh}
z%1{7$<q(X%KFT$B{s`8;Jh)C&Jd*u&ZJj<P$Sq2~qx9pk*N>dPr<_~KdzU|+Ee9<I
zyTItLOeWG|?B-%<`5CE}^POq3GUbY^14VNWt<~~EsTyC7ozn2CVP3$WqIzollgH94
zlKOk|>~5l$kJVK7e>=Pdjr#p}N@jnDEEnkab=s~Xo?Y%1a+iz$1?YWUTh6}mw%u_;
z4J5AHXP8`$-gl#SDKt3Uq>y_f=6?K(;W1em>6sbw9j_<ocmd60U<AwFpMAPm2aBD{
zU5Oz%?a#ndFa5JaMp>9)X&;V$6_6f&%mA{d_ie`pz5nFCERpju;BB0A5$54l=(F=j
zZhsTMUa{{kUrw##ip(FrF0%NX`DzXCETpV7qh4^Xgv)k*w$#&8<dICzk>XFOdiD4U
zuixmE7#H&Ke*M`QrrrUG<&rZyzKk|8Z3zk`V*{}D|1WV?-on)TIu7M~rF`BUb@(Qp
zx_QpxZpnC0jT9$EU5+K^Wk1c4aph$pcx;228x1@MOciJCyX)^etd;&LKesDPS;!^j
zCuS|I!q_*(JUS^bwCEuq1F<t^7Xwn(u@yYJN*LzZbuokoaFPK6GBLgBU@KODc|GDV
zlk#;dgTi_^V&W0svr2-lLeKGsG~>W~KOaH}v?(w%ntMfUTz?7aFe%wN{o{cR(((CE
z6XpGj$N-0E?7>%0eW__ESJG5we{uq`(i|pwtXs*{>aC-rt1auG<`z0_FwSUcclB23
zxSa$)nxAceNp-fuo&fkwocn+OatMtp4EmRIa<?jlv1BkBcBnvMF0?L7zbvwuP3n8-
zl!V8}r$y(RhR$1l{T=)}>F3~WD!f55s|tbS8+gw)k^`@p_s>`1)*xrpszr~doMpTa
zFu|5U^iRV}<8$Eg#KQv>_?$vn28TbYWZPVZ4KsV_U!UfVxZf#7NW{7{daS9!HEH^}
z)Iyd^?7L-0s`-(wY3vAkm5%8A6Jt2P=UZ2;%(Ud8io9CB0$p~%N3_#UzZ^KX^LByW
zDB<WnCI&qQa+Px*S^F{UeIYLd1X&-YKEErji3>BP_vc+Y{vdc?^=AauE>7P5al-|3
z4z5CN$3F{5*;Dc&`7BxLnrb+k@(9<6?Cy-&GHB%buJOb+XnxNaoczKfzLc<Yd*}^!
z0_Dw`a853Ld&zg@9$$zE^7#1p*GZBy;5KJajdLaFe&JgxHaOE5fwu-UR9@<)D^CgY
ziIadnhQCU_Pf=w6MZ8X_P!k3VFnxQW`tY)n6_LP&eA7C)f!oG>@oE1{Ag6oa2$@{U
z%ZSUYHfsND%RA}-(0k=LrRg06_q$6@RTko|kDe9SUoXGkotKUTT^a&R(c14e<OY}y
zIN#m$HPXK&Kn*V)d49bOpJ_YVc>6cHV#{A&+TtVc9BDaH(2HTd9_a-ng*$NBz(Cq;
z$i{B=Pp#2l;S8Ze(gk8R1YL?SIxVOo>2TymWo5k17Vp0Pv{1dSvQ?HT?B0G4q#ChN
zT7(`g<V}C-<jC-iozMcIcByWE2A7pW1g2MfdL6YjTLe2cn-Q`Ya9D_>1-(zV*KG#N
znd~-E7Lpi!pO_Kh)Vi6lyG``oyXtOe^IpDJ<$HLFB+WIQMH^57P}%#As)G8I4xeY@
zjueM$XQcsB0X<gFLBW#3Ot@;rXjQ;HSkxi(rCuJ_$RKTvh_X<IQOlYl9c~RP4BUjr
z4MCT2Q;hRmBDqkl+eKkTNI+M=R>6PyIbbMuTudqv?N8ee2gL!wOSED!0Y!k<97WSq
zlzs6fma`o3E!?S4qO{$%DQSY??atgem$d%><pRJn-Ek0*Jtf=rZXO;bF-PM;r%d|G
zT@E)d8_7hqHDpWS?RxZp=(&tswV;U0@sIH3>$<xyaIcQ9K^`n+y5jkj9QWubRp~Z`
zxboIC+w?@s^?u^Vs53i+@d{|QKD+|yTZ5%e!qnxbwTta*8eG#?St=iEkI>glD6^y(
zQAda_AE#}o446@?h+~!j*r1gdT^{<#b8ZwPMj6kt(dV=(u01u6yNN}eRgZR3<&(YE
z(7JdmaT$+RUf%72{uCF!#J*J)_+epGGP=@>jB?_2a+(jqPt6f)+W|D{p46cyUzN~j
z)s^3zl9`l~Zc=oqB3*d5nDaNMYWe!x_wuusZJudT>TbS6ysIGPQoi9=1|0b^%g49R
zZkJ}-gxiWaW~1~}+|;xk9KU0ZjS5Ll?u`^bOxyXvQZAoBV6cmZ)O!aFX%{=x(2_Y=
zf65&kF0{4vZ~Y5zCeCK_V{bmNfbdav)x$RmbkPA*!N}4--xq$44jES*o$FDE5O<B*
z5FGdCeu`murruD$y1yvY{a-%Bu}9sJ*5%$#anQWyYj2^ARA}?2)hHWiGNV`KC(?l9
zQTY(Lbs_m)e`~Y7*;cDZp7U1LySw7At$z;fhDR8IggBH7aZ(svo0kT_fif-n^ZtIa
z?8!d>xUc0K#}KM?JsP8DJ5rmf^R>}#^=Uru8MVQbB0RHWDa~93{4NZ7Wi`4y*Tc^H
zy}X}H&#K~HDColtQ6=dtA5Sw=fq@Z^7Uwa#y%D~qcaE-kHRVOti@5gp0c3A7O(O?-
ztsa)4Azj)b;jQUI3xI!`G^x{Hb_vU}q^Y*U20C_9%O6=G6aI1l0N=K+)%`7$#g!-Z
zbhl^!)V#+uZ}C^UY&>PbDEeL0n~f~iL}n}ce1Q}<>sLtE?}O`|m(HfgDJ~2T_o)%L
z4V)A7u5yi=kNOjGc`)cmFJ9PF+6sWOS0yGZ>YN&0Q#u<4-VPY&#v29w!<VPaBIpb1
z;9im(IQcVc?Ol{w6F&;dRRikxjX+yQS#e2vUNJn(2lbgF-fvNiGnr7?L-F{-x7Rm{
zEI9*f3^S+Y`;9x1fvjo#M$AZKZ^Y@#z>Zv(P?AFnsf<Ls^^;QCj={pZT-gHP=&FiQ
z(N#eTf1iML)T}YA+?Zbam3(=;H;U9Lt639?BFGTvC;M(0b)*C64d7`-cSXpY#W-&>
za!al|3rV=F367G3rVI2?gOns+uWDR^OUqnoXjPjousQF)(WKmEBUV~6ocYZtjVGL>
zYp7=XiTYqDwjPzDK;)NO$OHW;R*kcEdNyiXUD@K%8>p3*CBjue>B%i8DJ<Y}ot;tg
zxLe|*0N)4P{5*1hJv^7B?<HQ!4Ykb6mUKOh&OFFv<Tt#XP++cKq1XN9lewvw{rsT#
z??0?lqw5td)UQfKK_-Lu0VC}wHrarqFhTqQ!S^d+i&^(BHoDZd<+lsdy!+K3ziCH>
zpYujzn8AZ_p-cq(Soc%Wh10)}(>Eyn6`p78N60S|AQerL?p0A%SyMEyxA_-8jv-ae
z2v>Ay;6Usx{9O;0*ZtnfWFNi~oZTqteYLQ##7G@7+rLUPqA{E;|7-yL#jfx%zRo>>
zoW5FaUPlx!1#Nu!k{>)jEto0hxp7<ro&h`|zU|%b^ZXdcF{u{Yf;U4Cj5ZNk=PB=|
z!|{rfi-i%UM%DK7U23Gs9A&`J?I<?YIy^ZAJ1dL_T>F@q>&NBa>Ednrn^>5ac5l_Q
zqwp9?@i!FcXVwO54=?Y0L62T2{PH;}wBd>xyE&}a;CAkKe9u04DT!(SK<bzpVGHyd
z7F@3ybfZfdh+i=RFbrK@PQ<nbDj2zuwHdxNYCPA+bJ;(`2G78padJ6n!M|!oPbr^0
zz`mtp@CW!r*CP}kw95A@_FB$#>ipW^4Yd5-TBZm-c|o<EkfLW|dPV{rg|kpDs%bJm
zP_&%VDNCsjamnT#)Pul4qo~bU&Q*e1)hVB=d`~}%5&Nd<{t|H>9NaNITl#@%A*Xf>
z%y{4JrFwVj{+A*{_dlkeye}0~6FWj$K4+$NmN*;g`tig#5?$*;@&^s)$k8nEhtEir
znG~CK4AaJECe4>TWO<Tw1^+ew8BVF~xBs&JtaX9qNa0zj)#>%=)wSywCE-hZ|CP)_
zDp~Ojt|Chp^1ws&EEP_Pzt%<WTLBI#(cZ})kxdjuzXdBpxjFtAwqS{Ej?uuyr+poU
z8Z|@~zGd(XW{r$k1+qOq&t*?ukB|BY>?V<YR&cz`vEn4}gu%(w^*e^Bex5m;(DK!l
z^?2i5UWXe^07rSldCOg_`nA@k_MnY^lUl~YPuv)b8S$Zzjp=c$<wqu31Vnn#L%N~r
z+h*+vjNzhqyY|PuuNb;9;J1Y^pvltiiQTFi9T>xyVfHzS#f#>jkoCWO{2>mVqVEnJ
zwt||a`V<m~?BWsl*I@#K>uF`)I;|8dK5T!>|3`mIeAD<wK03iH|D`phF4GR}QYvk>
zSPcz8BYOC|<lft|deRGoTD%7I4Fo$&eQ2!`9kk+iq1g3jn`Dk{<5C1LP^X-w*50di
z_&=JuVAR^0nRgRFkg(QzG2HO=68>oesBC=JOP@=bz8XKx@q2iBmJ3O)s=U|6k7;?B
zYB5KH`$~+Ww%_c1lBrm-@nAo`(93$iP^=325NLiT*BJ%2-BSFBSt)DI^ToI7FE8>0
zUB<dEN~pRcG?Cc!qaoyMKVIR`lUP=r15}>3zJajer`hSxEWKRtKv`e{lPb>bxBMM*
z|0OJ2w)sfs57&KpL<C4b=c9FaDk&~;_kETHPm*OuK67d6zHu7Z#6#Gv?Mfqx-u#*b
z67eeGSL)1KdF6kOoAoDZoDBnfViyBf_r^1l$TWMz7^|LD?l=Y&<&OH;&4UN{a1{7a
zPxT2s)qdut;(o>q(O<_hSf(0x6WP~DH5LDTf28n_JO<FB(_F<!dM#to)21vOmW=ur
zb1^T9IpiD#9Yg8$zjr4YFT2{wnK~|q@75UIp8PG?of4MB2PG(P>{8*jCV$5cDN2lD
zuaw(yc;YrpJqY%hyZO*PiGxJgCJo6S>^e}vMY4OCOmB~61CA)l2?{ZmmtW?o7gYg*
zBkKp@8F(}FgYAN!2hlE+AJUTtpB_M{{ISbyKu)<8b+F^`#xZMc$Fy0v2Q3LOMH~Z6
z?|VzB3`+g^AzM{^$|alU0>RDa7O*I0F2|CasIs#~9NS^^NsXS}v)5-)2U5|TTvIB-
z3b_zvcu|tcEJJ0>)^EfBap=<+=LDDXjY$teNW(6~vQ;5qW@b2tck&Vn_Z9R!257WL
zoJc=;J#Vw$(AQEnhH3&NCJ)o#8GIGeMq$_k`s|4x*h$d%kfx~_j`;?ciOE3M#;OP`
z0A(C-wuUKRACFJyLUtxX0MNpErmw~p`(UVa7>(K~30<px*B6m54kIc~58l@+7^eNJ
za8)OhUbHM)n@;FY)g3)D+FX2!m_4*`<;nlO!7;zJ`1tQx?+;k9XN2}h&WI^XP+@|o
z*~xHrPAu87<aod(oPPCY<-7WD6Qbz2uu4FKeMfcY+0l)_-p-m*YKczwwBGR}^nP;@
z)SaO`Tw6gks=+MjK_6&4$`PKSj7Rev=uA|&8JhpqQLD+V<o`MAp=ni4@(gNpbI_Sx
zPB3ZvSx!z?@5sgG!u>esUyAsF)!}Uq6WDivDV`|0*Ep2<!r|$>PoK$6F)$VKFBPMw
z-ppWj`j@Wr?~Y-GH_Pw#$uKCFMcI>T?Z6M-uW@(E&*i>&{rsgi9&Y6FWzdsxVz9Zc
z!HgK87ionA(1-xaH#)BDxU-)H!f1RMe?JmUOBKaOxK_1x?vjf>j(dM=(*S>6R<Bou
zzo^yJKcE-mSTJqh&{*_6ySBIU5)GYF=~CdWw;gS|>|RvKk@q~m>9N1-t*)sx)O)(4
zPJffeGj~rXXi%7FDeR@Yp~s6ht~73zcq~xuBVaHzTvfebS0=IFw|jYh-vu(&_=+?h
z>~Q__N8IB1!k^I9nb-Z;py=nu7XB7XSUHB;dDv;$@hE98K2ZZG^B_&Stnp{Q;_c%5
z2oqF6#lGLr8*L^T8L^HODLN)oSop`H-W%Fh0eGY}E*Ys?gMGS@P>F+eCCAYcleqNH
zd!SktU<uiRHk_{?y4;w4cKbFzwyIwD>C0Sx;in&sH$a?y+0Li+9Av6aWD?6e4HT9H
z0<=F4Le%x-ETeD~a_0=xj1l$5pZ}oOuAEMjigU$i3o8hFI7rEC->$t|QkZpK-V>U$
zJfl&i*m8n6IGP$8`0ct0=0a=_NiVE4cd3wisfO5OkNSWDUb3KUTdV>c@#V6g>~`_)
zujmIu2ffDT<>iU}!fBzl>P^!gyAji;rrY;w->(qKWtSM`u;Bn_q9Uwo-hA&?`b)O)
zXSo4yM9fYjNlsoFPeNV^9$45g??z2Nw85+vQ4b|9ciU57)``3P24-eFz{-WTT^B8X
z`uo#BoB2b3t~DM%?7Dr$;qs8yPi~c7AJO*C=K953TUH6mpS3u-+$B7TM_o+DB`ave
z<H)2QQ8^AmO`bh2%z`#<d99W<dCX4J%U1!}J68rO`9sGypQra|C<NfD1~#hk>|k;+
zsF96sVJqUR$ntr~i}fG2B$f&f-h3P3RoGSPzydv11r$w}+A6)u$<Hg2z0bO*QsIy9
z!~Tt0?|atR5yo_Za;-W6d!!8<8W^awB^A-?Vw|x0)tkyTd3LO*uaOrDKmCH4@hC=H
z-s@-(-Mi`tmHd2Ig*yL31`fs)JVu1@Ar33qkr<QJ_s&bMV?2#979Bl$9(>#HnZs!s
z?}J7a9t=L_e!_o<<gDX&xSJzyuq?kS&`v?gvCR+L77wo%(Sj!FIjWhodoQd>*w#xD
z3U(X}C!j}=q^e0%yXNW6H!c%=zG5Wbyn*>b9Pm}ob9Mkl4j|)><0~c{-wN@CR=qoo
zG~V5|^Fm`veHvBN<wSz!$b_2kbLD^QY<h$xSq_XUfyap1_<5)Jm!{%3w+5><%Tudd
zIFw}^8|?EISwYV?fYJZXJoWD*HftNN$JcIdQA*iHYkIO2gJ*6Fhl3}j0ErU~3y4cs
z3D{#v-o3VO28I&8&0W%7-`sqx7Jz-@0s7hhs-{4Y7vELC+#g7(V*^XndCMg$#rsT7
zz*1;)kN#xMF<iSep~cQ-{@8P)2w^BXj`RMZ+)qPc{t}i1f~Ms0=)0WOYmjq+>@nW0
zmaaf@bAw-i9g&MwFi9(};(M?Azx5zbQx?|r1a{S%Yt<DWj?+7YnyV^8-j5Q57B;vz
zS1ql(LM_tI<npWQOwAS(#1d|wMHw^2+Bk?NtUntu%bXBgKwp-Ym60{jAd>{K+v1pM
zwEr&`kj#MfERy^H3q%K`XH(M)Fq$8dE#4ls(CVesL?#Z&_6)h~p|@uh-nsQDeZmrb
zT-@#l*W!~;IAn11l;lQv$RcDkbdyZ@C}P3TLxZ9)Fh9F+)O#|}s16{7crW04D;?8e
zFE69CN=sf|@oQCeIL^!Xvgh>@gE09F>j_e^g9Kf%Cq2h~<Okdd9$b5Z(Bu>H19dtU
zqZJcKtWE0mJy0$=ORB=q59$Z8%Auak1!<pH)$B;e>d~IJw=1w<lT@s4>@D33gd53f
zrJe*=_b;9zr(z)8Co5Es#_UUKSEx9&0CY|A10eY<$^(R}971UUCy{U3jHPOncmj1E
z1g}yz4DTJDlZ4(7gSvJ9Rga#A@xpNeky9(~W`YZ>69FGMxZ=SbYO1J9oGNWKDlj07
z_CR4mCx8?ubk%C*&!<iXAM(N)SIgpFqSQ6w_a+8%2~uiwSnr%0!Q>tMbRGQ4u<E$7
zWZ`EjNi*d(9{&yqqze2X(V8&eZ^@hLST#F>yq`(~X-fdmVa&xf?elz|phj@Fvv~31
z7KLx1yP&2a><}VLr>mYWER?{2W!e3h8w85O%c;`oIJ*eTE7@(IC9wOhuj|v4&Y$V)
z{+ni4S4k<4!8S#zs@)7RLe9`Lze}32*ad3@2jK*A(2?}4>KgrZuks4}Tq0rK=?<7L
zL0Z58s9%wMx34gNS@SR}Mln{xER!ia=gYeb$?&lV<y^9c68F7v<!>9f&5I5-z^}5<
zy<_$eX4mQqAJQ<^G%yK4I)a1%1cCx)c?ik7&>=T1=5kavtr)O${U;k-`L`_(Rw$-~
zT|!{6^m;%RjCm+6L_pD(=~_M%%%ETs)Y$czy$gD111u3m2$v+o0fD{%moGO;)8H^V
z&b($RB4Wi|QH`2eHyxL^8~I5N=C{TnPZh_HIqP}UkGT|~q0k;Jc>z$0ZJUGfd38Ta
zX1XG$y5Cp7kflO~!J*b&>IbG=QVXoCfHY8G15gb;)t}vg{f5=B=TzoOrw&+Kj*HvP
zJSW?>wN)y09%V)oowN>Z*y;%C!k9k#a2HZE@lj=TtUMILZqq{czzjI_)#<RFB{R4R
zg|ARyfpTepTQydEc-Np*kF@P+&cucD7kAZvely*c*TEB$TekA!8^kQJ$1&?dnIf_?
zib%ZtTdtsZ*fCdT>jgyFP^^5&)u#~$E9X8S$kit7R3uJaIaOnlK{$VNOH_eUGDt@@
zkXWfzSM+R?d_Fww<6gV1)bU*Av6<~IvowOO)WJ5X3-9lD+?qK#Efq&U!H1gc-Tf3>
z11$6^uW<s)P1V?Iq%yrTkko)+>l=zuk?3Y=@V<2iij!6d8!F-kpek0VB=|x4#ab0-
zjOoap8lNi<SH|U^y)Q!+_$vOi8f+PcIeDqVKYl_4<=&6Q0z<ymg9C*J6n&k)YCt`Q
zq!AO2K8G}}LQ)IXd{kPS@fG$I5gpiueFp#iTOa7adb2b8(#as%h+5nLR$jxM*V}{r
zffyJ#O5Cu&yRYulXb-vhG5sgaol>qV8c(GDt+S|W+Hr4-PGG`M+%YSkIcL&vNOvk9
zCweS0DH7#w0cLj9B_b#b|0j5BKtJ@U^KmZ6CwDt<3Q_bNv37Yy{|(Et4-N_|2tv4W
zN7v+I<}dR?u1gb2%lLo4iy@n#`L6+H>UFh98?=43jJZ*H78WdlB38MbV$kHU;I}){
z>Lu*Ila~kXcEdX+QYcKOf%iML`+c$EQhnX2Jjna+wYlju974&?ZT2`d47)TwOp>nV
z2h#MSrj3-X0%<yd!QIx?(hRP|4ZSC&VkWFi(f`y*2Y)v%KbO4_79-%a<o*Q|<}D-f
zeUC2hl|f&Ydkljv*({}MkEv{R{7NIihf!@nZoiT-zgn@|a!O9CDgia=9-ogX=y3J<
z$hx$Bx<a*DZO=!gH}xyROe5w!^XHO>c&b<ccGmX@Vo^X%-B#z<D|UAlfA|^3U-PGg
zUxTRJFmr0m*}TXU%F1Hr)RW4SGIkX$V!)R2M}3-dHApYMG-~yack#%~p0@-G${}6t
z%hI!P=8rfCO?d582YTAhINTWm2SgHjkr}K!M!zD#Bmf|fGc=UI#Ya}Agc#@2yZbE-
zc##9JRxHk1m`0&6!bW6119}gLX*e*SQsbg*z_k{?fu%1F4ee^Bq-@X!QArx=wy%8a
zJ$TOdum}P5m{~K?ne^Y?js&B|QU)tX8FrUjiaFmX;)8OF@`8v&<CGLuF5eC`VRvI!
ze@w>Z7dazkgzH!-kNp9p$;GqZLK%x+E@+I!xQu+YLW|i6q!s4G(<VSWa_k*3Z|mt!
z<EjhDPYhV;<HHEE$)2-ZffII-FADD>+fIn`zvD^4?}1K%W;MEjPvm36HB&B^HPFPx
z#Wja55>k;8L7sF!bMO3M>zMp<W&2KhLn+HceeiL}Pl&QGo_|7YkF^z)$DtA2s#c`@
zf?e2CN<4R@T<CI$Ma(E}%GwG9sskGL=!Vx>#vI0|#Ma!dgeT^iVtPV8-v6M6Mnhx#
z`ZkRR)<<&vO@l@(p4boa9zHGHgsgitRZ`)1yVwDl3KLN}9+$>0oDpm^VueaGQZG$t
z#cKORv;QMjupq4*Xc8B2%U_I~A*fzv?C8F(QtoLYGPQHrmw8;e`AtXj)Pidj;I;1g
zzJcsF!WNLsWD3#~ej%)h++zEgBD}zwCrI_64ks33t5@pyV@&=IbIG|x7^NHqaMXjg
zf%Y9y)@Tp<STh&JmVvYlh}Q2*uuF|M>52WO8#ZO!A1$MWNMs*my&k>7+8PIFo7hfk
z^2!1T6?xtJTmbl@XW@x<nbqG^$DU0ODNb{a__$b7;`s_HFWGzV=R&mE?RCn!Z{JQ*
zB^{;EXHo_D=;Pnx;w|rg(|MT;@FqvGrp@m<Il8Lw=o<pY^6R_DbOa7vvG185)~$NK
z`4M7Zbg#ll$ncSRm{4*J<7$jjPf51;PcrLTWl#x!NvgtXg5lW@^7*ObU)U)dqm4sr
zL{HEi@t}LDn1@Y?1R?f5O)f?<PQD0M6*enw@(GhMuroL(Nu$u92z_IxnKrd#Eo!cz
z`8+3|aWy#qrc~BwnNc4r_x7hVi)iihka^#V+?AH~OX*!!+pO?XH7y!`itK*L7@sfc
z>47c~ctX;BTovV;4<BFD{xEprIq0Svz^L{OSablFB`rS<w?}kzY)&B~8){51&E<QA
zH-HqV4`_(7)6h`kh+{huY5DAB*$-GrYLg}^ndg*3z4&%MjX^`Z;sN;*<{Iq3g2(b+
zy-I!hnN_t#+{W<w58*mTxkITGaV+VkeyWXAPvhO@b4S0$kxy8lQ+&g>ptJt>qw6}-
zjDG%Ql9gwqKA!LFL$N46s8jW~2#-)^5?2^CPpqx@1&fLDGsS}Qt?CNM4^~5{9@I)I
zf2$(u4y6S!Vskv+D)Oj{Sr>?Hj41ZJ0+q-C71^uD(b^1kZLY2hR(+nt5(D$(kzugc
z+@3RvFpRyqdPoh$!dop0aB;aR1-*Z}x#ooRi6T;2v~qKWN-U<!7jOj#*nZBC_nX$t
znQ{5k4$-9y<&YEiJRxq1RE`4a>;P4LFORV6YoVRBMGuyZLy?i{%OMeOVg_pvu6=@U
zthqh=s^8Me$q%}KPOzcjsxmw8TW7%Dkt>iyYOFly+kP<B)1uWZl#LIsA>gMhHL^{b
z9E}8;g{ebmzoq8U+-X#uw$S>OS!tEGPAo1&;6=whLiL^~rWu(4Ogj;aaGyrWPagP1
zIuue=NOtS^hl-R_Y)WXVhX%xdbeCU8VIW^k<$a!XK%(mUo=R_AB{LrFNA;28jea}0
z#dU8Fem}bMAm!r7%RX&umj?Vnxi<tIZ2W7H(D>DCw_}YA<I9)!3wfzFPy|?sgZPgE
zMGP)jEGk%zE~<z_y(}|1$-G@u{*o>M?)TT&tNX)5w-3o`fy$9YpE0+3HeQ}S=fV$d
z=f5owwjAa(rljw`Ue`*9PM?M9&5ln`1jUHwv}RH1$-+R<gx`sOvJ0Fcvq<aulFRLg
z=tLF8(fxI*EhZ*CT-h6o+3U)CTFO>@OeE?YS*vlrR1}kukuQv320@DMnuZ1l4W1j7
zk7^=MIq&SQzV<QK+T7B`zU<?&t*A5<4fllI9iA+kn5=el^lVHCj5_%^e|gJIyNwew
zLw(TwP8MSU)Qi?Hll5iuX{M>Sh4i3~Qv7M_O|#S4-|Sx;sT5>?ul9haXTsbDJm(n}
zT}ZEl>Tq(=z}0J^?H9UNr)P$v*W~TeokxF+Q`6akRu_b43=T$--Vp;^?ls}E653{5
z<gwjot3n_i@Z;xl6e4c0f8w8t{tQ;-?dvr!BmXM8O5JCeFp!q!0K4P93jNLTOD|sY
zt~=I(4(Wm|K!fxxOPpYx_AL?a?uO9>72fqTGiKHsDEm39Yv<YtcI4z|+L}Y|TzoP-
z-!#nhIuPdy1FL&N7vnjv(uv~tqZh4@?N+oOz0W7bW}_a`KrQZ4`wjV2`$J4Kq-Xum
zH<T5Man=(hgkd4mp9`VsCaZrIaw(q)-%d?VVw3Eu_HdN@tK9}=Zae!w&+mLPin|o)
zeAV^aT0sK{ly34M$-Bl8%08d_^C8~*1FaPhit(t-@K8Jy(8Ct@eO<vL#_Z74lhN*g
zVaIiELC!r@0amlM8hC&^<tAy{(9EdibMFaJS@MhgcwavA_7xcm7S?S;VcHIUBbqfn
zDaxiz=B~zq5)9g&N9lw|K+O%Io0eFp@l~5@Dj{C;K|;!l?-2Jsw+dUvll@d3E|HUP
z(o5KfiUcmG+!s$t7^<R#UdYwTu)(JTW7H|a#Rg!{5l7)g8+-S7N{AktWXU)8FcS&e
zLu!3|*_ZTxNHT{!ZjzI~8m5a%2Rv&kB<7dOH)AO(s;S&utHv(jiB$B)(|)s)*vzO`
zWw$xEhH65Oc)s`c(Z2nzyJA5@=74?+rHJM*=Ra{32|rKG98!iURV1kKCatw8T%ob&
z!r}az5qNN*1{XK06SXYF`l)v&*CVDXs8%3UT$UtK&BlPMhBBFkK`VA~&lvy?P3Yhc
zfAo=tHya)MzABu&ub%~anSeTc$Hg;%$^K3=$u;Dw#VP-xPduJAOf(*w9xTT5nFHzk
zByc0o8IWh_L>)^jbalLb!Wo^fm@llyp8ueW=Y5%-k82bS;Mj@0=LSYgdL1WnC1or>
zD3`x-@VUGas)T;1=Jh}BQf%5qhIFmDpgY*6A?#{EB*~5%zo*Z{>`HDYqn2O%l<*a%
zAS#|KERWKfEmuGEq-DbRYVwi4@}mSl&Ci=+V!GPSh5{8pMZ(MH8g|cO@5|OeX_T@$
zS4JV;L?v^h(*NZG1d#3eP~^-n??~6;SCrcRAGCY@w}j($l!Q1a3^zln*>Mkv`+=b8
zarq%R-LXcM=)}A@13|Ck%>vD)dpD=Y(=-7a!{QDXpGN5FsEIkEi#2aN+)RT#!Ys<V
zvCEnUE+`kpaVPQi6==0YG(9(#v-Q#Z50e8$Om-2zs2t`aI*iA;-7DsSI;xt$kB<>v
zpUPmnR^zduvuCjGjo@b*_$`<`d_frmlvz3QB4wot3V+Q`6~EDHi=TWIYkz)!7HEY2
zEljc65F5#x?#Z}$pFw-JqG!1$cS+aAKALD6JLDeYWusgh9-Tkn^9j*KhpREV>Q*Im
zk@pei(hx)uT4S7Xgii=Rpf`t19yLuql*=bbwlT?1waxo%G&UV;@ZflMK3X|SNDAY0
zz;Pu%(=Z5e3M0cxXbNN4VOP2CoqH1<V&qdShpIy;&h%4_Z^qtk=H2^J<!V#&#f7wp
z>^QP?{1q`U0n1cHY_i@=8No5b0yD#iv4sy;xf!9HG~L5&@R3vN-q&;mDrse<A5GZl
zkoFv1A3i@f6gG72?8_u9+>R#aAbh2#s3xwTG*(L4&r5rXy71kJvl&o9+S3v_oRAq$
zTU~Rjx$FhKcG%hS^7C9y>~6RCAfW#WxPQAHSaL-Hc>G;~*=Ms%ir*NEFdhRRSJ`&V
z=AKur??7VMlZe_CT?a+8p1yMzgPifJ0)sDQ^BD}0%=|3$fJJ=HRM!2HsWwxF&3F?X
z%SW7Lxy;a~1;=H`aMwzaAI5hAA<8-dEh4Koe*eN0QXo+D3g@q?eSliRl0M{_sn#e5
zfhuuP;+TYx{B52c#dxIrr%3RANq3QkKoUu-Xx<O-vvrzFnC1-LJLg=1Nu^U!Hq<49
zOYK5Q4ZP)7tAL$rpCSto$Vt&X)e0jYZ!&dG8V&!T$A$i_Wxu7@A#0so8xBk{$1UH!
z|J)MhR=wu$c50HP>3wd`*O}X<LvyT_S^PddM*eZzyh_B=iY48{CxF%dB~*C<B%nU(
zvUj*6AF&TuCv`picqon_{>Bg`UeiY_Kr?dOmuXvPlDJ%a;GNP;@C!#ifIdv9|J4cH
zTu3aF&7xNl_QtWknxI5YxlY)~uT+?hqjo92^Y@`5=DVyz^uK}R$0MiEPk)9*2z&n&
zojvCZ6`4N`g_%2L)=<Z>IC~dQY?WTGBNODY-$K+n)f+zz#)5@gl!*~#Y7cRRu8LB+
z1mDV~=9HBY<iAU2VvsCn8sby+*MU*Os4W~)IJ-XsSFGKp*8O_6wh-e*F+wE;R)cq7
zal1Y0@lwVDP;vbROld{&0L>dhtbF+a%PL!9CO*-kwq7~|k1d~gJER2T-Kr1Gt^ltL
ztvO&!cPl<^-TSH1j$y6-r7BBw-;tQ@Cugh^M{5?^<^`rtUl(hVlwU|b@_tq#hGvM7
z-#}x6UJkRBAcS&RkV>M%7AoW^<?G@(vfvlL+TKD^O|>2NWhq7A<s0Wre;kLh0Sb?6
z5_vCKiV587mn7dYFHJ#`s{~=p<)NMGKl1h~PV98m78yy&n+TH{`;-|8wjTSerzgib
z?1ZHoJ+r&coy6Bi!2L-@xF2R;bpK6+{OLnI);w(snsvXIWOjX_%F6@eG2fW!B{!Fa
zMj8U!k5U=>Bv)sD$J3N&^pB4%<{C`PPyhr4!N#gF?eBhfAKS8JOv!zpogB^;1lKKn
z`Mv9At7B<nn3GsDk+#E^@{P#rfD)zdu!+0Af|AOSpH#_SCCC_x*MOf&733C`9{RE~
zFcg|Xt2gLM`e`U@t;(rt?bY&Q8cUeVp8OIbtXt9HqKN8&VU}K!E6poqO>BHIvYETg
zAG4PwFBTzBFY}OnhH6lQqLg7Dg7UJ(H#FiK3IvLoRkWF2=JdnmK8&4ktgFKDf;Z9^
zs2Y?YTom?1{@Ri1+eFuYuOP5>nwrCRZ!crpjq87Gw}4e?^Q`f7LS2-8S-WND9XGdB
zc8uvJ4LVW;{i*BpQ(4l2Gk8k3o=RV_hDAsk_F0qn+X6mAUjo}tClZ;3Ul$Cz{-@8A
z)f_GfbR>S;G%wyqjo}3I*c;uvGwXXKOP82E<YMX?)zh1BGgJ~ay_Vhl<-Bjwp4Ch%
zTT5CBn)Xo-iWobu@R8J-s==<ZHozWRtB3)b+bI;r8jbPzH-0lnFF!R+&sti6yjQ5q
zdk784Y*;5^W9Vs?lSg*-Z^xjys_nU$Vw2r1=A2oObdHlNR1Omy>^x-b{o^LOy0xhl
zP0l3Ccof@VYWw_ZNrb(!J<tkqg#F17E7jFgHLQw>#od~^V%FKv<xg942Mh7|P|VbF
z=n{M}tLW*BSKW`zfRzs+I^t$iyWos&e?VjCWCmebfr&P1*2?e(-5VaKPBAFJTs)Q%
zss`B(Lgwf7lG6e;z|#?C#GDU>jAVHLHyrRs@G9cBrn-F1)i&>V*LGyR2di=vV$~gy
z^bwXi#s-=|hVY~-Owvg>Z`S!tQQ0dquHRoNBJk{N@_uxw-{6y^f$`$E;{5%#uFazp
z)VzWjd0(N7O2EsQo3<JVUjU0Bhc*r_@)hvJ6emwi)8Yh7bWlL)(?AIJ=EeB6LKp|P
zZu=W}kTV%StLQ7%{0{@ZtO~(=T4~8BL&=yty1ZM5RRVqn(k+4^+Zt%a?0T^1lLGN4
zC~-Pbx(N+^@g1)>H8xuL`v$!8=~ROitY7VoTtp>jGQ@^G_T(72*)wR#9+A-P0BGFL
z$4GH6#41}P?2rx6Y$Kc+Q>(Fvu8qsUm3CJjX^WRe0-GfeG%J+7f~#=S?^lcbXO$?o
zM#vL&{|{j4Yz>G$<LbtNj>dyVtyn`zzt1xl7q39#>iMLZ*wLZ=!_}!v0R9Ok{V0uT
z%-MO|Bt{unnoltT)*TnMl`rfn_r-jA$`Mwl6dR9gC*mbuZhYU?_V?%e@&VCrEI;=3
zLu!*m_Ua(8g=v<<g%+?#^E@+=kf20He_hux*~Xt~J020(`QdmcPz6vbjDA2v$(2z0
z5pM^gEG15b<aj7V2v?I*Hj3hmZKVLy6RI+5a<;A%^Vn{}@JPT~h!;R2FoB<8_tCmi
zK6|nnoc40UKSh_Mtji1*eS;XX-E=m3_h3-NF1)82ou4+9yL-dd^Pw<`RtHInb76Ri
z_<!7eRa6{J)a@i#@IY`)u;A|Q8r)rH@DSW3Kp?;%!C`QB!eGJOJ-E9C3!31!^Zo08
zzw18Ud14LI)z#Hir|Rr;&fXBN*2-6agw^DGrV-7=4gR$wM}pqwzrXX{aOU6BGQEoj
zYNx1v^{@<M@~-6N$=B#**je>UH}6u#WMjthL`$YClPzPr7IUJx1W(3=l#5eGyqC!{
zhs{={OrViE_)7}OCdA%;!vxnR(<y!4=Dxv@)pe&%oy7-Cy@uM9!*blGaj218qe|4O
zy(f}|IdajC#@{_ZcS@7jtywxIC65GPADXCS9olJrz-NuLiUxYI_Jx_CP)*0ceqx2*
zRQ)QCNLHVTOw-}C#-CYENOsuiF+T!YN%`VeEEN-u09mwbiPv7v^YP7!t9J2(vFv$2
z<J_<N1`ZX=cZ+~~6ch=;0I;I8!@riOj3NTPOTKm_#YPbR*Ld@FLsc31f8Cp5IHRLO
zOqV7M6S<Z2krb-vx<{9CM<U1hQ}I;9v^6;;VWduo4?DMaddwv1^=Qc`#vWZIv3)<&
zS-|C~>H+y$5F;}XrW7T0sNGymDi5SqQ@C~!ju{CPRSa;vW`#lF`tJ}9NL>+fcq~OE
z*ts%G3Zx7B75RA-XBU#+Is5BYy;yAJO);+P-;q7^*JUbE+tav^j@|)5$H;U?B4`#r
zagd;<u&dU6_%@m+6B<VPA{z^IO+*?C9~N_g4NeozcG24tR}#C{S(2eCl-lPSA!E|x
z%!jY$dO})y%o`Wq57bI+<8!s~m{kJZspv$GCd#TAH|u>L^z#J!>!zP}iifW94N-+9
z3+h_oj`vZ1Y(QgUVVGu`sD_M}mDO8ZECSdtt}rRQtj&XV#SCCswF-Ft8fe8&0*ldt
z<m9C}n{!t*CXdd=e0yo=_psuffNrgo>#U$bMMQKR8zbFqt}Vh*gNPqf;%8-4B;R94
zi9d#B8{Jg+p50v1vBVa@X$teV=PG-=vErAEl>L--jejZC_6l9j4m)^+4{VpO?la@W
z-aQsd!-=Xf7ZL+txQ^ewhj1gL-)>M66G!wFwbTduKXgX95c-2FQq@Hqy;_atcJLf|
zmR*r^jA(qukmVi&0<BuxoEbCJQaSEyW<N{fLO8$WrD;EQ-V1dm9#i652n-+r+w!j~
z4)zy{U{(Ru4Hte9R^2z{%8^t^vf+}sQx+`=GKkTNRw2ARYi8M~a2lkL7mSHAR5<-*
zujP<F=T{`%P5sDd56xWpI&~!8gkko93a5BW-^?v^c(wGC2IVfN)MpvsO%zI&Ab3Tg
zq~gkKn~>LJtYwwIlL#-jeJk9ZQ<hH4>cp5YFT2aB69RAu(!#x34=#($)zQDE|1_iC
zs67{OJaiKRbLnWa9_cwlT~Y>}6Y>d3I9~3&j_TWr`1{mebE@Y)*}|N;%z%M%kzqp`
zofx>FS3=M_g79IsUESOfmYC1izG`u~K-R@iLaG(bW?BiIE{?m=uc+rci!QQ_@Z!cr
zwd;dYme5k`t7#>b@h;Xyji(xYacy(U%cRn0wu?-m!5`BwXWlNM&=QZL)lvl8^uCJw
zR%9n9cO}ta=acvVUBPnZ4`Q{#1oSk_%C^uv+38uY_5{JRr*^XJ<phf0(-i>SU&(?1
z+pS$R4K3BCxO%Na8clqS6{F#jPxI>5%F6vt9l*Sos7@0l+Y?#wokXH$%rL>-D99E!
zGIlocS1EaZ7vo-FaevP3HDd8PXxME2Yn(4qb`LcgKeh(attRod@LF=Z5;(mmO!CRh
z?8k2{*>B7=zx;<Dl7AJzYayopJSb}?%k9$9eVcrA`)1xr7ai|JON1AJ^h71OTF4;p
zFI$!;NGl$nX9*iMD{4vJ?u1dx1aT5Yp7%H>TfU`NIkVjpA|SG2k4{G`Nm6Hg(?=pS
zMWotGl`Fm(!upd#Nm?txe@L%hjUpd|ccL+a^*;X&{j)~eIg^2kX+?M5lspY?a@lG=
z257j7FDKhB7qsm$w`pEEJ50zv?dGP<#|XIwF_7g5d&KN8G}X2E)r%N9SDp`Nybolw
zud384Dzjtf$HlrsR|OB@5YFO6>71NeRn34StxB~Z3p{^0%ipp{gW;X@8pPtpXmm`F
z>-m@|HF<kkj8Q#403RCO78f7%S5(^h0tpWXf=KdvNiOXj(S>jWyDp+w8M#LU4Jwn3
zJJc9p$(fhig-H-PTFiaaz*h!GRv-rF<Bdj=kRgHWzD^BPJS}mMR1lDr^Su^c1nuV9
zIsCE7lEouWopdnZ2UjteGG6)sbr7XxxMbvL;d1C72pI=tne94^IVM`Ifb(X^6M4eZ
zS1OMG#R5_WcI2H7UYBFYd<)JMr-1^@f!Cup!+I$vMChS7mq$RhfcWC^`Tnier$sW4
zss5aJGPHT-U2p4YP5l$-4NlaT$0rE|))Hch-G&?)k&n7Pc}-~2c%4|co)EI28cFKF
z!FV!^FbfW77@FEd|1cOcV>l-ZaNrY_-*#QgUeqC-eag4dk<dx1r}?`w@p&z{Mph%O
ztnBmDrab>38dG8)V&y~?G_tNi0d@jlO^IVam8|-|zO@(ROZ0re*8kS??JY3qA)kbP
z)sj;yVcB)(m~S8=hzp#M)p!WFy1%e<=OrgT(Vbc?d?}q&-{)G$8RPu1dcvYKI<JtX
zPpWI`CCY7_x1;pTR<QRUfa5Xq^kcIb#wh>iiK&Jn`yN+03aef5&%9)4GGiQp+@M5t
zDuG!U$?f=*YtPnA`t@16BRdIuypn&Fmb-2=y)stG`3guA&WU5l-2uqpKKlxhu1jWn
z)@jYOVqOhma(n60r8k&_KU_NVzDUnL=y!~W@U<}m(pv`ccjs||@0k+h`N^X5Oo_!s
za%c$R_0_fxeJ!>SLoJ>DUS|$p#3W%~|5MJ%;O;*m-PNhz6O=#wbo+XAI7*VR5N-sV
zC7M=6qw0}GTd$n~4^xJrL{2|=K8&Tz2>ry!!o|w<EaAV3l@w3R_MKQv4WfKblD^th
zt%i5v@s~+o0Ko$ICchBH?i)-od_Q`sKUnyJxNI{ofFlOyGKYmwA#Ji{KW9td9(<`M
zf+&R3Hrh2gqZn`Xv?yI393jn2M#fSQp4wj%R1(%}V25W9;34hc()06Z9EpQ+Bl1xz
z{UW2VqHa+Aks7_Fa|I3{es-pg_e=_u^opnT;h)N<!nViVZ5B>1zPxF}7|x~bTAnr9
z_UF(1SU%e|sytmMPxG41;d>+rW1@0gMN(Uavj9`L4R?ARE(XX>S$;3fVud|YYWqsd
zgQ&D()2x6n=wg{C-g>eF60W=P`xjFPU4$oN6HvL$+0rvMs{CztYN|_8gBX8UmgQGa
zC7q^zA+VDY^f+UPpX6#aSmTu*(}?)jbo-|8m^TFZe4g+Kx)7q+?9r(Dqv`+ZHDUi)
zHe>Oq_l{BNs6|cFs`BUxZp4C(nY{J|-%75eezr2^oYrOEAzoA;9@0rR$nJxamMR$I
z=M~m~RNp9ZTm5@>5{43M&Qvns@nw#0_R};ASHU-(W-i|E;|XM<2DUBto_@qiOXlW?
zopFQj>ZbCF2#5JYIahZ?ZOig3<~W1WrM?||Ap+g(c~KhrLM-5F@<pUIhTZ=(c(Lpf
zD{e+uX<{f~J>y89?Dt0DvUTH}n`^u^`%ik&mtg7|o2PRG?HJ6Z8FeL0jIUxM^hsma
zEcw+}Ur-rhT!_UTbF~QKzYVKMmR1y3_qu-g)4tN;y#G4HAdI&Zg#WH|<=g9{n;nB<
zAg0zkMO$Rk+P{P=Srt*>4V-;*&qgcov{CVS=>jt5!z#*_I>T8-eGQ9STG(c`V=+mT
zk{hy4UF!}z;Pp<YzCZO+<0hdfImv1?QjD-1Pkzz9uJh~<$hDWr^_(UDXm*m|{=I7_
zL)TbGwJj{I^rbR&)F?$YbHbX*&RR^{Uxbwv%H_Wmihq*UyuA9wo6d$z+O7s6GzMVM
zJ0t6%nrk8BRar)Ax6i*I{i8FH(0Ls3F?o87$6>l0N#dlDg~WHTS#EAHVoBm>ddgt|
zeDne5%q#-rzTZQwEY^>M+vfmmnWjxeK}t?O3>${-MZMrQwW=5r_3$z$%v4%dQ7Yu*
z6~#<<)=yUFKqw(zMnNZc`Yw^kltfGq%T>0FmSjgL$uZ9N#+3{&SJ)XdT;?DR?{0GC
z^>=P+C5QrEcuZ(WZk*VeowLbNJ;PO|gi5Ja(VqoP=L{4zQeFyq8!7{b%<q3}3ZSK<
zK@K|kz^=k*Gyj#xb0}o{uLl%nN@Up?OUATtta4{jRM4n|0qwQeY_&(00a!7jS4tg%
zrxw)u4~rkCy4EIhXJX}RKs=jICsVofCe@abINsA);_B4fgjkCe1c3jp6_@9Hf5DUQ
z<jHf%k2dlCEQm7C#$BLoG_fS(4F-mi#uMvmj}Ek*AE&T-tWCAZnqBIHf>INi^&SrY
zi_Y(d@_BqYdMrGyztiGo(F*C3nG>f7%W14?(}6IBn*MTFWm9Y|OYr0`=_%%7KZF1p
zlmWiOL~weU24g~@^yzGg^qi9>^-D>8WG#+mp1&6o&oNhDfEQ^!)-KFr(@viQ#tSO_
zvh|Be?#i>fir|u$KRc(G4boe@86^EKItlel+X;$fQk35zJ<L3ymLyn}GiVr1;bAI=
zcR7KH+s!8(r6+(a-a5gl6FWvDO#o$JKD>{Tyy&b+H{mK*6c33uoB24e_CIJr)kG9H
zPtXd%BJ${Wl{!FbGODN3hM0PN=?tjAI*vY;UOyZ;!7~&lXw*y{mdXj@BTFoLA78j~
z@8aYM%OA2`Gp~6I=y2@`Fn42kI!<T`<3`0wAKiYnn~wAM7<ayO44&Qp4V4bTpc@j~
z2rpJ(-(`nJQfXFx7~`Xt`CulcgH$6-S{6Zk$ON0(d4K?Ztie`61xU?VmRh#itbR_G
zJ^yYYl%WsmC0kliIJDJ(ekC5MXtPW1S)&I4zAoF|wco}@0YdOS7AL2V9(wvLunA!{
zO45pL2VUHLlzclF^}Ntu3{|G!MJsQVhwnm0yycl`vCK;E0Fi{OPJFz2b@Z?|qkTj^
zQ-hEp-e|Td&+N9<)X7mwa&Ee;hM(%V6XirOoK8QDXd-)gRa55ei>ppq9_~gdc1aSL
z76!M49=)Qo3WFur;7_RRzc~P;?i9UFz}J~?z=|RqAHHrs{=Oj0Yt3%57|>b&Wg6vS
z!xj7QrkhXd?I7URkWF0_!p)fklkj^7A;27f`DSy=+8kq&=draM6tG#6tJf_!+}Pk%
zzXeTu@5)CjbEVq#roz;vVBaUdT5GFXB&hQ)FTLsPou&&n)4BA(fc`zMH|Dq;z*R3D
z4_W*c#}fC-*Ohnkzy-j93hlpnNsOeA^dmp8XG>ENVC@}plyEps7MT~pyVZGxIP4es
z(QFT?50_73Y?z0+9kfAja$OeJJ{zDx5=c1+eBB{Bs;6WI0NOM)I{JFljzT8AB(w^j
z$87n#mx^xHAN%T68TZ-}t-E~*5od;0>H!;~3<Z>j94!L0y);P!@KTU+5<A_;rbP!{
z6fhUw7--b$tg{Zwjl+GBgkuhc+lE_!j0E%{;W2;Crkw!BC2V7v^M+?nX@}%@&k65#
z5Tync1sYJ5jK_;|EDuiF`oxbYVFofI@wH=2y}ptu_8#oDg>c(gnd$Hgf>P;7wi{x1
zhH%HQVy88@-n44HLW0j_7>@wSK(oNIl-Dq-PTF;leSegY#DE*tS4~tt3*@8_gHomF
zt9}xe<FxghGh$`%J7%p2NS{MLGXR$3L$)zBufTeVb8YKMMGcQa2JL+XSc~4ZxpmZv
zJ_!kd+F)Fd?%be*JRwOtWBSmI-_92qC#adDiJW>ie{>N&ifU1-Ie9kO*YwoVOc5~q
z({fV_<KKkIh1xt)29|z=C-Ek^j_9wa@W)*KfTax`Sh6F_x>P4@=y%{tHL0R3DHyS)
zjLjV+S%bJrl02YzguZtqB`pCHW{8+1W2k_WWY8vPp*bs@-#_-zZZeO!`Y@WvwPM5N
z-mA;#%mAM83h}bwpYN-Ok68~tq>3a+8F8%1@e~s00oxA{MW))5K@`EhvAioe5;l`I
zD*t-OnEQP--`m7frF_-esW*T#ao7dpty8T)rH*Togq8kJd$7QOb?n7bj<O6R3{qGA
zW7WipD~NHJm%@_XE|1f|vWPR845`5SwWSXXD{Q3tCFb-ocf(l7oQ$&i=Mnc3(dlVk
zTuiv^R<c)lH{5+1*K6v~4fd-(zZgEXx$-!i7tHIReI8kjRz9ofUaLk=qrlIEp@uXd
zmjrc+LuL3wx_@;@9>b^70Uv50L(AYCNU%hT=@IBV42xWJn^ft~sp-T2I3S;ulC^5#
z=$!uXYt(Q}NrvjUfN1-`z~~ifF1-tT-20?HM90BA-fr}#&Z(zN6rZ%)1qYAV0sC5g
zV$g>cHQ~$qY~uds93k;9a9I^F^WrqKr@bs$yNVcMEn0UK#-amxox*L*LaEK%+u}0l
z`8hD?Zr(^!(!2iJ+Ap=3rd^6Td2O`y5rn@a4kJHqn$aklj{22++;ip=Aj3iiO*0LM
z-vWm*MioNYK%e{1YW@?tIyuoo;pnEs;q}v?t_qFs+mcxDen-+_F3c+By1M3cJ%ry1
zt*MW@7WGTV9&a!KviY*LVD%CAX1;NIDIM4AkJ-(Z2-FeMVcV(VR>z68V}6<eq|#9b
z=UzsvgcF<8*k<WFS?!|-i!!D?FKpAxt^3!(aoh$Pf_?8k?&id%378Q&2@8d>jKHXQ
z-{}g&4nLBjA&ved>fm%>+)w=B5F59T6h2~|HIK6TZR6l;#SWS=stIXDO8^)pMqQto
zdjp#_b@9|Wt3*^iiTN9mJ*s8>*P>NzZ<XIa+6bm_(Y{zA8IOY)V}kY9u&d3a(db}5
zn=&nQxsn>a%k{cy-{ZXu55YwPA7WvK$@OR?aCsYGk`I3XbvgLF3+m#R+2+MIm~-C~
z)TBqVNNL>lGW$Bq5aT=+v0^-u?#1QKf{r3*B`|O9-%S+qZI;x~#Y?Iz74t6SunQW%
z&02SBXGW&pvik0~Bn?SK|EG4c9JmjHOdZK2x(!a+R@(BrIxm*pXlu9a!~yywj==(J
z`sU$RkVVnv*9%2B!TP)Jpb`YW56PMa`QsVc;+dy9g4whT*WO_hu#M1TgrQ|1B+EVZ
z9rN2K_HTo;ni-6NQge4?C;62_u5RMlRV=R~3fWX2`O7Q8-P%`pd?W=-29<PoIW>Bf
z$^=vzf(dGZ2<&eZ)vjiN=#H7}EEk&X#};-#I$P1|3qLoJKF|AoGt0wlyH~dOVP-lC
z0@TD?BsNgrLQ{Tg*{VF^;t9Uhn!p44av|R6CKqTdn*kYCiZ=;-U|S1<x~nI#xe%m0
zl|AC)=V-_ryuA5JHt+lg*;i@dp&IUB^~Zr3v^QB5%Dz4az8zveAX8)z&N}-D0(*ev
zlsj@97nBs|Sn(i9LzC1lxmnXlm>&-b<-X&PQ{fu6$Sui;tCyCnyjzInG3RDh4ImvA
zRBNxH+S2cPo2orp&_+i2#J>2H;|R9@F_eDfmNRjBvt;zyD|HsfN7reH1DAThdqosN
zqD7A$jv%0;rde7MP|wp6?MxVZ6U_=MMyc)krX?ghADZMzK}IUFe#AYWvB5wvWpU1}
zU)i9?jT^;x6}R|5J=FNfsIOqFnDoC`fWm)UrmU6}GAuHy3q!f(y>xwq0H$0Weu$Zl
zbJ`!1jQlUo)fiv*Cq}0UvLhkOC|GmTrT*2umv(cmA61HB+ujLKAF2@z`ke`9(}Msk
zz4~S+rfuhiXuc{le%!CpK&tXvGOpxN2YZEe;k(J(%^KA^o$P^8-^wvaqd`S7kOv)2
zTY!iV#EII+B*f_`siU!O9{KR?{9Np3L7-$YmKgi4Tj9G@?a6|8{qf}JuXfSDJ^}gS
z>PzHJ9-#8K9?gCOAu^+U77(2zSEVKr4g*J(gx0rO+Nd!xJ49rr+Y31|%Ac-9Jc`CG
za3Br$F<5^OFE%~}-3)nAxeE1XqQsCALhA2Vuv!+^SNO*_Kj~NAcyVSaa5m?I5)rWM
z?Bt6)51}F>&_AxdwZmNntVu3EMOE&dmsG03-8rAzCbI*-MyYs~e<9R68JYh2jib?)
zgySbV7aq}&2zc?UOf-7*#hs($1rgy(bu_RgwRIg&=1h$9{O1~3C`GuXtS?tNPVifP
z<E)}RNaHd~x-G9OD9ASMeo{;5_B(-GWl~6NHkyz??CxI{ZumE%#(@bIyWx7VPf*zO
zOikclqH^bt5rpuGi``Gn-dTJ@O4MXm`xIniW>ZwHOZ@M{Dz&)nFUd)X&iNg5x+GI<
z-vK#?6S`Enh}4$RMAjbMvnz%fo#?D7%O5>^-P9HOzej^;%bs-*-K7J|RRUWm*uE;;
zbbb9SR`eoRzt0M4MI6=Vb@sB~<gn4bg^J+ayinHso`<1vmjMM*Z<#v#h+t;jTfJkC
zT4*m(l<d~IUJQO7kVr^EpG0iX_OWpq@&U|CO+5NDyDBx2Js@M&oZG^x{_8$c@ie$r
zXsbp~7)Qy>=5-M6#zK*Y7kS>fhe+}uU8|?7kq^48a1H(!GaY?mYW@BY{0u|8PtHk>
zBs&wwgIrZJ8AUfIkDE)5GLv}wwV6>l@i`+WJVR3X8VdaB_C)>s)tLGutVuOip70^+
z?P4_|L&541#z>tgy(33sueP%^0LRzl%y%G&mC??SL7;zW!dBmPR5!VNt#^=~IvD>9
z4d-=Zhata$;B$Kzakj&X&rX{xh(zy6XFqnhf99LBm=HpfA35K6T`uu4jc~SN7XTY%
zlF+!0pUTRRL#PFOl84ChwZe4mWLaA>XJ?m*tZSDJM@~Pf2}ku=!b7JdKxjdpgX!!P
za84C)vO$q`O`TVmgO0!}NK$;(unK^Ht(Qa!xJZbNAfG!_?+!P4_aC2L)&0%yDlxJg
zEBA`_-mPd6dH;$R)`M{`u!<m(1kO(Qu)B~`KVHlnGIZrVaiuVkd0rq*mF25N6oed}
zPf$CQQOMn3*I<2N%|=^&g#~#}BKWiL{3o&2OIdJ5L7i4IS+cWmneEcwYP7x_4ruRf
z+mrD7yo346bnD;s9?fM6TTRD8@PSpUc&<<1K8X(r?DPa_Yk#Wxu6{0j_KDw5)U;MK
zAb-GONGyvH6hv&Z*j_i(@j*-nT#7JNldn#esDsN0!FP3GRAMoIGi<uhv1tXQ&g}ol
zpUcP(T98&sX?e6U3z~gZK1}8^N6<PX3oSZ`$5WNwu91(ye<0A_`ou_-O8-mbFhiwL
zT?B9<CA(k8fGj1Q@x%G*Egs{O6{tCj0z}oBxD43o&>{RDm2ZJ#NqWXGXDm`TNJYNn
zcsF1~-`E@LV#!$f$%Z}gE8Jj1$?8P7A3b<%leec_Jh@PwJ#ITo8j*#@ER}*kf+u2a
znITI7Z(<7-1CG4`cd>^U@KW~JcOA!Xb7cM1f-O`#_=WmW$7Uvu{mT(#q_t;MnjPab
zc@b3e_`=*dVa8#iR>|#N(DRB?LwS9wkJ?p$jui;jLk^@$ZSCmU<1JHVBBo{8H&Cps
z>z58jb_+u3XlX<WrUEf?)GO0%3;&F;$i2b%aE#X$qQ9i}m-s&EFdO=&mRJi=2P<s#
znXtsj(P|OctJw+M*VK~Hz=wRaxY-$;CKYyyL<SJnotSV=!5ztO2cWQ*f$;3Gum+sT
zxX_P76n&^@wYXk;>vUq@E3-e_0^8DXm548KCmz4_7<j0|;6o%69c#Ke<F@{sEOs6}
zr_LiCPU5f@&pdCUfU?X8CjD%LbA}eaqj@gJr#o-HyMEW)RNSu?@u*xEg1zrhf`ghi
zZb9s&C8LXo%A>j^H4$?qcwGB66vexWVBrbayQITPBG)2Lq*9EcFr}YtsKHrdP-qw@
z$qf1USIceam#m#!F?ibISK)mLMlMQWTF@T8{HHNq7Ed<AyWhaNO&D8<F`a?0xvOA9
zUUI#V8FK$2evOF{gAMLIx70K~*d8p<Adw`Qseqb0ytLwa<FfSO90%hKfJvvOl+}Fi
zZL0K+SwJ-T{wl8^^@uArM#z<h#Du*M7Q0r@eDB2L#u75Tc}2ZcLropZUBd7sv<5Y9
z>;uv+=X7`NOEWu;FN=7PAy11DMxZ*(Dz&hd7}%4KqlwU;n5*eoOsQpwrBu7FQi*=n
z)fDt|bB&&%u&=#s{K3xq0-okw=Us{M0dP_}k6+@>ciVf5p(JFEZP5`Mh!1+Rd39m1
z(ATX*6XE|C2AYmlqIfwi=JS5^4MO<$^FX3bH-3gtXFqQeY@$VGTwN=CUzb_HZgy^O
zj}=UQK<PX_&|{|A4a6=~Rc-0R+wZ*M5aX_mz0IX>Dk2u2=VV9qHxtTI0lx~Sk0d~U
zR86sYF_C6@oFRKX%vBBdNm!bfR?jhx_Tc>%kRt=UD&%2^Xo`$9dkHS=iyXBqSC1=#
z8p75Pa`c>^JKfzw9cuCqja_}qQL(-7^y6{B<#1y`a8-1Yp=0-O;lO-TB!Sb9R;y{B
zsYf!5>}YZ%uNSGbmw8mks!s9oG6yHW6mTYI!pzJuNn|9nxV5X+DyCa+2OcJc&UThW
z4-Am&Ew;|<`ujDP{?^TXwPWAgLF8>yaNvBG_BvRd*m%4sI%{~ce)I}}$?OowO_6Yo
z5?G!&2=K>dc3wGEkhmm`l=;(}sm&M-ykLZ|ge>uxyihPr*3l-#{`l3-{j}gJskwJ_
zVEc6?)fu+ZfeSCDA1iuuavCLo)Q-hz`Cs{^(5|Bp4J=-N7RQ|q{F~$pKrD!s0S8jL
zkdB19J}W;53I8-d$zGcQAroyS?YU1@Mo}u`W)*jZ-z|XLb`%6utJ=uCI~qqj<RXAS
zP)#Y1Grw`JHFJzVrZFlxH6wK#yIELj2WCDR`>?&u71W#}7$jzU7~!)N(VC3rj8Voc
z1%f@0&CxS%yWKeeg$wUWzgi~+Y3WG)d*TmjTYedIJHD~I-d%JC46vHR?tKcX?CPiD
z;P_g5;{Ji~u>NSi(2OhC71YDUL@Kiq+K)h}6g$3{l^{5C4DY4oAxhw&lJ|a>G)n-0
z|0I@fyqAj?*oagIi=((H#g=ihmnkE48PpsWettm?{lOB+exEe7EDzJ7qf<8ZdgfPD
z@S5}tnl5@{hn|BjLdGl#&B9Eq!S60ICcqMm<t%{PTrW3u)tok;{_Lu>BcnWttJoLb
zh6~T$;vRT?YjElUbP|PL`E-GIuONt*U{fW7UZAwe%1#^7&d+!AdVrE6`^l9NTvHeQ
zxmWuo8g8bjAx#xxKIfMH(ABsv5pf6dzxh)Tn)io~$tqbsN>n~yXX?e(HF2SSjEnyD
zz{8+OCO2@4k_s(xg;+Ku#p<SL-CdQt_xtVxb9o)MMtd$}@YDcLRg<iDrV&&zIgEq0
zZw}DOClsY%Rf}MAwUFNpFV)Jsao=AUyo<(j$V(cE7zWppg>d|OoGxE&VRoXHg~no=
znb>|~)rJcmQkIy?4%Es^N(eKN2`0^Q{~J_-e`c#PE<(W}SbKUaQs+r!)_WK{OG!l;
zP4og}rw!jud*Y4Gl|cKfrE~OqM*<SHH(_n&qlH2eO*n@YYw0n?_-QwAC`w=$+|1Z9
zRH9g=>WuW?rJtv4BimcC)O)3e5+-?p0Y?DpVEnhP0~UFn`&r6wRWTWdBuHQt22T)?
zp@?EjmprIDm&wR%W81H`kt^>JxR@Ta_Z3LZ5c)EG;2jAPx6D*gZAAVw-Ga1<dcC|6
zhxW80#<e;S+RVXHr@37CmAhO%>WkZe6x<fg%2XpE@Ixs9Awd_2HPJi7$x_4m@Jo#z
z$6T&hw+HqmDyg(3sAWMxxb+PO*`i7WY?LGvD{a<tchz&*^_yw?Syr=_(8`H;WwJwG
zNgW1ej>k}-_Ay?2c7U5e3lOs{@3HV)jNVPe2vJ|eIIpN}dz{f!abCXOzD1pQB_h}V
zWk{7Wl>n%5eV2<xBJkB@&N*qp?<O>*g!`}C)qyG9Ky7HZB<i@a9xv0p-rIj8erjA)
zrWiB!`CpxhyYNJI$L5wm?f%80SVPHa;NQXA_gQ{g+Qrqr_%d+M6}OR}eIwI^SeV!=
zuIsD)Q_o_nZs@Q?#Nhx+dV{+9dII=G)oKe=NJ=1DbZzSjmG22v&CFwqC&`*5`@xDm
zej!vfqM_jiowZ%~@o5rM30`D(Hy>)a+~7Yz{p^*Yy>Qa_m{Z$EeNA1+Hf&Z(8NEL!
zKCxOX_DB7nrGQX<scS#_b=-Qq6}3N_aXq{@hW+@cuCH^<yZohE;CW`Y+&6~I`<POd
zOei2jIn8L(^BMDK9^g#XrhGiM)(6v<5hUQ(EQP#ChPsY#x2*T+`y~W|ZH44)3~(0z
zaMAjibyr)UZG-oik9mxf9e6Rh6az1&O@AGyH~IdFp?uz$Lq$K76ehTzrabf8ytU?J
z4ct2noZQ6@I1o!_HI^Xs@s0K0Rm$d^dl=nsUs{{H?d<vUc-<}r@Q&IY92`7!-ixlx
z3TVdDvfK}_4qWb61&$$AH~kG4dsGPwq%3bOuWmhc*ELRong<q9dY-K+5ZfNc7itOS
zTlzN(i`2u1hS<Zet=k}vi~Iif4b{>0?!vc?ikz^ap^_r#KDS^v6WZN=B8gJ(%WtiL
zTOwzV^SdKD@NT1vbaXbs=Lgm2eM0>{Bj-&3W;zhy%!;{^hy1<T7qu|T@l#Tz7x6EF
z0aiXuUoG;J{-qc>d3({dbw#b7w88Vn=eBSkpS`h6*SqxD%e`^f)NIq^Y-PR_g2Qlk
z1lqWq-^duBlU^W}v5k`>IS~nG@{0eufB!B#$5q!^KcW_Gd_`Lz<G|e-$nIR*a%J^%
zvbmq9n;)aXm3#ki3?#g%sK^&WxJ0dsc?0Z9z0TvoeC>~`%I$kY9g2l)7PZUO&38T>
zfmRcznF%S_n3$|4tqyA|NZ1c2Y<0hXj#M>oo}4{Bo_#DnGd8Z}6}?2%AO>koEwA};
z0em(OzrxvCuZ&K4CWId={<K~q)IB+h{iQ2sr%pOqstu7;xpNVGrGhB(zgWN>pQ7H?
zGUk4Jm^KA)`TF_gOQ{^^##%6TKDlzk95+%{WRX_#_R|L<?u)Rab+;bU^*X!T;YuMB
z@GjjyE3d#~nn5;%QMy})<w%xq&IklK^`kctyCBn~+J=rgQ6--FaD#)q=$Meop|c7y
z#u=`!@e95m0|qW=m5{@bmkm{0C72E2J0g{i9e+=phLgt9VGy>{tYr)I-#n>fH+F=7
zI80C7>0vA;moYLc`4w~Yk(|PuE_H!#Sru+|lXr1CIx0_kt6X;Ns~zo+*wHK!2cW+_
zmJY4i4C)*%F1W^xoQ&+v#Ki`fM_iQbmz!(HMNaD62Yh4KocB*K0PZ*g!zEp2L-%K?
zz%khHt4c2WxeO+@mar<BFU&d|cn+LJoFP-zw$pnlb5#P-tUp#i>ToFiv;+IRZ_NEX
zH|LS;P?_TV=&)Jv7Kz)zwA}@NdSPj{csGVmD<%Q24S%=w)VqR{-P_Gyik%Cc@j{wL
z!0AZH+wa&(neswHiN35L%SMFdead%+^*0I(hMKZy#-!t-%Re0Oh6A3K*X!!*Ogyh=
z9a?o7&eN<92QJ4=p7-xh!J4wA#}$2JD0Q>G^}A^0%Y4<M4HgsBrgON|6-8h3_+9r#
zwMSB%R_lf2c=OQ~2u1%mH~)UZ4&W9^^@jNc(_>-Xkd6^r*4VtU|7bgF_)yFi8^hux
z^xX;jaba!E_Tg|dw@ZnwBR$}L{n--*0aQW}E2qli?{BI6rgVcVmuq%oW3uhfv%qzJ
z4V`g$Uf1!jc@w2|t|Cs!G?qs>#y>T-=c;^d;k4Amv~`j~ingWC@nX?(Y}=-eewZN|
z;_tb$CkFT%JjM>M`q1W%?JafzE@H^0rh5kiSe=~-k*ju6D3<Z|jk=#-qJU3|!l0s7
z{Go5zd}&Q+8fqbsBd$f2KXUcB-|=`dzS>gV^2=_!5pP+v$!ci6<1+JdE?YTe(cj@$
zi4G7fOR0p^%QNL!CoeS13O@0dGiWvZIy}rpuWfF=p%m$lw6gl1IMrD)<;UUQRK}Q}
z|5UYeaevxo|J2>5+j?{D<~?6^a@E#Wx&1l(Y`NZ72m!>7!r0BM53i_nmt-hHTm78O
zYVtJd`aF2Etd&j6+g7?U@A<HmPkA?USIeo5p0KGj-Jh3|R{|HE8;F?HW)0}bZhu|}
z%<B2>KDz!hbb7AsHkwbdCT^K-lGs)73u}r`KTOd|rJUV6m{YOr?0#eH%gRd;eWWT>
zZQu+!{cf3`Qns?9zCP(E$!?=ob#19l4H6*VZKuT%Esr!0eHeS8e7I0!Ig-N0_AZr}
zJ{D|RrA+kW7^U$s#d))=yt?BGUVd}DJiBxGc!kmdzC$?~WDC644CMxuunK<6QY$D^
z^n9Cty#efR@X9!f{sRgXL*9I?<mQUQgDO_ia(~+A#d_cHDS%}*z?h>;&E``{j-0YR
zXB!uhtAY1>KnaD)`@&d*TM(9YPt&SS@Wwl)U6avrQXV)*q<b7M`WwT~7B?n=yyy=J
zjkeuiW@7CwwyR2QE#9}$D(O~;?elc0eL5<Knf_Ti;uF2>%@Pq>zuEJw5ONg(IHyy`
zj;flIEq+c<IDBv#;}=0A`*BuodUsRV=<i4(dz+tgUB3PVb$N?amD%F?H{GE9e0G_x
z;xfheNz2TnjH<j-e;V?QV@Z{<pWR?6&6+>v4dQtBWd-NsLoOY_bHT%6+8TPOOcuUm
zU=WS&FdVkM=5Z7wYcpIDI>OE)sXdw@;ObS7xaQn5B+~oQli375`XguXqU-U#b%;h*
zj8&1<lO~0fd=w+a_*}4Y`4ZR`1;|<NoD(C#Pv7*Im%`M`7^zuHhibdiE9|zsVqcXH
zM!nR<p2m2oH9D(nV$E&u;Ak7Tsy&}s`_yU+3$U}X*_h70mw)HZZiyF{o2z*3k<Sj%
z>I9ToRYk9*f9Wcv9020K7C?m{ZFS%(DX=+n{Jj#>Qzj;*cj?y9PT>AxK{DX#$65BS
zfQJN;D;29T;C7_{OLgGB(Ba`xb9prd5y=X$>9g>y3#%1P8~gfTW!CeHqgn?6i=48r
z6=_5YreDc{{H&Kn_7H-9wwsb=-0lZXsJ_K?YBlF(S0t2ur1t%DT3|{%vVN5ela+hy
zcL5^V^Uc409TBn^!L8S;I@bOa+gAa}<9IN?c8Dn#Qj>&R7Aw=R<+srIxEV68=3ghS
zh~t)oI6pyjIn8RYtf3`3=8P=akSpB-r$Phuy}$WNDa_#AQwZeh4Oco9U5I|wTmT^4
zbRw!=0h<x2))4;a`8jYz^CB)uwpu_&Ni;yEIy>52lOt1E)tnKScknE~o5dNhe@QHM
zpw~9n`{ak)HQ(zwsIKwq+LCOFz5o<T;r$WYaHS30?r1rNmC`|VW|!%3-;`2eUEfc{
zD)uK1Dsa5mcG+Z|-TXJ6Nw5X-Q&*Uv<!r6R=H273CTl(uzo8^!W3HC?k>|S<v165(
zo0`)KSGLxJ3pM(`jVNcilngKyqwfc;*Zb3i$YX5Oj4{!ng)?NL0)s=G21bhCt#r{8
zZ4!j)5xD6D-JY(=JIschU(ILFW;rh0p*5YR1L8=Fv$md)x0W@m0<cAUkEBu@OUBqz
zI~@O>WETCkWHOO#WlKhCr-1F~EA8LEmO^iC`nc#Q<{L4Jb*G@u0|6-+nx{*K9ryK;
zxbt;9B3~E)%B0~uJ0gGLlx0IhhE!s0PRpU}vz8PBlRxJE3i|!Sd}_SD0Y^AGF#hwe
zzJ0}BN>!z!T0<Sy_f8(F>1Kj_#WJo0w~;A$0=XITYI(zOo`8M#-Lw3MZORov^P$JU
z7Fau7wfC9nv)6>_Gr#xk<%G!fimR%^LqzPuncs5<Q6m0sO_y0Per%OIYIJZK#~u-y
z%_M)Yg#V|n<KyGdj<)^wmP4k;pk=-3A39$`yCv=@B0{k#4;Mw&w#@z=)6xAq_@?ha
z;c)x2|FXCwQi{3c;OG8*H{bTof7A5z_6>}Ht>a>AlR6wt-*x=Bskjm#ty0sboxEZs
zajdtJ+#X=Gsbo3%Vl-b8Y!Q42WG(2F<H<zRZMnV6nnbZEM9+KsDWg<X7#jogka|12
zZ7sEzxqh+)#v%W6N8D<CA_ILL#sX7k%*U^z(j<<MCu=KjVV3bjGeA_|xlLs*O&_*p
zmP^@jQT}K`!n1GP(yjd|j`fx7t~mEIGkNJK&uyt<Ki8wOLpQSs$Q}AiecAJ4+XdV{
zhC)QxJLV9TCyq;1ENZUcnn^H1pI#u&j0(rF*-8MZc4#|h@|#E@yf7+d-E}=%sjBV3
z99m{&m$msO8p~lMnbr4KT14i6==otFpHF(>92psju;-(_9&Jk-=FQRNpp4~a$BM7+
zyQAqxfs+|7M(4n*(4tskNy-B-%!ObSp{t@F0}E^Qd9Ww*<m4WUf{c6?d+agb`I4<|
zWqDpmSa@Z5ePmQQ)_iDq0Zyx=kvTT3$5f83_*Wb_?UL1+IN1tWcUKp573a%6Ye+J3
zO`g~0Ia5UGc-gxv-eW~YD_Yy#^oPr`fptX6((A{{0zg6A50OKe!%!0|NqB5;s3}8P
zK#@^)sJal&tZaAupesfAS1;t~jgIHDMoO>s@b$}a?AGm~KX!{PTI&A2R0clxF;jOH
z7XeQrlq`lmksPP53agD<JPYr#h~InwDBv9{<nu*~CRz<To8S^{&$ltI^VzDV73``a
zm(sia5Hg~J^%_f<_bImH*wYI@;jQho)jHcZe$DDVpUsD)!G2_W3Cdc7&U*LxW2ovh
zD=u>$jsGtsLO9wd!A!0696?!0mEJs#vLyA~QAlG%a0&e#Uf4IA#H60Q+si)`{GB;v
z{8LOm$!H#rZQ2o-!(GO-a&Who1FgKu^uK=SY8Oh+HQ43R>u{v1GmcCt8*TB-j4;v|
zqRT2;5Y&9N;t?nSAGt$DPeP{1bAM$$4=^2>xH7^x@5IFdd-_}<6T7u%6IZ|Z{dOkb
zsEVfh3PVc`;a<0LVpj~7X0pwG*Y?%M&3_A|q|4?X?_x|7)tIJDm&yzr%KIAT8VZ$k
z)TS!pl2A}k&?~^oMZLHh{K=m6Rf}A@RU(cgr>dWA?h7W!*nx$WHjzE^eloRYI<9iS
zY$z+>s;OJo!>4FrzUuSaRQxWCE{7$c){2kO%!?(xa6`pBlBQH~uM96~#49(F%ghd*
zQE!p&k`B%PGn_*<dlajxCqIxpSBl@lsq+(_`v7_4U92oFA7ZOhWd>o?GRqad!ALUw
znOxV<K#FjewBVs0Yc({kPA4j(W5)jGm>_DTYgC%DyS8402MbNavvuv+;kZ#Y7fNdn
z22<VulUQ;x5hn*{N^Zv{*fsL*>)S6CnJh^hZ?0HJo|OCriAv(W{q8NQ)apyW`x`k_
z6q~^@_NBrmKI4d{WlDhMbyD;cxw<SuDw?35sw%iYzO*io%SX!Are2LBL@MN}J}UE-
z@s;z~QL)msXE*8u-3%fk*C56&T=w<1G$ZkpS|dP^{RtikBmnL;=W2!Zd`64tO+uyK
zHk28sN*2h|oWw<v$SySCXfCoco+etII>?qq;zkC|7SWZj%Y&yK9Bf`k?;~XtmI35q
zAWW8A_Ksoi%JjIC90N<cn}*;dBC3v0W%1<$NW<VHu3RHoB&He*lozs?(X`XLr(SgL
z_cik0hWAH<W()aDwb&tMv-Cci2r94HWvouRT#+Xa4tCPT#%bYNecamP9yFucjYdVW
zO&R${VbgU<xWe8<{gFj*)Ij>h&ny#mpGzEixq!X}X+e;^2<!miU(kW_(@Rv=#0|Pe
zL3OKy8&*v?_O}T&*75@Rhu&n>2HuQzM`d^R7VYnbw=37|WtG==+k-$J4YqfuFm$c}
z!wwB-0~*2L@OS5DS`p)-&#O;E4C8u9HU?Ey=$yk~e5o`!isyo2H}2~xQN=i@wclDp
zWXNYkIB_SpR57Qfg2$z$+CLn01JMVi_@};Et6LF-Eya2E#5jz&u$+cSXewsPu5{`B
zs{v;$SX_&q+zZaOA1I)tqFiZ9&O3$=!qhxSfCvPgB8`%@v%q|6xVFPUYKu{rEHp_9
zsbt0s`f{R7v@>k&=)<Tx<x6#M$yk0+2^sz@@nu(nh9Pj{w+KG(Q)s8hjl*2@-3!pv
z5(kfUG@*)4H~^sww+&({#a9qrXaltV-(5I!q>PzTEED~vZ&)qW1f0DqjOfyB!^nmq
zO-h~skpu|D^Wrk~g*dWKvPjaQ)Q;}S4`J&jC{W6ilxR1gchgi*Jos_fGNQuYu*4=T
zZ46ZOBE^rgN+3h#`<+pRiZj{TogFF=5t=zzeiPKyudo=PJ*H5|L1cMdK!UjUQBV)x
zZAU_;ReFx$&y~EwBJ_ngt+U%5LK=q2|6&1BrEP!AO-lCpP<G%;!9~!dpDSy<AiD&f
z`&T5hnOcILXPk*6jEu8yC$&z9G+p>?pfr=|I5}Ho_b*-$pW}PU8hvC685U<R$16th
zWtm}g1s?RSq=N`rV+X~82wSg(aR}g2Ymc%czDk^Gp3fLI!}W36n1U>PI5^y3Jcrs4
zoiu1nCe~;m`(PQIR7U7QU(DcT*}fbRRt#`|pERz{nqOkpxCDLIMOWv()BnUZw?!3^
z8m7}v%ORMWR_UoPSO-BY5tP8TCWCNsA>0j?_cm!o$sC-KTc{D20O76LSmE`xLo-l)
ze{!2qzqV`QgV8Rh1m5+G%%9k8Boq1PyjWU;l5DOIbKaAf&D^q05h|_ewdDDq%STJi
zLG-~U+}r0WhVEB*uadkeq@x;cZ;de+0V5OK;OO`9rdt3br)Y;Hw#KI?U?=sLfvOdf
z=W2hKq%G7XElo4+og7!$jNUUyO&t#z@iBvF?PEEFIZ1ni;rEY9UlWnu919?Lc(Bo)
z&nD{iTycAXkt3@o;Htt{x%&#D#cGMv<Gu28MiHfw%yKI~mbkNSs+Ks`L5I9<5h<6d
zbaZpaG~lD*#FHfkqwFW%cf5FtioN>ZBtH+fJGKz8!e%)<i|8ZWjNU38aG>t(?%*!2
zjUX|mXfw>JF^=#mwg;F@TA0hMB*y0}&{(~J4%KZQ>(u_4`nhgd3!PK`vwkGrXcu%C
zPxcCNzq?2ie*1OpYX=mzYKMP}g-+fXgB2_MXQ$!Q+wMr~nnhx~F#97DpzQkF20a2G
zlLiXv<`+qoC{wffr_ls_)WCo>`|qRupF-XL-B<O)bEp3<bAR#X17U6`Y7xNB=c01I
zi|M$}rjZvh*kul=Gwp?-7NLhn>f`Vyrz;p+f<R_3wYXu=6Z=zyW!4~25r;=fhR1J=
z+XxJ_{_~8YU-xPK{Ko+0+1`{#7uCdYRoD9)iu-Lkpe5}jL9L<?Yh)y;zKU05;bTZ3
zGYu^c*mZw>dB?MC;y4KO;U&t1OjkeSOFonLQa30d_V<clB{9#wQNF5wBx<y!Qedp;
z(a6tcI*2OLBLG8ZEtjITBOx<DXRoHs@5PE1tdApY?zi5(KnViTd0fT9kSW(k0OmNx
ze(WSwGGVC~-)kZ}&jq!$r;>3%of*N)zSs|5mVR%0f!`R!hY!0gd_bANKm+og$V}==
zQpYeroqqICb1hjA=rX4Vg4`$0&J@#Up^fWYXN3r2$7f7DdH9I{h~A8TR-)kLqDKza
zcP@F$WN@NE)gNDJJyn1M%4sf9^Vk?5Wk>}ohe{e|HaW=I^T{o1el(o!VnpWJG816g
zr4Ix5FB4{JehtvvjfQP|wTy)1UPOI)YskGcRKZJ%006*Ji~vgVPEbphkqJm5VL*(U
zwUFWcZ!+*l^w|+kwp7r(g3!VjzE1!GX&_KWjxO6Iyh7_0q_B38{BRLNisvQpwYZdm
z7^n!rQcxJ8#)t?|3ueX+*Y|_#3Xp(*28G27f{N6_w0LERSOd#Sj7Bbvs3^p2Gy2bK
zB%^Czk%i5n{QH?fq3w{=VolFt0=9!dOtD&+sHi58A&gu{y(Ckf@pU9(K~Kcf&pPuj
z8}Mt8c(j0bTwfi6k-8XKKM`~nczYCeLK=r3>hx$Ba);x~ERz4}SA$Aag>w;1qws6x
zQ-CBmfYHFVelcyVs<f<PFrC?6FzIQUo&UetKJ!+^scMk;*)@+Ijp{;=76`K=o>UO5
z4NuMy{A&nE0{M>q-yi>P%L2Ic|K|(oIDuDKieo@_(pWLpvec<+s{X(MEKg9vKb6c*
zEry<{g)H;=<}`shR1sH1fW{8=mJ}%O00nWrT4_{8?X7)Gj$c0Tzb68&vHDLB4V=@z
zJJkV>HVL>(ssNe?4FViEAkZ*%b156V)al}45GeCsM*i=D|0LhQZ+<vclO#;1l)Ph*
zqs0WS!1!mt)OZ!yIda(+57uwWa3X+tEdDP`7^J51jW9;Wl$@JYuJKCF<P@+4pg3&c
zqytLS-*EEf0YZRiNhAMS#{&WTJxDxlNNQ^8{)SUV`@#9&lOb&^HK+VH$$)7_@$Xsw
zeM&h06HW(4gHei-3y7-mw6IvSTvTNp=?nJ=6wj`0)$mse4>-%L4stDH+n0HaGpu6d
z%-N(9D3tU_9R5~wm^dFymg?HSL6((FB?pWr9#9VtQmZ=}|K)X3>bTE*T|-4nvwL7>
z_5_7&58P)h3Z#G4OuRI3(5*CuFs}qUczO6H%u=xjkz8G|KChb)KU}&36uTh6!U64s
z{xK3hD!R08@Mf-{nQ#!g+RCyNP1#=2Z1yB4j;!q+JDXV#J^Oot)naEXTz+!sDAJSr
zJ532vDF$XmDA5m*IE;B8^SCty)NX>%sQF<_z<}+z_ASj(w))=g+An7`{Iu6k@4vna
zA!SXy-FS2FP3k-Et3xs}Utt?~*Ob3}b7ShZc-+1{HH!}6Z34DW$kd3{BknqnbsaYH
z8(-gl4PQw78@dP4=b|r8qQwcy`kvOBzYlvy^-rJwUIDo>h0niM8#B5uS31SH@#1ZG
zkk#(@>K2{+2Y%KP{P91>{x^$uLL&iTMAq7LM=|g9$SB?V@0`S#ay=2ft=?;>J)uNm
z?SCb+L-Yy99l&OaXm6~FQa*SWanO$r3!J*9+-5BUOm7T8SK#9Rx>7;lE)ekhbk}Vz
zJ87c){vJD)!v1oYI8cb6ar}JDs3|98w#Xm;7izW2ppT62FPO|LVGQ{;XNZd~lQ#QS
ze;b==%<v7@&5$EPnViP04hLMGOz-0%j2h~73uFnFt(V^1&6qb5)c=glpzdl6{mUwL
z7WLglNSNq;<3wn(0tZ+uz_bb)Ez$9~@2FsQV&oG3Qx`aK{sQK1VR`W*UT+8HeS<`y
z0}CK@7saUsKg{0V{9PvB6`QLrNu_(DZvXw|?~3{uj;2gfX2~Z5fm^quO(n7xq1(6R
z`WNGA!{0^=&CGAU|2QUM;v0sXJx!I%$!!5oPxnvSb?|r`yV5|Y`hi%%2b?9iGhXv@
zodllY6E~ZFhAdJ&+;qoMjkg>4XXXR+8~0|{0(^h#QdUc@A0JT##)i>8d+m~<matf1
zaKBj;(nadD4D3s0xK|uN!y6+`#$KBY;3M5+NglL%wuw#(pL}@eVB_r1P0`t56L~$?
zYOb7%7yZ=@Go8mhB-<wPZeqBGg6XtL#7EGQar4>wl_jTLyNV+%{69Uc*^ZFf>l#OD
zpyMk4PAs3|u^NBx9<@}9+9NaZ&7Kt?Y)Q_|yu@m!?On8g+w<M311>~8E;%Pm6UD^h
zf?mz(n%{dpFu3$?wvQ;qRi?`H+AX4sxSM{$PImTB&u;B%6zo<PE36w8Bj+XP(@Vfs
zbfWTQY(91;IhO0Xol71jB!TnE9Ezz|U+V68Rq8}S0;86(hrXz^Q~e%&kf}}Cb~X7h
zs;*b$FFviMJ%#s$ige)6`NPy-&58k*jKyh4B=Jp8Q)Y}(3$Y`-a$s^D17wD=2Mp9C
z%g4q5vk)iml-cPmd=>(o7r%Z-u!@i(wB>79WcAekT>K!`PC_g|gvqO4vG3hNSMA^;
zRQLwQ<TY5`i)UE7Iwi47M{t5YAZHP5{Co5|Q?F@KO^wHQw_!$&GIxzyQJ7J1H741^
z<aK_}<G0V-(0%{Q6tvc?6`#btuMk(4di6D{y#?$;+C9hXc1v=@dB^9?geMUMR6qpt
zw_V9O5=gwz2tITB$mgNPm_PE-v=CW_Tb73J;cDULjBM3~pMW!<0R4)ZW%LJph?sht
z^v;xj>E2D%&&`3%yIEZ9XE&4ymTc-;vYj3Kgdh~t@mIR!&v&{b>ZkWqUG0t&f7&k+
z@kq+4zi8V_SIWm%zfL#~??;a|al87NPx$tKSiwP)2W#KwF3+P3p^I6@CXN4xySEH$
zv-$o9Q>8#3sA0w0;ts_n1S!zs#T^R8-HMa8l+vQb-QA137bq^lodyf;fk2YI)93sB
z@9)3YzSw=W*R}HoN$#1s&&-_jIWp&{0^tME{|tB&a=QCQnZiF;{LEt+Tk|z9ER)uo
z>wKD(>UsOS>a&MWH6QUPP0C%YkTdC&D8in2mAqnnDPsz&7}1a-K}vgPjtzt%)Qfq&
zZ;TK8xB=o502uwpud+b_2jI<Lhi*hFcSaUm!@rPH6hjsk8ZLCi#?7g(T-{cS;`S2-
zEK&U>veo!D%bwIF_V(H@9@N$M(l8nxa#+`R+auU`VJF8tpJ4Bmh<B7031yNO_m3*x
zN4yLffK{5@fqUs$l`On?C8VV=SVcQNz(GaMHbueJ1+gz$^;!imGOqIN(`g2UR77E@
z^6Gr*db+Ympd&s@WX1D~<?&W#w03^O{FZGeFa`Fi*M9vvr#8Bii5RwNMPffCoy5c?
z_OUi?2g=FQVW+fN!WLK3qpVn!b1}DSw^40WKX2e$GHnIJoWElOln#C=FbirSm&@*_
zYqGI>;R5>TBB?G5vQiD1FQo-;ekJzX5m6S?w+<L*#unSQ<bKmpo9Lgcl%U#v&~x+q
z<a&kB;^)bJX9@x{Wuqi6B0>DOTB3?Iw91}iV+v7534nw5IS?Tv5rAsHyZnXD-ZnQN
zk?X}E4d;6$y)Z2ce$!0mbVsfN?MJ1u0NIi`!po{p1x~#F#09Fy>3hfP+}$m)`1<}m
z<2*4_^VSx_8!km)YyRMlpaAh@Q4Sv})7%?g+$G_NwO<*kyHoSlazAqaV(N$a<U1{O
zE&UvHrMbkAd!=J8bK5kDMUBM!qKJs1P)ZH3Gsg+1WML?Q?dJUXxQCW4K#igzQv9@P
z?dqmGnqAixpwVxDeIaAjtv-;;U{;{vT~giTfVTf@*>_*l8GhOEUaN&=ZKx%#+UdV&
zzp&#~QZFshQcLXUc#|qM)Axq1h%P5pWAb6b#>#s4pLT}u#Q}D7i9n(SWI_t_eQ{=L
zuo_&=OQmcDkS7uVQW9NWy}GS61+f6IegJy&N>al-mBQxE($q#M`dfeaHi@soH#k2d
zA&RV5$Wm&HiX@(j>t|S^@Y_YZTp3bNQrJa89<k}n^8(A6M~<$qxPDF=-S|~zS!GhU
z<@mU>T3;2Rm`SW;r1zd8M`~8)yrn8I34xao$#O0oP8@!lkrSTKe!_M7iyS0DxB3_S
zeEd50eiMsK<>lQdpAFgEI?=e1^Ol@!nmvl~UW$!*aBOjn@a&+nXeE=hwK8l*-{0Mi
zPwQ4R8vwEh?_xn8dtCZnYM&R8t5GP@a}V_~BwZ9FhtS1pN^Fo(x4cH=0;1w6P#*`x
z7xxb#)qRj6F_$LDiVuKqqY@$uoyVMmQMXlZZRN^y=>W^kja!LNC25+oiTxS-)}bN1
zJUO$Ui#YOh$u%As{RC<wu!@=y12B~x!QJhg_Ht|N>*97nKzE6rR5`wrR^aSoU-cMU
ze0+OJt>juDvuEXc20f9LFSD>sK(ggtipa=|@&~z-ae7ICvl&(klDY0}3*I{CXRJnT
z+uv-nLKLd+t#XPB_5Mj`yYF-9NocIVdm|?S3dtec1&)kGo;&Cx;K#Z3@$SpI+<r&z
z{#C6@RW@oo6`itf8B(&?w@f?Mv3vN=`#-qz<MKHC*&Td@END~sI@~18Z!qqvf00Wp
z4b$eT>E$enbUxwl`5>QK{<?~&uk^+w4eYk=<Lb57BsYd=e(d4t?o{DV{gTtxjYzi<
z7Ez(9oE#o~R#Qo<g}y@w;!gd0D1IalpEla-COi4)C+n>LVjqulSbtqC{!YW8GK0vA
zuT9;Gh<9waE0DPOIzqavt#|Js$4Ek4b*DgIr8a52-g`XD?S_Etq;<r_buT=`gF)oF
zh&OW#)^14!;V#qlUfZC_P4u7d4=PPDJ&yzr)zRMlD(8BAzR&R-SSa$*UVwGIj&2b#
z!?${<|0nly`)AW(@o2vrN#hIN3OFmaG{Yyz;FUI;USgSx0sle1%Bv~>#B3cLF$Ar}
zy?VDN?@e-WYs}oOw7_PYKxJqzXwtjmCP?EBZmT?K%6)ovKQ_L0a4btE;_e&mOtzO*
z7UXZ>{-iF%1v0cEFwL#tD2txCsQ!8~xT`=9>3x>6tYGgan*u!>Z3zixOAjS&oFFB`
zgrq>!$=^NYG$}L~?J+be^+D@V;|s&o#PNgdVLJKmcmDbN*N9}p<?OHKj}}~+h32oT
zzz_ACRcvAtDR#ta>S<kmn}cv3br6X4HT4G;x#Za=qmu~PgudOFUtvcqL-*vg^C{n1
zJkly1`9*flLX$gTW0bz_#lq8D9+LoN%{M|ygFbqH#$k6!c@@g!%F2b;USKLN>2v0R
zu$VFb2K%;&N7H#v$UJ@<2E~x}y$_(7-th;51y#5oaDdtq;CSJBC8Wt+`%a>-Y$?16
zte-cDY`s&L6_gU}ZZI393TN#kExbP;<nYD8CN6{faRzgZ!aliXeiBJQk$v3+j~qGT
z!Qji341A=t@N*gIF;6~51{=o@qM(liIB-aw{hPqA`$fgr^EMd#xYjeDd?ZGki|uhE
z%NSqBZuhU4r##B_g}UL)yq_eyCyPDJO74F;$ru;QXdHSx2nYZ*dcym7FFKM^q9{Qb
zS%4P+FxHAV?TWgIiHYQz+1eM}HxI5{o|v$Y9S}G)p>VVb4rf~`j32mvEBGp5oZi;r
z@(cfn|7$L0Z{6pyH$d-!LI<F*Kc)F(9*TuL0^<-WDx#m`ud|*y{d_s**iR*Gew!cj
z!=Uyp9wP5E<2`OxIDk|eKI=+7zIvh}!7E2B0^1EbRm&pNsOT~zy{fzeDlo*cn+IhE
ztKOTsN+q7z(wOmW3v;ojWuyPZZDgozRICj62QYlIHdU>WsjlQ7qf#^MDq`8V#oY%?
z>xDN<#h<Z(IHP8Oh2OxjaCGwCW9%NkxE3oE`_th1!5y2?p8ld;L7gNzmqdtAKd!HW
zDW^*{3jBiFhtaor9|IFQ&Ln%tM$+PmU;y^fHZ`!#C)(=L5$l)Z`9+gkLQP-phDEw;
z7JOs*tedX4A-z_)Y=Zwt@xJZ)LNm{hNLE7ju-Rwy4<m5~#hFwoE+cPzK$-ByDb4QT
z!!^eBo<%hwuelBE#uUS1t8S`)r(_@cp|?RCj_c-qSauc#TY5d?{p9Qj-AMovtt$Fe
z6MN%lTLF&)dGtZs3tof+uwKTetPUC;97Y@P-@tR$*EWcnUPMDjl+(I>KeKhSF^^1o
zd(lBqcdJt+%QPW?ovU$YYq&H~H!aWL$SM*h_-363CRK!aMnP||e^YzrHVH3bzHE)l
zUGmtY8$epXthuXqV_Yfh{by2lLEIdC_dy>;1j}p0c+KB*hhyKK^Kd9~zrG9eQK>j)
zz4|Avy>qQzZ;E14sH{14N?v;pt;*`Zk`nr#r!{b6U+%7ZWviR#7MwM>kbM?<tP%HZ
zuz%tBC$Jhf*~;nrQJ)H|OPU$#qcr^>?B{{eN)1N80pt}3XqFQVg`vF(WiyS+vpW)u
z%<PDMsG#Cu`z}>(kP8jcmCE*Up2!~=T@B#DX=>(w-`5F)56XCPF{PH5n>Gy4SUzO1
z-zKnT5I0&h*!Od6*i?6f(e6xXQU<wB`PFlf1X{8i*f%eJ<@T-{@=iP#WWy7Ann(Gb
z@le2Wt&MJ2JNKopuTxT5|JL0^{1h|ML*M54a*-1)&)a!(!rz1KPR-%;cwF-d?-ejs
zmZ(QeOm+B~!hgQW)@klpY5iva;0zbs8>Xnk>2s;dMwcEQz|Vhb{Tw(2GQ3~q&Gf3p
zz27{`kjWf~95m^XiUjfu6-=WafHE*R%MOT}mbPWIH6Hj)11G2@BvAp!2iRuhcYA3(
zRA-cFRHV?$pZ6B7m8UQBtC!q5b}5EF2mp7XO+Cc?-;2<?P#pLQz_1zj&7oG4-p?A8
zx_ANBRsPqG3Ci#XUvO2;#w^xx94^XT_4Dl``7))~xSH)}lSfkf<d2~$)K{I*gOaI-
z*e5_glYXjSE5-PD#eOWP5uf}{qtRlF$8OyNUeNe+RblE4&_p>P_9_cAHO@<eP#PyR
zw=88nE-E+z42RBR7t^xJ$Rm3Ey|DY(<{b$VT9-Z#aXbRv^vlKYB1lA!wCx8cTT;HN
zsD!moYjNIpH|zVS7!EwRZUblt-RX1*l*~EBGcSs*NRn}nh0|4JmAS0^#EKFpny$4x
z+V>T36Lqs4<ZDH3-pU2@Re^sjY?Y0(eFN-DH*m7S<?@6P`kaFt>xNte9Ni0(<vxZs
zeTh56-iNDljO^?kPaNgcszqtI%5KbH!4Q)u*<^-=OS`QPd6}!ro2?h!+O>AM2M9vM
z_w4+Lv{&A&>V)fRv~#CoKU^}K<jbD{2CF+j>Q~V3^#(N4P^CH5dsv4DYFY(~IqA~|
z;)XY+R!h{6l!;te+-wW={V}=mBVs3mRCVg#m}>taslmW}K2scwe`)3c2e+IAE-Rw~
zUUI7ZR$d>Uo~9+ZL)f4YnBZFqy==#`hGcRzny_aEMPuOaqi?OPQ6~N@-fWeGpGx-p
zBeY5aSjlEh0MqwJ1EMQ<iH2kSxt<o0dUNV6ztyZM2%kpURDk*0-BhmC56q4!-g5}F
zpI<t9(2`lX$|ZZg`FdPIhsT2@$Zon)hrPV*e2(n(4dQoGgWshi415s`ZiGF7wCF>;
z?j?Uq%b@waz641AF~Loc6>|ZwSJz%<zFlrXF1YTas+0{|Y_J%=D0=jDJ|uVGplO{H
zUYDQhe3yhYRPWap#%~%gcv*>~iwP*8XPb~^nY!lvQ`pvPA$L*PO!&_7#a)g}LN^&R
zb2G2nO4$mI<+Ynrf;6c|a#f3A8YJt}Z7p<YOujK&i(PC*pK(Ldo_P~>ewU<|wEXL3
z?2^6gT0%2V*fArA3b^5MZTpuY<vQ!@eouA^S~9k?O!KCxt%A1fsuOTsvt{RT=)CWu
zt|csRr>tp7M+*6~*j1LED$_8DGl$HDrMwjhKDdOYU-F^jSnI04GeVs7u<GfU64-i<
z=wTNv*0YmFN8c<F07nmT$J0xvByNDKsgqeW#b>x-AdW);9ZVEX#;#-ao`W?lXPT-K
z_&W*F9#6D2U2Y6nB~ESe2UFhwk^#FmBA)3$Ubdp#dpM}X7hK`<j!CBFwNk#vu=K10
zx8KTRG5dF^cT`#_d%*cp{lT$ph|cbK11Yu~hfg&8hC69(nAq@(=@Q+pD4=%be!4fR
zP(G%#l1E@8fEX+hnaogZNg=rLg(<!h-~I+%*QC!z4P~JMmZXSQ3*4P+h*l<5MR0-1
zD2SPWSk@sX<LQ~>`C5Cg_4W9zo9F}-3HVDo`VSfQGPeBuoLZ2zE}HgYPF)4C>T>^e
zW0|{d9_(}55XQ(RC9B;3Dn0{|sJTaHtF%=Z3)h|<eJ<4fbu-;3jwobaWNx~|P?{`M
zKZDLO_`%|$t1bh@9a8uYbR4oprHyirV*ji2g)*5xdcasM5y<>7P9VF%Q#;=5b#jG5
zA-<(M?Cl9IDt-zgZN2^zV)vAv|58T})=EVgon}Cgr6HNcggj>B%)heJhz{L+0UjY&
zc_5?ZZDBp|6LDNT@0dSMO9HYN@IiGY{v3iHofwZ&Tl5u`MAk5q!^)ZI9ha&T_p2hK
znKDWx11q6dqirhwE6vY*_lk}4^fT6JJ+W83wO;_Udh=i5S_tD`eoXxsc}mqUG=7V^
zs7w^i$7(fd&f1)#U0sRp7fQ$jjydm$Vtq|^Z@AJm3?9ZBHWdMLeP1$d83m1O4TWFf
zd%(H+EL`Ziy11GTrNZaEPFLlau?8-P+#wDQjcOiNZP-Q!-hRFi5Jp#}UMK|b;Y(Y%
z>F9d=m=A0Pdy9xTK1`~yC2S+roGjRQa~a%kDmy5^TG8VecHe?t&HM8Pmri@ptI~$V
z+c!YLIQZs1Ov^TZU90{I(OsbN<gB=v`R-`PX?Nn+cxJBb@K?t1#$F78Bd1+Rsr|2S
z!+0FNyaX|P3cw?7KD>5)GSA#hq5FC29gOW!m_OF1?rqKHcCoP>aejMP10q(tVAOKr
zK4Mk1OriXYB4X^GaI&Dv4jpQI6XN*ASGv|dtuY<ic;%2?6z5L|*sJ(BDI+3Vw{GUb
z<Y>KwdT)))^p+S5o&flx-~nKeEpWvPq8GT6)t<-654uJDJFk&<9j*CkOD9EY@$(%*
zru*HIrVoX*?(;08Zr!@|#A1s(wNlRJ_P1t_0C^SUlFy&9vHqS6mYBzB-YAwvrwgZ%
zH9g}B5AkHGI<qH9%wgBCrX~Iv$d9YHIlky(<Lnnv&WW9U)2*oW30LH=$10<bD%S3~
z{?`@|$Id!#!LrI3doFRmtr7hJUS733zi`jatz*?`Fj)}N^4hApJtwgG;kaWQ>C$DB
z=oXKK@5-snCk{CJ;lSyA<)c8r;OK9lk8}Z)jkYE4#?4eq{tC609YHYOR~w(^0|wqj
zB)aWI-e%*U6P1IVh)U~Mm%ZdS%w0lR&W9~sC!ykXS2Hnr0c=g<G)efhuN^`}QXy^5
zq{)@WU_lgw>khzy&{6=T*<R@JQ|~9Y<Z!Bd>VaV?l_`Y|n-V8;_BdU}^cUQ7#ri>$
zo277+a9LEQi2V?+cp>2;ij5%!WQFhZTc8Bs;vWFP==?7ad|s4jOqZU;=JK1>=-l4V
zBeWoMj}<JpP2UKj!k1HneamHA9k!INQ!mqsG=Cn48XY{BaLH~$g@<g4fH?*DPaoxx
zy#yeFEdcXXvHnP@jJ4;BB4U5qj2HTBrpT6R?PRN33X0tXbo2I}w;jakhjuXWekl95
zQ|Y=MMfhXwA(p+&#Jx{z7GeQQqz4*V^#4WbsVjC#tt?s~P|=GA>OpkdvnNy~^p>eF
z&6MMjecC}bw#^Q#TGyLl1IxbqgQn%=gmRnwN3NEaX-n(nQ_`H5!<#=V=V6m}<*1X_
zHI)$tbC+M;sfj$km%djzmT*yk-u04v@aoe!n^x3(+F_e-eeIRk&A$cqKu<fDZoJW|
zQMV*B%(k*QYe)vWG5exX6j|*-S@O?bBwl~?9J?>LIIq84bG*wi#ISIaT0+4YQO&UD
z*kZEJ2U#mzzFa7}5X+;Pi(jrb@nW;A(N!R_C@CVQud^G;m~>bd;-m?ycmagejy2Uy
zjGHilKnz_4p@3xuP?b=1(-)qt86PyOqsp_pC)X_gVWhf;_Z3ZD)p%Qh16jt)CZmRm
zIInf9ougW}&efIf%zh5VI(=eM)2ul_cR{h|09LWWx$j1GEUtb5s!ofObDC-3UlmiP
zIPiwV<!^izZmMs$PkxoQ9elsu4+P!427JvpJvr>#pII+LYFmrBjT$}Q4{0`5Zr)3@
z>cl|3`-pB8-O&$=!o1`ljh^&$@m71RNiEq*kKfx@FF{rkz<3}EgQhZgfc9|WY84NN
zIUSC<Al`@gB2REGw7*`3A0*vX|0paJZwk7jc5fQ<M$6qu2+p$c!_36p%2wGYdL9L+
zp+I6a&<_QAA(40AVX$AIXSB^901w<}Tr>o(6#<0_{{E8Dk3)aB_J8@8%c@ti%FURY
z<<y{$Su0A9LC?q}tMjl{6@bI-3Fz;CzX4rTK4u3JuQQmsq0))?I0O`h|51JL?@+i2
z5K^lj3s8o$+z1YwCIU&k#i`f0_J2Dn&L{&Kd=2B%jOCBzWKJroC|vanhu;pj6yq9a
z005-POB{VnIKAnk%{4Xmi1NGlAFz{tBAd||e_}4G`Ii1ou#DN*H*w}bAOIAI)xfO<
zh*9c>eB2{WmFTWL^YwmZ4fe;cP?dAkWqBJ`%nyjdgGt%A?g8VrQ{m{)&R$T|t+8Rd
z^Qcry>p9itA)l^Y_{#5$P7TSQ+`zmax32&(7$yW7Y}pzc_B#b8tdw%l&zJ{jVRQr#
zh>!pRxB^HcJ<qx_=8&%rzmt!DJp=Lz8jfK`TLW`Zwa2}Hs$UU%lb8}rl}$nJe|&`V
zvVt_@s3?plfs!KopHBpv(O>IoYU;o>M+is%tELjgtq55uNh28dYdT;QvgxUo6r9=<
zk@Z?DWO3cLueNiLg4h3~*!cQT4l>*1xD085Z*&C_LrxY>9KE~F#;kUy+b;Jox9}K^
zbDNs3&<9QCXWQx}q_$G>V(3#|<I6e0mrI^Akdz;$<aYp|Ttuiu0XTsB`C@f<!>QOx
z3>r+4X<!fRS(<&h0~TiJk?P!IosNl!XsfhVH#S}l!lIWe4F}-PwBo*N-<dEE@#VBi
z#mx8S_$jorAxa*&m2bq+8R$~!A$tRX78;Ev+!#q0wInhWUyo5oUEvvUPD@9Kp-y>6
z2GjW2;F{jv-r^UIw3yw^R?mXXpU>{~h9mdqT14SVr}+pXU{O96NdX>G!0)Xzd0Twi
zU?jQD&Tpk7$p7dh9SBT5x`_?s^1E!bEx+tm@!xe3#$G|Og1sczonox8&-pHgeyu-N
z4)R?#i()zxnBqqqMM+RNe|s#0=~yj=t4`~xASs95maWZPvwLyOkF8#QTP>zPN7SMo
z>-GI#T}Kvwt}awfmx?Y;U&WUD1@v1{XpL8Qz=KMK=hc8sp^>y=X9L6(fhMzyf`<@)
zE=x*xnnXm)n$FL(jnC#nxLTbs%?%E9qEtkN&^>-UqO;Spv(5VTw637^g^P*8{IW!d
z$5N}`)k~tsSq1W9Pm^jdVL*2;J2xKyy;Jn!2h*E}$j0>VUksIdU!iEcw<23H82)0F
z%L_Tk^}Hx>;bQC#fyHv;*?dd%pV@JS5XV+Tj}`s4n{YgbK50nLb@r#wIu&TrJ_v}s
zDFABa;;0#Jsm7jE%Cp)lj*1)th_w4SozLHQYgLZM_hL-H?dUAR|4;OC^I4O}^+tTW
zkxL)72gbj%Mo&+lY}j~oyok61A|m3A1S6Xd|AbIDrepYmB7XuaKlktYdm4qx&;f@q
zba8O1#OQ472*{gUY0f57!(Xg57U;NyqAp5SBC-IKKz6^1X1*{?wN(u+#G|MacLG)Y
zg6U^dIfL@8kINfHL>cQe6pa&{18>R%WLLZvLYklf`T!}wfOB1>0^?($IjM11vOJPk
zroRqoAx%yl5PU`tgkj`n>H_y0HE3n%#!UYSzt0*xn0E*L9OZf{7YW$?+wcG72v0mE
zGl+BBO&}zdI)P*9xZ|vh%?A2s{OI+UV|W@xyonrTp8UzKMOplcLjjhRDKQG6|Mp^o
z6CmeFyX7N*G2Dy&$=(bm#g~(kZ0fSE5WO8DlhG~^`y<afxQIE5zB{YJ>dU6rDI4%a
z70#*&a?Skx>Rsq`^_M3=kV#AtpQf35*Ac4JMeK3u7LXttWPt;!Ad4J4mX6NT+A#6~
z8o(|`3%E4?w*MIfg6j=v|6lwIs8A1zd84m?mDL^6*tA*e@j<|=MIbp0E~GW^UULh7
zXg{PjOrAzJ^&*pnNouTP5t9~%7Twp%!OfYO<Ub5facB;vED8_hO-@cm(h7N=ZdG(-
zc1S!UkLcxBGUFc*#2%kd9z0?%YqnLB620C<;(b^e0^V5uFaKAsH0|yu<Z7UQ6l}ND
z=zh@ZS7KCM-dyN@sUO_fU!m>qz808{V<UeuS?GZ2?kCxnrwTe^dh*i>^I!Kw)l{0Q
zQzUwAi^4mMCV*};ZsSyW2^KM$1O27*+K1RJx(IPC*d7TJTxPSg*q^`QPBs-KV*dJM
zB{JXB$j;~*bxtBUTJ(78ZO&-kvS9!QCj!`U1!sUc21^$1Zg{kww08txFM4IQJoHFg
zhQTK#eFJ!PSn=_;#Nz}LWH^oI@1@$o?IfOe)J8vp+4mvm1ULfS{W^dL2xlN^^2k!l
zi1?LQv0NF2rG>##?eX3T*QNhS)-*p?bMRyKBzAKH`;NkC+-tr7yqq8j=dy<LxrbP*
zmb{myCmg@)Q^@R^yCunDF07839D61^^?2=H0Q*bzK8_hMcLtNNZ4M=4e`iNjpkjS|
zeOX?P)?I$E+|-jh$qHq&N(mEqXwQuMKKH-h4~#dcJSw!@wyTc7ce%e9d5;E+8q|KJ
zufCb2&lqtX*(hTFVont}o*5>8C1OEMekv)x%(mV8>%Ko2G(~&_jrZva9X9WmT+1Ta
zt01E=qJ#bq?sKoIGp$^Kh{KPaINP5@=CBZaa7e$d(wj^iBh|AmKUmJ{49x9n92p^g
z;*M=?Tdx<fXPz^_jl`W`@)QUe8lRe4T39eZuD^U)iTxC}?wGg$D=|k<Zm}WVNmvxM
z^9idnIRTAp&MF|_7Vz9NTEJ2Z%6Jw+$~6aFd1ebLqN12NR`~0OS*%w~4iR{YTZ_Mv
z|4B}h&;D3;ua4Ovt*4V!FShc<7~tzEq_uV(lQjdD`>zS?<L7FR4@5-&RDR_-+@@~f
z@`Lo=3qx4(1HPuH)*k|7_CRDmNEL(&Q2F?o&#UE=#1H;Qtk63|klE%Hg6U9R`_?<r
zKB;eMLavZO5pCSSYiJPmJef179s|OT{x#=iJQGL;>UCD#m3FqZLK>cS2h08MGyMXu
zN2O^u?ppnCGb3n3^iXd3Xlu(Y@e4Z6o{x4#;P%Ydzsx4~_$UH%Wgc&&x6)s|ku;g_
zdop!^<H<cZunCHl(zQK_E2X{q#dK0OJ2`t)5#j%3ic2hE5mQC$;o(6UZ~g|g47qmh
z4qneMGra20Q%b*Bv&2nVsRL)eRDD>iU7mGtr&f7)Z)dsLOJQ5D0Sy~+Y{RBC0cq{t
zFJGXvY5Z4OBYZEUaSJ-9ilY$12^J>!e#hEEqYs6;(!DWNX6V{&9{-(Gf$tF-LkvAV
z%#IlA<nmiRDe)}j-~b-{7wTpF0R+cXiSFX;Y~)@YP+2FiVXKo+Z(a|kPI0+F*7`e&
zgd5(g!Pa|4>$^3-+z@7Cs%_*CR1nA>gXeMRLoO>K#`i`ap(gK83gj#UJFEQ^DBuH>
zUCv(6e63O?<;DP8Y+sS6rK+)7m5S&!GcfW%AvE48U^!yv%G%ELB!Be+f-HehJP`nt
zBINLm{L?d}ww2TME3u=aa$lhGv8JOJj51Z((#MvKWN0gdAz4x_v!t-E`1i5?vVYZE
z9o`}v92tuK3e-OZgYG9vf_Yqsy&X1=1d1@4`T04nmW!-VnW{9pAVK>%MK8su_hx;N
z#p@3Q)*5WQ{xJ-=V8jHVE*&5QUqOv&{SJ0V^=Z_S8WGe7idg&A)PBa9M)Muu1%*<=
zJ=#vv?|%Kt98j^gLVJZg7^uhe$FgxXu3V3ewNJOXv!Sgzl_4DewFPJl0t@@G@9!~{
z*`ix<ob{eHj~BcCP3I=;_(;DB^+bSX(<Os-wrH}rtogcfs&>lJA6?ud#roNt(BdmT
zTRxT`019+L@wbay-<>H(=n189etGiJ5ocUVw%t(CAS}k+-QC~=BDclQFHmE=6`eX?
z;Ba0}dqGx|OrcQltk!y9ii9mr#prTU+c;IYYG<Ox7IAz8Z_x^2(B$!PfvW=~4%K)p
z2aLlCxW+*r<uhYy%m+y24GdGMX|J~Arq)u#lGJ7e9nnN=_ciMn$?8Kb!lJc*YY|+X
zIYQ-(aog$kzYBnaUt3p>2lXf6qR<iGu$w&ki=^st=n0s8yx0m5XDqS!cb9y&O6qZ@
z^5fdp^SIte5{qAN#c}BC!dc$A0&K18?^Hhjf;%S<k%n{!H)=hH^Gvb*uLF)#Zd5;x
zNwn{raWj+KbIt+b8K4Z%UrzetQ)_GOl)&9P*+cw49Q6c%dECM+@ROYU&CwEFUWzB7
z|BJ)?<<-BJz&>Py>Ae{y)eTnJINo~mFU2MA;^E24%93&z{LTR3*zW)2U{Wm?e+X^0
zN=;QkbE?%1xHJ6jFBMdijr?a3AF{0C$Z#C~e|~fi3SEml88#eorV3!Uf{!w0{nHK1
zj)3vs7*2_IckkX6X=)_pGHQlmZ`@5Z@b2sGk`ACu_XYG>(3ATlI7u{Ye9+o7JMDHp
zyF;!hl^iHQ^dC9(mq}asd^l*>`V*3>+#5+JM-iH>QR_LDwY=;s_u?TAfdhf=z#3=0
zJ)CLq>uuOf69uv#+`=QO{MzfhkQ;BXFgYe!$WDI${}huf%*ic)$v=b)x6h})NUg3$
zKAb85XyQ3ESx!y!^!h;b;8iI=efh2$cP`uzxq20*>wx%sgfAoDxY+2iEI##`IjU5*
zrXTSEgN~G|b%X+5Vo(fFb{7aGHrcZVZ2mooLqkJX#8hJ5r!y;~CeI#(_QI3$D!e<K
zQ-&-~yutRR_Ei=`2Heo4-@ktY`ohOcTm<9xUxM4s&CQW<7)>mK>sqR+`gU^3)m3=Y
z-u})h5Po{^KA=gQQq4749;~c@a8e2nx8y+k$l4`l@%J~-|C_57z!U#}jv@blcFBaX
za&FbuCP@(5Q8HU4DkADPG{l(?Gp%r<>itX6j0)={#y4t0kB%ZjPmyQTV3)O(PiV~8
zTP-@AS8;G5MR^kkXw4^!;x^)>!9jr49yn{jH=Oub6&`_a02>2nPbo?4UWIh8J6-rH
z+1uNvrlz_!ZQhT#?>OJ+4jbSCcC>{<9+8E{3sH|Q+o@FdsapGakG&=LLsep6rGdsg
z*xaxPT!sg)$B>LbkPGT6n6AM)d?!E&1+MzTtPn2$)j%?1@5|Vqh+CY0pGb%vK!~BM
z)d8g|w3o*3^m{LMSg|j(!){|xSGx_9WWs$tp{_EmTCDo_>)aeI!b=UCo?>M_*yCxl
z-td>v4^x!(1{J5uz-N1c%hwAhTn-Bt8tgQ<g8?*k*;Uh#w3g;)&6h)t=Kyui&tLNL
zXmg8hHlGYbu$@i&n1Q91zY+KVL(x4uJEPr3H2gVcBOjsO=NTg>WhAhO>BnI{2>NpW
zQ->tL2Z5$~qr=2%8G|M>bjy4eywPW2fp1|uohD!NQr`Tpt^|CCge0Vwm`2R4dp#bY
zTy(YdS|UD>pkb#`uz7Xq>Oc;-h61#Y))Hd@H}7>nAfOw(t@xJ5XMTPe1H1)Leg*e2
zNHN)j`$_n#Ver91ypeCDrv4e5#ip^-J8tqNKzIF@><O|@q?toi>EBIit($Dv+B5?E
zDBXJ-XZ`^i_a5%EOq0%{qJAX`uGZ5^vtA#Mz1gn6pMvrX*=g#&{Yly12RC_CZ5LW}
z4<g*kM0ZN!jr;=vwgEH^e3?fCj89Z_&NQk_KWyk)cAI{uZu$T)ZlHZ+jim3}Ici)O
zW>vOjtlSm`HkoC*Uz#M3#Yh@D>10?JU?d9-i$mhHBgv+nx0r!gb~=A-rZhMiP<eWL
z@*}8(J8>PE%<av!?Ce%egIk>Gild6|@EWVDE4U7HNLwUY&tEe~ExN(yIU5ge-gW<y
z<!-A$=$HCod(Hy`6Q#Mjf_p4nE`R&G=&;bweYWMzpQYq$^0dnI)O*Yav~}#x!9M3N
zncFqBjWCm3Q0tD*m-n~lt}jo@8c;=%tE=FIDPr6lyxra0en(Br&kq!3+K^P~R#_s?
z&Ul#H|8ex=om5kUh+{6Ki6NfLc}iSo=QQe15+ykv->xXO-I%M%2R61QnSm39!qg}R
zEsdR;m^i({UPA7I7)QsJ#9cQ+!^6+xHb~2-Z9Qf<vVJ>L6>}@W=yk(o%sxq&c)qW1
zgRaa}z|psE4N?`==w@vHw3J%c@H@!zlzMIs%i9iB`i*1wlZV3|ZJW9A#**qi%|H^F
zAVkkP^?aT0j=r%!qT7;UA{#a$bY(_+wR=ob97fybGmqSF!UFpi$e+*?x(?jF*Q*}|
zq&V!}?aw~Qz4;2)=_7crE`Ne+mBi$`kuUv;!!5Q;3;Qq?(KGEj>}O5s$<MPvkn<x5
z8Zk0y)1k`-tgGMEh`(LvA>fXS@V`iZ`=Z!UL!#+S6v88KSya?|)p8&Q<^71LvqMDH
z*iH?mfd?*l9^9u9cgaC|9*iCyZdpBh6!tqxG2dM`a7@^L?1c#Ra2}(ht%AaIXqj-8
zr4QH)FI6s_YO&f2klrxC_3$?Wgc{W6iUlb}2ZpVAdB72BJn-E~E_qr+Iw*eCFoM0X
zZ2R#D|L&~cHbmSZ^jxy0vToUvLrs@1!|uFE^gv+SA_9#*Do1O(FFgf4Rrf%qxB{t+
zggQfdOv@eSTYW~-%ruKY@A+JNLK#BH%EinByBsY0x?=Lv{c7_!xr^yf97zjAb`w>F
zVGSO-B~!>YB-j`;PNvJR!I9v11Zlh8JMbrF;&#b!nJxD}QimTmEuUFbo7hq1r#qkT
zwNdSuoDU<LiDdw~NHTRQi@I|tq&Y(Yekf?aWI9L8B2w7=VQ8CoM663F^7@!9c}t9_
zIP~cpyQ=#PZ>CG0<v~{4aU>L5H-c>&skAAWD+nbs^gV)&JhNVN0WQ!BxtC(XPcGoZ
z=<Rb_9xL+R2x{G0-}PoMLd5a!!^0{2@|U23obdDWopLDpk4(tcan%Ue18KZ3Y?S-F
zfna)mUaprxY-CKgnS!^Glrv@7r<sfD`_JRT?xCBSLEy)%mQT+)UG{}{u$UP$fb7B@
zd~3B9Lr>wIUBpYh86Bh14ySzCi=ZxEDcuqg^Y!h?;y8ArSLv3erKQSEsk}$`&ytE{
zO)D}ppBIrIELC|7#FfU1N>?~_d@e3)9Ji?eR1q+03(h}56uf<lGTqw(iwPhz_La1h
z+tgo1ZCvd)K>>zaLS^IepM6@mwWR5O&tik$!=cXk9V{=NoG)P_I&JPBkUTGN*Z_!s
zoJGiGWov6*6Cjm6fXFG|7j_-iZA*&-Y_#BWWbZ)}7Gu`i??qJ$?9<|MZw^CG_ug<k
z8qWgKWT~-Fh=cv>bhfg3yY=JsX+xi(79`q!8w}qu`S19@mdt?+%o~%tClt7hb39hu
zg-qZYO3;(yhFK3lLu}pOo_-2BrxHFsR^W16Zapy>$^7)G<28L&5i2iS+9poV@|kbm
zZ(!467u`FBHCm4NpCm6y7$X<1>O}XOUElv2$qQ9(p~UmzYP~pyV=wTEb=^F@v1nr1
zt})(Wp)eYN^{NX)4Fr?#6cPC_YAAalIin@GdAa<XV;|l%vy&)fN)>cA<K?bm<7(UW
zJ7@}IRd&0~45Dqoe!{D3X-u6YA_&XO0q`gW{hi6GkA+R!zzdL9hTixxLm`}vEBS!b
zLlcYt%FD=ZK^GO5y?1x}VJSu+BAeNJ2Em>{bCvq^p#L3Q_nh;jore}A(Q;Ww?7u=s
zi+PY+8Kwe8FCn2T$#wquwQ9Purw_J1jdo??$q<LpJOe8V+=(~#|2}Ez1yJ5w<ac(j
zRKzzLGO&nNRO7;bw|=WfA|9YmNElxJ*@W2g83Wpj|6w=wnm{u}hdMJznmCx|sbOBw
z8{)XwwJgFjBe);hk64U5w=x-jj4rEJCSo|@ZWXh8^M6>XqWQr~pkOKJBT7<oJ>_gC
z=<8SU>#>MsWZji+YF3ae@edkC@XVu1T@NIc87f<j)~^|JmpDW2RYVBqs9BDj-UZ2y
z&wus+i`T)+zqgb`jvQ&PKSuV8pUsX;O3rsLY~2{|;;YoHuzxxtd}SAxf+;Y<o67?x
z6CMT`zd4Dv_*B%Dh99dww`4AW)1uB+`Ukjx%+UUq#m41T8zHl!T{(CIQT9&}t7M*~
z<_hru7iD{JU;ON}s>FXRJG=LFL=27N^Buw8|Ltja$y^H86MuQbEV323*cpZH-)_~4
z3#Ta=TMnfWxBntlR{3G*DGJj`$Tj7W%<S!UN<Mo5A1apoFLO0Taz4f>f(2fJi=Np$
zcg?7gYy)3uDtVOY?7uX#jU?~{DCfzVRVXFb{q&ZLh@@cw8+lJOOxqRwhe_lgwhW|j
zN9ZnAHc-VkU!h>-Vk7foFZ9^mNT1V$)6DyAWu{}_ZK@{+Hx@>qN9rufb$%RaV_H|2
zp&PY}BaY^Qx*zuE2$!Ar7Ggu}9PoObfx4ThAmc_ToUU$J#-qHQ(rbqd;&kp#wrRxl
zFboU$0_?62+A6+Itl4%LhrIf)Er8}MLQzL*nTh=iiraPLe)dDSBh-V*_VsD|h$xb3
z?jE#xr_8L^<xEPq)sDpv>OOxiD|Dp{yb*%JGDS85b>VDB${m7O-~~Gfwn#sXM+`kD
zC*Uct4LmU1_!6w^m!)xDrVo+qC^6S!%6+LP#qxXq1E-MvrD)sP5gX=`LuN6_s_rLC
zc9Yx5G~_z%z|RITTf9fZv`CAN;~;Gea)Th2#tBM%Z{F%^O7jZjFZzef;F=4I`F_Gl
z9#Xz|vH^>r<g8DS1UGKW`;AWq(fH>`HpVH*5~t9JQ!YOdX4k9#(F(B9px6;5!KK5)
zTgb6#>b6UBZA(1f$MDFf5h6kIcBCJv@+?Qh_9kkuS69pE6`y7P)~!mOM!Jc*n@CPq
zsqPYSL+p1CE^*t~hyIKi*RK2e<wCWaqj7Q}`*O+OnD}&st>4h+r8Ltg3;J)z)x@U{
z5K;`^8ATg7^#uRp=(9)HcJY|)D=V9tnDd_xo=c{6Pa_&Vu#ukvVnx))Usjnd@{`pL
z+N56>FJs$ixgUETAIUjh=ii~^Bu@r%(yEq*lD;gE>#62ILJptVnw%bTHJv`1dje@g
z$Inh7tQ?Wv;7=w$L(Q7}b|{UFtGqQGjh6wN1!vRgc!b|69nS2RXgx}o+p7?fMB{^P
zm*{b4t<VLzB&UH-jt4k3`PQ52!u>e0J9x_~3P%39^|I2ct^~79ii8~{l{nz1K3xWO
zI&61@B7Fo5=Qf9QJW(!mH@myWHV?e6$L0@?Yx#}OTLnvJoJ2T01bwtyH$oqMo*jVt
z97Dyi(prz8*dJNUr_*$wR^sH+q1S@Y?}6FVzNgf-T;L#5pqPYLaR`l6e%t2EbU9je
zyO#}eI2E$&POZ7hEJ5RGj#r#80zQmhHADLt&j`G`JRGxW#Y~qjI}O`%Itis92-Rmx
z`lc0Sc;PO5PrXpI5fJQP^nIJ<B6Y3Wni@c^sAcj%T93}kN0VnpS4IJY*iN2Oa-!~7
zSAN(i*hj$rN9nxLP<{AV7UD3Hu0%0Z<9tZJ&1_=lo;k0@%TrHnPGjW=@ca$=SwTXH
z=Xvi&p1k5A4aql3t83mgto|Z->vxk!qSoGC#wm;EI*Im7$<#!YbvSrK(6al5hikO6
z*Cs3(dpeoU+rm3DYTSz6DZ5iO-)O0-WIZ+RW#_$!Y!OWs(X-%8x(X`C?2g7Q_H<rB
zPnQ?jNXHGc23o_l1o%&;IeF*ozXr)6TQv$lA*Na|FHo3VHcVpT8&`#$?)bJ3SG7aZ
z0Zc7;fa!T`Q*Ac~<5OzCSACpjI4}1#$Yo(8g0|jqY%Mo)$oL9;HH|EDh6M`xqbj2P
zJ<!^ii+y*8T4ZMN5_V6q?jkZ>%oivix|XT1?5dw<Tor=Z!HU=P#MVB$z8+cf-Ks&h
zSPP(M=gY4mn#dI^z0X)t7(jAYeU+p9^qIo`hh0ZWwsg4*lIFmCom)88{lf<mmu>~F
z)-7YmAs5l+_n!H3ySdZvD*lXq)O5tK<Gp#0=5-~<82ZaA$n{uPgm_P|TtqyPYG`lT
zTU`OdShhsW4L^BDN9;za{?!!<@T2NRGTKqV-Ei7QRRs&9U6%KmieQ^x@CZ;?4Q#`j
zd<4kU(b#xn3o$M%iVM52xafxsAojZwt&9C&3#+n>i#$41ha|mAFBx4@lQo|`lK%lD
zMk)0cas>=IzO0Jqv!yF?`lHY7M?kfW>`W({%k~a9onL?~0c+-bg1Bn$%D3_=_m08=
zL@&C0H{+-F1jjX|YB~Mqm;EUA0W**J7e86Hj2a5;hiBf7NsJt6oZCL2DUWXjl9;)I
z@rc(98+?|oN%BiFi`R%OR3FE&Pr*;l_e2TX<Tp{XN(yr&G`24i$QQvgNX66`c`G`D
zE0k^MKT&UOL;TMztvnNybo2CP8LHO+gkll<o@)JxJD;7H5xl~ZuX{-9%>|qm?WApK
ziRxTx6`vE*uYDrI`D7qQn^F#6#delr9`fkBqP~6exDR9GBmDB-lRUu|=bq3qRqj{u
z*7$5ob2YZ&fCas_R_W~2Sy#i#k*7;pM;1U#u%by5QWg4r=*lOY-E;+gU~6lCa(R05
ztv3%xja2QrEL|7i{WIZyJvOYPY&&kQ`!>xVmDmP3`t=3keKPNuv7ER3+6G^NZDA-K
zaxiCWw0Y)fT@w&Ql)L=d*%2Z2jJ*D;9H~)|-&(|+BqHD+S$Fp9m$<7omvyq?DE?yT
zZOQtTo?<S)5z0_ygBaL(OEugPa)H)(@gSF_c+tXui0Fc_Iqr!HxwH^t*3m>~_l~kN
z6D|8<#jWIEq1UOwIDr%GleFjOe02ilfqySHZNUZ?pF+#9+v$bkJw({mU??W>C}gJ%
zRi0SxJZ-t8^EGSg*Pj_fZFH!lR+Z&Q-T|Hu5lKDfdMCcg!aH;zW@t_&9g(ss?4-@2
z1a-vDMj&E@4Zq1|6`s@}f~LV>@PYrqmAb9kQGQi+c46OD8}tHR4!shE3$@p?z^TLx
zxx@X{^0mYCt8{*`8GG0-U76Y4HVb(F%5mV-&yBA=kI{@Z+ewO+0O!uXv-BDzJMc;1
ziC?ZikYMti%uAZ`qZ!_$ehVI&3(x!WQkpNbzbFtoqI;&HKE0_P3%XW5ahk>2V-C@+
zx~->yBUL>=FxASQJ^4d`xfu}{=R+;>o(ulgM+T|bWqi<ZFrhvT0HOmv|C|7Kz0P1c
zbA7tlTo=OFB2xB(;h9GybNce0jyzS(KJnI*AG+-@*IrZa7mlywnE0H5E4<mx!t*Xt
zJbka_tFHmE;y!a0fdBRZ;Pg>SKSFc>g^tz6)hQH6_pR{FtEP>d8!FgF?Kusbh2R{c
z1l4oI&}((A8v#M#a-W|!$sO2MzejI-K#`DI@X_b4Jv}5U#MjWidugr{rZr=TQgRk^
zbe~fnkO?sd00WpqsSW+BwB<@c3@(nHSa&027Y^;M00+|OVi3g;!8yyk<Qmh=$vnuw
zn8e!327)<$?7aDp@zP7-fW^af+MI*4$f0BIB*v(tsqY8qz@=TM5*D-VI%~EZ1;_e?
z?A)x1q>9dqy=8IV@Fk0JtDTF)iXFeLUSfk<tLqI${;CrF(o)oFXM4NJb2jx-_Sk+k
zD|`;FA_sxhYaVJ9bzjpyv!=RcM3`)dsnomB7m1NWzf**(z%<0EBJZp-9d_SV*Z3n`
zu@T|FfsEjJ1B+Fgqv;v2^PUco?pmq+*oue1>5p72Ourlaiq4L}C8v^w=;~dyd{(Jk
zL|r+wggWD)5~9<1zagHJa{d|s$W10)UvE-!QAA98?oz}y>xSyhe!)`)wudeq2{A6j
zB#724r$8X=)Xmr%(cJ?_{q?H#{^}`LyHea<5o)ncjNA$Z{|N63tyJ+Q?mM5F3MI)r
zeSEuz;!~fX0<zch!&Y2fYvbPMlMze!CbgQ%C|pI{3n4@HR3-h0Y226*@rf7BwLjZb
z-o2>+)uZ*fJ__Ni|LD&*m9F}lkH)7~l=q#P#X|N>U%4?ne2j3&^LO=OvN4v`9?yG9
zjq;OGRZm~c#4^8fc216CMJSR!yMHf{MfAhI@6JDhhE5n;@smRAMgKHr=ZFc@5iF<D
zQOSTRKqDq|G^kj&@r(MGqTmrvi*vDv2_Hg3&b7SC#YwxxsH)OvJ%^OGY|$$7o!V|f
zvhlu~X3J*q1JIq?;6a=eFTKm#FE(xD8s?l>WCU$NiWhwxlWJ77w#0Z2**F|4iOstR
z7&YkCxG?NJ5aU`vPq)?b)d40F6h1Uu{41Eo(VHR6Ay^!vt`Lf%<Y>6aB7{vV2J*m3
zL)G-3k>@l?Mn*a0JOccF+DMvZ*8(qD(b(E8^Q!Hvs;!W?Ua3e-K(EN=2<!IL?Y9}K
z76wy%O2G`|BNPw64eIb&cKxG`ULDA#S4<wLI3GWYd*972_H+(yfPl%>jwJK=^y$2&
z5nE_7gAbG(lcrXD9-m%&N3L(-PTpqf?l9J7B(Owlciv#!fT<nH!DB0`$_4aH+RMJa
z#Xe=HaxY{TakG9~%%FC(_Lj(IX~;s4%yc7VtM`~;y1!jXiN_yC@v{(O@OhfIRYYVw
ztSp@~vuj97%Rz5E&fe>7$1Y$*$RHk`=q)<(dei%XEq(_r7DlWLr)zF0P30t?est%E
za=Cd@s3$cs1;vZ*S`vDZuVU^komVtBH(9(Dhq!B9vuW&I_`}EiUk>Q;5h0iOl1-CB
zodUe1;(MKa+8s6j&eMuH*4lbLu3{|a$TJK;2-eBD#Z_Geu}YpRh1Ig%U6aMyIA<jG
zf=OKWwLmubQ<}qE<W|?|D&BswlW!Z~@s&U8S$EG*R}PAjU9OrS=$X9{T<*qaw+pHM
z@krdyLnJk(KlDeNE3(Y4kR2X1@doeK;)K^`ikU%Pll-Umww3RQsKv)u?Y0rwR~BpS
z6V8A=1SyKOHnFnmTpZ?zEm2bly_WV-=n;)J8kTQ!K+*88&MelOT@kI>+)@#ALDx*v
zfW6u0Q*+GRw3-R_5~C?B4};|7Q+i+p3~D!LMGCDQDpXW8&*SW%d~yMkC&OTm#l(Cv
z7xls>n^R%MQWfau&ZRFP$fa*eg)*wkpu)7ld3CG8td)_g)R8?C9Vf1|rR#aI`ne~5
z7`LZ~M$Ba2TEf*;V0W_l&A7?m_X*p7jVdS5OR#TnK6~{-k}#m-flQ&Nm~5oA=X;&E
zjNw>iYo!Ob+o1H5tz$b!K<!Aq=&5{K;<M9Ha3;gvo_)0i{Ud>=ljKlAcS6~;=F1*R
z7OL@nqlh5Qp2r>wqBE}Jhm|pfME3K^C?0OrEzybBSOEE_`5&eA(xPT*F*}XKet$~p
z{QeBqiC>36D2DD8h6-RO%uDDUuO~QMqv?2xf*aAaTuKZ|L&jAL^JR5rIsNk;LrprG
z|Il(Y4)`d!RP8~Uw#V5VphoFsu*sKPFp-#&vJCgKeu23lqc;j=suS%r4p?<m4UI_3
zb!K4Ed$QD6MH{oa^B=9*BSym}kBWQsCXVewXB$JKciisV`%aB#Rt*#e*~8nDUf}sz
zz~qFer^u(Dl2dUjm(*6*KDD%`1<dC_+&|T8B0bpLxRj-A1T{ptEteQR!E`ib+Q_P@
zyl!L8?j>Yu7aalAVW_55XHWcjlf!Fg-ccY<{YTRVN>Hn%9I9=(DNPKHYW<=%Te^JV
z&04y6)U*r}p=R=c419_r2lK&S?rC68nwHf-y#9*69#@<1U!$SwXJ5lTR3K*>bZ%q1
zpgDt6wmG-zHV(tagy6CsjPz{iqo;lZFc*3A9_3`3hcLG1Jz-zEB0~ig^6!ThlW!h`
zt=nA(wnvT0ls^xJI9D^}2e(vLR){w;DenE(7O<GOV+<Yo(pGOjUyHA@Q*7N;tUSZE
zWmNH=b5GG>+|Gj$?yl~m(IZ-GIYMJL|8xNHE7-q>{&K^vBpM?%%zPF^z#gxZob1s2
z$tcI|)45`!!BXN~1)tA(UXF;g`P8F`JRm`^edmx!%DI$7|BPj5ll;MCVUs-5%9dZU
z__NSLgZn*Kmuv1zr(btq#%?_>a8?xu-(ZJjD~We@Srb98sf+i-Eo9@lz5lSNUZS(B
z7lg6}AiBe*eT?BfsM$EO?oHd)!|RhUJ6UMtXP{(l)-M@|8h*GG+2ryc9&lNXRQ%@J
zmgZQQIpPDP?JVfv@>&z?4X<=nshKN{l(0IX8=;x?T0vnw$<SKrldZSp2%8H(1@s=E
z%D<o7#OZ09rMi_Dis+ae*p6<c0|{D2D|FiLVxvYoRLOR#>ELh~>MEH0xuKYJK5B^F
zEb@0|X&C>m+~k*Y@uHx@CZfwQtw5%xo$fus5?#62V!ZvUi8ucc_4@hrE)8t3C;82G
z5s!M+R}<OUnKt!?FfN`0MbwvRsE8_rdyI`HlGt0r7WK@&|1#yw=X^r2ZYcav@%^Al
zbqWccnd6r@i}aJV*{2CS->*IAJ2jXv3%#=C`!jFw)(ZnjL=2b@qZ0&fDmeVGWBVO!
z_wWpx^W|5t#<@nE4UNV1>&+<LN&%~so;>?le;Y5>U+;ULd+*L_G22%ecz<6qa+V@{
zNf$e&1!QU&U{74G{V4@`7HXu}(||p_B^s<>ZC>#68H36fA2A2-Mr%s7@39OK>|wG$
z*=L^w2bZ~V14Z+!*27dF(q~lJry|eSC}V$2;NOIwvmBc@>)wim3)s)f4|GL3v58iQ
zxepXFaiZ4(D~J}^7x(a?JV<WJ9snNf76!#3hjWZQj%i|#!j&+v$NgLs(>$Yo^?xb{
zLMc;zYHw;~f_VdJ5I|JyL+{z~kkh)hrjrf8y8*=Bl<8KX^y~ba3N~sqSaYcRz9Ank
zg~<DSE~>0k#AK_tv6u~vrt<CE*a+L_*0ruHJ;wBZ=`^#UZdy#k=;i&<r+>r~9Mn^0
z{-ixDp4(64XXn~tlVWl0RRa3lqfKy*z(EK}<-J;}Q}LM-im5WQS7Eth?{}t2@R}k%
z|KPpXTXOvhQ;NmkwgM?~#<J`=e<(>>Lm7H(uFm)J_0t3$IXUwCb&4v?Q5>obgE~^1
zcUeWEa@riXhDZFl&a#KrJ(2e5Zr*3`87pSBl|%Bq6AL@ff!Lm!@Pj?CQ*EX{>Q42)
zF!gRKOXuChC9PZRMvnA-C?cwcot?V)1%)AQWK6e4Q#N6j++6|iDPM6;3zwbGiX3*}
zS;U&eGc%6+hC54F(a5E<5vGV$=lQGhdi!SDxfDV4QLztijUM~xQYLruUO&$RD0Q~r
z3jzy`VlMiGuzeakh@VBzdI@=toKH_U!RaTF2I7yAB5I)#UhtpEWoaVOHojZqz2`uX
z(rA=>ev=MQ`mgGTIxhc5d)N8U#QLl`HhuzvN>Peb2~CQi^dgEVUApw%o74a?peUk9
z5ebAIIz|Mfm(WpaAb>z<p-2e<X`zG?$X(7k_uhZuez^N3<t>?g=h?}-JM+xEakNm4
z)(U_<A^6_YpRTWu9_t-urRJ*Qk2UOevdee+8+jp>H|s?r>BVCC=71!w0k6jhe+0j%
zZznLUB^t2BZpWN&-c2@QyzqucJ~Yp&+jSY%{4?f_ocu^$ixwVhh+@3OWN=sdq;>K@
zgm66X1h@LU?)=e-<47+!b`bHr&erb8#<F%JrtIZ9`-Jz8;GBX6OE&&%CNVu{_O0`?
z#+|^_jqyFKb^5B7dYOm3?7+T2OsJM{HxRr<E0=1Jqf}W^qQi7>1)q65V=?ncrBFRP
z2QF-kUJ+_ukZC!Zz=Y?RIxq#kkf2!D2tRz*&c(?lX<u~rplbxd{YGOy`J9iiv9ivU
zasMxP3EZerkWN!UQTitzfo~2*^@Irh6=@bW7j<1P3&>ci%Wy9;#{B)?H(lfxhk(oH
zs8^&kyMdLtP4G@Z=V8jT^t8stFShDo2MY+@o0K>9c1H(X$n3|*vD^3+pV+v#0oHIC
z^3-_-Hl^wDs&rIn&wZ}ukTy4mSXA7faSCykCe3nuYPj*}^Io&=i8ki74$7b{rrr37
z-#C=FYk}`1l5<p40lZ$#74Cv3PjGa(r3HDCawx|bgto8iaS|ReF;X!5=<5Z}$(ktR
z@vZVx>aYmgWWA$qu2k)`3QtW=i1%hoso8>Vaf(x>R>=m3oL@d<AR`3lPb>73q~!lY
zu0zU>9KTg=J45eGDDorx+Me&?w5V}(J9?N$E1Q|sLL~OZ6vlKCWBC3WOt^AOdI+yv
zlEEg$-Q=`T0Jqkbv9DSeBL9zpd)sbT)Te<s+8sdCnB*9#Q}Y6kex;A>d%Bu8TVHS7
zcKB70*5+a~GRM`a4|updMPM~%E4HNhC%W!kPpRRFGEep2EEjDuc#?m-#0E>X2UOXx
zR)5>g>|Y6&G|6`L80{-br!PV@BCZk*TQpCsjyNzumG$gI9p?+}yV&=>?e;_)?eK%n
z7xYMeq~T2@yIl|O_|~)2`4=(0JBv!fQ@5nV*!vh*OK?QvQ94FvlCUNJJ~|${I4j=b
z>G>HfI>92=^hFDf??*gwxhh!6TE5;E#d$hbyAz*(q(V8S&SQAKdcW`Ul$WsHvxevm
zQKhKR=WQ|RP^Vwcp`DdDqa(--tr~p_;Q#r)3QJ<09X5PJ(hjR<T^mfa-__F!A1WBs
zidXhv;TKR%9aOzn`!}|%CGs%s{cfAY#Bel(`F!LTqqgW?Gs2q%p8=wfWXRQ@F^m>2
zWdA!89qS6UP=rn%|C&i)nRUgVjB0;9Ge=ggq%2{#a7w=oZDS-<+=t;xEL)rBe)L73
z)9GWbBLZc@Dz5l+y)#v7nRRWKOHum8R`5)EE_?lQ-sbbbAv2cZu$jlkBUTvCqgnCO
zy78VtkVQbJrfEgtjrbq*UM0a2T3E?qzJ+$erZWrO%0;vxMz$C-6VWJA3(_-WHBDui
z$A|A@<f0l?$We>j(KpHsaC?Nc@t%e7doei3epY3e67!+}W-DRnH7ZCO%2|09xY0aJ
z?VK;)(K>iFNnx0}+;#%bom-VWbM58BFsV3+6?FqIHyTy;*ZeY1YnWGz%$_`f0M2(k
zjGc*urc=Oh({Oc#3Yj1#&)~KDs;ESDO4Ok!Tz>FnU%E3>An&wm5>t1WtHq@A;Swf%
zc-nICV3LooW3yoiu~X{Ik*=F!WiHO-NaO6-zV(4HdWkPFpY2IOSjNjbMLU&zPmSXj
zo#{H_g3RsR=tLLibn*?e{h}mYyJwj^fqaBKzUAZN(Dj7t-G2j0D^o0|uS28rs4Jdi
zE}G22Tp19+u-S0Dac+te4#fZgYRUx_Dl>a7U(x84A?6QnZ6H6H1NKHxSFOVOL-42T
zuc?`g^SVZd|3DV@u(&;Z%O90bE~k2-YP(6NKUg7Hqpa-9wHV==+WdDmy`m@1GRk{Q
zP$!g-ys>H^Vb7(^!OaJ^s|20P7$F)-^py{g!gmu#ih36G6wBS0gsNIt%f^f{w3;$#
zVZf7C(b5u>ywzgM?ot_(Uvh3j!2riMD=SUCH+nNr3v9#({*QB8D^0by?P<iv75R`Q
z>Y31ORB2xj$JNVkPyN=)XzSagtif&R%23**$r!HKzc`VdNzDU0Bt_*A4szq^65i&y
z-<W&Di<h(Wo6RSQolGvjY;kMi4f850vUa;a7eB=mkxwZnwySxP-jk9+$!i7<%H@qD
zmy>t?*8Z;@3<MB8xkKF)mrd{N+{O*XIGY)}tEvyKsae~Pe*N-Z{XHAQ&`q1cl#xl?
z*nKO#hKYVNkI!BWMJ_TZuUf){f6a1#T0_rRTGls|SEBnjakUanBc>1LTcY|S=XlTY
zMzl&up5JBAYtJd4+miH0ur?#K6&X6Te^dMdH#X}r{+s0;a)(`+Y4;<0dO~_lu@qA`
zvx#4`N024an7-V_*281tAIpfAq^n#MJ@M0>34c80H!UaN_*8-}AL=Rh49pZ~IQ;lN
zI&0}b_rVg@Yw5oIJ2DZZE$homdAecKj7Bl^^JX3ItFX!J;oxug0Z%~Txzp)aB=q(|
zr}y+$D1LFjH^~ONOt_yJ9&Fq-TC<M5>per9fov9ID6(Z%B=S!!Z>55@dU<#s*sr0P
zA!adXQ<yy9(_vfZv$>k8-E?}aMY4g-GAo`Ms0Vb}9aqvanBNk8EPx@|sjR%&{Bu*u
z4h?tFlVVw2(c~SRr{HkKDcGK_E&++fkH=aUF6?=`$&TI?k>y1~Rm?O(WyF|KqDjcO
z^#0qgpl+Q%O7(gzC!!8p#wtvjFNju*ao^_2Z#YW6@ENAThzT^y>C5X$J>Dl&3>)AL
zQ(@w<+&V*6!iETh4=3(~euR`J&;K(xkB-2ic(h_zY#L$$v|*<@+^M0iEUIG<RqDUE
zv@c9U?*A!*i?JcU`4f!rKGM?Dwcu2iHnfM?8oRlLd3w5MwQ+4}M&k?n<JZGG@Z+u7
zgfBb$lU#lIW=F)sgzXNes@vC|X5Enk9}bGE9NepY;C4TB_@<WH@t%hyC8)Z!gmwuF
zGu5DCXJXgrn5O6KJ)G=i{&+)lH^O!-1Q*xgt>SkNdnluM_%%-`G+4*jIH`I_{@$HC
zV$wC_&J*!glXd*a4I?9yAnTSnU!=BhQfR^I*RS5xg1}j1BP@rcZry_1ddv_nT_YRM
z!7{Y%=mEb`#fD)Qf4}iutlJkuuQAv+K3lO?gKcV<crJ%UX@9g`t`6G=t2{f8ZxyfU
zd$iZllPO1hc7DAznW3SS`7+%@RAnW9O3$-}6R#=UclIduUH2ic(Q@YKyThLgSLU69
zPz&Z}69)i{VsEXXWy}1{DEkUgw3t7XlTD=!a<P$ci{|M52AHt!RY`S%kIo8N>K&b)
zUhv2=#~q?)pvS0ElwcPTZQ4R~#7hxFL*NnqF_86<2U5~KD;p@CvBG|f8Q)W9hb2qE
zi~!LN!8Jr8JFq!1s|n~a46j^`QaLIoIzp#1O=#dY1=sR{g)^(fSzB5PFEnZhF{;S>
zsevfQ@weXvHmUwxI5;?XTHwcRECX)&YVDJLaYX>Thvp)$EZueB+#-3*#yq*SL@He^
zKOM!^dd*(jngE%K=1cyPtg(C6gm(lau(?RJ^<vW-H|bhEkg6o&(PMwV`)Q9s9RRt(
z9g$n~kjKVO#-sh8=H^C_hA>7&nWW1|{WC?mBb!k0y&SVwr!U+vuy29e1__D{79RRp
zGS&}-cQkeP#eVUo{Pn5}1w{c>u_jILLBnv90Jul9d46j4_;D|3@lBKVq|?_8^p9yg
z8I)xo>3$R5<R8_D{R*YL;zc&#Z!lyzzYf~fuG1|Gh09$-Q?;@?ZsKbFv7B<j1e<1f
zMn?Xn*Ncm{g-il1e+Vuq>@2uI3W2=HH_mbgvP@Z7XlNiav~RJoNJC8C5v>g}M+B2J
zn+yUm;+%^8=hjzJUu0VEiTR&N2_OHy-S5y9|K#!G6MP?Kes9OwAR8tG2x?H5xLF}H
z1<=DV8A<|OtOSB@d3i6phLu4k$I}9XG9%p18ns5{1BFnKWl=2<6ahqL%qcZfI^eOM
z`;#In+rN+d^X~}_K6NtiE1U7CHWv{Q5x4f79r8UTYj2{IHHAMnEIx3DX%<+!%q;Ew
zD_8TL7~`2-rU}{hmcI_j4b`)h+Hf6RT?6aea&j8ck{cq4l92RXwZwjqfT3QNyp^FL
zqZF_6P;M6toDiKahSUY7OwT|KwXdaLoE(yxmxr!dfz*JI51&fAh4ixK{deWM3sdPc
z<PEU(R)h$9!380;-n(PAuydI$5!<wEY;23z#>SVZ4rRCYx9EERq}osB`MgN2uZ9TI
z)!X9UEUr&5Z`XE<z^PY`Q&LSmJc`SFAb$HhJ3emPjY`BpF5)8@`h0f5Y*GbjqpuHR
z)8sx{QJ}?XvGqk!v#(bdArGBzFZx-)FXLlkQDP!R5<8s2*q76Bac06k$@>0=|0*ov
z|Ix)h`}so!xYj$+`AX-;w3oNHt0(NubY7Q~6n-Ej0n{ZI#UR2UkjI$Ef?NyoDgiVs
zPYLqz`d7M2K)N<`V?N~ZWA)y)?gU?K8C;kS^xvZC-EQd47(Sk=aT2vw+)U8EEKLly
zKV0aQGB%x+4;FL*2L)kJPZf~O&B}rjE1@BWL(>kD7X=V&JUKjEVRe{CwWj;q+h$cO
zcja8}bQvU!IMpiTtB-0~kKGxJ%estZ{W9YOFkW|rg@o=$n7OY8L`>N7sRS%MXn1|@
zNYx%q@jQ)G1QltgNjeeh%59?K<Kv^FD=ttUAEc3h(kf#n#r;8RV<i<86<Uwsm<)hY
zJRNdB+kI^{H;;EIKBZ$LMG4Py7yuV%;OG`=xl7fC$^32afX85BSg$#N$Con7V{{#>
zgh!Fe+iCw?Ndv7w=oUAiFFQNC$tokc=ienfNE_=kZ$6L*W6u*V(cJvcb<azRQ^EJ5
zI;<@$WIUh0eVMyC3+Co?D16x&zOWXa1pckIQLY#-%P1}o<AUjxFnM2!ME3Oc$t;f-
z0I=KpaN{0rRh~<Gpydz>-GRBTY)SZZ*xlI3cu0doSy_;NEc7jM3%Q}YxVT#MtqUb&
zwGj#1Ky_QGI2q6B0Q|tMi>((qM2Ycyva;jOl|Yd<enANdd3jA|CPM>Ibxn<liHT6<
z=bWCZ5oBMoQ*6lGU!&y@cjx(@c-^8+7#$ni_jfVI{0o4(DsbRQiy|x`%YP+%Sk*!z
zeP^qqh?d5}!knprr(^p-Kksv5;$rah_%@d(MaP1D?Ln}LiV9_~jO=-^byH3m0D<0q
z6wRwX*|%2jLRE=&mSGF(fH~xO^iEBk9>OgbGFde;cvZ{a-@hq!>>&DMY-Uz+a#A%g
zW4WrTDv@0|3vOc+VAebu#;@mvdljRrSZbDiONp^`A#29zKmVcAPEQU!$cu;3D-T^}
zgwcyP9^htAgHSgt=~fN=I9+$9(qpPw{r&c#_{ebE5cN$E@=p@>R6(i|ieQnWkN_ro
za?)Kxn!1dZ@CRza!4Fzp;3NSMsJn~u{u&~)uF=pYyyV-r-|9b0($X3l6vjZsbXRaM
z2rxROlk;Rzp5(2q9Q}j@K8Gi9aq(PiEY2@Y-+|!K(egfzs;6!d6Xd^}5>qPwkvOjj
ztbsKz|J{Qfqo@(GMN>*bjx36FDLE;TS2hGZw%hRt3m1-Xzj^f0o;X52wP-H35YrvJ
z{Syw-&ai)Zc*M>g<g#f@HO+tLj^|TXS3G=3e@H{)vLxvHTXUG(bM_L+l{;c$CC$dT
zL&rxBd23_5JMaI2ZJYwc)WE)dx5~{znqqnO+fJfZV*#~L5pd-3VW&;FS3kg7+tEsu
zpK1YvRojr!(SD#o#Z2vlSPoWrnmn|v{f<K}`ukF*&FO4eSRPfK=`-88Pdty#oj;FK
zmb=5t8~S6b`~CZzM^QlO7;eGVS&WVDn(&Q8e{vj4)JdsTCl`2Q8i_0^DQ!566up<0
zp3ct3X4&Kuk4*c=x=uo{F$6ar)z>KSx{<sqtuqq&3zV-t(<ETgc3IM=W@E|&s?%6=
z|B|MM$J#rDw__>Ypx|xUar^R@c2zFYlK0BZOLS`fLRJ25R?PhuA@63AsvWll@B=JN
zWK}}8S3UW+inUdh<A(@;#}w<}ee$ZY4TAKvFoFaaD?F}*f`K}{vL+(M<6pJDn#;DG
z-^3SbcMJ{NGlISLox$RCUd#Wxoc8T2e=-$dph;)+4=IdtIvkGia&EfL#iars_=Yqr
z0s$a$RPuMt(p~OyjA+i!uloLdYir0sO|tbZ`NXMPfE-zdKp@J>ro=wFdw6&xw1CXb
zC$YJe3TaC=zdT3s%Kt@8Ihdax<miZg3Hb#o_%L8A?J<y{pLczKW47#!4DbLENy}o{
zVjcQtMIUHBOpf?f1YGFv%%3Y#1I@3buWQ^+d8(*?<T_<*UhSi73lt-c{rFKts0sM1
z2Zl#Q4ZB#2qk`tiAqDZv3NXKTj<BsZ)@$?gG-vJ8y6x}Pu3rXeieySTw+E5DEi9(;
zVX)lXzJHoMfDix|8d@=HvXNUsxK2yFAAMwGq;9ID*%>3^6}tvqf&_1Z8o@dG=NNeX
z02gt%^ZU0w^V!sOkr%Fh;JL02yX@Kw8+vAAV*@$f&yD<8YT4wDf|&k2UgYuHD3yBh
zwh}6cnc2z!WE*V@5*8MQm0=n~;+by1KLMm~V5YeI3V~#Cg#-l2H>_Eby7GdQZ%Ne%
zW;T4NJyJ$kWOa?5>8u}JRbAclRFOoZLSF>}Bvmj48RzL-ZEjj>IpJD;W*5&o-IO&f
z)V6N+BxG5k&{C$(TOV{&vb8~C-Xp_H@mQ?P@-k;}NwMKs*FhCvnSh`W8d_Rh^#XWl
z37gcD;?ao)&Lw<xvFA&7H?v6d^|?(OD`=m0Es)okifX0l*~g`v-Bc~On4IDB@9QU|
z+unjZcNb#JiuRu!Z%wBX2>1c3x?qC6uLcrGP(ek7zs(Pd;gV72cd|eIz*zr;KK;;7
z(U4l|%};v`9WAX?MLECcjv9pO-rnBT)z!(#hR#Az6mDj0>~H<jc`GX`pZ@h%4iC?@
zYx6@xLwE1q{ct(Y!yB8S0I8YVbt@kIitaxjVJ49JKua^s*61bqeM-uEyADTnNp9{3
zVN_>oZk+=$N(Z5uhTKb<ps24E#85M{ZLYG=!D!|zCiIz*ts;lQXRohJ{vojq#@Jpu
z`<w>sI)USX)EUi@ipo_T*gyeC|5^AgK#OEOBid0>-QxoY<G^6&{~!E+cEKhPfQBfP
kO1#bl@aEFlEy8&!t<U*Wv(aCnz&BJHk9E~bAKFIz7yces8~^|S

diff --git a/docs/assets/room-en-light.png b/docs/assets/room-en-light.png
index 7be87121cb175be64d625f1c8e553a84dc419b43..a674d138e10bc891cfa52fef5b29e4ebb4a4710e 100644
GIT binary patch
literal 77213
zcmcG#hgVZy&@~)ILFp<|q^XD?y`ywQKt!5!>Am+}LlF?92+|RdE?v5`1XOwny+h~(
z0)!GE5J=vuzvubh?;m*YT3IXWCOLP`oPFlZ>^+HAS5+h<en1QYfyk6zzj_A(-S`N+
zC~sW{?hpo?wSYjBAf;EbTE1U*7l}d`Z2Y8gKK-Zd#o|gOnhllqeU0leHJ0Jm<PfaM
ze;(at4Hdd|`^je$;wK;OV%R8eaesKADTnF~aq6R;ujQVv)pqjQezKUo-<b9cZ?oA>
zUwPU%c=`;UFkL>|KFe7?x)gZk2j5CjV=JZwo)28;_}>5Cd@G?G{O_GVX(#Ewci(#c
zAK$Vh{QDd!5lP9q<Ge++-PyDCFN&&PB?P_p4MnmnaQC7=(2$aGGa7jIv2yY*{@CB)
z6eS}k=L>PZqxwHHz`!WLm!ERsZf95G%x3C+4Z0?WUv1!+Ut7|ju6Z(r(E$$#K?R;S
zx`6kx;8~fOE22$C;2~iH9;oM4rZ#6P_XE24uKYpp*!EyXbl-2q1nHWy4gw14ma8Qq
z%oPbWY1?KBuisuJuMH^sgXv#`nS3t)V4^M9)Z%g_eVoNo-qOU#Z<2P(JY1rofAGLi
zpv86jsK!cJQGaXka3DbHBm*z$c0}c5(r{j@+lKMuZQHO0KdqT#FS$B6H3>#yrGs3j
zEj&H8XOcwmhbT$xCcWO)i_?$XlV1v^=l`uhM;4;+w5I2DZ_(pn#v4IV#HXGq7d?+z
zD<r})&8wS8>M|M?g!i^qsFn7+s)Q|gONRRgH(V{L1@DV6!Hkbq4VKPNrLD48T38yj
zXyT1wa(o29M5_C&J<b;DjuRD`wnS;-Vk??0C;K;)X?Pjv7!VXua)Wg4&6nu6tLWKi
zmL63G-=l+!=-a{g`?`*8E0N_aiF^*ZhvPQ*l||;ID~!|}4%>u3M>+?whARZ(8eJe~
zznM$oROqL#23p}#ExwN&n41`Cidy{87dQSc%g@NF?Xs$8EoJtZs_DZW+Bcq3Dp6U<
zCf!KHSup-^fonG5cU7e>kUK+ZMjjjY%XPRcoLw=9Ln0=B%M$&J+l1GfB+lrNQ$~Yx
zD+enUF5oRJ0G$T2y&Vb&)<x7=Z@_<V9kbnvY6fprDW2_vcm9+fz7o)GlmnXt&dwlO
zgwqT?Ha1{CSL{B~#QiW12!!FFL1#o~yV5^B9s8oB4}8jXxNY{9mjI`2#T(;g{yL3D
zU8vzZhv!g-oTUcwYXPIW(`M{GmdV$Y#>sK+$9}4fv&XO5zyj6WjGtG!^FAp4HwM#&
zb?4pm)fSa`?`LzNC(O@M7BOfCX`Bmc``oiu+~;zW6MxojvT%ZoWIFk3<J@|Z!aM7I
zC0tPgU@{j!B)xcr#6HUkx-7si_%99;C_0ulGPgs*{(>=Hp{S<qoy?PCK4R-fFW8Bl
zzUN$FdY}t+TOg;lOL<u9e%a9A(0+jHbQAbMb8hB`+0bz=SkR%9`Kk}T9~{VBR13pT
zN9n0a`XLZRQb&CzON)9>IOPv_U6wA2Kj}7>Xie5nU(JfMXF1LN+=oh^%T8VAWvnTh
z^F?38pyPe6xQ{cWgOKoqgxqHLf#MkEAjC>f@a4FPHkKU(^1P?rSKB3FB}lj=4~C*?
zxHIJ#^hq!;oWUk=Bp9Wg#lWXkEkDq$Fm2dokMERYQ~jEmqgtWwamS(mFRJ&%_u)Uh
zPqqMOb()5p42wdr1=5$}P0V8Mu?@?mzZG4u-9Fu^ToBL22UFrOzwRk<pM|qOO9c16
zXd2`$S>AzJ0N(OuY!6;*HC1Rvf~D{$QQmvSXB(R()%f$v=_M>KVN|htq0Ox?sSAjD
z{%qA8TAUWk6bc$zl<U@Yvx`3PvtAapkr(^)CRls1XO=m9&qtunCtV3BNg11_nEWck
z*@LzM@nAm~oAi~{9A=?M>Suk4+JK_edGpy7mQ7E5gkIQZp;?ad1F~vgKRWvH{{1YG
zz!L-MnI=@9HfNei;3)CbLp7$FqW9ANLA^emv8&Yb0x`yyM`7^H%Bpv!*ffg3-5%+4
zRwwA8SG8ZKi&?Y}D8x8lOGk#|n66>gu@TrTK1+77@df?iJ;QEmHHa813vuRP^m^an
z%F0a^7CAD>OP8e+oTb3YnG62dz!{QwLS9sx5VZNJqH=$}xx8uCarD;;4uV;PLcn;O
zT=m5sjR;zgf*CMM0x&8;j;>U_yKWYPq2ox*kefS^4nRtesLWkdC*Vll(Sc-K?rU%!
zbM{-u#oG;9d%!QdDYR4q&OhaB)f}2KXfv^cc4xr{2YD80CXh#zpPi%*2AYDfX+BFH
zlbZueXA~&Y_TxCz<qxBVT7l%D@1!%o`Qr?D;J&aRihc0|OLp3})gv+y=8bb;D~>Bx
zOP?2=6W#yAv~=P-o1J@gIo-cMTWdA0oi)%S3R&^0HUoi1xHGFtNc0J%s7Vxd&#pJG
z#WN;I9AS#dkjB`ZG=9{@(KNI!00!Z#n!)VaxHO!9rfEY{6c<}dVRM-gD;#4)6pViR
z1K?aQQY%bu5O#p(#5sMTx)F};Zff)B3=3rrns!ziVFTdxG~O6|6zo`(Idcip8Tw6u
zDpsD&Mjwbm_Ju#%fIy3(@99SPDR0lb*Em~fwu3xHal;n6CE|i*#2Sj2Ps_?h$jHd1
z7V%NixSK@+9BC(fDTx%9J#6}H8jIU<%vdy=)Fp3)B4WFU?Yz?{Ve}sE*VZ(%`$jI{
zivq=J7e9$~{ZhwIvs)Iy!WC6SK6Dy!;JcQBpb%9}q5Ii~q0EHdQ=$R8{1(lH<)S8=
zr<1um`OKe#2eVt53Ycey=hUU4YtAjfU7vD${I}A4@R`JKDt-r_erol(wBDL3F&gs!
zkYh<~js7ry+Zy-6Tv^y3EwZxQDOaxB3OOrC3!jyvknSeX<~*qq9V`-Wahz>C?B`D7
z2Z0dj`DJ{d<JUj#4W4E?$oviBgG7j)LQR8<L}bpKsv2wodVFWjcZIv%@a0aUOK^f$
zmo5$!AW3SCeu7_=27k<P^`9dmBC<#Ama{Y_UllaHV8;KU!C$K3LtFya;qak_(xRJk
z4Do6l4nb6pCBM=vY{K3VfI>vZgc&ykVB+5BKk&A-b`#uKlRZj7@j4?#!`X{qbBT;M
zybtK~8-DFm6`bLF*m!5%H5Ui4;u4_h7ifzy3T0`5tL28Xh4at+ycY8((|^o0rowXZ
z_C53X6_W%e>COi}m+P2p@!;PrVKLS=PoL^1jC^^kCY%*8=U}_~v0<UfV;Y4UHP~LZ
z+_%IdP6T;%2bmTcvKsp6@duOO(*x&=4=$zvMxS{;9bQ1i=eppBeS*82rYoTs6_*xa
zs#;;A{&s{S<m$8)x5{hW6xj7{O3G8Bw?b!h_fO3i&-TqE?ZKSZ{bp31$;BKvcsch&
zrV+E3O2B|P{5ZC98c1+b1|wmCE9K0Wh?3a2gf_gssARU+-K!sfwFn}U#(JHE6Sh;@
zwT-G-_ZLV;|3(MY!G;<hJ6_%1-{N;M_{RkQ8;aYe4^G&BTOx=@<M5c_1m_Yg{IsMR
zJkE^UPqbjm!Ny2`KiTkJIO|W7$`y9L9Q=bG9Gsh^nMa8VGD}X*qk=+mPHo_Ua&e0f
zB+a>*uO_ze$Kxj7;+opFDfCGyEGCbRXe3c`_)8vZdORr@I|U>_%s6s~&qKgcm+Mx)
zZ@+l#A+yG@`QDk>nuvl4w+-75T=K{r9T9|B9V-CmpYu0FW51POk*ff|A7a6`>@$)i
zQkN`_hf$9<+5SpFTqJ1I(mnqhNBz7Wy!WV6z5)8G0Bi6@GXwlp%q!9h1Rx@Ow)C*h
zv)#RUQ7C<wc2UaYU?Hm%bC8uyA-%W5?RhmN3U$WiPz?^Nu<Zs8zkM2T)_!)pmy27i
zQY8|+Fhe!Fu;Du$e2@BAJcG6`BC)-&CrNmC4?e(r$8bBF8Pj{Nd5)}_yCi}h6N~5C
zZ~acFwbmfp8LEb+5D8{^@B7zBn-<&86||l)NUCa>DM`!)dL>FvUfNaXjj~L=EZuD>
z7aeyqICORDY68nd?Ma$kOyHaBev3_+i6ks3EaE$=s=;eSWo5VxllCn5@iYpPrVHJX
zpEe$^6W-6<%rsRf-CfJYyeufKxZU+qV_N?qI|+B28&H6#eEU+^f>q}TaJ($dWe)U(
z&sqqcPsp%)Z|C2KwXOGarW(HE&XRQ7?6tIxbkUp=laS0AwBa#oE1OHR^~4{;4W#fN
zUWBd>x!~FdcudqpUGTGumvTC$^!m@yy5Osx=<Po}Qm5xu13kZ14x;as<lrx}py)0a
z$vry*V=T7&87d8mu7qE1nq55M)ZxB5!=nW6*~HbYr?u}k!-9t!dzconrD|8G`&qn0
z8}6Pqb}!-~3nkJ)^N@D6Q4zeBXOffTSMXveP72p&a@@*W>=G^Y$HCu5RqX(^m9ISj
zz8G(<VD7xI)>AsEMw1u??A=FeV@`>r4wP_S35=4mx!l>qLwJcAJ&ZhWbHuFXnQywl
z@$c1$IAIOUqO?CJ{3oi@s7N&Hcp|YtZCCO~;H=)`#6os=YjgL}UOpr(?zgHD?bl6l
zx3Q1?DzRy6Q<V_RP;~(mxeNn0tl2=@K9vapMTVsR<qh7snR*+%ta$6y1&+uBTMVsr
ze%BT2QUURu#NxMs^En4>ak{&Rf8wx!*%mz83-q=3w}wH&b)6s;+xc|hvh#6cIS)my
zlmYe>jVHyX-E*B~Nmr{?Cip`W$S2%w@L@UJ`MdKJLzbdT0egz%T5$=tiMP}~lX!60
zzNZDBM-PJ_XUb?qgTk~|jB#_Iu?A-wZ`QEoemg#|wGqFGsQH2>F1ItL)gk~bQ={)1
z`7oEIXmGTmX6}tQKiQMcR=(QAEQym#`I;9Wwf@k;*1k)%63F_7ov#JUw+_DOOExn`
zuWpTa+0n(-j?h34hF*^9-3>V!WNFR$7FRT&@a#Eb;1OT;BaPh`qLOl=QISLydh!TC
zb&j=pG<!}27rNuD9ko{ElUgi*^V)v8*yj?w#|htJ&X3xK`+S5e%}b;tnk=3>T&PxP
zbxU8wRpVW8G#r|l{k>_>ORy(}B*EqJ$Q8P%GGR*R%=b0x_@H5D>dA05D&S+z7kChG
z!g-C8Y5AV-Q`mfx$UXn13k3dqM$k28IBctORAdqQHy?2EUqQ8RJHhdNjF-W4!<M@|
z3q4>xT=+Df*Dz*a&-PUX@=xiww|BrrgRbQHfsyC=Q3-yr<;!(Bv24FikDT*bnwhvm
z5vXBlbYCgz3KOqsGrUQ1vy7hcxo_{Vvby|b>84r$*$`umLh~*Mi-o#`g_HcvC7Akn
z#@qkp0s_~s2Dx0AUU-L*%R6MUGByP=2ZO*Hc*xlx%@z5cIu~_i)G@{Al?WSVR>I#Y
z|AN+t{h@kg?7P{`p|tljElNIPQ5Y#8V4Cx+#K-8jzN35L;k{bY1ov7$INXvtqnkEL
zFMO5~w1<S_cc!5x>M>|INiO&piCdloYN3z$X$FNL(DSI_o!tA3Vxp=IwPOJYm3p}?
z)xF&3!J}cU$7j+RU%zAg5V#luD*8nzmDLX$skLpY_v{}=BGS^+`B%0;+A$a^t{5?@
z4#b|Ub?h{;!EvpQN$n0$#;UV&cg`GIu(>pE6nlITOwNAepkAVuYt-iZi1Qg(-{b<Z
za!=>{)AR^?mp(<4y<t5)Ja-!IYhI`({(QzJ=>6QcTcR)g_ILkK1(jb8yRyH|4ZXYe
zg(yBb=#jO~Z$#FXG)a(ZzfsYN<Q%mAvn{yZW^pa=JFS|<^Mx5INcH8JB68oNuIoB;
z&uj1<HRyi7GSB<-J?6_~XWUY`@q;)847qgMRaydS7S<$<8C4sV`b0x#bI_v}55*EN
zubhpG|H7j~6J{!O513Q&%fgm*3TUUAV?|DcNzqmP3;24ohxEmHweiUqP22fN6An$|
zGwb*IafbP+`h}S1IxTBW5D^Rtm3g#Rkc+$QJqV*&a6i`8bxhvq9{zl;Ih1?)AoIDo
zU&?N!OE9C8kXB9oc5NI|hl{>IlxEnNwhCct>~YB9@OX9_awX>vH`|^$Z#JXKv19h%
zotDPCWw~6N0Z_3jN!!;$!BkcIoB8PVX1>S;&n;`Ba*4&E7yjr8M(B*&<)2bqD6ZD@
zG#iE6b%0}}oFw+<xC2fZfGG#d&x3Jn;2D#nEDE41;?(XPS|5OQj72!+e=hwA&U=Hu
z@?JEF4C}#49W=FR$;*EHHHf+#R%TyU*E#PXvZlY%U{WrMJ&R4_W;Uqz^;RF>9HM_V
zus1InQ2f(*u`4jkMk08tRMW<nuYgL_bp`d5Sl3gfW`tPzGKW<;mQTsYxW$YtNcvLs
zmox>mk(7c$1GGkumSnSjH~TgfatsaFB049h8dLqsz>9rpg$WdlG1j@rr+k?k$JA;*
zId*O`F}WYKY!;(EZ4$82#i`5n{`pI`QXqmK0D*kUGaIONEY2>I-5*R+Be+rpx|uJB
z2exsq9{1Ut9Mo7E(Gtv3zTtAgg16Efd9p30yshNuxKaKvsFB}!_asfVf6Lw<t1l04
z0jxy8Qk`=?+83xsr>;mM33JaX=&NVyA){JTjNP`~<)Zj~=Jv^9aT1kp6KH5Ijsh}7
zF)+qvv$*pKici5?TR%&$Qp=V)o^%PyHI9%vbwTa#xf!r{Hh)*Qc9Z2ZX!pM_Z_JT7
z>W!4I8y!t7uWAdl{SH3fpzoJ@)m6W;(zzwIMOW>=K?3&LYB#}eQg};Y^mud;s13^7
zAQ1DNboHj!V>F}`AI!&_NrorQJ70spySqJP@4GLk-EiA3Zr>zEjiYs=SroD*2_E{S
zrG*s>@QxWOchk68v0Fp+-j+GX-q&=kGd3-!VzFX0_Wsq*ut~L%&z*#~68Hl(Tb1Af
zaeAi-4IPF8f8AM{vfj-1-Gj0z;yzL@=@NEA(WH7SKX}BL>`@Pulk&@&4I!iX`mG1%
z<W_Y9&d;Io$3S%MCAJnd26I>EXdLFDL({5E<n-g|NKoVyLPt2>s~>}xoen7K=ntj-
zUsP=}IWrridfrmWUvwHg%S==Y+HX8-Lptdi*Yph!Cx>P@q4z2cJPzeK)8KAf@yu{H
zHddhvPHc7>)YjHEL^vYH-dbv}!N+0s<Hm2AQbPrLm!NSZdwLLBGnd!t+RL*M#oWLd
z9V0hL4-;Imh|gawbV+~Ng;{GM&fRf)h&O0&e(-Dgl==W=mSQy{Rf`lZnpZ&Zsn+}!
z5M8^<#d+RO4Km8n&8H8g^3r1mpuRy}6jzf5_};nTmE&A1n{#gv$d<*Qt#zLvL0hgM
zjpzMg)>=TNU5BiOv1FU)-s=r1B8woFsFEJeC3x!90E1ZIZuOEkWI{&YVY_zJ$)LLE
zC{f!dze4_IO)b&b><i{0+IR)$1%Ga<9EYm;wxFIXo$bB{HhOp98TRIv<<fr>t;;b3
z#G|5{qA_~O#on{VU%o(&2YBXXD4K#F#~2(#DP8n_DTjF;)4_ZnTv6o$+2wnaWOv3Z
zTeM$AW}b>ytE;?)28W~y?1{o}$?v~3;>yj}WTi3_U5+!uC!0rOY_xpeS_x1YVW@=r
z?L-W&k5LQ^GPj*NlSD?UTB?ou_-cfA#>W2!<65C*m`DBA%(ygskE210<zXlr#q?qv
zjNih#@x0^=uecorIWCy5ZudVfH@>)TO%U{A>YFK_>l)cKlavCOzQhFGW+R;4pYF%U
zcWhVPZU7`h^0f)U7sn>e7X|gQk1|&I)q301SRC@Aq^e^_yHRbcUGS@wz2tsO62;Wj
z<mD_t;*1m|q>=el3~Y`%5Z&*u_<8a-VYZ;*X;2hpRm$J(Sm+k6EAbV<0=0%Cs#gI7
zawYHU{<>5|K$7d%mom*|)Wj}DOA?8=*x5klc=e@l5^?0Fax)tWF>p)6^8?CMXdOK9
z?~;on31QMxWl0)+pYAFzM!77tC9bOQeA%dpW5RTcwmqdL5u~@Zxp<GhU%oiL5My8M
ze?qby+5n}@<FgLR9nj?p+H(N6&TZupK{kC%26syXB+w^ahzs=W?I{wS(v_uLa8^?_
zW=U5{4o1N|)O(gEIIY~c@ajaUtn9GV_A=Oi`2^<oBIqM8ht>V5omFWrpi0pbvu3D@
zN?@{SuQS`TpQ`m~--45;l725YyP8whTQeU;c<CCs?WO2)8PAOQO5n7POWGqh<MlX_
zH9!R~=>*xbMiWm{@HqB}8la>ZMB2rjj%-D-8u?zd;O00ho9-f*khlk{H8bM)qan}N
z;GN^9JrSCry5F0l^WXm#B|b|hS-gSU^ivVeW7&fd3-$4IR)RE>kFSBgY1BTvub*9N
zD60f9?_*^d#a-R&xfk&k%>Jf9;Ek2=17V{UTPrzal5h+783*$r@w-JVeh=Vs8(~&y
z)%a?)wk9+a@e8ZgA$ZSAHYJoF%w!r;vMc`V%CX1<!R_J~)U{`y+qjFZz^J4KGjTi;
zphx(AZ~xuf8+MPaJApymt*e-9Ffvcp!u?l5@aaGc$y>p-<aX6}t828?OYY6WJ=Wuq
zUa*#JLNVmksxEZslSSK)4o$jTt!|k4wic#;KomD^1ARMBRynCG%_Rsvm}@n1@9W0`
zf$+{@#(b5H<V)D#8Q5Jhj*&x^I}7Tqzvop112+#1RTQge&niC~GpZM$C9S0%(Ht5q
zX+L$2W2#{&;(cR2)j}>2DGAh~S_%anQ>)2>4%+B6$U$l~pdFx7uQ8S<k7GLZ2^a@m
zf)^{%!@p3_^J*uaaO-1)(?r9xWAUfaX9uZS-;)&Rohwq@fJzz!T6Rh@bzmThDEdUr
zRXP)1^Wcrn>2K|OSUI){NhXCfF8}pJwq2l_se*3yi{fw&OGm?J6N_KGTel;T_Ne1L
zaPah{PRvwxo8tBR)D@A$R)9WHjoXc@kiCpzG<vtS+%_Sh9Q-YUHK%z?!h_RDPjg2q
zbkA#i>M7Ll2}4Z1gd$MkrcIHs0du6z849jDHgjMo@UoGUL~nD4*rTqGU`e1Cow}7-
zQ=R(WU(<pkALLd(2I?A**hgMX3!Vqdk8~3%<@oA0%;s5+0Pxs_vG?W|+Hw%U3s^$q
zqvo)&+;njYECAa<&MfKd!N1|tzNd!xwGbWr_QGsiu^5O?Il3lxLW48GC<2u;yzOFb
z&8UrI(A-~EM-0^rYpIE9zqYMZT#`8?xhE{-_UFB?uELUNu9vAwooXEzeUXu-i)gX0
zJA|#(nP9{m?%{3&W_Vn`yTpGZJe%baWwLJ7dsTW03G}VwYdDLsgtyYZdy)W|Rn>k$
zY|T^H?Y}jp3;E#Hg~EBKL4c}2shBO$^@l3<b0b5IL>_-r4Hzx5#e&D}PnPrMe`<ha
z(EGhecbaWWtYQxKJ^RbKy_ccD?`}b@gI)q$8$;Qbk%&;}tOV)H&}CK{dX+7oeg9o_
z#!@|~bTa{e;FA-GsX8ZU7je=%8!?i;gsb7BhMbwHFRpF(6p~#eZWC3v;yrSLSd74c
zB4yR?aU7?H`t_vAz<H_h#7?(vX+=!{{L8`P=+3-G98-Ix>!|zKvEO-IA7_(cqt(Du
zVr%f}6xeqSY5Y6$Xt`<;O=lY}MG*87;Aj}BlfvKR6>TJR>>+4>)EV$m(K76q1og=i
z<w|&Bs~e%Gle`v7^3o3lr>LPHgDo#Qk^6W+ze9e>Js%5iWx`IL1_aDpU(a^I-n$^w
z>v^4z5q0qsL^57%Bb1DPn05>cC_}{l5tA3GJ&Lh`s|Bd5To`z-ZZo1G<oXhQW*l(p
zj!<e){&MFlp`yjyz1sV9qQh7B>etFZ^^7a#V01Cybn$Gt3R&e2r{on!C>AiQr#|@$
zl*aS#(``qrxfpaBz~|5V(+=vG)E`~pF@W-M9HnQ|hRVfl=BLD|Oxg4L`)8bM%`d?J
za>APcC!Dl&SOvAp@!m*P(RE&W-e}41gt%@{YdH$A=+@TUb2;E=ScG&NlGpgaKop?%
z$<SY~fkLS1Nc3)p#qd1D-AfMdRM@0@la$O$wR&}Ep{TY$3w9mqDkmhm$Y^4a^1mD~
z!HWP%dt`Z3R1_f*R(^C!E18oAelVW9*nsNzausyQop$CZ*4<6!;AI5Gcb>us0+CrJ
zXDtRMeg0d=O+m*<IBsREh82GSL;X0Xlm_&<Oey~>rRUk{=E1*6Y+V8u9m=#jaOg@f
z{@{1(vviGyxN9I8)Vg+2NJ~bpItPjH(iLms>*6uGi^X;ySSJnw5rv%oEh71<p9fj5
z)|ue^A7>as&4jbR{;?Rv;iRw>(6zL)%ipbW_LFDOBRJJ(JyhWOmt5?O4WxH2>fNlt
z5<05FhY4PX?}B0#>koNR!98^@kWL&yd(fX$`$NRZBb4so8%gwm1t5C%*seiwb@qt&
z0xbtU(pUE<hrSOtTK1U(xRZQ5E?yoMvVSgh$N7hj_3azs8E?HkJ<S9%q&zlv*8(Ui
z^h7q}IBsauLokyrqken++5^??-hx-*wD0-YXPCB>cp$c2f7T};L2CQ{jxgmM{8!T-
zHsb*~-b1OZ1)qZ5rX?$^&@Bg{KG3?RhFVXt<Km_(X@6%EKyVGlPw5K%kAm`7)-mba
zoxo(&uzrFcwCGO1Hbg%Xv-Au#!#oDbz?AZ7KU*423me%iYt*vKUtht5=fwXn7f{^l
zHddO$r95jGe160qT-<uRqKL(=4s<WH8;$|;$X_8No0kgFcDk(wjoGJruuE~{fvS!{
zZtzghne-)~g;9ZwFTxD;P>zPs(+F75RJ3LZ1>=kE%)eSAb^?5fB%3zs^50Q$!L}0l
zNH*H7wSWWQ@EStD6F`HmDwuW&6ivPZ0xf*pv6k1CJsGrMkJUJE9=LwH&yoXBqdhXd
zwg-?4)bU>dy2fU=ta%CS?E<cRuk~!Vz)6ZQR^(!}1_F8R(2v=!1LLN^5^hHmaca=h
zHT-FgG4~6nW{(~h$PpNh?J|NoBQ&V`oP#!$8;!tZ$Y*6KSLg7{@xP)JppGYi(YcB=
zyp}45V|NV7_7tnDAEpBv#zB4M?WC~0u6EoTTdh}ebVF7*3f@0df22kIM2T`+dP-`1
zTrk5iUL>AD(hc8E@vQ95TJ=)ktT0eA*vs?MpUwLGCn|ra#yn9TYnV1^cJF#O7q9Tk
zi-x!AID>*Y04okxoOS#?H_04$20!(N(D}Guq8HB=pdQl&0cX-)s}sJDGdSi$X%eR@
zo7XcrdBNReY924m{r<0_{JM1aH#4SHd((bY<+uYd-$St){MUR?h@zfN%emposNyL@
z;1MMhJlflvsjO3J2=P4pmDm}IbAA5j>!Y**HP{o?-0bJ>yMKVJIX5HS$kX?PmBuKz
zD^h(%4_0Zk)u1Jcjq(Beo~<c7TSLKdTkY8e8w$D5y)4w#L64oqc()h+XunC+h?8^U
zZy$hYf^qIYNgIUvq41GzK6>Jd8l$8;M(^obJnKNgXfLoGc$<CYP4K%vs~Z!pVLPIv
z58F|2ReFGs+*LCMJ5Z!O_eeBxf}VZJZQYZtqedsuz>kKT@Xs8WbphqD#TD)UUjv5k
z8=kbR93}fq>qTJaP0Wtlu(82dzihu1``r`!B9u#MRIk38S42Xh-u3X8JPC~+^Ids2
z*KfQFp*Q_dm<`F?i$Q$ObHA93!`=J5!Am4A&COf)U<~Zp!<YZlLa~wP_&@y<!V`4x
zr!;^<?eC8Er~lXg;Tu<s)QWsvBsiG8T4USB%i~?!gh_M3o=!u~+e=I7f;|9{$FOeW
zNO`(izrlPqKhX@lDfGr1$Q~$|C2_zOqL8>moCYv2pYiJP9c1c4)*G52U%g`I6K38S
zJ@;=X{?{<mrlgVl_G#A8hL*O4^Ft-`Ck*ilEVT=RNzN*ml?3qNvG_g&yv0Jw(R{kY
znRC2LZ-TkBsi|^Z1mJ*GtUmh>4n6mex&mv|xkmh|^S9q`r`Igqjnkfx7fU3&v7!Eu
zmh{9ruVi~WBb#C`*c=97%aw3nUC$`>*s8TwB!))6`UO;7sqx$`>q#kT&U!v4DOvuL
zKY!IIIzEeHXgB`XGXQjcj95JW+W-QfFX!dIRuCYA;J+dG-z}#9x<me--TFf3xr8H#
z@|K3Uz;SE|Oyc}fQv8yVUk0}RHtT>wjz7rdb#{gVWXJu1v?_yuzT!CKR8{jw*{Itk
z_cTex!hg-cP&2`2@z@@<TtMmtu6>~v-_baO>Y(AeCXLq?BXqZ{8Qpq#QRh=W!S%>Q
zwtvk|A-ax`)iK?+-J3ATIU(U*r0JBkICJ1S7;<oOp7^$8%imjh`lhVuzY$d}zy912
z6NKr(a{r`$^F57}4m_FEHR}8pL^(LOEiH91>k^2J`qwAbfiymep@HmGx>$}py=A@U
zw!EBo7PJgK-IxBax9Sq8t|q}}!_o$I4=QEnK%Et2`{ySFV7wZ0;{)zgYA_H6Kp=^Y
zU(qjC)Di6{KP;IVG*Z^#N4$RdJ^+89wFR2m2o)vQEEM?r&4WUcdDam-zHHL*XZ+z)
z57Qey*jwQb_9+0-6}XrSG|k2Mtw*lksM`ccX9Nnr{d>y=DfVy04-%5@nTqijk6RE9
zz2tLP0{A<VEk!<aK*R?w3|Te^W+nK4KOX}JqU&hTrmr~u{hFEM1sU*DF(vB}svC9I
zyMYIHDs+LP76ej{R888}%8*^79LzkF1~OuJN5wy5K|1c{j@cY?a+HG)yn!W|J?Xs{
zXdv?&pcR3&PP%6yrmb*x`Lvhx0lE@(iMWg_E>1PV$7(z9nn=_?rzU;lCvWxltDtu3
zq@tIyl0IVX_|fsRCBJmxvh_dds_D5w$7G}r9(`4P%m2gaYz>P;sNqtDk$ynG*kKF*
zO}U4Ez1uOX%Jlqf2qrn0c>>S9Tm~RTI}@1~8+U%rIIpiMBJDJ5f<q1=s|>=l{>^7t
zw9y*jglhKNj=46KT&$KAMABKo?}Pf8E4*I}e;+iiJhkIn`)_E;`iIy(>E;+!EB&=h
zai>#3%Lu|<X;<4zG~Lugv1C#B&#-?B{F5@fUnFq|QJ<ljLpKAUFJv(RwMKtR#PaTt
zrt}|_4C7R7MWvlGhO#R)t&r<<yE1$Z9gr)vBQk6yt;tDb`F}tjkX(~@aN4)a<}hG`
znG%KR6T~x#kB;D~1FxvL|HIsZDoq^W8kuC_=ogz@IbakF=Fe_wyH`=q6zP93QJe8y
zOs~A!R84{9N`#Z$vL;K<$yuRqiSsI|26uD(^TP6d;_<z&tM5ztr}_kELIINvrC_4F
zgZu^o=YLZyppty#t?Ksw8H-HL>*D{P`_H@f7;e<5-X>)I|J}%twOPNP^3NT<w^ZH4
ziT*~;j;zz1ewC*w(aG=pw_Y1E?SI+!FQnK4Mkf!W`MdaP8Lv68svG@BGv^7#vELhE
z3&u@PVm}aqmMML?fzc1h-&mb7yq;aiIGUFd%o#oPKYjqP);IqR&cab#>-#E3aou;~
zXK_~Pt|KdViiVwdiuSV{eQ}nYYalf7-%}!lW>C$Fs!t(GP9h;?;aQsFhjhA0_QLFR
zo_DXa-sUia`iSI?Uf2Z^gfm?Oi4j%*0PHeW7b~qWe^TE4y<{k&{!qz6c;>J)aJyt9
zcQ!LMvg`p!hV5Ta|GBiJ`NHAV<D%NhflR||sjCdo;tx6xU|iTi-VareKp>~6o5g@r
z46C_IE2ymMh8!*wX+D$%H3yIvo~FK41zH-YAN@@hej3=x*ei3?O~l#sT7y7)VY0UX
zGxn`h2Fh5!Qy(72O)7{8pxtkPY>Bi6flmw_&8rd~7YXEi6AP6(-mw~uVHTjSQ{@1h
z{yzL~|Jbs*j$rq2kpK@<qJyO%aHCT8?|I<L4>{6{BIHjkO&y9&y<pD_r8jIpDoZoO
zJ#MiE4gb$i+svo7-7~rj(Qh-s(lOS{#L7h7-Gn`e%xljn{<+lPu=wNRvow8<NExaj
z;F16OCzqX#IMduFW2~nfMFBGO`hVZt6Hh_9H^-LK-el9@C+HF9_c&TdEB$+z*Wa0Z
z<JS_h0P)lx_lAqlhLd(As`LM~lU1sud|-{1`&d!XoSg+E!}+gY(l9zqy{p++@&k?;
z5V?P=-v9<^`t|uG2>V2Xw9iZ_Sx9Aw+9R`yAH>#4A_lCzL07?WS^Bl-L#q(^fvD6t
z@>rgaWIbUtTnRbDC2ZqgO02sRvc<hcggZh0WdBgL?OvujE$A1tU+l&hO{9-fui;72
zrVC-|ORBf)>pm$!M&-**o<>KQd+OJic6reli6>?*1o)%&za$`AhC%)}{*98yo}fWH
z@PZc?tG3xwas*6^$HaeDo3omDpf1R5EMl-UL(}GqjZLlKthvslmQr#7K;IXFH3COx
zmi3-cGDTCk#KC`9&8B86G6$|s+#~%)^UncaZN;i#R9`WhlJDrAPlX{y8Ykzw3DXX;
zurP)hQ3wiyj-E@%&!4>*ZAgnXyh|eQ^1f~_e<fu;w~Z}Pg)e0PUsm8s-9z2~nxlN;
zwbi|6R)rKL)FbpXylt3Sq;u*ki`9+JI<<FuNW+V-*+fj)VsFwS4vn;IT5WyrZ`8y0
zO#*wCOvbWFzkM3v0al?yU)APoRzEotY+}X?Ub+Bm2*MFBdWC6epWhzrDfcH<c~5ai
zTLJq&GWxk}H1A0VUE26C{xq0A`OM(o2}IoXgS&(y^0xrggUAK4eQZ&oEv2z?BH{Z6
z?Y1X^Q%kStH8VWmewbEZir;IFm3hD#aS2jx_Ano&bLYotg?n3$zNck3Iq77Y{_V-<
zU5DHGf?FxGZ><=t>H<znXk~P{VtE6HFKkA;E&X?*5^%O0f?Z{;{u|mB;T9GI7Q&}5
zvY#LSUX<SS7|dy3(GO3&MmTc+pGEO95ykh$i9K=-``WIwx>X9PECmtqSyPS$NJD-f
zY|i|6M16LYVck*LocN$+u?svPs;u<dGuQD<dO8{1|Lpk%8BPEder!O>gjG51yHNL!
z4V{=4I!5xxjo4{jGni@mEV3`*dgf_eypNl%Xv?fZQV;dcuFtlTFAVuW0=KP5za9Tu
zeE$TS^wAYcByIVSq|vdjLUZ}tutbtZUPX#_AwQf{jDsoW@Y~6sQZ{lGhO$=tBx{5~
zc~LMKRuv`fy7^FW%}^cauqKyNGXORQQvrG`&V4o_f_JU>1sxkx;-EvuR=rNrOd#4L
z?vE9EBuaHgs4==q*eGDRH{APl>)G(!lHHnyc*3q>ovoKTxpCuqEm4BxACTB>-ei!m
zNTSx$cm0+}mszX7H@8PGSj`AQ@fsHi^>X&4ChJNS?S2&#l0@%#o83QOtDi3_phsNP
zd}$SoxbS#bog-T9=xDmTKG-*xkU2cOO9yW?^SruXMcx_wHV(|ZE&4HCyM{_>#bxj@
z6OKtFLg<MQh%Ftj*3e!d8{6&<!%dJmtdV{T;$doLr{asm?MpUH595k9YMTS9E|v<|
zkW#MIbb}Yag9ZrG7;~kDL1KiRq#X|INu${D6CY)|E}=KJ$U(=*4}>F}MRh;k>9aD~
z9anGWln8X2xF!)33caMS)cX-u1$zQ}Yqi7sB*?2sB)0A5>&5(8-&LW>Awm{{fv7Z=
zbXmm}*1H{=WkmuG<k4Of+4#dm<sv}?N*Ji6+LOV8qo7eV{l%jcH-$V1h5Q>$inIUa
z0t9WdSg#5^gDw|tPhHQFue-OUs?J9*2z@NG1z^ax=Tb|-FILpA+_TJP!R1d~?3-!f
z2Nb5OQZkAu@fJe!F7=iCEI}esg#wZJboJUYq@)UQ(VuKIZFYC1!3->l@`Ba`lN%zn
z%8IKjq~E?AT-;h_v?_J<l>P3EbRu@Nwifg*@R_nXYSC7z+s&Hqs22)p%tGkRQ*2H2
zbFpX2wxZ>+m~Kz+mi=MfX+zaasrOBiEO?Imho=#%eG)pVQL4b<a`17?jzf#xpq;Dx
zfl%7&%eGh%d@}j?7-+7lVvneuyB5IzlC~Llg`G83f2?r7*rZjBUG~1)^(D>J(uy1R
zZ@<DQw0y3_DwU-S{464{5ZBK(O&x}L2aysz*5RY4r{y#vbt-93y#fjU^~nce>Y8RP
zotU&yMB$G)@%^dkmm&m+8xC}~Z)^|0TY{%DELbvb7SQEAD$3XaP8?2IrLaGuR1K<g
zB^WImB6@Bas-RPNGJ6awd|tbV<q?22FJHGC2Vw1d%2q|}S(EWLZT^wIo04HNx?)Bd
zG;`m?J?AppZT1Ts_i?ji-9DoOQU<e5Mq91)V8kYKJrSO(#f={|aTCWrbjh(v9<0?u
zSbrF=RNwZAA}c$!n<1wMlqqL6I47l%l<jG>MxXz%tYVS{>TIE)M7ag2GCss!vn2sa
zwdr{W!Y7c$ZY}GT!`<aW&#rMP$dd<4*M06JZliN}tr(S-MdLm_%;bMNEgw2VA?tra
zCQdQ2wWzsvO~G_rsFT#?tzg|(KPP8C*-1}9k(St@qM~h++(Qc2m}bV}3|TqI8G?di
zDOZy?kcHtE&7^r8OeXKsm{HtQW(tPczMZ`4U!uhQ=S|N_U+MUeK9P}g<+-`c7-;+^
zN`1XtN33;AW+zhE%~DV?@kVycySr9=p-UQ@{DU8j&G*&?3>w@Y*SYq*s!>fH_mrKC
z6U(xmSg<uHAshPmmGrAAEicswd1+vh3+V^!muAboZ06@j%gSX$g5q+N+vNvjp16?s
zUr3e^<e_^;Hd8G3YA$r{he8|4(mjQJfw43VToR`7`=>!DqBNZ(m*y3JL9eyeWcr<X
z_BM?~6~TQo(DKXKmm->j3IvIXkcgfVB$t&=fvt6kp#t?OcOlXv!%q8mh#BIcH2#9{
z;JSmieu-wri8ja728LLkR4n$LqRhmvB<e2>!TOA(?4H{c-`(^-y?(DgVF@m&eZU^7
zamB~Jb4MvR=rn9cUA>5GZT3sU=kLl=*}a6zZ`K6Y05Q+jW{c=Oa<Im-L+|~C=aCQr
z;t7zjwS6lHryYP!x!U61+mOoFky8%diS|sqX`z$uSU)J^Zp#+BU3<rJ$i|Cjw5;3o
zwd^RJk(R|9`Z9Zvs^{gx;U`6&_cf+|?3Dd9NUmAk%J!&ix7eUO$Y?N2I%Ad?5YTSB
zR9^o%4@ue>Xel=LBA2h5(zt%>mjA1X)w&agf(Hs4*`EuEVqaLiwpx@?O1DqYh%U2#
zkTO9?V4ti1x$u3_$E5cIBY*DCZH%m&L27~z--~0@M10pB<1GwDTjHy<RU{?6K3?;@
z8%7s`^fL3-r}M}Yw8LFVDn&ah@;`j?K<*yVb%nb~lJ9r)NglA=O}xesO2J%Ys&E)P
zb|fPcJ@9^pLAZaeQ+J4O>QRa;){;1bz=mS1yPK7M4~S7h1=;Qy?6<PId5YrNOU|Bg
zJWZFi0TSb%GfPW1^X%mX2}MSlgI^2uo6B9Z3Yq@%O68^OAlZ{px)ULf)Va?ZZ#AFQ
zDS04kghM%Af8+!W%?7QywJ?1obu{*tU(EI+p+puBxzA2=R>j<SJT-kC!Txuj{Y^_b
z4OXdl1PFU?Thj_E_H@M>Gq!|mD?2}>?Gnlkqbow*e8f_y(LpZ6^yBKw5MTVAIR^=T
z2!8My@Rx~vWMqE0*O^QG&E9;7yl!P%jEHxxe;~&i&gw?zA#iLNItr9}*6k@~#1zo+
z5AD8GpzmPM{z)&lJmK3xYC&57P@-esF|#y$EmjJwDZ~!>d&_%Kj*-6}dj67B!@VDk
z$$z-;^P;;&+(2HirAj<rgX$0cv|~Y>=OYi)7pNI1JIa)B*}R=m>|?&ZF#6X6kq5rE
zBw-5CTwHdD-}{`&J-?Dvi9%}9uQ7s7yG#AWvqlpl-RV4ER;6P%AmVlwj;?(}$Q*qi
zu(6Q1Mv;<5sey=ujalFak^MPvQ~rviB7zWblMk}*dG~`$iJ`Za{xi0B^2iBOzK?du
zS@c>!*fjelc6VQ<eJtz~zL%+6H~ZR9fg^m_?`T)^j5#<&WQyC^Ks4(Ra_%)?1#3sA
zep1jG?QU0F^s(HzMSvh~TOnK4xu;aLYWfl(Fp8*B<t=`%{*pAj?7J;>BI1{jQLkNC
zK1qy@S>c+0U9Be!mz=h=*6~mQQBRa0MU{L#E6t_Yk(#0lCE=?3IO}`k@fp*(Y@Axd
zLov_sxhw@N&G@ODBJ-SAAPoV68rXz}&q{VYJ57Hr5z~3Z#HuoNe|TId@FOazt@(B4
zoQnua>2tEZ$Obpq2f7Pch0FRUAas9w)c#r=bsBkm`%XW6Nl2$53fH%@Mk~tOx~i?)
zo>Wo`XK2Ao)lm|S2>VvvaJ|M7`HaiuLrqcutDPt9{W_-4@)pfoKR({i&13a^ILg{x
zANF)zE79Jzh<U>TzW@<gCUaPQZ8ah+o*?l&JHv14!iKQ0qjAzeG}d`0$o(wmu-%K9
zJ$m(`i=M}zCA!I*tE|gp4~p!oQxgc;|24oG;-SHm)n`K6&0rBIAT5<*BW1D9uSD{(
z*J4CfR)Zp@tgNo>>85rJw(fQug~LJs$5ywm$lWvz&hUM4-_zyNKc$sv3$BN~@+^ld
zHWlsL+i8Yi-__peKYh{bv)hC9`9nC>6nQ^Bv7g^v?r6{GkX0vj&5DYh<x07tG@*S|
zf~4P&2Qjyo)k_331zG5ntnQl>350GxijH`t{j1hugx}Lso|T(pR9xUXtB|&jn?!+@
z_wTvq1c(SvsjE6RXA`OV%i1D(T^>EU<S+-C>O2xWyY_D_qc1lS%j~Tv0_|5vEZCUE
zUj)TmL*D{I&)V~5^=?K9<CDr)Vm^f)0<bm}9%BF3f4<8j%6`0x&=;<bd7<KJAtA>>
z!1mmGpVo+wC0t9a;B%v;sTO4{SS7jV4M9e+LrF0}i2Ll0tmkFyT)hOf5CGYro2m^%
z_BC=Qwdtjm9D-*QZ@KQ=EO=$@sXKb7?;Fv}Bn7XzFb-?ZF2SiIv|x-{1p(5)v|Ye8
zd3zTv*TYmyQdFCVP&awbl**FCUY423xtY|wuC>WP;7ST?BAbk1aZy5A7FxFBQpc<J
zIrDY;f7tbHuaDP|)1h_L$HMLol)u!u*O27fUCow6tfnI(H)kp(_*rfI<nuRjLqFEV
z@zhuwSq_4pF|QyFNqHK=WmBL&A$JdK`TmC7ss43oMfa`lbHmJ`mq|=_gzpg0bSfc!
zkSf`ymf7sw{IoCv<;AHD#>i1kT8q9Tu8zL1sv>_j?7%~lW0bz+Z;Ct-t-k<D_B+OM
z*S>}=wdC|6v-d;P&dZ`FVVTHIM3v*yPgH&Aknj8;#TfOIw-bV8dJ|>dc{R9Zvhhf3
z(%(bT_IbbJfq(pkb+9egi@m%nd3X&pcfGn0q$;~5SDq%XAEhzr;2C;oeU5PL9mbtT
z@#?InI#P?YtUO8z9ajolVk`Gk>E%c&LvqOTs!YdzDlY9FF<4_7KiBx#yn0EiDE{Pb
z(Y3df@@94my>^_0`D!ZEFsu4f&us9?_oPtzII`F{G9I(dd>hgZvjczP<y)8SJ5TNP
z$?`s08KzA@?ElnJvt)E3#%Hz`sGY16-0v%Y2|d;TX$n`W3&j|f{Th?6{2pB)>D!Xk
zE_>U_?(3VgF;CU3zU{{w!W!wr?;_$x!N|eUgkFo~cR-D1@94U_j_%6_{!q(6#9IMs
zpU$S9vHE@ITm%}g_=NM`J0`*E`Ke0q<DwA?#9%7uk;bR~2h?l?J^5`~?DjEb)Wiz<
z6==Ec7@M~PP25@9e6-X=TeuY-q@bcc$y@4)5UyusPn8)j$Kq4eNX`e(od}E7cP|4B
z@(?#guXRY>5DZyD4*z;3{4`pF)WPCzRsudmb--FfiNpf)_<2&<&UyYjE`)s1l=R?_
zLgoBS?ZW-+o5;7%$~?{V6|CyN)jUmhGt24zo$eR+L}&KWrWl-OZOoE)O$gLU`mLve
z$DXl^i2wBSZ|a<>wOXcExfHHBfwD!)d8TJ^Ng*9K^oL6G8>aN95t%tKPS3m#)Z~3s
zKxs5N!XC>y{5V0F#Z5=3I&lQ_AjFh##G;6#O=Mc2rfSolqcPj#Y1T>KgQqE><Lb1^
zHutriFjv?0O*QnDIk#xUkOFUPXB`uHIzKZ+-+0wY!cUl3VdVSL;;lz7We-a7f`D*Y
z3qZZ()V5nJxsugj>^Ci@U8m7l)!Nl-!XZ}u9ZJOV!e6whiq7xyWS@6iau=Y#IqQ^t
z)<xVUCt}ax7cF=#Lc{h=5_7CHDVRJAvhP5W%kZYeSvX=t<hBY0s>JKI?LTT(l9rNw
zeUhbpx9=rqX>5VXmI50+5yMimA%9ALS_6k$VqKJcVJ&$cTk1<*f)EaXuR;`!xy9~H
zR#~6zP0r`*57Ksi^s`!ixLuJnM6I9o(ONmHehjO_(3PM0cKhn^^TU>1u1n0lhMe|J
z9KsZA>H5%q(UQ+b%*?a=YYu<)J^f%0sebG8dWh?N<Ctq4fR^V<*{{(`{zQT1gJTuW
z@amYI2%rL3G(?a}d?eBDZvples!z<N_dnM+HB%ZYZHHNBmKD`S_*N99)$)|<4Ca9v
z?a%ql^_(uxp9Q6oGiUKtC8(wDWx!~U&-jY(m;#78XtlNV=6S`%P;odqhp`xMez~2U
z5g4IaRU1TG&R6de*iQ?7eHc4w2x@t3L*4&I<>~##4_+C)=<l&wgu_WgK82=CcQeY6
z@<bIdU9RtMUVpLjAtkAJUL9-Ry%{$^CuB8wbf=~G`r3-c7pt2>{$+9+WCPjPl7Y%G
zfpfs9!9wp-zm!cEZ;k6i9sgq>0_#LHfP_r0UNEKD3po}_r1pQ0&s5b>*-~(sqU_`t
zTb6iJqv=Ae?)LNh3v(xaZ4IM4g8(6{JrL<vAEJ}Kl3F|aN`HHI_m10a(QpvOoo{TE
zgB>istNC1(PJE)z#S$x9VY@pp&2Ev1`g3M0=kX0Y>$~G}w(%6hEVtgG21B3S=3=+M
zIrR3y=r>5PRYW$z!3R>^zC4#Q^tpfTlXQmFELSeIx)1?-gehUw`WWq$m}vKp91<l=
z7lkSn>6>Q565?K24c>#W1$AlU{m`3+cL)3XtzKJY%c$AuYf^G(@x0<AU=KAV<XN6)
z*<926UoL=_(CJPpUn}WX_6MmXH?_yb+|A#}3+j)g<nTC9-zG8~O{uBaB6_F4<+$|o
zayZ~jU-X#nn!I4hyIa=F>dBoLPp&_FsO`<?3UuYEp_<Y8BXF9pO4R6K%ep1PI#)gN
zsKuH=Pna&ZxOmFX<50=^!&nCqF2j*lVjErceQw5)kNI>m&u$31QhwmK6{o8k=;*Xm
zV%Q}q8jHvu!?jfL$NW&7T(uRVC2n535zZk}Bsw&VS>#E3@g!D5N<uJY=BGa$@`=B{
zayZ@nAzIL&EMK_ss@%Oh-QPSG8r!%r@lS3OT;)0HDB0Zao;#NcoB8y&X<7c)wLVEn
z=_8sd%<~y$vv#@W?@^E9AQ$)4a-Ik9C`E`*DJ2Ih+hm#vv4jBZe+!w};MNrP?K&QJ
z2j%An8LwZFM{EQd53R@SJ(!)@2$!b({A(q|K!>~B+Vz`g`D;z4g0TAz{d$IPsL_^r
zlSl0G0&C)QI~I%z+h<{>sb+b!1fWP$LZfiAnEQ(@Ub9Z(@q*I&@I}+9rMov|w$!~u
z?-sj%NggPV$bZlNv*2d=6Xk3Ag)cL9hlep%_XfYG|MrhkEQnO+phtdrma>=S_#$06
zi<I7~5I!~<YZuD>heSB!S|_O(iC;zIeHIN9t2(bmRjaq6nas<&Qa_cRKN*!DM+a(X
z-{(%7&J>Rn_g@&OeKK%eyU#YfS!eb}9aFxT_PyrsyzKEA?a8(li>{_{%S7RUi=9s`
zQmJ>x2SHr7tVizjTAZG9XL-?yZG<aF=TqM9<NCA8ucIX-KN)kg;rq@hkyzQD)Ws0r
z(>Jy3%3<vOuIa8W16C@uNb%g5xX;vSs>PXH^*I?N)<)^;n=M;(-yA3hzhzgP1Gzrg
zp^`{}yZ&?!zd*rs_9yrV5g)C^O)Gx$(-#v$#buc<HB`ohv~}ytG*q05ET5_iP_b%!
zW)D~D)}?t12)jF43Ttr+G1gSS*<+1d6Zng3iu$Z`T&5_NT>--hdo3yp98as#s@k1;
zY6|Y@Z_0BjJf5H8{T5dzXg4Jv!;|kwX#6sTBj#;r$GM<;ze)0t)*IWFn!HhYQGtwi
zRN<NYnYz;_wXq`el@qb=(NMSXpT%OdM(G_lbh$|PYy$1|Be2-Q&8JyjmB&P&3E*5B
zl4EjcHE802LwwwOmXtPM%uiA93e9I9{vV>gJRa)ri+g0vo_$bujj_)ld-gr+SjLtx
zV~=b}wg_SD24f3j4`onUBFV^@v4-dyNe0m(R4ATL{hsIb{5$hm?mhQ@&OP^>_xpX7
z+qJ8r#OkIG{q?z%T_~*m<7SQ~)xDw?cD(Y6<1qp4ZLQ7&+!fsm%7fleA9+^)9oLQA
z%qeA&BtxYX^fwvbS3Z?`G->TR#gxbGA`JyzTROl4FV?NAC_{SjL+ADSKB~&`u1d3I
zi@9GCZrYu8Vo*_dVQccYV4p%1Er_B)bz&vXO<HN-5yV-v>Ykyirt_<h<)MmBCewFo
z6&UDP{pkj$O7muw_@=R++Ld(@0~h1^4e@`1fBYI+yn3nBhhfT%3GKx%j=Z!h<99(|
zK4yC!h3Y0OY4Xg#GL<;JK)U%3^bs{oVcg|GR`;!%=ZMNxD;Jwp?397Hc~gT9-jq90
zaF_v$TvY3v|F|48?+=xoC9dYQDEK0jp*8*t%g(RwR%G75Tu1q32ehQk2~dClbXo(g
z^Y!;RHb#V#7ia+3n>yAQQ90v$*YY!3vp(P!Q*J!PBAgly@=O|A2+xzn3E&u9OGj5G
zy}0|>iQp`P4ZrW$cAeTgAwrG|x%$W}FSIeD^DISBcIa!s+OKHPC}1CE&asL#E_RRq
z>~(;h#P<Apt4|qwK!76;y$2tFEbX_bPH`Wm`9fPXaAfe|_ZXVzjZ3HS%;B)+&qrz`
z;!aUcs41E@7jQ`|q6Hcis!#K~=X-9{)U~^H-ixaK<MYl*<nx@Z*=$s?{YzbBVIJjq
zRzYTyS0FA(wU@X*R@ZyorT^Q7`iyYgwr1j#jKv7qNpObq&GULrvKOB?F6-OJ;fJ@(
zv^4XTAId6P>!?3*nIydgR`cC@Sw-BjWJv3aC=D#OgL_8B!%W8B-6@~)+y^L;OlM5n
z6wtRt5^%}`%In)v`oGSy4l1w&n+3h+V?rmHQLjhnH)*rmA=VuFFC5LB?=kBA;pZRE
z?$#%bZ4-94Sukz*Ntl1l6wq?L;>8d1vb&CrL)>KhM+l=fvTSg>GDV>x*o0nXo@e=R
zZN{<~mP>#JJGsgVv1T+eOx*FJ-qhK8`f6Ou)PkhN!@Bea^5RJ(t%E9laHMv?OTqay
zMQh`0GbB*$p}_fWV>_NVZ@gj-lg%RLI-SIkNLGCL1BOdeM6a0D{4Jf?p0o4pyl&qn
zKW5!P8Y*&zX&H0d6Z>Ixu!W%Ol4AFRi^)NhHV8#{>JWbnWlxinZxw6N2jE_Z&Lu1;
zZOrto#F5o#EvlMR>DjjQ;Z^rLgkpnT%Q;?SxSGGiEakGS@1x9{e3_s2tr~W$@0{H>
zF(_H?+NqH^n;G=;vg&YP;4=%NkAR0r)w0h!UlS!Eu<*O+h1IW*qGj0v_TOHrv<R@s
zp?T`y$vwjys}xHCzvYErU-1>PziX(OxNn>N!gW>_h&q^u$hp0jqo)(jr+L4%i?BM+
z<qFQUZ>gPD_2B82;65AKu$S~Cfc(m}B*$bkcA<mE!?M=S72g#-UE3rHo~68XTkR6Z
zrJ8o<z!KRMU-5s>*a~pmJNS<^4BsVARc&>impsxjTd***dPIFIFt7LZ9vFX4aG$i{
zIodl8Em_P>-e)l@j@ymaLm~{VQxx=+_V_QF5@1dSZ(V0LUxa36mW|IU>dTjJFFwko
zjIZ%8*PPYNy8AJ*fs>g;`0w{EG3-cST-QMWS}irXCO<W+AOmNmHVpc&x+x26Y^xmC
zaZWp97aqJ_^1jgg$T?BB^vXrp&E>w_?w#Tdw!~i!Ki9JqV)`x$v!>C~^qx$W42159
zZ98KQQez+UL~)2U>hl9bX7;nOu)F@<N>0!Gw`ZS!EnGQFE*O`Ir1)iNWVZ+5dg%4G
z;%CEL8Y-m6DgAdeE6bY%CVOoaWTlu4PM>>0gw3V=GA&G(bs7CxJopJMd4@IQv`q8X
z^38X$)R^{P(v@d5*feQ|$o#Q0H+LVOA8m;WeezPG;Fd>%a09^t>UQF}#tx_6Qm@)7
zv&MEH9_vZLs9cB%%lfSX4u(1xNdb1ooy*1ci~GN#AFP^g{Q;`eSY|L^y*&VL%&?$S
zxAo+f!PZQgvgvU6ymv!sPy$s_b;YMR>EK`8di)<958iK4J@ksW796Rrayb{vq<mo#
z7Kk+Kv<UOe^ebzaeOnwkjdK%vT3)z92-mdPl@knkAF~E-RVlY)``qBDh_6N3d_Zb1
z^Jf^%HcOhQB}ee6h&6ieZjvCF>96Vul<GzcQ(+!N{f9rqD|?11(=mEKc98xf*Pk;5
z*zzaiN~RTC9JA707Ul$o)O$sZ@-d5sV-(iVbuo(Ie=eWz$WqI`_SLdnb{yksb{|>J
zXva4#SwTxEvhll|b5lFocR5fMmmBg;yTL6j-OT|5@dc6x9IPg_9g&*YaTHkZE2K<0
ztRo4FSA3a%N2zEeHuJ-Lr1VI272*1Go=MJ`YC$^q<fpMSsMc60-eB<)ijsJ_UMwUI
z7V2)Z{@^oNDE(1^!tb2(AdSLT$h~fDye&d{Qs&QYSSxx9Q}Bit|2A+(Z?Tp8{9Xt%
z-I<gWLu098a}+@XF<JdKvp28NtU<g0tYk8seP)LKBCh_RqgwLzQ+Fp?k==U%0k&+(
zIK~5C6I{JF6euaVM!fg-iJ@e--vYOp7|8x<7k=}8y0DpSfYNK|bZPx`!>s<1De;Nh
zB4*{IrS)DoZtl$8AGnFi&ttEMNy5Scti+-i>B0%$+4l2+%-0RB$vr%4{O;>{UEuYr
z5Tvo;s@K6jeK*$H($I{S{WPJ!!8sLn{q}|fQpVE+f7e8{EAx*5NxfyrN7Lh57<7$m
z%Uu*QCot=e>Lh?skrz)Pa0gt+a+k(b$Hhg=E5d&(m!}pMfGJTv27zi`GBB-v#z=(p
zTFUXDr`Y!l1=F;SxRY@=_aEC5DT*ag3Ro;G$UmER%H^S@-&U()8IK<!)l1aghtc9H
zYK^xod@(71l+QI{^4FhdBs6)aMI>uv%O3Jkre-}HsJ63HjbM1AhU15lS<0CpltsGM
z_cMYd{}aHqpL_Oc&o1zGu00NQ{eobSf0&QW2VAZHggd_VGjpnRiHrPp%_Ja9f@Nkf
zjI`sGa(=Y|3y_OvpiD<PO=S}=WKPE3cDcrC&RYHW@ZI@yGyQBsWR_U1xM_PQh3#-?
zr|kiT<9cNHmeuBmkNGE2<8;lxx3?^wcwbAoSb-3K@S{fIp{7TP<hXLLkq>=K_4?jo
zu*qzhRn2?Z-suxhxj>@o9%ImB0YfBfHPXp!*u|8?P$}ZlMWAF1?3M5=20G@bjlnys
zw%Sl!#N;O%?d=5Tcypc<njYI7lluC^1K7M)zO7ICP~?|j<Vsw-^LW|fIhBKhgLRgD
z5veXYE<y6>o&fJC=73p8CyUJNwfUB2>a4)_<~1g?0yWP7?Ch!#<ljM<sPTOoiwkay
zjDDN5_T;+9{CY57E`4KzjxL=wPpV5-hs2#3evg>p+?nI%g6O*%Dy2w+Ax@8@qoZs=
zLE|oWry+>x3J^9d7#pLAJTU5&(u+VT*$K>cmLkMS{*PqWytDa|{(&}7{6+q{<Z!9n
zZshBHn+F@Zrush-4k4X&9Sg4)UWs=J;2`0z<ySQ+nDC`54?L+Kdy&nHg0B5Gc9}dg
z;XUp(rKS(!ui8b`c<t|fd;hy*CRxCci#9Bca3{yiUm?|tY9Y(drupgS>bVG2zZ?>Z
zd~L_K69}kDXpgF3zAOe~^9tP9rz$N!j#o2!S0y?9(adZQv5pnN^Ls>0c0sl(f_B>9
zYT>|ONUjcmtBRxPV+tEsh-77EAJ46aukifkS{pw1u7Pr#)uzrlO#eqeM2@d0Cb<A5
zf*7N4L=PF(Cm2OJMC;&!`Oc0Ft-8Rlld+po@C$4QBjwtx5G>Nt`gVpWlNdMLdPSAl
z-xyz<mPd_kxvtXZ9En$_{x}%5Wv2ZG5bbywG<)fjapmfbbEeHecI8>fFT1y&P#r0w
zv)!G@pNuM8=3I=7;>uD*7VF{kH*L%_(^7U_YzxZ1s$QxrSJ!?vD){o(t6$N*qk{9B
z#Wk4jjAQ{dWuG$zXgU>mz08O>N{u1MRM~3IWt!FJdhnWESzq1|=r;)H)R`f&Y6SoS
zFy_bjMEdrS4OW(i)^LJa!t#g6UOCY$!xTFJKf00C9Bg-U?rf}*XsSWD3KvhRT1DOW
zO;rI;vu1K{x&qInb{>hulq|rSy7eNI4_j*>b44{-FeEk<^T5&$X*FkT?8D5BkiaN!
zbef2{@+zf)7~bDD^JgFG33vW~xqx&pDtk`gfgQ1>R3i*1x<NOmFCjw-$cAw|*pmK?
zw<u@ksNrFMfh@Gg-EOu_i}7_7Ug`-EvT~MqzjwOrZ9nX?`jf)L^ymCS+!ph~Yc%7p
zkkpaq)YNt_J$8ndwh+A`OgA?FCH25--xFG{D9X6Wh3hj{Rgq``V=g;Ju6|{%1k)?~
zU}~?wRFcS09_=9T^*#DAk~aW)&LFAcXP^{8bFmTTWRD7u>A}F~tJ=ZjSXkK&U8vqP
zO7ud*C-XZB^inq9D-NpMv#O5ui2AL_6!FqqsQ(%`l-EoendNIa^Dv=S#V>7Lis_FS
z?iy6VQp_Oz<^__>wUBO&#=~Op?8N=VSsFe4D~`Ozj^utPl~ZDk)cz!p=_@71u)+nQ
zgyrV^rve82pe`Y<GQ4Q1M&+6VE{KFGjxlOcp2dWtL$lB(zhO9KvN~g<=2>IK{1>I(
zbZ||f#>>3esI@wGrTG^PbS8IXMYGVKK5Vq|oMT?}u31{!v`dDJ?JG$<z%6u^+Xq}@
z7c|Jf#8W$U`(#BhHN3tFD)=Y#f(mifTUd$}s=Pwrl!*o}Sdn=h=Ys2BE!C;$BdMm%
zhkat#Y4j$s(klDmJG^vo(+DqGBFxm?QDN=VgbH4yMQeym_F!1^Ejz(WqCa-D_|5SI
zLf*QpF=XF7QpLO7-4$?j&L)9pH`=4h_q@=iP}sCP#}XtiBN_a>6xURy?WanhL7CON
zY&9yq3V)6XfYs0~6psbyN-}wiLKxoAUp(4(4kg~&BfScsCPu~uv|NgPx}cAB+q(kF
z9~9C1DmO)g77ik+0a(N`i`yEtN%JTsH2XT40kgN8iOT|<NJW6tLw}RYh+}>gJlsdu
z%}hB^nCPPNtb5j%1dD7Llhl-b7}pz6#E3DWr<QaKyxxg}N#rUMdqwWW=sdE0TD_zu
zG;eiBPp^RXUf>n{;9`;-yywNZmI(WUAnitv=VtqH)vcZ2ufnCFBBd#4$|?Es#&sb(
z3_wU4k1-g|oO^fIi)uR&{9OGi$6Eo-D$k0L4rfGmwv&$wH{Hp7A+8B`SFOu`Le-k+
zll9kfMX_1}T~;c%a>teZn!D(<OO>XoomrT`|CAWdeE--`ekCBr8P_ubdl5W}Tbz9H
zRrBG;5RfJ$s^tKDMUDJB<aH3`_FZIcx74@AEVM8@uxB4484U_cn(0n9<M7jqEbI1G
zm9B}RNyc%vxvRW#A2D7N=vl&p%dN}%)2n)*jvXH$x{q>AyW?~x6KSWmG#qCzYI*u=
zHZ9poo2<-w{ah>{P(1__vZ6KCQgN|WAmdxi<B<4c#&_!a$a2n2Iy(61jgx*DOJX17
z!i^QMdmrD6d2#?kJA*fizU$StaP0LxY4nL^^%++s&f2?ttZBaBhdu!IUthamE@5Rp
z_yT(8k<V92j(}xr|EaU;H8=S9>tSjOhj<UM#_><q@CRygceo5{T$E;9#B2gE`if1N
zWsWf9p0gzHEJjn%SOuS-m;``QyEu#q=g~D}-3v3Dc5VwCw^gh30o<#`y*_)K)P;kQ
z(u>f0>)EH@Q693@8xZKmca2`jLaQPpiE13bTqA%vmG1@eIZh3;UzH5sIl;@tYV<vr
z(AKL&gxaN|=@ip*UrQg_-yoZLYt$asPCwlaXek~?N1$coIhkzP<ONt6Q(PngeN{mx
z3GD7I;kX=~N~U^3=0OdDD3A-+jT)%LI)(v2!6i<z@DLz~CL8XIk2}sxeewD=U8YYv
z+WNQb%tJFMKK0D1t-6&4g;xg(FgZ6`u0Zkd`!NXUZRg&7=@lw2ByQ%OpLQMAX%gzH
zv7k#A2LQr<wx<4e_l0`AU#OBRIp_1*n??$jTMct{qWDIDEl?)vEXI&Ju^JkXikRfl
zhu0k+`e6Vg{J+3Wa{6fJOrDcZ?@~?=+p-p&1|^-797{fI#>_1E_9|gzz9~5c9>DmY
ztT#^|()L>{90V(v^2etczsPry<74tFk^sQHUI~B*NCCw!wQC0EYTWtEkjf><pmzk|
z!4);suyzbuVQM2(sL%57RqmlDO)hALu2#{^qNx|FVM?16{T^T{G!aJdGT82)m76nn
zi%C$`+eY|4{Ge#*0S4{>&h_=A_y|8^pN}bLjx%29vXZ`1k|dWdF&(BZUQ;3gO3KAv
zkq^2Jl|@N+9nq_(UAp{vzHMCT=`<i(8asTa8S~;ze0pQ)!nB)%8A|D@on7Xb5e#?F
z#HS`tnH!)HCIPrF?;U?==eIM04@xMd(^B8nE&P@NU_33m6^e19j=jtWkOzCei>Z7^
z<SxBKb?8r$9*0SF`Ktu7-v%(fSKlP8z9w9ssBerRGG3aOuT<`O_fsKX|E94aO(P(s
zS9B<itq=KPKD4vCwu$|EHM3Td3*I<c(I8mXB3@4m`em@SL#UEt@_pGEd$okH_~TRC
z`Jp*ZaxdjhH!O4#(rF6~YT{mNU!(Vh-=9^Lue7ez33>@PmH~(j-xMrR^E)sL(|M+0
z1^mOlSY(l+mj{L2N4%o#oZfptYsF)|E4A*AO0x1hqr^C0_<Kmz6|0IXk^ssNq`hqx
zFq!MGD5O6k@g0a(mKIr!;Wh?J+ZPzE<@XGsmMARM9-JP`P;5oK=Lesi{i`Fm?9=_H
zIvkm0S=?>>8GIe_Uth?mGQ)DR*Sr*9uECfOtb3YpEXvj0QgD&g0u=$y^c(w#Y2OC0
z-rB3li>P7i05Z_bHtMhXkUv8}yxIFQpc%7_lGzm8>jH4Alna<Bv2uM}q-Ollesd&r
z3;^x^$tfZ$_~huP_ARY&pv!KtCL=Gk0?w?WE_l}{z4{Yh5Vvkz$Fps$o!apjcT5no
zLY|dWb8PYW>T>{`eMxpzz0sXG{nNpR0RG?IqZ)0iqtOw&F{aPNUQ%1!fNGV0N_Sdf
z3m;JGJt1$_aO^=WZp0q_x8Eb<81hyNaDh{(-)upRmFI7$62#-*LdtHPO-A}@gat0L
zn-27NJ3jHp_r#bu!eWbd-#q3ck!;_w2H6b9^~7EOu!D<S`eJYkK)DM$J>Cj|69Ye-
z0~^EdZ^lo8IU?S>&dd*bnm*en=U(G!-!xD(BxczmTBe0FIFjlnr!u&Z#+Pr2AG?*9
zm>gIBS^}sP@M5b89_GV=fdnMcQWjty3gcu;G-|*;#{1b(pS2ldnfy4;cLnZpMsVrg
z%hzB<wFIgv#InIW(;6@#+t0*LYRC3m9(vYY(DkeiCW5GA8xfIPA_DhJDh?WeQF>ak
zn{b3!=cu`aFA*(`%A6HUP-=Yqr9<QU6v@jvX7rwo+FJry-+^(+jtdSSF}P8km~{3G
zfP(j1yJ%(|bZplWEt5NN$}7<=xSitWm4j?lZ&_vBc>WXN8hS7->tD^$jq1dWjb(VB
zv$UfHsh_VDohyC0&N*?)UK7<+dYDSPkv1>za+A4;QoL_j8q6?PM>tFlj}8k{;vx#+
zKwp$9t$AgmT-eO8lO<>Pts&W|FIfLeD;XEo>Lce!a3c}qejpE{SfSQO{@jci_Jud0
zrSXyki$o*7H(h)S-n;6wparNCk^{e=AknXJ6C#Wl(MnYB6!DSSKmA5a2ftc+xepUQ
z{RyRW{Pw2_)Q9Q|@2&P{*pniksN6F4A!@!p>*#QN%qRd-cSDXnu#Jy@QEPuv16u0n
z#XXQkzXz)`$FJTiM3;bBa&C!ZZ$Qcp!Pt?_SW&2R|NXlk7jO0BtXvlk?$C@L(49%L
zN3FIv%^Tbx8&>qRtNh|j#wn6TM&CRLRIewbjOuh7>13i4(AW{agR4_J>HH*;Zzq_9
zPDz<?HKqkUcW#(T9orB7+TM)mP_80r0sz`ybji3xJCjf0tIKc+f$?g8YQ$l!Nr|nV
z+_Uu1BHr2Xo*go)kboW#Lv0qwz|+pFmlGb3KSgokFHTlhvnJzyYWN-kub%a+?8>ag
zh1v<MfrF(V$T5@oD6Kazf3OLQA{si}HXr#E1a`8-$h4qH&JiV&5ASg4_LMmftq70+
z90=ql10efv`g4_@cGI_q`Dvcsxfj>q|C{v0!nc*AZju8lM|zGEU+4pPlO*<Cdr2Q^
zlEl8x{#iMt&p`;j#_@LAvwJK3FP12qd&;<<hR|W}*%KpPcn}>POKHjW`N+0^__&?g
z3GR2J0Zk<UZu*Os_If?S=_V)MkZ7X64HUXlc0&_LE(qNV`ETv@*78|Hza?!Tjp4dw
z9Yl2#S?n$cMY3T%NtlTa;N5hc1*}btgoQp@e08*G6n(rr7P6fVeku%@V=+-AHJry|
zQ!44A%KU4HX`%^XmrlINX15mn_4Jy13&ux#MenkxE4B-V!{z6nBhvkiCiYwaw~Z3~
zI+z_yjb=hG-|X5oCIk3@2>GPe109RwvF{&=jCwOc=?8jL=greqH>YVi=hp^=S6V8?
zIX-gdU#i>Mn>!SF!*Dy>+koSpf~_>batPpO{E0v*fz_R5i1m}!>5S4yb(sSbI>A`E
z^|H7_n_RHd<O?b8N%aR9lRj)bq|!RopvH?csQe75>n;!-%a(b1-doNZ1e~@n{HMVl
z2PnzOE<V^UF)zKHu!;IlVsiQFJo{ZsY3{$|oJa9r>-<P4d4(fVCz$r;UpmI79LZ-q
zeYog9XhN5Z9D2s3ngLX8ZUWto>S>j4Yon~E&a^2?0)6)UOG(fvo`~_IV+ZM7vV*S0
zE5>G#+~an|=H&+ZZTqO7B+7eur~sj8zqF-g(Mp;t8(7i&>1<FT$gRczCwSn1_ReN<
z-k-0H5zktu4Og-OnBtPpS<OT}mL`9o01BGQ`^?^irCbffjCL-`a!ljx!E;Z)_-X}N
zw8@%^%bI)}A5rBbYqMt!(LPPCg`^sY3A~J*1%Vz<fpfSSl<fyv;!aa#Ih1`W#WJGe
zuhqPb79Nb+hWWyuJQs#1{m^?D=WnM_0tBlQ4J{#?;nRGkf>#^5KMQ`U_BZZUh%oRt
z7YvxhKZP=GyP4#)zW3}huv&#>Rh5iWIlLpKbr&&rghWek3G+UD;=Oz^NvLVxByw6N
z6!>n{k;oZ;%O^)^rEQ-*;BI#f<fxCIo&n}sh}&gM@O*%qt#V2<gva9>RTl8bkiR~p
z2l!i2v^<K3sBF*&VTJ<MJ@|_TLD6(b3u{-QuSZ0RXVv2N#7Yn83CN9VcZSck5My8_
zsvbQ4W!T($QAgV~{eS;65s(*w|3m5m+JB=sKvQn-%q^(>uqO=wA|D5|_>hHwd|UJH
z0)VcWM2w16k%&J@8HInjf)dU|vja4-c)xNmx#E#Dp7Hm5{W*pyU7*&kDL1+G|8fDK
zFb&6peK$GwUyIP<cw!?)Y6QT80JOH&Hq7H+g}0uV!ouk3;Fk^5g0d*%$u0=NCCld!
z2GGxP?UHGg$$_z2_4lS)uJHi@vQ>cS*jdW$d`vFdU6~8@-i!&YYrGh|ZuSvKvx8Mq
z?ZFJn2FHJwprrY4QTN;K^5t6Wn)&$kHx=mH0G;7~cJ(_@t$jCeldHbd#I6Pa%xLNt
z{UvT)F2kuT7YhosU$!OG{NUBD>5y52UQqr3PE|RnAv6(7nygWXrEk#}v|#zhBjgTF
z@^AKG!SW;o!+CK_0bv%<0KU#}OHM@53scy7eliCkGU_5UA}?{{it>GUq5RQv4W4AM
zXt^r&i9)tlAUN`#B)tGAGPTy<c;p_<^tYYCK7UC8_>+K?cKG6pe1}<9&0t?h@%<|(
zIpr}^Hveb~zo`m5McQri3>{p_Rt?XRraDhFRT9VQZ_p(JpV#@iprf9%`m_7mm1Um{
ztc2f$-I%MqrJa&fi+CIcaf-e;()m(yTf{_r`yQ`^KjgDJ6FO}9agWpl=Oh)coksmN
z6)*%!2J0OM^!~+0jY;~d3Ozp6gEpYTjTtKKl(EPd?JTwy7CvPVz|jZFkmZhdFJPwV
zhrG;q>~iV-8{OMW6`Kx|Uxc<S#z^F%d4!b8It&9FVV1G37B-z>i8uVk3a2kLpPxD$
z9s{cLXE4EXsR)L5=a{>1*&#qH_NqGNvc8>}?e|4k8hwRMF7jp5*{N*Pl{b?MEa|MJ
zT$G#y-0ux#zX$gCw!9y}hR_rR=5!%}YxE#qJIQfh=0yv;mKuEw9|;W*o{f=DY7l6d
zx|Bj!h01R`AKrn0yV7|lOHYZH0Fy1;9X@CNf(52$IfFan0ZnMi2nX}CFiHzlG%~gF
z7LlBC*gDX5y-ryI-`{Zs%`mHTPS8H*JDGf1PTw`15THFh&U;~+Po!6dYXpdRs4|&l
zW_&!|pF*>#BvfnjG)6z$<K}K{lDnTlksRY0n$c%JOC~o|+CI&e7IY(O>wV|l+ge|L
zfW$N0U6&3qhDNB-!TnhktIt=y`o??Vt<Vg^9_~(D?8wZUPuV6MfRIfi*C!z4pZD<3
z;_%>OPB+xI0$h!~!b3?1jb}$6@eSiBcf7n_8uJJECHdxOHtND`>2BGOkdpEGh#sr%
z+y-AA`EACZybfd1jNI++us28IbXh*r8*NvA&pvAeCjnF)eYg|G=$5mHr}-M~d6_oV
zu0XL7rGXCEjmP`cWNhcxAbXV$TTSJQtRcHK$KD-8%@LZUdY3v^Wcv@@D<$JkA1nG(
zi3k%2wu2ADI<j<NrNI2-@+oY6G`Hq5a#$$`V1JRT*{CO#SHC^13>RE^-`$O!PfoMB
zpmFj%0sWRQqIO|;l%+Dq4^pIWV<bLZy_W{3d1?%E+;BF`T8Fh~KLc0dNTuh<f%Sx<
zo$Ba&W#WoovUE;iX~FZHK(-UWfo<{x)nEv`@EqN-vZ<|@G+mJ??pnx?g9A9o-=d~z
zzSNo6?V_-@)Lo6#))gJM{_Rm{F?Y1}OVnh(%tihAk|`yvm=!WP7%Z?z)-4*Z-~eDR
zW($#yaHss~$n5Fv8@Wz$^WgG!NUYk!dsdv}jM-Yf(`i)=kx7?h;-y+!2A$U{m-H4f
zG<ps^^$EF6Q_0|Y7_^s7zRmp>i+`~G(EOnHXam7rp$*dg=}vuf@IkNio};o@Aaf8u
zpr&|GaEFtCy8<ZzoIAMdZf!}e{n88%wp|7LIO<)0gBy0mW1Rm}zmkwvo$P6v60A(r
zUFEr?9RS6M{oU1jyML_YR@LY)1^}V#FUgnVWgwxqSLZqS@SMZlr`adF1mSz5j5vw8
zO4s>zeT=q6cfM26NRq+g4x8I(0^#=ekC9dSyl#|<5LRKJ--6XGWwin&;wU9!)nONB
z#!4Y6b?CEZD`isXPHjT3Ku6$8oe6#S7)Ce0`QVQWm{kh4*`p^qby?{-sG5GL+Dh@H
zce#Aa#*kjDsYeT|EaWggV_oLqWI;)Tl<t0B89<L2jus@ih0ICU!T14GgDd2gjB%SS
zf;m%}&TgT6C+}^*b{gf<6@Gz1(Ti=t(##v-kt0L~UppQm!;P*K2c~3o^*6t{9)O;o
zJ(Fcj+Z_4C*|Fnt+;m5qt~#`2?w9{<2c#RZ$VqbCTSf5wBJE<ZF7TqEW@wRv>N8v0
zOk>rnwoTH+|Iq5OCx6CQ7iCsV?t}!IoMkXV7HpP<3({^@4h`v>zZh546Ec#}zv73p
z`bof1R<p=Mg`}s}KS#f^AEhqybAV^3D0GBy$#9_h!b<(GHwsMq^Er-&3@tTpwY6>5
zCH9*+98^sAkC)0QjCtGg8H$+~Pu-;H4e|0);t4b?R|mcSFkKB{YL2|rAaD!7z`~Cj
zc-&u$43;Iy{rH($UvPC@)};1p?AFrf+ZXLLeb7+ZZ44VbkX^rNY)nC6<LqRXHbd6I
zEw!kv0*9t(KK9I^YRPdk|0%XVv?=*a30KZ^Ayv4T=w2dPrg~OTRp5bF_4eHie44ic
zaZ-F|iQZV20)hFb-jW73XY6s?z!F*1-WlAUH^z6qbX2nWc8G?`mGO_8wYExGch|l2
zJ`Rh4G_Qf0S*v}{5L8qI#;BQFRyCiqn}hjCr9t+{Hpg-1+F1uA1Y(M(ITCu<F{#$M
zmU`LJuZVR0U2nx579b*FH$Hb%kDcI&qE3~(vsD+TPf0a!z8E2!S!^}!%u{<!hAaQv
zWcBAf5~x>{i+xI}P~O(SVNUIL8QuWt-k}wjZ;vayh`kZzEFbY*lo<Bv*Kz%)Cd!|9
zfyq3QJ5c2_jl5!m`rd5yq|aHk29UJDT2c2j=0h|cCpWp+#`FC_tE@{#0)m1s`e8}!
z879e*W9wLVeVLEt_tirNC)4+UXGc59%W8)D4@#cp8GCW9rw6;;`uJ{DuHPo+D-gaX
z=!c3(+tZK!=)14Dyl~ONTdnZgGrdJQXIp%}p8DPOiE1eVASfnWL`%Z}ddJH?7CG%5
zJ5X(FCd(%z&>K2vOLT|D<u6*Ias*#OG7TV*bc1lEsZU?MFF5ym=omuxKtLgXRz)YD
zgo-exssVK^zI9*C=|cUI{r<mTM)486K5Ot@sx1~{j}xu#X4RXV8q*P3F?;xl-dL5(
zRln_-boU<va73I<oaH+NwW1kCkelwS<stg^{P~*gnj(a}$l?zG)l4rETC?&<f49hM
znVFh8g${@((eA8ihO{%bnw5y6WtH8@4M$_j&(RdFV%-#m5ue?dtCwj(e$@bSniP4B
zsyOPcFWVA$^5Ra8KE({B#)7(zLlA@OVBrdH#u3uy-b$k51Wr~9O15*bSpZG8T8_1^
z>!e-EAz4rN8MSsb=y6+P`8zpEjr@Qg5F7*b-HnFM7V3a;t>qZaEiW%fr3E!sX`NgR
zU9y5*e#6ga_XBjB&Q4fBfGJ&^6(lSpYKgWPOuDeZ>nO{o+RKi9eeW~!&2?as@6;2T
zy*R9SAsOZcoOvU9wqNG@?ngLEua$jRJO}78q}}pRZLwom6DoT7>v7cNhxd;TaD7VQ
zTp_zU3`68`bb-c`MgsCo*1^GaUqN$lL4Zz-rH#XZujb_`es7&{X}eea-Nt{0Y(ZO7
zTLv}X^iHeqb&u2hr^g8qFuP&*MUlBi_fA3pACE+xOqU%Zz~{u!9RcxC<10X;q1y(-
z9QxIg(so?<Q<=OmlT#l*HshKYcu5#(l<s>I@v>&b@13=kcf&hd{@MVx<TkKxk;TgJ
zWIh9*EQr;ZK?DjMnh_;hTM_#SfohFLFLZuggcsUDu+t{(O=6`Q;7Z?@YkxXQwU&(-
zK{?{cLD=yOG{ajm<^<(57v(q&X_G1QL||%iO&}5GH5goT>kosO*1`~hW*%uA4IpG2
z@pfcz(3N~S1i)(BQ5~7kRoID-I7`R-h4T08ub%4ZmRS1P$1Yg<EmkZ|dzqj*^5oc!
z#s`f&ca0Wjw>N#;9)?zzkK<|evJA?+ct|aikU~0r*b$B3Y5TgK5?6*pkJW4xzNNv|
z7tS2i5{P&cNx2b}2+-c!F8x-b-px4U0iIK`%ge6%!9#S{P<ES*B(0VaH$xZAJ`%6C
z-uW_33DGn)pL|`GT|B`vVcp<wDshk5s_y2_=9seD%LmQ}S0i?x$1^t2=fCR=%~ZWU
za!=Xd0+6_69U_-!8pmqf_;My+o;h`R$V;ivd?VbWGRoxP)c*Jr!?pL#(nQ5Bk7CNN
z%Du0Q>D7h#12Kt`$zT+y-R@EWw#JMvgLtS`uZnNs>wizbcn@8MbaTk&j*)1iR4&SD
zR#H2^1o=SWDaGfyF+pQYLMD9hCsGU6gK8&%2nnz9Y1fT~XeZv8z{mS_HbbV*oysi<
z(KX6U(eGwUwBxjmCqKs2hJA4VQwSzY?VYXIxK)_$05%;I_ud`wf)r8EnW<me==2o-
zD|oY5V1|qjmWFFx=)Rns*k)}sdhKd|E=|(yq8yLbEPm3NJDPBkB;Hq&-evtNr^(?+
zQ!m-c3o@cyi90*-ADU_!)hX?BT`22i*N-4=Y+3scv7w5$*t3t~lIY29WVtOR9~8%0
zV&^MEWlTGoMVHJCk!dChRkti|8-M;R8F!R5;Ehw3{z0fWnO};MLoHu1&CgG0{$Z9#
z!!Hku))Uy{t@w1S5TfxDrNWsj*P9>_#CUYYyd+McWXyN-pg78NW631-jJQW@FHW_j
z70AIXg-Aa@2>)U7;H>#Mxpu?+MIpy~!8RU}>$SVW5~nJ*?l9t{GC;|Zj7o6e#~jlS
zFqM1C^nzt9fs}HOp4_XuN!3C(1^AB;#8XVJlGUp+!KvHxlPy`0gmsq8mdzf64sTih
z^f&$eFRn>%636tU9hm4og3zVMwAM2HfFId+dv0w!aQxwc3DPa~#kF4F=IG)pH@p1s
z%4q|I5haY`-*L6m3wJ-v*Y@1>3j)$Sg^+LOfsC~r5A(>{pF4U<fbHeTSwAFj6a(Z2
z`LSGZ+^r)cZwuc*+xC6Ey~ajFF;h&O3tMW3f&Lgj!or8#y(y>QT%DyHmiDmlLQ%b~
zS+wgVOMi)q$y-ixTxLB_PEFUu^Uc(SCpIFsA~U0?m#m)-%Y!GKfi)McN>p|gF}P2>
z4xnE;Tq=^mw4k5<{yXAu2V~;u8LHZdw^;cVnGx6Qti9SVs|XWixe`a%Ve(Ju$SIqm
z37#2~r+l^fdH?`mI3{8$<*$Faz(V~_taG9Y?O(807e1T%g8H6Vv^-yeGUvlre#K6j
z!U;XK$nG1MA`;i)qL*4ykDtf6907wNAP@A@KXONWYy0ZdumN%wf|cTq68vKa)e`!S
zE?)_5H<N|10~zoCohjHeGIyX{9@)^?nHpJa-W;bQh`EdU`Qz%H!!U~tWRX3?@o?b=
zOmpwoy;PWqHlBMkOdZIe5Rh%>J8#q5ZDvKSwaEmjNaXqf&|lYP3^bsrG^z~u%6q8#
z*!ndnuDzxst2G`@>YaSjY_&isD%kbPXjO2WEogR!jnuAsUDbw&SKR`#CnfY}W|C_*
z_pKg3X-khy{(uBnS}cx}-w)k8-o$N~#CB}wGOoApJ9M}v6)hvxaylY8CD0{N2o*uR
zAydQ{$h|S6BkNhE-8{2aGbTn6iz1{VdfyMjD_}VHI|{r0O^P|!ezd1|YUZ*q)UDQR
zTEXsr^|rZXy4t1>DdmOSUngYiY720#b$DIkC)L#=t*id1cE+i@FV*A^ixREzg>X%D
zZ9Zf<i7xE?DaPX?0f$g4Z|N%^wa2vtX87jZ904g{$Nct2?hKeg-Ygo&SL4IHHvpiV
zf&iv&)?WPG+<NJGDX&Z;@mmsA>%j-}{1^ske%O=K>~FQmEehd$Q<BLdYl?u@olibu
zB;RXRlC)v>rNwc#M-{@O?QuU%l&CD9BE{E+JF=qeJS)q9kaxHPLR{|SO~ze)={*$Y
zV%@N}SYc!7M|N4hl4;b;$yNUysZgTG(-PfQw*eI_Ha2Z<(cr`?CwDyaHE+O+3+I?|
zE&J2`d&>jhEhko}p8oLb(!<rgM$pm7wbtA_EUWtyrcIG*Z$vUo4Y#ax*VbZ8&H!ko
zNDoCm<{tOQkqoX7$q{iF@zEj8A9)7>Jd5CM&{Jpp>{#je|DM>=U~}=e){oHvBh8EE
zXO6b|&L!i%z9OjW?aJ|y_<8P6mhsYw2`~es1w_3IkFhaVq@UARb@ryBI!^|%Rypzj
z6xIz`;qCvdaM3y6x*@#x%TFf}HL00fbnr_CN_#RbRmKwfy&w0OrMj#hZ$4>1s(60a
zOp=p*tfqQ5RNwA(oNoE#I<qSOCfy}2x@mtp!_!o8)-9pu6oaxyN-Hjsd(Yn(E995j
zfBKX5-4{Bm`ff5pS+KrEu=0JXf%@c4@bA>a^MCO5mRGfXB~>z|G)6d7RRH9em<CtT
zxM!y?vS2+%j<4~e*!^+p-l2hR`r$}BP=n+(&VJ#~B(DP~Hf3!2lDU2Oaf^KSnNfh5
z>)xk~;NNCd0djf^Lsta^FvhsyJ4!5%)SvAKrPkU*nh@rD_TX%0>HIuNOM4{<<EI07
z-ABG`;-<kQXr$A7$p7&}$R>GP5CLW>y@mPbY=RUDZu#tpcfR9WdC-gj2bsguZ95OY
zy%-7<nVWhk;+o{Z2QjTlT}EPzvp;+1XRgM!>wTSS&ipiR>A@KU4U5@owUNFor+>q0
z)$_ZLdU#x~UL9<K(EDfrgnB&nm{<P%y_~mRc^_O#Pk5AE&pnqd%kr%P_r1y^Sq&vQ
z^iqk=IWwsmo}l<N52hj3z#1iPrA!XujoR(rTK~)z8D=S-cW=U65cprbc}7US>~k3f
zlH&-b;EhF%cp{UBxCvSwY7E8mQtZp_1F2YH)T1P;TV($=17kY|(1m0(bOf*!E6JP4
z^1KkMn7OYTAX+l20(X<de^#>o{*E!x&x=1*SfUXeilqEFtZ8a!F)@(HY!OQIC&oEY
z-t4@7$QT>YaEjq7l{BlpC046<3ln9h$3B(XApmc9(^51UW9yLlt8yAyYxlcOg-@mZ
z%$*<TP*7NobeTe|Oo1{S@SzUTKlTAm{*gCO7AZgaAjY5oXjM`05#B8pj#fs!8Uhs`
zaOaj))*3R@ART9^pZEHZ_bKWld}R3shl7+8POAd{U|Y!uDpH-^5Q^WmC__5e-E*?#
z!8fD@1hnA?50lJ`vuiS4Xa%3YwUt^6X1@wh)tELD%uwXuDOGjOO5&N>gO~Urrr7m9
z?qqNzosDgQulw;QQTTSI{`SY`F2iLce~anA*c_LXdWA*Kyv;;-wmFw)11PSh$Bd}`
zdUe>l@uKeD2d<eYV*{9>+5;Irwi<V;r}`Srrl=2FP+?SVV6}Id!Ge)$S<9~{^pEV=
zv1C#7N2NU*bK<5EXi#6W^UZw(^|O<Rs;ydKx_1U*!1iTn5eu;UpAyNbHXbNnRph9C
zAnBkKbMj8kV>UYnn%QD!G>d?@ffEBKw%Gn-pOHgyWy`K5W?mCtiUR#|oy{lT20o3?
zz)pU&8N)&c_-22ogIPm3t5v?)BSpTKp^i@gvB^zkeIDQGQa#7$!G-{|1n=B08`ayb
z0$Ke2d{nt)vwTYx92=5utzo(})k|F*RHQE{>vI`<ST|?tL9}YgtFYjQ^&HWgaIi40
zyU2a4Sf{JzRd+iR2C2Hy@<(DW+rIqVd?dbxnfD#~^wO926vxQr+o_k_l^3Y5!4F?d
z7ke#>xv<=u%(>7d_^8y4nz)hio5bW9{FpcE+yGtGh|&osXh&bNeDb6YcG`9HC}sIr
zXp>`fZ7A5<-0yqkHq&RTqET^u4S;|l2Be1DCBJcD?*X-oFg7E?;m*&OKd(LDDBrv(
z2JDCn#(7zcRVxo-XtFJQYiyHRQujS&XhZ)=t|d(vNIqaHBrVAb1KaQmEbA<Q%L{(o
z1plfXz(X{kkr6Ivwtn>-|4-tn+JSQnN?3`{zh;k2F|xaNmo^f-$>Lxj3k|ICa{o_Y
z<_v*{nKYEd!%8Yue$V)~AOzIv?)lEWQ7i&($%4#Hr5b04R88^pDg<Ua@VDek*%jC8
z>D8I>DY^1XWFNBp6He{o7DuYG@sgB)8h^~|)wjLvvYGAvWj$3*4S||}7T1@>&Tva+
zUMmnCuYI{!D(SscI{8ngPVctug>C0D9BA#(j3_8mq|ADCM@gUa42{@xBPW7zCt6On
zrMYE#+GQ<1M-{!SQc&KJa@|Bz$WT1HiYUGokD;Uy(T%9FH}AJeW+s+CzDf{)C<OF@
z7qdR0K(Ucr_cws0C0DX4wm$Zo1@Qd2X7jc+ti$}bja8C)9OpjmppD=@J>d8sp=Ms%
z&AavJO@{g0I}QJ9oJJMNA8#`@m8u3!Q!yg+3POvn{i@xgP}^sIMGdXyA^_GG5NCms
zSX`Q0t&nEpEXw-1{4WK9@@&MxozKEm(pR%Uy8mm?hNC44l_qHpDB*k*TT)=^=oi3m
z_li+2=aWxJ)2vyhv`J_GD!qZw*m?ro6g_d_ik$nj&D)Nluwc=bUrP+*JMz2ZwC-#3
zzMj=rrGz@M1e|2}vZlg7{{K`7K>{RuWURDJGe*tgp-df{oFLdmvz+wej}MuQp2tJe
zx~ATT-#3EskN^$*f5U7mhCQFKPyYSxd(ZpYxssA)_~mlsM0!_-p~Y|SBL@z)fFUue
z9i)in|7zv^o<Kt-%C9eLo?4U88E|g6pEQ6BFV1(c0VkGzKKqP+Mo_+}Mobq({@3I8
zK|dT8i5ATmTS={_v#&hn!%U-BE4pBw%mHj|cEl-85m3uN>wSBeX21BnHa}BD^YQIa
zAPCY3XdTLH_~AizudPuf*+OWO07MpGnYb4D=HQ=-Hzg+!ArDuK%+?mzIRe<SJ$!*S
zCIPaPz$FQ<QxQ%?A+fgUj;z1GUitUy!0aF3*LtxwAPoIyv46)3C*|H%xnsX*)=>fs
zo}rk$yS6O-+M&Zu|DnYMv3J0MH#r_gHLM^(fQ}0QLs)pmj<Q~a?FQeEo$u{rX%3b~
znn`BWRP!)rTw8N(>4^B8C!K!eEzud|wo%yl@`VQ4X+~3UM(}*!tG_*H_$S>KBb@6S
zdH(fG{HH^K`EG=X&|$Jg2_5`#IeS1*RRZs+?PAM((G)<d18y^uB6NxY;3pOKe*%D=
zt!5@~i%4l$!};`H9EqgDKSOe|lO0DFN2jV_Jm``X{%6eU88afa9yYUuD4u-4>wrAG
z{=>j^<ZGs1r%&Hcr}9F8U{>^NL~RXBR5+st)ZPGCUJUbkM}o23v&M_fJ7nJ+)mO{`
z<D=f><(pAq8x9%pvs&4Pkn*jX#WSv|SBzkP-xdAO5q&!Y%>m5KH|Byx6jzN+p0Yl>
zf+{v1zBd2*rfQ<~QZ1I2{8+l7@Y;?zsO#K6^~OGIwyWIS9|RH8j5;t?a++P?hnydM
zvwzcgx3%?p!%M|>CxsxD0_DFiVgIK&9ri#lA9Db~R^nc*vp|EG>j`%TM1w|e8aD^e
zt!K5C&q<f6UWz^kd<UC!`9Noq-r5SdmGW=d%VW>g!M<D?)K$I=9D-*l*-(%nbKH!v
zxrqOJ4s9fm%?B<nf0N-W+3q>DoFa~l6jd3NHE}al;;X=s5+c54%$zT~=SvpuyJyA#
zI-gpD0p`~i+uQFy^jFT-U-FRxjFk`WogjbYmm6%#ZkC(gc}=jj4RnS|)Hm<^>M#m`
z26?|1AAVyD+T;Tu6d+Jz`3lWodtFykFa%#;=X_1GM19PeR(1{mw)OZTRkKVco?HtK
zg&q%v?ySGP=L>ot_iy&H&)H_QV)z6t*c2}RD!k8n0IuA2ZWn2P>ZW@ulhXE@eC52>
zYg;IMU^4He^96h_*y9q<j79m{lPXeci&p?tV(cYP5S=*CXOVw>UhCo-`}jBC!+54M
zg*Nv~IicOT)eXRKcg_4|^_f>JJq_tm{jbA&FfZ`eJ)?w>i*;DF(XZ~%ASU1;|5pPw
zrAxVh;w(6$(3f!5gF_*+vnSZ8*REG3BHh3>U^rK;0X7o}9scACnlk*?iJYlvGqw8-
zP+As)KwZnX$&!AP=XuxlMs&2!&9s)c{%H>82onDLc;UZo)XR<1D4;YxVD=DMz7)0N
zRr?{#)UwZ@tbPQjni?k}p;`%YV}f@&vH)Gze~;IhHR>~FS?@4YnOJK3QlVnGE!K8`
za5~aaDI;-?fu7s_b0EEK8&a_HGM0cM%FJv}uUN=o!@)BP)L&EU{d>&2wPG{kIt%Gz
zWUnF`!z;%U5cF`-H;P%tp|>=uJI|yUqrfY&Yy>@~JhXXZ_3uWP|K0e$-OLG!o7me1
zaPaimUw&-W34amk)ZFPTh|WO)tB1^MXL;=Tx6htrAbynJws{o$w^cy#4VV_1<InP2
zt!kQpWk$MTcD_=(N>y;ie{#mLO~V2ec}-Qdgfta-4)nM11*n@kXmgJRL)ii@{`gX+
zeWPKiq6@gNr`ac6vxvk5Ol<XkgRFPFt4+OQ#>e`q-(tQg(q6YWw8dmC@Ba_*t!$#$
zl|}%};r#C_i#ApQn)1I~fWMFgrkNaY{#!X8GmuRt(sc^MWA8Na8ZNCiTDSK;jdK^*
zxqG=qk*|IJ-L&Aoe+VK-_^%dn)jzjC#jt##+iaE8ul88x`mSzvu|&Fc+*aobK6@o`
z&C-I~6}iB<=USy(?m5t#`02Guynom=x!YfwAdJw2X#nWT4Cotc|62*Gr4q``OvL1Q
z{C9rexyg2x0pXb_<f0_>Byz54u(^eBeA3A?<8lx+BWH#Jy$8~vfGw|lcaz+PXk{TK
zurx{O|5kB<AD_WjpIm!Aas9YTAaQ;Cv1q{@AFE1Yj`HO?^A3<Pto(r)E$Hb#{{%Yz
zb~}-nvY6$0!#F$U$Dh#8M?+6UYO*DA@1MNas+tu1IA`|wdu{zCopFB}`&d5+Bv)SW
z{h!Ofd^@S%0R5w(h}IifCdq!%%&eg2Z2v|VqbV@B{BwDi|Jm<M{z31(-|;aqK38tI
z_Ko~-joJl{V=Sj!T2OuYbb`Mupl?OR0yVkR`@Z8@^Sj#)z%%~Jet|#&smh+r5^=*M
zwAdB({^R}A_@Ars#}kdP@^zS%q$~i9i)6Gxb=_Euoupm^eG~ZWZITuRoXRMh-%pnh
z`h(`>YM_gk6E-i-SCu>zdUi14_9?-@h;V@boc9Q~D@BHnfoMTtn*Y3%AyQ4^^yuWi
zJ?rhRI@`wqln;r&JN<Zh|LpX1{oBN4Ld`!AM*h^Q_ce8ih%bH|g9C?0EToO{u_=1I
ze2DWYswe!pvo2fJgQEed|C9CqmD8}5s~xlR{sfM*s``#?_|(!eovNnhp%(r7)$2&{
z(VucxP`*F!%ntr3ehW>QXmf6lJ&aHsj2?GwG$xo?VTgCFTqhe;=bd;aH(xxd<eq6o
zm_%RTxE>3r)`FhW{&g9@#&vF<|NV*o>-fgo|L%E@8m4c3AAQ)f%l2@YBy6}4Wq}&b
z@*NO=^AWt(_{G}H=b4fsR;Q2#^z>gW@axrSJZfVyVPAc_bTaPq7cafo&*KmMbg*Om
z5r^KIS6}gCJEr#rw`FR;3)E;mC)imjPG$xJnt3N6swjtG<ppu_&h}8ZeQ!W`J&gOW
zA-`o^{k@+tgLr(6Vr<E$$V&IIT5h(xLtj$HtGchwOEfI}cdMLvkb>v6IJ08%aR!gd
zkFt1#LdoFTmt)}A^3d-#$GeKBpN<|lJ@o9!i}J8@EX2iWy4k8=SGWa`k(x53#j_E5
zc$eM?>HO8inbYYL2%J#|wgA0?;t*z$OE~-2G_3zjW1xvWrG{u7{&<x<lo-EpUuQ2Z
z$fevJXql>;+Q3Q3SL&s~@6T3#ueo`??7au|fo}zCIuDeF2mdh{Q11S@E0ao3;8ryh
zbnBCO-Lslg2^^%F(BT6;DdVpwpLpqwU@H;;C0YKBC6W}iPd3dRXAgfco}RS5ZGW)x
zeL&3Z;k)0A4`ZkK2X|?g298huw7PAkYnG5C;XO-z$g|miA~vdqd%Dz?3@qEdep_Lt
z&Ud@6Y_B;1#|?*CEJdFW`N+)dA-<}Ys4bTXV2HxB|JgUy@Obij_5+2hD?bp#klRaG
z?NX`P!!0B9l(5JfI|M`vUTKf$t})%s<CEPyCqML6c@25(1EQt1fchJ7<z!cbGW*4k
zY4Z8?67!~=J>E6d?EC3`J&#pEdJ*3==|P|i{4;k?YV+<_waEZyQ@+rY5M+0IduWg!
z<)Uv#Y%C~S_O;Ty@L%Lf+F^EMBgUdEA(+E)hRSg>(#z~YB}v_JcH)X(dU`DlYY-jC
z?_YE_S*!hb4e64nWcvkm4ftM##0)&UroR>Atx-Z&t0Y0o&VTXu+*{4DW)FzA2RFhi
z14~&Lv^<{!I^FbthcbrKn2=B}X~~my$13)Er$cw^Oc}<02l0C?(qr-?a8P!PnS;|q
z3KcfX__LFTrAp^RMV?bJ$$DQ=sHK4PG)^C2oIm%4gTj>lnUGyKFu&xLoPnCG?ytO}
zGB$Lo_XA7Im7m|f9E&W)f5w)#za=#9pXj}h8)*d+fTd@XMKhDt7AERG^VFA)qYxuZ
z9WyOio30*Fb_E?<!|AaXW}tP1pi8e41q^_tNGKU6dyq;R^?8|cE=bGqRdKuuZc+(Q
zX@4LvroQ^^90~p1J=wO1ngTW^ESwy!OfLTtKF(Sgq$)0d6Wqqr9R3b<tlu*P`_$ON
z%6&dN364>>Z<z%tU;%ZPOakB@hd9X<FG#LVFQJxK_l8}zW4t=Og`_l%)InjDg8Ag?
z?GL+a`+hD}?`mA?y?+dy9=+fnI7#8xz5O=*WLHu4%eRix!=+K(pWQ594l8ct@=hj8
z4Yf9Pxt2T#dV1L+s>l7<1U;YQyN6Bdf}7rle*8Z?y>&noU(`PgD5A6o2q+yQ&C-o@
zcP(AJw1{+yDBZEZ0!udwNPlUOhNW{sK<VyO;vIj_^SuAg?#|54y>srl=X_#5L|1Vy
ztUjLsLb4;xO7Rri=u3tw1QSdZ5l)E_Tt}aNfe~*+`W=a!i5!PKh`}Fb-e%KRVg{eh
zMB1`gaWzG_V<%e|{W@7sTzfc!9ZmLK1$k|q<#=}AHk53Y)Sl7iJ42uFiD*%wM8#4P
z;RTd0xwmuF3U$!pPU;1TNWFK{Q?=$stx=7dRf1LBI7D^3^qh1Rn|`x>uBoNX`52-6
zViu*%dO#QW%iVJn*CUKAS)RSzNd}{ar|W9xfd*<$vlnISOaMfbS}ZYUDip0pH*#Q7
zI-P3c@%v`>xlKW|k-EkGwSV<utwWF=JHp0*)k{2`m(c|%qvPW~F4hIhJ8iP-&<t;7
z1YB`4ze+^@*y3M<BNCu2{A*(qyaiRg<wV}j3@|_?=p~*!W1|jjF!i8^VB#pJ89$)x
z3>aGIRvEX%`KmfJzTOiWwbWo?p-^$e7&qHEAm7VihZ!*^M*-tKar|(16@J)q)y0`s
zY2iIMbR%}0F&{{DR7|jZ_C;`8=45|?-OeQV@uMPlRLgVJe;xJ_T#;&AiGz!;Wzg1<
zF$~~|Ws4B9$@Maa7A>V#)=z#OzVoJ&e?qFwZ8WHuTN+-D6xZ^-2yH0?sDk#w6tULk
zl=bN4?via$_+XWVKp(~epx&O*zeX9J03`pAPC0}3Rn|}f2nQ*fH@x$9QozG%hEf?h
ziJ0}uZIz`QK3DAa7$l1tRFi~Ni2hgOl!(0D<Dw|UbIG!b=7zqxMnJ{crwJTxS@?9(
zvZ3+<I$&Yah_FX_#2T)-zB5DCZ$`7$UIk77GL{%^AK&@Y6=F(<^V1H-C|h(XF=dm*
z2!vH)7e`Z@SQ@7?X_E?!u%41eo0++wNeG{8gOL3o5nM49(KN#b^iiQ<qI1WcbJxDX
zKpT%2kUM*=5gSOro`p~V1lokxghQnX@1j{@C$&bOIDWpA#rRSM=%8F?(oXWcA;8EO
z_hZ6)9CITN*0wIE$`V`T_Hh2}0IlLhjAeEq_sHsW^k`xfLp&%C<H@5O*^)I1lbY4~
za2+ligpv}K$@5fi+AChB5PE0PP7dk7S#k4%Undk<YO$Hky~;Jy$dYKf|6%EMy6@bJ
z?~cj^j6QPfe3S~DRO|uTiluHV1Ld2D{HpR((_Xc=Uf&V}rE%Bc&u>$*pYW;H7!5#l
z)!v?m7u|oz$#=w-*VjWtImqklI+7DD(hTm_hKY?5Idn?0nVn_~modFnWnkuAu*9I2
z*01d_5{8e$(~$c7b$z^XoXCVBz>;JE3lMz*=+S0Aj6s0-cWH5ZqI0Uq2nrY48~3EH
z*#X*Xj#KB%qOXUmauV{)vzF2srM?E9^eA=!L~f%pitRJXcT;|rmZt&~#z#TiwejB{
zE0e_V=GowFkQJnKMg8dO>1k%q5&D7AV!iVtuie3hf9*COET4k*;Uy@b%>(r55i%#;
zoFgZ#kwU9m*!*GiaTr?pzrCWF0i}Po3gSVv5T;#H_@<<{Vp<S+<z~D@#=aag2-gN&
zo`jZOLHbCRQ<BsImEm{lX?h3}K;%86e2TWb2I9<vpj@N(WSr(*YIFHwd23h2%)&Ed
z>cNTI=Q21?EFb9_ox~AAW)~R?ATF<rewWwV8@Rk?Jg^LWnhV?&p{J;BkQYeOdu#`(
z=e^ZCaSDDM%?Mj*rH*wx^FGAFcYBNx7iB{aYakh9nD99WtpD&8Qg`xeKiW<(O-d;F
zHPyDwL8H@E$Dli3fd9_wdm=}+3|}Nt4ytQD{WgB17oEaP<)HkO$K=yn1yLI;vrGvC
z=!r|6Nqb!O#V^qSe#T7pj2Vi4pVj>vA^_mb36PygGs*a}%UC_YZcaf%jz4YzGl3~d
z(X>d`Z1C^OOovz^H#tm#@8O~##~L|NLnX-R6#VD6@`<2|@X_k~TbS#^`k46@+w6PV
zo1^Mu0%elF;S6>qx`_!BpTBq-y<!Bv@HxzA=W6fV*TlH`roeaVV?cl{=!B!j^JSJk
z-BYDJfwSFVgMs}^19Nc0^FXQDCcTW=dDDi<0tW(YehiBp52oSuC_89U^AG1M`6U#7
z0k7}y>T!2TY+Wf}5XxQ<9cFP7Vpl`XT5in2CNH127f!QuCS`GVC>wvULF;#OR*nC-
zaL_hGV=rd&BCrMsW}ecnjFiEKU{2|D5hGqWT%wF!-J<9V1-sW{OncH0a7h+t42`7V
zU#EEoN|fY1;>?M?(oE7h3osFwOjM>az$7@q|DG&LJvdNS)}!_(q^WOO>nrct?T)wL
z`I)7{@<m7d-3rmC4u?A`6_*qwu6$?-vK@!0(x|0Si|0LAG--PjwmclqvR92IZE&;n
zX<?=dA6w8PAQ=Dov1MwtR2bl6{n3x^6&Un$Yyl?`KeqsxPnl_=?Y9%U!_I5SUZ4jk
z1J`2%H!2Qu-r}}Y^z{H)nw=%gURqPFQU+gn&?hD8CIccejr*fNL*ys;-Z*?=gSsw=
zpYNE}xqg(o-ZpPRJuqp~NRDQBZa~;SJ;3J1I&(VM%`9#37LF@0flC4m1Fw<3Xx}p;
z_fsR^^Kv7FNB@$fdRwkS%0(9<2Oy>_k0X@&VqgU`09|rD>?KQ@#kBW6vCG3{OULJg
z>$31MW?UDVOo>{$pfiG3=EqsX6$c4QcHwIiTHkI~+R$o4(AHjDizVl#0gT+|0)Kpw
z76Jw><CM~SK;&}S46kp*_m&fX^r4zu?AM%2lTn{DkrDV~@9ym{rR$$xjZiB*Y^J`k
z$K#3a@iYh#iDbS7gRdd|qlKdy%r~QHNYnp5-YBuMQc^F;zax=fGfuSyXJn`>1<kF^
zmIUt6N{C5csr(4(n%~aHG`JG89g$;98NkSTR))U-5KBaVP#r2gt28@_aiz<~6t<XC
zvE8r`V(n-At=IVRWrNHEof$Io)m&{XGwt1%rrY?2yZBFc)&@)ZY1IJ_{XwXvPnQ+_
zD;KF-eE!ynAA~6^W2J$-;F#z!UuyOXz$f&7Y5@S11S+0glZt0=AgD@KI~WiKBs1r1
zN#MRP91V?HM>I0y=ysjn>2FbIL(%2v-W&(G({FJ3i-I9WkP8lTA9Ji4kL<tmz5;;2
zVUt)?PMmosK4FQm7#dS&N_~-7CW0WIWI_!lkbKeaG%6Jc_uoqPy+Z~4+N+1Hc$Z=j
zI7#7&^_RwQarz`ojO%|5Fa6dqVQXLxxeGHT!KfnSx06uoy3GOLz1t`x4-`NNrU1r{
z2L2EC_QEvJCIsq$*@^Le3>Yw>1yE0-;aI{5hF|YzAepk@mrIlXa^g{yF!C}P-IiZI
z<JCwz=qUAd*XHB{D-~hSk9W%Ti`S12$bqtA7rtNF1r`-I;vh#j3~Yz7G;Q4~uL7Zt
zwJl<$)*gxCiVpunsy|G{u2|6=qN4{OKr0)S>ecgEpFrMHBy?kn(5XIONTTvFHs(k?
zVFPd>7@9!gMe*0OSOF6W6S3OY-Bg$@xxFM{X+psT%+7XJfeU$=qO0u|4TsoMxLf63
zU+VjD6{<zN&1r!G&yEQRixj!fl0+L4EyZGBT^>ikc5#R<{j;tS8rjTTUiN<WWt7ei
zfO*Cd4w$x{Vg+j_vVUiq<pfGy7+OH7LpWOGDn>x4HZcUPuR53K@nqcGJl1w89H?~u
zb3^$20$lknBf@U`Db_ewgzZ7dzvG_t>7U&NsK>_DXmjO(gGnQWQ7XWTh=H*SP;5$^
zn6r5S4OFV0GYST9bg5i%x;|)@)Z;r2#xXsh{)n?o^%#wx>u$Usyt3#OJ^EQY8t62=
z20n@1RI%HheX8|JfwK{h0odf!18cKsapWZB(QJf#DdrGeQp5io2P)w|OPVJs$@89k
z`~MFD4XFS0Ulj4Fi9C{Ka(XHEkD$a2oR)V8T2ePj*4^8yJ+dhaNUt>!4=ylgD(5XR
z0GFT!ezmw0<KxdVJ^oF>mhbpgy@@j(@P1+B0*$lpcvRH05zbG7f=R%wbimA$2K1>u
zD;~$uHF1nBz6L(p{NPWNvmdRH%0*>8E-Y8;^$wWj!Bs$AT(kMk=utOS;>hd09=Q9U
zM;zB(%?AsPAKwN4?_2*W_0<mcMvS#!SLP{nRP)|C+8v+jtI{m+tbvE}0ubJOHvp}Y
zhVasSpRG35p&DbY1TV6tp+5s(;cPTPsp9{8>=^*TYWb`4CPSo06@T!AdIxVK@e9=M
zFJJsbq&#QpfDa5%Jiw?2tVzV9t3P@TpSB?oZ!?Q<(YBJ^xh8*Xeka?-5|n4c1aH3e
z@lFz+(aL)YdOWt;4qjoQXaMY@Mkm&fJTVM;3`E4pYn#s&5;p?#Siii_V*{_4p4WzP
z&(ic?e_zwoc3$+qW;)|7kLN^1s~3XU5-%<Q_e1e0y*`vus*)PeGY5|1+StibnE~iw
zj9h>u_I)j3B+Gf{r)BR8cl}zbHHtEWKA}JPk_ewZMoP1PO%uj{h$(zi+ka2wmmbB?
z)8+m;_y}*T>Yp&)+!`ljMmqZS%J#UC%j<%fw_o)sSGQf%o36gg)#_0E2i&_xSQO=T
z$XyGiKC1M6U#<yqB1VtDf;VnL1p>e-^eYtf1{bjOfw}TQQV;c=dw*_(HB);DU!AJe
z=3lzDqYLp)jkOV%ir^)`)Z8KhzMbDocx~Ub{lDY>jYI;&2PiyUKZVpOve=4AoKHx1
zI&FJISyPbpZ0|?8P9chRqKE7anw`s}sJ4Zu2glz}glI<xNxP!c3v%6KZYmN8G0cJ9
z(!KSkKt9{Lsyqs4`){)Xy3O!+F%h<vvP@?*=6wC4lo-E!f%zat0O8|!KT9n@@-lEc
zBlhLlEFG$qc+fapX;ax?E$3#9Y;0~a5smTv#rW-`+W{kgQJcMAijM-r0d*;-mUbL@
z5Qj=%UQ>AZMcO$ITl-3epXg@%^HGd{E#F_dO|*Du6cl*0l+t!uFl2LFbcF3|2KW|?
zv)pQnzJ77J`%UFKV4_A2eA(ji)iz`1yTub3aOdQF^tYMEIXC8l$r%~1UAdB&Z4Z3p
z<eA)~J5=QBfMLC&k(7UXxDE!Y4Id~`ypJsE(9*QYBf0IRTC;LYvM&N=Pvt<8X)&KG
zjG`UW2`C5v1RX%xz&H#AhA-nTv_zZ#OQU_hR#;Jfb7PFL9GiPVhfxn(#thAfy(g|!
zy8jc5fB1`_{+B`(t*-!Iojodqc9>G16$7P_6UFI741h;VEe6#)KE{~q(o(=^B{=8J
zeV#FEFBE`px;~CcD{Ri6X`<n009Ho=P_lm|Gaxz!f38K_>zTZsaXeCx=L1MUdIkC*
zIZ&9=le2Sq#+0G!^uCLV)Nj5O_Ljtq82<sW<U3N4<x!K|9zWLaM^u{3ZzzKa0u<nP
zcQwZRe2bjqFf0bjlstxXeVmG#Z}d-iv4Z`9+B9kvuz<*YzK{=K)+Aj+G?_uY$fTNL
zCR_f?<5nj@^DH$xi8hM%CP0!=DmgQKRGkNd76=`}W1GQ!4UEII;x+M@dK30Sx00WL
znO`bzAM(Do5&KM(1edk^$M*Y{r!6=1&^9sa4%z&%`$3f0V?X>mJJaj-5Y}-n8JmiB
z*%wc`86W*lWSsJ^^sk~=Qt+Pa`@JJkboJ<(0QgJT@1@B74qBX-mRK`^Rj&_&YuY{!
zwPo}2`Cx$36f65qi^3<W2RQ#(qg(Y2eIS<yd@)86de3=AG;YUZWAx@(h<%R$%}+V#
z{h%D~`;Z&n7FE(4n*4#QyubESZ6>75m^)R)urIGz!z!tMez!@74Lw~#-?gA8B2kHv
z9A=q|XfnpF=qi9{(I+HM^7|DA0*H57qod_hKo~Lu9-NAR9_yKJGLanUXu@Y!C)R0A
zML)I;vdk};pDBX+X<4}wu$^}VbF`~lDH)=&dm@tje3?m^e=W-``n}R-&SuznY))Sn
zYuH55IZc$KnJOfur|}3;$Rv1l?~J}Abobx$vl+~C*{k_L=s^r{@S3M66S*kHpAtBf
zUgYQC0qq~IqD+0xnd`CtK#j565YrQ-K9AdW6t52AMtnxqQ$d>VzTl^V??}W4sC6<*
z>kV9An5cHw=4`}+8KzCMSkv^I#r&4uqx}a*E+AzBD4}5LeUFBE)lvczS+?@!ohhp<
zlRGwSid6si?`T$qGSwN1`d1Rw=lpf$5+#qp#Xc;9Nw#vrEmmIzBj<jlJ86TFNG<5n
z%Fah{0~`2D4wLFj!0A}Fn^p1OiWofP>^0UOtdQemf1U4&2SKah9*`rTjn_pw7<|_0
z`KV3aus4hEJpM#mslgwhVPJ4_Y$3}~zT1dyrkKXAkAHj=8d;FRo-!ky<AM_=EMo%9
zVLfP_zhr9GCEwrfmv>-R*+>+<&xWdY6!apRA^oJ2Hy+n?__dTVD>?Un$>uRkB9`lX
zgK93Df>xulXlE9ouGU~9@6*!Rys8)%O$fPD1S2zl51&2o4gwgTmaPK&O-%w%i*u_y
zU`Y$#{)zylgRyk+d-KcbzuaKmW%54kMi+gNkn4Jl`xYmr5ZWj3BP*)uk*{rlzkfgf
zf*Rx`;<>eAxa^72MhPoS{~z~w)F55bKJXcE5h~y!oL*1(^X)f<0RMnLAJF!4weP3E
z6XGw0s$zu=rir_Azw%0bD<xBnatfgvP|zqyA*b_L+Tdbj$C>kXe{Hh_xM(32C|W;g
zqJMJsY|2o%#AqU<l)rV14<#DoA#9AP^Z)}yt!M;htR8QHvlkmWk(cBb|D`T`B{f!o
zX^(J?e{sMH8zLA*Mk&qcVOFx%ujW`M!6T=PKk%-+5c?6Pxrq(J!`AP}(kD+KB5~K|
z(WaoL(}4@7ju;FbZwsRtmd((%Vy`GXX}0sMOb7aKgbbEI4pQ1Z8r)ZN{~XX;tOMv*
zuAv~g+PDm{SV0iQT^<|mBYSrBnNvru96N_I7P9eeb>@O>^1>AI{T>bhTpPof_iL{_
zMv^J81=)(xIW~QU#hVp+hKnT%Y_H6S^VND6^6HZWB^^k|%L%+WdRxV6n>{Df(Tb1h
zN49`=)oz_g?sGJ%`yZfbCZ?8rk#mzdOvxazoGmoudEYjb0Pi+Ped^SA$U%f=nn}A*
zD3i4apnbCyKXcig9%BT<sh;os6T8HR9(3zcR-i$){xCg-P{0t=8p*f$W7%1WoqF5o
zC3k}rf?o;<hoxhqNmF|K!0sg7c~hC9!>I4IqM<a-?Imc~8W%zEG76jetmiwgp1STx
zRx0SB7boN$TY>x!`m*TcDHT2nGu_b2KDHUthIcV894RyM77<)+VNj{O|2_LRY%}SA
zVW?(64u4O7Y40Ul2Bao{-hy@AlX?vQzhJj<a$I;!B7maOR>T{}v*2NkqTU~t`e236
zt_mR=hDc}va)YHeWWF*^`N3gaw;h15vSl<PpVD~CA3uycRR+jdZGx>Ot4n)Lxx#s#
zR2lFuem-@HvdhylD&Dg!HS4D4<eORie0&lMX%u6DnH>|L$i}H+?eICT1OK^<aFLD#
z^xhxKkCgyJJWFZQb?RFlw{a$-4p>ZXk*WuXy(SzRQO5h`1uP$07!~ujE6`@-RvBti
zPJGddaJUWN(&Iaw|7)nUYVn^D0kqz;ZXm!L>*<vWrgD?Vi1%RxFxsiGz?qbPfB0(7
z)NO?;&k37g4c1<Yx%$W<(3!aAg;N5GzPOu@w`)2Oj<bsW*9RWQARW2=9>jL`K{G(E
z)?gj4IUw$SEMNGEWJ$TBsKg>OD^)DEtq3Whki@IlU8pzpecViZVgYF3pX_ha%otnB
z@axo}|5$1%!vy|WgG)bht`dsPhx-F;6dIb2d25^isU{PCv6z>&&1xooY@5->tm8$g
z-WX;HgXv3GFZjCX$i^A+wC3+|9mFFm`9bqaz43%`?+Z|U<tfAIUru~xwFG4=6o|T`
zC8cd>5J)NO>?kO{slAnXee%$sKQ967xOOB*V*0<dh5@GSw(qPYMx%WPA3D7WV1o&}
z|Cw%f*M+MAh@|~_+e5Yde*{w>jXddUK|Z^&Y)S9;pqya`!TUii0VD?uc5z!ekM&jL
zBk@|mIdzr!tn~Oo$IIwqKXO1KfIxNvmAqfyd$oQnA7ktsmrq&;XzQlUEVOUVt3fX}
zn8WiaeT)Iu%DfLu<grh_G>}X)t}WisDd0K;{8~-iX$OK4Ux9Vwcm~u!Fm3{<bVMtz
z1HQ0CG@2!~7yVMShyfkJ?qCH#HRzE&1=)x~f$;$sUAn_2*FQjc7&k+bz-McU&>B-g
z8-ZLWs_ID2T_T3S&tn_z;FhP#<yk)eR}09ec&5mh_@N<AC1qsDIPmxYe!Rb5TdR}Q
zjl(<I<OfDU|6QgUknqdTQ~JQOUu&4WV|s7e2%i#5D__KZEYH`JD?V#MdYcMBGBUJS
z*ZJUTTxpO4X+SnWFKdu3noFEO-PVpB`bhgW?g{OL0B5rD1T*o|uie_9PZIS}BPS*7
zl^-{w-o>0vTm>BeSIHL+s6l+1Q=J1HlecY)jmpag0{s%3!>OzB!DkP)d}5Vn+WhX4
znW{?uZ(;OF0xEWXEQnEPUDTvwBr-*xdF|Oqi$ko<e*CYO{MRYX41m}zEJCg{n7k+p
zdiJ?!jbd$r#b4^uK%7ChupW)KzAg7eo-e-Z_*sA6<O}yVbNV;N=SuBdbZz#1-^-kf
zL1XoQejP|8MV7JXfMsS!!(yVV0a^gtU=IpDwKiy*-(D6|_rqw^Jeg?7xu3<|<DD+?
z@guW2KKS|iI=DbFA{K_B+Rv-g7}<JRNnnHR=>LUh0=vimI4o;TYhtIYjLH2~CjrD3
z(3!}()7$)fQIJ`cq>aC(58C8A_X-qE9)c|LIo4zVDlUDus>-%xPSe)0ZZWgr7y+SI
zPoE8R*^5&>`@4Dop!dp<I^MNFqQwyfrTJpHDHlH4%$<IdjDSP&v-&r!Av8*mN;y!c
z1`~TB-%dbPU1Cf@6i_O^iH?UNdE;u%W$nqaB=z)g`2e@ltSAK=4|wMzc~Ymv*t+4N
zc|aRnzRsj+RjpeLSPn82$?97E=3+-o%_~Db(osbAm?41ir_$#j)me(NC9kj-?8H`j
zs{#RP4c}uRY$<ZqVapPc{i}%s*q^@+DF$?Vj!>}wGi8>m)#bPOMej35kjoseHZ7w3
z!+I*tnh$o-+H5d;ZVKwqs9#}8;yu%Ig+l#4I_3|T#f&&%CK*D*71D~h*<pE%PcgJd
zKGnT=VOPmj_EL?<{Zn&H-OZPjRNStEV-lkAq$zOZ=$_+#aL3K4l@yG3ZV0LaumcHB
zPedpD*kEc!R6%_U5w)qXR+(Df+8T~P7@@UXGyeB{*4~{R_byA8W$%u(2B9HH*2q1x
zB1>&Lbd%C26370TaqxekTe_4C;DTDX8VELB|HrA>D+ShYol^JB*Q`ah0Yrtt<Nmp;
zZ16Vk1dWN6{Wi_*Qh{&s*^|CapU37Kn8u;K#fUKtHuocI2*4qNr&|-8x-+q}sj$Jn
zO$E1#sl1rG?W56Cu-SCxe}bW(l`a@U*-Np>c{!K)#PvI#gmi@#zq_z&Nv)i&``~Mm
zK_J-|q@V%Pq`w~TLp)VQ5h^S%P!a%6@!Md#Q(6PoomAW75h;v?@1xdJ_<mj8WgMBx
z>gsVqDMNmX%WJ^uY$EdCa?7AD<qB(ir#rv8g!lVNGXS`=OQne-yo^?CH{h+K6qtDE
z<~x>rE&XbqBLktL0orD$F0N%U{(aS^(#JPn-bLUcBHnJt)0VI@CD3fjm6$cF7mFF(
zlvNu7f5{H@Du#cy%e8(oPP29~%P%{D9B#`P0=A7>>;d8YU4V<36%dAW&_Do0CQp{F
zpP!TJPzHzlmH`@3Vh(3d75MysVz9KoxT6g}P-vO^%1=}b>X3%t%|^cmr^VpfBa@-f
z;^Z=*Y!hD_2KqxD2J(9n2EwW*Fb)=eTvQu+<A<%*#7V!TB@}?;Wx6iFTMpCztEIT@
z><48_b62?nV118iP~x+!w71X5_<|dKfdGf|EqSQaU^8ED);^DeUaVe40TXHMhIB_r
zjUoUmgk$XLIGe|vK!RrfY8k8WQW9{g9#_7T&$}c%r0SX<j{!+~B|1V-WvrP?p4VcK
zk(08R*+^%v!=JVtfTGDSH;VqJ<{<zO@xa!u#^DJyFmcM$XXd-)0kZ^1L7CR(x>6si
zFNS@q;qI4DlfsZQQXL8%-8l0Fz*)&`*()04p(ioY8=x4Q$F4y2(f*BC;Mv<ut77mQ
zpSQ5)Kn1Woq%39^S|qeMkHv)0fYxnmKlz0%9)=jg-SjFlybcx@jj014KYcxf;UXAE
zPS-weK`Nd+L=x-K?Hx2FKm2c9%AX`1j8i)Tw!wykRVBu7Urm4GVA9iOTM`Kh%%8ER
zz)GXnp0|@NBnhX@kvUmW1Y*R({>0#SGDekHY9Bme+d9GWR$KV%r!5RH0ser*F;<%@
z8FWmNk;9V$mzH|BnjJY%7shu4YdmGai@KmO8&kFlI@k@cW0n4!=Ncr0R)*Z&;ia#k
zX*;%4Yof{Ykuk7_M-EgoL!|P6pQj*e;)wUL@aT&G95YJH1){*S*5dbUe3x#rY;`Nd
zD>X~U{u=r-9#mg|yWP@L5KbUY98!tZ%s1Fn1Q2Eib|tPs;uKcnRAObwF<^MOb)j}T
z@Uzz6R|YJ}P~h|_Lp)wJY6ZH(0H-=$Be!i68~7Quc9Xr}>`J4uz&+`ta}g+<o5|%9
z9Kd4l4nf__v3`MYNR%KO8BW)3fMCJml?LboV44veS8Bp*V>E@tP8lNK+!OCkRQh>S
zhT1%qCmk9x<!z~SR^JVftajjX3dQ>6uE*Ye+zYC#xB6M*O@c-p0A-+D-Epi!_x(c9
zn<gs`asa>#kV!mTbK)B*@Z<5nDndWLF!(~e?4Bd^vEDdx9Zv)(yL^5gbJno@`cpV1
zs<Dz5`bz`2dBo{}?XOh(N<*Xb5m${*?cPR+oFV7S9?b#P6kZhw;MVZ1nXDA28?SQt
z&uvilNK_~Tz&(@(EIz83hZ9Bs?mvF6E-<j9BMTMpyNSX}YQw^~trfs;X}X7u$oTa2
zfuhS}*f2$k{gKS%0Q4|a1bAS!C9aZ>76X!oe6HjRL2)X!Gm<?{_F2V@fQM%{AW6cS
z1{3uWU%Ct}<Xu4lb{QC=0~#xUc;eq%puHOi7!n;i!~VYEGOD1`qzHaRQHH-!D^i98
zEQ1+f2Lpdq2B7bOve7u$Ga9IR@yvfuT_BKJmmYsrhMx=w1O92*JN8zIwjqne(zw9L
ziqk<?tzBf&h~QwCjB=i<g#yZJVq$5SXq4x_3lD4b0uHP#f1+iSDm*urj(&v}9u$H&
zXv|*q*3~)#akklEW*Av~lh4G9@!{La*CAc>_J@e($2ouG<ts1y>f-)s5ejxMOmP95
zgK;;{I?5<$0~&7Jm&KNtUJL)nsi0bZ-MMO8r~l=Zk6`i!fYrkhgMC2DY2n%!csUx1
z7bwk!%7EcOHl!%%j^_b65BYxySjJV(X6ER|7-WgRF;9Cta|M?zrP<q&vZ%Ht8fJBE
z?Lzu*Au#Z6(h^Pq^!qV{lLR7oY1|au7Abm!tLbr;WYZ?F`zQ@%J*6a>YQ>mqqgXTB
z_lle-0aPD+&y0WC`y@ni^L-!@BJ22rpzO-6!L)e;KCpu*c7G9Ga%I$hN=vz-aRulh
zaN8@;u5wEMKUQkV$GK?`G<CQ<XaL{YL!F+FCUH%h(Q#4%{hqW>hZ0sba<FWO=ep>&
z4`_r^0vIAnX`x*E*{l}b;e?^vU`1{fYrvjFi*4=dwUz(d?2&Y#NY<!CCH~CbPCAT!
z-}%roltxN^V9Zi+I{RzH!21=k$lj6Hgk7i$LWC+P?d(=dAuJ!PyQ{&u=Wg2_Z(Wn1
zHvJ$Ut2axW-Lts@_T!_H2mH|(u3*E(qBD^-O<wy5QxOs{Z%B~MC?JTAO)~%u3eE@1
z?yGU)Jq|%x0f}GzpY6w@G(Ubng=Sz1N4*+`pjv_6<le*Bav(;d_Hy9sPfWf?uy*f(
z5DtTRVmio?wlVar>t}Lfs0l8o%V%=j6zw6_0_PzbE9|GlGIWnfNNTS>zFs_`sV%(X
zmWb1`RZewQ_D<@cjd7Pm*e)ep+@60rZ2s~Ty4hPABc1ity~ZKT?i@F82IQV?tiZ-+
z8WhyA>IV&mGZ{3i#m84C&GjMF#{xQ(yO2+z(zhOdH4aq{#i2CE-C1)<?;VkEV3ea!
zRrUdPJq(nUzYIZQ&Uu+yvUA_|O)>B+R>Skb!Xzi<klz+E8G7VSBF)WUaLoAAbeVpq
zG`Lm3k6;}pm_rU{wH^<12qm#0>4*&88yNgx8r0ej(}S|fhcfRt6pK9&E4{<~%e(u0
zU7fi|2hfy&0-D)$Rje7IsUPN&2)Eimh#}I|zWk`DXy?YB|Kd0kkR(O4Hh}jzu<sLj
zjtcfEuqRjB#*{+&I#QOQvYZ?1S64|YV9rk{pe6~H&~huHqJXrJGBs^}KK8I-q2OV8
z@8Xok_AUmCylRJ8vFgIc=66L&Sgp+6d8TaJ6^v4y^Ul?Xg@y8Q&9XadNZV@cuR&<<
zOlvu{OC<j-Mgo81oG{kIh5Os&TYa?=WB8oiiea|DmRAHe2f0FXtPmUY<kv#7%+Oyi
zyEi$JO1&K1j3z}%Utb*;G!~bS&^S_TPd9%(KlNN}+y`=k<kVDi9n+-jQN@H{%n(lq
z|KK%kg^*C;M>bt6(h>WPKH4shFyWNvYQD)X{&sd57o4oRZyC?8uUW(!kYzO;m9cu8
zEQ!df8ega0s)Z+f=4kLPl$jZV2E%cK9sX0*@AI@rx;p=b>Q_4ShsTtRrFjRzUUFwN
zxJmOwlM$MJZA{Nczt2;&=C@<RlfbvpDXz6_R%L*Lgra+OjP#Py>{{~K6MAIgZ|RHJ
zZjwAmAADFk-7d&SD|g8={;QG20d!D_H6=D;XAcNw$ASAB<Thz=Pge1|xzs8cu!C&D
zcP}OY%0o?y<5bc?TP-Kqj0yWs1eqeiu5QBL?k()>`q_?hY!Nine6Q{2Ex(DMi&^Z{
zVE?)_%B8{uZ|mq+V>$F@*KD=Q;fgEP1!95=NqX`&<!0eqotv!uS}thJ$0kb)iuJhe
znjyF=oOGm^2!DoJBMKULs@gQee3ssLgYdN0gOX^lEyAa5cxD9z|32Zn(bhaa&_=3p
zv$L}^G8Qy87B~0Cv~zt<DH^*-I!YSPry2XX#$}My|AQDAsbU$;7y{mZ-bXCwoBTHe
ziXa`q9ojXf+A~S6qlV{bAt=PuAq-$$aF9l7c0vnSDhI!K*uDeLN10dM+C(ZDTd-mV
zD4hJ9PSH2yF5=^|!AOrjTxEUH5|)}~Gdz6grwUUdj~h!fBot*`C-V!)tod3`!I<8w
zGoYkk`sE|hn0=;XZt_*k@=ej;LLP7D2vvTys)1LPuV}3*(;h!e-&Q#3!kuE!%oh!A
zku=a<DUF7bw72cC<6R#hH};yE)5=__B>syBQF`xi@D+4)RMjNvst2b(6*UM-_nzCz
z_WcvR4ryHjm(Z(Qr~maYC<qJ@CucDXcJB)zOsRg!l--Np#Q_z4y}`ump|@<iS8rde
zh^gF>4-PW<;bC3#HXG<N{|_#pe$k{`8B(b%k)g9fBhN1AY?wVE>A`ch({HribWHBb
z%qgS_Pnxmj9N<QwhLU`st_|!M+GKvm@exWrA4`yg-8d?iXJ!g{s)7bj?9Hy_1s<{#
zq6GnsINq1n+eM!kz3`fV-WixVah#D?r4nVv#n-<Qqzt)eK$sR*2#%nW_HBM{s#2WY
z{w{a2Pcnwz{^!|GbVm{B4MSZWtlDo%c~S1bnS0^tB&~Z+)Pz)C(xkn&Mb+#!+a1BJ
zLqbu$?o?@6aRMP=d{0(*=ssFWPgOtrHzj9YG*pLo4`G<3RuJr?V2ux0X~{A2&dzvz
zgulG{b*(IfZzJt1a?noMv|oC-xE5}f(qt#4;M%Ol=HN@+BAlU>s;Fxt8yNV=Mi6V_
zT>*=mbE!SWG~=8r^gG}1`HK50c>e=+oe_GCJ85_$bI9~FYvH$E7~+%M<eN@@AeAHk
z^KlXk-R+s5o>wO7n{H01$DM}Mtf{RSgJtk%wqb~5li32rprFq)j=C5LpeLytU*Bi6
zTsqHAI>u77L3tbPXz<+Fb<lANd#ebCHC3@4*o0WMhbQDmJXVrx(|Qv)ge?6hBQJC-
zW4-A4XlUV{PJuyjbDaVB_iU8ejR@S&7<$RcetKBl62{{Cpm0?gdHF^|l4syK8XX%O
zOAt#ySZ*h6STt_Y$Mox}$<O;8sv3v!(Wf3vVCG;c)Jl(#PEw|9Wk4lrUn9KiQR<r4
z+R~z}S@mEA>+{0eFk-wyW45V3DP&s^yNxaAuz8Y0!<Ge)>lTLQo4)<8cWcnZU3h?i
zfPkQ&P$Mt@({b#27n1NRS5JS2y@aU%f1X+!n<z_i6HG?%_deVlPAj(}7e6n%g5Y%+
z(>W_0y(44@m@5<4*Rj(>Ay3^F(tq;%R(E-3=e<kH1zskD#(;*#MnNGVK>;^)M>>Xj
zN0PAH=J!NqnCy0bhuJ6iyfQq|d6!;;hus13V=&p<uKbYHaxZ@4CLu3DT%}?f?84;V
ztSDt2_|^}|XJxkGA<%F-Z9{`TeYSG+jK0%aT}m!VvjMrZpI=zO#^$Dw${n&S@;+AD
z=o$}B%;6|q_V@fEI1RK|khJ+?Yyes#3k2sCy-QiN+5vj!&7`7itw|f-K`CZsUfK@A
z!gy{nJ%XAFZ-18fXa)=}-szdwTY(Zay!3*O^J|J2R0xa#rEIXSyQ)(i7V+y!^15eP
zMW&9@%E9rIOujeSmW^U5z6({Ys&*0B3Xm9PfVC}hX6>!F7)TSw?u=VzrI_rgOu@*n
zBB&e5(wUq{;SLi~Vskp&p9Y1Jrov%ndZs_??5f+^Lh9>1urVUPligOV;pa4#p9;z?
zniTM>*hEHwQTy<rHun^Zo9MMy{>HUa<fE)~?WZb@Z#2UDfVa1W`;AN7NBGh*m0!T^
z0>9x<wsDvQ*!|<jjf%<<F6{c*+2TgQ-O^y9454SM-xHZT{yL6fN(Pm}c4%U<Lny_B
z!hoPK%?rb(!IQ)EH_~y~qwHg)^Bj3Ll~+@jNO7ii%2rxYN$BRpMs)qz637bL+Qe__
z3ul%WpiM%8g2Jzv_@&jiGdq0P88b4LFc0-EyIV6Jd?Brh19QI4@y=oMbm_e+<9eHw
znb>WQeo<l<wslSNl_Ybyx1UDsvAu%rgwg;(U~NrkCS1epP$Q;I?YW$vaZ3QiZmYgw
z!DOFvWMm|+Q4qVZ{8=F1I??88WhE}Ou{Cq`P@D1*!f-Qa>ud}f@jL{KjA?+f=2mza
ztS|71-3=QWukJ2F|M0G^SF7nJbn=r&H_SLxx@d*Diz2wv_<Ahl!sW@dp1u=y&aURr
z`~qm06LA{zD#?F|o<2{kf{OKb`d+XO=$QpL{mqfVCq`LAj-J_&jT4ACRAuofklQyl
z37c+G$Nkt$s?J5wsDZpfrgjo6$*nQNdpB~op0uEfvbb)>s3*4D<4EaqTEU!$54#!E
zp6Yt>Bdk(lm2{bOmR$Qp-wUZ0Id%jM{p=V^phb2Wf|;Qj5Q7S^LMStgzL7&^q2y!F
zqDLpariwfK`iwN!i75uW@bK_^to8k$<Po(9J*dn+$@ey@gVZ0RV*KSECM^Y(^2}74
zd^0|Tilv(&Q&W-8Bgh?UjhzouSf*NEWJD)~^=wEME}o?e3>4K4K%ps`Y<$d@xR&N#
zCANGs4&e%!Ga2ty>%>qO*=fWZppvQQe{ORG*{R2f*(Z}4$}Z#IJatf_TjnVab$?k4
zFS9KKzfFU`@W<v6@D5j~U~jKm&<P_Q`Dynpy;S+7C=8xwN<LZ!!HtNPkjdy1ao|b3
z#NV7#=Vh?vJEMca$;F=Vv}PEnS}AOyIm9IDy7<!s>X>D0l5~eHH4gNj-tB~XTlQaS
zR}MNvyjaOdXI6Px#gGYq7vyCOZ2^y-gaLfK1PrQ0Ju3>bVq|^Hrl77VKMVa3g#JA<
ztc!!=@UrF#du`!`$Ox-I<?N3b+dU7eXr|dj+d35g-l%AmD->VBnqTCSAOT}vL$zRu
ztZxu1$d~0z-eQ_choB&{l)2}GKIAHB$X;^<>9r{}7h5PBxahtrsuNzD2A$blVMNk@
z)(}($I+-#qv|=Tx^x7WwT7PZ%^Qi)ELV2P=f7af#2=rORhu~wo1H0>I1;sNusY||m
z?7*KLT(;H|RE_uujxeDnPmBIYNn+4H*-u2Teic~w$QE~=x?PR58;c>cR~IZ<#(_zU
z3YOEE%E#psv*74Xg$@itH)$E9Jl-gjtWJZNUTN0-<gR#&n3+B-RWMdHYW;G3h*7L-
zg!T3~>r_vBabck^l)+j_hw@Pn6F|yJQ2HT-=3wWn6FD?Q5GD?Z+i+y&nf8@IlzdyG
z-v-rrjw!C7X73RwsCXyFWp~W_cmdrP-BIgsy;OkADIMaL;|z88{3A3AZRiup3_a|z
z4-<Thp!iJe<?Xw73_9Kv*f^jpBW-6WaQ6PG<6p=PiId89%T=}OsVilKF_Qy#;PY?R
zqDB{GlSWoWlnMsJ2TEQrj?1Sm2{Z;bwFKPj`hOKXl6sr7a{1J3s8#+d>siBJWF2{H
za(3)eNxvo2|DI)EV-Q+CMHoB8r&Qp7GjCTXM{&kDy(r!Q%8llbe8AqCdOP`QHYi<d
zd3zJ#Fv(%(@L*waQ4yHkyY&Q76Et9k`~0I_owNK7GLs3$`^1KU0T`yT8ujHPv(0~x
z_>8fq(o};gLSXptJBgc-1MTU`hM3~R6xhSPS<0<u8@s*6?Ftn)HhyKH8g6%3(!j|X
zORk4MQCB1OUzEqHbrWXfkT@E(z5%*<n$0T}EC<=4fGs@y4$VA|urrfpQ?=h0q5B-_
zJL5n$jHmgghxms6z2^rJ2MiuwS8-j_b0i=BMdJ3n@6-KO2s<gsJN1g*!>3Mz`{!yE
z%*))qd@(n_ahKO3HDWLlh&{yj43l7*BCJn!z$CwZDNNRaUv%^yd<fG=IXLTv{_f2w
zweVR0Zbg$;L6jFu`jqEea4H-+a?C_qM|QX#3FDns)S*kK7ukRo7Qu60m<hR5Ic9ba
zX?F}$kNJ^-S@5-surZUqE;*DrxRF7<?t`=OH0|VsGO=yq=uc%!K>tq4diIiQ=7lax
z>_z60(3{b72faV7gbtNncB=I_=q6vkA9jAD<D;V*!)ybm_g=|aH;uM~SE{KTX<K~0
ztLbrn?Yr_Jet))J=Hw+jeF{~Q(P39T*E0Zb`E4Uon>sF!3VqI*hOreFRZef$z;b8~
zA;#9h<;lCV5t+1M{7zOj1O;Y#R`+k8yUKV&r125{egBYSO$-(9b>SLO6MFSZJFR}_
z;ci}a8QNZ)c|X~cX2RXR8c($H$sJh-528YF73YMF(r^NqeBn#kx|^(6WU`TQxc6Y(
z*qdL~6hcAVH$jKZC8ZSpmuSNr|4V&|gO{jt$y2j*=Tv|$y*cS{)XKcV+4<1b@96X@
z44>w>E_#d_WIG-O15^k$H)fn>)5u?%c}$2Tv&0!Ly?|adANuS|jSXEzbBh}Gh9PC#
zGZ{IpT0vY(ziyXwE0ab<m(TBI(x%7Xi_SI91!JI*6Ew4Qu|w`1;EHaVRyV35BPbxy
z=PY!)lT+P(HX)Ff^J!31<0SL#i${Mhf;N9I`lXWNWLfB>znOaQ-Msj8yXOEGcIdPE
zbhEVKH@I@Q@i|`V;g7{bn?tp>EExucRd-)yXUk<=Y-S_G&igcPLAAQ=VY<$B`R~;p
z4#9qfwPtO29PQ-nT%|8!yiHqua}Ul-09`JbczcIriV{El&I#X{y*xwKUKuHTTp*fq
z8Aa7!db5J(m**!<7w30eefM|fX#D?pl0A8AHF$ND8t^c;7*t`cPy#}~^Ygwwz`Jq#
z{gQh(q{NvPokXqb$U`3j2lOC@hqv3*5yhq}flV@!Hpv@{87AvoqXvKbVl(F|7rzDi
zH;-)KZoL!LUvV_#Wh~p5ia&aeBIh&))hzl>YN}=y$TJs~`^~xLeAJu4j_v<ARXHYl
z*eNc(#BqyxuHV!@egt$}-v`z%&d=XQ@7@2|xb3BOJuT+0aTvbbd*AW5tMg9q&6{D@
z`v#$hwT{IqlTNqcXxD(_Rhy<^lxo$Vvo|^1!uz>{r*{|doS$b+d&&?De2>3o@h(dS
zZhtEcX#>|W^U?x7&Hh|@IFSV3TU;#{TC4TbQxCQs__!*w-F_p5*)eqTqD05WxH{!m
z6(a~!I|{5lT)yHfL+G>PS43Pp+fS-V#!@+Mg4#;_$jvAnW<!>2R>R{=I)r*fl^EHc
zLZ9_*d{kz0$~n%GT1!}MEg?9PMD&p%tPS`7V49x{zhVx%83|DPxUjZ+|7p26-*#tr
zVNS}ZsiAFQL!~V_!b>=OuGuf#T%i_?&~y=jRL`(Y7;&UdPOd)henLjR>DBVV>fQ3R
z@|xuBy6RC@(XipC+Z)3cy3{m8W%ptmwyNJH>!I*N1@@sPE+^Ma0kY@L{-)VU$eE^f
zZhY~`|Mr@e+Hc@pGBC|-_Zq3sI?O*#Xlfqv!=8bm8|9u4zPkd=hAWa1`l#(HzpmBr
ztAIM;@lMsbkTy4Vxx=KJAZqS{z04zn-AE002LKQxz6OE}#+o^iw_KT(L^p^oIGu29
zIC=`Nb5$Nzg>#L)zN-8!u4M0`VMprEr-JW~(xsi6I=#!sTM7l4@lQ3>M*fXSqb*7z
zhmFQ24c%Xy|G?e)W;~bv7zO!l{9nVI>)4KNYBkAdqswB)?QZ7X)zTX|!DQU|7grC;
zEHrmV6&+p9it?W7E_c6i4k}u?FAu>iD|5&dj+MZzt6ebL3Uk<j6eLUUg3ZgI`DLjS
zg=p!61d+sIiDvw(Pk}X97;Ab*<;h21p45A*r)+ju?4NKN`QB9R0f_MbsRg8^`1kUs
z?>N6evaWm2!Zp<0=sK?^+3#69HG=;B;5NrUGtYh^{kOla^<g5%W>0X6=-^Q}<4@g*
zRRhj_CBwlK&1OwOCAsz&YmJ@b)Q|aII6Pz2MN=OP59E-xcE9yb6j_$y_KO3(P=+j%
zz-_-pbBh~x?75>-G%KAagjCm6<-bf1F~Mep{VQy*4*WcAQ~ZPbWOF0~*Z-Cayed|U
zx>lF5<Ej2F`@|!Qo0bFr)wHH&Jf*-s>P1P8?+F3uZtp=%vtv(pxYoUv6eB(C2*WRf
zo_frqnPa{(Ui?EeC`6q38MF)6`j91IxTqkFKVo4at7ebmtlHl-qh8bK$TVL3zEd&B
zr&;)ogwPa=OWkZ^l@v4epr}`8N;e~lQ7*@|_}@Yi5iXL`PWGXr3bwO8TN7<F=ge81
zY7AG=BQN@Kch>HbrlOTJGK&Nkv<zkTV~t+DVtB}>&0(?t)j0QNs8+RH{K(1D(bm3O
z!y8Kx(JhH--MZX+>VSc7r?+`RrmflQLzs4CQZo5mEvU7ky&@s=E3=)yCT-fFhSi4+
zs8a4nyYgAVlBM54?+Gdqq}w3zN6G&w@+#MT?Aq1?tmYG0)Ke@svlG6uba9Xu1k>Fh
z&6@^YfBY?&;#;n<uu|t26j-_VHC3QUD6*gM*6@B)@M?h8pP>D^Rw|(V!`nBRm^`l}
zW__<^E#$P*J9#C$H`q1bIiL3MwrB`A<g^#kHLm1sU30n*Vwb#~O8yV_+rdMXKz;0l
zu)(#)r;2;+CKYCNd?97U5keVL|6z;`tfvEBG4CZ?Y@GX#q@La8G3~|0Tb*Z)i;XTt
zt^NPS4}9yo+xUA)E%xeF=7k*a%46#GAC;EQO3e!K??#5)w%wJ)oGqW+7%u+}+GzQ7
zcgCV@UmNLv&N@0gdN@_m-*N$%+SlYN7GJi`v*+AnAx<UGYMT9(=`3$mYYl`|`~K)v
zEJ?grvisD~Ai^d25dO2__!Y2&P_|y?E2i<i-3VO?;D)O+XT;QFd?GsV3V+OB@%Pgj
zH%`<wV>&%eF?B#&_J0pKO*h5W590Ux@_&$Z{W-A)mHUM|vW=4MS}cxc?a4mJL^W5I
zum~ntCAba>=sFlAF1nsx-<7Ccf4pCnTDmztrhjBB6Z9JNtutWf=F?5T4axE*=k@!}
z!L=tu&Qep(=qQ1B$-9M6DIgMR%XV7SG*&fs<ma~_kv@x!QS@K_zLkq#uW2c6Or?A2
zS-B{Ycq9^v_}m+;(d$vz72H<yZOYMTdKjW{g|_0lYG^dOM@-)NIN8&1SNKGZ9eyBc
z<$TpuhbjJS1TjTQ$tiH$5i#F#{llGBS1M-6r<dDxx&Y(|k{IM8kNCMR)+yFU$bH>;
z#^M_`Y>|xY-iTHX9PWHz(GDLbl3=oVDk1`&Ge4P%4)Tq@l9~MUcWp)_JGsa9KGbme
z^bbn&=h@%OmOG+O)S%Z`bt&?GMBO`{M&uf$8=p!GFgIjccU#14Gv1vQC^3LtbWNO0
zjJ{;f9CZ95dPZ<u(8|4gLc|=@bM}+3(<vqN`XI0WX{4S%O|-4>_Vt$j!NeQ$RBkfG
z!}Q$`BH~Bc1{Fo^z+{%go>9ihrp&1-*=AWLd~TwH)B0(Z=p}2i<t1&-YB~+A1+)dn
zxs6q{OU<_yJ^$P6?LhiF{r0^m92ql9<CJxisvC#Sq_%rD5)p^r=Kc#6GgepaSe_Bl
zDke+$D}47!Iav%A9qxT`G?GVmC1PC7a|84isDQS$TbiO?K8v=_nLpi^;ty>vHdN{T
zn385ZcP1q|p2hlvrRbQhcPtEsshd1nW~=FUW%6h*>@a-2{f79Mg?hO~>ar!Jk10lk
z@%C2l<<Kpb&d*Wa<P{od&LA)?tNqOsqPIYehb~1gG6LReN)y<TlAB>~U`;*yEF{x2
zbNA4uzH9S<4utTj&yA3ZtDJHOA)Hz-(79+e9XQ}fTlQ3-5xlRVpHA7;Y8l441g$|+
zdxa01J$sfqgum5sX?`5UO{l8l?I2*BrVFnY9s5E&mLU4)a;JG^`b1OW@9e;HSuAs#
zg(iZ#dt`HMAqVYLbb6={Rz}Bdef`m0RSh|%H}=4eN6Qb9BI6*#{@*)WBSE9wX9FN0
zlu9*-HTK38*5;V`_z9~Hoh81ZjNU4Ek<p!(rLnw_MC|(cS#f>g`u0xv?DQ<b>v7j{
zY40xE<KX+`5;fMhoNQcd9PI4c#d9?v@?K-`$9bpVjr(C2&9)<-Pk9eHO9gMhT*58v
zK!eNDV9Gj@H4|M(3>`_Cgx7J}uPvToX8YnKeH<5%g31(vDz@q`WB5gau=X*+r;503
zU9Xzkh)(d|ZiKCv-c~pr{r9`L_2GIBN0u8sJq`LGO$#>fUGBbG;c!#(cACB;^K?V`
zd+u<>lkJ>liI79Hj;D+J<fc7&iaqNB`(m?%gHn96<4+6aZtgEaa<?A)X};ty-+I&X
zUB}#{h&cNZp@_(B=oho*icDi;<K5j?SuSzsG3Oy6SeYZcAB1;zcTG%;T^t-lnni#v
z5F1s8Nu%}8bZy+Qa-=7xdC8D>^Ge_UZHXqHQ6`NrP}7Vp|9rh)OmSg@uUoPK3IWGF
zR)vrZhHTVWo)0>7&~yIsf%s`DDtLeW?Il<b+fewu_Q)3}=VsZC-N5y!n?ilSset44
zFUtPcwspOiV@R3;i=4>9F^f~DaaEZ;>q@n9TPsD7MGGN$oJ9De$e4oWndR}HJJyZJ
z^Ec)JCZQ!_V{ZcffM%Chw!J&hg^$M0H5BhA@j8f>%bIgKiiv4Lz>iVHsMRpb)N=;W
z4b;RedA@aOD*5kbC+(S8D3RBTGLGU#y&EA&3-RFXwn|2K;HmN!o}CW~)rLTiMSTby
z?ICXU_VyjsmqhW+4_^g1610C1L3f(bL$+;b{hSomoH>8jQ^Ji^?+$A{pl0^<ijPiS
zpiy~G<fk(^0}NcLFw1pLR`g}LoS40V+7YtjkQxlBicl&&+Z26U5UOEc8yvvf!br?X
zoq4q6Fy4wo>LL8X&1e1bs{d%F9S@mZMrGi3-?ate^-}*L1y+G+D(;Whggq1Fj`lb<
zV_bMkkrT)-Fs8OR1Vus8(Cs$PG&cW=c^oxxPD??O=L;w^R#goyLz7I^U8n*3(WhsT
z@Bc`vBwIGt4Nlq<HK>K84sZ8Rh`A|2%yp!bamGe!2VHkOtbDB-mS`AAq=iJ3Az?`}
zMT4#J3>1K12+#;J5>);95ia9A-Ny^N!R5<V7OW_BajBVN#f-7KPae|2^rwIK9EI_p
zvLK$3Xo2Yysg8}>|B67|H=YP+-K^l&sAw&vCB~S3qt6aJWXk=SYv@-1NqYRKbCPlc
zbbZ2})+++@{p28A#5V}Vl@1VjeS0JDJUlre%M!qjT+*SD#qwxs1P65CBc<$mzq;_7
zz+MgEqPi&KT1sLmt}Ei0$9#Nl7SoykA8l_P7FGBC4UYk+luAjX^pJvrG}1^(4J9Ek
zboUSg1|ZViAT8Y>El3Vs14BwT14H+FxWC`~d7tOH-v6H8d;Z}X_Bs3PvumyOS!;c^
zNEC2t6zCF_8kYnCnr$j36CKz4SbYv2vX5?`RLw&bRrmL3(}~Z#k%z8Iax1U{G0UF>
zp6+e)AfPW-D4p<Bpt^Y|#V7_q6WM>u$@|<YAqYsXqAO#^UE#TJX2UEa7S%7|`(At)
z55OUQJ!bX;@n{YyB)@!Sg1{V`yppf$Q%F;BwjTO5HzgB=^Eif4gd>ZkcC_Qe!zt#7
z+K$_=ek`8EW2qO{`Yd#D=dneBQ=(bryIzE`J+3FHJ9<ztFYv)*JxC$r6Ip20RNKXp
zk*P{#Nu{owS<qMh0&PnR%lG2OQBFEZj271~%V_CWc<xnimk7x}Qd=de|0ZiMLr2gJ
zVloYFHQY{`vhu&hr4gMRlq3-@A-i32b$#6R#!UXK&e*&p6)_W2tELYgOR4H`Qit6w
z@5bSO#jYd;oT7_u2}6C?d{o}L#SBUF+E>D2U~(q7cmjZhX=#zMtJjGBZi0Pi^`2~L
zaG!5(9BRP(o?65>X*7c$X9V@f%8upIMc*_}$>)3?l)<q&_P*ywQT~tQUNO-e(|e#1
zRj-oAb6bdwf9u)tz)l}Jey!oY|KKs1r6r^yaX;IWJXzy-VH<@@TBPv}A8@Vd9|emQ
zq2#K`9x_SQ^@(TnLTg^tlXS!>zh<I3ruTM%-d_x`F=I!aTJq_!AOBuNw>0c_;t(4L
z01h6ptNrn@{s?i2nBHZ=ri`m+lCizSf8W~6{AL)LA$!J<OfJsX!2GQ6XS6N~i|j`J
zd7Q;id&*cplM2n5Z_6d>H~gM6uTaZ-Y$IiC_$7IVQ)0iBtKiQR7gdQani4bY_QZas
z{ogAN^)bP%iHlM-u(1ONCEKG4lEUkQG0H=ukb9qXgu64md(I}n00kH5!B+#?+rLKK
zw>&%mCs)WnJfk3N05b)C`n3X+7r6e9VmXbPI|7eDe%ZfW0UEC$@LEa+rU^O_h7=GY
z27cexAZL>}>WOf#AP3Q949C8_D}X{h0vU-$^<zpY;}_&DK%nR!`&5AQ;67lss)9h3
zQ64hDsgMW%{U<iwb}0zNB(s4B>ig2^EcL+b$unN7gfs_MkRME5*yOhii2HkO{<f_!
zJr&;dlTSWOVWUK(SRn4wH~}H5WC{|{?+0_a6}9^z4v+g@lns7;DdHKUp`igh&MLsi
zSJlVL3=pX;WTV(a&Hc-O2J&<%ifP;dDat>Bh7OkAvaFF0*@O|dvhy(0i0K0bGLN9H
zz87H%iFf>9|1G(9ej;+TY~p^?PDclHP>^ZpU~#NO;$6_Q(k2)?zL_N-n^c>cK`*&_
zBuYoe2U*u*VPmBR0!gB<mxmmmfclu2g)aQfX#p@8^6frJ<+q-<ZsS~B$JcV>c%Tpo
z@I6rUp6ycw^+XLM*8R$oHw(YA8mTEbOm8_Cv$^93AD@lL#pPB=ECWaFy6lv437!79
zIs{;RAPHL>f#D0tfw700`f~zQ53}>vo>~0Ku=fJDW$(^1?y%#VSkkb$khB)*E&n|r
z&yGagj=tJEuY1}_?b#J}#u}Y09tS&w=(9Bw_|mKT2Ub9_94B@1FJL6Kt}w;}Y+ItA
zbzHWKir|+$WCpMueSldClnsP7=zCo2gtR^*xnF59RR!CkwD;MY!>MEgPZr!(p$rTJ
z74Ov$QF!`*W_H#$BT}Myc7x;oOmtkacBSRgDm97bhfoUO)*v=!p$7Bts5|#A0JGL6
zJ!t7Tkz3~Z)V~u_26`X33-krp<bmtA5wLFp7x%MUIzbQ!Pv(}v_W!1sJSo%jUo7DN
zuBQLNr!9eHx65i@aNSeXAgI5M#`)0bzVR67dO;wh7_?qufa)L;RQMo94!aM;E&JWd
zDnFKA2Y$hlTy(990FfEp?SIyPIo||-o|OWo7~Lyi-O~v&#o*&lW~i!>1HI=rbbHUw
zhm#qR0R5qO-t8|7%+`?H?d?EjJ4pQ1nVUs65j_a>5rFJLncI2v1QSF6Lma5B9V_<^
zNR>&N_cr1ENqNi!g!T68{T$a3K=v}||J_#Jbm4*O3#tt?i&d*BHD~$8KNRa)#b#+r
zuOD<!E?>MQ!e*s=g5uFI`-A{P&U`dl#Wi^pq06iw@#Wh`U(_C1SKCGw=;pkrE%%=I
zZ6NKbtEMAE7_V3b(QZWbx!<ANj|qA2!&K0$P6DEP3bguL`+4|yfXZxj1!p8fO^%(G
z-WTY5w8WXJ8cJ0bKPE_)#$bf2#lonxZLoQkrFFYYR)sG4dAa<o&CqkJy@f}h$20>k
z@A>V;_!h3tWI&omS2UOyJbO-_Ea8e?AXA52z(isVE{&IO+>ZhPGA3>pi;TNZQyUeR
zJ6>>+!xn(f5%0hQ39g-A`^NPjXuJ|WxLzFE*y^MdZP{lIWTDgfb&fViZ2|u12SKf3
zAiC^TtLjs7g??-jGFter{l87*584~45UUP4Hl%?{b;NB;*YC6J8j|)*PM$pn2KHyd
z9r5>Z0ZtSADnC0@!Jd3^=ySW?`ZWJAzgkYcQNb$rmUilFM}_2_EM(ux@gcRcyVhA6
zWNqE$;t4s&)d&^%jzElSVU~lc!p*oXbY<X@FTQw8SL}stmuTYj`J@$wodeujw^=#G
z7yAn!Gg2bQWHC03tEr{){Xj%b6lHSe^;HaFmCP6bT?Me@gFZ*-qCN*^B_pa-#7bO{
z%QkkXsr_8bKeBj<+ZsU|E4eA|$-MXGTx=k{mZ(s0M%6DH!z#SgX&#Sww!Ds5CVw8Z
zQes@qJsu=&Qd50k^%gS~#Xxz1`*c8sAAb)1lqF@kzO=q_B47%-@`4_G1H{f-Z`YRZ
zZwWhV81GT9U_B=-J1S73Y*A%Q^5tJ1u<w6R{yQcFnZCyN^ZszIO=XfypC!5OO5ej@
zeoA%6@8;oF1B+=jg0X&hLIk)t`97uZfdhh{#XbSub>M_?lIAN~5ohTA*@Yr-O<%^o
z&xVi+0^q4Qsd~`woUuh@b9yZvZX6<}AwCP5-*lp<WRm=013df;MuoI-X!!*K0q3`X
zj0nT(zjvZebZfaZhF3+?ndJswid7`A7d>r{<I^jn34xow)X`2fNM*bDk{j8OlDd62
zzJlFmhikvDHa_c&98QG@RxmKeNT`EAw7{f3eY<lRUwd`(J*4vpj17!TyTwNnpD_vu
zc&n{VMh7`nI1|ZL$M(0FGjMd}^doz8sV;W)PbqLx;=-Gl_=Lux<&|6zr~%kRe-~F9
z?}WwsYF&&6pD|)tTE47{`Bn%X6l%)Pxn9!u!n=MhhUoLdO`dVOAS}<W&aHE^twtAP
zvik6Tm05Dsp1ABPLyrTd&TT1EZEbgI>pr}u)EY-mZl_kZs?Mw{W*eCWEWN*NdUSkp
z<N9(=9tb#i4D>jZO>B05B(!*?5Gq*8ZP*b&6ZxS5c6Hfe^WoIT#48~3;hCx#_J_&k
z!|v0mIGwGU0fTvsVbShD#qMw(-oI_Rnk#*-yKvtk?HY@Ncv_^L&XP@KZ@5x}o867s
z!0O<<eerw_nT3NH->;`;=B%Ssf#?2AT!OHT9^ChL#1Vj+Bj<WF->iSMaL-e)mToYP
zG(7qTMG6qrcCbt1=qWL%XhG26CH>*}IGAhep$P9MZFWxkj-u*}-0G6t;*7bK!w;Rm
zH!5<>!G+^17V|nA@1E-2O?g8W@u@50pYF|D!D8W(!~*4WFwMGx=v3vL9VSxp8pX`k
zx*R6O72FDIuN|c49eXJYnOAGWTj_|*kDl=f=1sbPjHUC`O`Q|eF1^Ber8Ty8Xlw7#
zE46W&rXzy!CWGW^Sy<Mv_OR^!(tKs=;^}5*H+YS7Ice_Y+(DW2NkPkV)~d813N}hX
zN91|1FiBY5>#-X5<T0*4jZNV|kX6C2Fmk`K@n0Bq`(j0HTV%83MPWj@@BBm^<4gu|
z(N)37$yCA9R$oeIQQL>^a^aFZdhjTdV>YFhd0{KJgFOoK8pYb`SMtT|9K5~8_#a4<
zQ_5j7$0Kt=&aZjZsRQ*U?A!$5-J6WE`f0ovKt{0!m4txQG^{&x=QWrrDolhVe5U*!
zh&~7grYv>j@Y5{+P@cA$%Die3iyWw#LI=AxxVO9tPpL2>Gw~f&t{}mcfeR+el>IS?
zH5f2}q<78_U$zL4qspm!W}_xj_$<r;SjD)a?A>EvGwU+*C#n6<T535=YT~Vl)uoi+
ziu>poqB1Ya)AT};air%HP^VDyx?nT+9Xe@Xab{;uopEiweCCq_ZTB8>p8mE|V^E#S
zK3WJNRe!irwcW`|o|+QEfZJ^hej+zCC1i4NCvhvd_^ranD1=O|=5~5@b9ga?k>Y?V
zklN4%)3$tW22vwx#S=$3j%kj;kBqy{EXntu5whA|c0N9OR3}gR{^9ys9scu8GpA_w
zA5R0NDz11ZR0ehD=4*P<Ovz3w+PWw2rbR`(I=)psicL^-qQdqb?&(!G$bJM;3)z{X
zEY$)<yt8WY%y;eD3_HM8z~vwf{w`u|*;H&^+?%73+<&z~elajr$mFw4YMrhR{unA>
ztD;;h#8J=#wRNbgHB~8ec9Plh7YMz8GWF3#8|cK<@K|5{J=DkO>#+BOXLl=Bw0E9%
z67=f2nj$yn9%{24K!If(7FE9~o;<vQpr{JJ>!;E76ByXw$~wC(U(Saf>NijBk(4n9
z_KqwDnL<|jssx{Ixm0{DgK7R9`7j?$Q*G9<X@v$ENdSgYgf4}acY$9SihVaM*dLke
zZH=4Hp5~E%SMD{iIppU!9+5rr+t^pbim(FI5VdbvC7DY`As|ILg95xecj<03B(fvo
zZ0Fg2P<}v+Y*xH}!%OiYk%Kc?f_?upR)pH(OTJg21S#t?UFh9`&6%2Nk)x_YfCN_W
z`>bTo^mj_rHr*7tKZpz6;kaWN^_nyT)GFMU9H6ITwRZ8G?tXRgv#MR_ZErq1B{k!L
zF1GwLYp0yjs*|b)8_AIZ)0U%J&6D!+<En8o?PO2XrsiFq8%Gwd$&|=I7LXi1@CB^x
z22Jwh@A&;)=_ljUMr*v_Q$y4>8A2M1Ly?MsFAY7z*1X~rQxayqB_Pr7?yHec?{=rp
z3p(gnqaT@<sOvChSJ%zVDne>wJ)7fM2QARiJbcutO^xZrGK^tT0tEQJt#`$Rf$cjx
zqK1NAFR>Umz{TbfPWINbps4<9gZTNEQCNpE(L!mAQhdp?!ZwLbgPk>**s&YUBU+E0
zdOsuYsHsfzJOBB5Sj-o!kZ5q1I<T|Z=nmb$KfPVqQ&u5!TKrLIsy%FTCZuO8rp`Yd
z@v6tHcgJ#Kb%K@Xq5wLyy}BTj3j5eu#CY61P30eoB3I|-Gt;I*v_IW?^J)(Z7qs8?
zmlhbi!eVLi=Of56Cih4oFj4TUSW73ex-6c;j$$A4*WpD@D>53FQyYD$sH%8|DhQG9
zVxmJ=hANjfi2FXEO&Iq+SvO7N?xCh`2sGzT=1;C{h(Nrm%bL+o3@2_DwW2AXjYK=>
zXnb`Oa2B<osO~hF%I$ljYf?cI2*kVtpYvGHcGh|rF`KGytI`!C`mspJ-Ei2fesN?b
z?yX*`bXZBVfSnt$4~pj(;$vrDVo}#~5Cf2X1!{k<v59B9$_A0jnOmXOn`Z#0)>%&@
zC{i~HDC4HRN-VdAw>Obrr1bxJlj5_>d*bh$VKTxKH6_zgX_0BMsj;!~97JG>%#k=(
z&9!&sZ5k8&TV_ChH!2QLln*}4Zzm(+;{#OVBKReJz^Kncdn+bmEfaR$RMk!;ZzU%s
zCqWkjyG~$0h{q#9;g+*(#(!%LIMtgelC8n+E6Z!E@uazV?pxue6=`uM1EYWH^O3PY
z2SAoWB>sMwhv=r&h|EtF^|fkrWz5b&v~)(b$>?Sy5uofh^*ndQK_d?AhAn_VGjRPv
z@42>|P(X%q@){Ez<5jWmtUj)IXYO)5(OI+DANB%Du_{2Yg2l*H=m(e=K(1W`c$2iT
z;Dtt0RzXPt#5I=96W=&Ku~T20yy>kFB+2YDoI(o{$|lHKj*6}6S7l**10`Srs>osB
zVj;=kY_z#UcZ<?xe+__ETCIwdzR*&yE3|g4{7LxHJnH3srf5tid8b(woAnpothvOD
zOw&O6(#C$`2`k<nV4=N$vF3O8^g;|8f&CERG84yCqNgBNJ%0)cmrdXeB8zvxnFdQd
z^20Vzy_hb_kn?+PZ;N@o;(3#>O5T|dK+H3E?(k9tVlW#L#eE6}jhLqpP{cMcSE3AO
zCvMbd)wOi8LRRHQ3gx8tL#jEg-Ev<4;?X>;svp@*8TJ-GSZ{Njyoy&jF>C`F!GYB-
zKVZ;Q?Kr+x;6<@T;oWsafFl6@q#fIvVFUI|L0Gv<AKYo^+XJ+qH?y=mk_K%U3E+KW
zx9|IKFa-lsByA-VM`<MY*7uV4?>|rFWKBwZkwDI=%avl$6mjQw)qn0p<^Xplzi42O
z&F@qVd2tYu^-Ow$)I69sNdRFd&)f6uEPysJvf1IYsB(-!H^@l$gAs*zRHc@k#_(fH
zt<InH8y#Vq0&FQTuqPF#LN(h%u0O>u#0avE+Jca{<RHac;o2iWnZ;`tSlOQuk<G*L
zB)lG#Pnx%%rIhrx%HYkg=kt4hmbZ3yK4<UK6{nvanVmVjZ9*WryD28vpqC$6cX#Dn
z;3EOM@0qxHI1n8<M3q_21ZwW4x>T?@QWBA-B3D^xsRL^;kM2K<#{1TGQ8ZOFSks=a
zw6#?s!5?X?Nz8idZ3~}G?nl|bl3sJ_dwQVU&C}r!A81y5R#T0J$YxYlzJjVN=a)fs
zs4ya<#)CCAP;jC}Zxq+~YIBbjS2f>Z&A3jC0y&3HxFkppII|n{jl{Bz3Cae^jFBJF
zAnxxr;G-+Hs%xqpPi>g0D6-WlsZmrpbW&mSx=>WmOL|vUi64FR=Dr`plfx6&f3bjD
z#_Qj<AI{y*04(R(C&23X*u%0O%fEXVGDkG>=p5{9T{t^c@8dW+6;2%*TR>?ekb{yW
z3_k$NZuQ`pbicD4)_;9Zi=j#z{T3t#iNj2Ru|Pf62Vczd?bxQhI)9s#LLPQ%*6!u!
z9;N4V_Rx4cTxTD|eyl%Q{_@f@r;4R0NdUr7bv!=P2)3G_-MR@TBL*>W0dR<)GJ_eI
zh}5z{0oOqKXH7+}fO*mI&NZj#*<(c_vzfv;q`mLBW>5q|gZ-Ee#J~@1ZeOERhphjW
zYvq4s3^mbHwv=*r%q2-MjcwRl{u0^MlYXcUrC_|!AF0;lo&Nrn$?LtrTfn-*zI{?n
zaNmQZbNpw?)gRlybccbkRIwC|(aA}dxxv!oWE9q{Z%W_uK<SEKV2T@h=x1C9%Sh3)
zh;X8V*reAN!5@hTW6{mL(5{}{=v0;lwKK7tZyn~+ncWAE?t)yxfL_fY#+%OSO|&yr
z08&S{7MRnvJi1a+wndvh8weMeL>xrP9*APHCBqFHKAL>%dMGPX`tS)yI=@H3qr;d>
zjEuL``SKrMs`=QFQR+%{jpdc)!>wsO|NWS@;eCU7pB9NQqO+)nBC?RKlddp9?Cvna
zMfab9aPh1Cx4-e%Pk>h32S(cOy^|N7n*Py=*zD<k^57BsmYsQ{ov5;mYRk8{K~~D2
ziu5DQ^Zs3tjr&7OgH&bc>_GH&VY?-XEha(b=ECj_<F!{(tXt+aK8Boy4@!Q-?tQ(*
zciIob)M+h0Syo`G-#a}D4b`i`ZXOYLH+Tz*P`edXcjRTGB9ZJ#KAR7_NJ*DluDAd2
z_-tUUt?R|JyT((yaI}@;X2x{8tYnyIKL4vkIPaV+jA=vJ<5RyHx_DDRwBOlB2n|#0
zrao%(gy%s+Sw^h$d@alJ7K$@3mp;k*q_?1(yn7+7^_LwQk|tTp_^8;M(_XZz!{)D-
zt}yjgFZYsp(!J?zOu{)+6X(88X}MQu%EfqFo}qWYJ^Z&VysL?@r#(k&_UBqRZ%T{B
zzTdSERH*x_{c|nMW|RPW;OcMer>l#1D-b@_E|U0_!TP=Lp~<xfqBj<u<og15@6eqA
znj4*9cDBP->Pe4#BK#5+@2$5m@&>-r@9v7k6sFv7kf-P$*^9;Yk<Pi1Rste^a7XSQ
z&$x%Z`n<9=C3dMP))pD4+<>XqtA|1K-q<x?(VTHAxdr87US${0?^~{$H^a8vQc2@V
zb?I?EXj_|*D#GrVeOZOzn^~R8SZ3tArRz55!Ee$i@Uy0uzP|mj^>pMmCT=rz6<CJ`
zL$&92ZfJr>2{FdYr&-|<gt*y<YstZfn;yPn(~V0$M{!~&RYY73dtE%w#XRk!G@ps>
zOy0{)7lba}&z}JgmYnGAr)rKr0u9;TZaYaAH*Uct95$$WAV)mV2w7;JKlZ`}i4js~
zYgcNOBl=+c=cuJ#F{xuk2;7oT`=05LUanU!*Ii><qdXgzy}k!NQWuY~|4{Ab)0L;X
z@DN;G?W!W;5+6ezU#d;d>$*Cuw=r60xU#Y=7i>slI~$<%)WdZ3v^-0LisK5NgV~rO
zGd4jC#L|ID7*KUv{PvM+MTPR7hNr9KO<x!)5NWX-S&J)Eh6dmk)kl6u`1s9*OSS!j
zLI<X>HiUZYxQ@c-@)?HbXTPtQdg#|vwq<Jqh!K1?kIELOYj!*q_AgeRm|m~(8dB71
zeK-NOme5yNpl{fg!^hjIxw4*nLh~|71-Rxdt~<1L(a4>2bmJhu*FOU+OXK+i<C1uA
zA^j%+Z}YT}@v^<{E&CDqY|%tE@zTkwLta{5&-S6W8OpjsH!12ltH+yqXb!#RcVNC*
zF-EQz?l(udWQJZBVP3RR#RdExzeDrg?GnOKjyN5GHiE2I@&z${>?&{iyyP{NYFd{0
zS%WtO>Yo-)Xr+5H6U7@`>7m|I^4Y6`{3ZeXl&(j|`4NyQ5;7e7{hQrpOuOG>6F#ZP
z68fHrOMe9h@6A=OQx!=qlfy4^*b(n~pW|#NM@Ms%E45AE3%}Ol%35UOXI`WAJ!{hN
z0yafMsB7Cy0+g{sZGH5$qz-kDYjd?|Q&@eR$9803!J8->)=#JllQP>~pEOL6UrE84
z=(kH2-lHl5*|U+4_J`j-K8FbBt|cU{`Qw3r^qqSV%OeV*v?fDBpf9gXoAP*FJ=GJk
zIXE+vAKAer9ov=7%mTiWTjnYp?}dSeH%22U#^!Gh_0ZuJWi+p(o!b1@(iU_gEdvfe
zkNPvo(~C82^EY|M1=PK~@%W>urZh78RN27e5{_<eIC5`^6F{hIjA{Pzs6UR6-<&V`
zZ0}4xY1%ftdg`*PHTTh`QG^?6rmkLz{)6bdxONLJGWkss&-Ks-9M`uef$f(7IPw7C
zSI)o{*PuA@q;az#l1wyZ!ny37Y5#b#wOBLb<%%<5GwXn4%2ry+++1?=3m;4?F%?_^
z;^+%y(${-UR3c{)D#Xv}yZv<B*8d_kRqTuykdndQ$^97OU%QBn<CCzh7TnjWwN#br
z)hbEKTa+e@=gL?7&W)p(I_daHF5R1Z*fWJ?b4s0O;rmz8V&<8CG9FL@EubVuDRAv3
z^DfejYpxv3zYpryY&p;Rwp(^EU8~`Zzdb+UMP4o<eYyN42)QJsLZ;R4&Gs~@&~cVo
z;H<8|YnhRq%M=SF9||Z*XDccq`mV9Xu(d_4>)fZv0D!wp(CS6Kg06z*4CHJCcR;7o
z;<(FRlx%Ogo>TbDXxWjk53ZfqS;4=%J5`WqD=jhV#obcXu;k{l#)t<BYIEBOonQmW
zS=AJI>)FX4oMVBVAi<2Y<(2s#wTA!7ztho>h$L-v?oBBQ=`INw(U^E&X$ebi%J5hx
zzNb}Zts?rYaC}6!skx@04evtL$$qpzhf)7KTdr>8P@~t7S>@D-O+UVpzE{fPAI^S?
z$J3G0px=167E8hU6bqeyjx>P$;rAb7$IhE<5BuL^PV`;(U)}6~O-Tk}_Yu<?Uop!m
ze4uH=X>V!O!^&pa%NcwFc0cF|G~0%c71p>e=;0?%5R<JQuFosD#wHSW8+nzL6x8H8
z#eaWn0td+fQIH_k?2o9TO_dkx*pQh@hFWeFm0E$6Bc<b2NT4E%vqGg#C65gZwZW6|
zVq#?MgPsn3d258`?rJnT=F^30scyX!#J-S)g_V8X07q<;CgS<Ak))E(QP=}rYBjcA
zYUk{`eq*<GiSBko&A881OQ&XfpaDCx7=KF@w}^<~)jG(+%}Y-os$`-sx!&O<Llq--
zba<F43K$Rop{zK#Ld)LPK&TY9rRKFFV{UTs3=f&ob~y4$$EV9IuR3=pp%m0Eqc_N^
zWJ}&^;HM*bVuB|FV!g$lKgDpVvKeai50gKAEZ$Hg@fyQ0Zryknv>gN#w%T5uN8enT
zE4CD+VI5lDueX!6ovz^M4@`weZVGAM0o?^i2gO-%sGKV1Q*J{>KrR6j1R$xexQe%K
ztp86p?0?-U;w(hWVYvJBenuWUAaTG|3VMuSBuiPjSX%b6_;B~*LiIh+laIf=LF?@%
z;bJX+lhHAG83L9s$U3pwI;?R(ZL)xx69dt#v%cz7ny!TaF1?cCVj%uT^BZ{so3r!Q
zdg}3~YFnr+covOJ!F%0UI%QwAGAR!h)4Kywdjy!~YGdvSTI~82nI$#w<-O-XPW9$!
zp{%OvTQ^9YgiRw)?Mlf61*Pr>z@T}!v&PHLo67<c-vnqO#Sy4R*mRMO^Sej51e5L~
z399tO#^_J(Ni?t)*35<!uY{G)^nm+DIveo&fD?JmucyYh!js|8BH8T#_}vmrGzeeZ
z)RdbA+JHsE3z8!_Itry7Ja7E@<8Kv_IZL~OZI*Q>t-I@XtH%zj0JCC0dw2P(+WNV)
zdC#q2d}?%ZYDQXfXWN+>DB{sGP5`9%oL!N~D@G%11j=V0Fi4#kc^OOn^7+y)*2K`_
zl5o;mzUgt*3sc2;=By>3WZm&CXYw#CklI~<a)pjjuGr?VEaO(9NqGC5>-(89!usY`
zr_@$HG|cX!4VS|yW8xC+9(tVU9Bd5=WlG%vMN!{28t%N>#|37gizPQcGn4&&md;VB
z0PgLtB3{)_*3)m;Oua)kjnbxTP`P~o=<cYQ)&6N@iGd2COx9N#+M9q;XPLul4(-|F
zvy)>#+^RP=6&I$=V34>P0B(y%CBL>F2-yf^eI{jP+`2k{9NlQbWCm|&-pM#gl9<tV
zOW&5l0=67rY08<+bLgw8Y5(p%#ip2@M>?)fezF|A%>6qlPp;`YV5>P09M&i3INxXF
z9zV-0r0SM)7ce{kTY#Z5M*#vTzYJJQR6Lx&9fH+xdV8w0*$dpukAAU|cd7KJym`gZ
zJ_}_=lxTqbmH~PPP()P$*nNB)sm{rZWW9ijUfM;^Cz=@+SJ3(#lqjRw&XjgJi7JQ;
zy|#Q%8H_p7k3bP2w`SsqZj0k+_ktubo@Ru}S$~f}fx>c_le-8<gPPk<pgpX&?J3^T
zV+$al$u_D|C+xmN4Wqykw^-AOEGo7FNVK4n2aH!b%blX4-O<9p&ksLbXKjn6#8TRP
zmAQ4su)FW4vi@7$t<Nu8Q%_G%L*s`Lf!ej86*@#~t=juse+$ze7B;~jEzDQnvJ>G*
zp0^#pvD3QF`0tbdG$bw#xn0DLH5&2D^?E@Elk<Z4-(moI`DbMV9|c<6IoGpmS&F07
zSZ+>fSuezzN1O}=1M%yN&Cw@uXu#=v|MqA~h5+B|iy$vrPvI2Cwf-BK=9|q5T;H<;
z+}p4VKVX}&;6K^&=W04uJ}OE2Loju7>8z~IM4xZd!g?Wm(cQGb?!7w*XY2)Na40B~
zIh)RFom+H&`ch4{pmD?JZ%%wgFA>RTQSU+9+gW@UMAr%ICZJl|6`@_PQ~4ef`Tzp>
zb!=_g)%=!MDAo1;nxPrgjLQA+$rtQHT$jAu*wV|j)^NzKg(|qxXev=lA1;^w9e>v6
z<>g#ZMfO<#vO($`6uHgC*|aG$E+RN(i>lXusy|qvZF?Ui{`5BDWCl{KBWAPr+a&Cb
zRIcx<t1_*5PxQ`-sOZu%Enq^49G+IzUM)=dofM!{^<M3+M|Y7Gd9L}=ww$c=1X4|?
zbPNF<h9tVVJR!O>_$vAtsp?4wwGi8l_nHrn<L~BZn&yjA0fAkGz^kR!E{(67l$4CI
zfQP#NJJ5L!TjN=ZYVS0UN}?7s0g!-<bh#nMx>GgKcCP*^THxUG46D~BlphOk9SC3f
zPmX}H=5gl{ZrqgSV33J%62e;^Jjxv9O03H5wNre;Z#TD@jA$?Qbu4%P6wuju0EZvV
zl#(K_VVfBZojb2L0h_jAX)f@vxPEjg?0f31N)}}V9k?^9B69TA<mNhWH|{Thu>kbI
zAP36V#_Jh4yYBr;zWsx}#r77B3kAIl8T#%Aw#9B2j-!Nxj$NhbmepPRQCS-2aYGf_
z%tgjN-hRPqs~yiXc=w$PPxZuf*_(^D5wsTK>v9Qmx>pC6qx{c{BlNZRIFyV9=!M&p
z4lUew$(eV=T-Ee_u7Le`WOP&pkCMlAWG<1M{7)dkBgax7&eI)^dHC@N?#ZRqg$laK
z*eUEgj)+||I^`Mu?>APbL;PtzQt5#;#omDzA1ZJMBDq#Juwh7lEx`Wq`RjL$ZobS`
z>{SF-7RUu)Q34Iwp}voEwFsy)K}z*~r-FD*jn5F{7!en4g~6@YPE#9XF<cF9tCu-e
z7!4BVC<Oenve0{Nn;)89f>rrM5~ue>Wex5+m&lC6o<!}n3<M)-4UV*Z_7>@~FN*-o
zP$1B$9?;i74h`eH*a6RYoql2P_-`((OJaiJ=e^xgh;e>cuF%h`)sB<e!!1LN%H16m
zu;zXO4H)8$qZPC9I@qkx;*CR#eAKU1c=g`uG<x4n{j%#zxV$p%ugeM&wo*XbKhiO+
zHwJvE-)_MX@utgwhWD$<&Bqk4B?`=WWZ#)bp-k`SOHQkwA^Z)Sk3Z?>j(COF9h&D6
zLS8aJU$VxC9CV93!B3*~{N(5rTEE>!JMV~=ENwh1@!m*OyN^rS_o~Ie>0oy08}}&=
z=!e4X!gSZ!t|AIMO64^h+e2&N8P*tAE2g-$g^10=41XB$E%r^Lh1ENHxP0NQV&g<n
z{VsJyOO|E^o_(E$`feZJ5PAWKg4}GMP*G+AkE2A{L3?Ki1#CHE)CGL8fy#qp&f-0r
z*?k8rnLTB#?}O;n{sUFX$+*uRp@r<~o~JOng4Fk&t~hD~&)P3jE-DS>7o##!VmDV(
zWeb?s^3a#SX%pfVv+#rDbT*JUPbLte@_t_tI-4hZEr(bKq|PmYx_F~&@rTu%E+f1f
zMIeNyFB}*txo3l-PU!dpfU*??>gfU^hvdP$yjl5mI*jo#O3(^6Xdocpq5v>ld<4wG
zGFe>+dCuBh5<`7^=j~dSFD$C^(1ZC)s72_r3IUN_QN*{B6M}9QL6*$_h#)rALJ(+z
z{1^ZtAiwO_9)JB}3ny3^u>KGE5F10fLblAISN`sKYmaiw|6UPlaz6{03-A9^kPkEx
zKutkCHZzl|ny;&g`=2Ili=u)m*Z^4ryOlLP)Uf5ML|X66h%(cY9%VoXW&;6Aehd>W
zzUdi%a9S=q75(os2r2*X(ilFPtAx_j6S6)gd-PD+Epht|$_J2wxA=6#Qvxx}j}>cV
zRR7a&+w3T4#S$@y4oe$hU3mL<Y=R#yymgTI`SYl9N`{dgSIbLvD`*q~gK@eozJ*?@
z`x1G5cQ%iBb7}d^#vWiD=+qdG_YsPc3wm<{jCTKc*63Dj<{E90MFNceSUB54K^|r_
zPkVr`E-T1A?xxRsIfVnt2H2)S*+0>7CEE3-()zYnfMf;)?^vEzcxL8jK=S!}SX$Z5
zRTsMH!8)dnC?O>V@rDunZkH@2TG*icTh*AgxWH-R97uVzFP_xV(bv<P9vLZk%$1l(
zj)jE<&FN^mIDRJVATDnic^8xo23`kT&q5Y3x8aHZ^HE>7wg3MXQuaSsxh2?f42iUz
zYb<W`HXk3@)PL=Y9~$b`0K_T+=7QSB#zvihfVBS^BebK*Gxi8QpZ9~#knw>6%r=&%
zHaB+_+6yVxEzhmbb({SA_RIOn&TOHqyrZgtft{I5z^!5e%F)%;+uEWmC~&vsDxEBY
zZ6zI1e#ga?38COK>-)C7%?`E8B`{Nap;u<q)8?<hgcgA>etk(FfDeRo0`f6U(;CU4
z+i25TtH7j0AqK;E@RAMnQT8>bG#Cw#0hG)&H?25|v5N`+XhGfb<U5shhQ2&&y_Pu2
zs2jf?L`>haK145@XwvJvs$ZwFql9d%oB-ku93&#5Io>dL_BR@_xk(?Ef-KY`g!1I#
zn)SvNrwAM@sjIwkYw5WF<QcFTr@?TWVF09P-uK44FCh}4*hkVw%C22uG3>sU3Lp7>
z=L%4rKp?5<P9?px>-jCflu8zcHS*vSVe!gC6<YKhhr<VdT)Y78@te#qm^(^0H=q!*
zi-A=n>Tq&5*`VI##{!Nt;A&6$N)SZzRGcAz#hF{0n~ke90cgyDvRDuhL<a)V5ioel
zfg+#1_$Za=$NCv1Te+Iz*;bwctOB6Wj=@h3FOoY`@%O3G@yZNVPDe*b>utas-2g*?
z+_Olz%n&mN?!w~Y<b#e&S|u^X+ff#ukq1g%v`Ud9{u<R7wMPBP-5Jb>0wo~4=O3kB
z1l=csve19gQCB|z#)m-EsNkP*{UXN@Y4l=WioC1asKy3W(Bl<8*xRdl`<T(=Acm)k
z3~4M&*{n-Ny5(ko^1~`+++QDx_Bq^$H{|+I?zuC7u<~!$g6IkZg8nK`S#b56WB@+-
zPvG&#?nKNXiDwJU*ar4fWkwJ^JuQ88A>+x%{(D9GE&I)Z>E0%*fscBm?;Z~zu$)&p
zer;XLDyKM(#m1+Jxp40Tftz$C3<<&)7|N$=j~-!SpWtmFe!&iEK7PSr{kjIEyrsYq
zDsoVH6}R$j3)Ji*;GO%7`%)6$dA@xlsl;GXfr+g7;Ln$E5sqqNbhxs4WiM)7qZl!s
z8*!iA5)%8dd{w(x$Fmb{*Hl?hze+}yo(D?!joewG<hKP*mAe>7)oie`-lC+~aclS<
ze0X@+IFkZwq7@ZU*FK(vR717)XafWl-V8f8l`NBS*JPH$Vh<AY{iTTvnErO}jd@}K
z-`L3_NR`p*RF>bDO4{(8y3L8T{xCr5Z)#d@HdW+Lst^F2(aEpxe4NkB0>Va>S@zZf
z?g*QX0$>dzUVRUK)D=Qee)6jc8-G17#Au-Z?jJ|f7jBC%mtx(@-9IR2Wuc`v(EEQr
zqfEj@eK*d`<Ku|g?$^3qb#CNcN~tJh^es&0M{L{F@Yru`f6=<>Jp-umI1K79gJHNx
z+nH=%c20IG9t-gsxR2)%I~yxFD%^>eXGHTuRn64O!F7Rt1HyfKrV%<_kDpv%Jw=%+
ziA@0LK0QR8VUT^}wEs3IM5G>ESU?Nt2*F$edgQHTB_Y7}gBLTOe?bFRQ~6~L&8`@u
z6PhyK$lo$^0?k}aBoq62=rp-q1*Z26b2O%GZ}$NCzofs#mjve&zEm(|m1X~OIE^^2
ztN_$zaQ_h2JbNTFtD#{ZrNh|A(Evi~BI6#LWUPRtZmI2OUM}*&krA1A#@Zd*B@Nd;
zT^#%@_iN2&JF`@5x#Ft@!0W9Eg6zn?S9*jZSJ!MeP&^+x(Yb`Pg%sF9>>AO@7s46$
zDR^{jP=8|W-%76L5n2Y7X?sKvZ<tznr1pQ`(!RD{e;qgNd#k+APnI<8dqTg~Ig=@h
zZPWSxP4ivpuQTM(NK+0`HcyoRa__Q@&B}k_PKkKMD5bu7d*@q@?X<h_exHIud}+)E
zJz=WbwLo6tjifs)0Ee1;e8maKo3|W|EAG`QiW4|f-T5B%?cet<tUtZ&*iSghsxsV|
zyQ2?)Bb&)KAI6WCeFuju&TXXe_AhfAdB{k0OaznqzP?HB=!FykDe)I!sn~Ag57h0H
zmC<QXNo>LtZnLpw_2Wdrmyq=L-Yrf?yj)FowbK_z8$K9ES!M_>di@U}jfnB2wS7wq
zZ2B07<^ml)_{Op{@{i^#hC{PY3vYOy2$c)f<H>5t9895qM!Q2Gy<eMbh3J>^s1$TP
zb?wh;0X=Iju$1*jA<};4vaQg*>3RTXMd;~;@VJ3Uuk!iuVWqMFeDC))*prk?|GH0M
zH-0kv;nINMkw<KqfyYX*e{f555N*1n)5&0nO45I)SEiQ>jC?XS@_Qm|Lt|A2tnjwM
z{hToH&f|>Dq@)H~4@FU3q!<A$kHyrrI@6AbTl>&+pNm5T|J9y?>k+<QZEUG-gWW={
z!kV{$?@>KIq1b+kcTZrJmLc5H@ngm&-=HjdS7xpiXWQ%YrR+~BrqHpOnUuj*IHPq;
z8r;)eR7^Sd-<Ei|B;JOfL;*SUzTQi;H@O#VX>N-lz*pH}M3*!rBG=zowZA_TyiTBB
z=>ldgY+=0C5N?ty)ju(J{kJB$RA_hok0!s(bhBh0GTU-_qk6AO)u82aG5v63R$ZF&
zj1L#DD>7&@2r&$$fdD!&r~Ays5Lao7v>NKAEDg^=4)gVK7v)pVSXYKZI<^;u^lXfU
zOl&NL`SlCFr7b44)67cG;uS-Mb;xw+b+~kd#u?@7bd27FDYh%0gmWI;!fa}1fRTsU
zBO2^!H-!84e{r7^bUJ+;D`o0xnqxX{stZwvKwNt$dBtWLZM|AVo1)RLNd8lqjx0$A
z!`y%NyF4M;`21Vl5hnK@c9nYKb;Rzqzke|(x^q7^8>j{g`Wgyti0B85xKb`(7hsAN
znr2TZAXSmCF1;A9{yUxYh3flmEn4|Sz-Kd(za50LtN6J&IHTtg!fMlo)H1!3P%JS^
zI9}`>@>318$#iFI_cgxyh&}1EFnXf$(dw*Tn_C4KZw`KAGW%t}S;$VlVmG+8+X{gI
ztE9{5TydkTJvK0|l>8)Qq%=OKtzcNsRF5Dc32`1!>HXd2KlKo83_~SuAuo^d*RT1n
z_w5nR209}X2=5-m=0U&d5tRO`b3E57M+6#&_E+gUH&5!Lb2qT-zhkw&&hz{h-uZjq
z0g%%F!2%j@=Vf?nLi<`Q7JXq+mt{=o&_)|2pKT<ex^qQk-VVPGqmYg)z_Vzmvo)lU
zJNDlWS)kQlZFlX9f|w~I->zL+Tt2w~;(4Y=Mn7<BS(`YYP4%aX9w0YMTY}d!;Mb+e
z7a>&7_Hw6E8w{GRB3*;qILHap1$Te*hHdbB%E>6lbr?HNPH%z><Gl~Z*9MzLM<%IO
zzodBdV?~>}jO1ig*RA}KHMria)_El7w#9FUj6bQ{tO(Y47e(T0kIbuh!YPREYrS_7
zsEwIMH*2K{Ccne4$W8CRdWZBJ@`FDoRj3A*M#oNfQGW3O-%ua{O+<WhVZ?TuaD5-Z
zn&uRx;kMe}5@7@xYY5EdNu+0G;pO-Gd-}xua^Z&HVk78@h_0>~@!dw@oKd*fhCr=>
zfD7gsj0xjynk&o?3&04kpb&S#o||meNcL~+zD&_%^PU%ny`1sr^R65=t)6g<{&VuC
zy-huYGsy<AKy?wlj-!rGwU_$WG8_L3P417|79=7kqKBttL4k;PMV9Dc>w*cvui7@G
zbYD-Y5}jB3(_Pm0^HNTnuc}Ypij8Cmy{Pktxg-*iR4%)0udLxER>c#D!5MB8MK&I=
zruy8RNsv7EvM#Lb-w?{H&PUlRbBonu8p{J!s&(&qlhO@34}FbPR}sY=n9oBZ9RyR3
z<B+s8T~_jgeM8pz<sYqAa-B#hznsvxPM$HlrnFp7ucQl~1@L_04Hr{3o(#6HHndb_
z>I|a-B5e$O*Y2Ick*r<$#7u=Z7)oBK`iGms-p?GBu3j(z(pzk6V+q@F12DYT_SgIu
zN+@$c(Y-vFSLxH+>#q!-DO8k1Y9O_cy2vI#Q@Il#)M0i<B6u+JY_)+lmY8hTLGxn%
z>ogiBx2ia8|6M{2cWs@A<Fk$phfe*XVYrwN!VyS=x}+oF%DLx>Pa&oz`y;M%)n4p$
z5%{(qE)K!v#wFQpvA3&h#H*pgMrh9am5i0EO^$0s1qxQ~5CPx>K|E`9{i~C7uB3|*
zFAn^ESwpwg1j)Q^^>@8;v}F_TNiq=q)3m?Vnb6^Zh7Opw=7SO7l>6OE^BsH9QMlKR
zv*-3&EYYxoKRPNc=k<RU_EI<c&7wx_uDe7$r_3r--4XK4RIb?)ix-~5ix_I5Ktgij
zEVu=*zt2#gh`RhQfDeTzx?RHn)x%r9?y(@EyPTDdqmVOE(;*NEqhRb6W{vC;fKFFr
z<)N4?9&(-e&5qX<yR8%~s`KpPZx$U)1ygtVrSz4x(u{J~=r&wET@oRSSd~dr^$oke
zrskT}?#d}9;b%wG0&i+r3{^@KTMkowMYCq=ex6?i8g9S*X)oWBrl!6r;_~BrsZMxP
zlp$os+To@a?d5q;@!E5>OQo4<5Rw+9NEQ?ObC>*$+ppbPl(v2?T)yaYB9Iw)LDX`c
z%oA-Z<R*O9qD6qRpPv))JRO)<)nT3Yii<lRm@!a&j;oT$-K;X0_MGNmGbj+7<tFsH
zgV|TT<;{L8lxKfN$E*3Ho!4PXrM+H>a-;e2Y#_F0JF1qTVN=p|hT8hN(f0?C^~lU6
zuuU^h&A-^mPeXl;mgIu#h1PAJ@eiW2hFZ1K7`SbHMen)U-+yRU@%A%TW&d<d@5%L5
zrZe4H4$pJxN{7#=u+&&{eUFaLe!V8=Y=k?2DV=g=9hCKn0f5;pr0I`!#w85*9js6z
z5zv_j#Qo?N&3g^L;G$Ci-`UszI3Z%5W`0kZj~k}N5x!cq_EbN$%``olJz=Y_>$-=b
zQJqDFRGRrZZfNpvUO64?oHSxq8-R$H>BvBupY;r)vS!2^<0sb^0VX^$vI@k~E5Els
zD~EHAz6<z{DztBz0CLFoO=MX;w2Szv8;DGtC9~Y&E4i4Y@8HzW^$t@Bf94>Dn(FT%
z!VZlM>NA~;g$&!$hYw0;7sSkxgc)V^lGAE(-M2!z;8_90C$@tOntE;?m4@GcPE{*3
z(+cePmD9_*)$fhOvWcah#Lh6fa7#*PH}>f_rdFLy?x8W5TH2<j?O;S_(nw0%QYV$i
z)ST?kY&yz?o;3p`CBu*Jk51Nz0Z)9s-Bto(*JphnfcPIKW*N)ZI=!&M-#QuxdW)Yw
z*e1~H=IR%4X3q}Yybr(f8^P7_v0?vN3Rh2n8){m}u6kdaHt_{Ly=1c(X4%>4!^U-l
zr*iiHLixY{N>^oXU$=Pq=j}7;R2u!<*q^OMMcJqPT9=BV3=y>pfSrtL&XV|?X#cXm
z!EdUvdo{IGh#Y~FqP7xak+<es{Z}t>pl2Y;J?7KZRhQG*-=)D7$UM&efU2l}1K{Kc
zr11s9x~nTDRlVXchn2BGs(%6v+!n%lc^fb|nd+SRV+|iX1zWO*gj#MAJ~H}v{w%4O
zD!ND)y!z`LKFaJUuRLAmu_CL|h)jLJU<vj)k@;DQw?!e9Sv+16=wM@Ow?9BtG5B*P
z>h4uLAE$otV&+nh*;b1y;d{#{-v0WHUFk}6oG)LK!{@QCG1YL6`VDTMKe=R|XR-zv
z2m70)T;qKmw+AaHE_Hx>$Sr=v$rH&x)W=I)w8GcpolsBR3Y7YRIp=)&g8L}Fg}9gg
zMd0)@z4OY(5c;YSSqr-j#Javx;rEPhyo^d`|Ip}y!e{~!I1|5`WH#LV;4D|<jf(5Y
z@RKFYD+>(2_ri9qppU30{W|{Bh~^<3dDY0xG^2b)gw%rUllf56&o(Ucu7=faP2VF7
z<{y*6wg$|G**J;L`vmn_MtP4e_xQgxvTh+O-7AGJS|&8D_GXLWUcz>68rv~sN%t!s
z_sT{4^k<^L?~FZ7t@2VGwgKI(@ha`Og}1IwfJatZ83Cj*!JLC*3PS3?I);SBabDWK
zto&zHY^#zp-rXt4kA0Y*aOUb5^G|wBa;a}jLUwd)pYL9I-jR!m`T?NG&oA;8e8rf8
z?XgF_)e|wqyQX1^!Z(QID8!+O=nW>hIsAuuVg#1yOA<=WWcOF&uh%y+qB~Qry4aX#
zyoT=N(fYKFi*c-zJG!^NU6M6htrrun)Gj7RCC=TEw%M?hWDbw)0=CMnSv>3z$~3)g
zf<fiLO7ERjZuHTBSbE*g*WQ(_NW;q^BeaN<L;YHG+3I=cX-qGH&`moaDpKeBTD`(W
zxAT}ccEft?kBdFI>p!;Ks12SjpX}0>rZue<i{hS69WFD@VJUk!>6IB~l8xeS!!K>a
z)3VSWJz2?(xNunY$wcZw8&fQ}20h6-e{uY<kn-xL`Kmh^(P$brHl)F@3}85Lc(pQA
zVrukhI)jwF$;#yDzzL~{>75|cIWHd`^RyFs^F*`~RAQCZ9Vrb2^954<ZRT6gb8d+;
z%y8pJc7+gFuTwNVImCYWv-KbWRwqzEDFLL|5?nmjvmeRm>b=80UDKR#W&g`&{Ex~T
z*=9bQsm0mVcmvn0zR2V@n08aM=j^>rjM+Zv!<_P6nrl<{la7CQfa<+?>t!W__OgXg
zv!zW(&1s@1htb{&{7!xAWT!<a!*v0kg)7QT{%>;u6&Z*7^b3aeDrc(p@@ORkPx33q
z(L1z|ojD;Vcgyvy<iqlv*|$zy=-ts4i5A66nl3cI=w7!vyulT4kDT8*!kq6n^=`Qm
z9-Cg?7tXvZ`Vux7J<z0)B!hWJCAOmt3uvZ%OCv>tI5|1Dm7Mp#CmQW%>~89*l)~+{
zzs8Ghx-v_QL-TMrYkW1m5I(86_yd`@ieh*nAgcLQs5>Hyv7Kw&`zFonrsnI}`_?q8
zt}hISJacC^9)DGvs10BTA}|MZd7j%1))3c-@;~A@6Pve3nE!giUh8HTBL7D1D9Q;1
zfOybcMKO=HV)vUBCRX_#AVX}@`|1slq;}bYI~cu@o0~g*?J$e4rO!md+hWM<TZ}B4
zraM@Hz*5Anjwf^y69H2iGcX)Z=L`lHddJ7iZ(Tf4lZ-aZNDq*D*RoB<p$93NF1M@f
zReu$I`s(~g5VOA5!pj?Xh-&EwqW_6|ZFO$X+Yy@188S(0yYkxWy(%w)-G+HqSs;+N
zuZO~`JLa%YG10D|*sylpYg`l1vyNzx@Ot%e<abR&4pqnU>uC~|%X53UA&}da5Gud+
z#qh(?$BX6ZaM8{9uh|2uO|O5TYIk9RD8jf|XSa3l>hp|bJL{Wlr*Yc}SX`tb|Nc2G
zA_h1_mHj=j;ye7%-Ce{P?4y3lS}N4=e#(to#93?Km1pFuzuA4&rUMNlEb)khsys$1
zk+T^#Os(>!K9BP*PO03H$#rJOT<uPMy=P*+*nH}1uQ1Fjmqvw6(z8z&N?`Wx_=2e^
z{N1*RhRPY%8z7GI!J5uS=nsB5aoe=8QF8K)g2K!MgsBf<0=%GhIBSq(n3e)j<MVg;
zrhsL5Yr3Xk)I(N(j{T0cv3--!)}Z^Gp~m|k{M}7A1Se1Ljx39etM^B=&z1Y!ATMZP
zVh=ok@X%}#<{jR7BKTq6y)zi>>C(|YeXm?wd~%J=EN7x&ptt;W^T)wjo2}H*{f|vu
zd#lCM_H|7@#EdY}xo<2&yGSAQ!LBH4S-1XjB{rJ*3Fb}9^=$gl=<!A9^HZOZ4B;I!
zG#CD{Y2yjLhZL5#afTi}hEB`CU7?Kd?lKu54_XSkJ9fJd>5I9}=CZ1S*UGnaGcQ9o
zJrIf$ZV}IA6}k*57BhfoQ=(N#Sh`i$;MA>u9gbq3<Y_Ks#VMF0z{qd|(V=G?hJDUA
zEXi_nN~T;X-j~B*ynp2J-o(r3pUxP^-P9@{S%2?|tWr}mvk>yv5`%brhVxB7%f!t{
zNmu1#z#Ob`zcjVqM?~+;Hvs%sHRbu1mkGmj*P;C!9I=|?71``uVgyt}T4_Oj`I9<~
z3IyvDwejY7*k}vx^C#X1+3f6unZ_o&y|fy(s0ATep7FSqtwyncdHXUq^P`jW0mI8y
zvUJfa<QKB}!-*yMemwcj398b5%kHb1Omso~W)!VH%%J7vZsfC6<uwE>xFI?hJA}MM
z$oAcet@`Ep%iQDFzHx=oa|umm!w3BJ{C^5^tnYE~o|C1sM?uYSD0lvdJpN|>=^OU3
zHsAKslcwE$?-ym>IWe;QK8LLpv@|;eC$8sn*Wwvp0G;XEDoz%q;Q1eb6*qa8^Z*lE
zSR31Lv%MZrolO86jH}hOM6P@FG!*S-LYlMGRuxKwj5ei!gi+;vyovH#&o|Y1w`AT1
zzX@8XTweKkn0~Qh_xYynVt+jx*VNox<O<zz<o&RUw&g6PeC>QoEn!~3)o|cuRg3>x
z9s%{ezOs+W^UY!>g%59|ed|>rN-Di?S1vx)Yb==dHUd%EBOjuFFs6Un9Lf<ZKDHhE
z7Yo3ONH!hq**~5uQepJmSdy(sWT*l{sK?SN*1xz-M!cOfT+@3vOvvMTI^;*V#j!Y!
zM2Z{@>3cR$T}ix8%iUC(_^>hS=)|x^_0#>Qfk9f|rG5PAm5c!9%B`@9v2kz+{c|Y(
zbHs<KZP*PkXYbBUc-_v~dpL)~(~!ZI!_UqxrP64bJ)h?|%U9C%ClxRcuW7^<|E3nj
z_7uVQgW-{}F{-_IPc#dy=Bdc`|I^-?M??Mpd%RsGDTO3dXd$L3OAOyOC0of7vSpb>
z#?Fi}vagYytl6eQvNe4NBeIWu>@l(%+c1MM818%e^}FYH?z#7O&i&{9b^o06IcLu6
z^ZvZo*X!|ozNy@{HHb@IEi)J~@4TM0^s**?f0X|;Q(}XHXs}XZpwcK|n(ck=@&Lh|
zTy|wUTp3aUKd*YFsQnrd;}2b)-;o3)bfqWGucLQiQBA)Iro4f3LRtqijvEx)F~HHl
zMJDFp#as479viprX2+~KCqM|bIKZ_9a3WOl$Q(EE2?14LRJzqPvc+r+)8bchwKKF<
zaW?)@+|FZXRB2Ps4HKuUzGw^8_*sMc(5x{jEwltV(~g{v+qMYg7-$$4X>V)imvSuK
zQsEBCl7w2!n?G4e+~%IcqL;_YKk;u+Zd@1sX^gP7u^XC?Q9gbr3nMfxslCRh)FRNe
z#UVG5-N`8#)7(?bw)!hHVf~E<YG&m`PY}Gqi+Pn^HiyzQd(sT=uaCG_asuONFL2W-
zeB+Tj!KkG93Ch;Hv^zREM)*c1ZX?hk)H+8#V7GK)i+<EW51ATjk8MufyzCQFjc6d5
z3|NJ^LsdN4=@yYL7ol*Ad+*rI@h1o>kJ31}?0iZ~uQPU)mGzJU+J9xGHBY>`lMbl;
zmEHrc(1!8?oK~+sq8Hk~$N1+J<Pnt-r=)pip8b}E<KxlRKITJwo@6KDFMUrGzZ<Tr
zr{sQ;l555LkE-ZYb+r&(gkgN~>+K9<UgMl=`Xe1@PgHF%0<_yZllveOa}R^*d-ovT
zc4h^!c|O%>cD%#J5zFvGE?jeprbjW4Ix$BB(u6sUj4KHg*+4<Oc2!4(u2SX8R3*NV
zO*ht7peVwfF7a)@kxI<;+4j5286%Gc48tSTA(SuI7h{yY(eKX`MWxX{kh3%!Jga=J
z;lBDEkvF`#-L<G3OOm3BtUh6y<EKkxs(eseha*W=*=6&anFK-;xetrQ7b=yy?0#0|
zKRJ9W07J|olyZ6M)RTjRM4DhEU$_!;EYIsAMZ%`li!W(-+EMlJX?axeJoPnA|8qnJ
zL(*Km*@}8_<D|9#d(QfW00>1jXDrx{bAAL{7)!9k>(uX2@{J{|r0kS0RV1R1T#5Uv
zPx0v9v;dj70dJhtPoj&hz1`uGe4U#aefW!lQK=OBnfa&KNg6LYSc{{4RwtoRTAuul
zT}9~nz)NRLaVkHytzu^&lw<Tj-Rq4vr(Z5xRv7>M6yLgSSQovB|Il%${jamYB{Uzm
zP-_&lsRF?=hyB84cCYjV@uo{tW2W1*jc?fb>(uB6oC;PBSzR>vYR#-K_}P5_&CJ%r
z*9~vvmp(G2_qORrb-)+Uyt2f-2~GSj8=|6CJwGL&llxljZDu@_ReRt#YS3f4PxmTz
zX(Yr-_)`0ULtkH?Oa;zrpthwZbv}&aT0tBmnnRSo_9q)eY!+%kvv!}!r1X@v7VpG{
zklb}Olu}!oniw<+T7vQg8KJbSe!6xvJgrdSAvv%RTg_`XIy7%LjEoWUsogaqk<0JA
zA-%_j(KIT;xw@KJr;UI6JRjcJS5-%s+ghO^ss&}Vao4Bmr=v_q>HJk&$j%UH-?XC{
zrZ1>x+E^lkW5!&Mqh@}uyUj7R6+~+7=ZZz1fpF3}M7HCZdHoq=m~3N{z>hOHsLK7R
zHEO6#(D*XUBwA}Bu6-tB<7_vWh#eNmyxZ&H*OLp}3)_@)=_&_R*Gc^!*>+~Ok9Mg$
zm4b~W4keacr(o6|JbK5gB#*9zgH)mBu;HJb2w!^w?4iWXrbYt1LY&=G`lZ}WC{A5`
zG>D+g_?9&pa{&4r?=MP`6Cw@9qV}g0o_7J|oXhQI=ScEkFjCfqNExCK59Zv2I|twO
z??2DWZ+4%U5Z(`!e2}8*YP->{+4o~8Y(ZRBGU)~+MPZ7Yd(pLV!dJ?@07dM&K{C5A
z`YGSk6Vm!MzIUmiRY=Koh_$C2_^!kgRyXMsS2(=Y3*A|mdMY5y*^kM<Z1O!6bs&U#
z*qNL#F&=aoJfZ(cK+>RBVsAvE(o~u*0VQUAt1u_t1$bazs<!JHbRFGSLR?dN&WPYZ
zk9*H6IH+TUr#8{C;*<z)2J=Qcpp_`<(8M&9B1D?<jed@DXfMf!&x^brs?9@#CN*GT
z<MJ4AGhxQ&n*WaG75-ZYnFn9?Q=Of1QuWJh^;I4BEhsjb6+N)(IwnsZQd=#}pZXh<
zD#Cx)yD6o}GXS?3V28cR=BiU(m~(DU(9Y-cD<1l+)_}z-T@c%MzfgG``}A&dBi-Xs
zxpE@sQ`5M$c>5xTpxwsS3FC~n$t$pZINbv5C(}l{%(u!a{dmr`FYgtouGz|_OI~kg
zIIrB?R-qWL*n9o@3{p@PLgpSqcM+jx1_nu=q;b@t<>13>wJW7*-V9M?U2~nD>s5K4
z0T7=1Qw82tTGQ7S)-58I3L=|UfF&g>|7xHDxxn!?`EzA4F{l!#A0A$PD=_WVD%S2c
z*LIZ3P0SL_bjTE1i>#`=S$l`Ey`Y^Isazj^W|6Mbv#3la^}!nwl1--ig*lTp%Qkyv
zH#2F`327C5imO}VQW6yQQPalvzvnSXVp9<nGqQcNKN3%@j_;hXTKbi`z*ZVtvRJX|
zjx>}q`p)(^%`SI5DZ#QNqVMb4rYk8@b|OkxBEy~dHY96v;fCFMcM(&Cqu0Xjl9uQ~
zSOSTic3kF)!N4P3jGsaJ@x5B#Hns+Kyo9A?=NiK_=j8LNOmdxQYhd+ERf<(?>`X|N
zM-J9r*Gk`qA^vT>-6cywN_B<3cfIaW(>RZ!+ZL96w4%`uOpqd0G8oI*_XAUJz!tmW
zQu}UW^>seHIC5I>>v389sJ<l4x!WSmR@dF@Qr&J?B_oikGp*g`e=Q4GRnr1SB%z=-
z_QPP?od}uVc5Ok%##b<Fyit&OVb{QllrxMoE2}V}wT0c>`9H%oZAqhNwy4SW=8b;q
z96iV0+3lMgI9ttgNldKY(8L69G3}6k;?3=t2f1v5;jRVqU;Nf$^b+h78hhU^d|la$
z6X0dZgkY^{Cpy_iC)3QutcLw0Is#hHTc<es#9pW|&<^F2HbrI<>s)?zQ)au)t>Ld5
z<+S~JHNlW9ln%i<$I=^2piJld5ywlMml_<t2fewTs4A@!?c5+<;=1)lY~4OC@+!%T
zp-S=dP&mAyhxLu(J_IH%&*!8_wOH6)1?Fh5x{z0GHK;?L6SKxo@R8_PqndfoGpoYR
zjOH6$So9jPL`^MJ(H4eS^Df-kekbl38|UGjl`Yl&B2-eoUo6iJO6{h>QdY7$g@Xdn
zmIhgoBd9h{pJSD|PA;x6HU<<u9}#~w2)^po-zgjz;BjfdMOk5IK6#tUIZ4A9;R)Ax
zHiZ8+BWx`P=6#K$bWkq*kx3av$TDB9*2_}}^6IQZht=i60&SIVbDzC|{|Lw7YL4Xo
z?SZsm!9_VLUUH|s0D53`HF@Am-r|q@+t``mcHRD?Rlg?u+S1I`I8#QGXZcAxePN@D
zzx>H;f^>qA+DDC@OOsNbYIy`Q)p+VBC*ET^z5T<%)E&BQp!%TN1-JZ>js7_A&IGwI
zKajk^{SxYP%};CE(n>>CZYD^nX~84$<|eXJt(;(IK09|bD2piiO6Dg5lj2hI*t~4q
z+{qMTh+4a+|M16TrGA=r({1;#=#Zs${o@TO8^oSD8O5FS&0J(47kQ@AARWCjz#DTR
zTw$(zT-U?pNX(Hb&w$S#FvW?;(KsxR<n|)i3MfuB-q|C`>LA<bksm!h=5P3(XluK)
zaw|Xio|cKWlmy^JEDgPlRVFzAFg11>*M%LSb<AT;XR0>G?2@te$}8VW?7z(xr>9ar
zAH#3ew*bR>W)EfuYHs(EbCO%e%Um_-V9B$Q{YZb65y9O^&F|T~w=wtiU-XSQZNkws
zXDfeyN^`K;pyApnk#4fX=N)SV?`Jk<T^MCeK>kI4w<9v+s417vROOcW-D~ZH=S7w-
zA67B<(7uH_`_<TRY%4UE@S&4fom@qM)1t3G9{nLbdz_{_q}p-bHs|c2b0D>>de&g6
zH5%|1`l`1$%ORB7QH+#<*TBKz%f2~MorUS;USI9+)aDqdKG(iU^kWmz6MItLr(fv#
z7uag{nIJyy!JSjNe}PN0f%HZDOV7s^1(%oW7x`^jJ?P$5HN)0b4owV^)U91!g8VTS
z7iNvdTiw$S6p#HtYk^Zz-PXcG8U%HQ%GDpj7W0yB$iNNoi(s-cVy?P3KVqsJZIg6}
z)HuJ2)leIEG`2A<Cp;gPh}b>s*cF*efQ3RTHr#-H7aaD!#&?U>E`MW7p?OxkJ@;Ud
zdKIaXN~3+UeYtXIPV5Nslq`HFz+cU(IJX#I+{;9=RqjLZ%CL866v;`wl1WC5=$V|$
zxjHE*^wTT;F|Pd^$|h~UCEmm=83Xx@=WV%T+GrGcA!k!o#ih9DFy(h;tP4pURM1^%
zL7;O{AMKxllQA_XbAiT7S``rIdT<Mt>Qu2$+UDgmYD`JR-Z9bA-~+=v;`)U|35kJ|
zpi-)(#eeg~cNX3QD$)*v2ok#kdGu?~qR%i_aQ;UpP93?kQ0UB0uk7UgGx(=xk}U2=
zzKyhAL@!;Vq_DR^D-+tU7F2q!zLk$uT&-}AxB{VTAB<G$)4Z3Af1vWk$f|E=98$%(
zV`;%n>a;Rsm9y>q*w%KI`7T0fU2}BB6(LHZ%Ar|saxG%#{Se2UKq)?M`NaR}6=`9M
z^^WSUHc&Q<9*-oW8c&3no2QN17#8PJjY0Vk+AkGl&y%tF+{N-C`}SCRN=|!O+XF3%
z+@}T&&?D+qm0y;XL!3m*q_mT4$b_pOBoDDliFrVO@huNhB?oknU;wg`#A0=gVuVn_
zEJ5X9r6m%%@fz>7u{PV&-+diM+7mZ#DPW~x<z-dCnx^Al0s<zC9Cg{iwx++6%59f_
zFR76CY@BG$RZz}hvA#9pl2<Agrsgci+`aKnyq_kXx3sc~v%0NkDsvk{fLU2-oSGIa
zm@a{2y6uM%yXG#<iQ5Vwn_>t50We(L$|9uvh6f@PHXOX-`o#;YtR`nahp)sqSORt-
zZaP}8cw=-(RQ94LXdbHhOIMB7O(E~x=!E>#{H*+s`EYv}2A19Sr*eN>z<BB|i{f=;
z7D_6R@83_L^dqV#`$W9_blCC$g@;tVdrJqnw>)A27J3GHiY=a2mf0|C>v;tPd{QtA
z5iv6PEG94?{JnZ302HiU+(e^K4*ZF>>rb?b+sg?fWIMO10DX~VhIR4FV&9u_O=9<5
zMk<DewwW9A&^9mKjXo0ER8+Xqq&R}r|G`Ue|A7_AHGfbCF)kgK^!gDdqs{c0^OI;-
z+t{9{xUT8Ark5)3n(u15#iJ6DOS?DMu1E|QzuIIktjLKD%a39O_m6j%qd(mEL&f0S
zT#}BlsF+qDTb@sMAIfa7NpY;--#3i%<XW+d)qTqy)zfKlwfS)1h+n7HEp!@6d8}hE
zv8#(U?-tONz|`G)ulGT(TCe7U3Gu4v@}DLhmIrjm9Qf2+Hvu-oIRx(-=2Tp3Q7dE-
z(u~uffLjU*hJ&8-!SC+?U+%bc*jk$4e~0`aw*kpSo+Utz!j9CNO`Px;?wkahGOsz%
zFI!zB$Kv)SEJgQ*nD81D7I$$0EQ7d2Nz4C(V7bs{r1*W45OHxll>B@*ErYJuJdJZX
zPX|qtolafKP!qvzk+D_ynF?uBkJW;{5yoG>Z%`nEN)WrYI&0ttCa!eX=H>T==LK@d
zz(sq#JcvsOh_`#M9l{j;;)Nn>L8@UbLKD&!lQyZ1$Q%r&>E@?{q9cD=;juhUJ;2P`
zBrA|}*nkXd?{%%@xT~*}HEQ;qU<JTGQ8~L|YJ9;IEQeb?TW}tTQIS2fenG)a=DLiS
zGoiJKJX~Ve_{--+efXezv(l4`nvWjq8a~r8c`T2b`87`L%KmtfvN*}Dpry1p0~8XU
z{EHoFy`T$u6TU9k*x2A)pBFu~T+m4nY5fyYCluG>2SVD^O3jA2!i%OZ1q~!W3YMg6
z(%=60Yj@|_>I<_27v6(60X!lQR>ixo5Vca4JLe%2&~2al={KnzHur_lz?_TXy_F<*
z4hOR#9}g0Is%LnfSZq@4_DL<;qU5{7nWW&<4*-ZUFJG&li#tBmW_*?T#qXpqV1G9#
z?1jz#b<tDW63vs39&qs3=C<~tw_AkZ-*DOA=BB%L9Xtn>&>%G?zkBEGRNSz5qd2Fm
z4As!)$}c1Fw6ykl*}JV655~meK!OR7O2kpak1?~dINO(>Jt`~B{+28pE&4CW8_H|F
zX_`$??jB$p&1Af{$80vWR7(a<`o5i72e7(+zDeHDz?EUL9f-u{t9Do&vrEpg{_%7Q
zI&;r4X)@Uc<iIsrC8VG){;I-PdV&O>zK&k=2njGnAK))qnwzg&Y1Gdx0<8|PGv*Kh
zj-oR|r{d%Bl}Ob(Gmy}2W@?&W7Js8TCo=j^>ZrXlNA=gv7J;$3Ap4lFn&qY*zSN)9
zZi?I<;Bw&hH7ZAsuRK9#Vp7|zgDfz&i%S3p(Ysa!5vtf2dGE(2w(FWT_NREB`@q5i
zjP}{29KGyLz{V%c35Bt<2OT-xQDvGApuLBop;Ra5Y?}{bnPokauUY{Tnl1GOL6Et8
zRHv_dCOO+i%6w>M6y&mma;gmt&rGH%<_`ZS5}Q~2X=C(adewS#3E+3xtszw_Ymb98
z`LEdp-+s_uMV$ih?Gvr?X9Y)LZwLdKZ^MV6rwRZSyZJ@P`)~5Q5-lizClh9k%T_s*
zS2X(d@OMt5z%4eP^78a^qter5T{?EzBs|C?Do8_QW!)^IL~H-_&}Bs&5RcJE=fP3c
zF-6MPyn22-vTDYtcl_60y6#L1pn|>nn2{ddz!U#B799RQUE~iH?7?m|21?=czlq>l
zeP=bbSH@myYI&5F(B@{UK%9b@+v1?EQD1*YclS^)4@S8P43dEX1BU$H_wMZn%qJN3
zgIT5B?mjIo;h;A6)D+wBFSM%HTAjX;yWSb}x=-`L!2KlvzPBfRS*VcK(mUt}A3mZQ
zX~<`mU!QBu5Fr(o!DPCwM{$N{d05}Wa6SJsDCEu<YgMfq?%eXK59j+BZr1O>U~bZr
zpqpv|OAn;IMpQjV=u0v1maRwU5UFzGAH*ThbXxN+i>7isxEgejKfA7PXlUwcXT~>R
zO0B0Ce_egddoVmn_78kG-C1VM3}j;X+;YzU5VIa*z)X`JyUkOqd7^+{37+1GF-2E8
zfC9gQcpf*Gse#S%htWIq^qb^F;iG&q{tpf$Mhx4-qg2u>TS>iBZ&lKXWT(G%o;|(7
zlic%Ctpsu4uofX!FT_T&+v3-s?{z@XIIlN98Q|iublayvO2U2vzWdc?Kh3o%)+LtA
zv3T^qJePa0v@qI5Ey2Pg&vonhq^)ax;R)S+&In1?^T6Nu`&funL{#+^1qIu#>}3F|
z8UB_)+!Bd?aJ4C7{M!uyKE4+J?!(GSG%MXzN#K>cYnS6i79a1Edg_LspTVtL+ogLk
z6}0M$ETDYXm}X7zU9LkHnjaltlP=oX9V4EXH!ZQQ@*BB7qY5zn^HF#CTG!1kM94V}
zio@~cjznNR&HC4KyYD^^_CId5C-<OrC2}?K+V~P?hkg?{w}Yp_d;cL1cyQ|R1+!4I
z+@U+uktuSHL*8kK5WC+hfLsxm2P<!PoxgTB$<M$yi5lJ^=Qi{qD9s~Y=?&}upWht|
zWQhy{BWq^}tkK_MIZzxY4MU><ov<j25c(ZOr!>4;76``{!})@eF?zX4l8GTyYG|Z&
z>tzYa?aq}S4@1L#iymCGfYi}lX+66bw-GFiNt&pTGPOQpJ(%Fk+roIhZBATMUVr@&
zf%yA(vz*sA9a$O}Dg@0q37RX>+;ZzRkaOI9^=cS=HXg}mQV7a2;Q#r+K>sc2Sjsmn
zvF{wSV#gax*>tTp#We7vxyi@W1zJk~NBv1uY^Rj8)bHpn^>hu2)fE9M{wD!k#7x40
z{yA3Tdps-f4WIOR1qHPvqdohiA(u1$7aEv`7EvkXkdwf;3MdUOC(YahBD!6>-o9gr
z>HdqyIr#nWEYSb|@xQYq0Il=?kN>Gu1FZA^b#M8y!?tVJ&d%GtNS1Kv0P7U8ch_#I
V@6O^4%}`b}s`oVSe!gwy`yaD`@u>g+

literal 92709
zcmce-XIN8f&^C&jrWA222q;BG1nEUYYD5I2gY>Qfp@Y(Ef*>GWQF@mqU3yPMn$!@G
zUP4dkEf63i`4;Z?J?F>yaeke{C0-ELdY&gUvu5tO?@6SNmI^)1EgCX1GJ4e)&tH;}
zQG5ix*)RVCywbe7VnarDjZF2qg1&FY)*N*(o1Gts=yNuZw5hp$f2x}McE6G<V}G#2
zr3{_xcOn&ucf;;~z+PKm{^#!9OaDCldjBcS{mv_@yzf(n>8K<{Sem+%1bP#+w(~d5
zz(ojBYU-$?m#v$RTmRM$Zh7C))osVKp?M~AS9TZQx|BK~Kn@&&j4XJ3k@fEnWVMVT
z|NZnd`fkdlzpvG@{D1pW%I}M9a-szVY#@6bJz2g7KNmZCw6dhdCE+@}EU?`g*I(~4
z3X2IrZRwBWECct)`-Nxx2z4z10Rb#eYu?(4)zDq6(2QUw;RoGj{ct$Wzz^+eu8lh-
z%x!yXW>&}lP!0QD247rcfgWvu5<$dGb@7@*WO_ih7vX5a+;3`#eWqJ7o{r(cjVmR0
zs$8Ej{c5eq&P<b%ez(+19s$`K&cg-bsF5vH)Mu8sG|m8mOC^{r_QNYGV9jBro%8V^
zPJCyPc2-(GLC(lx|3;<ndcW2AxxQHM!n3A8V!su9v&QPY52nIVBq`~_hEJ4)5yKi}
zBP8Y{ZveMFk@Exld%Fr{j|%q3&HR4Zw_Pp3trz*8NUTEUYNks%&$qsBKfCkSBc9PX
zQWuJVV}^JCdU0F|g3bs^g3{YfVO}@_6sO&wvcHvB>Dy}t#Tl7c4<LkP&oD#+o&j9r
zH|{#JzEWY4Z0@&O0fSjmNhpY1_#YGa#jbGvbO-LcwNI!e#i0TYZ@UK2hdKrx9FzPJ
z)F3sPmdeSap53##D&%WJP_tztsf9uQVDAPpol7w^*}OGqGf6X#OEE}JF6v&7i_JrW
zJ&n;cgw0S!ro8w0N_&UOkQU<kZu7=Qe>S0P^ZJ!og~V$Ez|PW_GI^x3&}S9sfc%zQ
z8+9P*^|dQKv>A6svXA6xLH^j2-L`FQz^b!ey<NLdoLOa~Gmlf<=odS<2a23Q{v1Or
zx|*FPn?AU@j;=qk^r!P5S=YR+>|^P^?=`Unnb$<Hv2(mBKR)?FJ%3h#+Xeahj&@fu
zz;+qxU1ol5EbjLlL-8`Gf(%9cghd<vOwP#VHfmsc5E*#`G>Q8i$^cTvf4!fLo3*p3
z3SbU({Of^Q$sP|EgqL}QLeVu!-KB@QSIRiP8y>Hr&K1>cFCt0>w6~L_&66kVjfWC(
zlDjZ?NxVPu5I29EW;ERJ)08h60Y4SoZAQ0%a-5Hm420gZO|TE-FzdUHvcsto0`B0P
zpB2`)mM$xE6x*^>K+*qeWQx}6N3ufKU$adoqVa`JTnS!$QFc*x_BSiC+V(Zw0s!wZ
zI>?_&a@ucyY%IFUe!8Fn+8^B2XYN(g_4MnnBpr0k^q6ewc%9M1k8k#YFPs_)58^b7
z5Qgk;MqFjj%`}=jOR%%_q2FXg1?=St&;F}nJ6mOq=eOK{LzVdN{K0WUwfA8b4zjY4
z%N0=3^rj0(T;>5CGGw38wMk|^gWd(A$+&*=rgO)k92I*M@tw=Wm2Sxc+0rpQX=!%{
zhJFu3-+3?m)I%xBWb=Fm8nn+0SuR(JW4GJf!y+T0_^o7RmGG>p&6nf%7+tMSTG4^{
ztX;V((!#*jtR|wO>LYVOb(ZG_8oE~Zj>X(mC0)|BapjwfHoO1XBZJ{Wu+MgLiUQ@d
zaEcsuco|Cg44uX8Eqk`x`8^I8b%QNK;Rofty)}ro^=|sx$}D7LPkFvQOI<gnYYtv+
zim|SvcWON}!x83sNMYW@{k+{G58H8R&hy_W(rE-}XyZMNA?kc6sCM+%^)CYbMiy0@
z;@S9Y0`*n5nda4R8~nZ(UgXJs@}hW)*^<;eP8@yo!paR%AXBgBUEo~EOv7wZo7ip&
z98Y)l+Y9CPn8$suBzN0HOJb1lGc(dc8{>>Ui5a!`ML1wx5XfpdH+1=G*wPgy-pW<h
zJ0IiSNHxxnaTiahx@%Kv-PM9>IKBvK>vi;#ffFn^2<GZgWGvl*k?`7bM_4E5(s+sd
zF%aV@A5>_qVqJBdhV5s4F)5heawvnGKiEBrqx3U!yumH9sh+LxMObw*9DB2*Uymhk
zMxXC9VjYC1g=>aY(_3>viA8QIeB@-oTDC1hj<yybt4->xZ-IjFX!y}K{@C2BE4%Gb
zu*{3NU1L>dRPKDG4}7~vIlF4}`uM#G^V66BIBr2NBFpf5u=lDh6Xa_JGi(oK<z<00
zXn^H+D2oWGc!`(fY(Y2nfOJ^d_$K+jDxKj3#~_F|csl@76){x4eJ!^HL(Z@@N~`=#
zZ#`)zH}kgJ?3dvo;q)J`oqZ8wMlmidxj(ysq%xg>#`~52%rWD(EkCfl(*Qd_gTZJL
zQE}I0k#B_hsvMzuqV>H*3~!XxX{EMhZMkjR(~H~*$ELe+vSC`5;UI&>i03XW4-?vm
zUX^d=7Dq|@VLjQh!4G1cuA6L84$8`(rixKNFBX_?+MMCXokmhg-pjf~_S8(=BIebW
zBbGcTl1XB(5ePQb;+Q^LK@Hm#a!w+J)BT=z@+U|*X@-G##pz#v-*ts~-0x*<FzT$D
zxy<kU{QTJ;HWKjoM|#npfgh$IB_VTlM#o1-V#Z3dp(dh<ZRZ8;2x)_#Nt_;g!=IhC
zP##C(hUavkz?1#nQM)|t16sEeRiGjbXR!$wjvryDe-=9j)c_Sya*o)^Z`o&xt_Xms
z-*);@8FaXV=kVQ=lC<nG{lH;E1I7j$T_4~G@&wTueRjni^_4tB2?X^68I~moFNq4|
zatfYmI(<)+pO*5(VB*+kj02*)L;^6mJr8wsQ#ak@&$H5^E#TK6Ss=gNh;_Z~rn4v~
zLx*Yx0Ni-gqs1`(SnD5P5i{f8fuwd7d-SR>MBXWLhO`-7_Ry7t5Uv+VL57}_h$rOO
z;L(oxnHfFe0#LI?wvPfT-bhHjb96uK799`Am=(TKMnOVDrZ`ExR`63zkfe+xZmbf5
z&V-(rmC2341e9-V1w65@IyvxSP{<dlN2krz9<El-cU=U=r(Ha6vRD1`4IU^-aQ74o
z53D$UjkSIXqFaqWZD-)jn`uKd%O{#oq*b6AH|HB#4-pTvGHk|V{LVCP^x1x{4BFf&
zUQd$H%%M)@aP;1JExg<rIXdMGv9W(Ua{@LjKm@Jxg9z&I)7fNrTs5ncB35uzQVS(7
zcezZIH!-Z?u*{`PI)xxY2e!8M;ytqTI9l}#a6F&`s<6Fc+{7`hD(W;g0J5#Q`>~z@
zdXlX%YLgiUv+Xne+GuQ1e%i6u`Gp#DeCAYPQ+~J|05>8AYeUb489>;~C2!J%Jg)5a
z@pB(}|6L=?qXTA@2*PnX1VX~?o=>BRP3Ly_p&*7IX&PCX@^3K?ZslcWmRKDXh5%Nc
z4h{F-t{Ia=2+3kMZ~HwpCv3mDbV5%QKr}?cl2evhbK7d>Zuz44uwbbrHa6Q?L*zDQ
z7x>4}AU|IJM(*po1FT8&+>^(BfR&rmH;o>}AwA2!Or=IPi8s64zwg!R=BbDHbT7$C
zH^|1-T^i)}B#Ez2u@|;YaLPC~2nhUeuMbEF663a75q4r;Dj>S+{E}(=dyCed0RS>9
zQ=?7YvLX(GGzQIeg8Wfd(6UD8a-9(g3OZU&3@oAM^#3}>m#T5zhd>>N2}9cs82t7Y
zRh&|E(Ejsz@gP<1cFo&8FC!^R4gPz>0Nh#k1|Un>El%P|(RcIXWzg}<W<mp;bgi@$
zK|&b8Pc!kvRck2nLpK2%i^Ba3MTP>V3MA!{nwE#mg-A#^LEjT0Gk^M?v+XEMa(=j4
zV#jfu%7V3232vRW9F_3fU{?Dk8QGmRS?G2YYeBUNPd0IFF-TjJ-Ad%hlDo;tW>b*a
z%42m>srttOzdSqq)ylV^K2x5XLtxF!IIHc-@5d)y!UK=8eZ^8t5BcE-;w_c4N^TH>
zlaI<SA60$sA`x{uCs`78z8{Z*ES(g$1-PAW7{L#@KnJarkfRwy;F?4wY3dGL;F*;?
zu5DNDdA3d9Od<R{T3bV#k}KKrs3f^{Pbq*iz?0M?e_Ux~5!CdWqAd-2n(U^>Sa8xX
zikAIBa+r>nH@F5G3i8F`j*s*6w25Cp1Zylevc-F+`J;UAl=vv;>2DrMx2eXUnVV<+
zQK(-Bl^ODi>zSdUK|zGJ2nI^KjokngN(m~QIE1NLJyc#tM-u04UJ{T-ttkfJLC)|m
zMIm>eNyH>aZ_U0#R<^$9czSx<XAXbVvO_$QBtn<dC3XFQJ%~*Q+SR0mMYXFfBs?gP
zAWYKQACx5gLOhp|5t=@p_aP8xPy}?D7(TlMQ)%|*U|@=xBhcRUt|BK4UBZ82s?DAk
zA?-iepOQ&`eHZh>Yg0g_xGYYu-;$6AI(QF)$ZQ85%HZJp4f9&?tEBVY?D!pr@0i>1
z93P~=>3eq^8O6Fukw)d;om0$B#kC8JE3z7`G*`Gxg*!;^&`exCY=$iSTnyNSz6HE-
zdP<2fGkSdsh=2#JG~r?|%VS<nk>9}E(MmOINSXbHkUGDhWU(DzQj3}5i>8f4ZJCgA
zo=}T8tDVINQoQR!F#;yO?W3!Dzx~%R;;A0VHnm+=I!Z{F<`ye^{-g(HPgmL}KTtvv
z{?zT5;rOOCQ!Zl9cyc{X7C_~?WHO{x+iK{s9j9Ph&7(xX_HC*@%5IP~6pXPgT7IRN
zT;-dL1L(~Ew*?B84NF+HlA2Tfw^YO6$D_p0+R(EaPlg~4HCtqZ2Gnc6Z52p7PZ=2J
z;^-Kv$4$fwo@WJh)FE}cFH%pm&&yZ8(MQQ}%xTx9SSONKQE66%n4CDii_~_Aoq8x;
zdOkv$_uCu(7e0O|7OBWCw`IHHE<JaAREE5h{|A8ZflGf@+|CaWNXXm_q;;VQLF}}m
zR%9)1_1ik>%|2a4S;}{Q_QnhX$dEaklm}9xo;*HflKJL?B-j<%@ttmdbCdPIHtyi<
zN^F3j<L&Xwpi`%kL|wj?vyJ}f+rS$iY57Kem0h}T`Z?ZU0MmdewIU65R(%05uZLSJ
zabv_s_d2jP>>!nNa$Qbpgm$FHb@s3netxz+(?ba(9Pj`ju~<!ug=cL@r+h$IDoN-K
zN0wC3+p|B%MEd^t?4e3o^{gGMcfoJ!dYE;o0*HrMn)~6;F1zT8Mp1gWUwv7CnSc`L
z&AKIZOLED;Dbc<6OG1%Ddem8vttuYz!&EwJebqc8Qs(HF(*NZGno=qIo)t)Z7q=@^
zRtaTYFX$@m>RG|`zB%PD$<>YGhxk^dC`Tj`+jMunY0pd~3qee$b1zGZizoN4Btcj8
zMr%CHTE)+tu|j7{c>x%YmpgpryU1i+(-&odwdgbuUD(^mi52PYwelNED$RyNjuPUM
zxK+2=qiG}9xe<g|UkN#sNeq1PIN2^S7wfe$xlcOXkYr$!=A0<9vjbuGwXf3CwVrb~
zm<NoBKd)*QU%})GF^>Npt7kX&$$5Fd^tw{@?aH<@MNYiUT#MKaq<d(8@b>zz&Oc#`
z8;7LBF?HaP?asy*V+Ij{#5e%-Jx)9yW6WA-Ih!P%tf;7j^EFdk3tC2o{(yi8dX+gd
z>;Qzun(hZn!cWnFH?MQl#MVU~(}Hi@D1x1q2gGMT$=p#Dz5<5s=fdImEb8l#o%Js1
zU^`|Qju4S0eS!r+&O^Dl%3I%1004=t*+n4btXhWF#Cp}ku%qghKlC9D2lN=$pj^O5
z^NcY9vQcEIa5tj54?mCdL5hBL6jLD5czf@dvvK$xjUjRbd=`E#Nj;k5+*V-~Za&1W
z*XWAOyxXrI(O2d*M+$cRTKe6M$)dj<5{~dhuO?eOv(onDiIms&G<)=9vN9a~wN}xp
z#=)c?exS#LV8s5~nM-EUo4Sq+6pym(!Yc7hVf}cIV%=tH&xKv?stLde)aYbqp-gK-
zAN6ptn{9+SC=A_ax7BDrQ&S^lXvEe7^sVPy!oETUJ)zp1g7ctB6p2f?^|XZF+aSF!
zE%e#HO4SU|b3G_=r$Nxq$YLa|gpYK#505&|yBk-)Ff_!@9JG!iW`zxcFvr-`8WOQd
z7`Z#GLOhS>)37}<*xD178SR#1Np^z2di?ltD>{uIkN2-^+Bo3e-B2y+R*rx!Yq~Wq
zo|TF>otw=cXEilZULa9oBhAMBE2`TD2{mC`VLpxzy;l1o`TF?5e9ds79%iL4eU|45
z=_tYuDmF@AAD@;+Q<x@D{7%qq>_u)^T;$8aHNo2|$`RjQ8446DMdh&?c}_I!!adQ)
zyy;4(JZB%edfhzj>SCpn0#|i6l}h4~Lyl81i5h~|i#dJN01dRnHb%aF$k?%%HlA_0
zz@emq`8(LatmXU&A-e3B74>5CVcO?-!szxc1n;)nRPv3<ezcemrgwJWZRw6YE;rjb
zKW-xhpc@|MZo>j6v|$_LM53kP7mQ3nMBDl6Z@fBfzaI&zDU^xne&*ZgIY9&KXp=_V
zM$+N?{UBy;(I^`@sRB0=06$zMeHToZJBCt!XH*WW{JfY8z{@s$3bTEYzN!K@V!xd{
z;#ZTSK^<MLTSgeeKV}Vz5pl#BICbfYZkKbNwfq@UTdDkTJ;mE$Y!cG$+`kqJKiUMr
zms%jlc9w@S@S|?~g{6h3DC&7!91O-0V@*L8eD!Hj!j7qUbT?kvC)SxjjO2+P{b8%n
zY-2xKpvaH@kZXgA46EUvw@O}CXP5Fn_krL8{|$dRSU6}M;MV-UPldGWvKzmXUsi`(
zyPXtxhx=wpsP2O9jp;$jxu=U8XSXY1==oh{b?vTq;rvlo3)76T4WPr+iStQ*D-F(<
zrf+AOHt$8bAkQ1r@<)q-GE?xJFByrB>9g;u<l`$tqVTO~xi7Hj_@FJTXz02y>A(eB
z&IHPLKQ~1`_9Uc*OidN1I)<{!O@9qD3}m*gVL0C>Su@SlzQYzPs*KADq*-@|P^&>F
z0!SrT3#*fZ3Ae_bjS1MnYS};OkM-v|&5{bzvpqVH%RB&!)ON((@F%11vfLkmz{!5j
zq!;$Iv{R=VV2$!x>05MfT6Z=O1ccFg(qo!e4TKRld7QdcE<TzzZEW_|eV{=f(k7h5
z6L9QSMf%5)aL6ug7Jh4qP<mQt6-a=oklcFT_DF;+e-5R7Up@nLNW?Q?67Mv$M+PMF
z?)>?B!1|y*-&9<`hL65ID?6(|?CY<Cp8&j^Bfd8~U1^{0AMV<8lC~+i&8B)>WRvJx
ziE2HhWZq@nH95`j3LqI*rkT3)%+*YPsB(-K{`Sbgf5@~<LN_J1^VhihMMCnm#)R1i
zas@326Mtzx_`+98#;yTnCd8J`=}8mH-1#A^02<`9a_0%FTAEO`t(|}qd6EKuJ6ZYg
z2VD{f)PNimL1QlP7!{3@XMpDtg;OR#)eMYpZ|@Qh6}ibb`Uqah;|CMECcE8EmCX=D
zV&10H*XweBkR6uF((HeX5E<naR_E~~OuX#gf?_s)#K<^h)Rly1Ak3hkAEUtVQ+~Ic
zSV|`rbAvIS{HIJ_Cm%;9YFsA|#Vdnsu|my7zED=i6V$O8{25%06Th+@Us>mGri+bL
zVR*()z?2K06B#&8|G>}f-sMTIYmJ9Dil-(CeuWhp!H;7->6hI=*es`t;_p!w-O2ES
zL0l`23+soe5e3+7Z|jzd#j>`0HLKD*;(F9Y+P1NQYMMF#CQH5ZRVLnTNE)o8Qu6)9
zv!?x5oWykK8IE)^vfH}O4B1YGB$X?!>nIx*Tr{h@=QVJf!2=@5-;91U<#WjE1lT;E
zG`A2=5=s(=o;Hw9^eXXHsFS*EVUNj7pZUYzT-vhe?oG&6!B|)LTd(zq?_%D|bqaF=
z078MC4fn{a`Uquv)u(9(ZlF-4Tv{-lGPl^Yl#JYAvt+B^Qs=`cv#+DXHBNbUud(=U
z$(sz(@*QT-L!<9HH@8RknS?@*3o2**04mhdYiw0GaM9Axjgv3~C4Oe6UKS*6qew06
zPPU(~n)h6ANrxX3V=sNCd>23pX9^Ih2v0CDSS*=d&fOV5f88i6t4?f}PV$Xw#hgka
zyB!Z&)3bWhFinW2&tuQ^m^8~PESt@-I#w{lC#>wZ!SO#rBPKW&n<$hjFUktQ7T#5R
z(<M{vugp~Q{R<?FSF`-_!CM>qy$aGPZYdpp=mclk)_Kftu~dc?|9a}o9|hZAP_PdM
zlH7nLl$%y&y{3MQs(tIvN~+VOKR*~~Bwb>cpXgp=Z;;O{%nd@uUuqba{ykyUlJ2^D
zy2Idp8t6g*jk}G8BhkA-;}*EUWQloz6Z7-653ai`_ZzEI;{mj`fMDQoCDBn&g-1)j
z<y?|dWcs_IazV}D?NEMUeQE3MP?+sm_xcQ~w(5Pd7u6ZwL?-%(u}p4a3+yE(#p)^D
zeC$Xe3pD3O*R3L4!NWUzr=pnc?WV=%SM$hZID{GCFf0#g#u*#h>Q$l0sBZu-us2`V
zt*BOA>oW6X`}`G(tL%Y3H!anp@YtuuW|6>l$Lk8O==X*|=jFF6;NVvP7t<qJokCsX
zRB`pz5^0%-w2Za!Vs}o?VIW0lL&5<KrdIqj^LNu<InhXlU}F<`D3aE#a0UU{=P&d6
z{ze&~bCO#Z*3h%Q>`s{&g*cAA14h;Pcl(CZKoi{a0AbiH{fs)tEeU3Ov+Pl0A_v7d
znXY1BvrF>O34helA->=0EJPT3R1v}9e?C?jv@8r;<WWZ{G5xUNOVtvzNa0Q&<>5h?
zzpO57U+*mzhOVa9dJIY!o&O5U29Q)v8*j)5WXxO)gp5!2U_7~P!8-c{3&<R#@i`pI
z{jkO)x^-1@esUNY^Np7{pAL<zyDHa;y~A)7izJ7wwO8LeIy&B(tlA#V&AZ@SCg3{;
zWirE({l7SH*zM8KpRbszcKTTS5CNd;+@(iPLCOHbOvhAj_hG08EZ)s64^WV#<7HAc
z(Bcs{^`IT5Xp}s@3v@oJTxS=EYMDPvGlIp`4LLz}CU{fY){~*fM-6Sw3CrTCTLS~L
zq;rI%^NinExv<}wmy<9vatDT6P_$}Xc1pNU#Kgnw-~NCX6%B14$f(|?5Pzmr6T|?5
zNN4Z>Os-E59x~m8O^6mUsh`G0ektPc!}fkCw5-D)yl;O+M1@x^${ATz5ySC7EQ`Kw
zu3w#`YmO99OHA&Mf-LbsS67OAea`38QEz9Qj5h=KxS%8-61K8z{##uu@caKrFU=0i
zlXjrPDjHDdyNnt=@dyS^JdwQpYz=;P2-0(5{&ei_x%3>X4ef}XFbAZu&x;Ct?f_pH
zKvDD3?QGCTN6W1IA8-GIt?X7@hv(1ms?P`#n&&U?{p|53UtNKiJGx;9-vK%!+Ya1E
z$?Nv2>BZ{doW~FJFGLf|{ZY64OwegwL+f4=TA%nHsF<x4qy;<!r?h7+Pv%+J1l-j*
z|1SHAnd`yU9}wgWBsMh*RKE)N;)cyV<V>`?iBy#<u?ir>4m4>jY7f;x4F}Gmeb&&E
zW7MnH&!XdiAi~Icrd333S_EF1{)eDAk<@pYGTaEZ#9ezh?$ZWJM%0X-wpo!1K&Mc6
z$A-eS4>;H+&MdtT)1Dvk)f=-|&X@REpRe~&mNIcLUGk-UF6Nmn_xL+ZdelqSpmglu
zNP`CINoe(lhE_s(Sr7n3F0_#@$=02<w$cjI6fJJa7<x`wPpnrZ0r?05$g(+#S7e2+
zd_$z51L&kb^L|Xr*Ke#padh=RK0=Y&JG8ezCs1wqqp0LI`$37}TXr~c?>1~0B3(A%
z_;=NEnW3;hQ4@-9$880TAC-9pqDZT#Gbo<JFA&GnGEXXUt32-T%UbrGe>7NbCOL?(
zEiAO-2*l`0+r}F5Y|>pQFWRIYW{v)D`t<<r!enJ-)qZ=F&uPu$0MCs9qDiN3-+aac
zSzh%;=l&O8g|g8;uL}k5JRRzL@aO(&YCL3NuH4kU86$&}d;9;CplTl{RQ&+-s)p9h
ztX<+OKoE<EV6?lHo!G)y=<V|}?KQZz&EHLFMP+Wwm%RhrD!J2)+vj2U@q?agtk0f0
zl!gDV@Hu=1!v|aTtJr;cDfWbJ`U*4S%kN)*(Xy?I!gjpM^HkzV^E1S+)l(JfLJ(35
zYI^z<{27q$9_GrO?B(IJr2`!goF69_WzQ@Htczk)izHoG=KOlQCM;_3ev)z?p1vRJ
zZmq^Pz%~IUn4?htxE)7muXiz<lpYuwx(yzFeFPAM4BG(%^`TDu|D)d3S*v`?yTJqb
zvHRJ+O-%KA<x~xR=`HfHfi4x*w69AQ_}Tv`p8Apj=oZpaRS#|y(vN>spZA@bYkLd!
zW`YyG>El$9n8*hf9~I#Y!uEdmR8|hB5^nOvj|-*)+SHl9KckZCBFi5pWa6FC+BNZ1
zal4{;c97rR-shT8ab(MP9q-k|<cE$TS8f)U@%<+|&n*$4`#vN>S0!>NtF+=|EE`@P
z=A_;5*=;U}gaY~xJja#hzP1A<VZY5?B424`_{EUGe{%uZODW0;{c8;D^4?g?a|KD`
z7UcDfdY5Gxq4_j5;kd-E%iWIuY4x6;W#C?@9{K(CFGUYbSP+mUCgGsd=xo$Mq@C#3
zel-02s0B!lmCrvr15UT{Tiz_)Za0o>wfqhCDBzMpWM!sG%gD*Jd>RCMwJkgmGWc$s
zp+l+7820>`deJC3d0PjUA{SR^7w$kdTdODmkZ~pc>XBs4Lq%?+bLja*GN82NN#f);
z&o(QY4yrR{>SNtFSUK`dRc5<~ByMqYmY8S$zo_c;%gvT?Aq!0-CT4k@S^9hrFT2$9
z8nOM4_FXJP#HFJe4|jG!CznGLXWz~l2>UM%Ho&$h%O0}z<esJIim)SWx0P2Y4fMW;
zKZv>)n)W}p)`f))FhEWwZ)kHo2|StX)w5e$W2T|xa<xX^isk!|R(Om%a-DwSzu#ph
z40lE!P3-J!Z@(^om0Is$hRtTDdxKR|k?N-AtoZ#PGUUE`)ct<7*!~>FfB&!Ph}T$v
zDgwU#{~Mk7zb7*y>2A4!y@|wKd0)&ha;m9mJ+*1wp*d56?#tgPj?TyuKE+USMMZ*Q
zD1n?nknwg7IIgL<&4#fael-gWf`oQIImcGvcc6PMDEwkaynOrL_cA>?W@JGuv$Mo!
z*jf1OE19uAq6#rlls&+F$%YX;a6vc)pv?yw{fE5iZNz#`_(oqp%b(jJCYkKgf!K>#
zi%p+-i=8{!9KL_AyQbolSq3`^lY|rNjdmM-Z-<^Kh?Ew=&xS$gX!Opjznf<6)PW$I
zZlpC~vF|r1YR-P!ctFpy;N6o-7k|cZApFL?b_09dj`H>B#_8M3u4c_bG4ZHFBLL=!
zU0f3ETI~`zDuddeN#34re-(6XV0<&(XO5%-JxGpQ7WsS04p-C?Ct-27b>S2N{&Dp(
zc=K6ZwIpoa<%R9V--icz(}R}WP!Y{j{(E$eOhf#5{`|j-W86K}G<do_{ReUkFN5pw
z%eZriwZy+xz9ubNIBHE*_e`V|X%&Rw91i{WVy&EyTJh`mQx!C?4LH67sM|85zqa^6
zk$Hc#SS)noZpzpaU@AaD1ipTXJu#@D4>1|Lz!Q}yKgqu%I>ELW{Zy?KR((|)odRtX
zQL6rGwSes5>5Oo*bEA(AlWqH<9K!D6elo#MkJ|mXRWO()B0GgR-w<z{)bFUoGhk$K
zdX;MIr!;s>3h;FHX%osuLKRmm?B6vcn0)n{)|HE!tJbQP@piC%5Owt-RcS9AvZ2Uq
zRhy{Lr6XFZ<&w!F6&EnC?z06s25T(<C;|xffqm!x)lg8wp-DW-XKBVt4r2uRwF$#>
zJ{Kvaag-c8-N8YAm*7US8@Ec*>+k$E)YIFGlskRt4d=g0g{;R)w`-fy@1_{M1_F3d
zCF_-e|CF{lq!-{kp8cIgs?Ak*o7}6OFdr(x?&WC@_lk!`0hcclH+n?p_cHd?aWSH`
zxQoLCKVGd-uVii6FD&Wdp0^skpHmU`$}kLQG7LSQsN?t~Vc0i+E<`G_oO0xq?O5Ta
zk6Ny!XWt#Qvs&0fOqjsvwGwHfQsr!ywdH?XgS1vKEA=G|#m6g6{TFBSFO14Aw^5s~
z_6Yv#F3%5u@d{tMul5*u9nf6{8>D2(<7y1rGpf+7n0wv1=6_wC8DfVh)SH#alrfNp
z9?&rXUH~qXYGCo9eDBoX#hZMw)>D<K);8#N=ujqKHpnlW=1z)1yU0KvgVvFuE}HV<
z)F0uVP$mMXMB0yv&eoYx;pTrXp#InPkJl~Ac;`G{`J2LkO3#86jCZ{uR?+*<)9trW
zGfysqV?#Jifj*|3yeKx3mA}tgDb(TJ6Yi@8&ovkS9U;px1+ECa7-kyQ<&9MO?A(PL
zvSFY87DVF^Q2*c>f{bj5to@>e^w8nMcQ2>XFcf}Jrse_yw)4_O`g<B-ESgA<eNo+6
zq^}?pX_>UTN+)Ub)}e?6A#@v1>j7<?f8mrFSm1_$wk>0CHx-kKc`l=}PvP}wG?~;~
z<g;m9Jf=T>j1lsL+fgk0tDlBCIhj2hg*f0-tslE7ma|2(67nTC^NjpFjU8U3XViR;
z0ZT;-Dq?@+8_N1lP<i#|!~hva$LDXob*Zc^pf0HHZzwX><jviF@$qXPSp0Y^#3IH{
z39o&-_O<CPvZr&451D`yZ8P=TZmQZUVO6`S7|&#v^QNP??&di-luAGV2JO~=6F&`r
z-R!HXoAaw*lFMBWde&^Q-^Rc`x(*D1k?An}-E+I#xak(BfeE?JoO9jC6mgWQnw9LS
z#eesUmLw{zij_DSOm62<VS67Ql_w2;69zmwPX5=fvFr@}wy$q1$4a~$X0}m()8*`q
z(vz|gCkyuai&*Tf^_p^6m!DR4-im)Y6$Smbpn5$a>5Qz(tA7Yh7@!AfHqhOH{5KqA
zQ2X2X&-2d`lmsQ~Q2uj^8#S2W%Pw~c@<$!hE_Gi2>#vrmZqdg@=7x`kxdb_fUz}dc
zW4-jhXR%<Kf&6&zO+QKPa{q3Ry)s$w(bEgmWN&ms{AO1^({1-hf1dh>@jm&YC=%M(
zpE~vBut-cf=~Ab5-q{9#o}VfTCiSPu#EB-Tef&x#hz_ZW_M@}?Fo_?3?<OAH_&@JQ
z(+OWy$Vz8RL1s*S@jscp`sizr^7uV|EpbH>16god?wgBvOrlAeNO%`x%cvoIcR5YC
z^XpIAsPDt&=%#S%Mve-ur>*}Pxby+en!;WtPmas%>~Z{Y9Q^~TFKXYg7AE4L^z2mg
z6j^znKt9PqGE@2sd*9j7NS?~lZV2C0!9C&7(-U*b%-9hNZv0j~xf6?+l&W{SgM?3u
zI&iDbjKAN%-GCCwOrHXsu2>fl<1f`-{cFO&K^Dl+vB`kOP@1}_*gu^;iRs=}GBB0I
zKbXOgg6s^CL}IojuK=S!#}S*tH3`+tQU3_Nj`Xv~#R+0xZ?!t~Xihjct+hu6X=gw}
zF4g|?cTqOYjVx9G_iOn)u+yNr2GZwjSx-oReB>H4AGk5lPHuNKBL!qa%&Wf|x63x=
zx4);P%6&Sker)-uaeJo&2c}`A8aDqMj{DE*zB_Og7RS)oMrdu6w)se-?P=nPoWs|d
z>8-FK>Tdsr<yc{IYa*aes@x2-Eg&hsqvL$qN3QmOAK2fPm-n0-cWR(_oe}%7%HwYt
zgeJOa4rqx4Klr70p@+40)*C7pZ$)x7iBWHXT-dU!h97aJ?N(Q13O8*jeeH8boURew
zf~-lI{DsvEzv+|9eM$PRXZ$2w-7Z^e`Z1HP-zk&uoM@mZx&6JrPdSTJrq|r$;6vIK
z&!RxS=sW2OhubVu`>pEPDl#5tv&<Z4zx3=FlB7<mt1N8i@tx~DAkrRlH8|<m%5#dg
zf!^7cY%t^^gI#0RGwFH57R{+<YYPk(DNH$|MA@h4(yX7zo&U-d&SB^KJhwlYY<IxV
z+;>kV+=uP~bvJeWSE)6PwJr8|h?F(O)K*w>TMh`>Lzec>-)On{09;mN=Q93E!c#Bf
ziQaeFL?v+b)oRv9J%cjG?rh?0hnw27sp5yL3@~SBJKq44(~dP-S}W+m?FzJ7NUcwg
zCSA_MzYnKryx4$Z5B4kH59M!x67RZG1}B-i#ib7-xulwH$MT%L1H0dl#a`H6Wu&9_
zFtcbUYZTqbDVuR?dKRAQEp%&ozVs*w<jW_+G$=Xqr(wNBvxW8P@?ZF0%Q2RWF?6*7
zb!6;3H`BQ!Q=vVSRtq<M7JZMEy(#Oc?>PJM)r`k1Pp$8-u6Qj^RKI;QIXbFc=@;mb
z>uh8!&A<CIwdkrQJ6PeoB~HzbE~kB1h!aSVUEdp@-*(F9cG+1UTr#yOe*RYMPIR=#
zjC-?LPgmZ<bQjjI$fumQUgHY+pTr#k^F7uK6@DVzr6VHBcemejp{x$`Fygx`Fyou6
z{E|Dw#r+_<oX>zYq^CM#B)*u*&h$rokqg&b(oyStrbt$Guwv8EuVx$0^>QvoVkAg=
zHOs?+1|g;6qYLfo(UMPU7|$a2JDn7I4+7~MfB9o!-EyqGBTUluI6J>lgtLOZo~WR2
zxi*l4yx8J~QZ<mdSH*XujaI2g?}a@w@1?SrI+JtpY>IhlQYAkgh^6PquJU%(VSP$4
ze^hIc7{Xa1(P3Z%jIexOPJuUablEadh~K2Mmwnn^rlRS#G2`h@yiab=lJV)1=Pl_D
z{1WUmVtgY)Ibs{+61coS&_?Zn$)Fm3R=_S+Ms+Tx{H4!WecNhX`rn`a&g+~-Gc{Ai
zQ+583Pvzuh)Cq*eol}E<di<3ov2o?6RbNtj!+!m<9m5bO9;^)HNenMz1FwDgNyU2(
z2WOq!SZ{lE?&l^ec?^+DCV7=p<UgYxsD-BLq3a4tO`&DE!;};oPSz-@W;s!xZwa9Y
zgiy<#r1K!`^z#i5g<NMv1Qpfr3zoji!%|5_Vo{b~J6~S8+xM!UQgHgBSl3X-%X^Cm
z#xeX>k5lcFUCY1p=<?WSHFedd5XA{i<IGN;#3~W!&TP(7D#gaL>-n%BD1!dZRvPu_
zXJ&dA2A`%kVuu})-f@;^ZCnf(Crw?MbU8eo_o<HKr%R83s`E4=$D@V2*f~(&?2s;g
z1FWm~*jp%{fKs)t3wKUQq8hf>Rp}h7$kz|MXOh?AuOA%+o^aL_3HI959Yqdhz<#W?
z>zc$^XCTfK=UX--Za8@!r3ep<mjB#;$ek$eL6;+X;qd3{kC>!OTLJ^33?9-rSd-Ia
z4h({~R|RYG;^u+M|8*F^Bf84u#_)C8h-;(5b2n7n+uh#41^NSBt_Wu6ga1^m2DRxR
z>DuW^+<~Vs8efFg&NhF-v|U<#a~pGft4k<u**k3TcJhkY&a4)9dztY|_1~tVDcfvw
zsfGynA9>%c2)c`g1DI`2>_5&<hwGa0@f!%_DP_(kWzSPuKd5PM?2$9O@f%FGscT%!
ztt>*J>x1#}%P~?beztlg7Gl>?%D0~>tfp<~I}+Sy0YB0^5>5JFE}(gdc<Jb=Xv&q@
zH_HJ%7RyCJ6Br?bm-anYxu!Q`>@-T(**loo)A$<X>$aPaR}q<{^*Jg3^+H%|m*l?#
zuLu|CQg~-5M_Iz2zTvGP?RZ1%UEz<VkQzqBP5__ERLu2Tp+mpkwXfP_og%N&YN-TD
zmoFmPdIg96>~(A+<)e2PcwC;#Ks+@(v!O7hI!?$Bt63249a8EGC&%r;T7;615RBhg
zG07`mtc@nQ>{8~)2j2Xuy)*UwANKF7&D$T=yfg{a340r;113w9l7f~rW{XyL1);3Y
zyZ-f^mrG7F^bB-;bL2yX09Bwh%f=L*uiT_{wp48eaK?x*!z;pDY0BYaOlQU9m`h+S
zk)JX)-qAC}7t;unO;@@x<Jx>b%z0esMC2yrX&-|kbI*q^mNk#XtB5dUag=t`$Yc&T
zCuf*&#foBMqI_UEyqjS(jk!Rg+mGY0(ZgqCjk3Yqz$$=lh2QBOr^Y1<L+U)=n;rX6
ztAi^*Mxn9t$3hKTQJyy|O}^i2dzRR8|FifZHG-qnW+h?l>LjQM<t|{D#3vY+@o4*S
zPzmm}FhiG9@m2^panx#cl|q4#9C=c7xXR0Q=PvaFeB3&s=~39C>b^o^#T|cLGV5pw
zp)4FFD9Xls)r8mZ*DOom>aRBk2g$-G*SqU;>es6F#u*OH8kZ@#WyW7m3ngCqqdsn&
zff>sy6jv@hZ`an~;Jq=Bl@XXwUZAoa>Fs_~8v2wRs13CZZ<+)!F`yiv>Wric>~~ce
z6j+hliVsLSUEzCsWl@k)MBZQgyMGnah><A5Q%LBe3+%^811ClOkLfj`?)nAI38$I^
zQ|g~J6n~W3g)m83pKf%lFWxxh>E{e|B(6+t{dwVk5)#mnJHdn2)><u`G7TS56xbTX
z_&47AhyDXvCHUA-gxTu8x3hzCrFb7iKiLdI(il(eKKnzj%=&C4C=zGTu726l)Dv&h
zpzS`Ikj^NlxyRU^hdV$D2sU1m6S#-&Z>_un5evlncToQ@a@RxV^-xnkf|nVdGf@SX
zXn==?x4Y+K6WLm81=fVGeuucbL%BIQ2!cq|<zb-zA=`G5X70@Grhj7|R}BE@iO#aF
zoC;p`=b{1+o8=NFcx2?hsYiyqOuc0*Lh<7$ms;oYi0QR~U(`~Uo3VFzD3f<`@swBN
z-)1^|Pf^IsxGdux!{DsjRi_fYl`Z>fdhu;M#z$JiR*K7KZ!1><RIj2Le-tw^v_EwN
zD0X}2mxt%S37t9#-M6sfuV=~qmg>4VO={NB`qU&6c}0P{$mrl3%gvh}A{!N~PlR~Y
z`Tk)Vmo3Q;Bhf^^PH|8Bm{ISlXwOLD<!*EKqSj*_Q{cq0bvpmW?kYuqZhD?bs)1Nb
zOqk1l2V#LERq7Yntt;(xIk8F#A2*CN`ID7iUU}CAubK>};8Q`LMJ;gua@VZfD$M_H
zXYv+<+PjP9a|!OZ2)B=3Xo+A&=^O&(s@;w1cr|_-Cvt2kH_+;~ZANJt>ARm34@I5#
zi;sGH$(<ko5=Tt>DtW#=g`JaaMgUHJ>@Dkz7agAY<8ETp^^LVK)gWXksnf4yL4}f4
zdP18ftNBU$l_jkeV-f5-(R|9TM>Gzbtk_16&}Jt^f>G1QqD+g!%x505kd1fE+Xev@
z^X_A5)QI&%6>!{09A`z;$)BlEKYsX{iUokPzl3DZ^k~Zuk=+84bxy2qSJ{<87NgoX
z$QWSw0c_67tl#}jWSlF&p;!H~P@zbjOxE8G+d-u)p09O7|BaV7S_L^J+lZGWzNQra
zUfDaq+GkXIIN&0A%yTv_3xOKnTW(bA5sk}N;Z3Q!bBTy5lkfST%~k~~xmT+{wvK$d
zUz@_O)TF*h_^@yk&c(#s!9vCBeNTGyOXC7cn&~(|BTAq0=s9czy6O5G{K9tlG75AM
zG*kD`X|8p7O@cvQ+QU-_q%C77W~VinEd>4X^AOQyBTQ@Qc*wv;kSDj7r4SE({CIRE
zH?+F(*Y6ftKJaS}+Gy)V5hc;@-*Uvp4SeGswkBU|^ZY?c&%y1wjf&<?_u61AYp?zI
zE@t?$iMY@1Vt|94H7cBWtJ!vN8JB&9#x`+4C}6RI`D#JPYX6R$XZC8&w#XxLphUMs
zQPJ1iuvy<PC?B?Pc`(s7I`Ccg+y3izo2n<_Qr2^E(cRKC?F(Z$Hhff9$_KP5m6GGk
zzh}bo(uGt-gS#g|r+*ZCI14k?RfL*s(TDw<=PRk?h1SaZ&Jz02fZkPMn7zFWEuTBc
z*Z<ZaORnm0-OZd>i6&OAGG5Fy^W&X7vv6Lj(rX<|6$V*NFl}Z7=Xf7OwH<vE|Dl3n
zd{&>=h^MAnI`Blnd{!>0eyW%}iOI}MF8unZA^S|L`*)ddzC*fp*8Faz{KwaKr1o0X
zT{-BPg#u1GJ3z9q_)Cvyhc?Kj6PByi%VZu;R=cxaW;1in6`~3q=S{hrsKCwJ>lDH%
z;g!#syXusu8?>%ug!LSV0knGhH``+NtpQi(@WYWguJy%k%TAR6^kKDQaRQ^q%O!(G
zZQcm&=fzvpH$dk*qYM{qk_Y$G+rOt^o7Ard-Ub!<vRd4vvUy(@x9Yj>S?zHos{OM-
z&^RI|{J{wa!Z|zdpR{d@YsiYJG#1WJIQG$*X3ubaszGd95vTDm^YP9k|NhcEyQIZq
z@2TY?4ipsZ5abN|@neOY(sEX!{;)6B2pd+;E;!MQUudK5fW(sxekf88J`tO{lYs1A
z;wh5(BK~0Wf%&H}IW=1awqxV~`34t;@w(@(Cwq2H>#M^d`gi#+6bowpvO}fYORQsr
zV`t4fi3(rjq?$<BU+cH)QNH`b$GLwN4uyhtJcJ-apVzr~#ES~W^k}<7mW8xFB>5H#
zBV{r;=KnM};1?dhw`v_e{gWEXz~*<ysQtPfnOB6JMsP~nA2}NE{`0zOMINtl35xmT
zRN*VcrSIY&#O#B=2N%+0thy&5q|nVDwq|o&S-(Ea(zMI;j<oyQGrUc18b<TR3c9pu
zb|$$y@7Xo}zC7WMrL_MQ7i56Tgm;kk0!1^lms(zqfVJk~1l7GwyHtA_i0Lhg!=4!9
zqH3PF6~h2G&z(t8msQ>bT?xgtAP&M#?nB?3Wp#J(18ctGEI--K`H;eYB+PDzo7hRC
zJK_F-7v8-M+@Wv@GTl{DWOi9ciH%EkM;r!oEAUwmMvq#1!$xm-^gK+ojS(QXe+WFR
zzPb9|Vw|WNAvN0@b}?eq!w;7wIS{Rws4Q;;_#W_?IK}&+Nte4NX|k5Yzt|=9Ouase
z`A56<77KSR4^M2!dbxNm(ykP5`f)k*KmyZ#xk_QICa8z=TkJ8l9{EG=@~D!ZhZX2s
z^`9lGYtGonKhj_9ncCMPP%%dc`8THLNX;Ko>-9L=kh<_ixIu1iSID{@Ht)Aaa!t_u
z@eo3;<stjm{BO6W^@oZ@@?+O&ORV|h#t>3@!i{2QbYJ&3m=NABI#p4RI>$9!lO9uD
zvj%FXs92&`S)<UK&!d?oYl(H%kC#&__h9B3>QvXrzjps>kIm|OSEy}thJZU&g?sO4
z_JO|+e<K8@j3$U7vQtH~rM3LFLJ-A#U5KZwZg0A!-%cBA6Jq5Nw$^;6L1biQ)LDv`
zmO_SNwa~Lw@1F>1K9+JC9}fLoZ8Ch&qM2l!z?-noK`9Q<A+pQ^ayR5quQFE41KUC?
zLZ2r;!$kQ0q?L{si5-;P`K5pJz#@5m*Mn{ONgPDgp|r_=Tp7MbM)ofJ71cFb&+@Ze
z>$5n`*v#~QkG5ZMcUD1CUHMNx<p>fplp4w&U^VFrx>6<vzg0!^?Y=X<duvH^g}}Ib
z+x5|Yj338p>7Dn;IP^%i{MhLE@acSRc+ELFZ9cm<BU|8Bmv}0=V*ZXWmezxk^ruzt
z#{_SVF3W9=$d5L|mfmqY8l}afheg^#8E?o$0iN|5Ek2GikAk00T_Syuf_W%ZA+lK!
zI`Pz0jhn(`#Yo2YvC{-wZxjH@aT)4*RfFK`X#Qt9{MKZm%DPdG<`rnlh6=l;vW2&X
znbJNKQbV|hb4bXuSCNbj51AfSnDP437P>VnxQnx8L!za!ZmUsh>+QoA{`v6@$d;}f
zGrmvdf?rXI0wV6Pzqm=!P8%}Gtor_=Hr6m9HT!B7^Owm53y=D%+cI_xM;7y*>C?%|
zTX)rP2lwGi7IJs*b>6fUnb~*g@yNInp9oW5W<gNb4Bcv&_N(m1IWo^GwreZ|>8>aZ
z6}@Cf1sSZJ2kr^BJa&mj;c3W~TH<*{6=)#W5-D!jT76<6`vdUGIY-~zO%xMNuKN=t
zswB2S>~v{S1{X1QC5!J)f&!cF_2|bv2Yu%;FRPMq<{is&aMeqZBPohzzKh|^zN$;l
zb+1uo-MhDG4$czy0&lQwix{i=4(^6ftEir-{n9?Zn}13F60l9z_Z)raaOHi6y7yt5
z`jGvq2RY95wmNaWlRWYowlptUJ7dtNh1=6fc2kK-Wd*O0=0KYoH?cLa(3G`4!rH{Y
zmvR3vL4&n?luGhtkcQP$j#8yh;6rmT-wS&=Mfo`~GGkgG;Y71%R~d)umX}?zt&(7W
z;?ntg)#US`0Ww)M@ZY7*qriT5LH_RvReY4p9<uSv2w~508*EogxRYs?fG)jePHY{B
zhN-5=m$`#+B9^1KSXQOo`Bffs#Kx3`c2K%&%>~oS0N(khcJjHZNdLM}X+xxV*pqy*
zn~<VS6W(H>4>{;Y9uNDYOQLT~U4`6My?QFVTzPE8!wx%>j(_YI&)PMgwi@tGW=+h)
z-*^<A6kETrJ$k;sg;ltlmOEj}*!!vPPCd{knihMqarH87WaRKBDrK@*Fa2CMjQh^`
zq>z%HMVCLcF(+GT?(+2B<gq_gAnZ>1>9bO3Yfv_8cpkI!Oa;ld@Ij7<@@Ijor@36Z
zOM@EkUbK>xw(BSd8>Yd2u;#7)+0O5CZ;cdJ)^M~{y74-o`{v-ILnaQF{kxVllzk#z
zcy9U)aF(6O*+aK?6+Z+KIJPYGhx#-x<@c|T8Lhy|Q<E<$OJ0-+P&GJ;2*i7{h=5ZR
zCdFbFyyeYO5SUudxu)k}J{JEO@fcbgGJb%+wlDY<ric$=>ekv=O=d2Aj`cGZs4MY;
z-4ii*$`{Has?qT3&*?~HrykSLgoPSda0nc?oEo0Tz52LBt~{xaH$ImB2zyiyiE?&U
zx+Kv|&-q<pI@M}8J}V=4hMSrz{ZbiKJ6&_~owxT8w6#~-T^c#fQB0vj2sT>(%rGbH
zTk}t!LL@^ZJIu0|zcu`0+4#ii&*(Ic&;^nkvNEqr4BG`)sDva!TXRsg%sakGEuQvP
z>j!VF3Dp9J2Hds&<ur3o^rY;5MH@c+UoL>hsXk|s+R^r!c+%?QH&?_`aTeJomYd|C
z9hwrh>eYom4g8^*V}5A8)$B`WTQxnL=i}uT5;8^X_@Z87_jNEKNJx5}T;TmHs?3<B
zr27X6PaEF&-Y#q4qIpfWJR$ybErfaZPM6YRx&P4nS;t+P5=-=TQ?(l}OLQLOBimnd
zl%jtP(~o>8s7=<RuzGr1`6FwO%OAx3vB9l{DBaDPRCHa>Zl;rpZ3eB*{XA3F(4$=6
z;{iEl-N)&&Ejs?Bsk~pmAKQor)80u@;K|7;`1m22Tj9F>@;ZGJ`?zdoie<ph*Hz)l
zyeYlt2ll=9?4)3}e)|m8>X@X70SEB)-G{u%3g;Bb9=8rdRk`2vfuohgO|U*L);hrC
zlK0W7nTU5)+_zuL$mP+l0A4yYT8hq|f;a3H)pkVGE5;5R6aD9RXa9W;^RqiGS7I&O
zelzJ#S<~AdbE)&1Tw;?}o+-0hhFi@K`^U4u2PBuJbe%)3;JkOg&eyo~UwdgX=Q1N}
z4@_du34r1+#gZ{U1%wd2`?{Ygq?(yRMQ)O$Svsi+KVFTAedJNP$u{FO9IQ<9JOp7H
zz^amq-t@-wHQrCueI0R+!YM4UUBi)P(;WMANEp*~3TBLql}+AKMAE$i<_bEmQdWMr
zN14v&knsCS=MSyChl4UkH>5ZfIF=&$z>yzPCM+ggUO=v=?$)}drItjMj8M6Nk`O{p
z5WYOwW4I4ULk7`8tRA`wX7uk-_E)EVv_T7$bM)O51pysa0aa0rq;<n9roM~%&0i!u
z*tq;5PcwS4o<;A%S4|BGJ&z9P(>v<NQT-32?(pB62u~jSw(>Krl%<<Dm%b(`HEnR%
z<(b~CTUUF+10EoR7^A^pd1JR*fRc3YGI&@Fn~<q*<A3QzarMXp!q?Y?wASWFkRNx}
zY*Lw(hH?hqZq9Uw7>|^#^E$q~|7F?^j0RMma>tGr!eL+gj5Rlyem+bgpccPi6I-{|
zN=-ThtO9;kJyH0@^eC7tg!NIn0L?=KRfm@^6KD4Q9fOV@<WtUp=WGC4NwYKW4ONv2
zci{)V5sy6Emcs33tssbfdTK1D*gSzkwJ_H0bb8!C^oSNV4Xf=owR03|anT!-s3{Lx
z`nt1Pc2rnX;{kk{vHsmhiOB?HOx&Qf-^qigz@$qKD{nBjK_s8GgJ$A%uBy@KtoP{J
z%&r{LV9HtDBQ!N$w`%yoch?6|?X3d+#{&H3U)}~?Dwkr0`M&?co%J%6x863$zxUfn
zxnuVe+2JoBsjd>q1V$=}yLaDdYv74zHwEIu#U8gOV4c=ez*Ijjx6|Ev@%cH8b?>YH
z!_!xXHT{QOqXN<b(j_V}#^~-G4bqI191W6^ild~ZySr<2=s*}fx{;C+kWTCU{+{Q0
z-fRDIZQr=L<J{+*PqH?HDVf1oCpeqcws%;8R_aMVZDFqVRcsTjYy9?7JoUHx7Ge*V
zjpYe5UOrKcq=(0ETvsg7J*WO}??7E_)xLr@y1VE=#8WZN?`_uv%6p84)myJM$r6P!
zsw_@L>HTw<upsihq4&v(g(8*LI?T=(!V1lK;Jz^P@Yiu9^B&giRD{RM6n73}ylQrJ
zhbwNR(>YG^Cc(c>XLypB&k<h;Q_$GGT=yIG!;M?y_z}NmlwWBb7~nS7O6|S2jTC(D
zey0}@XKoANU~JgUtgAoiCZ1>mi?mr{bKzrEP!B#=VYEXvER}m04m7@&ol6)oZh2ay
zSXJQ^Rm)7lGy8=z^Ju5Mz3G2UJA%6%-v0<>_75vFbjV`!rp2WFtjj5=x;Z9|rZ*o=
zrR#fU)mKF?&0Fw!SS3?-vbzU%nvco^rQm1J)V%k%Bai!^2yL)P`J$U8&)S5HfHSom
z-nuBQZ&bT2rieh63DTM;I!IH!g1$Xr%X*$K$G%Zi>43`L!whlckuBJ5=J&pGjC;2q
zyzYxVT%5b{_syX3ttshmY3yGpV(L};SjF#%8$y(n^fSEmB^=D2mP?+Sy2P$gQhWsY
z?>E-rd>p2MrR?QghCO9If3ZUNfynYr`f^i>{F}n&`!ypit$6>ujN1LP&H8tnr<z$G
z)-)(2ihcSc1CzZ+DzbgK@f=&NR)~o;_4%5mw06nH3T)0$6!ir~1|w%;3sjRwb>=J+
z;e0&^%d)7|`Mgv@4b>?66Eb#wgIB`NCVNk?K)}w~DN(=lgZGQt5hB*6fG!^l?6rJ=
z_lp_TQUNtP3W*r^2y^k!I$lWo;>nI?<cLG36`k*&g+*3F(lHuYqryY7T9{eq_*Z*h
zJp*TrgqvtPi$LWh`ES?u1O}41!p#@x=!O(pS!@7BmtC;?MZPSX5K+fO>@!n`I(vQ`
zA8arFGFt~s|IDOi?=j}WQL`+rG3D@HtbcaAAPFw!L+F?`s*$IsEf`uSx5MAbges`j
zZy&teW#a3ZFD*N>cy8|xAJB6#UA%jQr3NH3D1|D6igS-@s&Z5f2WYtaU|{8BO=jk2
zY4drd3%=aOzJ09lavNg;xryj%BLDI|_a86sq!IO;l~$>q2URv5IWerimuIq^HS&ig
zLg{!?gT*D1>tCcc?)v`k>#-#EPFu~NC9nNyFqd25-5S`vm-k2DSoE+)<oQ~sJ@Q<?
zHH_uFXUkfp*tU$`P>`#(^%FcWXZS2Dq|toxP9t3)nCP3U3}qdkYuC{tqO17*+(jGC
zj6`a!TfFh?U2*tM(;E&+A}1`Mj?7(^BMbAw!gOM|C<n6}IYa$~)k~XwEAyb5Z0dWd
zwUH14PqjmJ$0IY9(QMzARKb2i6BdwU6RkHtdXFgo#v^*A6-+xW>fT=NwHh%?P(KmB
z_sq1S@j_Yfq>XhjGVn1jOMqH={koUb!i~fFRiDtjdHOY1`UaX#{2784(m!R~B0im+
zq-f?9M_47X=BsCIZIYkC{q_ADo7*`zc$^O1^uCaUdj@5MptymMRJ?t6m<ulBh>aO)
z$9#<2`ISK}Uoih63u~RS@jbt0<yaN}7i9N^aw6yyRch(DGm1hHkZ$rHwjNHCtcm-Q
zE*9aTvBZJxcM9Iir8n;6JyKgy51+V-9MhGAwN5--79L*mJlpSf)0?h#A9Hp9n<DBM
zFS)8qrfPfCRJ<hXHU#3gp_kR6@!NN1sBPDhCSjvHx*0V8gg^w3!z2F8x4W@b`Ky<U
z*v;pn@r2xC;Zv@|U3~_>x|v%$xO=EXty~CC3Wp-Z>5)&d1@OWXT`JfsRX*CfGJ^}I
zv{J@FW{eW)^=ajhaWC7I>Au#<9;IH)v;mr_C+KjX3%7XtP&Cr@qz;wc_i80bJwjra
z*i@u;=lOVHvQc{FLv|0pmWT;CA@crhP3p>;ID@W1<iRa^_xLzChJ)2Tke$Cpu-Tje
zy*QC8gBWAOZ$iq$i!I@c@w9H20hZz<IKTjIga`i;Ku%yVOo1;$bX+d-e2OY%io07T
z+J1_nKKP$!dE#*T9npZ8i~dKOmZEyAle!OCroj|fl?tYTJb~ZGq+A&LKCxYvPl%A<
zgB{B#dzkc8Q8)f<_vAm|lVq!w*e~z5+j^?zGvdc6x>Jrw*b$sn%6rv$CRC38dkGO+
z{@jHsNXnDK7g=_JDU)MfABc5`w;t_nnQNvF#66Po9?b%c5Dk!d>-g<!ems;Zf4qJn
zwL4SGcGi1BAF=&dLDCRJEEaFd%SZt7F4fuShztJlN-A*XEVIuBEigyoX7-9@Wx356
zm60b>RxHAiYA)28?(4StJ4u=CgfC|~)Osr1YkC#2gPkfk!@bzbe!7qI@OXkG`b*BX
zmD-z?YNxn^A{#<2-K}!(wvAa)f`Xk~nJkSBf6c<<-<eMg<}}bPh)=spAGlyDPeZ{4
zl%!*wDMJ^<e>kd=af)fO5ffL>vWFP5xl=es6|eGZ6_))Po|o4~TR``-@}COUov*%;
zaj@QrY~y6?{w*+h)pr-(mn1<M-{s+aZ@dyX0f9YX8nq?V8U($?_r39ZlDa&9!P8QE
z!rxhnC7datgwLgBr%3q}`R_|qePd^m;s;?cS@WqChc>MyrX&6XwWWhz*(fbj0_&)_
z5^~VHrI;YW?x@>fyBQWF{vJtcFehj{tH!N6g9D%{aEdtu->3KkKk3d~d0^@9!x-@3
znF@PEz*Fz3k3vw2;h#$~dc%pEv6ajnI`YNI@5Ha_jYh9pl{oqcOtf(r!;TC5-zb=9
zPgRqIOYJuO4LdCwy+6pyIoKr<aqsA)6wEHq&+JW6Y%`5)x%$_oeGmSrh+jL~c=x9!
zaeqbC$y1k}mjI`yz|^qx>CXpSA@B4w(?x>8fiF`HxFpHa$(z2OTSOQ`ge`n8=4t|j
z%K7J|fp-zREea)9FZY{NaKU}V?b6@mldR?>M8bdrdV;FyV$pZpmVG6V&8^GQWwXvw
zZ84jIXuV3eTc!x-TOpy>SVEa_b2&cF(Zya)Tje0=c9*#8<{8!x**d_9ohx}|?t|3Q
zSFq76bjkv$20X7n^iP>6;DRwJr>pS-?CWTj3Qyhz(DPBb?CMk0sF^6j=AGQXZ@uM9
zool~Wd!M}9>e6?yYAhe|e9f;a@$5F8$Kdw4(FwyVb@TMC_BYqcqE|0zXkOJ1MeI;$
zMArSFE!!@5Ei;RcFm5Y&x<A$HE%>q8@h5RIrRlS1UnCR<Y3TFYxy-VIYetwWUCq{j
zt6)_SMORR#%%cK%HnEWus#*E2Y^$3O`k)3T!s%mqA6XNnsB@%xqgJF3qR<u(6}<?W
zI2E1gC!cnH>KCt7+`=2B!$e4xQ6FM8Z*%wQ&AF3Bf)1CP&?R(YY_IB`bis$1XWrRS
z_`{bARRa?CT^t@O?=z(363z^X8`tAdrb0L#+&qMEkURdG&AHBHcK15)Rn5{4Pb#Th
zVsa@Vu7OFb@+;>wXxpBRs=jQX_lxGY3(RwqF!m-_9-1jPT&`f_>;eRnYt95m$~Z-$
z8&2W$^QM#$rp#`8L80Ct1{?F`clzox<k2<zI6amWW<+`)ZVM&h0Xd=aOF#B?$?SN!
zj{3?!zUWuL(Ue>0Wz{k6zCQjHajb+t&dc>ESh0W(56-AX9zGu0Q@R$JRU8DS-%r%d
z%22~=g8gKXE|(DNAE#Ue3ag(lx>r@rq3tK_aS1A}b(=0iuVC-|+KgbvzE`eZHcf#?
zD+|o3A60$2g)DxSz5dx!<AkBJ73u9exA<*%wNdGnfN4B+m_C?`Guld9Rv_qEu^uzk
zQG;4UW6bE3KpdMMd9qLdZenTKcy7c_(b=`dEwZEiBzHZ*SMuNQzp_>30{?nMx#=z!
zpY`tCy~~(%k%CkXcrg=weT*<>r&nQBx=*5vU#}<*yus9@jSS+ZHhxfx)YFxUYjyZ6
zSfV3YywSF-46S7he7ZGXsQA0<^q2GuAr-V~0;U|^ODJJ)lBRy9VZa#>P}p2);p1?Z
ztFJ__?pkX!^Sf#&Nh7-|BU~QEOF)zIkjwV*%rGd`BjwR?{{LYCM05FG6%ZvMKCT?z
zGTi2Y(;;NUvG@|g;^MbGf#bu&-^}A)X1a+EF>ve2YTIwT7iGDeFm8AmiXRW28^ulU
zMt4-&hvO_BZOb{qSqugYOU_xF_|qbhOE@bg9Ak>LjK-p3T%GJ$`BeQ>zrD|Rvju#L
zXK)Yo4#tpcNKW=-XGrYDs%t&?#^0rf)rRh6Q_W;qRh1P@na(LGrl6w;oXJ=N{kS1#
z$H!MVvZ;n@`m+5X3MX%SR5_-CSt*i|(<bI7rz_v*nd<jn6I`{bSIs$A2RPs|V^?tt
z+#e*UnnyriH1(Hay(s46%~8I&=acZpGo2Qi>UkalM}7a|FyZVLuTJMwE)nR(3@l@E
zO8^>YfoZxcFdP&oGsxWUD!v%jFESGj-1xfiUvY7G-^&|pxf>b$<J7^k`xT*+1DYz&
z*6PZ|dA-hI@};vlRL8LyiJdwD%G-R%E+{wYF}358f4D0kl($DNr>Q}*7aPSeVtuB-
z!CA{1{p-kVzAt2&0Lpmxcm|~oM|qw{XbuRjHF?lB0L*3|ibMiC1u0c1oU18_)Mic3
zxYC-|RoEsH-!(3Rc!0yn!{HPL5)GGU7ildb{L_&G9Wb@K;)n;>KiR+)2<*2EkIRVp
zeD#d;x5?67nm{=h=M2()ZeMcx{wY~S`*=){Xyxa1yzL}j9k5I)m(N_Q^%}0o_yl7p
z233=ryhT1Ra9X-kQr;BhaxoE@%`O<t>O8>iXC&^Dtrx;`G{;5Nc$EnH&sfHkPjl0L
zU7XZ6bSh9TibE`Y&oNMyEUv#;^xmA8Dy}u@S-$#xFK8FvR>1M`0Av@4QCzCIh1ZJ<
zrY)<{Q%>r86v3okuH17A<jT*?i<oLrl%{}KktL2<sA-|HgTfHpE7CANnIRjun>Z7F
zRyn;QzUZXcuR_8PwxXi@RSnc4^mNQHoDqUEO7$CcA(r!GqQcABbVrV7*j22Asv=ye
zlvC?1FQ4o3W{cXuoUf(}M!p^2<T)6;RTeKiiFJGC%wPM%LOr^NmLq}krEy7SwN^Un
zqMNFTYqV*cx1<H-1SM5)qZxGJ0i`t7k+u9RKxELh{`}G)5;7MS3bk8ySU>CTwu1IE
zc76X{DDga_MM`d?mFR}``@H@;HOg#P#jKo>=zX4^pg<>Kn^zMV&J$8V)yhmGa(3Az
z`tohGt!ci}7p{^o-o4zF)&1i#tM6N!=ZnN92!TE7eSGNi_y%E~A)B$YP;lk~4l6&D
zoI-WhR@Fdp#74y$ONi9JSEO)y5Vnk5GeeD0A@Ch(4i~LR$Cl}L8pr#4iYD(DIsgWh
zi?*XGn3Et)O&u>X{xJ0t=Ri|M^CzA>Dt1CYOMw4*Pw-1;#+DJG%L=yEpdLr6R@_XH
zGUMOc=dpBQeyThw4rO){WubiR4McNj2AMG%3*|k&_+dna4sJ3l7bqr5^4=F~*1)gv
zCEsH58#5l$h9(>Z5eU-f2%xvSy71=G9IFr7;-^n9+3Acb&O0>?=^eOiX?&=%-$^Lp
zc^9POyc;ACzlRL7<!XPY{Q8I-N6w%sP(NY(L?$`A-O0uMAYkU}n+wP{zdR#@IN|k+
z8q18Ad{b=L2+3C1vu%m<u_z}??<|#4UgHv8wn?r8-)k(OcI^Dp1H0z!?P*F>(;N4D
zn=2xPBP{3Bu=7?#7nA2rp1pga&mEIS5)+$H1rZ)p7Bb#qw;$t2D{>ls2IfKIr&E-6
zJRJ5u)p`p&Wz@0yYH1}^qa6{&GW`A+2d8eNw{Y6>ayiMfjK5ZrhwxI-yaXqQlupKI
z2Z{-VRebASCsAi8MpPt2Y;e`#c@v2f4+tOe;<3WhP!_6H0teeClb+r}wjRP+81K;u
zsxdQ^plde(Lt{5zD=e^~BY&~-DfM3_q#}o2W5CnI<f$j~WAL{}+1)-E8s{Qg-7@x>
z95->sx4|)5Yf1Q-?<inbfKa)z<`u2QI~jv%5{;7>1;S5iZ(?J13#UFK4?Fdt&AH5_
zI<Wqlka!BAi#Pq;F}ZxOMDF^EO<ncPNe&LP6<R(b=0Q=aD^bQ{bsgT(2)!wSjOcl3
zAe=OGQ_+!u0FTYnx|8%+n<b{7d2k0YS3&4@r**G?)8*M+KCDS6q`8IjjrRz#={?w>
zB<?YzuWB%`EdJX4c%@~Fq4`CB)US*|N_@o`{j#avr(XrozL2VNvAWQ_U#?s^VpK$i
zC5&yZ>0!HKY*CjIqoYO4ga{UVRQyLL8d>_7vLfOu7Bill=rVe-{-3jQ;*5__HMy5;
zbDED1GBm)PU`Djc4nLKVgfMHKXcFf-;rFR1jf<|m$J+?RI7ddSRjbDg9yjcTUP%Rq
zdJB&d1=n*%JAwYGCmR1gx&4~mbdYOaY{jZnd-D*YW<oQKP&0uk71N_V%!uB`O66O_
zGSI69qJu5wD^6;!lNvI*O5PMRMq3h%iaqiMec1bz^k1au$&c>iupk%Zd7bGMdZH4)
zQN-kLi7J89i7%18&hKd@T3JSJ93g3cvl7%akeO*VS#^#bTBf-LKqp}*XYjSN<_W!B
zv$Wl9qQH&fjmB>L)O<OKj*3k#6t7Z^muu!mN&-|UCZ|{&kfmTGmN;XAv5%SK<vH4v
zvx4kON&4j_V_TH;8ToNe*AB%5eL^cHavwbpdEm_v;JL2}M*8QaPmSZOjb+oAJmbNG
zA6sq9cJh=q!oU%kAHKoL`Kh32i^?%u0q`H42Mxou7wQ~MD)i<v{H`MV)MPA36YinM
zMtwmtolL%eF<v6n3{>K;!=>8LI5-WYF?A)8dg|OY^SJ(ySX<8?dMs^WiNR~0j^;;B
zb~_#nJfr-{JNrht7NVgkyNV*4wK3ek$2a(*t;PsV-iGmw*|?4MX?$w&i>JP24mh*I
zEv};eO!H-uf(&b<xEx=+x+HFbkH0f<I8wbxj)*y9fHC*Pjp;|+d~ia!1A~o=eL9z%
zP|p%hm&Vi)fU|HB!O6ty2?nvja`Meb%-Kuchm*CMH<Nb(pE|quKX24dZaw?kp<(#X
z+0yJ(U&}tMiDC?zh!Dm?oZzPobou)64_(B($0mOG#;M)n5;hVvDOuw8N^pJ(|8H}s
zIfghw+FEqv-cJrEme7VKrpl@|6FkWG{G&+@b6DG@v!Vn8H7?hE58(;^ddxNOBzP{f
zq(5m*!X@P7voZ8+^P4Ul*v+uw^v$!xcbf4hGI}272e;{?FH$MS*~+eVF@l^$dagW@
zn`{(q2;jqrAtnT&Bo1EXe>=D*cBhtS59uC)F6{O{(DC-A$)&)39dWQ+9i;yz=#4dp
zA|IFJ97SJS|6AUQC>q_xJ5FXRaj(8-`1WU!Y`3%?e1dkADeZpw#VeM@qXK!)e!lVM
z2<4UxW3`>w!^~x<M?%i6$TAzZTyGC1{_S}kA>PiM$-}y~+D|=kf&;kylAnamZAq_<
zKOWdW#rn#H<v`o{O?>ew#Kd*kjm;ghAF*Qz2?jPa1Jr+#To@115BVI+J))nESxa}-
z%w|EGqYmVsB4~4ebqpjQfTF^opZI5@LDW$wO#fDbB24OHtw4Wpe|D941P-Z5=i>nv
z8l2j_F+)yOTKUoceYRV<QKM7g`0+(B{#08_kdNKH_f!p7I^(YIvF2mN=QMGw%(Zg}
zCP_9(aP%AMnV?UTeg6>8>NnU~yR&^d0Z@;}f}V83oO%OsU<imh49ive-n>o{?r)+#
zhnHC{x-M*2<UY?Bpx9}2E&gMjol`p^m%P&|)=1K8lF9RQZ1?Iu0eM{nUfj|al%V^x
z+i@7sM5s*cx%V#8NOZfzlFIzzCdNHq-Pp|APNsVdllAeTji}X#)e)ko6r?6+Mi@#*
z);Ba*z@~F)H$CmldU^60_JJ6>vseLEZ?m{mqWEbOOISx8Morq+KuL1X8DB`rn?!|G
zz^!jw<cgH3q$i=AY{HrGNSvf2K|$h||68-lEZZ^IBtp_8+)XDBdB2E*V2e8Fh|?zv
z*I9pKsY>dFma)F>{1ysIIkJYuL^D|_60#w2x{|`Yj(xVGGhKb;DuoCfrp5*amYrem
ziN6ul^EEWE1-gN4-i$&^O+H_~kUjf1!1)k)H`Vajp?&>so}a<!w@j1hqPvI4{mb7x
z1hzz21#?v1UG0Y2?(*Poz6{)jYRI@oZ*GSc_wNK{^cVBUV<Hs9ce&b-N{X`ux{{#F
zp_wyYV?t$GQE5$eDgI=Eu(ki68HAymgf(2~WoKklCX1?^E}`!}CO+toa}S8T9u|Uw
zweOjrX&bM3=&c$sa1rJ}{xx-5YFoi%FI=!QK5gE1c^^mIw1MV7t!X#X2pj`IAydqQ
zMF0<eYphB=4VsPu`x_D~vno|TdYsBvL$WHm8Px5Ss=-Zj55iH^B$&wxD|80bL!wV-
z?xlX&vzJ|+qbb}uN_<@8x7+g+v(4k(U*f^}rY$OKDvk&Flt8c2GU0}789I^$BQ%r)
zh|UZ<e+R>FLDGcJ-gS{iID0gvDYfzcN%#Z^Onki2y~EZ|eh_G4hqo{n9y6URbvZXE
zD2vJe0iq2mQPxz!YD0fzQ?r`n2uJCDZiRY`715)w`IPvysP@VmnM<M1HIq^*G6w(C
ze{BK-c?wSo0A0rmg9`vOnc|FSKFpGeP&aUX1k{5xk{NWGI*_JBLsm*eecv%KeuYs?
z6NEpU8~<8>C>xTa)EwM$1Vm`5IBUH?C(2(L%dJr^$d}q~sat2~|KId%w#-2?R`}|?
z?X?WT57!weXFbB2c95V6rx}k}XMQ3ZH*U};s}k$%^I(|@4--S_XEmdcVL4*W#ME;s
z{0CSC-9L?qf?M>3g)6jKOpmJs*YedMdFFe4QzFgA66IYK(?xy&Bwp@b>Z0_aR^)j^
zn~K{SA*yBol;BE#kiHBw?KK6X;iJE=8PTwJ90D_t47NO43B}osMpEIJbUVP%j!cuR
zQ45gdU6FUM5)+cFcfE)EgNwZY55m+Z6w%}+-s;b}s!A9|Q=3Pm5jw&v;w3s^3Mz-f
zc<|b<UM{0=@+nRVL)iBSaaQKI-Ws+QNg5(;^bjpv;0V5b{<=dd0&&;wFM9HNwyA&j
z{8<FCuteSE+D-tlEZ~2~NEku&gJ2g&R#(pnFymqSclUCxqeo&hs5M3_DDWHojpGVE
zSq$j+4@WH7cL_$5VdxA|y@t-s=w~&3UQ)%{1#v&%R`SLF^pReGl8s9EHz+t+cWGxu
zujU;fKg3g5b{Wje;Tz5QRM2J9CdccXN&M#^g{mu@xk8!>%0J(+@82-?V|vnn0qw((
zt3tlhjCBl%l=ls9e&%zS%XI#%teKTfPy_}nwh5Y@dTJTr#LNtCVEYKSZJq#{V7gFG
z1@71XhXqJQ{Y@F%3hP@eW~UZ!Q8c8G{zFOgB^>cLyS4Pte+1rCQ>8Dvtt0ygYhS!H
zl!iWQB)TF*>HTQdoIrHU`(IZt0gR>i2W==xxaIuAgE0Q(bXyNk2k_fdmv|rXfL;mj
zrlL6&E&Fc9exlB}J^%2JMHQR3N;+SYS+Hc=+Hd+Q?Ic<S-MNGHrLuE`?5U6V&yM1Q
zlT#+$mW752o^Iw8F9|}IB^RHL@y5hGjvw>AUK}U_h#=w0Oj%7c1aGh4u}+7&X^zuu
zRNe#**xU3EusTu2PcygP84%MP+PTQ8R?6Qc#_4E2S*m$yH8oe31hqPR^SUO0$XgX0
z<777#{em)JKkVu>s&1&dfe!6)ez&^1YR1-VX?$x1JXBj9iLVa%FKF#p<_YASKXFB!
zXP)K}viHfMWqF;MbT-=JFE2c@+T{~#)OBgigQ~!(&`;wbINS8*<`@iS90D23E*t(&
z$tq>2%k8`ibk0Q`t~<?3z#J+od?<+rA14<^C(I?;;f$7g(jIyXl{ewpH3yPxn=xeU
z{R&6)^2($eXS6|nt6*VyXIZZ#q!C%0)dj5qdL+lBunA!3WqH{%97bMGQvTZii0IHe
zWdvw}tHn~GB$`V@aMH7&S3LU{US63;2-j_0RzQ3E5oq68_c=N8$9W4HFPJlg6m%0K
z15AvczDB%@t9)2j$@sTkM$B0kY;zUjf?JC4O9O5Mv*TsFaBxb=1~~T0HQozO(ie~J
zr;LoemjY$^&|o)5BrCqVc;jBP%=@kJWbAuT=^y-TxUfz7Yx71=o$7?)%m5{h5%_EW
zhlB+v|GGn4uch!YGdavJpb#%FHXaP5-)5wYM(-bT=m~PZTbiUL9ixkxUQ8>Ley&9<
z(>Jhv1v4kL-kT4W_BMO{Ua}a|@OLwYGi$6JK=;*QX)T|OVR&qLoA!^e3e2Y}$q4P!
z8*e$hCX`+aD+&0LV>b`d9jI4&c2mXt2O1N`Y(s>j52YjH#0e;>onq{#(9>Mb8If8r
zz~c#vnxEia9xk1a0c4C-y+BbA9B>hsd|E#`pLh;!4&*kYpkJn=%5W<v0Y4dZbfP89
zu2zz0qA9QYlUb_6PGD3SmN6Zc0v_W3ysSsQ)0Xpd0)DKNGGur;i62;_tisV=@qqdb
zBYXDvG$jsKqIQa?g%=K12qjdYWnbf^VS25)&Xh|FJ{{q>_`eTqK#ZkWIxT7Q#5}Ef
ztDJfdE0k?n_9E`7rfCCoGG6|=X?~+5=dhmL5(8HIfY<(ge&a%C(W|6SBa9muB@#8*
zkcu^FNsqBY=Efo^o7>0FK~U;Sqd+5~SH}ea)Eh_MR%r)0x<gr)iGK9Z><~34EpqY2
zSb3ccR78IvK$J0O;(!ZS$yIf}dO@&cSE11I_Le^&XnJ{NR@?H`KF-=t&95Q`@;kf?
z)jC_kEwQOYh4BeHp)@N4g&g#8vIRuu82cu|GTN@|axCq<n9QQJ$Y`xbpeW&A{@bT%
z&syQKZlA^}ZMyeGx;KUDO~4Xl=^w#V<wPXWK2P0VWZGg)k~CcgI=_B1rMZF0ufJdb
z91M#X^Y#o>;gfDu)-wOehVhy+=fLm``22HVSu>DSCY3g`6`o%7_qHZ?M}ubsPGp(c
zOqh1yr#e7;X@<Gct<<lf62K0j<l;$B{kGji_|5rsd$(jMKX$XPAQ?A~A)MUkH)Hnv
z+k_ilhxY&;Zgs~`-GP|t%WFs(0q2-dc_q`P16(B71d;tin)tn6@3_;6n~ej8cYLuv
zW|vecNtF7#4D-`aE4C#4nO>$tl8MVDL8X82QQ0?zJ!_bVw4A48G8c|-45w_4SG6O8
zHrJ(dh(_!Xm$AsT7tp1NQ1g^j@3C?1-$}9}_4&E*ZXF+d<WVKX9P{ooojpV2nLk9;
za4Oo}>!!p*(9VDL7qryu$SB4;(+=;a8vbVHNKFT#ZcDoxX~t5L2y<}E?WK!5Y5!A~
zSLfvLQ1r=Fbhg|oN;$*M%#7$dNfE|IA62{ZmSWd_UW}vxR3Z&@u_i~ym{s1PLykW8
zEeb?|s3sqRV_}UeTDh>fkN+@4d8U6hN@~BwJSdAfa9!ge28UVB-x-?v^Oko#k{Ykh
z&?$r%Iw#JNMZ?!rN!!1L(NK<8D3+B_z0Z!`rb!3Lhg3^iT3oQ?i>_8zeM&)mK+esq
zW)0LzfXnkMTQqdQsPiGhc+a#p3QSoKZ@&JI=^7Rh?|9U`8KeH6+^$A~)$aNIAAU8e
zKV}{bHnwc`$^*!Qj_`4tejuaJg}hio2>=pV#t&MH;#bqc0BvplZY0*GWc^~_D7ZkG
zj$WUR41>5`XsuQ;`sqE`lO?wRsBB)Gr?mWMx7k#o*t#sLBwldKJ<;MVm9JtM3`pz6
z0g}|0MB{mmeU_@E3y}EIp{8Y-*@^=1VbBGo25-!}V?F#v3mn0F7a&-O6Cp_grrq2O
zNHup|$u3f}6myVh%2z{rw92rnaNF(SWHu?s)Xs%i9`&qOPsal+%ReNVJ0yAIjaoXJ
zMfE_pdrv<7^Nh*1*%yeHyR<f2GtI^jU_Drh&tdS%u6Oy9l9h|+Ad(@$CpqU}DowXx
zP-TIv;{w`TK=`reHu<wH!}eH*zS83x2h`L0!_I)`JQ0BVL(R(YoqS|z(}+D{wfX(-
z|KhYma93h>?A-c@wAg_#fI<f>A9ARUKE}Al?B{tY<6b=g$3uUurJ>byrXZ!f`@;Ia
z)T$7fgzwH{Dk1I7CDw-G9}~eY1HZUtW(R^^bpqxTU+yU&H&e-kHF~qWGViTT0B#Dc
zZF4I?t9CA^fzrcs>+t``bf$sNDf)@f#b9Gy5>L9+DYYjc+}3Yl6=pC5_kJhKNLCr(
z#t4f91iK!&=P%4I&gF;T$0RT7v3|UaafGi$|FC();b@aDU&!h7SiY_F@yE^V0lC=H
zpmh;~P5^+z!g9Jgxye7u&{s-yk&5Y6T7s|<F3Pu%j)^n86L??}e@-*dn)of1np=RY
z+0uKt?+^=1)9Y6cJHOJQ#CH9AVP&niKq)nSzb!Zdzs%SmYG4G!akI)Mn>1g*X|t1Q
zyhQyz+JcX;D(J#Vmu)Kt*pYyA9)MU=DxKo(lbhLslLE%)0Qb*D#R$1B6oWv>y$ZlS
zsdZW5AD5Tc0Pd{<H#K5kxU|)i`K4Wz1NfaFwnvbDb<oc9`!7p1Yae&Qfd#EX8^CR_
zodj?=tRIhh&aI?~W@gD%;}yCehrlknX*4T(MaGzFN{qcPbmE*n2O&M|(e^t=Owma+
z(547sqhc3f>5{l7tTae`fcbwfJ3utw-=wijfpe(&NVev#cXaE_v#ns|CWjEtCFn5-
zJNrAG8VPH^B_(`RV&^|@X1Wj1Z``^Z1+oNN3C*@2V|~OK6$DaAx4(rM6(p{op=yhH
zP>7QHnbUc6J;m!OyplM;VPO^(Z-uWwYn7`pdKnDq1m=yzwDi%mC)Tm-f)5>Eil!dD
z(eM5i<DVb*c9>TQr$0dK>mXDUE2KqJ<FKX_lq%)Hf?mcBhf$0#|Ca~492c0IjEm#0
zyhr-dCUsjwskMN=l?t%J2bGKX3?yEw*(HjOp+kj$-3g9ubHs9BV;|NJ6v_!mTF%DO
z!aPO}mhSzmpw!y=)0Y$bWC~M|zyFnr|M~yImFpn-G2nAng^$$`5p~d)6bLEzf9lPV
zDuhG_Zx=XF0VQCqNaXqRY@vtC?_?P}xWWH@EzIK1QA@Yz^A2EY0L(`~7WWN#I>L=`
zF?>rg%o|Vk17yhA_7Lmq%x|@WqN&_{cKdM!_A54#u6hZIach#=@15!?fF*>$A$BFv
zk5PMoXX%RZSS9(Zc^&+D=TM!eM!&geR<X?{bVN3RqITDeXR4&>nkyyMM4EuY8V6N#
zs4d*Z0m*uvT|1-Bv%uR$^n<8_sNm1|1oc)kf!EqnT{-gpd!t7E?_t{HR(*K}74^!n
zhKVpBYY01I;NteT>j<|QrE&z3H9o3FT}QZhnwBcGo)*eq!e1eghd%Yh3h@MsxfjY(
zQnrH%O9cxf=;*=$f8tynR#QYYybDb>W=(*q37oo0T5(&}@DZqa{JJ)!Pp>2P!7M!w
z5CgIzS()EwvD1%?yQX1tI6I(19pboLLPsEd?F`s2Pa~<cbS{cpf92}GF#WlRWEyw+
zKqJq4=#(;k{gduUU4>>IMybISic6-=_bBA29_*7;_JV+ml@bkuS89`yG__N$HRY&-
zy0)bAO&XJd@%~qSOQ0n`^qop+21sMTn9K`PpN$|3r74udChJ$n%0k@)qt9GcQonB8
znWf!^foI}D=Sd*8mJJaPX;V?DRJ%#bZTfqTROqj|@d+ksaw&`T0v^G`gNABd+Uln7
zc$z@^`fyhGHQS>5Ph%93n!TMiIB;ADA9s?s=;NMk2rfS{Pumy&JbPNi388ACJNmZj
zF}qNvT&OFJmNH*^O5UdC+N<l^%5S>^0wJPbRIwn@YW7{|z@Lk6%QQY0*Fg>V$2da)
z28{*zX%3P0`_^soR_7%*H?8Y2HOysYhEnG9*RuYFIuXB;gAY<)!^|T`$2>c5UaNNm
z_g`N6^+II`qz}W=Vm%^~vD#&4$ymU-n;rFdl|)&x<Oed{77u6R4g)9#HAY)p7ucCj
zGUq5!xW9Do`WQlS3nnFI^C9nJ_dM@#bTD^L(+9MdcK8=~KMF)XB>%hZ`%GLD@&mrD
zK&K?E<V&Q!fBis{nd6r4QN@#$YmF6QO*EJBk0lQMKb%UN51`GgKbn?bNL2w3lT&i>
zZHK%Pzh_=jt6t9-Iw0Y2CNkPM_IU<sB>E*iN1l{;;=%HdC86w{Y7v{P2Z9V3k7z``
zV8~Sy;{q?kjHl!Y;^KyG#4a%m{4yieb1A?e6<Dafo`h+S)hPe#B`Qz=GOE~spD>@f
zsBrDum1ujO9y5hUN)9AY16DFX#Nk`FM~hQ#xvc)exFo{UxJ0B@YkY?`XS>#2=ZPwX
zlZqXb0^{;%ukH{59or(3S#1!G2HuI|;eQy7BMvg9Z*MHkrvYjj<iHOdU{MNLrY*C{
z0^AV>ZsyInZG>8|$bznO)Y0uNBzi323C1rC*X`3P1FN4<&Em);+Xxju_Ub<k&_h9k
zdtPBM_TyLSKRd~CrwZ?sbASt{EP6=iN-<VMN4GZ5SyCBa+wS|h(tRmo(PIE_O#yY3
z*S~99w)CnO5Q5rPRaNq{0hx7(_XuFO0T$nnoVe4WRjv>C9nJ#Z#-&Mxsh0&<!&oqT
z)GiV&%Yi;qnCQP>b?kjR2N&$r>_)S<jW{_#JRRQK3wh$<E{2af`zDwN0WN8^n$h3?
z!vd%V=;#RP7nGj6%Dn}jG{54Dbt`63k_d+PE|~pZ{7{=+%t)XDJmF$XrL!8xIRQb-
zFg8Ftg`oX|!YT;R2aQrg7ED`)n)5u371OHdd(f%JT5_Myhi&U=KF@vEY_?pPcRKMA
zO?$d9=WEk0)A3iIYU=k_^?HW;k>Z&lxB>pFZ@lq*^Q2>zJ!%RjB`}3zMm1+v<p>$~
z$b{TmlwOUsm9Fj+O|i%2IT3>bBOexA(tL@Ezdq3{b;LI?pvBV1++?~fmex|Io7#88
zhCezDm|2!@{W2f7eP`RG9J^jMTz5!8u!GA1w{_25BZYbdH_xbPFKXfQ0|!*qDS~69
zumvhUZ=LQ?qWNAiz~_pFyszN?=!V61zlfhPljPoWl7*~*3h8ST!wUCXi{8J0a=Bfm
z@vr5e9$5VfKj>(1_*ZZJUb7v^P)sjlb5XC&$U#Yri(!X@FhQsv;D4lqZ+LN;xffm?
zaF1HCIHfySx~6L!@%W86IAx%YKi=}=rn!~-r7HH(9;pd8i?)v}`ytTA#lTxR&GpEE
z|GrX-rLjU#c6?-vlQZep2$W={u7X5y>E}785s6<CCcq`$^l%2-$ckJlWgPY!IDX>F
z@L2A%E$Q~6(g$HfDVh3)doH=%6%?(D3E8J{u=in}4sK(lC2k8LdHP-#vID8mC*mmM
z$Ejk&*=t!hFI4><D}BdEG=fl%4lNM3UB|TjmSh;c+uiK{&!si3+(ykhohYUvNsf>e
znUW?8)F0p9CdmR~@8Z52YOdr`{;dn^FEw`?Pv%h7O^WiCEKgcab2L`Ue8hi_lTZj*
zxHX3bNG(K^nN*zM<?M6Ao6+zl*t&~P;9KJOC!0HE#DLhN6co|ntvY_ji19L8_hA^Z
ztTXy-za;cIWFsoW>CG5%eaDmm`dA9-ao@mO{HqzKOyaM1@9Khr6{PeHeLxsv{|hzS
zNt5UzHgX4nM-ALXLo>UgTrkt{Y1RDkQA#tKS!7rdi!sDMubMhb@Z;3YkKawshgqvn
z$6|_It|NM~PsDjwT&rshKfa*F<!dFx7JyN*HZn(a$YGnVdSp}ggVRYn6rZ%Q=1i$A
z#kvt%nR4{oNn*}|0IDGY{jakb5|8K6y8M~ZR;I!s*Ds<GV0AIH?KrEyS^YS^a}SGW
ztU5~|3rCrP!2amMRqW>gTIWBxH0m6W2y6IQ5{(Sb=A~?c@hipDYk^iZ%zH&Mn-+<m
zQ`M*2dc4%?+>z(1^TK(F9Me+xiRv47$BKQgK)MI?LvgwLGWLTVeg|4PQr*fFhz$*w
zEaN0?2U@ZxYHv$5QeDj1DACVCr7Qqjx|iJ~WrU%8_4G4N2l2#%eIfIi@B4Ot$}GR+
z0URoUAviR{WZr^wjCsTV9qFJ8nm{*muUXV^aDLb)XnCxmxR}L*yvIb1Vj3Ir3}>8z
z+bV^Ciu+MWz=l6}<*<JCv`_UEkGc2Hb?39x5=zw+r0o;Tz|D&S$6eQIvr-R>>)gf9
z(j!TqG=`GAdufMnwGjl0DdXVRuogWXz;T_nEUkqaySZ-nS1+K=ILJynY&V~s8fpz?
z9w9O!Wi+PP56FfTN8l2pz0AOK$tqvHTk&PH3F_Xm?04jdXxNYc)fGyXti$Zy67=QQ
zIAmpgw+>oLcwt<q&E2+N<bK}RtEm3L%s^2yHSNiVDBKe%;lvL6e;NyE6Q4$wDG<i#
zo(z~0YTgxm6XwBKX2BD5l9K}tngiRl%&)3Ym7m8t<)t7l`l8ZSJW&z+$N>*ZR{2hs
z*RS96#|lXpVHZ!CncMLc3xm3YqjCII(pkLo-c^%2-sx42$vj@wi%O?cjQMWH+O`yO
zt<fD=uTQ$3LBRC<4hjJ55DA8QYfcqtP>pIaL55V4Dk{<(8`zp47;7eX&*(AECQvlZ
z2Hq75o;-h|Jn-9~_&sv`OmY)m@~;*)#|H#DYZaK?QUU}MhA_(3gu;4l7JacA#NBV0
zkimrBW#!4+d#ul@XDgSaSd|LU82^KD^#QZ<pN@+k_2+>c-1*TpFa=EzaXfg*@s^B|
zDruMn!`JTsFj+Rux)7ULY2_o`fQg>Z3j%BY)M-H?jt367avM+aEiPDRkeZ_{kn-IH
z$+?|?oEGW?IBM2TEO9^T;uK0X_WBf*diSm)MU4H<;&(5;4k;*USPonr;ClE*dwmhu
z>;R0d<J%~E6}w}A$;ElwTTkuMvw<8{<j>oCI!wWeM0`W+X-C_O4+x-VC^{iVSI$_n
z9L8xJsT^la%h;3tpcj=@iu66_#%a!xZK>>n-=4h4)SYr>OP@??BL5XHEj@EVyTB>(
zn1}OTE2k_i>ftNZ*z*hsfj)`dAt_rLHqL*W%JSCP^)6@9!_*cD?B)sk6}L|#vBH5Q
zMThZG*mL8z2%S@tM0RsDMohRT%{e-3ns!#nphcgbRSi~8RA8rAWgLTI6-E<NhvF+_
z8To$yxa)Z^LSTnrW+Oj<YsJ-NS_~~~bqG9AzzcZSK!ZosTDX+~nkK<4TwJAZ86%hZ
zSp~rbI+BMOVM^ir$oqXPfcQ9pTs8ZKJn}tmuW-s@#tTQdt<?Je5Y)t6)P%83jXru*
z0b8V!p*1tx(DBCkhy(sSSyo9tz`t^Bh9)dp4u2ju0_`E;F}lv;7^RyVfk{9*tuy>b
z!6Fi0HjR~>cB<@(m{rKBOZF|xH+kB19>n<q!tcfgxgl|d<&53}@#}~)l(SoV1;8n{
zcbkZIa`>{S3JlYkR^t9^PV4$qiME+quEfQ%^v*ad*FNwz;p~o0ECxB*%{r+`9}6|R
z41HYER}XtCK$3chKbEwwfbE5vL!OI2ezL*2<R~9^qK0}>-|`2$=|lSt{|8Le8eGnv
zjj>GjI^+l>1H_~sYB0WQT2mPQYv7a8uL0Q>>!u>Cvi8<p+>;+d=fP=pdDTj8^SB@m
zX#Slh&$o9ce={TEb4otjozy)jX^ICRphhzc55<x1D?74)T`e{}eQ|*?#36D+qR7S2
zGX7J_4~eoOPx~e+yXFrmDPMEi7WG=N6InAK$R35q{rwvD^=c&t!fQlKPG>O1u<*9q
z68)MArl_OA60lrK<7QfB0a{?l@9i-jc9!pd5>UZG9`oWAH7!TP6j#siR*7IqDmc!7
zqLWHX<Inp0bqv@GP`9kfttVzGc^`iUcs;?MxQy7S8k+;0QHMqGY_2ci{dCYN-dMJ`
z(+RLvdzhQNE2>`On|E=v@z{#v!(1l^6W$=c-P|Rt0{!XD07mJ3f7Hx-1WV2<v%0s^
zB^`Cjulf)rBTe(%pSM#+&hP15xAtr?uCmeuHZ<(mqTm=DzSzI+nDW7jhpl-}%CQaB
zdtauY_r3V{0soua;hUiT{Q`a8cov-G51Kl>nlm0*e~7cvsyVDfEsQ_`ToerbXTsN9
zjP%JOR54)>6K4M0PJg7UDfo(2p!t#Mu+87@%1MWJKXEVh6q!>;RF)J>A-c+3uA_Ew
z%-iZ8)7IGa2EO84-sC^rwvay3zL5y{dv?TZcWj&yyhVttoRL%hk(mDM&U-R>a{&0#
z;$8306He6hy|?B0tnFqEwP-7YdyehhZjj;a(mzfhK;sHII#m1px&D^yHTWlTm%mfb
zRK8fH_3grjcrzeDM;P1lyQW*P!`KPLnVs=<QZ#2A&T9k~&JJ{3Cp843ZS`r3b2U&0
zQ{1-$g1H0l)naX8**h%?Sd;L_K#v@r<zNCBq<7v>PJr}UO0ra-j|nA{m!|Evc?<k6
zT^NtG{l}vwjt?L*x6Mn9wMqJ|%=cvt*VI%cF_z&v<Pdm2p~gm$NXMJ)l|~Y!e{4Ef
zgl?)SXvBNT-DV-C<nw<Sy_g)!PcaxnF~S+YYlQl*2{>2421y=QPM(MWrI~8Er0<U3
zliegAN$h5lowv6cB77A9vI_{zmeK~Y2HauGlo+Awp-eYN-k51R1#k>&XG)!8$`HBh
z6oek@MHT%R=;`n1b46{C`V~PR9ZqybYwMQWU+X#6n!#H+*JCrX!Gsst&%Pb-FbyNj
z*I#2s+g(lNz@`TRiUyEqZ2w^|MT@PV_?T#M)Gt4(W9*B{&?ai?SQVnbhaWfT;<uOe
zkCCAkJezoPh8CZhR3Be_iqwsf;ZG(sobdJ@eKO61-h)IkUDozT^_D0O@Xew-A8WCR
zKkbojXio~%dx_~p%!L+#nplkG`Z<clUeePq{8k|IU#<{UqCVa?6f;WajJMHGYk5-E
z5BF>x@_5;^FEHiJP+obNUp7S3g*Pc&AwBDU=46-4oklU@q;v=O@JwyEea||Py3`la
znlXz29sF9gcGzA#zf^kd#aj<~t#Zi{8ov13tN5Vr1}Bm8xBPk0iHZeU#(!%2DYwO*
zamrVhd!F8xQG<wuvr?WNt5G#A%U&z-XyiB6)<Q1k3?H@+dx~;zRz+KFHQZ>et`ruo
zC=8ymF7a#5@UJNi3dnt@Tb2V?62Q6rmS95?12ruGqCDbmPmRzm97Q~!*)Lhws3P~a
z(5Fa!Ae&uKK7<@EHP5TAA&1(X>IWRl8*hhs#Pb=hd3CvFw`L|Q){Q-;!hUb@V{Dj&
zObwZKOeHekTGYf;%1;#`s7iG}UJJpOkLBs@7Y8sfw);{8O6l^q^7X&fCYvd8L8DF9
zCJ~Mqc?+N1bAVIEmbqU`8L<}gQc;fo2a1~*Ba6doBWVS3!W%=<zPu!vRH8^Imd}Kp
zZO9s^J05bU2<5xdb{qxWolJlKW85Ji@mu$9vI!W^HAfG+9k1n7IAP)PZ+6TRp~h6U
z#)|3<6QMw|)rXc<Nl7U*);<3Sz@1<UOoboZxXu*wBa`K<YIV`rBBdS_0=0s;x2r|J
zc4c_Us8>^R#dc=8O5{X3EZ8Z>85APi_e*XaI$nFZkVarPte+2RUB9Su+`s!xw<Znw
zmTxG|o7!PzJWQkqEKck84kI+PL3ma2*&x*n#5b`wY731Z6_%$>hm-h0><KWK7U@73
zsLF{H1InMXd-D>?rb(Hto$+JtD=353>ZgeZL-FB#^WKPE555i=UrAvjC;=zCh*yz6
z<Qf%Dm~y2^m|}4Gz)W6~Bg$6dZ{A@zWT)vItqsop(XJ1da3dWagJGUIlcIgRI!$?9
z3=%1z1^jfO*OBiBw3I%V9#D)@*R(R(nA2O33K4KctCb3jw$9IV=#cwsKDDi+y^Cym
z-H4+i=oRb65uD1TC;rhx)h4*&r5x%0o-)2AH?3^8j`{rFX_1lRP!fw+;t$H()*8w0
zo)>A3DKdlKm%Q!cEH8s!^DH8Ler(D9hb-joQfhS8FtZBc&tR4rCw_?MR7H1x+3{K7
zJ#3f`TG_0etj8I@K={G2LowCn8cI5Tn!?rJ|G!3nY=F(M6jx7|q6d^3S7wL4NuT}7
z`>}CqpMp!pCK{}^uT3-wXW{v1t2SUm?f>5_!BVLyL2<uy)a{zN^8^?ZwtRKL0$k<V
z4TNxkPQErA%!OAc^tr)|t+=DrWb0|d!W{xv+R-BERvzUk{v)%)GY7(n6l;YqmAS6O
z_xNfM?=IjLx6!Yh+Jt{L5(Q41yACImaMpRil@%%cDG9iiUeWj`BQ~DetT7jer&tXy
zzS;K(r@yK88!>!39G2xYqcft<KLX!nu#Y=qE|Ue$vko}sq0!=Y_w_GyftCTHb(A`I
zn1yP}5fIIpf8bXFKi89=AzlHAI@dX^SN7ReLf0?)rsCw}FO0H6&^X~u%t=va>e3W*
zpd{iF?cqvxF-YQYG`LU^cQQhBu#}P8)rhQtMMtYFz`xMEi_I@Ddwil+ENYqbw_``~
zLk(1emp@^pi;#Cf`nahydcP(?jvhcfUr>xW2vC-jPNZCkH^2V5+*gW0Bs$e?FSk;%
zB0<%<9vURn_=$j{v3NcxT8AUGVBv+V>ACUrP5|f0DOtR^2Fpy->Y$gh)WWzeyt_p_
z(8mJY>?)Fea;<9TToiM%l%s0&U5GNBZsiHWctOWDQP`B2j&^E({M8!-2(PHjDNCVL
zVE4RtRP>eN!jcv{p8O|t-@n`IoWmzrko{BC)sjJtmQt#afu@s5RV~j~(fH)?i5juj
zoy@laxv3)`-L%1nop5-|6d_ewk()B`DAkg%m&x&mo6JT@BCdV*E(LTpSdFy<gjmfa
zvj`mE+VaKp&FY6yxttXVs+Z4n!de+WV`J6alRSgajBv9i_jn7%w+M{#dv=6da_lq_
z6v@2wH355>*K5nRC8*()`?i(?RC{`0DpWF7)N{0{V}Hy==(-@h<_5coRkK5Vf`(7b
z`Uj9k->7?UaSuZ>JsDO^Yy-?&NzEb)-)rA1r&2%@ZR64E6taO&gX<PH1<RvVl)^o@
zGJ!*oj;u?P21Zm2FR4mMx{>>$77G)f>f^TCMKSIYw~s?*1*tNHWe)Ttz05FWrs(4m
zemY8kYMTy~D{(3uN<V1<MFh)}N0l6QqU0S~DK9;}UDnan^7IAo*O=qO1%^N=9z+*t
ztmV9oW~OX)KS`sr8D8{RR+@ebw(|x1gY_HFCI0|clWpF?T{{_`4WFvb*-dHONuc|G
z^B{h2){E29FYg(v;K~(8k(h6`rt)@Z5G$T8&7h(Mc{p7eB_5(69LCH0rAR)D(Qt<0
z@gwk7__ip4)r*~mhNCD{G!|nhLTPzZZ%%(0vD=CAZnAwmI~;2GY{}TYw!=Ug4Y$Q?
zNC>CmHy$L{#9ht|TJuEYmRf1z!5gXypwFKPdd7b9<|r4-Q_tShVU1H$^`_4!AkR(L
zJ14JzuuaB)d3?pERdJ~9$t$BuaF3aOd%XC7z$s;#blN0bs{_GIRo2)r6vZwW5--nD
zjNVM<MjKq{z8uwOQGYu)M;nk^XhLf+Hu7xO!^PyfW&&WHF<d8Uv#!AcX>~2FUb^A0
zjV+T-*c9kK#Nao5`F`<vuXj(+#LJwg^9o_wnNW9#<6lc=gX-AOmu$zPTm9Jm1!v}a
z7<0(fO3;iUqKuRVE+|G8F1X;^_fe@u@O~YggH$3%V7K1p%ZgOQKJb1K(0bC?k<wp9
z7Y!lMeKDu-ioE6}1wjWQ&-8*f@}}GtbBuVtQU%UL(ZOk|fwfPnHlH&P@Y)jbdy313
z_v7WClt6{IsKwh;lV@v6S3)vX%^q@ooE+^QtJaUVH-uMr4kE~nZmGi)A?;m`2i5X&
zfXMVf!{nBYlANQkL+h)r85*rVbbl)UX`sYXvWmf$Pp&V^28%KFUC#^&l)ty?{MF+c
zE#C+0m>nv}DC|Nu`N{HD;M!S9#gII>()I$r!2Q*vP+z|91>BVYFobv!`^t=(N+66>
zk7}I=H%MHIbUw#H<Te!b1M$2PHT%VqaF9LX{}J`oQBil_*Mrhh(v5Tu-Q5k+FmyLa
zODckdba!_vLrO_E4Bd!yOLzGD=<|Np`!{RN+_{{4a-Y2)fMt@^zzfLm_LR0Pw5%tr
zfL3V7uG_uc(Rr@gG|qnl-{hc%gBV4n;G^xZby;RLU2>eJ0ufv0->=B~gzv7;QN|$_
zWi27=E@I=l*3jBGZ^4hPjrNY=)0eh4S$;rC5b44~*pLRTG&sv<U1YGI@ZccTpQLmg
z7`NJGBErs%e^ed->*%1UB<^jzGj38L!D(ZA^Tl5>kq1wgYZ;I&5$8hK&dZYv(TK7i
zy)dLtD<ddiE>>kXV)M=PMD>l&YwpW^W$dr_dNa7`>>h3caL~oU-z{flnN`u3wo95Z
zA}o6uwk{=|$5564Bd7g3(dTrACxc6C%yt?gd73cvX0%d4JAuY<(eWKHi37`?NtcZD
zj>rZhae((KH+*6UWO&4EtFTvIKcDp3tMkNk01e9L&7NMowm!La=6i}rp_k%}UAr2r
zN&^1cWCZ(?F;#Tj;GqjL&lies_rD*tZR$CY@53h!`)3|rfAYVCCa5w+un>n@q<PK9
zIBpS@G6YqGGtnh`!UI#<G(oYlx5n%3X7BL$+KNB-cQ5ymh#h>zZtRch@5%B@%s!Of
zV0)&hZXs@CW-^?Nrr<S#JhHVAlX07&SfhtNLAsATYsi#b_?m9%W395_@~|gcEN6MU
zN^J;bFe)tl2co?iSu|l_@8_jt3eD3}TG&A1u>cg8<)E+}8(51#3(fsjBk{FWOJD{!
zeu^<z_0vbCz(!mQjNTJAP(4nBrO4kX`@4pORVC%1mtMpKwu?q>GL%m=3G;wd#-b`<
zvneP_UMP>$vdlx<G04~C2_$G0)GQ@ZWbXTkJn*v?0Qm}Wi!a7%v`XHF4N|8;IKOFR
zpctej+bycBd?pGvGO-q12{vA5MNma#$%%Wae2%}9J9Np6W3N%HfxKB2J@O<gIGiED
z{}gSwBeq;cFiN$5Jafo!RwQ_i+D|H_SySf1zM+<&E@z2Vd-UB;UQtB|J7v(Rua4G=
zEV~~6YJ3{DU6(9xqd~<E;rKKVG`aduvjTMRwnX0A-To?)LX%L5X1ai(PIc?ygDBrS
zh&3$|0sKdu{s<!;R9`sewgULw7GUp#*PXON4RI`%Y&qIS@zvaKT!CRzC}9<yl$AK*
zD!^$0z;+K5Jb@LiqggfDL~S10p=_d|a2ys*-V-0ZtFpAzM?>8jtvO_gN;HAA47_$C
z4-u~?m+}l#dc)FCuQXUjYETc4WssMC0TvGj#sRSUWrXqHr&7O`<*Y4{$Hy={T9B75
zh6d#@<1!swth)d#{`j#PkV5$UaO{bY#D=m8S<10jx+VFXRtt9vm;_~K?PX)G6RXVy
zr}&=S7`hQ(mWb-g{9Lhmz42=f75<p{GqC{VN5ILM7tFJWpgVT-Y_@f7C-pO}OYt5-
z=^oAXJt(tHZmB^bLkW^$<Ft`LQUDuk{k;?*8qRv_PS~-4svZ-eF>BvlY}33K%bt(-
z@mIj_7104OtHet+@Lvjlklw-6qx9E0y`TAHOO17!<ePN`UixICs6%^3U4oOUal`g{
z!{6L9f2E#2N#;*U5@j#JzT~h{CH2jlZwTJV?fVgSw)|tV??h14gfQm#NXU<D_qf5m
zLq^G_X#7r7so1Pluc!@GHHn&ZJ@R+X@0LvOLkbWj&HDM$gX7;3_}?{X=|sFriN=1w
z5&3fT+IQNbfU*eH|A#hj(WKmvqU3Z!+r<7Wj=PQ;-4-|Q;+3pDuslN&oQKeVzo4Eb
zd3$#(5y>X89n~p;itZt4?}KsNv_-4Pd_e%0UxbZncXnxXHU1R8syerd%9+uG2P;F8
z)$Z!BK3j`fE+$TZDCj?{qgsAdno<NUjLk02_UTC%!&zY~r=qR@x&Bi{_sH5zI59Dp
zWz@PaRv&+ADu<V@gxAGT_Y!XYs!Dw^iqrh_NK!tvC`cLri2w>H(U3Z+Imxpzb0%gh
z5><&fwvW%~0IOA|!V;*JJu~~`JFKZ4y_m+Qs8mDGiD_P6H?c!$ZM<Rs7;v~T25_Q0
z_<!OOO@&&G#V#ecI}znk3`4zmO)K?VsuCKct!%m34Oi(?>oEl9={6|$c1uCut%G)K
zdpbC0h$zP{+Jkbq(A&E=$$sXh2qQ70yzC75cdi!w?Q+L~XumzLkhkj(aulM3$Fe<S
zsiO)8Zrtvk9Pgth=bkCYxL>v8Trrc!rNuv1g<B1SOc4Nw3<9lIR%p!$an?T?SsRO8
zc6MxJHm<XzC(e~qj(KMLf9R?`MvZOq`KSXZ0^flGwg0Jnc$CA@Yo=;7x_D(&7imgm
zoID_iIHU<yvRK}!=PRFnL*)P^0eofv#50;9*(gg4;-4s~6#&R;li^IUOix@z>7Fgf
zL|W8EL?#!)nF2`=a1JAziE+aslepoW`>y@%uvzA0aP4^94pV^Y$#&JgFl=laAn>X<
z_0GK``T~f=^dJRB{CAeuKW#|Hju7k0%SSQqd%hZSRqz&_jjF?2=XBHoKjP+<Y)9TM
zQKd&{THgZ~^u#Sq9TAlLPyA#LH3)Xa@7Otxu|Oa3o|iJ&3hG5?!wAhAY%4&HpsC`W
zwI7S?f92-u*tCntQ)#-*txMpsq{_oxwAh#oc==?onyhdPSpI{tcs?4a;y>M<b(&Zz
zqEg?i9q{GyK;+HWlwtXH4T$P{e5gbWr*bN9N`pX5;b*#$Hm1mWO&|F~vfry7ea`s(
zTmk}vta`IcCd5<quj$)^t7CV4TXJey3ePb)yg#a58v@<3z=MC!(u1YXN(AGpw}hJ7
zlcMG#m-F{>)^cSwe)o%=1fhVnSV{d*gy@~}gc7DU<z#M%9(a5rRUd0h1=d{VjcLWD
zKw?T@S$FYK3Tw(u&aP6R2*JdXQkUIhsq$2cA!<y?SfUdU_$vFSrzSpd2I=0M!l3tw
zG_!dskJ3sWX7C*wO?M!-)@OB+ppE7bAUtHyP%Vtp@g0rWWI|AIJ?a=eN{Y`^y)LsN
z4wI%F(+<miuGB*a;wij<tbO%hp^~Z1+OwfyAwdTn{u2tB5a7?HHDcX9HCIrKdwNXJ
z@;d)@6hUE3m;AKW^t)O(8ImHzWzdH#j^9r*eXcw*Owc?jp~9~##>}-GJq$@NAMIWo
z#T}8aV5pQV(1n1DQ2LW}`M2#zM*Pu%MEo&mS4S{AD#U_d*9vp>6z(7SJ_sZT2h$ry
zp(6TdwjQdnm={oVYYjAWFPLYb2g$>Z1DQEo4wV$Hq<k}_S_#7`QI$m}k-YaE!0`N!
ze8M&CV^m)C^-W7n;Vzd~U-fA)=K3ST&^(9NYtX^Jz?9dH@`2r+W8Y;3^#q!kHEam*
zuW}hR^*3`)e2v>=YWp89U~speV{V0r6V<Msi}R;J+q5R4u3_%d#R~A$$6i#*;#&~F
z<^BBk%9oOHRcWS$o%^<-K;K{iDdHVqv3DI}Tn-Cf(b*dhzT2N$ern+>Tr)0v#b*8K
z?yVPbK{vRbB@T7Qb?Y#Z=|=5mRm|xD@Rs-gtlw5laRM$^S0@*3_EAf=WLJ5*f+M+D
zQ$vtZ=HXD;DuF4b1gc4Y5j@}SvcJpm3PI%1N87)FRW5#1ZcPSci)DBUBpbFQq!t+?
z(HW25AgsypQ?H|XIaj8VGa?VthOKv%d&&x&WEoX(?tQmxKR%ToO&#*#t_iyeKlHJY
zv5IsyR)^fByNvBIX+U(&>9jq7H;pLS2ZZ%JbTt|!e*dNQ-r)kc0akf3+@S(3e2+mr
zcDp(io1Sr-8Rq1%$z2xyD!K?3w5!TKzQfF6(TCi(Okeum{^sY^9;!Gvm0*Yh%kQ-!
zgV2FFJaFF*!hIEat5o#2+Mk27_-8hiS%2gfC{Z{SDlFY(E#6IkSPQLIiYez!23vxA
zs$Ag<8C-&&b`QM|Au`b&4JxT<xNE>_K>bOJYJObZ=z-v^ff=*^t9Z2kiPMyfHy9M1
z>&~v{y@_!dQjz;{tu1rri_|cAma{zo5WKh(QM>CO3z%35K0YB;C|VWqfp1FEH+@SK
zG9C1sw~dI9?q|*2AFrY+fv<6`vbOGGDdF6Ccy%!wAcsLw-_3SP*o+Js`{!k_gbDym
zg6R63M%8P0_2~p?m3jsj*!fv`XH<HpJZ!uSrTo3T0rr&eJoM^Kz4RiB*wxGgUG009
zV5{c4sC>3G=Id9GI|qDkjxKtfuJVx0&y-_cK>1l2#$A!jc)sCr<2mkSkTCqbPeIPu
zQJIkwIcmki>?bfv`!cXZ>aPe@`0KvSDc(}w25C<91jYn~1n7nz`YJEok-0p{QrZ!T
z;$<vd<l-n#T}-l-+0~cEjjVco$&A726w6)744F&|y_~}=OyMUHMM(o;Oo$EBa-*Lm
zkTM8}9i7JG`BVHgdw?Mbhzt5`_DyL}pYJ6a(JYk}DY!D_-J6U>(T)X}>qd2*{NtP8
zc_x>jZ;yj5A@$!9tc7x{d_uQTNmCVhXp#e-9NyM3O-j{7J_qgjgaep&!GE!)x;Ojq
zm~u|5Ts;Y1hSRKAS(|a~CRo7i_oBrePMG_o%Yg05X2Q#PiYc1-)bWsd`BlxuFPjh@
zbZXm{y=BsV)))UzTC!f5aLBv-Uaj*?ID}r&s=nu-6ks;Hj&z?Q#+}kL(j)@RY0+Pe
zmTT^{9USNYU=jq3d$Ei=rK02IhtIn{+DhdS{muOtZG~|q6b-}#Q*+D5n^T{rw5}Kb
z_(RXNc3h&UAQIBaXdv_d+=>qaKtrR{Vu+r-fFPlT!ziNxsVk98PvJ_P#K~YG(Gj)5
zms(o5?mC7MHlh0Dn6&7*hfq2_m9ywafHi!W+y%s_?|it8-~(?Z{z-`;GQo<RSl7>a
zikK7<{$|je4gh`3eu$|YF1$8A`gBUe3?8hVfyit5{b*G+n-<<w!c!rj($-_(2SB{Y
z2cQM1I02TNpm6$s;!*txZKmp+vz1nRW(~*qB*U%%e}WZ4KfT+eNZXr{FA_@?sCGF$
zHZbzHv5pWoW!my6s>MO?cV}a$nh@DbC^i)lsF(O(j#OC2n(F1<XED2pt35pf&sIOi
ze3cOAb#yksSX9kVA5CDiGe$zhp+76=cKd({xM*G@K{fxnZf6QD<`H>hD-hQEfB)*M
zojU1e)q1UfcbGAS@+mX*@B_1TtLBO7^3!!kgM~H=Owm#imHKl3|A|PY_fu*)0mh%>
z?VkY$@<9Ff%Uag`Q_w0bd72EA5y?)!H&?k=0Ri^<zT=&Kjoo6(@ls6d<G0cr;TE%L
zmlk@6uMO`zYiMW{at8&sw_$lJbtE+1!J3Sj!9UrKRPw#^vWUjx*4oo=1whJjkNw|C
zJ;k@Hlg5e-JNmsMC1|GgSk%?D@Zx!w-ixe3owUE3jxYC4PUqfT>iYU>HnrXMGk^Wg
z-7<aAX4qwEHjf3t#)GI?e%X&wxs$SpaLBx{aZ-Q1?HEJgtq$>(gwhmEemFD29U^c3
zLj&xavHbhSL&-i4rg++H{R6`U24;PY6udb)_?&56fo#L|SK};OIu8sZUbbAyHr{V!
z-d$rPec(_2wL<^VMF%T{^RNi-<}E4g1MtFth!XS9E2&XWVlIL0$p^GefEh@MeR*2F
zfuq2P3uoOO4?!Iu91IwB0&t`M35|7rqNjgv%-gtQ#-;iF;Y8r_F_U$1E>oxdz|T*O
zMiZwZ18b>t)!Yfbqko4s)R_cFX}4&R^!=kWA~hjgUhuz6=o@Cot^@8UVwmQ;yWrG`
zV|#!{X7lFf`x~<*pI<^@VpkpWP<xjs&4$kfbUq!?%itPYkDgy#?^+HnhsvjfG!?8I
z%Lb4QLeo+<TN+r1)zIu7Fkla}U!_u%k$qMH{n6upMMMjk4Cj)b9{NLP?uTOmK9k47
zuN}Ta99sMLBVu<;I1luYEB=^L`I3sE+j@hludBKyip%E@J~>KdZj$K0wk6MTiFHvt
z<sAYax*Ge#nja?`=*_j@aRC`ntv7fX^IltsebBCdyLhCO>-QPe7SQz-<)Xi!xZixG
zv3Sz9zN0A0#TGuK_3lsSw~}H(o@8x#+>j!=I_obQM6V*P=TB7GL4gbZ+_I?_6|*%L
z{@ldRYlGZOq0E!IyK*@|k-9ZE;HcA_iG)nC{STO})oqu!Zc<uZvH0QPKD3+emW*(y
zf<m{s<3~+KFk_TVd6Zh;QQRURH))P31qc#?UL=j>w7(xfdcJhf;<hl`KVo~ntknIz
zavJ@BfghVMj6XX(uAKW0{jGZS<;5VhpiDu*-q^G34!>mQ`3C2YK(m>*>83o;({y`N
z45jcpbE$t@e$=tKRFk_j^7l*r`o$Ji-1gr;b|)^)5l0BtX4fjW>q5==S(HuI(nR&{
zKgE)#J$`R`+C6_OzZgZe0(-ixYmANUt6nWg*}_p!g*}A$gOB-iHd}vQe&MR06s12!
z$FxgM9tCPYznm1-Ka0D7oq7Ru>p;n~-I<tJtT}i<72y&~A?$Yu)_vYM+|bB96VAQ7
zzGx5Veq+&iysU!-%fOk^n^tFPb$$Ep?}=-tAFafmULb-d=>Ep0yvRq`F2(cIF1cB>
z>-|yp+Q*%o+I8ayn<`I+SUi?i(<OlWsU}sPb(}txCWhCS3)Rk-?r;%WG@%2NsZo;B
z=aMOR^k5*AP%J-+M`>K2ZE~U7nR+R{{8#2N&{?7ZI;GWU*E6_N`?>`zQgS(_%=+>C
za*^P7yKCQ#>>gKEny^w>z*erPRFelx>~TP3-niBiAntW&3EIY0uEb&`!(XM2j#3%R
zR@Y-Co$wYdR+GGNlxrgE_mIFX8>K}$tIDyer(-VRgr3;Fzf5jIwx@r4@iGt?GXA}#
zjYNtcY)kq6S6?Z7VCPBNnZGU!dz{;LB6k1ul0fwM9?p$od40qSo%Qd6lDVpAZ%VyP
zq?$UctV>IGY*cHHqPowOB#Dz}(>4W5RNgzSG4k0qTS%?CO^b6R2Ru+3Ej)|{!Q4v<
z8TesvfsLQ&S%9Tb)SI;c{)0OSAb*V5!+E}Ed)$(HKI5wYIM9?qFseK<gg@G5=2OY{
zZP!xfXLI_btPIEWsB&(4Zg!iuRLlkGNIhc$UaTSKN-bDY-;SyEuq&(iM)o_KRoZ2>
zKn0y$1&z{+m!NO}jr#Y?+%*?%!xRlX-&)0!)O-)(A;25naSPe#>{C3AC~zdU$?Uhf
zkQm~_G3y(37s<4DCJJUI8e71ptmaM*IQ$fKnnkkJ)hAJOseOR33~lq!(9zC11(x~N
zeNch=BJ04_E^{PzvXGA?X;?8^v{l@ourz%(Zdj2_yM{Sn8mtyBa0pX|u0(b3kL(up
zu@@P|4gb#F%nb+@<o&iqIN(|56UkwseYm&@56b)f&)}r)Sk_$`GgEsgKiHJiRn@66
z0Q;z5dfSX|KFoz+WV^eN{r$T|1u>!O^APXQ`YC4$%p-$e&I^T3<i=<6!`3ZbfZG%w
z{p&l$OM!^y@f~P4J#T0X7}9akJ;Xx$mxSlq`dUfnxs=0rLi1=tzzU64m52QI-ACP*
z5Hn|41{T`_yu>&_a<ae`yi}@{^27hV+j1!9z;cR(Pz{YaungBr@Hc>aU?`$#Q7L^V
zHJL&V&dl7s5gT%g%oZysxjvN0UH=qDzE*Fx)jvz0%wxtt&F11<SU}`XI>L?CV)X(R
z8*^7^aj9z+)!qFlEG9&a&zUg;jgyV9N*m6}Vc24A7jCd{zr$Sjjsg50p%l9VJvLiJ
z&>OcG?VYDl7Nk!KHk6THc`tS9cYQl{abQ;>OK1M`013mhI{*+C0*Dpr)Lf$!Efs7+
z>fZgnv|~-RxjMc3^E9{oeAxq(63bpcm<l>86Xdnu=)7xGiC2EFJM5oT;c7ulvW)e)
zJ_rze>4YgqB8G6c+EGSR5hafl1SndCO%q%lEw${(F`{aZd|TlDo5(;|)Y=kcC`XM7
zSi*7JgFyYSUQnzk3bUP3nanE%!~jiBht?RfBX0nE*<mq#=;Bg(cpI}h_ot5>l=oUX
z_iDkv+vrXq;UeI}Ia+0BtLSa*pT{XaW0&bGil@4!YVS_D=Y1}9zDFvi?5EMMKQ?FC
zTDRvvKGQ>{uV}PduuC)XD_^ZOu}pJ&wgl=9t!Jg=RTEBGbGbV@%TCq}HAoWEii#wr
z;zBekaxQr|X$UkI)9nu9cz?F~J!DW651UK&pkRV}$#P0FA|z9p7%R#K)j>E69txb>
zY&DCiXT9v_j0J`}X+akFEL_bE)j>{r(Igx%L25X(j!k90+cgI2OQv|j0c4_H8*4vK
zwU_Sh-*>#9f5H^~vp5eH2(-6S(tv!1617*-b}6TP{zR@a=(-p*GzUm%XJV&opSJ4{
zLqa>x11hF}e5y4~NsXKDTl8^q)|uu~7=kbssk2WLP45%a(4Ru7)a5I;*b20+gEH{}
z21_QtLGr^N&j~zYirT$eK?hcVuCw?GWf~7^Hl5m$x?SR)&SZD?4$`-)i6Axu#tsF%
z#vm1eF;r(K%_bGJFYtlDpMR1=b-UDp+~2lY47suSSoBDhOH-91fv@<YYbI7swzf7#
z>s3f(f8HSdsP%E&x-fx60UI{94nu*m3Rw5k#I*H>lzNOA+C%OlBPFrikFx}&#^?d!
z5~eMCtt$u=hjcjg=?1(l@W+Aw>jjJ>QG(gVS!~_8^hGn1QbW1tUDG#1M+^>o3ad(W
znYdOsl&zj7MT?;U{imH=@00(aGDg`&6xkPaQYT9USYCBs8hTBi2C{785+7iSX-7kC
zrd8)4@W%3tC`%DHY8+q(T(^{*!lIr097GVhoB+!@qBiH`S8tCSXyQ3eA~W|NdAga8
z&w~^nA3Bh348I>vMe3&2T^^+V#6|$f#?=u4KEl<zMzN>UN@Fi2kGD!tqT-mG&lzf4
zZDu=BiX?k}F-o+Y%bWo^0W_OsOMrUy@qI?7@{~37P0`t68#iBWTK2K48^Q5J5Gj!~
z)O{_a6Wh$uz*Uu)wuQjZRW$jDU5LH;hREvKIKn)G&Mtz%)R<^y_L;hLf3AMTXqk^a
z&=)}ZFCox2Byo1%+pc+3Rh8RROZLx@q4~lG`fdhe+zM+C-P*guo7jC`Zg)U(s%+<D
zN&^45n5GDTMGWK$3jGL+uCvZ(n97_<$k1SSns(cpgV6GQk8vUl$y+tQT6vRjhtPFX
znR|6qoJi-inW?;E*cC(59YK_Qv^QdeJ(a?T!8o_bko;s?V{?0_TXU<6EL=KR!179K
z4C~fcbu_fb9HJ`A7kaOu^gB1l<mjkkQ13k)F(6-iAobd6DKtS{zOGJ7mJ8Lx;XCh3
zKyq2p+>U-P5T<RkWLChyXg{^(Jx3<>RVL@H1F93Q52{Yu1WV?1;f-LURn?TUs|p6}
zJm}qoSbxh!%y_Tdg6-`#BFRa5TQ-{|^ih(oyqTF7<ID9$%fnOo)?nl{%iZUK&Y=Vb
z1>x0*G$q7CDIm`X#+iIhaO4$fYL*WWOg9Cg11Zr}=|p<mf>07Nu?-%nyDDt-0D^;p
z4yvHJH(bI%wW{(>sIs-!ND8XKF6rbdZQbeB=weW`1r~rBGhw^X#VV_1=PR=JV9_*r
z>+{)xjoEBdk=?ZkTN3Nwu9~!=h`Nh|%PO5gI=rs{|0dJJ4yE0t)x6w04ftXjI>jKG
za|vqynSngjy$!c|cQ<=4KuzT!#MZ`#13ixwSfi;8T8|OwA@K{n&@oemjT1u9Jm3R)
zhO}twe8#Gu9WyPURrdOdSmQrBT@8&iWgbog#P%u-kOe(1OBo7>lSUl}Uh(p+=$Igm
zVZH!s4+)okp=BtgSIO*ZgpZcOhfb}u$x^Do=z#1x=-X8?pSlFg!e>)6A{IjQ=r~o|
zdcf?bh*qaQczkpv-Ha$_@nw5KQiT%)0VLjgu39w|AcamiBtsd3vlBbf026XKH%L$M
zqB&`dnP;Zy?{FeIg5?pqPhs{ac2b(l_?*{?P{8M&#eoOrt|G-374&hPP*nlT)?%0V
zw_pvy_{BLHtZ>XTfN$Z<b9`O~X4h9q*axQ6Yfs!9Kn#fv?r{0ib#eXJUGi*f+}%rV
z8=C*@p+zd>WBp<N+P%y1$~CIAWJfh8+hTpC&OGjA860rXw3u=Q)ZkZ>mHx2_c}|fh
zFg&P@yL*chz-)qleT}>XhT2aGv=z{5%WUfGN2uPUewYhIEd47@s~=jESz<iYRUkfF
zdV!fS@R&8|7F5b<QWCy%M~)!G*X&t-FZ&UmaCH-Do+3Cj29MWs3jnx$8}38;2oD#v
zDL~oGrKcF$O}I+o#GKSEi%2M5cS$p2OP|K|vBviACU}dOq7_Tla2IF}uB%EN)hoIy
z>Oj6^bD@hzY3DZQ_^hNyK$Oeq=ehKN6~bG$^mnZZhpxbO&yi5nh49XO7D0z-L>5I`
z%~=Ol)>rrk|B1@sRPQjG4kmt-FSIg%M2Gek_ImZiB^>3YHaeZJ?MP+_*PQ^W9U7<w
zTjZgLG=?|-UiG5~>(>fKnc3ke`$EY$0#++teP|2>Cxxu_;C!dSGO9Voi2XbTGBV4W
zdQn%9OF)pyg+rKJ&BXLpM%~F(49za-dxVf7KMm*oK-Zv@Edi88<31w?21$_$;Y78z
z>gUkVuD)euaYj7+OpzzcST*}4Z5&T|e$I*Y<Q8Edmv5`BX9ryVOUD4-<X&TUVo1e>
zBeC_gy`DNuh`Cor`xK`jH|g>7){VUCkE3Ed+4N{0V~t5x4en+4l8Xx)_X|QmSyP1J
z3vIA`|LuX$6G~8-odRS|=RwUk22AMnmt%Hy_d(-Z=jC0|S*KL&58obe)z6>Tr4+2c
z4LXDbG8M`=oy>y?_#2(-)CPsTz+|UnF;=u<Y%>d_A+32Gec)v?d5eh{UUW=pGnPUm
zT|r>i-rL@uwW3I!X1SvrVT4dJ4B*niE!;wwx?uE$_+(mvQ#igO7^Jb#II+oo)d?M$
z<aLmJ2Y%K<&RQ$IZRcF|4S+6Js<}DLC{^`Fl1xbzmgj$$L<A^i1ak<zI^WLB!I}JR
zDq4lnOnjg5AD<X=hxP0-S?fkK#Ac!A?2Dei&CQQkjGi~_ngbKJdYhjg$^ALwO1dc!
z`gqp3yA&hz*5Ic+gWEfeeU-V7I|>WS!Bmi%MvPlJm|KGG-c&yWXj^T9$q7!waaK>C
zgPE+?d$Pm~@tZS1+~KDDc2~rq3mZm^B9bP)`a#LKS(MLWqCZF-%tFXJ=3ZrT7RvKZ
z`a+gRxB4a)GvL|Q-(qg&Elbv{QzD$WO}y~j=4pk&$Twbyjy9MvCA-f|f80NA7<CtE
zL0z38KI!sT(2apJ;bXdxYAw5px~Id%0&-v7loy$A7r)m=z1>nza6lhs>4f(A-SK|9
zfX-Zv67Ny_S;9tU66UKEqi<OqMHRzW=|Pff*>(rAlqWt7S}mwSxyiz>`d9*IorsT@
zKU%sPL)64GN2WxIk&-aXrD2$5ui)!s1<GTys%#HDh0gqWEl%r?G2bdpLHSDV3Q^v1
zug^3sL-Z94d7)0@gV}~@oZ0$_yFe*ZCebRRT5a_WR9Z$ui|hdN%^1VOKM$dOpAqnK
z=@KA(u}&HjJ$)j=x2}5=D^h>H>*KotUx`u-ZTfRRlDeWG5CJXNeIP-aBN_Ey<3eq*
z+cQ>Cvfd4r-w`6Muml051q}hy@-wy^*?MMP5G~oBH?n2az^b6p+(sR~P&3xd^pr;2
zge>+?y>5lM{ecP-m8<e{NWi+5^-}kN4ajNO1|?QWC`${-IQRjmxwYacFc=udtE%eg
z7Pk%XF0>`y$B|=r)9&qeUh#VS{fVF-oyo3Ea{i~8pCoJn+e$Z8UgD~J?kLQ~!&P)S
zyBc3c*<X!*71X&S9Z{#jY3D~TKnia?KTI%c^xV9Z^eW>U`#0b@pmuOyL|9iNobttc
z=eM+);pMk=Wt>#38Qvv*5;(_I4a*%K=V#Rq2Gyfi4AcA_ZZ&vx0?jcxJRWr;W-;gF
zpU1+vL~CaB8XC?L?A1B1e*+<oTqr%@ajSbVYJFOl3E92H{r*VO<95#lR!k5r`ylm_
zAj@+f;m~2tI7>c7wc_iaFE%&V@KR}IYW;H>7dQonOCgd!p;5%52(-0%s|A7bh-x-k
z%**^MFwg-Kkbu1F+M+0N(kIqxcS@S@T`6j=`7CQ=-81yuCB3$|vSR5xC$lRX=)FlG
z^y`A>G8qeAeKrB0n2Mt=BTSy!s_Hnuoavq*bea^!tFCDeH8ME=`R9c1IluYO?#EmG
z#ujiU;-B^FlL=Mccm9XZ^r@JJhAJAG72s5XMs0?zqorlAZ_6)>1uBrZ0U)n|7(rL`
z<f2Hd(|#-hP@EabNp1=_vxu-K9f@#!^eTxn17V2;QAFu03pQL{W6402swRQ-=jA>P
z>=vP2ZB|Z3f*EQ(vE;W&i-eKgvim8x{>PtRc1ui*saJFj9a?zDaAl&_xaZ^Fja{^B
zZ%x&qL4ndh-$oTkD2PhXavCX=6*d{)>*jJLl(}}1Qk{1<enJnnKAHTkFjBppga9J`
zRMT>~Ac5qsBk~2+(q1v?V4_wnQO5I4G2@2+Pxh*cTq*{0?F6Xt-IPPFu(z)-uilQW
ztxGf!T?EZ_@yyT9{TFz`{1UBwl3f$+8FX{R{u9eR(n$WGKwd!ZZ*247NKYrP`t2F(
z;rqr?qx?A@-D$-QqQYfWuyXDgY#kmxuK_o<*r_AbE3ylElQdXg^k(LwFMN}~LWNdK
zfiJtw>>%{GW>zyNXih5)%0!yV&mHIc@NPwM@d&EKJMkPbfGqshL`pI~v4SSj;bSnl
z3@7zo;K}@qvpT_J)RsV+Ja8L;yj&i_j>>au;&}(-p9InOHo1vqcK+0`v&;us!~_w!
z9aR!u{ezeFfje$?VX2j{*M<{tV&Rs;KfI70m(=hJs@ckyViNhtdg?t!8jq4~$`B<g
zH_FZXFd2=ijvm*TQ8H*8aEC0vTtg6oydp!L@jZUr?~q@@`EU?6?-jfh1&L<@8GQ<e
z(eE>&vp?2-S5fbj<qx)dmg(H<5*O_-OKAbdVeRzKBc)C?p^;3a1DfQTGw?8;@@8s)
zOC?BKqqr1#q|s@Bi)^6LsG@Lkr@6+&;XPVJYC)$`!5fqynzIN7MJl#w<G!`@LqRR7
zx=~4VlTQR*oiGLCW2qiE(3`&o(HF5v5~h99^4d?n@}4w!vl)HA>qGVK-b#6!6+6h5
zQ1mD;x2AlRiY+`NMGY6M>;)G0QAnoMwzl)?_z`~S6SMifLk@2247rbct?&;a0Yc+1
z2Xx=-2d&~#F`pb9AJG;(Y2z&i(m1ku1Mc%itGUx!Ez(y)zaB&pSzmxWu;97EBN>DL
z41b0S>>G1A-Y{zCUX~ZsyL%t*k6!K{p#eLeg)}K%%}FEk?B+2{3Kbbic*%XS;&+NQ
zo{bJFj>{~#=c+0%zkw?f6mnGm5CVfP5E<~|H@2mX`O|mV4qU$ydsP@cMX74>UZWK!
z_pYZW*2GSVfUYQk1b+wH87zfKt1ww##Gu{ett(eh$~D45=v&j6OgQ#!wcwLiBnXuK
zste6Lj1_@mJY24>yEx$YZwa|_H%4+)>(p3hF=2PfCI=#Fc#sT~qTXP}9w=xyAUX{|
zMMWm~t4T=AzR7ma_$ods=NYXF7M`;@Q$Y>_)dTWjy-A1eZ^yrc;rH60Eu^A1oAdOP
zT1u=4v|ZgkrrQO4f)l^eVk=8vG)9k)(oFtbK}$UETpR73LjYXlC9&YI2Q#Ec7QtUH
zK^}noYB<lb1rXDacKR}T7c9OovGQJ!HZ^>Vs<4sUrFU@tjyMs5%{ss7Vh)^S*IPzO
zjcL;x_kG%7OK3b-^oz=zfycJJUFlGaTL6rL(1o@n-nHK0YS_^{@ZEW)#y;h_^AGH2
z0H|3dCjj)3r)}VPMc!>O6GVjDT_U~+r~woPzW{qoPRS?{oHif`?iWpP3g(OFCqZ;5
zv5-HZNe=$pWNiw&Nw^e&{*Kxdg4MyGPk&quEg^FdsN><+-C1T`DatSZ>jhL!n{yxU
z31B5qp@9+#Nv$JYVvy-A*QP08a(<nq^8NYEJyh}EmR^2P73ozZy(o)En+LcC%A^6v
zET>mXFK@1kp=NVmip>5fRmKjV>hkRTZ&Yt0P*f-LD68wW3#%uq#4+5OHG9VEp|qt{
z^TCswt+`e6G)-Z|1|)x=`I`&?P!$#4bhmqS@{ci+@la;@l)iZ}0ISHXf0tLcEYt}y
zCBz#jleSK5HuUY}BLw5O!mWZiuN=Q&(Q^LK9WLjj*qDt>xO+VW0x^*TqCz>Vtm}EY
z{3VRsi#am;RShlbTL^~RXn};5JP8oD1GtZ6tun7y!S<`*`<HOBEW2(27-C;_hJyCs
zC_tbB;E~cG&|E8Ky6W&Gk4sASx2Ax{eI>9k&^$N-6_fqmM@FS9>(tFMo!)MkMzA0S
zb>ywl?|KYLo75vcA`2?Ofdct&KZIa628i!nWvZs*LaqH74`dCZKjGY5Hf<8}XyFc<
z?I7<ac}raj1Z{fPEt+#KdwVpMT?ew=J^eJDfI&}wCzJoen+=WJbAAm1$pRv6Q*#7c
zxl0y;cIIW13H#61)w5j};MRML0+N6-c>DK}*fy|gB!6Re0M^UZVxXm<(R*@JwhFfX
zGeoIQ!!<}Q5noFMcp!j2h`~qVi=SEUS@`{6cZ)Kt?JKX4_1u||-?F<yD7+eWS({bt
zDejOP{}+WkdFuue75pt^Z1q-y%g`Q)l=kqYmmSI>oTNxEK!G#BMUgT@`IQb#Z128x
zL?PmIaNOozwB}R(`O{rIp>9tCzJKg@V~weNhER37#5H_~qGi%>*?6+&H*AF9K6^ew
z6*R(E2roYc@?oRY9ff%J;T$`^1~3jFP5{rfUAW3D+%VuV-0RZ7SSXk_W}0Ip=HqZ9
zIx}_|ssVuoh9T~~4`|4i=$8%==x$RPE}pPrPh-K)3@1O;R%9p4V@l7`#Jv4v`#uuR
zqX`)VS_BdS=myFK?1(48MdRC0hWZ?oSefg9?)T9un+0YC;Zp0vVI`@o#RgLR2*CuR
zvg{`bYh~=+IDYr*_^1kd*~CT1T9g+ZuV=_lU&5Jmo@hhGj0;`tF>jsKQK*4YqxkhH
z58Ae@#)1-(GJXALeXiEw^l8g%9U)iUcO=(E{pmXRhvY7Aa~FPn(>LE-75&J-tyL0E
zfjOjCAo7c3+mI@K$ebtBu`Td7emctt+>fvWOU3JKU_5!DLBo~TDgy!yk^#m|$@CHY
zj*EO6H$yvFowt&Axpap6c>lzdJw{pf3bik(%lCfu3@*yq{-rG-E2px-nDAxM1}<h3
zj9)qFxH-9MUf<d$-btcC4Vh!W@I$Cb82V>q{QzEIcrKGn_9KnIx3v+^9HdfGqiA)u
z$FyxmS752-9%9%dqjF>&5KX;KX&*u25xaC>JGDTaMcw^sksieu3v69EWN8*|86`tS
z`D2X$1HsL^s>rLU%o`rk6#)+l^at+Wt+8VOE2+7V&T^(uzpjv#O0GrtC0aj12s2ZX
z9Xf$UwttcHK=X$O(fd`AU!vwZ%#~V=$R|-Q0s!!XI}OZRI5`?v>%zZx<HML%dlXW*
z3ikC0q5OOI&j86p`tlSTBF*pS60F=V)|sseS%nn809M4!AbazqUcLIe0{l^pdW#k4
zLmuz1dL7&PZ%PN>EhVoJh=aRqYZoS0sWjQDyCfw(cAg}=9XN9^FgQz~AoKq<$a7$5
zIJ`!lij|~XS`W{)|I1WS#a%DO5RNUlJ5q)v!sb$n7HWA+*nlG2UU}qdpUhGk8cCW=
z3%0IP!97#|>eWPucKg@W*sKBfkK~^!fl-)<3j#3^`VWcA@b7K^nYSJ;dh5T0lA|s(
z8MV~i%ud|*1;@VLtRgu?G9LJ3i*3$~4!0Kjt%BVI9)#Nimz46T%~5LyPtV|0;}ES9
z2F~sKPtUBmuw*Bu!iL{?$*OfT4gjA3D6qTx22CphgW|`AsjO?{ZgYA=qBq7#%$b@A
zkJfX6K7^gqgV$72s9%q%P=0Pot%nID!^srSgYemwW~AVl3OKv%*K)gWOIgAu`?`Rp
z<<Oz$)r}|MYbw&LZuDZl%M|yp+>mS`kJC<9t~wbVHl0M0O~8Q|>}=Ow;8}h(@U9#=
z{e*V^g5yi*e#4lM?=m57nhv+a;X$dV>USmPyuMPlrR@kF^Q;BEF{VK6jS8q(YSgYz
zU7s^2gdgyVz}=zTisX~F8fZOS=TT%Sl(>t$B)?ZjLR`gj8$<*RlLQfIrBpu^q}zne
zm%^;It^E=U8+%p<@;b|GcfO@JAVx4=*D&S3E>z#CsQaPC&4!#}OJk8ocW3(MSM+E1
z184Q>gdx$_UzAOjT4xXKqaIztukb9n2?;^s`#{1NQP-hcPn?vly`R}p&rj0U6)3c2
zp(d}zt>kLN+2ZiK-nybR`KDn6K184ga6^I#kZP~OuAmRg>5}m*zi#~84xKrAxl$Pl
zTV==!v`UOl*}ZP*cAhXkxp4S`7yxNjwJ$%9u+ZB$`zVWZqOLtl=T%l_z6-Hz!iSnO
zok$XuvWG2UisouJVtaR)dzKN<O3`R01p?8Sbrp<_YQd_Gau#kWh*uff;E6Gsef=!=
zX)ZjT5?Dtil3)*3EMj-=lPFX`=7mfj4Sf+7tNXB#@;d-^obS_%@Ep|?qu9tvd27Cc
zb*lDwD*>!agcqW;rSdyCc&TsXCPrdAqT9+sy}0ILCe7;TglTXi>OF7LqY$&a5kbWW
zYw~LOmLcsc)^1_bsU%g1?hdo?h;h2I>6utt4pNXJ&In5{KTmCymm29Tm8)PNd_Dw_
z(>{=&iWIm_u-p&<!^yx&hJJhVTK0a8MvIlUrtAZ|)tAnfbI8D_<8hT4zD|ES3EW>P
zm-wVq=V17*(ktvSK$PGmVI8R|Jq|oTu$mcVt#d}hxN+mtlONa(Wi?kikQuU6wBlU)
zn3D7by+OaHZvkOX6L|Eib9f^b+X3cGpd<=X@aKpfR9EIDu7hz0d(T2huXd?fRRKX1
zKIdC2(t%}1ZSC1Bd8>7o!Oh<kq<bhKkBcQx<N-u9w=fyEzsJVhX0Aq{rme|;K1-~(
zDB{#-sZ+^a=mdcjQ2|?Q2_QGKFu8Y>eHfUw&ma=7kq%KoKA(knoOh*zuMaX16TeT9
zu!c%X%$t5)o|SvaqGV>g&oi8DjWSQmY**_**yvfA%C0aM<Em@$-qC;2#ONhx7_;IL
z<Y?5S_AZ_nY&Wh|OFV{i#AB560Wl7pRiD9K)|++H(v&-+nimQ7s;Ypo%e3?4W?0}V
zkOCJsH4lFB<p;<FD?n9Mcgs9ZUj)^omd$WmlFlMT0~G_gyZCXDt54=x8>2)d<(TM-
z^e((^CrS90+p&I`GGa(2x@&0EGVDu%ZG-j~a~TtMUG*eT`{bjj%uq|KOo#=X@iClO
z6#3~0vQ;&3=eX_l*3s^zJgx1YKC2Q;hQ9_W0%0qViNTevi3Dbgj>>qG>l33=Y4>xb
zJr&L}k7-nhDqR*J1p(`Xl|%guldJ^FWS~dDTL<jWGIfv!BfbhvJz&(1$KlCGjaSLG
zT)u&`x+qjO3Z&Ko45~vf5pR>p`ZqJDwR);#-3!}GaL|b<X_?~7LpW*cwEA7~>&6^w
zT@AOrlqnVB#XAX5Z{3i!wPG*BBjn;HYvp{DCP%1NdEP0$l6o6eJj9}3ss&pW`bLX&
z#u11b3S$erIrc)qVc9r3;HIyy=ch+2kf5fKnCv9lImS*kTkN;xGytm_m#x&KQN_D-
zo($z%U{bk`f`^Sgj?~R?Y4tU>lgjo8OHL<m)M&7YIwE7dU4~Cf^2sj4f8qqBLifzD
z1U<UZSIv6{WSH)52XFJx@S|>pgr%I`G9-_c8)!I{f92(ykdLrI%hLd6>7?eKsSCF8
zmCEJgjuOGL^0G<a@7dX`z07f87hZBIw7IIXW-NO*q3(kHuXoZ7;sU6!Az$KWUj;Ek
zX*4Yp_Qe#nB6vxka?Ah7zGIkt<RNV@P*={>XS7Az4Sn9+|B?T#A3gFKR*5m;_ujTm
z5EtF^#Xu#s_puoHA}fNTxn|`qPz)2!?Jt%VLl?Y>xyC)~&>swgJ5B@H+P>P9nWQrv
zP7ItU`6@ZIhdB55gK%+!h&m~0LJV9dyswkQ4=hS15u+Qjb3_r@N6FVKIDh+2I@UtK
zUOMpuJ9g**VR_&h^Y+{-)z@YjS|Ag;l1A6WZDg>Mu}fE)+ej@~eVt7sn6sbGd6`>e
z949Pi$O0|@ahso?zd&~y#2Zm6C=hL)9L8kf$R9fS_R;9&bB?Q$RnoxE)!n6euHoFm
ztP=FzwPpQxB5kwf+uVq1gaA10%YD#F$p=>nrzON_^k6tlV(u4_#;>8gy_sCCj`f|9
zymBGet?~~$U3mcIP`zUU58!o!NhLW72)FWo(JJU)Pd#gIEg&NtD}>2Z`fA)eWgR%$
zix>9NO@O}2@OrWf>SGmZ^Xq(INT6+XIQeC*<BdC%qrcn*m8Mh~v6Ht|1E@Mcg?ek$
zs*Osj78OruITqDC(aSA2TxE`Q4Y`=2h4<(Kqt>l`_Fp?KC1$aK><Z1>eIcL}=~lWy
z5ntkcB!a8}GxjT^%h)1x1vlvg+;mFcZGvJxh00Nx?!r|HaD@zY<{RlSX$d8lNs}te
zW1@vDHHK*q?`sTrUp-27sIQaKTA4Pq%DQ08%&hX_^LNj1n>b)45>z-r%$+k!th_og
zYF4k4N%j(sFE~QlAdGrci1Tn)3QM}RFyliVDz#jz0UG=x3*g+XVtiy4!3=xO957tE
z^6!!7_)j=rWZ5B4Z=Z&W(@;Y4wzt%O|0+9WMGNCrC&QO<LeoXHX|h}OiyE~K{$#8p
z{~d2w0~Yt8EYPcaML#PH(FZ67*js*retb8{%B_*u+&T#DQpH?4)q2Aeubw}e1Tp`n
zM`m5uFy-qP>D9D{9`b_4F99f1j$~*?!fdyhsnGvOsS9AMa}fq(7u$Zd+h8Vi!eP{q
z$6@@Yu2uNLpnkBV=PmiLb#_jG9CtR>T9vEnlX;>oquSRf+#v?(+822Ti()#r_1>~S
zh&l;@H4vIB)mVN;qhQ%WQ`>La@7JN$c>OHpV+33RPA0f$yf%2p<h6>}CEWO@pL@P%
zeIg?I?fhC!$gQx171cEU8#j$IBU&{UGaMOJ(R}uY4K|T{Yi`PndH7&`O`O?Yoy%_G
z?OIvCL-D-UAyL{7!pW1iXjXN4Hupa9K1`LK#7Fp(&UjH9loY4=;rcCTA(n5&&u?jo
zC;EHe<VYC*Js!`B6abTFZs0$B@UKC}5Yt6m$}Y!nZ$!==D$<Eub*!x$&i`i0k9F$v
zH#NaM1~||)fBvr*Fd6$Bzb-$yYla>F$)vRl6sm5=Ep77lK*3QepzGD7ZwB$i%phF^
zV#PO<%|$5|?SAZYJ>g-;PvNQCun2H_xn}w*)0`k0b&sC#G3&hwj)R48$KYTbex%JV
zt23!UqMl8x?G5q}aL%GBl3#pRkrxgc$9u@6Zx<cc#OZ_G<l^&L83?(MG3s|M-fQWq
z%|`;o?S~(0i4N~0fwVeYJ_Sxe$y5s~Qo3F|w66ONvpv^b922kXm~9Xx@f<@55knPT
z{S`G{Z^an8K6Sr%Z&QN}`csaEh^~@D`g=I+OsNRFg7yF!5zpu#9fv}Jlm@6|tRnu@
zUhL1i$KNxU^U%d4-&dNgKE1_LrpUm`D)C_p`t(skUz~kvt>{w5Yopy%zQWPjkY;5l
zP&NRQCFZRtPDs2IT&~zJO}7Xn<4+ZqZbjH^J4uWXrzpY_5I#mo;TSG8e>vVcGx1gN
zFPFnO+Yz~7TS8R3OU%@H=Lbf`>Jx7#)m3a_<F&gCUN;ArKB{B%^_=BynhdjD$89Dz
zQeBs#1nZ(yndDV09+Dn*b##ip%?IejVB8!Zp{ng6|M_?Hiqv{h8f{ibPg$W2Ii<m2
zVDT?5wCY=fNa$vUW(e#3u;l#R_87KEIZJQ=&bYni!<{LfctUX=;7jg-mWat&_+<~x
zWuVxLYM6_jh^G9i0mh^np#oZeqL;I|%dOH|=AzdPCa;5i3y4X$8r0@m>GBt3_%tsc
zU8Sc{UVi$m3KOj;wJWb$(s;YsAh=wH>2H6$2Zk_611#b)J$<zklKPs}U$FIag^tb?
z%5n7D^!Q?%RrULT^$_`YsY+?OBl8&=0gZxDb4+ys?7z&^j2WT?da|g4Gh&t~JK8h6
zjP$-2Zm7KZ1#}D)uSI@oVi(GX{>I0V9x+eqlgwY|jX)EpsOPPlWHx5c*)0?pvt^h4
z7`wj7>WR|}KfB|LYLV2nC+BBcB_u~ocoi{QTNzE8$3z4WXs!1R+a^s2-b+zGyi!1%
zSE#fE93K&6){eiDM}_T8Vg<1w9A=DTDo%{6r^I-cL@0ZDwN7Q>Q6^jHERf8utFea-
z$lm75hu(zCCTzQ;1ra`JjF|8JAisQ@vK{C3A%mEdzmRwgP2FD20>J{`$+hPThob{*
zDISxk!I0OvoQ1rvE?p;H1Cq;})%e9ixH?dF@#yxuCmPdB!2V=?A0Nq6*=N)3VM8p$
zhgI4l9TJFE5=oF?Ukyk`mCX9sP8lch7=TV8`}NTFnsF3Lu#>J7_i_(Tti^;xXPGgy
zL7w+qLkm<ag@XQ`N^+nGP2XMaCEoOmY^-BjRK~E5<9@W~Cqm66Eqn{yyApkzr=!D5
zo7s-D25`Hd-y`sBrT43_fd^}8@7ZJqmBQBeUCbwR==;Q)g{6U5rYPG0tuJkxmN0KE
z4BfqOnF<k|EFnd`eevOIlBNj#ATz5vM#}NQkQNOoN=UFhO`&k8b%dJNo&g&!M#zj3
zfv-=FZV!YzfAXZQo|+KZ<Ai8IxWU)B`&PV{?*I=bd)=$IqJ<xugIElW`S}KKg418V
zp5XZ<h1dsdC}a`9ArB^rbvqs5V189<(6quuYp}NYN+DA>wG-tM<8ogks!SI-yTdZS
z6B$8;6bvL6sZuyX6`c2l1hlU%lKtW&SGCd6LpXvqdDJM&SV)l(_rgN^Y(=?bKSmeN
zV^y2Pslqy_GgRemhxv<roh4xu%pO_8+>_4t;06pSxsQXJBYX1bc%T#i4}2LsDFD<n
zkfm*&dEBjJU+~8eWPX>TmsRgeL6kPh7TE4B(`MT20n7YP0=pkf^4ieASSZm5whYu3
z^H#CXtBKz~nxVlL3uSle94F6Fy5QI=KuZ<}o+qpPPo`T(XQ9_*9i#R|{WBrt(w~c|
zkY};9>cks7mpRxPW~{2OB%%DV-W?`*AEYHRa!RRBi?vt<F!aJ%N@z5DiiBEddS$=E
zN9WP8$%Xah&A3E4AfNYpn0?;#1|m2Hd>xcpL8J2|Uy^8qyqY&w;#v!EyY&Z>>!u8Z
z!%7x13K}n7FIrdJ^5&_rTHZUxKYj|#-Q^FSlztukfv8tmOolO#XUU*a1-({2#f43K
zN{7rlM#kWYHp^&ksq7FZFw<V;Qs_cef*}*^=vkm*@f~>fgX5~H>_1W}d5bF$xtASY
zk1EFGeY=12PF{ECwRhL=s<Dw|e-GM%|HX7IQuoMF=3zWNYR$^XE>r%ZXSVH=t=en2
zD`a1GmieXH2Lvk_og`Csaj~p0E?Jz6A<OY1xq;7GbL)!+PR`*x4p9x($_%M}Cif6P
zVs&w>yJK8DbP;VgGZ|PT4y<wlFwSu;w$|+02Ba@P@C9R2GTB!v%M-BtHF3_0v|3Kd
zd@8Kd(4Kr!auW52Yc+pK1Uk;8?`WZtxPw7Sb`WEq;Ju31!?~PU6K%$^857EMiCt+&
zf^ka-<qeUF4(P-UBg&e*4)qOCTUComoLb&q1g^qCSe70!`uMDMbYiv8^#kXS^^$pk
zgazd9{VW+1e3T|TQC{3|Dkuav6txIvoX_s++qKfhbSlS&h7peOLdxZLE)+FbJ#*fC
zZAMqjJHNjU|2&HrSuaL}y6eW#<o)3HGN_YBFseI0yImt+nS`Ba_y7ykSvE5+`NE!A
z?kZt62{sdMZB8wyJq3`nxAW+bPPbS_og};V<ZnYu1aX+j?4w5cGuJKa+(JxC<nV*l
zoLFn8bzi(LU&|eNeWL+17^J>>8!i>3FN$KFvQO|Oj?N-Y-&ES_e$^@&m>zJ)QS<A(
znRvz;$uY^3rwd~`lI9$){UrVd7gdcR(M|syO3-8gn}UX~$U2I4nE$T<CTsoyG$uuw
z;oS=j_Q*yTZhAvZmBUPqK2pSuan?d&t?Ig7;s>kDF&8N0PJ(?p+d9nZ`7^Oj5U=MI
zg~#rcjX2}d@diN&a|VylA=aqJc!6;hi;6nXXfLgk#TwZdiJg*BYiEF9#78Mwh^iku
zb7+{Yf)zFRv5+;Qm0RPSJHmV9UQ$I!QjXDJIE9sK5+Mjklnst+=Ow`ZAA4`vRLApm
zfgXZ};I6?5?!h$#hj5Sphv4qP-8HzoyE_De6WrYc1a}Ay2fM@XUr*J2c|X9N7Zi17
zrn{%7yJz>>d#{!6>0Lc!rZ!?)6ybg*Z8lJHDJ&9~Yo+$hc(5kB-%IE@s1nJ<81Uzi
z<EwIcRIBs;<eOWooYQkov##<@_G4M1?x59P4Z(*i&X2;E?UYC*8hZTobqFWQ4K9@u
zQs~rFlJyDip9<YbWuvJDK&<7igpyyegDOq?Fv*>iM@qHRRMkCMQb`6g9E}s}iCMjV
zmcN-A^vs#AqRSPhENhjr8L7lHH(_0w-7jCa)cT+WBv61Qfle?b$H<$Gmtbm7F0vms
zPFuAB;Qt@Y#;o3vH$-rpUiOl%ro3ZSm2_cfQp^L%t_&&@HMb8AVMYnPfAWqi+ur}n
zA2@<N>}!1I_SGyMGI?m|*K8s;#9)%JPM2s7i;`nd;uTn;UXDfpOUv2E8BY%>Za#0{
zPM%*frc&Y_DS-7lSq7Pn0o+}qjss*#j~m0Xyfm_Ei>>XObw#SAb$klk^=2ra8Fr3a
zmBoTM(i3PcJ`3noY&0u>p`Hp3_s-@CIr=O`7e|Pb4Ym{dJA;-(WEkMBc1Ob#D)<B@
zji^hSPh*!5=+{x?y`f7O$$1mxZ_y-hHDvWuW0dxC(DkQFvq8~M1g6IN5y{~iF{&0*
zCeHoyx8yFZT6sL$bA{b%ai%CqwaXaa<EK5ZrqnxEA>V$N%Ab_}URhs1xooLdFs8`5
zCfY%(->$4tm87Zj^LzGt7WUB-R89>JGg<D+QMYDJtstcWys`gkFByoVN<Qr%hltxO
z{O!`~oH$C{xn*S%3!-8mGw;DM*Eq<}gV0v8udnXOHs^3BZ~@EDpDFL7;0`VUnd_en
z9R=kqJB75P-)829<xRqSl(bu_A$0p>1cNkj@UDd`)K00?K0(^aOaQ5k7VOj0lV6u>
zlNuZPnXA%iUbYgWiK^leF-!7Sh=j^e79VU3tG@e03nC%{f@jZ3q~S*3?+E88HNrt^
zeMxNkG)N-4X9sM=P?Z=(Or0)B*4Sy@0)bz&bQDhpyO~KXWK6A3Hl8|2JD~mjgx=5M
z`1@Bkju0)MhW`57Slh)DXJ8Mucge06$jg94VqCeXV9o1|BG7=DKjUvt*cAh&lkVeO
z&=W~)HQXo=1cn|;xQR!ITo4%HA0|2*Z5;6F=3z3Io{Q1*uPj?xnaC-z_^q`JXnjNs
z8&|+7y@t+r>&*`+wC8PN;g<e(?=tOKXejJC0hqA?&IIv3_F-+xfyf9QvtFc_PvjU#
z!TzoMAzua<0_sOLmnuJHGmiQF6w`ffjSMpAE*9+4I3dA_sz5L1C0@5;<CDj8!H7f+
zE8^F#j8I{v(6(kvT66l2Bk>mgNjUr4P|=Gh4bjk_JSN=6p(02F0;L4+yd2^(eH{E_
zi>sXS6cb**<jGtBvYB6ud?`vK0gPnfpzOEK<smhh+c*)1R*7SW4V*e;An%+_O)PX}
z3(u5Sg|yD1W{x}s_gx`}#~}btIZH)$>lqc&lAztURaI2g6~;^V=apIkyMg-dmX57P
zyKqxgx_s%~TaUsYy|Qq9+@><~b};>+A9z(&7>b=Ei1JgO;{lSmWNZ>|*uj9xr%#7(
z%b3xWy6j>orL%_#_H5^qv=~%ymbM6OTcH5Hi8Caa=gzX^o6B2zyf0%aUz+vJy2`ZY
zKf@gs*Z_-eK{k}4oPHq)+Ni%R<N!&JV3Sy|>hZj*Xj`l_NSy;wd_1Oqvn}@B_v~FA
z4yl;kVXDd8N!5FVtrCU+O~OJBC8k=~$Zl}go}Ka90p&^k-Df^`7D7h6VZZ<{Qk%%%
zfa!!v=BO5}N^Bj3;HIpfUEa5C7-R!P32qA;%IJ+?-`Z~@woUV9+nmkQ4L<se3?@4u
zdJ=MxpI627zql65<Q^>g3i}B+NDfpW3g(3zkfha9?`jY7OI5rRJEc<|x<28|Q9NRR
zQAN%;ty0Jm0z?0vA^sOa>@a9JP5_9&>vWDtlh@?TGwiPeu!R`1R_#xR;+mAKvl=9T
zFG_;Lly_%u1<b%$h!@fA>tmZEK!R+->-EEMm9}((?kIOgB0lActJJ@UgP!u&p8%ZE
zx<e9pkn9iVD9C-I;Vc2_qIxyCYc0%$xZ2{+Zmvi=+Q0rLTfd1m%BBlBit`fyI9%?u
zTc_HEt;dnVp<<ofC6(q$E4gB({`*ANZtNB;rf!HSD<g^wa;p$aHvT{y%y8;_LM_t@
zy9tueZZZ&j;M=w&9JBka+oUc<0z2SSowSw$@7Ra*v|-uerfAVF0k%o(D5F`FX#4aP
zax$(F9VK0ON@P6`#Get%Fou5a&p!gGY??k`h<+~t?O2s)sdbm448H~T8f(p;o}PBv
z{|^h$3Sm|F_V2AT&KU9_UHvjfHuNL-8(WezL%i|Q$Hl$N7Klkuoo|j~TA^5M(Y$$m
zyPqh!as3@u>O9pTX5@$MrkCg+IOotm(#9a%-!}9U&Jj$@rEdem{9sW)_YH;Xi$)4g
z$l%Pz!!Et#h#75U(FBMW+gFAy0#g??Vw6Iq29%J1_qTe%nVz3r3w2ff{k@wQhqWVb
z)QBeeP2|DWr6PF;fnO1`4DUt#=8w+ruI--8K!f?<D`k9&pm4PEY*#Puj?(d2)$n;b
zFd6_AUmW;`TuNw!(c%gYC~+U%ps@`y>gc0VWSPo1q^1p%6vhsl>Gmkjz3=4d3DrjE
zqZ)=zKoxH2&yCs3(x*}u$J$}PX=L5C>2#9qCBh`Y${J)LIfS@DNoCtW8<U9MZpC#C
zUOVD^K)Unbhafuv#9u*9rOt657RxY4FTy|J7uKonP)04C%pn-Q^>izL@@z(+rqAab
z{?s;Y8beh$ISzo%02UBAYyc#8xLQu60Ua8|&XBJp_%85r9$xy&-S|D=d8uF>M1$Ug
z`*e}lw!$5+OqQ`(6JUT*A-MAAJAVat%x0LeNx+Z^mxnkEf}1k_HVQpDU=n?$i5>ow
z>$@P7GDK*AJfM|#j44;DRFO1Rq&g9K9bJ8m^hxBNzncjw6wD&7qVGH1xWH*)SAnHe
zX(dG*_LBH&)lB$fxpa*v{48GnXjSvoL!1=lA{T&3cT}IeGyt#H)bA?=C7kRD+|i2q
zFf4`ynjiDS^HKa+I|1uw=t1HrAlb+dzpoLRg>gcHOG~Xplp%d$imagfrbZEkVxNzA
z#a$b#$%tR|*BA<AfrV-mPhf_J9*dCVc!)YtDc5R}+$CL>BN11VmjoHEh71<$PM2s+
z_L)JT7qH}aO_RTFSitPOSw8{YyG#yv^ppxK&asGE?eq9lRA7!{$|Me>AjGfg^j$II
zAfvRn8`FFBkTN7Vr5U-%eAFdT^b-}0n|ywo)9ZLQr`k{cMM`%ve(YmD&#?n4l!Kp>
z&=H_($|3)WTJWn#HbCLbPi${mM_LmH6;0~n%<V$^#NK%`;<QeYe7jXcNl6d~TCV)Z
ziwrJEoZTFUZ=87SaSnRvF@{%_EgGr!pZiA}0MC~t0p^^T6)9Wcsb3cpQD%{+j#5(|
z!L+t?+8%sJey|<%sY4y7Z|fBOZswMZ&Y@y}8l6ZsNBr?ztkg>OS_>LVMu?24!~#pl
zoG>hiSx_eqW>{HB-C{2)o_DTToF2(Z$W>qv6$>;z^$ls{S5{B~Txjrivhwq;L31I2
zs`zocZpHOU-kj}mMnmzC>^renKa@TES&M4=5%EbSfQZ8Sy|*6CXrY-)a=&I#>4A<f
zG{okzrJaKku)>U_jo$*>O~Yf7mqs%-0dE`9fN3Dy5KNa29jlB|&90d<Y4yYJvBx_Z
z^rNp}8KW8DElWKAlvY$AK`rr{#if%H;DGpM*|A@B_bC<90PJT=7Wl(&D%Z^{=adO^
zVan3Y)r*oSUCCe)B4T=Nbs%pT5|n;LL=x6PWW-e@eLo%CTxKOC8*K1aO(~6#6VG9;
zCDeIu+p31=`5k<vBOo9-R!ARi*bQgl(lx3W7Hsg)$E$QW#2-*5B<?^-<0c8sF+c!w
za9<lOuj>U3sx!=hxy94_u>j-@Ecy*`hC1-=Plniq@77Y^nXpV1m#+Fu9Eeb$?J*4#
zM>nnr(_iqm6Vc*7cM=xh$Qd6JdT`uaf@FKbRw*PthgaU7m|gC$Cz{8M$pQ`#Q5fqJ
zo+1`ETatBO?@P{nr@L5#H}OldBJ#<z&Y@M$qFw3EvP~u6%8EEe201o@ebVcT8Nhde
zHnFy-P@v%(_wSh2r<&|+f#SXHcIHV{g?s-5Ngae9*d@}D%WOCoSxT<!m2cGIXMI^l
z6Zt%4R?nZxqQp0Fa`-M}CVP6-^z&JGD4iFuwlE6^n7>ih8s6a*y6t)kN^?OA<kyOu
z0&@st=l;;jneELB;(+Q01zM@u0}CedQM<6=;geMW`7A_<OO9SUglua3+{t~2LjvIG
zm-wAK8?O{vF+%+S7g(nR?t4YGgkaORq_~%gNrVm}G>Y%@e3O(wExT`rkI+i80~H#f
z*0x!Cx~8Jxie6Q0L0m~6aBjFyZg5yG`tq%UkJ1w{JmX<-l0J+!{YsRHQq9esQkvN!
z?P77`IN*Q$OP6?1@8H?^?Xg=Jn(1Cwvpg3<ox2?$2x;K{4}72+P^`=v$or5Unn&;@
z*&8P3ht5jrPa?K38WpVl{dX2iq24pm|KZcl<!nh3Ilc>fXwiz);cgbzQkLz7!)5C>
zwd4rh726P$Pxb8$)hd6;kZvAE+@cRNbuJ4Mo_5pW3>*8V&RjSND7-?*q8P-ISJ`Bh
z11*g0TfWf0d2{qp_Q%c;SV3M+cL+tY`nw4m!6Tne0xk&oi)F7gtfZki9A{ZHjh3=}
zxM{+$MLCLdz398Rub)P~cZM%P2g3e`YNb9?q$IYvp?>^`N5yD7lVWJ?p-5<2|4hEV
zm3+ipD%_n;>V#xMRe18R$Er3p!lXzfR(esqR35O`|KxF)iMsfgnrX9IEHNz?*`YpF
zar2nra}oc$HN(&1p4P#d7}-z96!kHPB#;~I81E|C+JYsXn>@x7duML-nH?Oi|6Zhz
zk3M>g+<|ld9aVZFKxH@?B>LIF*jhZ>b+}hGdjv0FNWZQnAV>(kxxv;Vgv|30O{78%
zaVA@uciZ`v@c;laF+U_4e;zRbKAlGbIy3HO$N!EC$?DAt$*hThI39VEPO>v{&?>|w
zr<aA3z_K?bO-)>mptP?(??Y`YUApz+-tVAdCjjx-wmv<r=1z9*vm(d12pJJfA^n%4
zMN!RZj2%Vm!3@ZRFSD`I$v7;5L&%`m$nb5aT&5@t@(1kn&B~Bny7YFRxjKEE=}nJm
zo^<AC-)wq~auENgojTIhLYz@aZiCUA4f$%FmFd=+xzN1SETG#3!?>Q=zEsk|oLz?w
za2G<`fStQ4&t-_ii!j{>?$D-!ebj&%^AIv%y*=ehj!8<LwvOxB$L3iFz@DHw!Y~t%
zdtJVVmOu+Zt5GDu2rLoTA&E08s2|u~<%?*CkC`AY6O?=o`Wm9_bf@2RRNE76OSgYs
zAY+Wf-8v?19Ar?d0Vk#h${}8nV@NqUx{7v44&9QsoE#Lbu5kgeeZlFsK2(gSv0y?g
z&oyHCr%aABc&MDEX~O+25_<HHiUh5!u`Xe3pYpJ8xPYytkCh;Q%BXRf5VRlgfo=w!
z5tG!bo6<Rh*9LfKx$_7=762fO$gX@Ul5Wx2qU9&nFfK=S2;Np_26)5gc8&POOGi%*
z)s_3}*s2{<?P}}%>oqI!<ji%&;Bu@YtOlg7>AbRnfZR)_;-thR;G@GaNdwp+=T!7o
zaz1I;0+}Z1JsQ7S6KPZHrQ*C<>`3-%7T7YC9`qcqi?e8Z>shE;?8(p@Vi&Er<4dO*
zCqV9Ch7$sMmeZq(oSEy}>$}MurEFjs>YwZPj%O-9_-Ld2H3)CaRl>SA#o$ePdm8@L
zbt!IWpw=l@DN`5Ys-z5{%h>iKuiK=a7=^c$G$$pl(eUc-Y7U*Vu#VIkcflM3cp=z;
zL%JDR#%e_`?KX4HtcqKG(~ToxSlN;MI|n3E(koF6h<4Rvlv@&M%~p4p=TKha%~$BN
zaiL6y!BMJvCJ^!_O`KxjOsq9yC4X?AEN(i@X?>&w+oom?1L1AF^~0>TrOtETNUoo}
zdCIA8*uE!d)Xg-&=`?7bw78#@lv>rWUb`84iyd$dyAI$7O_>$6qz-Jo4Y5-t$U#Cw
zlg;-Q4gOs!!aJZSrCVb^&PaT)+FsQ|E1)djWyf2@y9Q<_Mjy^4Q2m+HYkjJCInPNP
z(WtiSWT(W7kXjy9a7?zYG<J1`N+E;U#HhgV4oS9JtSXS_5s1WOZWTy*2Bu#~k2wb+
z5TGldXnQpwB6Rg4rs#`ooR~4JaV1|rTS-{^zz--ZA|s`9P}k=U;CyKs_##n{%%@s-
z9i46PrhJV42S3BvNZodxW@;RNV(t6<QHH-X1*-F$f1Ms4uX?UR4o%QJ68jAFL2Mn$
zjtQOBoZ#M(psDP&h82~y1;&xdFlMh*#fa5qJ6}CDx<y-xpdY{67t(h*nrWxNrsW2>
zIsBvHL+dP(`9oIoN<4{ml;z9>iK-zU0d3QkvkOZnh6`(}WXO?qWLp=gr1sngXL0L9
zQ{?<4Xz6494tK+_1RqLSb&E2WBt*Qb{_(0$G<1%TTd);7hH3x#-OXnL^;KxQusY=&
zEk92UR6Vcg(^)^VJ1AuL)=x1SC)$l;rkHq#_pQ-;jqK|4pMWP!`mg)Q=dy}Rnd(1V
zGlvbbPGN4Zk`O|!pANCV4t>haO=6P_C|OZR+=B~QHOD}GAN_%HBZ1S`KVL8DW@O~#
zU2DF=!LeFxY4Gq$n-bICDQsjvuTwT;<MW#vSH$)W2Ft4&qAzqaFmUzfK_G-4AXsAE
z@J`gQj4CLPoSV-Qy~Q1px=EmpE$d|g!L2S<8EHFxmZqMw@sd6Yh)pC`Y48v)OSwjA
z-U=XGokch-m&+kjs$Zh~=Ra|FiD=tKl2gO41!*7xzccGV>f>ycC~+dX077wg69(uK
z*$KuvbY4C&r_ekce$pcboc=)}YzQ(|WNajAdrd`;2o?<sQ|A>ms##KZ85Ccn*J9h2
z4DcmLomT!{wutAdnue+DR4-^`wR`;+COS9L_{-Dp?z}b~`^XaeeO^(s7?04T+3Xa4
zWVcxb2S)5PgrJZUB$Nv$Awt?NhHRoLlpkZl^UjbyKlgJ|XuD8HP`rvWH{MHSaEzKB
z(3k{{IEpI2-_1_iziY=z!%Q;V+YjEhy02&~vD1$x<@tC{>D4Y?&BO>16mW!p=!3%=
zXi<oRY9?)Ytmt7J<Aty6p(9WMagmrOay=*N-}`B$U2E5tI-<Q@P@AJu_)-s0tTpqx
z_ls?JZ?}xz`hJq0SNEp<q@U_7xRx7@Ul~^v#MP2YS!{019xZ|uMwc6-b=5&8_dAD&
z<HC^5T<U%~@P{dUfSwu~)lYlR`yT1mKSl6PYYc{EJ$``wJ7eSk-(C?hS?q2dmPNof
zu3v4^0sx%V3yB7A_>zW))x9FMk6dai9c)ikKc-w?4J@-SW6`eFnU>so7Jt=UfQx4T
zfe?^CY{muu*dbbz*E)(o7ii?Qv&T_xM#HRMfH%=l5{$x)_uwvRzMP3Mhvh(YWA+X(
zVg5?4yW2(J1y>&7DO$+P;AMxIq_^BA%;b8RrtIw$4E(836BxMUKe(pGdg~zwOP}>l
zXu>96`NrCq1h4+4d*=qKCCsjL03>%{fMh<4sdn~Q*tx+jrzAm_@8<HIGtWq&Mb+ib
z`)=hQQ%5BOrZE1&Kl*`rdqL!ig5AGw<cY(iYuDK%VLLXSMK*hV#0Q*3Y=;g$iL){0
zVA9klFcV|WG0b^4<&J##sG)2Pk`%LQ_)6wzYS)e_#5tTHlu?EWe7WX^h(9IK-0Jy+
zji2L2T@!3$sIPgMmZ2cz7Us58diVx=K(!ha5XAGF{ukBDR-3zQ!+!MC6S)Nhf=`*D
zNp3-S{b!Uw7cc@JX^a{a50oaDW`rj&Cy){Go#+$9f7&faZE?FBbD=OSu4o^$Hk&mp
z5W4y$c5p=!5Y`_RVN$iT3spVOCNmxJ42tC{uXQ?oMYHbODF$=TI!JoWQJfGooxZo|
z-LKI|Beu{8#enO!a8R9_eT798)j1JC1c;?B3W?$_mbD9-ymwIg8u3ewFpu20YsBUg
z*gvCXsw=Pq%|l<Yov$0~u}sk~KV6i2LMoiI_M9%}|Fs}0yF{IF&<X2QWx)1GGNjF^
zH@VyjFwy4g<>(X17&j~);Ude}tb?igliq%%xyAhO&wtDWFm+%OMM%V&B0+o%FKTec
zpPx#iUYg&t{Ge&j`#eCl1?sNQlZ-UV#|uASf{&;?;%Hp<M4*`akTqk}L~MPkd<x%N
z0%ntQ=Q9^$OBr)N2xb3!3m@QzgMA0zN23a6n3?4}aW0o>O@KIXrSx@b`PoXh^4a+V
zQKyNNS@;!d=|fg;5#Drz$pfpzK=!^~>C+nxKb8ls!IW}$$GgpUcoDAp?*P%+n%730
zR{UL54th6yocaE_<gGb0F->c(rgY?6OC?g7zh|8xrYcs$QYJryiy_hVskB8O<wCYP
zcT<@#JnIX0o#`V1vY|r}H=)Fo8HQYY<-6)E50l!Iv4l~&ba+^ALa8ZGo$sxjxveJZ
zm7Ney3l=uyDtlux7<;rI$W@0yJxNCSzI&eTQAQAa_AJ|I-Nm~~Sn{#>1is)Vr!_f|
z+#?Wwr(lPpzE3g{S;*?Sj;VF^iGG|Z+!j!@TPw}4O9kBS!u`DQQ}QAv;X#`aa)KX$
zQvyh$2>;$fu!6<sOOiRlBUS1(v;@Vu8A;&kKZPn9pCylNij>qXIdr=v;ckwh^*~gn
zua;K#OGy8<KE+~L>hv*=63VnJIr!^wK(1;sXE?zskPFMWA(A8Zq<fkXJ?iTg(?f}g
z%I*>{T}q2OfiH4MJ6=1XkQ}|$2KB(;nU1W^`G=JD^~u=aU^!DT(tcuX%qGAk`K^DW
zq=>G^#W+mNcpv>j0AZTsM_z03JlAERb8{KPsKXGCQAoS&2dTfFI>`xjBOx~VOdA^d
zg_~|`2DPf{>I)@LJp3rZS5KvHK>L1i$5MoDrjH#A;U_=PP9hD88)Crhj49$O5Gxcp
zIv@RqVDZW$?k_(dBI!L~fY5JR5ApQ!^hBimQKr}eX4m{k0w+6JWwvc}1W$Te0=7YY
zv=D#4&^&kA%sGpNGSgUFIvh#-D3G|I7-1_<p~2GeGNuqmzfGqu<BTSo<U5l^7iMy}
z`Zq+W!;)w30%6)%sp}iHgY(m;kGDTAmLWXaC=O1@iaF683>mhOr!YASwY>wZx``9n
zb9qnyP0UFJbdui$64@s>6TfjL{3#sk(DgX&r5Xt4o3`3>T&A80)?d`*1gou@Lp+(I
zN#n+H*Z_lw#+)I1ZcNe(1Tt*Z`dv|G8_73DJEghW{L8Ys;sINm1e2vNXrw}|`2BdU
zDge13Do%|7c}~!&4Mb{FuC)CDlfpnC9B3{^@&(8wYOLv#&Q3o28APzZsDJp@#7=u7
z+Fd6VI+l_$mLm#OXABeVfKKj`sm+}&CgVXmK=ezPNlt!!U!^~LJ3iP{i;kL&)YEPx
zt^kRdp7w|BXzuMtR4BQm57Tleq5bhO3IbTaNUeUxl-`ex+dC7>wQAnRh|jz6DO?N&
z@IVY>hOp{^4D~Q^(<z>e{A|I~c2n{Rb61I1I!Z<rcM6n7khmSyBevi49GW(wRcmJh
zGD%Z-cnq)uD*8d*=NTW!e?2x22EONG&g=0f&tY{H0yz$oZOHpm79H`;Q4>9F_zK@%
z^U?r-uA2^esl0Vx3P+-hv@sjERsugYk_9(0OJQyVf^qQ7<|3PQ!Ox>;t0ErC35vu6
z3>_@clYLM#QG6Vf=^OMS-wN-?el2Nd3ANW@2GJ;75o}z7g^S-I@jeOJ#gDBJ7N^`B
zDr`A(By(_`B&y-tm@&sei|IafHfn&|Y?2kCzs6?DQ?z7=?b=QLLtjRB-R;w`%C@T*
zKACVGQ=!H$M|HRb_rNzBvqH<cLR5iVbo8l#wQz$bE&leYHXC1ICL4Ww<*_&m1Zsfz
zk~$)eEBiXaVubqbNCM7h7FIeMZK{5xmMs7CSc2(<+=6}_A+2?Ey=E~RXMHA^x>WC3
zfhn=fFThS~Ka+8E?m~9?tb2dRL@d*hnY_RguPrA84@dS;G6JiRgUcZBd_cm*?||%@
zdh}KRO~2=b&G+0^8fok9k?Z|rT`DV`gpt*d#8$(PH__ERnE?DVDX@%x8OSHqf)IIi
zV$NN%6oH$*ycd#pD=b1y{}sKPw-LpWGM67SduGy08WT16jv;@onj*FEj+)!iHV1<)
zolwHNi&&DI5joyZib_(b#}XF&#vcgL?RRvd&Dv7%r=Y{Vulor-yA+Sg8jm-4lc9+K
z#mSz5>qlcQV$aA%NF^TDF|^D~As$A!{$kk4LxPeFX`T~^-8&>T>n*VaLa7S7Ga&(z
zN*FW}Q8;I1Gi}cgk6^_$nMQA03&Mo3-Y4@Q)MBn6in4ABGzGn_^j=A<ytmya(SH-_
z?edE_GBk@kUJLQNsn(*X8cy&g3lB4~ZwTR0Ln$3L?pwp1l(sK>0uib+2TXs|f(a$V
zSN}?kX7j_s_%!AUm)HOrU=q1ix@^)_Y77OqdBGgN>y|w_#$rz20r@i)QslYk>rb+)
zdm%Xi!XmR(jPW8enueI3)?#jiZla$p2L!afhJT%}G1Uq~8`G<}E3C0HA0zV6qA;rW
z&x2A|S|GH%7ApIQDM?mouE@Q`yT(NHCU(-*d#dn&QWxFJyWos08z!NB5$%z}aJ{;?
zJ$u1`B1$Ya601wHBbX*^m^X5+$oo4lP7+|0z?4=50)bWu1THD%yEqi9rc4v>Xr}-Q
z!bp5!C;WTQ^G@7?gyN)JAI}oAKepn7n76&A4dRzXhgNP}B+VM0j$dxl5^{;sDF~8Q
z{gB+@hFA;grUCaO*q|YPtW4oR;0@-il?jq$e}25=Q}Recf)G1kK>Hd6`-{bS+DfY$
zo~K5lCU0o;E&N$ywXbcq-+AC6R6j<S*3Nm<;~=0<*{G;*!*HuwHW6iDWPW`sQp&R}
zsWU0h9&+0f65vnD-L36dab%mbQuz0>hxUZf0mMOt!$t1x7+-FjjWrRly|ly7Vu8Gm
zosAi0NODSaC#f8S$;O!6ZpYXEvti>9e!`z;q)o{9Z2avcr}x`ed{c%(MrfTWzWg)M
z>=&X$f9ITP9i_BFx@6qWiRjtnc*&PLP!R4ry7O}y@$-*O8)bheUJ5*qCsnU_8ueM`
zzT$0VpXP2!ZI|nP#;Ha8DykMQD#Clt#M5wSVTFJ|gG9y%DjX)>{j4)o5bH0)RVQ6y
zyTl}68gY1k&?nr=WKAV`6^)*wYZuF+R>!|hMyI<RYT6MK=$gcrp{h0wfD^JQjJ<Oy
z3GyuR23QecSP2P_*{YdET569h7q7_=IjRzhf+`|KQy-;iU+MUC1PN9>(tmPH3YEd4
zB5+!U46xUm;WR&X?)2g8aD0swF*2f`YibSz(i=d9q5|e&-WhmGy+LtOIZpnnY6xKV
zfQ#PpJ>%p@M3>KBe9XXM&eIyks?$72p*pVo7;krKZTcBY$E{hROU8#zBXO)u?gnrm
zI%Z9nF@4O&H)+)LTT8uD7FhC>tV3a}bO&YTG%Zj%Vjv4Cm@bY_e#ds%axdqxKMB0x
z%P*LlM#`62?i3M6{hPzVcwQzyY0O`lS9dSHkhe90tOLyga|nxw{S9cl<Vla`NvGb~
zQ0_92CVX#T{d#+*I>TjrsKT|O;~LTsO7(;$VT3FvFO-uy(Poq|Cmab6!NXlLV^6U*
zu@<BeZxYE1ah+dUsyCj&3xTX=E4oVTf1E~;?C{L__S&|<>F?W<N6M$(+*jKxp{swg
zYg0Nm9lebN-^q+(Zyu)_*Lz;W#{s>5Tt8w2k*(#Q1iC)#OWaNfnU~E<l#u<!lSkH`
z$wUUUHhdhTzm|$7%!udd?$&bNCX8%p`j73&SF*XA=kL(-OsmgWgAWd_7pdyY0xg`W
zt_QJ~jUUAMB0JXnuTXg&QDgL-H*r%<k;$G+CgU`IH}!UpXYG->(LUc#J~^huo3KXT
z2}4{L|EMSm_~9;^Ry`BJ*DsFIgyT<I;<T2wOA-;i%;tBR<^Zc2f1J!wtB?o!<K@PH
z%kiSu=Gy_Sn_6_@2+3^LfBT);n$OF_eDy`TjvH<>#f^3BBL(oQ8iJR{;kT=|U7hcL
zMdJojGy46Y#%ty5%CH95a$l;uZ5HU(X(lQY)z82kF2C5mD{mHI#SoC`&yTLnxDA<X
z*-9LIe_8+j-e=cm{caOC`+i#rOLDqvJ5=H2Zp#|`&_a^f$I?16Ao%QIz{mSOq;sY#
zWP<;GVErkNd&kB5u~l8I;<@L0hsgJFM+6WU<>7|xak<I6#Zoanv`l2Ev&IPWJQ2?-
z0zKRFxsNB-{J>NHyY*pBYF{c+U)?9chDEy}=Sgqj(1ly+AmZklJ~hMTW~kzyByA5)
z3IA1Zef8sk3lDmuli-yOecBl1R0%EW9v6QwBl6*G0tphlR!4)+rc`IM>1u0gmiNna
zcy;^Tv}M!k4XGO2h^~%UX@m~d$<B{xqcjbyd`~%6x=MK<VHmwz9{6-FMjYry<t#k>
zxnxCz6^o+(KvI8KbMNr;`)a2_UwS&X&1%zGS88!)%8>l@MKH3f&?ebBlo8p4%eE%J
z{Fk{u_ikA^%R=y_f0Q;nm2wR3zhUj5nLV|R2ldj0#49AS)$4r3f^}~l0tnA#5Fh_v
z({bK(yI3&qf>nR9U}+@TH-@4fRNdx{c^>snfr}~)DCNTnzfJQ&lz<PEw0tgu?Kxef
zd8?^uy~b2`rAM*t-@o>znZXIImwcel`R?y%t{y^7lV1*t*MY=NUrOi@>sh|4^9r*r
z-`3TZvf}-pch&2zGu7tM_4RXYH9bv+d?8n4zS>y16wT;qSq;at&g@4rMnPn(CePb<
zgm^m*#hFYVW+!HGjYUKMz+8oOI1?XoX9f|;?rvexA0OILzoC8OP2Nc#beQAT=k}xf
zKP;dJeA!p8_?~cxtM;4=wUR`3;fkMQk_WCH3p<ulI6E7mP1uK=AkR;fZT}XL27(6X
zuS_kXR3K`KpoH~sUg=Wtt;vsr0Ck|h`rGYk^!Jm;Q<sjkYO9}iArB&~r^1ULW1u)x
zUWZAhzY_Xq0jJ!<z3z%IhYup-NB^#c`T5bbsYA!*=`UJ44P=dXHTb%2oZKc`Nu;dR
zu5yeCOU!u8ZIzn!`k%xV9`7dB|80FO=V@y+p$fm*T?gxykB{lEG~RakyUl!m8GG8x
z@|q4EVAThKBtB7??v!1tdmZ{WltxT)t+<@FpH)ZC<j0)^?ZLyR$Cfe$D-%8m@AT&D
zcwbu+?UOmy`-fI1PT4v*^mOmP{XS$N%&cIj!A!_y<+Imref5yIu=ZuOA#T`CUnZ8?
zc%jOxg3b1P{~}ng2w!#kJc!Et+j<`nA%lGGMhvx7IuE*6QJ^smbz~zhrBHlLLQ_!$
zPEVHG4UM%1V}jSMz=DgT<EqCxtW~p`^UYH6)R<|u*LfKutEnNtk6MK|?-X3@p0LEh
z2$g6+Ha_X@Kl5t)H9syJPA!v}nOVN3<8!4XRWN9x3iEJz_8g6HdcV@S6#!9pdC3`Z
z7(OSPOk?F%C@EeSxFyM14~h6*lE04A69sWk`CWUOCG7O3$pxAq)7f(5x0@79-0A!g
z7DSiz41@oa#qmp`wG@vFZFQ@-Ah!|VTT_|NM<yCQZ8_723Ry7BWEnk<wR@~AHa8y(
zSj4vh>tF?>m3;=gFk#VW>RZp0+=Dt{)+Z`sTP#i8tLwbaWkJ&@*SF|(kGX;-9RF%t
zbmbh@mI?j5$x{yC`zRo?**^dsC3dK7uD%cNr%ppMu3R9w?nA;bU9@>28&tu#Rw5j4
z&E*Alxm}g9^|Zys=V4_f+ikb6@rYZ?iH2C9EK!NUfqrWWL*#5f+<)Y5wxY2$aRx6*
zgXe=kc|$`<D?ae%ztx$&ABjuqHZb{;E@<DzB*$6wWjc6oBK5rXQt@SRZoO!u+Uptn
z>R|`>`^yH;dXvT&3P_Z!1nsB$s$?bQRY%{u#pe8F)v%&~^W2i0d$w-o^`}kKPDh7_
znd*oOsr(H&!c%YYy!<&#Na#E5d*yE@1?#%cj{_pE7gMS7FP-XYPrK+ZDSuQgdEPqq
zW}xLt*$Ztd&~TJ15xDtrFubqw+S-uc6+L3^q0imN7}XP`2C}ir6P-wowHo$qhrid>
zkN0otEr5XZ2J_8X%MMeh*EBo0EK`x2oBMRBK7EHFX+V;=dN9OU+hJ}%L|%le#{6g;
zSZaD0MebuyPoJZ8@7akQW~Y0+ogPq;%t2tShV=|^frUtll6v5MVdHx(ccbZ<m`w+z
zT;i|&`KoxtYN{6K&vuQhKko+JWE&0(dvOPlb6bX|G9c+ghh}Fgd0mjmwy#enrn&pw
zE{(bQ6$Qdb)rozdv+~yyh6z-$0A`9J2`Lt%!(XPEV<m&){m#d0*=!iC^irLtSjd*W
zd+3jw<DC<!LMPkU$vU^!E3;W5y9%992N73~6UhuK1dzMKtyeVohWG3^e(M`&R5VTM
z*TeDl{cs%Gf!t&fWKABgy-P%a7J6G|Vf*K2*i3w_i=9AoVUL}@vB+!r^@um75v^en
z^WMtSEmL9Ki5t9MFnD1n>Xn7|k=+2|%D#rvOjLR6&BaB`lXujtnLb>KC8t(L3`<23
z_PYv%>1DWTY1!+*Y-?=%$mF3(+!s~#KASZMRh92#BuaB}Zk4Qk=>&-1KK~N(lu{Vd
z_x^5TAZw+~`j*W5(o5E?VV;P{;uud3SWZrbtO4X317&0?|F`UCwcZU*$_Pruf#{LH
z908yphuijOvoWGlYKb02;mhG>ZSOKZ_tJ9tL%rq1@bq_T?0_WjI@kFz=a-1p#+%GB
zrnFu>boHBO#}_Kgd27Mj(Rd9R!b3U^{fde}+)!s&-mI;BB~*&aY4VhA*XFx?b#vIx
zr<0TOgQK;F_c`g|c+8K$qP<-%*N>jfeexIfNF&89;VsR=y_8yZcX)B)8sg9S`++Q>
z)@b2Fq@?!zWF|qAgN^T1-nTE_&jYD5v@@X9jCuZ0?}l@c=bd((HML5&vwfNn1?$Wb
zA&Z&$%-hGO^VebL=1}x~t!3oo!qMe+VPRpiYNDYOn{XR_hh0}1IcNt*-SO+n9#TdR
z6J-Gmbq?G7+Ek`(-BR;MqJqxp_o#uj=|e?YPvf*nXEUQX5|%|JX0Z0dXnb^u%)%E>
z^$F<CS2cF*Z2Q6~OYqf*_NR5q0+wHt^D0UC8ojv#Bl}#rg@S4Uj*8#>4;3ngJyTV}
z9bUjf+t;t<HMbKUrTXxOZ*fYZhlvbt)Y0?wLSpLl;x@t3<=)87VXxn*a9P{?kcCjC
zMssZaak{t)dNEe}PUht*saiAtL#Wr5Tz1=G%eUvtW5&a~r2ZA3f5zn!r0c6IFV|=5
z>@GL6(b{(uEiy|HSj*QukAcBc=HBm>>?+oYqqKWI1W7kU;GvYOKY*)YE%BtXX3@Z@
zW()U8XWo9LPZ(=U&sU5?EtRY>>udMX4=>NzcON({YQMCnL9Tw)dj8m9hm3FjscAg3
z;&-*(&lA{68Xo-q{0|*E<OyBtfZ?W<y(%zw8nd;)Re12(7k0-z?Kq1Sc|P5h$69Fq
zC=|pFu+RL?vmkgf>q+RKOELe-VLkd)UFQqc+0#WN7cD?+X9;9=q`2`iDtOuKw1^b6
zba9nB*stHs_G%7LC!v;$)tcN#q07a_;6$zB7$;Sn3sevLcwKO2KO#N#Mnl+KcFXo&
zgzbmjIEy>ZkDsUpcxLAWFaMqWetbB(3{%Wd6hXNNxzLCf=&h4NF9?+EmOpYpf#)hA
z`8cKXd~^Dp?0U_z8cO%nduD5?ViC;{Q?@@!infvgQAuW!Z9%Md(s}t+F5KTwxg2fq
z(=9^c;oi)~;%?^YC5-HTiILT0YqMZ0c|7am$9VcC>-BoizQdMfi=+=>niBbqcnW5Z
zV0h-9F9r=mwtfe3fWNZrvsgnKGnXEBDx8wg8VOnuHZ*^RSXTFS&P)hD<T+#3FG^S1
z^pls(cYB@LZ%Cn2j{#~=W^d9WjEC@d_f=L+1~<P=lK-HbK%~@%#PS6d^3tU4g+s1l
zRJ@zyv|t1d-ZY79UKDrAN-;S^dY0y$%Re2<Hp`-m66Q}f9`93~J{)b;o5&NoMIHna
z4LY#4eE}e3c<V?t>=Wrp1NLg2)>!|gL2oIumn`L_w8r%Pstilksmp;BtVm;eT1y*c
zflG~g?@K;Ynk>PaJMqq`ajtL$8Ksj0)8v8oUy&5BXGaW|Nq<gwLi6N{iuc63D=;Rc
z6wEBLDKaYd-ILMn0e6>yW?DLH>oJw}!^$3Wipsa*_o1niV4n;6fu=86y!xMdw$<9R
z*|5taDz%#^I)L67Z<G1+U4-><2mbz7V<=gxDbsE>ZzcfunVY>plzBtMh5*rH()4-)
zc~$=So(-cJGgJEd&Dfm+YqdF2(D5F={Gn=5rUdQhiCF1oxwtv1owy2ZUo$hKP9CO<
zj2=qLEHRq9`GqPduo-dRQt0fspBGReS;>P{?ACLI&W3UcF}AJP{CcjOJF|F-VuG~k
z0UNt-X&=C~h3)y@TDt)A_YX8|_R!Fx`aK~DV}6B1AA1;&=H@V*L^H}m-2@DLy+p{w
z)Wl_O<I-%&>1UzytC77-CyoIJDshjBEJ;?H9{5r@xP^m5!<ba#4>~dTz15vJIE<jC
z74ht;4e+25_l!QX5)RcyjR*#iGlUQz_SdadC|Sit(*66)e9!KLK3El)K$+UI>J5?5
zKnv$>N0vQlJjK5$GX+SHG5VG{n%4NAJ(LKXvc~ilefm0L?G>VNjd}&tCK&b7YE<Hy
zb@k&7mJc~DQgkivzZa|}g@~_QZCwA$pRiu3{U9-yz4vR0v)KDMk2CNMk9>~uB4Cfy
z&$CmZt~;&wEGLc`<P~>$v4?1;Lg$lqtiCb7Ki=1AwZX<6<4A2TET!ntoR<dTO>Tg|
zxA~8}&H6`GcCNyNdDqxJJHD}da4f<%hV-YT`FE+sjQ}q*p%Fqi(>r%0lP$m**`@^3
zV-7|k%*LS&>KSrZ&b23G#i_lOqrsBVtc~TP@o&HVokKFmjv-GV0~zA|X|Pa|*kDB0
znfiIn0t;hWFJp%><p3F1V>Y}v)4~2R#cbe7Th(f)_9TyJDDQ*R!5s!9xLcl$7=`=Y
z4EC@IqJX=>Q_iI2K>1!a>T0?6oUeqXvD?`VY<Gp|WCA82q^iEH_oF_{BAPr^J~Pi}
zBrjV#>G8|8JsX((X|1=YQnioB<0WjWC_00JpCmTHmU>Ri`DB|bStRfJ^alq~mj+m=
zkcK4@HPYN>@Yev+i4`4uB_49ouTn8<W<Jjy5Jaee=JIeu`8xhzo4Bq5-CHCRHvWVW
z20zx{l!O`fNeqdl$(>A_RW)&xDM}1Ir=os${>q;w?j&P5f4D{M<1~C016M0En->>R
zXDT19DhY^0BAcOr!W5#^I%9|Xm%t0;$P@2)WxvJ&_!EPsv;i!~9v8!>x=f3pp`jII
zyu9$o(IMqB;ZiUQV@9AoA#O#l{|TJgM=m@C-O?=xwL9}iWP7teNMJ3CONqB$2zZeN
z+#mnK!6g4+5^@~_F_4mK5hK~>Qh#Nah@xJ>-VOW4qVk~iMTw<HfBBOg*)po3m<r@K
zSy)zAk_iXUD}9^@pgv#KB1Bi**JwvjiNdoM#W?n+<WK%sN`9eMdD%4yVewxTF`nJG
z3!V*)8+VnKWdW&?z$#T-6{2KaX-NLV3W4o82JuSVQeil!002R|Vtjj{Xv~@PbqU8P
zFf8t&oNClzafh=(NW;eP;;A1v9u*W1%#Pc=w#kVm?i#FdUqM+;U%TM=VMiMGG_nA!
zSG~Wpd_`M^%wK>b%>KfjQ2kH+2!MZ3+99reA28#>IUx?*;tiLP)~?705$gVd_5Gv*
z&YL2<#-P=SjeEU4^wZQdge|UYqKERQp}aPWI931e+&8KfoRWT~5@&kiLPzrQ*Cblc
z(!UAqKww^uGEQg!eqqCF^Xc~E1+nH&8b^S45TyYVhLyTh60UQAY5=tgMu-FfQU0PK
zlS#GzyVgv7VX$zYMz_f{nVl{}&!|L;_V56iFJVkM`E)V|pn#KoQ)P$%%4e(F2C|YU
zJIx+;=tqp@#n>1NGz9wFbmiP5MkR$YWZiAv;f~oF1KrRiArc~oW{MFp$E{Yxi$>;E
z2-jT!mc80~D{8p;d+3y5SE6u=(D1yM2(HM6UjwIMPfVf>JS}%x8XH$f2=v6}{=X1a
z_w1fF@HiRTpm8C*0^z&Db%8;UZ2Z?|()Itt0@&TqiTc`091rVXAGAaxKvcWYFhXWE
zXA1w5rKGPv<0(E|L>Oxq<MiCh(0@*}!pb9ZSULr$U~5Ea`*R*=f8Nv=wk^IV?g*J!
zf>MKE7E$u(Lu)fzE@Y_H-zgIf#r>VX$p6Bu)_;YI>Hm!{1SfS~bwbp~Ig*^bNQSW{
zaQq_I<h<=z88Y*<B$c|YxXiWvX&RiigP&)LHa&BF{nh&UfEs32mW<CQ(=c=Pfs9(a
z=CsuJlj=GYQH2QNe(E~fJvnTE`!d1jaVM3zm7Bv?*-%!8Wh-n+&b!P$l|0PiFmG?*
z{0(dG%j5!9q-r#w<dGmRDnF0ruTZqM!+O&EV8+2*eb8XACfC-v%s0m?ETkYe(lxDm
z=+uCY@hiy)yyL{#b6ZnWI7~u<>JvL&^-45Oa*G-^q`%Pom}y&*G5LTm(Oj7;KkWJ%
z9Rx3-FA9zh-PrnR25{ZM==h_iuRk1#Jdfn)0e(TVv1Mx>udN4SXDb5`&F{g3%e-mX
zFg?i~jwE)HfiZ>BjGV+gMb8XF1U8#ltA46<T*OLeF*<36Zyol1V<IgctIO6X$OwBW
zxbrup*18?Lt;yPU<8|1IDSsBN*dg-%elYuqp)_YSohhctJH=Z4VD^zjHJj<nw<c*g
zzXY5yxj_WzQ!Ru8Q~Hgn$$Wl-L>80T3(~vjcYkzlcdb{{+n&d<6{}D}dQgx<j~uVr
z2S@9$0bk?m5tEu&Ej&)nX*LW{@&O0<HQD~ZLn8Q92naa-Km1e}R{cAX0tS>L|M$%d
za7UTd!gwrVPwqnN@3U(_ZO2zRI1GX}YJv@j2MXoprQRQh?$*=hxg&sbcoyBpk^Lcf
zhesA6!8kyTP<;&z!(Waq=gn_XK%g)iSM~d+Ow&Qo>otdEA;G-BH7%cTIcMy!fm*~4
z07;j@V3)+BBTE7!6yO_o?X>t4kf4cFCX_V=lz5cXzm1U_BAGxm*nC)k>b+)UO@n)E
z=}>{&YA!Qy;p&-~1WeunXI9_kWlI9&sa@j^YLnXDctu}Qc^v?K34vRHEPs;5Je%j=
zF^n7AD4_jRV%C)EoJDAaf?Iz~68;Arlp}}JUjp8J*s}pN-9SQJHVy#2Zk@xyz&K~x
z<T^gcw*#Cz>Tx?id87?Il%ub6ig{D27&mZ@ii*lp=?JR<P%64A8KAQ9^jaJ0vVPI3
z3BuA}er+$5I!xqX5&I!iC=>w@*TG4gw8+;aeC^57%1Y?1_-#%i<R>sBh^&otp^t!E
zASevA6o5ZMI<D>&sS<ZU-AwqVnRXX*>N>;!y-@OT)2g<s3eGS3F+y<lBvafjyCGjp
z{yT*s(K=9~vyHOAKC-H?-U=YPxA*D<uct(f^HqyZ-izBz-VbQ3dc267{d&m;>H^xW
ztdx7qS&|ru>JND@`0!_>^Pwj@{${3R(&B%G7BbwUSzBArB@6rPKuj}6^{g;PFQ{-(
zUQYa^UZ7q1TwSllfQB=tjP7Q4@VzcB!Y2_80q&F?6`z+b5i;+KNS=k`#a|(S7#RqZ
zke|v~^xk7MPEN%6eHCRU5FrO&Yx;d<m}kN2PeWnT_nhM5&f+Fk3?$%9ybe7>?sQ;q
z9UYb(9a-RwX15-v(5Mv48^ye8(*Jiz1RnvKNUsMD;j4TRaEQhN{^9@r`~QCm1>Ulr
z6&e(3qv7VWJmlSRTqbFW3XDHrOu*a$=~bjvHii?M2)2HA3NsfLyaodQfOAHGWd{&7
z{!Mc;o&T0GbZT8U>*>6f`Z{9b{*yQptRWnw&s#9v%QnZElmv<+r+*dZ8jM!aM0@$$
zOC=d4VtBEMorVw02axoC+Uys*KxxaUyLap#X$4*#U7&*h^wix{ES-VEA?Jp|0x$B#
zQ?J9E9Ef}dN-M6{OeR_3(j^u)-~2s8`yQaA1(B2fcdFiUH<RMRUxH1C6CX$x1!zwF
zh3kN`6Pi{|*_kfEe)z;pUtinH(dE<v{cjQgBLqE-1E?1`{$B%Qg9MP5BeB!3o^B2J
zb;EuuwtHqsfgbPAB*(~eqHeUa*rQ1(N{=N!YG#_Gxoc)Ju2yAJWKhEnwD0{mpqVtN
z^RROKmw&z~)0iG7Y1v(CCe5-TU9tKP2LZA@i35@R9#eXG<e#}Up3>Z5GYkSz`m)Tv
zH2m76e4tfEuz-LbIkAV1$%Bre7|+Pi@a;|2+M14aJ&B9P(L8Ls7#?&s@zU&Z{kdg{
ziP%)3!e^`9%j^A_QvC-O0V`x!I&E4+OCdi6p&)>_)5JE45ctbKUys{Ve=@P1F+A8C
ze8>=Tf2Wd`?cveNxV@lEc)wk|iwft(b<wPn_PURTN#Jr%pG*&0<GAVv*mhC=zV-)-
zm3IQEYkVZc(lGHM5<K$xp{c_mfr;_lMf+)~$2IHd^u|L_|Mg}VAJ&zBF7urMW34}c
zCdifmQ?KARJalQLb3%?`W;9Ey)!dL36^s&2R=rx#YSJ{%G07PEmV#FH?q(FZ-D~Z+
z9jXQp;BNodcIAvF6^Kix`>co$_vzuX$fC|!M1=eIi5%WvEymqfZ!5S?B7QLT^fT*=
zM;AyYyNhL6BC&D?n*6|2^QT1a)Gb@WuvjB3Jxe0hPp!uG;_N$h3mzZ()ESRngY^Mj
zV<*bu*F@D_q+@)2;GHJ=I#-wagT@-<uvtQ#;in`52$cUSu1Y{k`d3|TJ#$^P2y)%u
zbrY~kYiMA2k%N;4S+yS>LQ_k7K5b$_PmydtqIUR)o%H7T2wzzgQx|pIRe;wRTnlHU
zWOAm?8>wX!YWHHEWF6^w`hf&b+ej|lQSa)af~{0BV`cmzs%~l864wEki~pO7ajp-y
zR(j|oP5)X-?W=|Q;5;)2YRu3XKX%#+a7!v@HnoXHXr0le5@4$Z?!9qPhcCVvNmBZN
z!E2m0=}>BI9S@FMsxVv8zgBgg#RnF`2w$}e;DNy0kM$U(5f(V5x4~}}MB{7YJ~h_O
z0!|q?E<#3l<gNKY+D^=jB&I}6AoWS|knEQ9^s9WuERKT!$zp!TFJOrPl2$;z;?h~~
z*BLu^`R8jq;}I){G^1#QLtq=Z*cmYes0`}xBHo(SWyWIdqo!Oej`%@r_{Kgdd3&(_
zX`}eV#2%FxmG?d5YB#TmpnVD$^}VmX?3!%}xcFY6H2L3o7(u_N!pq~0Kib(<q7c91
zva7X1`{*RcZ9LmtNLPmw+oKPaBCciOr7uaCZZy5BA)Wpfv1WGVYzP9e0iQcSxGbo}
z<(jpV=TBpg(h&|Sf*Qzv{ULHdt(hO8C$|)D;7$25=5I;em-n5m!+L^iOI-E_nJZY{
zK2E=G(WGI9R1JU1*Gwt+B=aniVT}44%3eQUe@huZ`7t}t0{!Pm665bZWzjUt{m*~@
z?C8RY%t%mI$U3U)9apz-X@7A_g;q);l8{x%6`sQ^zt(r5<MsNVy9MQus58KH>=Ors
zv3>7<wl7}~y3i#~)wH*OGbt^E;w(>X)*Yo*S|4EFpU|RCDiHA<_VO2BM^qoUw^nXN
zdUbc_dT*Qi+Ds2BeVDI=>7zvV5kWg%^R&ITR~+!B$-B8DyZ9xr?on>IdZa%A&L-1Y
z+K+!1xBc$(hn3tL$$TEt_UnDr!T-^CgH-t^pv4b5kL~XL7>3-%+8A(Zu3oX^Pf7Vc
zT--U4Oy+SS?(H1LcR#Us>H_J`Sj7gnklhdp!J?L}gX~|}2vYN;V{@@m2MgGUqpgcD
z!kS5^i6hr+ro@8Qe6P5H(B?!`1wxpdys6W_T}M8Vs|~!!i#rIWZ|OU7p*_V!rj3YR
z3jMhvQm}ioKYylFoMYExDX|V__Bho*snS1H<#Y=-q;P?STF3Xf`V>bUCx#H=zJ$_Q
zSoW9A6Xp$BIjeGh(UuGtQxfnJ-f|-<RnTI*lPx_$7qSkya=vT{4s%*wne^`E0}RSn
zVn@-P3u}*$!v7C@?;X|D_q`3Gd=LQvl_p(91u0UcSCOK0>7n;tq!UU+no>oi3!(Rb
zKmh3iO7EeDCellQ&<T*tjo;7roq2z2&8#(R&7X7s5tH0=?>T3mz4v+cbM{UeeGphP
zF+dtod92);v#|fnA(b97Wf>rK^+<K#^-p8@@7fGernO{@%X`(eq8scMmW2USze1Q3
zFmeh~^h5j(5uOLCra}j!f|NY9R2%HUe`qa6x{_3*Y{5v1O_ZXW_$!7j#qfm~Nt@ak
zb^(HSQDKEZCe54|^Gz7jX2IZ?-Z#@^Z_sLlMCsqZC(~Ddcx<R<%#HZ9K+>UkpC8F|
zqs)YlLCp0_M`{wK2GvFBKQdg*jYtZr1+Syze32)F1jWjLpQD+BNm*p{efFi#V8dJw
zMfK#^M&PlUA~1sd@-bhnhc?O|rN=z6Z4`OMWNf}syoC74L&!cT=rthhm0{TH)!XA$
z#~kN}cseTbgh2K&Km&UBdIfY<JV|UNIcl)qdi=8i6=;%PXCZV=t?P9kJ9jJ5=3P3x
zs(2$S=T!9;N30r9dL~=#z>%b7;ga_D^kt5<V+KEFhC-=zb0hZScE&YX8+@x#Z2n+C
z`UO0i?eE369^Z;S$uHI)F%i1PB{wB8_jJqFi%#vwYbBmNiFWvf&|%$^_9XX|AJkl|
zS!_N*J=Hc9InhZ^GMyvyfM!vz+};3;2#fFP`idw(oAq`5aDtpT`}wS#CDSMR2Y(fx
z2Go#;Qth1GR0Y*9!xw?DNH+$K9NL&XB>f%zh*+bJ8z`{N@q5Xs+orZRlU|Z_B?LxQ
zsg*7Oxpr7w?c+tSqDBWIi=u)e8IiR2#LLddf~!&~>f{aekiNUDVhgSN<y%zJgTU$m
z4)YV}&_4d{+O$_gVwd9ZWH7zlw21V6+|TdXmN&WH|L9eGLf`ONHC4QjX}T2xN6-B%
z!~RSo^RD#;HY6{!6$y&D7hsif>3zAM`tBzn-4n=k(ZLdQFFCp1S-Xip#^@0d6yL|s
zb8v&=)qk-7!{*sVbAs#uzq0GH1%SSMNBYnotmxBqlR*5Xo37Wj>jX5wA#wsv<!?b$
zg!c%;-^x7!Qzse;6McDaW|q^jL{3IPqW~;R8n*F<=*@TI%bJ*-gY0mknAggvXI}+h
z4>0{HyEKL=74sIjt}eGQ3Oh&LI|=*c8h+Zdbx&fLLDawWfq>a9R#%RKGCrqA;j?TL
zsHkyNypFH((6yPnIxiXNN@<$anggmW%%euuS3+x>0h0F>pynfLholp(5$N0i>_+kZ
zCG1ssasHKeLW?(?^(&t#NfbB7>rlPA%4e1oAGN{Zy)ETlm%R4i2j;s8R7Muxt=B9&
z)L;31OxyB5_wxK5T6iC@QdUMCvD+O~r;1y~)neH<?<i>IO6h*5uHmv==-gVkRmHi`
zHsa@=kmFK1?ZlZ`A@|xwf*Zp~OJFXE*9Alg#`EO{*CX}|KYBo=LZ8Mazy>|)JNepT
z(~eDTwi3@}0$>?zn~cX=&H*EKLG0FN@In3le%0>Fs3n;B_H52m)EzsHRl3z|XTv+G
zt!&1Sa);qJ%hJTGE1yr!ODG@LGSeOc<IT5=_hEEy_lopH$)VF;I2GE!MI>XM6h@8^
zro}OTIfpi(((<eCrKhrZXio0c$7}GnGJHMva6eg4cHyY$Okw_f*oJL5;%F=1?#z5#
z&rG`ww5mys7Y(^D%KXUD-oUf@-l)Y?)bhrIBiX{KTU2`AWxzZ0)t^?E?@5KRC{x;D
z*aTg@-34gc!H<pfl6a#$xvnGhBA;y6D}A~<M-hD(K}5g-gog==ITY+|X=jk-egoX>
zN3vj1L;>;TB;lLM5><K1{7Av88LAS0L7|C)RL^Nm$tVYZ^T{E1ld#qAAktEydikJw
zG9rQ=F1%}S{qu$M8zXW?La^vy*ycd;x9<;Ay-|-@q`umA9R1{C)W2cp^_t@8l%r|U
zjsaD=<o(rD2x*aVy*$A?4?HfYDLd8*7Pj?IdllSrdqDoAr(gBJUOzur|GRK;%+qJC
zaYCph$4>EWqq2YRF$D@+M=;IJ+ww7}(gLZ?@5K6xYAd5tS6PS|1=C3eqiTp#rQxqS
znwBKXS%LpM=HBOL&gQ6nE?}X_;-u%*U+A(#k{FI9c^|nMN>Sgb%&~KN7K)V>)dB0*
z16&NCtP8=r2X9{HLf`T7O-q=2Pk*f);_nhHLG&Jk**@NSk_w}UExBXWQT_yUsY(of
zWE8n_>zm|1LsD<l>Yb-F_z)95$_WD#>jw=g2cPE%2#CS~t3Z&K&D=fILfjH+g{;>D
zA8Ho%T$FdY%0F^rrd)fgXXT~o5!Yf|xS70zdZYVtv|pq=xK17{KRQba-~r}3cp-Q?
z=Y-9iI3l&WG6~w1rt4QT_+mnv%)V8AG^!h6v~;R?Fu8qyun!hWz$RE>R=2{H8ctoM
z?eU#D=&M{&2I|wo>!XOix{P1WivY+{02GEH;C%0kPzf!=_Ew8bOMEh#=Z+8PBuck%
zJyG`GC6nG09FUW}Ghf|Xv;zBRTj{)==>1lT0MO7!Pjc(;_OrCOYz_idz&U|>Fa%%P
zdVaKrte$=|Cigm4sNTz!^~o?WT@8w85WC%bNT;-5mr4kAK3d~Vx|8C(HT8-Q(e9({
z#tNpYG9JxHS?B-^H&EyGn(Vn}%N4Ief?)-9x;zCrL(ut<mbA$~HR@u+Je-HpolIe=
z8@dM#V8W;>v$1a7HZQ;zoVDYoiz*c1Z3ze5tp*^A;X47PZe-A`{<kW0L(2^9;EJp?
z7hia)g)4Yf67qH>C_?N52NTVp0rnr791T_gx(kxX7a5ukxX7;O15O=lo&a0p?16LN
z*4~5mz1|9a-^Z!zFEoK3WL!(L@=rRYUkmGZ)9(7#L8;s*%KmL*)}qesYyM#`f)RLu
z`oA|5%?eis-o(^22WpEh27$t&7hl~#uQmNxosj!A@S`{QG4z_EZL`Xx0v{K~C-s<-
zeJ1eW2-ty)@EDsj5cC;;hsg9ty4PJnR$4U3n7ux?kJl6#1Ovk<#`jHGb7-4pLiAZ1
zJ8ZRLde%bpBF<A0s*$w-_<D`uQNUb?&7^FH_uO5hN~liH>i2!{0U>Ae@ufkQ5z89B
zg@ZR7m1ZBJIu4B9_ZyDZcRDYMzFJQ#5&;|-*Br|m1U9bRSNtpjtjU?pQz2fO25(kz
z4jbm}155>xfj92OSsiy61T^<V13vvZ`1(1RjgVl2mJ`5Zh}x%CJq)+dUoBi|?>*$M
zTw^?x>}0xU__ICIV1YyJ@^?wHOEpDQ$Z8|=bs%-T&Hw=c>5H$PeATsvyR|ie*)107
z4-g^!<*md)ld(&ZfkEz3>3#MQs>E^6QNdi(;`faZdVc>r$!OrCnc3+68O{^<^Jhol
zhMJ&uw?Tt)%kMPq6E2}jOQjl*d5UX5ns-1fW#!x_vn@th^n4in0lzvUDU(W70%e?S
z<nuvQfU=<cTbh0-ZTK@4p-=}lg^Dl8@uY2^n}8+8gChh6&-Y}0HHQM|0yW+VkX4Ks
zB01@NCM?WDjZ%x5`t|siBD=~R4W(kMP{<VSkr^u^VLQkv4cq?KWaU!o+&b!;W_lnm
zXq5I*ZAaUC0)o}3ZLcLyDuTY55D8ujD?P|h!$cV`=I)g7c5XwDwnJZB)|7!dx3-2m
z)A`3-6gnQ&%dWi=KDJ^t>Q!~Wgq(LR1a)DMrHbhQ(!XQ}=IARDyc6O`s?9o|xT|6l
zM#mIgnJwj)T#zku+lxEDo7S^UW{Ms9p20S%Ni%&T7p=x>-Z0kxK40&h{%wNnW;{xk
zZ|S9;4Wj2V)X~3FUTY}zh}(!g6QfW_C?<JsZ7=Qk@s-F{T!VPM0%G=kzM@9bg4`_t
zQvnD(1fO2d=N<}_Bn2H3*JpYx*qBJQRPjqgaa2>m&n>Jey2M#c`P3vHmnn(TeJx2j
zFh9|druUW(=jCsKU&hi$tLHAF**3%TQsPZtf}dKkH5k*m1kyfo^9%XEJR-^y^FVC~
zp6QG{kHeiWLs^;5Wy>bU=2GE$d;&ecM&>L%O#{aonof3A_@S!z80c)Dx4^tf7*S6j
zuf(DgP>I8V(rB^*a(3&Yz$zmcl~KCE4UMN%Yyit)4F=B~p(MArvVZ%>Elx;4Hty@I
zj>0T(1ac`<OW(Xh0)W&%<M*k`zut(Xt!~-je3$z*q(yUD<6;Nzty_5s+dXe7v3-b$
zb%q8~9Og8?ow~vqoP_*>G%xE#A-EUqvmk936qr}3{;tu<J6fU7PEl=*T%G0(o~H|8
z{1E?r{&d2t5m}1E)3ZPq6m#Cf^JL%K1hNW$pBYX^;V`bW`9WZ8$h)6ca&LgMXjz8x
zG9jY!{Ky6gcx$CL#4y@~k$)0iTZ2|DtaUBMo3LkPv-U$yDKgK4UOPEUgL0NX+L`6^
z3&~QBKbh=e=W=p4tP4~zSkZD&DY_c9)?m|9IA7h{`v}3J<D+<u9y=X$A3T@|Y?fwS
zB?mu+oG<S=v^%WyjrU~;NuT_AQXUdEp?)~NJC<xSzG~U<3{<VelPVIhYUG5&?k|%p
zE19gzoFAJAxep$TI9hGcSD2peuDs%bv)JEn{iNdW-MNi3Iq$H7C4!1QRLbmE-Xo4u
zjL!>#h>@ElOpr+>s=6Pl!t4Ov09ZPL^B0f9S+SS(M;Q@&klzVsE$&FM;GJHaqajz0
z$LF1ANQXjZGi1)*u3B?(uM{NU!^yk6_@GRm_nYeg?N>LWvxJ@5cb;4%9$j9iI_Gs!
zxgmn8))p!#lDojLK_gBEDB-^L4i^0<nL={T6kBg_=j~)eSGQ4U+-booH-nSII<~K0
z2K1p?R{+^}xgb)3ApP8{x7I_KGWqU=)Bd!p@?@G!$ng#5Cr_CpIdKEog0?f`d>-|k
z!nz?PX+5LE6f-aEdc~zE`N-h33H&BmyoBe>Cfzd=FHv1r!=nNXgZ-@5U;uEk!Ut+T
ziL_m84uV{AU@e{75Si5H>cx4Wu;kjiL*uXC>I=Zh)T@?^%+8rmw7x#atyPXZ<o2G~
zQf>^pTe}wF`7{P_lM_m_VDhV9sHT&cK!*9z>^~k2IPes2@xXVRZFPnc8x|Lymc|2~
zris@9mqPXP0jJu(a}vnt1}v8Cm)BglD;&(Cl3wvXBho6pKN{V%F3Tuo2TRXyp+);E
z283`_k8!CuMZ~7K1)nouqIC$4{94e_iQk4~&{bp`BsKQBdi@~kn9XOTz1=J=scS%1
z`hVcU#hP`#I1aMlee)^#Q(WAd?6SV(MUTZ{*D(!nhJw-FoPfY4ZrKko^-H5HsIUky
ztSB<<(8XTg8+B0BdLBA!zjvY}gL4TyQTCxj2|>YQRoqDHXG@fWslqlZ(87JeAqgOZ
z%BauwbDgMHehf%KsEqIA(NoydHP2r*bZ-VxiyBh(4*fo*(=k_Hn#<?jZUf}N%T4Gd
z<{79ANy_SN<H+k8amaLjJ(d#Wt%J$ad6kxy<sK2ATgm`~^ttKKBD(C83|#zcwfF3Q
zr&k6?nr62UBMlNp7}Ks1e0d%?a7{LC8Kz!HNo@sxt)S;ypum4$0ZQ(lKasFucZ?*b
zmad&Y9e_sY#g5v(0E%|-us^$aH{qBwt+<3bJ-t-Rh=}FQn85V2LgGuM7BAaja8de-
z0SuCX^T^@3Jcy~!8(k~yLSGB|lU9`Vv+ItH3h4mA%bWDy@gKW$4OU7kL)G|-t=7VY
zep87oz|(F}x$1XbmQ^w@#vd@r)Ih>@z!Q)kOcf7LEV#*7V?cZh&c-N_`4nYBpBwa+
z)LX}0Wh07BG2wA?EIis-fd1*gh^x3wyaDBH2k4E7?BEl~;>Y>?kG1OB9PGya=Sq2G
z9&<gpW_23UY1D_Kq-tLjrH>mbMbwK`TB!N!124d(Pk@Y^>MV^o->RwI$i*v$Sc}oz
zT)puAlc%e7_tWv>gQ~1q*)}F~7P_yHudm-qv)%P%@_M2o<|^cDW~^rsdt?jh(xUqs
z%<(N26L@eyVQCeNcQ07+R3N~B_P4Ap;@wq`=i3Nh35KGoH?$kGd*IdNfuj1%eJP_(
z9pN~5^4F@#40LtSL9eJrYp-!xrPRe7ty(16=k!Xuz2pFy{;u+^4Hae;=?(x_paUEi
z%{6YpI18(h8kCyepE=@%UPlZz)2#-b>z$%e5);J-FiwR$-UE7G;5=P}W%cBX*Z2D+
z4X5ktB=P82z!F37&iUHUE!*w#Wy1<_eH^=)OI6g1gvY}tIGf{73*^HwhY#!39Y2~V
za+^{Bb}(I|6{N661X}{$%Z=<agOu)Kg?>2&BO@c24Dlc7Qe12B{4W*&>_<2tLwV1J
z8dO9cj5KY^v{^rP!bJtB9hmD;@`qtW;-(&&9d7pfR2X3o5-H=r9wvXELOB?_*>$oW
zoHCoc=_2<AVJc?_OSEdp`>(4^)#|@o4^(C{Tppxo*Q1)QiLi-Z7uDKA2N0Kn;<;fI
zO(h0ZdlLaGbyI^~I~6f^kIpYnTuE=t*CLXsof15Q4|?|{>2_w9x3-^Qwv}tE$>VX7
z@a?3nbkzWOd=ZrB6%UqXg-Gsp_`50SY`LR4w%q?<3GeCW98wY#Q#Tx6f1|69D)t5w
zTCjSK^PXu=tSA(2(Z<oGnvPPub<YlR$2Dff4jZM-+6sT;KK4BUo0w{Q(|8KS9X^b|
z>MhdyImKURf3XODI8xP=vtWowy`Y)(YLYATBbpDYXkWON{P^hn8bK01%EI{p*y<4W
z@AdA35lmJSRE{pXJ}BFlpQW(w_aD8gF6U6K7mXv4bQ31^iI$`GC@I$D^gJe4O`Xo)
zpA+Rhn1%*|eu0^-qHXV-x5iZ<yTlWJ4Rpyu8LhYUM<h1rH@5osd*4WX!{iT7uR(zz
z7CzxTflhMI54ovX+<}W(0$8A|bFJJvs!LMenSj&y5w*{8L!hhMR&RMtoG*(vzxXA9
zAL2K}Ngw{CLDqpX_ptzYQa!BjTu5AU*eEk1y|?fq8TSC&NlQOLHs8bA$cr?oO-A=F
zexPiqW(eM6RYYKgXU`?ctb<<P0$jTaTS4icpg2nc0(TDlo^}Pf7`$qBI+$T!>U%G&
z%Il0=v;9%{@%PS*+4t;bfiw>RA6EcxeoMF|(C@?exy*vTUXvB~+XDhsM0BZuxdJW@
z0iY@T_3k0C)%yF_|M*C`puyof;k%us7D9qgH24SW42f-rqD5ppR|{?d-s33+fvjGb
z+rk+S(Bvy25e@fg7pF!4cnX{uX7sS4Yv{48?f$|wf*w*lQ3ro%TK_+C93BGiF~Vx7
z_0S_Mxc_AWO|nEBg}g^|)bdNy{6)ZFm9@i<j;t9+OnAQg%Vee}WrOy@Q8yCkrl&{d
zUL<@Ip>`(@5)#QXmz4xsGLfr{0V3mU7EkZSggKTEF_eYUD7FpH?|G)Z%#-^u`U-d$
z8GaB($T+|BR*!9zKmT|`Pq|$=wH51^l{bbD?~h#b!UFq-M%h|{*ET#8$KmQWVc37J
z9$-9=lmIyM9R)yZB9KM*Mgfl~))PKK^a{L$e84hYX<-n+3ujN`UpV{h#hdS4TTGE4
zLrMINn;O7F-&x{^{oTXplNjEDUDR^gx|#IhAFeo2Y&oNAW9BL)z6p+Wp!HF_gD;z)
zu=1hPT8+QGl@K)*w7u5Pi`{Q&yV?w?3thyadCd&bYu%L%*!0S|?=}}hqwDk^=Pv3a
zW!$%j1Zgv0wn6<)epw3^$*5_(!|#J=0HFq=r!?ixik?v<lg%|t-~4N2yf?#D=y;kj
zi7CyE2e8WE^~mmE^WLAyg?pEa!=I%}%bM0>D6`H0OXqg*b1jk;f?Pk07pK2+z;6Mw
zH{40+@N#9C9Q$<mnUjO#Ty@Y?+<btYdd9&d@|Y)<s@T<M)ZcD*p$UgBg0dbz$mLi#
ztL0U$Znl{n(i9E+Q^oqtKyf(usA!V}2sppX1<+_<gc51QyzOF?c%=@k=)QV(g+m=3
zoj*MsV+}sflabl46y$B~K%s-NrSV06zw6zwy;Q@kK&!?<$Lum)Z|8~;BhW(jAAs;h
zk>X|l-NVCwf)Ly6g_+KP%hYmp)y-|<EL6H$E3#;6Cy++VEG_d(9z%S?%&Zo(-qy7K
zJuhYM0JU8bBfMqZ1V-*W)$jo10w`07?{be{Tzt=)sN9*5leq4z%e{=UsoGj!rWUW!
zQI)vt#dxXXIfeDiH1N>#3ElOqw~iO>6~wGTxo+m}FM{TK95yr%ROY~&Dg2F~D|8(O
za@?hj%_9cbtn8Vdz4^(7(L*v$mY&O{&$r#aZ=O^J?!Io^j>vG$m>xSq7`f&LP_fY5
zieSN<YU`?Z|IXg7q?DSR6K%I-xndH;Addb4f^@Q4IZxSuxi(ZL&3I`Q+5#RA;Kl9e
zZ=4cBFy77sr4xH2$_$=IV{A`rw9GFKYN6_W<3F;u8yQ_qYr)LqtgYs|@vXSnh8o)#
zah&V0EZ<!L(q*uV6EHvj;B}0qb#?ApN64l(Pu_xr)#xkGjcC?a?K`Oj(H!ww%6W}5
z2Su!w4akXE*XOC{k4!>=?#58!R~<*I?4uPvL#Oh%1Yc(Ry?Zln_=8u9sjQ0^*L{eC
zY)1hU1eh{F;}b+_@T7-dQkAi%{zN;yxfc^Qd!w;jk*v=Kc)Aymo&@+sd~U)kp|Prt
z58PF6<^Hn(@eGI&!oTaADD?h;<dpP?d^oqB`4RgD<tQ{y22W7%BEYwQ)WLD@pDZ`V
zjjhuL!}gJZO^p%O7aB3Z{IUXR_kr($5()rOzvpwObuIm%;^?P8NCbUuL-<1rH;&&F
z7<*Uh-jVkJ(ZUOl<P#iy_+$7oZp1B(qq@VRyJY<vnlp~d|8EUfubVF0z*3Iqkj^Q2
zKtP~F0npKax4;h~ekk$R{~N{^@bmv~Z^Y~0p2UULkd}Z`U%2n_(NUA+t|nhO2Pv1$
zXUjRd^eJXnZ<X3RzrMIv&JPrdcq$EBtaIDw;VET3^#Aeg2&@hlx?qfpv*Mz^(<K7B
z;7?(LvE+dK+a`Wo7S*d}F`{o?CV|dErH$UaxY(heGgJX4P}UW%D9u&t+!kvOVr!r4
z4%x682tbBZ^_~UeVsIM67d7CXRd!FPbP}MxRtSI?CBc1P-q!EAEwJSsgvL{#By(<U
zwX-(8|8JUtDpGGiz<P-AVAdzH`0mpq1h24${r8RLn%9jjf0P&Ad93jevKjGZ)r|Y0
z=#zVo-{*ciJyCGQ7WwK&e&LH9%)eaDkQ@>L)Q>YBo+0RAD5&mc39`lRq|rekK4}F4
z2bD?fTEkpTmoGgt6Cpt=e!eMQ24#M|=)9l2Zl3~nj&I`!<t|>&TE{xtL{mT^TOYft
zJdU=y_KTMx2dR78r~a*8^%n)l4_;X)zCC)0xioSG#NpF_NHasxycPCYBbpT@G0slW
zG2+;HsRWVw(ll7t5Em)qe%yl5vh2vKGJve{ANC1B^|zplij%sy=pl*dq{{KDWyp~z
zA}u<W`D!fDjaVu3{_Q&sG^0^~7ePS(*Yt3g2U?+KilA?T*OPvE8hm~>&#oa1K|4F$
z&!4;c3b7t$t%^i&=F<EE?hyD(L`(y_El;L%+NB-G$c*iL%rjG2v(rbmfm<i6HJhxB
zg}dG78<MRli*#RdMd{Ju`+w_i{~ebDj8cNkNw|F3pYg?rFE}juWf{iIJtd1>XR#4q
z<+F;4L`3CI{C!X;nJOUw(Sa{++#oi#F?+^F$16C0*bG@ovz=N<Yi&}949|;15WtGN
zvjUU#KqfB0u}cDFVjBE}_bjwrtPf?ibG{oK2s#er>L-!<#8N?y*vd`n!gm6XcM;HU
z+V7<c7bNLMkfo$aUp!E$i_eWT{=Rcnrv5*FxVh=(>TFK49BpS5?EaBQfif0tF93vn
z?#g`Dqk{?IC+phZB~1U;e-04w^3R&*+c64V5ZJBOM*e0PkHA5>V4qbDdlb-b<K_Ws
zr}lgDWzl*J_@Tk0?F813sBdMcJ<+q^a5Z@wl@@GpV(&fr+6q5Me+gPK98qr;rjmvv
zKql}pyf(k_*P(b9?0E{^JO!){T$`n3<pW?Qq5(nBdGuGYegPbat5No>L3hh^kBRhS
znU>XAKrv+>{B>4xG$+Nun+cScn^O)&`Ja*GBJ+v}JC*_bUY#Z2pbhDsgg{R<1*5x4
zYw<|XBBpP>0)VUVE#zl61p=D;gKpVk&LUl=uk8~m4MzuY+s)kRyf*=Ehm*h9GZ|HE
z#4Z4g?`zdYeoAs%JJ6RXa{Tn%qik!q815YsLX=ulWiT4v2$aSFSenzws%z%>!N^rx
zhNhVk8|&E=#NecE57`OacytY~QAy(-&fqQUV-j00Uflr$TfNp6R{*eD)~0W`{6mS@
z6VZcBxORcWuxS1IOaNfep=w&gFxED~72^>_aMMG;#s%8nnor^r0jw4pNKOJ^+)52x
ziGqUyRi3A&7{FdH^?HnJ598bbp8&akMJZXmQ>=hKeN%!03?cR~QwE^15`ghuJ;Acv
zwup?arKeShc(<?k4x=e<ucGAwzlGM09a=ur8g*W8T;)dI`b=t*QRnO%Ac@BhVc!aM
zC;nRFzs_7cVDQe4O-{Sxa~MFb?aqLfJPJ5&^lbuzm3Y!KzwZ$0mD#+I4@yGh#QM7(
z>XAC=a3O%ok$~K65dU@Ee*WBWuyP@mFcga5fnajZ0t97BxZ693JVETWI}#(<+CA(>
zyzks=`WOWXoM>SCoL14^=62I=M8^7XrUDg04QAN|bjj<+-vNG~J2k2jA9(c94ge`t
z8Pqd=>cI?$BbJRxbsk>;uo-?h^;>Iwmfp$-p`A>?`F=VbKheJU?ccvPmg5U_!DG2w
z=7I(@+GkUy*H+^=xRLTyVq`(?&a=czMRlpo=_FoBpWY<1+{QHF2vSR6X1c&OG5Tgk
z0W%8gxRoj2(fvqizxT7tvAP2l-*-9y;bC$51K_usFO7@J;sN>2Ka4h;yGqPx%Ulhe
z2IN-#WAytO;NN7-pHZMLVUJcqY*K>TeBi}YTQCnWR{v289N!a%8p47htDgG7=SaNo
zO>pmDx!N+<A@6VK1bXqV`mb2f0|#8Ss4<xndBrdBzG|`|;jde(-x>kgxBNSEiZM^*
z@85%`4jM{vc48&_?!umd8~_=;Pl(@g^t?mt0yRmjKk@%>>-9d{@$qwF3BIqs;QwL)
zP4w0=|4WD9S8b27c7GUv=<)a5`(I7soq|sZPqm-8&D15zb^Q<3Fg~HDuPY(qGT(lm
z5T5(Lf2qnN>O9m}Kgria0OJ7R`OfzR|F%}rNjtE~>Xl=kObdGm(t<bQh0+$URPK}Y
z$C+FXknwUwb=)TbiNT}n6##bRJAA<`0$Ezy!Sn@zs?AY$sLiK;U`!wdcrO0duD`cR
z6lMBcwpZ+?m<DCG--LtgS4TMUh6boF517#MOwS>Q?S=U;=j3;KH(|6OfZjuJU*+FP
zweDR;OI;mB4^lBa6W`;GTQ;!Krd|b}Q-H6W(KL_u)2e|S>I4K00q9>eC>LfsXmH=9
zn4n<+67JnC$lE+8P({LX4{!+V@LlA4GF!g~I`2ZJbFNoYa+d%_DifRmZGj;+0Xi77
zAPx8#+<)Jia$)wnH(;8GiH$w&hEs(LY8$F@3LE>J1(LM6loYhCx0~aB{B9rG1*XMi
zrmm(G+3@?D*mqMvZ^r=TdjUU0&28}qU~?ppz{16tu=sM^dsf7irPU*peoMV6ueG(X
z#HQoR)5LAZGT_&;(s=!gzo_XO`-%Vl^*^@U_|N|TkN$7)i2n>uLJ~#&Yz+hwU}xtG
z)CS4!M;)Jc<N#uZzsv{Bg{I3VIg9ctS{tjXEDly^BRhv)|2=_-p}qN!u<Kl%%XURb
zdpkWqKTngaa(E%{;u1UW_&hBJkV)WrS7pw(f<DJ!FcOW8r@L;m4R&tcx)VEM2s-Xm
z7vYSw)=lwLt&h&fTgOgQt@SHC;nB21(C1colMY-x11FhHQ!dl+wM_D8I@UU`%{$;{
z*_$G%Ee#%n+ivC3=Vw-NGHV=>^LXtGT-EC*e)`SlCtO?$lDpFd-P}eUUa#WY%WG;b
zAiOQ6`r1L0n?)mTfb;_wpK!|+;c)A|z!mm)N%wPMVZO{!6TVrv!)(oPYv7W<9pDQn
z|L3QlWXdL+52q7xQrqR)Ys1jNqnBpw&V%W`Q?Q`DW!4t+z7;&D9JuZ;0_TM<y4m7+
zL4nhsA4dw#k7)7b>C~ZHT=au4^MLfYe}5K^n3ZwI$*>r@Pdi^(3$_@WgAs);I$ZLc
ze|!G!Mc#<qXz2Buzit;&Hr}+&%$x@f{vLG8fUms)WFNR<2%}i2WjP`=?^%dvN1LCt
zrI@zuHw(VSFDLxhjHLIe<vC*bm^p&^0z6k4UYBiz0-Gw}>Z1R3o0N_El|dDaSZc$3
z*3_Z_epK+BbYQ~XDp`a*Bq5^G(@~(XEz_@*0frdJqW1SoYNGHvQIDuq4YX(kQ;DvJ
z)H*FnU{mpoZQznk(0r6*{sJ9Fqro3K(-k|L%+xSqQ4i=m;ClBkNBKp2*dG!umIRvN
zI#|<?G|KwM%yf${u7>xSSuJ?Jj=3q|0`u6=R<rM)tjaQ2nv^GURD~|n8~F-Rs0t_|
zV7_)~dA{NXqARJ<V1xpht!urVxx4#hjKeJfp!kJ|FYX)&?OAIoa)5xn*4S{Ah(7L*
zFGL(yj%W=;72O%ex6wsU1Z1JZ$v^nD^sUB{1Ek$`bunwFn%Qw*5Er;pBKYi*`i<dC
zUP`K|J-Fd-uVZ+l*s0$bBv8XFf$UMST(9jmh5~TvwO^*y6i)h&^1|*#^KlSA9H#eQ
z=s?rb!g7L6BW1R?S<gBqpymYGgg`n7Kq4f71V2UfZsz7A+lP@I7Q)YBZiEgxmQ+-f
zR+eRs&%IpC7*wN5m8O1MD?4h@AJ*}7cTxdT(Ng1ty__k(2k`w^xgsD^2S=Oi%#npL
z4qE6iA4IK%0*T7lyWD^1zp%v#lDv4{O%KnI!D0a*d*Ap5kZ$I}XM1tB*`dD<D@TWj
z1r+#YLruJ>vuPED>z3!g527E2Ib96R^KwJ3{={c>M&;PI?<@r1{0C`LmPl<&Pyo6V
zLnc#jye}7C{b9U6d+y_lOg(WbKWsxcHtKMYplh*-QKSt$3Bvp{>8htMR;1yQIsSs!
zW!tH=Y)80k)ZTjeAvLLgb1OEaJ+2~)5Jl{Zni1h^M!aIB0N^n664_c6Iu|-|T_KW(
zinQpvk-i)52P^L2_k_M#AMiG6^exiRc}JU1V{W_HLrqTY4rLpf_ons<PWg@WEl2Qc
z_y`t|Xgnpe>9lpfkJN>7*tYhW^q+5R6d4l!mSkLakvZiB(DW^OM8r_v!s28rwuQ%O
zs!d7bbFe++=qNEhe%|Ol*oa5dYg!=3J*vrDOETwEM^wH&O^w;*pIzwOrOS=p(PUpF
zk-Qzf!ozv{b^|fdp+`~V$o=Se9J2zDj2`{7hPSoV@p&}MTN(6pUc3aD1W`4m5A#2c
z)kTJ^EXSFGv4%xe9UQQKyJ;6#SMguRitENwhDdNUO=n+{6UUB#@@~5l)cAZ7Bs@MF
znIT7%;5U?=={%`v<~#l;*F=Lb`vud^Mk6jnN!V4Zk_)``syhf%9c{$Ed6g|8)k&4i
zT);uf{41}sH=`b9pE>>K+pGch%OA&(+|Fc@a6t+qI)8K$O*c!^7aDnfUOw^?7^p>^
z@so{AD5*Se<83KKj4+|s@J)a83DS2FbT||-IP0@FGc_~6d^~!G^~y9SYu!I%Vr*Jd
z#>H{F0{}U{t@Ly-=VVu&5VM?Xa4=;7P+Eegv<?WBE$!7ua%ekzc8VCTul1et-&=f!
z+lX8r%<4VJ$=4^NX0B7^_}bxOq5udqrgrCutO-1R*w?W{aTH_b|1vb^BQ{Obto|Up
z`<`qCUZ<{GX-K1YqM0-2%fCE-F8mcT>5yXTXBr%^3ie%IgGe5*G8hE@v`7ie54(^H
z+E~<pnc!H+126MfSuWDhHZ`E^jc+zDmR5YXqn=u7E9wj!mDN{5{BD<&Ung(bcnk1#
zeZb%gi0A1QQvH@TZ~6@QvO15JwaR?*$N^ZKJHlML1*xW5&xe<fnRhmjtxl)NV@Cb*
zzyKh_6XfzR^hn<9hgs`MAEuE(*w$;q#7Ksn`{GA~UErrA0pzP%Ls%s&Fgm%%oG)he
z?5!A#mP6b*O;gl=uF>myyK37b=6ZqmZ$k$OJP!AlH5M_^i%n9d46PfNHPSxqVgQb8
zT@d;r4`ERR1=6)a1G-9tY>yks;hOQ%XzrkE+Sm3a%y18Rs2K@g2T^{RQqQWRhR46?
zKMpUGNt=Ca*zfl5a_{Y*EMUb*8IuD3-+4Q%tr?vReZwiSJWd7mKf^*74p3vSZSryz
zvWaqj<%H)d<PqinvbNgqp&AbBSo)>Jq^B<759fxzgd4-XxY=zQ{vFhqpzSd{4Ee75
zprJBI!wGemw-<ah1jT*gR0ndC{~38PnmfwJ^Mr@HpJZYViIjL!CzQ14!1<qs;4$1P
zHqHNS%4U1)Z+PTDPHr_k#mvdM7_!m2XySuDFINRxxjtq&*0J_!&}Vm{%mll^wjTH)
ziOr?Kp5Eb=AVg=T^51c7a4`Xg0&cG6lVJC4-dY_W+#W>lh6|lGzDMKLhIK9sW_~tA
z(Wcm9V+my8YHop5r%HNGwb{Rlz+<-Y2)~=lW|F)-Lx9M-7B5%U1e{t^Z{d3pUFVSh
zYj|I4&vmXjU=O>+xgM!57LvpZ5(g=Q-hdWV3oAeUyVlufVJeY$2l=(Bh8qsnb|w{_
zrLT8VTkQw`hCH{0pTX}6`1dfn!3q}HSptN(e31f<{TX_z<^OiX(8WX?@2_hf04T*3
zh&9G0(9}=>-UE_}h2I@hZ}x>SGOGg8)y>=zmL&1_@ur}yac#Zve;0k?`DB5{_c+5D
z0mH#=GoO<V%HSVb`fT@JDrmiEm0hnOti&#tFuS#-Oq5q#b*c^47%8>%PYCYs&Entz
z^R&rnX-dpKJ4(Z;qQ2>)j%%Xoq)KxwSB%)x$tYqd3FbQe(8{G-AQ)}vkS-K<y`2ts
zv|$wA_LK9CzS~|{V`CWqk%YygFT@zkC<A}+Dw4}kA(sfUTcGdo*!ZefrBF31)w1t+
zuLNa8%lh_S*)4ef-*v)JM&xBPS2rM+B2gEr4k_!~G}qh}m}@*Dp{Y4|S+Zj#5)|^@
z&|90ZK!8F1X^(Xc{MpyzQPx20iiVA^s)^9*gC7X(#tn%n<CD(qLf$lu;jk>q*!*?H
z;ZIrYQby_TR^y9&-PhB14(!DIS4!+!_vcw9FULoSq=a2()kRqSOIIrQuH|6>ty8_B
zo6of}UY%gy?tq@zFIBccBm>FUK6I{CU!D)nL$azi9$~~bzp7BcefgwDlXZ-?s7b3p
z1aIy^c@B?t%i_hZ*jUeh)*>m%omwPb`1iYSkFo0v^dZvBnw^n<{6S~0WY5=&DIuR;
z+hyom&l89+k@nsZ3s&u6Rlb)vFf$co+5S`seaX>%eZyZ}Ebs)N0yO>!QPo(S>iNt>
z5wQTJ9Hv)QbSY^%tvlV_vkupq*MY1=#uY5G?SU_gPWhS7HUPi-a<!5**wH>{3`p5!
z|0vWW-=uC82my6+-s8dMX-KM+{Q=lC#?=lKK3>O^jiqH@{dZ<j2gAWO6I;GdYK53v
zyzWSa09Y6*MCK}e^9IjT9$ud3JOQ4FFs-7eKOL_ry9Cw^K(5veL)IZD5D`Za2(a)R
z2Hq<1+GtJ+%rttD0SVcKo#!x-Kn9@%&mqyPFUvE2B^h&~HcQSt*NK8cj(MA_{)E^u
zc~1amO6Cl^nbenIx+gRJaXk-GUHlv-sAO=0{U6JUG~$$-6Hc3?GW5%h&U-xN+<wDO
z|9Jiv3y_CiOkXA@k7?hHjp#kBmY!Y=$X-6x50ddY{Gwszepz6rMH6>@1$$ao^S%Mg
zDnq}qF;f%l)Zxd_8?|1Nf<3LY!)~L&%Sv6<hWc*2G=p%9ra>R{j9pg17BT&o*7~W|
z+0hv(D@Ugg%;gyX&0Y3Z?t%X0xRp(G97WMW^*V;6F6_gZYR~qyibg>~YEWd~!Alhz
zJa!0biPIFe5|{69^0^9t@AUd;9<+i81o$b8Y#-gNGT^4m@-6f^tdqdXTHVum2RBM_
zO)}+U^lE^dUj#G;Tv%FliJfei_3xC_ZRO~VOX#}=u8H8x9iMGMu<?{4stzTYq9Km2
z)ezkm5@!Vg0E1vkNImoD$PE{4j!<`5>4*4#&Ek=I%-}OQRbAy^!l&(2zq#$ZH=|i>
z?z2L_r7IA8jCSLf+T7T}9<s%=K*q<CySmQMN9t9eLE-4<!PWtG>}t(kOC5zI<WJYm
zCluJF_&s*M@-`m`o`fIn&AlYVHCrD%IAv~LA5#GiF%RJ;4kXkWT;lp6qRSY%88Mle
z^E@lXrVJFW-%cH?dr2m;-Nn9}=70K1UuJO43^&YP3Dn5$FmhVRS?uPOh|-k=kx&oV
zhd&~-C8j7v-D0m@v6BbVvQxlW2UbD=hULGEIV-E;KHtG2-e{;|f2R<3I*$&r<!M&w
zA&%$XP;GgNDSb&!@zI3au<DxXMJFrk!wf5FDN~rlstP{dFi5^T8RH}Rdyi740u~jf
zt5dNs+w2`vc~)#`G;W}`tkS>u9gl)etrpHgj)9%v)pDh)#Bsirp?a5H{{Wi{+Dhd3
zn;NaXQ*U0gv!9r9llP{cn9cz9>c|rgX>f06x}n9y`)x@v=2|7MaH}t5-P{+N{N6*<
zMU_-ZGAMKilRg<<v$57nKKpdX=6Pf{#KW!Q9{Bax{u0*$U!foi`%s!5LV#KjgKV^%
zseExnQC#_JlbxyF{A34C<pylTf6bO{J}3#L{}M)?F=2ZY9dGdITpnA8nOT*X@(#c-
z?mTB7G&t%lu&b(;<yzvUlrDvR((*nnHu){2R%~Y_><EkL`sqshp)MtHV&Pj|GqO6~
zF{Ug$83RN}RYV)&-ppvYHJ~>Nlx(G;3I4SnEBn=JnRVEwTJc6M%_Bxn_|sGgLqj2$
z{!qAy7C6U(p|g7Z@VxST%U5qJkND)e3lDhu<{<}avcRZ-VSr)FvF+s7@W^aTYXsma
zNA?j>5B!OCs3MupQK*~tgC#s*o(6*6`SwMz5T`*fL!BYdl!>RpcK**+V^cqWqIpJ{
z#OZsq`rpZJ$otOY;$ad#qt-=PfyS3ia61)3Pg`}|ToS8DT1+_*thJ2FC6{n4vs`8$
zglf%xy@(U#-S0N`!;qvv^D=)bh`H=F&0<g2ySwj(aH!Eo=)W%lDyJ$bys&_gb!*<g
z$0&yC5vv0go%}p;nQQO*)e9BJ2T%eg-GbH|rVKZmtmY3SHlSCOnM%j}KFF5sR!Fr^
zH#YLKWbU~j&KOHCtoQL(6)Vr;IopliorRkC;Nf&>p3cp-!y{H<pPjLYrx{mHS2$tc
z-G<|@!!<j2^6=;bPX_zU@w*bHjBNoy02twD=WDMWj246%U+i|N8P(yAE6kXL-Qwz4
zvj<;G+|VFIE@<rRmkNtuZkaV*mcWOVj7X5A^tuon!Bs^`g{76CBWKf6;q24Mk)B(2
zciYC^WYf^J?acb3EDXnz^^H!nVr^>e$yj177Nx<P4;iwb%P&7I9R=az6_-FDd&phy
zs6aJC?b6Zzw;9eN=>gV8&F@#Yn!Yb(%jlEBa?i167XU5SFpJu&e?0Jy6<u?c;~=Vy
z0rS<txwwd*J3yyy;*BA9y=KYQd~Di@Ql=RZ66A5_JX-Tt#ragmP>0;OVWO(mMNXo|
z^!J3P^>S?nbt2qaVR^6lbPxG$Y8`i~Jxsg|PBI@=rRg_MKhx>T4VPf(%$<L)#fexu
zA6A0KKtq%JZmNB%JN@?cn0e!%DN<c1z10s}P#@?pn%2$RbSA$ZbgVr@VkkoQwc5R|
zw~$40*>Ay~|Cc!Rom+p79v?bnk!z<LRy<)9M(E{5*cpD7@MZ4V*BZWDW3A6TRluAh
z=oS_&+|s2c%yk4!e=IXXJ!TT@n0yatSXsod?-?t`(j}7HR%OP;^D@vaBDHra12tOC
zCsrdD7)9iouOR2D&hHPgpW)=G!fC?o`<Ijpo+T$ghUaQzgqJeRVy_xhSdqh=3U>8i
zTdRn{jS@Ye$S}W9L|2XT2zpt=_(GQ_=?)TFc=qx^l#kv}^G1}xXy}t{W!ivouFA?N
zW{*O2m5!qQrC5sbD*9aA_~csS`Bq>3hQ_z0%;R%UJDY=Ycv3d((<rpgOe))|-f-q#
zzOs$g&PnLx!k@&U0`k;JmmO;@P+8GeU;3+^`9)fz^(kWrTkK}vj`@Go0_Xa~U06~H
zS?lFyq`iy13*BbnWPW1TC8pw{237dkbhjG{Hf3xDf=S&euJ#$D3%_}JAo7gzgjK`0
zUBd0RKk0p`yV5+Hnq;3JpS0eoxaY!vii}Xo<Y5f<-dNI*1Tx&E)VXw<-UsXKtRk>s
zC&I5%H9E{Lub|lU{c2ZaoqR@)aEmZ*`UqLg9w0!XIG?K+WGOU@r~9H9MkU@Zy|o(?
zj4>k-qDt4jTvRiNL{r6MR26l<^9Zi>gdZ;YVMomtgQ>_7ZVZL|+$!*3mOvesDONMJ
z+?OwB+4~QOIQu3)|B0u7t$!aroVHVmsCj*&qvZOir08R8k%^a!l;p{Zr_kYaU3Y}c
zHMoca$f5q(Jm-YDV%mBa?qXBF?Lz*wsLpY&$4u)LO6YUM-sL&v-WmE7NT?~|U|o$y
z25vlwy}V3<W-rO!cb}znJv%vu*2HrBK@?3?0FHy?yvkw2YFA~tTA`XzeRmf?Y~~j_
zJbSvi*EJmCXn({GFOo|TcyO_*GCMhM(nQHInoIwysG*w|voBI9xqO(SBQkl+($m<$
z!#k!ZK;1PSokR3~Y2-p9pkq8aPsW3x|6{MCsr#Qd@^F)o#nqV>SHXVW`IW9hdif%W
z<62)gh!Y`KbBWSGPT%yhObhQ)Bqwl8l?%cfxP+mLya8=p&kB3=(z|ZDB@cw{l-FPn
zSS&O%Nf$RmopqkNF=Db8f@ekY0IHDD5$tsM!z_5cH&3CxdL=fv%I5oCb>Mnqc^7-l
z0m>UrsAN+?UWrSI%htAuIVpPj@@locd!r_9%S6ayl`LNC*b0c_S((kc)<-HjcKe!v
zD)f>Zl-Pv}>Xd?aMx)EVQk0gWkY%*3*o)8U2bIm2d1;bdE|2|`W*JAq^2m!~yXG=D
zSNM}g51vU}bxf<r`&4}J8TmAc+S@y4?5A?^@9e#h>~X2p{F7UKFT5&@Xle}k)1Ewb
z_v*~9?X!h&o{1?e@y6>Nw$nW*7z?Q)yml(He-kx4iZ#3>kwK1Li=0>IH=PZ(XLx<)
zrEe5KY!l40qJ0og8GyE#olZ@tiFN6ObBiouxm;4SG`Js*k)3uzal$7DS|Q;qFS;2l
zl^)tln_cY21DUe->9mza$J%o*2CHP!cY1%aNNmwQ-=b1!5qTll0E8M7nQvyx91XJ0
z^;PR<^LXZ)^Y!GqWE!Z$K@WozV<l~#)YBDn81?taq+9A4)$I+q>s1wr9~jI&H@i}Q
zA*>>-c4;{lQ3@l*JTz$BaK~`DmA`Qt<IHuV0@FMbJ(cGs{42%h+o_`xsP~@ZbR~IZ
z8Nu~JB~q-Zs$J)vwhnBGu~RIjCad`gy1GZ<t|hRN!tc7PULYQ}(6s*bQ^d8;1{Ynj
zeA81hvOu~>uNrR;GASws#5_VtTiwyY)!F{T)%-NmpTkFLOdo;`s5|<U%r>01qgdtB
zN?rPQrw0dS$s55Kk+w$6Jl%rd@t(%K|M97t)H<1r^!8z;)INMN=2M@&&atJK*hQm;
z>etGXpB()Mb-H_TkJZ$&WVD^&uafGomM7x))Bc<ciU!wJQ_9F)9O9a_u1b-uZ>Q`L
z1LqxF+xF?Jz2FN?iR&NLKk0U}WY`8P28~zdD*aREns=~)#kG9fylS|5*`mIP;N`oQ
zGmC&uoLK{KLw~MWnU}j1*j{_yYN6VtyIuX*N@=#La9nP2=BO6=+_)px%@FnxWT(#?
z3!LNxLf&49ieo0+$m9rVTMemAQB=R^iCTH0_6IV3E;e{GQv9RMd>9Eg?cw5Ht30Dd
z$jK@@D>tSA3tvogS7(N?f>f&DC#y~}Y6!TEvCzc~ZeBUMkQ|{%1CgEI{Dw$BA0~w4
z&p%Ip5R~Saqar~n>pNPShe9=^m=<glxX64N<j4UIqZmmzX1l-z3)MbeHJrWvAe`7B
zSQIZlYj9_H)dTND*e}oQGlnSm>bBuxw=H>@TzWwi<EEM}V1SxC<)(ZV4PRw%E<dh)
zUS*g1P1io<eYP>fhhW^30D(Md;W~v_%ugT#ztgrJBLwih5g?u}y%(2^{yJ4M)Y}=R
z?0=~hYJItTW(-4nNjE$LLc08&&`M>BY&iR!5U=8g7Ij8-y93sGNZ~vwT}-)cB#ToX
z?@jSAx(hDk`gxCosbLi-R;>t-JP+Ui!`Nl*4QeE3RM5vSRb$fKsuGWPhAA(%fmpQh
zc2{<be2W(i^F_`dnrPv-<AoZ+(p+9bmWv_6JQ-SHdG~#@ukJs7hIEBDGEKCrDtae5
z=0rb)p7>gkf*lQ;=eO%FSGQ#(j<=$1S!!j4=m}l-3a2KS=BjYzye56)i6bk!SM<j$
zUAb4Dk{1_0JJ2ep(!vhd7zd@&l>Hjf9R%%QL0eDtTjX<A6ZeBRFb&+U6v|EV(oFb9
z;+mQWXuQv8WL@HRicHSCwXeYupnT^nF>P{(k58ayOJcsRxqTD46177#GM@ItaXa~l
zVLM)F^ijQS@zr^E=8rCe7xl4h(YEVQmKI;k&iT$SwNZYFdZlPLdCxL#FU?*Q8r&?6
z^i-308`@$!eha8eC#)#NXaNLi*?ikKxxQMa3QIa+bX@LRPztoC6_vi?t*d#_L`EM>
z6_6XmJoEX~$o#f~_&WyDa1YTN&{G{nGbUt%4|34JMYC-E=j6n6c&-bR{Y;|Tr&-6*
zF~5$d)*#M{O&<BCH4p@Rq~I^q52w4$Luo&eb;c|K8+)FUV=Cc2w|$D}QtZ^Rv>BCB
zNtcxvsh}}&up3%F9{ZtR(eimq47sIt^BnZ}k<Yt#wgSF@9Mnu`in(IG=rJtL`6(|i
zO@E~l_CWm(7ml!<U6lC*sL0d!+?G*GU1^umG3m6k?zlO;?Pp_UF>_ZDj*ZA7l=}K9
zg!aE!0F_GwiIKM>5mLYkp8KrD#o;l+c7MBR4+pSC+8V&jE>J^n`cfBfP_xFyJ+}Yq
zPw^8&2d9Xv{1cr;R#vIW<dFo87fbxY<S3r*HlWHT*TigXw_`@K9>LT?#}Vp>K%&p~
z7;J1e34Np;SF{39H6$uq(UZi<OmYsf5mxJOwMf&YJQ-S6^5Pcj*rMlsNv)3L<UL2!
zA52(2pjj;5r;#Z661X2`#a;^^(Z3U0)Hhx1neCA#ymqJ`oSPjPQZjbD2c4s8a;Q${
zy=vR$_F*I^4#eK-f9;*fDC3SL=Aoz!(VW_?qoHhJg*FqqCR2f*uwuK4)>+!Z=*D#>
zYbvj17Ntg7L=f4cr5`;DJx60i+`qXY4(bgbpbXoNliGCpo^D#*M%}b7UjBrt&%|}6
zp+{A`V~`CWCPSnH&|4~YZ3n|D1{Jmgxj=>@YG!mwRaXR<6v%_xC_rM1-&a;1;~2dq
z`y);!vfSSa!j=UvFPLWpt4}f+@`47Pn&#noR1%*{gEq&A^CoY+DQmOAs;P2?DCjF!
zlML8uPgCVw>Se43o60%apzRe#Nk7)M_mlBdj#aZ~++Uyg{LNS8q8-WN?tGeX!#=$(
zG&5~L&55G`b=Ku`_F2uj#sJ<TQhIm9*Xfc0;j;#}`Uk$QltDGPh4S8ebN)W63jM(B
zf(t#nRK}(EIK!n5K4#nz5Qcr(VHS9Z@?M7~9eEL;Vikv%s92lc+2$s_G!RyF)yk9R
zr&Y78vH)97&ASW2x(rez;htZ2H0+O)4L;=&+fI82gwzeh4efq-banbm-?eF((o1lX
zaF9?1qDCVKUeEFxdMpxrd}x>DQ_XQxEq0R<(f#nB$Cm~><Knn`7i9UPy_27p%Hao3
zVaW!OQZ=^f@xv8W@kf3n=fV~Yus*eIJuWXNHY+7XmY_dvLT|bAY#-ux&yN>Pute*D
z_ET9wp!jp@WXr3-pN`r`f?L2LSFUGG9~30WKE{q>%wvvmcgR4{)=NvkUs+5Sw()R|
zUl}7C&XXqvwcTHiDK#pBoLIs#0>-Lb79&#hYz|}tyeFEeQbe~W@-{C-c4LSHN%fDZ
zB0&y{?{fw&2BH4r7IuNy&zMQuxMgaE%{lMiC1zJHF+tt~rat+e?=iPZ?oQX${x0*)
z&Rb7vlWxCXoAWbi{DVqzZ0`zXmNZU(R^*rNz-Lnx*p6xjveD{v0oCL)oR);Wi-H=1
zC)b9gNUk8<_UT!5-Ir(b4M(W6<-MR~ARzXEwZywnDRSLmMI$&!e<v)&pgRT)KZ(-u
z_$ZUc-fFXKLzk)HIf6W~{y)Wv$wwmGK)lY#NPAE~FIz`Z;vsA6C4);U?cqVRv?|xj
ziyVHkwLx{X0mzNsXG_`M-_Ywn+ASw@KI|l!ZCHfO&^w*AP3qec;bGpSJ`Zh8T{mr8
zmBTvJo`|$jMM5zfrR(JM{J~1M&vz?G3Se$#$H~tX$KrT@wkg30Y1wd=mwyoQ!MJGF
zuCAXH7C&t}auvR*`iRu_9ro~W&QKvDYSCtw14RZmbf2qrOtc8-f8a@6NJZ267bV>`
z8!uRb&H9es`KQkr<ec|^w0E6<O$E&wQBV=FA&4~T5_+!*Doq7MX`xpW0tlf9ks1XA
zktUJe5kl`EB{UHMAwVe7n+iw`NDDP^59+=5UwA*fpYmaL<~KV#=VbQG^X$sF^MdpI
zHu1xcMbjCDNvW{DZRuFX+vazx8N4b=!|W;=<`gWn#0qu^!VKU;F*K<wFsCy}so!R8
zItnS{m?)tQc9|Prs*^g>VpK+g_lx(ImDn?__RYT@-lO|d_%&Fnjdu#k_(_d+@17iv
zz2N9PPY9MqfNaSt$Bmg6b>YnJyn>0{l`j~SN1x4pEV_1Ny7HU4J0W7C)J4*<Zz5z9
z-lb^Y`~~<^YZ+cmzr5YXMS#f$H!xRu9!waEI;0MIO+iZxkE;1Jr8o1SW|CHI+>VJ;
zr&${g2G}oS6MPoj*ps{`IQtNmeVd&g#Z$YpB1afvYp+_O*Y2}W<)Sk|hs~#x+NE|P
zRs<}V<&JU^2K5U{`Yx0-G`g7V8zTS^%L>Pg^-#DrcQpQLvIla@c(4|QmEFVerCIhZ
znYJ3qB1soSnyNg=ZEgfvsrQROak**J6k()nMjW^_$%wXM&zBe}GLWa+Pdf`-&`1d~
zs$dc-YQ?$T|B4)AqweO;C<yw7;3-|8c_4k)J*J`|vm&#A??@%H5;((39hKn#<6}ol
z65Z_%cq*k44UQ~C|7TEBj~^O%3&PSJSs{^7Vej(ut|me`=-F%F1}0yx;o-sh-)l`d
zDVpOlS~a-mZ=q=(CX46WJvM&k42wS~bkSRZ&jfy9Ndk^^ptWOWbFUhumKeK;omJfE
ze8zRmsc}@^&k=SE*^e91w7y6+Q(yw1=fiNSJl@u2Ej)r_kr5uwfk8@J&DU<TVsqnL
zGi`Ur)25QG#%Jo03BWEPt9srR;u+F>tG|ELu`2k8Os@~OCIkm98t(D1%Rw){7#l&H
zZk$J6GTRP`>`9U0+D^8k6H(f;T%qI`!}JeH0ZC|e^m^P_e5Fy!ud4E%PS;z5N!yZ|
ztplYap3sAZ?CHvIEQCAmS)xg!FS)r#m^eNgVbXLAbU6n|*$pN(F2W>_p2uTF8r6Sc
z4u8Au$&1_Opn)(|<#y8NADRbIkvpviej}n-9;+<WC-Tp<qmQdi0)}mm_O__nExcka
zZ-844z*F<bznys{6c4v-2zwjtdEc@pvs{g2Z|FSb@k<1{3+r9TqvrDGt%OD~$92V<
z3u6O*Ywk)z!Y<Nu5sEW47o2K9KQOT9&TKZZ`Sr9Z8Inc<6RmQeOv`ec;&%V>(RLSl
z=0N39P-C$$<e<w<n|v#ve+TH4i!|)xm~>6jj!{$l>jLscM)Vh-`Zdz*^{PW^-3X27
zse^H#lMGopLulAqIyU#VS-%q8m&$|>V`zz0BEK7YR&pn=FdZ@doVdROdGWc-HreZE
z?zP!c<8#DV*oIxp2X<Md!`0y%pE5QYVU2Yzcy)-25OLYz<Af5hUmi!hLsz=-ABr5c
z<>xU-i{n~?d4|EckISBi2Wu#Rav~f+i(rh+dPR%hmh1IGgdwk_hcihnV&8czKO~v}
zo73$Q3;f%R*(C9M;!)o@QUW_M_46r0a;BH|!-J2<#l1VjGU*27m)@vfK@4V!z^`vw
z%SK2<<Ze5(Ru(?iFD=#wHz|&Zx*peH#Tme(VU&izN#pj)?WijHIm!Y0%6A_@mtVij
zZlk8*E*N$+#348YE*MuIY-uHXf-+lkV(t`h8iBap^X8{ruftfp^2*Y87^*;Ufyc0!
zlQkC8?r1x#xODx=2We37;JtSrEyHLkVfQ+iMsLQ_R2hRp-BS|xI@%IXz9VwP#}vJ6
z7r?uYus`44TJuGX<7}aoj@{V0dvE2BcY8`A>$VD2ZP_da^t7=O+xGCrJL9pFNX3nb
zi0Ww@RVf#eUZ^fHDR2pSAQRE<j<vZR(4ef;`qh$Ry+>(TQa*bZ$lJKPqM=d@`L6OO
zxY{oE`=NxNi4l?c!2Mk<PRuu+6Oj&Sie)?jwfQ^%&8>`dfhVpL@xad0E>G9gUom))
zQdI5rh&a_<OM8(CvoYH@L*ER-BEBJ7B+Zl3!DD9cF3X%+c;&%?ERx|b@|`)ZK+QKl
zi9@lpr)hb}$efqEf9?$C+>`UJJg!t<oO4gz{o-%9_)613omD<lRlwfyNp_0y$~Tv1
zd9Yjqnm3d*lF6<-L0mr|v$U5(W;tK6a5H1Jk_6$o(xr0J1f<N`uwa6PbRF6!&8OoC
z(lq0l=w4CgT3AOLYWb@Q62Hke=+PgC?Nt8wIYY|=`1x2lw~R~`xVrE%TRY))vnJ=4
zLZ$(h1j;YFiBgMIvMx)7<Onp=Ta)@Od+Bzy9oZMNyUkn{a^-2mHM3E(Wf>u-=V;9<
z;G@!%d3ucx2ZyqA!kt!2DT?O9dcv9tc1~xiAMG`$h7%N}`R9IlGQvz!_u89cWguK7
zaVUP-HouY-dk2!Lc;dcY<Z2X>fF4{=3Xidwgc$<p17}BYCJrpO9mOL6IlzBz4R^a)
zn_K;>VZxuv9_zdZ3b>{05*p{}Y2@9ihWDFl3{YqD`%M}qKcubOqrML1j_HKv?K8Mt
zkwF>09CFjKJ#ueOQg4#i*VW}3Hz=3`NHd4)s3t%AHoc@GW2s~Tt{A3RUnc57&WPu6
zR-U&hUWO)-x4J0MO&3i(1j$(~MRT`!G=Atb(ta+ouq!jfse6Qnof9d^y+56TW%=Hp
zr)eMk5Nn=iY>!-m3Ef~wmr5Q>z<k_qo#u(m{$(6JPZYToQ_FL<4qpl&aldceQ<f+A
z{xBMS;eO=bMGn>v=4gG`QO+@kzcoSHhD@20Z!#oLtYeiO<ZzPS;W{M*qJjR>;}%Nd
zf~IWb%p^?nBt&Nic(q@+E^(EM9bl(ZWwBNq2P8h&!?OGzoND~jQPsP9`=qzwQ2}{8
z&|;?voNld1-lM;6?hlEq%Ko*cU4g^LpZLW4tJ~MlbmMEi|K|ikkITU(Tqix6A8<>j
zCSa}HSjgObh~xZeJu*x8q8y`Ji~<IiB|rKOnDjEyfOGNIKWlDvf2~1|NTejvGt#au
zp>~}N*GZ&DXv1_|E2fs$=7)vEKcJ`g^%tQ<<GB-24Z?X(Krvpdo*L>m7!c~VpFNFx
z&8SrX;A%DJ-Bv%XnSxD5#m$1@iIs9Se)YHI(@<WRv`ox-3wESjyu9nk_tM^Xp|x?q
z-8lslp?ciz58QP!^+4P58^YD>|LhI@wTF^Gu5LD=$*Kp6;WIhiKI_{`HO(>MI{x&W
zb0hPX(Uh!B{_6_zRJ-_Lu^k?xu3x@qBMT>gzjkHR`D=J-{2}XX+rOzg;P42;_O2R5
zu%f-a!*zLSyVF#X)0G|9)FN4qdOo*m82FGD=kqpdxNz-ntaj*@*ryewvmI0z(MlGV
zPNSf}q0>g5tuk>N+9};rsNV?Vwke5u;Sn@9Ung7%JP;*!BZ*V}JJx6Pg>zT#N9L-P
zt`V+rr_#W<m6Q>ODBM$@EVaCE>(zD3rFRtMuk{Rcu8QCEPjGpC2Gt`XXg?BdG2s3>
zVy^923-GJ*jgLx)9M(w5%V)GxDlNw;){-moQmkLTsjkY4k*w&lfgH{HZBRem5(_<|
zpg3Z+kDMX4Q#4(!3>n4?fY{JmR&(V*gdHpl^g$S0p+V@k+{6xY5Y<>;f^(|$qOdYY
zJQLKk<c7ECCcs==J_lzFJ?tkk_fyj#s6xa<$Qz6sBXw)NsfDM5Bh$JdD2|f!()ypq
zMXv}Q_)$eAi?rXRz3~fdI}@xjvR0oO0`~Kyud~p{Lmz(=kp5*=0c(k+2>ZA|L2<7C
zfy!My;>MzI%f>?B*$+5XP#nfh3^j-gXLJ)W>VnI`1-<!r-}BdCz4@FZ1bZWT0yiri
zQA}r>yJ~{C=`_b<@|IAKee4}T^zv8tu;VgW7wLN$xJN2It6c0DLV37lb4zm#A${yg
zl79Gz=X+u39rC62u!ml^JhNP{Fjucu5-zhc+!X)S$bE1<RVPj_$M_5Qf8($wJo7tw
zb3@}{a9CKO%TDBDMB>(HFy5dusN-o~L4i)bT852iLcJmw$+GQfv$|RAXU--nDEAG-
zK092j4?wH88Wf5<;ds1A7bNX{?eV+h^5wqCUiF^?C|e<;vi;qVfqbi=h4mQ>mS)hI
z>?UB#?Y3z3%Huh2a=YiGdqwwnf6yguJ$b|hc!E(dhMF(2JC#Q3-Q>C(V<W@`=a=vB
zzQfqWq_|fszB_|gmy8bISFmSG%B7GEZ?&#678(Z4eTR}^X_GiLQz0RN+c-hAw*+ZL
zKuBO`eVt~7KAo0p-g>nstO0LOEa!Tt0@K%js<J!sglnHvt2>C+iJyIAp0tuuGx0Aa
zA(JquK1^f$z1-6`smn2%o=_11Rt6zs(q@|Cm43PV8FsEL3(fpWRfKLss5j9|E6Tr4
z!aFGbX0grI*6)$hjh6V-Cp0hL>qDUy!nM{F`r}PtU+IJ1zH7B{8!OY)R32}`V_VkE
zxNw1;91_5DRWO)8_PQG`AW(8!xYm`w>G$#kvM06fvFltuS-sq$U*xFAyiCSPIi_Lo
zd-|uU226YDznALNDhMRJcW_q2wmY%-c`rj3#Hh?^A~$OaC0f?(C}>hkijkQrM-C6_
z4}Xi6G#xr8^Uayc=3U40nKk_3@Gs4@&(XSf4x-2uqs)jyQd0flfGwc|@`@!08g%9R
z8lOT+gLP(I5X#O+#{-;#>aNhBy-=Ac@k5a~YL?UU6gif96p(i<nr_U0bf{=C%F0ZQ
zj=9iTVNGZs(OkDC<0p{QV?X!A)`rd(WknJ-0xSAxPCwe^Fn_UXOXy0>pr|bA%+D{t
z0t-@=lqM($YK*pcXYu&9x}yfZ6C_ZOUs64gW)V8NLL^@Qz9zzV3K#fV?Q7Gq*{5zi
zevJRq^yo6_hNEFRYs&fgzHu`J3DPXXEFT{qKWimbg-!b-KVJx{ty29u%dPotKMC}y
zWi8a1R5rFvbI(_9u$OArhe7yGd{afWtz@~wPv8w7gff_j{l6*pnz8%V=X(>rLVSM$
zQ_RLkzI{8<2v%+uD^G%OXB;bBINtMIf>Z5C@xxYDa?qW=u$Sf=c_NpRig5M!JofVK
z?P(?Xi*s^vBCF%lN=gRDrmiV7d;WFTj<724wt854#Vh-%-c3S$2=>?<?6*RmfDZ|d
z&b#TzAg5Dmk7pNGKHyuEmEGK3{RFvd+)PX2IYLhBwncDaPEqTbnF*bpaU3Sjt~oiH
znWfk>^1knAX=!;zl1%D0s4$9PV7AR*3;&lXZL9L`ya!52)!_A(j)&J$ngs=xAKN_`
zt?ckxE&c=fuZx71TsXI(eSaZGa{clCm-coTt8CY-+zD!35_6xkS><O)zq+mHCW*u*
znTs4NZU8WxfGFz!Mb|<?$kkXPkdseNM7^urVfVSCEI(BCvvg5X9=;Fa%XS*eKM|!*
zKDhBm(GDvYACl2>l{;&-M?U?Ji1h(&lqhGE%3`)sd`O=S#-P{;4VnKy2?$?$aGX-H
zeiL{FMiF!l{^N%gKYxdYLE$g>2@8yZc;`d#nad#@SJk3V-QbK50Tzy$ZmI4?2Tl1O
zBz+F1m!nUa^39jaFj}?qa88a43!mwl*P(IFT3jdkd{H$V8Ok4m+vc*G2+^qRa&Zih
zMcLU-DdOuHKp8=QGN>|T(&#MUQW^&HEZGg_5p)60DN^!1RA`YSB|xW*2M?t>8CImL
zXNtku75K1%c{^_H#7uU*Y3_1@su}FZCG14rkhflFICbRrCxVG3m4%9q!&8oSb(kQ&
zn^y3{V|-1sW^`;U49+%Dy>|ceOK<9_ft(#yu|MNk+?F&+M=kB;bSx(eVQq~j7Tllq
z&j?5`gTdzdGWoPqWldb?I$8U`-fHfl3s)IfCPt@+hw=D7p}&)t4>B=QZJoon#%)~a
znKxB*TlINtX*rQnw!ZE%H8s^aVtOlH3Udu1Cs*s~Nu~N4sKjDpp?Z4b`PWaTb{ke^
zeCXqQT7fDskot9Su&S!+%{}^2RE^GG+D`S;baw!53M{e>=O2dDOZW*R4#<bF6WSLA
zMdFn|;yV&2q$>&vgxX)d?i0Efpv82;VFVJ3>%YqXu>m`}KtXYQTq8tvLJOomscueF
YQ0AJ@ChggVoGji0)kiAD_bmPY2m55lwEzGB

diff --git a/docs/assets/room-zh-dark.png b/docs/assets/room-zh-dark.png
index 1f2f47a2104b65095b37b651a4201878b75a535b..0ea23b1fe89c083d639a540eb71946d048943abe 100644
GIT binary patch
literal 78592
zcmcG$cQ9Ok*fzc*AqgT)Z%K&WH;A$%5k!mLYp_f7=zWDC>Lz-L9=&YzZiygRJqW@Q
z-RgC%vhR`a?|J5(`ThNxF|%`=J)d@$>%Ol02v>itKyj1)CI|$gP<-`L69l^Y5%|4*
z{R(h}#P_%n1iB4UeED44>&wOrX%?fkx4@Za?-As@&{J8rVv(CBijT2PbgcTrRY7Oe
zhfl^2mS#UVKMXneK=z@U;kwWwJ6k;42UvZeWij+y^yBGDE9FG{62`I7x+E?Pcs~Pd
zxH&1@B-tdnMA-Kck(4aho&*#8XOF#?b`K?Kfhhn#2Z*2leaJ%IM*sH-Pu@=c?^D*`
z|Km$mB$wlSv+=T8#LqN&Zce#RF8A9_lru5WMR!{AdhIowp*PS!e*AD9l=j`3Ygahl
zOiN3Lf=pPWkeK$%?>^Wu^`9{Dob_H&6`T2yl^Dhnu-JOqdVc7;4cr!JemTHxHz)Wh
z+;`t-R!Tym*Gan3iO?>q#^if6IeM?4z}mXd<3~`~`UgwaT)Xk|$x842@^n38)Tu-(
z90pt7&pbV|mfjyEZ_~IAyL=cggJ`U3$wVognW*&Br?fW|k|pmecWQHsh={u{AFM5O
zXUe=gdx~wHc0!%cY<mx;irCql4r!^)cw){mr}LD-DL?3Qza0IgX;~eRbi#OdQn~FP
ztc|h|nov!Ii&KN+hW$I!Nns_Zhsi`B(6a|o(b1c&7ojEPt*NgaQfP(@w%>DP{61b)
z%P%M}@N6a!Z^O^Am^SpQqZ9Zk0$Bft=U}lJw}mwLR<u-x|4E-2ekc?E(LJn=xdP%<
zk7o{|1D1g^=4FPjDLbLwy<7ivfJTSk;~4xRE-3;@c%2uSch@!S)l(_Kr-IU=tv-jv
z6b$1CzFWM0i}PWq{q)oQ21eI`;)IfmRW$;xm<O4&sphwrA>e<)LvFYmI)U0UL7lyx
zdb+dtp7LT~J00SgDBgV!@!M3|nE1-2Wo6wmnIJEA%t<5v@|gFwoZ@}C#-2v=i3GjY
zqeJ9MF6tJO&w5*XaDiIp8`E#F{`C@%&8ddbLNu_=$bgeR(oDZt@%c*CG--SVqRgOb
zd2%J=G!k`&%~e3?FnzP1#6?e-sj>Kt=124BmcC-Yt3zs4Ik~?wC_^~g4JM_8?5*a;
z#cA<+@uU3uoGu2<Fn*IzV6cE~r?W2CL7BlXbHfVu$IRvJ?=Q_qJ^FicexX}`R#=o5
zyVi@iWY;aP$-biv?>i3aM_xPKG8w6RvkyvkcPoq>TT_HV4l+A!lmzTF29};}IEnH9
zyAa>YJX1$NTpSD*=f|1A&$pUP&x>hVvue7cWPDcVeNh+D3M@0-SJ<f${yUxlr}&u(
z4N>30rr8<q88jB5-_26~{!wRGq7ZOyf*PMy_>y$whBa8Q;xo9dlE!?p91VF(Cf^PQ
zjMr$id|UnY#rE0G`xbF0(dsO<)1Tl$^^gc|FoUQ)Eggd|zNkQ-^kNT5Sl{DI(&9dC
z+dj+C)Ga*+obJ3IgJY2)9MzQ>H6_-3oLxLhYWC_&<m--sq$%a;n-7WYNMg=ssU$t@
zF}0f!CX(CdQxp26emfuC&*telpOeEfai?mfhBZEfi*u3fmaWDaq|adqc7_ZDl9n%e
z#+7ip2OrrDe*Zm%v+~xE_?C#CSzM15VZYBTyShzk>+FP#<8{WL>URtHL#(9uq(6al
zmY`L4{;O&bay*SXZtvATs+8Qu?PL<(GJGz*+j4?6b)5(yiyM?aWh9GbfgB7)iy5OV
zPd$ohHfNfWYC6>r`UTA8&+pZn%Qs-txBXVOW}4pmzQyA^JzMvKQH1A>o`lwO>p=<e
z@OvPT@oSwzbzRupEkDM$(;f8Nz$q8*JzJ?aI~z$_W&C{dLLyx{;O~#bexp?@y;~s}
zzO_rP$Cq9XLGAHW?>4cV1@}7jP0!*JJ<s<9gu<G4mT86#-xCw1n!UVp{1dETcG#=8
z@w;LHw?8OzY~0uI3y%0bz*0_hzuvrSVSMY_g#Q8-Gk41MO@qz%u*6Jt`uLCQpjhj!
zJ79(H-{cF2yiZ$A?V9R^HI+B-B_RE%9MqTE#fqZ(miDX%)0<o-1}GRrRbIa~tsk1w
zJ03>iBHP>BFI|(A<?M4!oaW>-#z)Nc*O(q%KQnPcKMV$|ocu#Eu|3=Be~LPvM%5hD
z2KfK*z&TT7J-7v33=xiimgtt{uctJq%`Gsz#hMV#O<qBPx#Sda+d{WqPL_@dMOS#8
ztzdR<8N_Zk5hSH)+w1RBJ;Ghh;4>0{A8^QM^m?!~{)@hAn*xx7Us~{!3Ao*+-(<Sy
zQ+=M2my^6Umh_p@eqP7!6OOaZ4cfer-5>WvF})bX?^>4f_WSYWQQEh23B?}#`IV7J
z+n72hvqM~$+KekDF$k17;$CLVE9_jM&h}y#z1)s$#fpf{x{VI!cDMQ<GtFTBn<mKC
zvpqh9)Y;C&cFnZI-!u$<e06no`{IJdu;dler0IwdupU>M7H~lW_qMPIy4D5c5gZ2`
zcd8BX?d&si+*b|S`RK4PPp=}p-(=>uBAG<;%_r*2V`i&3{a_h5A<DmWpg@5lXq35|
zB%ZEk{#!b0cUKoKwVCn)*NvW7CHo3C!CS!3a!Csc(mb`{hbEpH+_^3(3B5lh;kz{Y
zNyA~da~T{fHSNJ>p3~j{PkELTZeqKoZf%#y`$sL_nSwWy6wH&L!4*}Wq}!1?rK;G!
zLGxW*f*7>JWZ5FjtGn!T)@@~7Ik|;(GG9(@HZ?|;K0dfMlGNb3LUr&MbG+#!0=XEF
zG?Sk=p7BK0tl+Vpb&dK446Cw3q&I)zVF#-D<{m5Qo>Mnq|BdL-F<v&E;k|r)|EUZx
zw7R?IHvSicY%OL3Q<q691p@7msy^r5C&4R*&o8%c6qg|LvBad5m7pwvxB<5{Wk;WU
zNhx8MQB|>#uHyiltlf$UGJpzu1OM#(O<=T(Ov1v1W8)e-zIL#GKvcSZUt#0YZAy@h
z>n+>9GOl8$loLnI$Nt-=t6?%|v4AxiOnY<BL_7M6_V@|sOCMKLv0TC>G&z%<fSB-~
zrifi^*qNRh8i@YwT?-#|Yk_U1_7b-qw`|Ys_ox{v<ZBkGoy`!$-B#6?gnUg8atPZi
zm^+bjxc=bf8-L49nsEJotvEHp@u*u=O~FkWbC?g_Wcwt6Bg3nCuY*bY>>%^JCsW%$
z%Q_R%>$&x(A#Rq9I&w5kM*TDOx=?^-;{biRM9Z6nF2LW`Qc^|>1_ga*Pa;t}RWkdd
zs+6b40v9WgOuWLf@Bws$Mp9Hl$qX01(9OW;-O`{mlzV!#LPNuAT5I1t=3?;B4A&y_
zgyiwX?lxSIK5_~!i+^@7&(2YxFE}KY(mFP=-5S%nd5nR>gITA&e(=i`ZG;n(ayy!y
zd}x6sqjqKB=LJU_C)21?9Nd4U$#1ZLFn_N^uMFSQ+U@w;e-rM1?8|c6hpN5Rx|~{q
zA<SYJ>FLkv2)Ms8{>x?t*bN!uVDw<S{c)@#i$l{2i}YbQN^A-XzZpzN1Uh>GZmRHQ
z%0reVIW0|t!BtW|E&ECElTLvEA&g@9Disivmg<IwKVwc>FeN_I9cnWDVgc2j0*~{0
zkN3YDIr+DfnZ6R^*-z+H(yeY;h)8z}P$V7o&5f^dpVq}Y$Hm2o$jtXjDb5~ld5(sV
zHh0~K4lvF6RcKTDZh^f~`rTi)s+CZzCy=<}WC$3a4uzlx5vbGmgu}SZ4c|YenJtv?
zRW)SGGW`^8xo*2es%Db}Z?UG5)VkAU-6*BUBIWk(Gll_)$~e63U+?5srI^0B>D1y2
zK!x#sH;MBlWWZ*E0DKaMdx{CTI9aGBh<LU{w6;{Ar@+s7T@4@IK^-R2ELWb8GW&gU
z4{RN~k6xXgeVSZ@|G32I<A2b>l5>}i(mbI?xOK0cNuW-LEN?=~rQwg$8N$q{3g!+S
z_t|Q&&K=(2G4)vKrRu{RUts1XF?;!$Objf!(M^~=SmRDQ0&-FB9>^rhQobqfvbX~t
zWSnetXK)Z4+|v}CZgiM7L3(etn4PYJ6%1)#G@=f@ftY;zs%RfnlP%sDEL<HR_2pw?
zWyndKR!TTs&96e}&$g+G_hYOU`r}GUc(lDwPS3_?T}0iW(({C#6;_sWvf?rge2$=~
z1ni4_%kP&A)&sN&Vm#l6jV4bx&CU?;0<5H&$4Z~s?oA~Fzk);Qp4|nG@p2R8OcJ&0
zlu|pgjgd45t8sKp40T#!;QSO3au|S*g-{==&>8x?@)I(+cFHxC<KmKXDd#!G#)~BQ
z`JWM1u4IZ^w|;wPYU}HxJeV-E4VIEvVY~&h>4^R!M9di|1l;^fEkZCRO&-Dw0cS(3
zKz@}eo${W*3XIbdRw)Ar%QSy}ADj<`+0movX=!PHyY}%(CA*Im>y*^lPsa8yXNY@L
z#~uE_)uqCx8Eg*k^l32Xs{4#tK%<yj{5Vh(7s>KBEfFkUvFqjnsQuSdUT3=;g*i0=
z=RQ218le1Q`j+}<6V(o#-y}`(v1a~*O|lP9iV8AdW#3Mm9mdF<8V<{xeA9UQ2s=e;
z`w$kwsoDh=b=HSq{?pgo1#XYhob-ib{mb$zML)cF^Za)2QfxUEfWK#b1N%~Wl}mc%
zMub=s%V}K&63Y<nfaSIDdl+Bay|x=Q#*!1!W)-3msf*L`HKC&XWR&s+nGz=3veiC*
zRLlW5b@{#6q}F(A?p~8M?Fd_Fk+!X^OKh=zvuG!!q}NWC4r$fhI|4z&T^!OEyP3Xm
z?_9dDP9kCKy4m(!3v>eG2DzMk39@u+OxzJZhhq~%1qwwf8cID@`@csIR%+}UDxP3}
zx!K7s7vkE)aH&7_;5hE__jcutE;crTnSG;gv6Z_}x0`m+_pl@voqGb!L`t2df1ke)
zb(s2T@4F%yFmH{)jq1qK5zb{U_A}I`nP%S-I>vZH%FIw(opm!uEi7k&?i2}q9wrr*
zZeCUoQkpGJV_pZ*5p?&Re2F(97B}E0fk^|U>GykVTT9g`6Fk=BK2Z7}2qZ>FpAVD5
z1*j3b=Q;_drbPK+2k`R=Ph5uNmKPV3-`--6ZugTZzxvt;%}LKK0&;;$r#_lNY~=OT
zD#r@V$rdxL+ad8ylS;<BkDq6wZYVGNaoi1`nb?kbnKQ^JEi5UP)?;-hG;|FFO02wx
zF4UDTvOkPA!u7AJ`z=uzC37z4j}|S6gsy9B_9+=8{$2%bA`M9G4sm(hVZyQ70V|U5
zQ!%*Z%-Q!98K=%NCDsmBzhJ$=;;ouJ2B?%oryp)U%s}=mUEMpnlCG1l_d{4_0G{A?
zcCSvM|KNYP0DGY+K1gzkdqZ8zxx;enb%#=ux?1i&owxXXdPdr>SU2u|{7M9m$ItAc
zxUgH%(J`94?_a<17Cb$W@e6VcAdt$`yR7g_vqfcIT)>^+*uj=v>*W<KHD(E%R^5#J
zX+c5$nsG`mjfXTN!QzBwwr%xi;ckYtbtwcWm&_qngbs(P>fK}bAZMTc4ON{n>rDTE
z{bkh&Q{ThgI1YVJb#CAJele%%TGjX;AMa-)bU2rb%zsXOM~$6L&pr!7=qo|BIZpv6
z=QSA>HL<^Cu~-<>;*S+AP99#^6mi1Q!3HD%Xth-;70R5cxAi2VB>u<ju@Op<2Fvdw
zMVP2-eg3}8CDG6l2!Nuy_}`yd!-_5s0+Wl-omG~E@7D#`O^fE*o)1&PfAdf<wA?{|
zQG!}^?kx$xJ9$Ly|KK*A{IS_#%*D--nv-c5i|b*s_h(x#4v}!YR;C2}LaGu#Y%-JA
zVY1lnB3<2vuz~4NF+P?SKb=kUTA#1Wr`hK<!3L4tV!9%c8{Zdyt^WMTt9+ojm~^qP
z+?>-%9ch?(`klsxFwu%16KI|IJ=kY);uk}=@?^fZBE*dbyuvk{rtSYydVIHT_B0K3
z4ixs@`%CxBNk~c8Saszkb%j!*XKzqpal6xX+k(>gzt&^MRhfFfjj^Tr+!eaN>F{zK
zS!fdJ7!9tZOrQ0&;R+!M*SxgqQ6+;WWRs)0dA6umx3Z~JRehG06f^2DL|}3H{&c|M
z4B?y!b-*vl@)=$+4~uNxwfH!863lk*#<(m~K)vhAfW|c!Ak+CeHb5N%V#IAbBbIy}
zz2}$vjdF%R*2D#<c+S4-?ia)O?aXD9!VhxoMJGm17csUaBsyvg2z_uAQ&ul6OS=uk
zhbzP6e4cW5fMr}L8Z*{SxL|Q<U~J*viKQWEFOd<&_m_Gd{a!%8H;@<0dYFAjiP$}c
z&FlvX6XT)~w-kqe2g@8~HGOJ}pu31f_*r4c9jfQEMe)qnVcPtb0|ux!9Za5oDm-Qy
zf1Ua12>N!Yq2~LYMCBdNa0-+r75fo-Exlf2^G+9dq*l>=Vo>0-n;bcx+t;f~)F0iY
zEA^Ln6uMNtWmfFM$=b;#0r#JK&oVH8*6fvV+fghbk(-ZLr}TUJXtVlA>pbG(Y}di=
z>|q|e-Je_?p%TV(eabw63ugY92xCU_lL0e4^rrp6>q33&Yf|{3vs{6fFHax#C#+sg
zvY<+6W|rAmtgNWWoT{?6vDry2DX$*zv9`9x>~x9kl6bnYB~0LWneausFwbVI;b5Up
zd<`q31buPa3YVCag>?$3-&{LscQ+TdJZ@0JZ_DT6EW{rH;lKVjkuQx0EXy7T@x%SR
z=w@*eNpPonTz-j=&3?aFt@IJp^{^<F$S3moIULe!foVSG(Oz4UEHU&MlKtGEA3W5l
zl~U*RAQ|Gi_)|e<?+thAu*ZsARh9K1z<y!S8ygD<h^hNT#1c=wbw28_-|2jsrgi6U
zQtM*B%yB*ziIS#|egyDOxVQ&T_`b(ihP>crVQORxO{nU$C_ZXP)z!3xahJWW`lO3M
zYVz~MTRS$s&E6ItYtnqXv|fTtN&WJ*X{6{E;RMG~7zJZ8(>csxJE}qYkJ%=v(K$_4
zLN`V{PTblesCcmcSMJa2B28u2A~B`*7wx+dba_p_7xQrk?~@HobDz*gcApsOEQ^in
zcbJ}h)#eWC$bR+okL@s;t9hFAaXG?ob+9x&zO{5yR*m8OFJ}SNby7$awwal!264>L
z*P@8N>4>iVNXNEH=Hy39<y`0^OH*Q#*aO?ttB}aFlxK-?54|#NiGaN8;}b*LiM}go
z@qA5l6D%<0TC#hZQxy&_K%KU1*UdOuy$!F-7iF%{CS3@R<fy1?Io#ryJr0Plu70yw
z9rHHg(IkWEaif6$5)ZN->wd;gHPj^^eJ7daVkmPYRHvcLN84yx71gB#7{7=5s?YXm
zl+92U>4FK;pMs@#H5=OBEEGT7Ztt=Fs|a=WyW4j5a2OHrYw7|&v6V*#6uX4GSF_iu
z^8i!_R#Pi&eiO+V?uRhcg&{K1Acjq!4e{uWp)RP%v80P%-sj;v#nsxI&D%zpoV{P;
z4n|yL{`32p1!N^PF?838d-Hne>-wAy#K{rlw{C6KTV!`)>RL}!r9qX&7G3CNmNVKZ
zS|)}9PMhe)uZUTxgcKQM7wMwQq_dZoxpUUjC4D31)534h63X*VPi*8{TU<K#dRYhg
zYLh;8FZ7|0lKmp+m#TZ-8kv0$oaBiGz;{?bdZ08MNyk8!{*&*3@DzUGw^!Mx4;Dks
zb@_BW<tiQynUrN2SpJ+wy^@@ult(!3chZ|Z1b~A1Ok<532z!hB3B@gP^`qS6gPjh9
z+sIWH^cNFREukW0{w<b@ZGX(E41S){KqgCcJUPFc0s0DC6AaX0Lu3-+UVp(rWd|@B
zUnj0}7VnCT8>Zs*5&dB$Oxm1Pf5(C76~`dvSlXQA$Q`jq!*X(cpMKB{T3tE$nN^{2
zCixBs6x4Pd)*sWOg8qV=)lzw~oDg#NPH}<;x8&}*?3z{$Ls1?_K5KAAaR75jib~53
z%Q9xO@M5F*nv8(;PdY-Zo~>s~&1WK#b+<QhQNqRkfUikAEwS9xj>s7p;AI@GH@P_3
zUs-kQU#GFiK9CC$XtX;IJp^*YC+OPB>;bI!gi-jsx5;iWHfK>jsW)NVE2X?BA21aU
z4=*n-KYPDomiCR_lJdpJTqQJDkTN^NQD@0^$c8S7=zP{psh!1CkuLJC;(?nS9Iq#(
zi1P&!Q_Q>;I@sCS$3NBBvA-6$3RYrDbGQmFcsjP0L1|OHye7Uixso|uxm2mb?)!I<
zYn*6yHnep!n$qs{P9Kd|R_|{n0k{sd=?w4!KKlx5OD#VoD`-=vqAL{49izc^x~JEQ
z&oOdhVq&ms#vP966f^w8%&3b#)Q-o=II|M8I?nr3(zsBr)N-~V8wgbYg;ObY%8CnI
z^HqiU>F2c92-8+>VOoKF7j2$g?ffEl@XRl*dwgZe<LkTBN=jOBaoWi_jGeyVJ&nlb
z(JsRA{x)t=#xG(3$0e}aV;P^ztsu%Q<+T$@*xhdaG*)jRFK&Ap!_;i{b3`q8HZhhe
zv*qYB;zDkWe%x3hVLrHt{k5uoCNZJZi{V_2fPp(U#?zfQ>&wQ)t%w0|2q3{bj!fHB
zQy_mGn>OWCX_8^`@(#jQkqFB#Us9_F)Cp@~LgUJ~(KymfZNhI5!Q!)+s=Ut-A_hxj
z9WbkJBctKtn^HF81)~6GfE;gB#n0B+&#HtxXkD3Wm#sT?-U15J{O(_04CQr7d(-ak
zNFV9JI~teKDOIOOGN!!LBWp1}zK%kAg1+Sz^Yy8Q{yz*0)nWck+}24<f|Bqd_oV?J
zT>Q^C4z)c6d#JK}@#Kg|Oa3#&I!C`Jl*+wih)BC`1u5_Zx<5Zv%mS%T;zykrq1?Ci
zQ1S^+rgkjKqV_cffiUCzi8I3EmR6tbI?k$}IqFco(zd9;qNLjubvTQ$citZPq*WEs
ziPiIKS~r!LUB9C_De!euE&LQML(pnb%c{tiL59Z_I5mHE`28(oavyh3?d+6>u<t3e
zgGyyq3_D*O_K!vsO)3meovgtHsVS4wG8g=NlJKa^lO)lu@Lhq#%W$D_y#Q+>iTrjX
z<?`0)on%gh%@S{JV)gDkeyJ_4pH)@s%%~r=Nl}geSaZn})#cFW^pv-*b4$m3_L$mE
z9wZ%S_Q4C96-5<WWuE_8SsS|=uz!g3<!kZV34xzdMmT6w<fC=R_%VC^P8e&~=ioGe
zak8JTJvTk7DKo0u^@cKsn8W(qn~;_u&>T3({C@wFg!fpwrAnAAomz%eMn9}uUSaL<
zv}*y$d+fK)vi7|>yj2C@8kF+|ns+}Vw!oT8hfT;TJRBfo&sVd<%y2<z`p3hhIh5U3
zf?Ing(pI7`;WB`$$}1np7nK&5+i10X-xxW+BxlNvT^b=rEalH(*v=P-sX8Ya6V!fE
zz-RFfC|Q7gqtHmC^?IM4soh{Kfk$gh)feX=!x6gzajjPP?+h&BVv>CmQeL|jWYjL(
z6ApX>;|&@950d6Ei-0<0RX%COtpKDko+|O8QWQY<Oz$hBa52^y;xB0I{J{cyu7cA}
z%Z1p&Dfb!2aU!36fGbZQm%IuBVX`DtMpKlBJVoIuofaoMT3yEZ>5@oV78Xm#y%;l}
z2_PtpjZ}7A5=mz7Ca|*y<8^fsF`rx8(wDu&@v&=UPCjS;$1@5OfL_;Bvofr3tic!Q
zPUrtoAuamKA>D;)>vpS?7-Xa$p>JJ-ci#LEmKbN+J19$cto3OMg|HaoxVX4?Nx9nf
zIYzj{%5#sOZATM<0#UCX8t_;=$t_WQXjH(Hr}+*B!w<CwOL}fLE-j~_e6}Z2;KMYp
zCJs7Bl2pvRMi)>4+bw`J=j&nmt`p#UZE8RbD_Vr#o5NAFOk7jU_@faqZx}4JbzYV7
z)&OhmSeTtTfbb`qE>4>QcGJo9NjYQvi)U;|K_Ex=>p6@!d6q7C70FeH)xrYgMJWfC
z_7PHhJ4@5GCIKgjCFPBKZA7H>;`O)v-yU2`?1kbjT)mrk&H^r6GvR~C<`n>P$@3(u
zs;KxKSi%7>!?Bb~uBMAQ&~1YcHlfRPQ_H*0y?)dlJ5#W8Nn6?N-rk-<VG6&bLwpl2
zsIJO00I5y%cw5p)d8`F~5C%VsM#71U$U$x0UNQ$=kkM=bHiN`PYSWjxR3h}z`75JI
z4wKC%m3^<jNKL-MxY8I_!43f>g~q`TP>ulgAUQ34)Xj);24Fw`0xHAOa(`OY<e$+n
z%Kh|9r3K9JO0WPpVVToB0eHf-9tKlFqh9OZB|t&D*u-1}_KWSFv(|2g*$LiQz<Pdr
zFn_JucdMbmbR7Q!1OMBI_0ST`wPgSxdz*SfWicnYafb@@;dsvc{JfXcZV*lLTq?G_
z&#LlLb-`E8x+O&+5a(!y*-t9$%or2_DC>HcDqUS&k1%IP(@um@8L;6j>QoPYzB+6<
zesP(PfRc9xEgs)1HT?PebM5<h9ERTYI((%LetL1bT}KF&4)~{WJRs<yxi$Xc=eFUW
zL}$;-8?&(+DXz$X!;&J$F04I3)C4`h|M>asVF>2&qI!LvVM?Ah_v5=aiVXqGRA$&>
z+qcXI$S(T|R6!AxNcg7R+LPlH)<G#i{c|@-OGz1apSke$+G<!?HTLd~VVbUUIvqG}
zMaI*ZhCg+l>mj3IH}l#jOTGuFn5dhEWxUjg^Z9MU?CMY0@^`KO;R1dpq0aIK{g%Oe
zEoEjb73ng@#GLx=QGcnSWok3~MI_;on8(-2J7|bNLGrh`(iK&#pZcz{;^}_QJ5SFD
zuUQuqD)CaoFHTl)DO(9m9)RGpzak(g(6nC6V|JX{^nG41eL3J*QvNy2!!h63v7vot
zw#C=Ur(HE3&5x;E0`$I&8p5P?=IQJ)yx#9*&)sgK(&I9m$>2!gXTL2GRe>i9GPrXf
zR$uD9ghQikOTN7&*72e+yP>O&oUDL?t)(qCdY@{niWxlhw{L*gT=41BWR+V(BrFf*
z859uAzJP>!^!I^K@w*w9{r)7g){xqhPl8iFtwxHpBWj>yy*lvYa0C+2d58T^34r7r
zB_Qt5aDkukY{Bc4dDwk@<*_}1x>G%XLzgD}uYTHtg>3sAPr5qXs@>~n9p4SJ%X)CB
zr~k^vram82C5JxgzCngg=zVF~9N`+OApf`Gse}Eb-$|tDp4R*)A(PFa?1Ed2QeOB2
zy5(zj<E5>(6a1|p?IPogc~2C4!@v^q*I0VOZTD{%|8(_QF3Tw`w8}cucS``!R(V#^
z-t{F$W4z7}fe_SeKiWmrr^gl-UQCRR9XMIZlnDR|Yz1b2Hy4+PYm}V`%vmO?6>vz-
zgqCBmfQ5#YOlzhcJZr5l<;2{x%bW~?R}Q$b4*!f6o2_;Q<^lJCE&m9QvmW@8o|>Ul
zFwz-oM6LYsLkDp%@q*<-i5_z5+ne*>tDG44D$p~*>|L)fNFC_1{v>G~20ti(`;8^Y
z%XIz!G<*BfF1NWJVwSUXj9rtiZjaIbCE0`g`sg3ZhlYjLnpN!Yl_hc9y|H|4(*9@_
ztUxK_ZsQn`vHi~P)$dc8or?+71x59{)uIAvf)n8l-#ZeDKW?MZP8SVgTg~4&DgL)1
zLA<*O@tax7*q`!Wx5*hVePj$dLc3hE#kOV_g9D66JL?r2E?G#7Goi2H66|`ce-8m$
zM-xh$+)UEa)A$z2&~NK70jEuv{R|PiaY1m#|MXatuxAi~3*uUEasrL}1JmAYlK%LE
zZo<~K;d+!)oE~$9zjr;J;lD<RFPstDA3t`tXmA>FC-rGAJ;yH7ul{etNaIubO~CFb
znSIuOR}E%lJcU3c@1eiQE85#zx%E$p7>PQ~*6c@MJ<Yn02hnIhAf^-0))y)6(FH93
z+AXO5jdC@Jw`cdI6mw*_rX<hT!;F0H20!VfelA-?qV%OAIODz22Pk6lBsG9i*#XFO
z7(f9`I{X0iY_!1Z@s$5PMENOW_{$gB>iUUL#aQm{sKcakyW(Q*2u=Q^h)$OxZL4!Z
zKz2I^RBn&WM*IEc8oP;@m?+K7kJl*2Zdk*t0mPpHbiDvQ5C98chQjOD@87}3hLvRg
za}B`G4pNLvA6@n)fk4-JuY&)52$YunXM-TnD)|5LrIhE#Z;OlHa+_dN^VjG{-O|^9
zC=3F%`CrAW-A5B%YQ(O>8(~Ax>oAj-iYhw25t{i@UH>N8+{XFPrm^=)zOb(7k@}0c
zrB7^OpN1Mq+e>*kql)tGb_xR;I)LQfX~Q^^BHTW+8Qcux`YPm1AC%JZq}M9XqT^LQ
z!{M8M&pIyl?^UvHur<{v@}Q1UzZ3o5b!Wy+vq3*gdwhfQtMKJb&JFSfrBWFhqGWP8
z<cvY)%jBv$%AHasW|cHGmu(uLooHn>#}mN{XSUFA>zHRvex!vFnrNtiDik&<_un&i
zqC?`QBWF6-t|q?@Ub9Mm-hCS_k;l1YA>H)#93p(#r31o^JmzS0qgUbRa8p8Ofv>}u
zvXe-aP8ctP0_eJ+#AErHQrYXUP4IGpNo?;o*ptiaS9?3}nM(+jJJy5Bo(bBS6(u8S
z+ds;)T>kC$lc0qD)gQ^P5p>mL?WL+q7V{%XS3mV${_Q~^e+J3unov3$*oG{~KoZA2
z@^Ak^+(U|$p*=8%=Yn>mn*ZkYO!cXbBV~|5U!h@s@pvD|1_#7e;G|0LSxV^0AD@Z-
zBsct;s6<sam11~Qnb|sDoF<AWqra}Om=iQBa(U|z{Eh)PRl-`;8Zo8J=_cXqhTUW*
z@a;E=OSgk{uLICQ@SCdE*bDwD=iEd2D5sO9X=IB-RgeV3<+tmndkO~p|Ejf)kECg5
zFe@x5YQ)n14mBT7b*UJdEu4f1pw@LfF<+H!X0Kn~Kl|YRp|A8=zjbDYc^O#<Yxb-7
z_YRtVHgv?(QJr)LiCBP!IV}^oShGv{sQu4WW*?GG%y@VU-;vz=p*a4?WP&SA=o>|Q
z>9y2i?y{uISUtC-CwTd65T#)g)If4lW#X|o+s9QA8=4>kGR~wTKK{OM-rZ9Z%?ly_
znQ;|oT0-SgT=ziTfo=}lo75ElkKg#RBIxXfB{9c0|33poHlDJN=ZL<}2qp&xYs{~4
zJ8KF!7V){d|L=_2_T3b{`UEhuQ)$&+dyLN4VSGbw*a~O~p&QSm`_DE(X7xw4{YSTq
zpX!u9^$uOWjW*0S@GkXc+JMUV6aTZE9kP(Mqu1|f)DlE^XQ!`Rt)gBn<0bbWQx!GS
z__w5;(8Sm8j3m5C0NsSnNTluGMZc>B^)tcd<9zcU(f`+lZTq_WRMn(_W&#44wR1Th
z|BEKL(fO*7wQ6C2Ch?5nSgIgODeoqAz6JQ;BQH&0tvd-t)h>(n+1v<|W--f`HLS}=
zwK^JXfB`49xdJW}2nTeA9h<J@_ION8@@`aZUD^a-H3I*d@T4`s36Cu`h1oe4x<qEs
zi!|JCQ@$uor!*_=q9tf|$w66W|2h}X%-?e7zN&TM{l2f?`MSY^^*g#y{^90<amtG+
zH~e4FD{0!;LB$0I+Joz$A&6Hfu!f!BUPY(~s{uqF;vn=jJ&m7!0^Hf_*@vkT;iJ$I
z0R=k#OUXOU9oA&yA73g#jmFvajW`E(?UZa1cF`_B&YrE(UjfZM<rSm=7V91JwNfd*
zzr4ZEdCBJMY#6YlW#`UCV4178FN1nuoel|`f@VtITPaylVvzGql83-HdZp>`mn3CL
z{OA@NXPEps)OQEecBAkTzj*!rWx*n+1eJR3PTaD>XSX1-ElgeYng_5jiQvn2wYfLC
z;I6GaVSc(e1}iXdA^rJf_}&q0-P2DZ5z;M6>W@mqbEdwhF-E;PwnH{XmeU2E{yQ=+
zT4b_&lQB$)1`?OJr7%n`^`?JleXOHoEtRPLUkVD;+s*&j!j)uT8~W^iKQQEne?vMz
zc#_^7M!?4H#Xuk%;(zPXV-h!7eb*3GLU*k|Lx^}n5&~aF|DkJyfwqF(FU==QMEi*)
zi1}bO+#gZtPu`ZGE_69hHtB+r?gd&tWd*PW03V-m{5wdg@F4a622=kJ7eEwq=uii$
zQ4sR`rx&18HjSvC8jA5xRQr?2Qp<%vV(s@NfNj-#ys%ZAOjO?=@qP&_KVHsgD4t5I
z{6WBg8DfNfZCx-pkSQtRYby-y1mP(z0Z7~C&EnS+`*Qxf`R|yNLk$S(75s5}bb&lQ
zvDJ2C1DiZ`h#v~;OmQFCRx1PC&Q;SKzx1lGNW*b+DYA{_;6Ukr+w9EMYk9xx=2oQ4
zN`B-DECN_oxuNUQ7DZF;-V3uY_FSGG7aLYSF48iY0xLSI2`|N&V<@^vk~or(%%)6a
za@}#3b?i<J9-B3Yj6cV}CJShv$^1K;`e9>@Oo4{oPT#M>&Sk^6pBa3<x|GPjVwnxj
z2R|EF@3|H*ps1+&Ymt8%z5QGt-9>HgLDITJrFJ%gi~J&p4ygZ~N>hEUy1cM=-gEA>
zUd{#Lr!|2W_4bp{Iw#+7Hu`%42vuq28sy|gX}Xw{xN9tbUo1i^-C^{%eD7NsaQ)wl
z4oqG;c~;mEKX3|dCIc&f(t2Z57wH+D7wzYFCa(~$HZbwjq3pYv;(L{BPb9-or)Fvx
zCvbuRJ6H=Naj?n4c%EI3y(7L?Y=Zn<X%8k|efSSj(4_D*Rv$kb)$V$j_I%sHpmnLB
zc2=GN+%PF1bCh7s&*<R11DI+_dy87SKfX`R@3GFS(IX~FN6gd4_e2Lb|E<kP1)VS>
zjzq(_7dX=(IF(SMgCCWPm6Elnc+vbSu$jzGbjly{l5IRilO83~6jI&TF0`UW(;Bct
z*cFG>ZF{Xb+kYfFxccv5JnGqN2VcJbS^48O9KgMhFMP9-?x4#dX*(PHqQMz6dJI)I
zkaTkC2%U+hOdjl?@x%q_Xvu1>*7lkG0QvlDb8VxFaf4rdAXnOr$X^9&cvv>?v?-;0
zFN}8d`iwl)Hz;wR&BCby{Ap4ez>82Ylow$0<-o!z8E5UoEPKI7L)XW|tJ0VI6L_&e
z2V2tr;2u4;oKfyAmHS6$+nl+lP<_0IdnDP3#3Uh#&1=YKeM4(d4T3qqVR>#sb(POa
zV!ptaS3@k(QLb;qe}EdvAr3$U!AFfK3-m&hs9U4bmaV>6sR$#X8KV-47RtjDA{p_+
zvMh~nCe}^d%GRdTUT;*nN~ygYKgt!IT_3&&aI${N`nSv))_eU6j=+JA-|syR%v8-w
zD2ftJZ^h-{lD&PZ{dMAr0`0UfVm%at=Od-U#nZaEAzn}Rr?8=PfurU64Z-D^Qm%q}
zw$h|~_{aObx|C(oV0iwnQUB6PrnIM5ckkx3o`Zs5up@vwcQ_)f4qk}lRj!{eGhfh)
zhCBf>gqS|QWS!UUwk1jmr?Q+_rbsgPrLRj&?nT!Sro)<YTD-N=xVGN<Sda3{TYP9(
zzqu$alfGoLhlOJhksC!2T_8rCEq9_IjU`bi;%)p;ZOSD14T>x?ZtFMDJtg7goy_Id
z0^zPq=aHKvPlAHS5x~Kat&xEnmdO;&%t|O&orp%NZ9MqhGuB}p71{2V*xTr=lAZfE
z=6DV@Q$)gkOv$dm{T4Ns(9}P`fwLuy-N`*g10-OvufhYIzbLb8NMZ~`>SN0}U}{yj
ze)FcLXFycj?Q2f%5CM3VyiF!CU%1z@xyPtX3u5_a_Uf1a;Q~;123@#K#B8Jj!%smb
zI^r?I_NaM%OL-qBenlv`9N1a=6*)zBba-T33YkZY89=<{=FnBWUw4t5q*~~CM>3@9
z6>xP2QLJ6-@?@m?Q1qH8xQZ@pm<PKrH&gu8Acoh`+>kzSA-{3_r~^_XOcnu~i+_&;
zVUqg>MIbnQXrJO}i|RCZ5Ao>c-)C$o{1!`YtJHvbW)^<Qe-Tp2XLqkuE|QD?d!LQ6
z+L|CAMcX?a2bopq=S%a~p&D;bg~?~5^>a&&OsJ>FH<>x+WOPz`mDDTLqnxaiPx80F
znl?lkfvfQv<7~;$NHP<a-0Wm3G+-X(#^jqCzI>-d^g!y}xnaj^;agOCS0Hy-@lA`~
zpE5*<J;@NoxbRT?Q0%*&i&F4}yfB$O_=Pezcr2v>tQ!=2HQb5QHm+K2x2T6m)G&|}
z|9v~2GlD8}daL*Ir|YmGaVhaDxb`<Ing)-1VbKe8$c%>>Cx{0_39t2*Lqu)DUK^45
zQg1^ePiaJHWnLnEoOJ5k(^(wPa?=Pycg|W?yE^|Ak)4%2+0RWTy{fT9Kh(v;zPrvZ
zZU4rQ-qo9#*oHDh$nMll&SS(q+Ua9ZVdZO<6IBMVQcyka-C=4bWgsh%<fOL0(S5?z
z1{a~fFHBa1+xL%3x3bZjUOB$~dF>!o0Lr8|Cl(#~AXP|ZLhk)<%I7}k6p~Jb0+XY2
z6j5#YZ-eM&lVLFN{i#3ZLB(q@`vclEW#v()%w4jl9nH5!(OHkpAkI$x=hyOnh~;G4
z81RXCQQmLloDs3v+l{-2sD!QN?nKAB>_U~eKZ`IC-x#|4MVSaknwd26`2NXy!T_^W
zYQxeVTV+bgtDx6%T;amW&ybw^w6K=~74KXO3Jn`R8`N9o{ATNW+nBX3pRNkFb*wHM
z4TZgYP2wmR%5l^AMSk)!gY0m-+rt^$T;`YG$5Z%r^uX<xcuqg!bQ!>b&aTgSHygtW
zNG-!~r%18VJIJ8pkk3s~2heyFTPxrCBQk!xE^p|da!#^_6}Z?I{n6q6Y~jy*I$v6l
zmwIdbV8Z^cy1k$I<PYPxJT(3N{*Cy)pOx>SZjiJzEfI3sQ2v{HnNA>?Z?GhH$pizI
zJeWxgQvF9(AE*0=mweoBZx}GdkIjF2k<|VvHNGbKYlxicEe~$Hz`L|#lpQ(DaR(vW
zrus}bN~+)Z9b54|TGxEWQAy-A(s1I6-YBwJnagw=Pq7^PR8f6!a^MYk8-Ukv&-F-!
zbm65HKSyc?Xd_@I50Y8$u00~_DixfxNqN6G$M$}$@{U#i_PRxmPIUXHpd4^xVOPAU
z_891ojfKbG%3W2g!i3z5&lU|mvHpiszQ5_ZpWdd^7q_`ur3Jo6o|U#U!W~%0RHWZp
zYHh2#qW%QS_&D%WR`*N32K7Oq;y2o};jestCWAw@$I0S96dlnf6&B}fC^|g-dMo*w
zVzEvHXOTO(s&PBlpc=~x!?d1#jjJCtSYcrKX_o^}-Ed8DQMYx5HE0IFd2`;7WE0&^
z<5d;IMw9^8FqV_#<x5MOzv@3<Sr9)IVYho@`SOu)AkWTx?tL_8hK3>YO)f=)$kbf<
zlzUgk$SoN(>7H`v^)jVP$umgmZC1OUjSNS5^g?qUY#91qb6}K)ztj+FCvPMJVqnLu
zV}a{qJgGw8-VYqI#%fSA+~AUJW@op(d(*=7!3}g_K}yvx`6!E2r4&^|V?-H+_VX9U
zL^gx%qhYH)oT30RQ<BDvHVV`ib4ctfH$zEMM;Ne>WtCjI8M1pxxZF0}$flR}0Y~y1
zG$T`zppX0Nm3#s36!ZI|ZZ~1^<qE9wuW|#KY$4{P9BFSDS)XE!*Z+WNVn(_E+(#cy
zDF$gBqkhmwnz%jtElu=R2INWH{)KSRoDWc)FpH+^`b-|>D)kRXCBr<paw*Key#5pY
z(AielDpV*+<ACetTkSK(>vS{13$aQeBEud#w_b?KzPa5v-);^6Y6I1{ZCbq~r%G8H
z0dt#iW6b6JDA4Ff>0qVYz#?;c`#(rPiQOK0e!qV`n`69ixJ{OUg5hyx;n!?R-z;_J
zNF@mfD5{fumB`%bOEId7&i^fE(sQx<y&>DoC(;h3%%+F24g!uoQUa;z<)dFKM$#p>
z^b;8iqFJQ&W#u~TVur|oWz3Ezy^Er_>YbYM^Pq6}(F>+qJnwSfhjo4GzM_^NTQoTt
z!Y`y4$H4vs1*_Wq8l_D#v%j(EieMz%aIiP3sCg^8;J=@i*k|g|nV!}K^noKXeQ`g~
zH%Nx=d9^dNmE?~o^|yZ*vdkGaNzYKJ`SyX9#9d>Umwh<oZKL|oRXLjbWnHhjH(}7V
zc5C4PpJ?J>+U)70^gk?#FD6QxLMsh~W6v&zS-$QS`H;d7!+jZ=O8`*pVB};ZULRC@
zocV`<`>{Ztr3VxhJ70r}N3R9nIOVZGa|ug$)832t)Z50aw72}|?RwTE@7Lug)kd}K
z{`X+3WOS4xu|Sb26L9fn*5+OR&U$9cmbFJ&`LrxS<@{aLL}?4&+7tD;pfW52zWAo<
zHt7)9tNiK?h&7a})aFA)L`!V73prJl^d~vXhLysPRGHbV2hVbpgWf(?<t%(OHpIQX
zWJzdl6`kWt;`rQ~Wz7t!aN-vujBE<rQp|=JInGqLbhm>^0UT7n#-Nl_@8222GqLfv
zjH%D|#CPy)ZnDRk?wQm4+TFGmPDDSA0EK1wJI6*Z$NZmHx_(;5Qs4dD-KO|PgEF$X
zxGIO8S|{R^>;|CPOZnB#b$W?r#B1;b&q|7VZ`iMIl%+W}*!zuoxoiMf`{;YW7)z$a
zI|+9fH$*%sO{+QtRaD7I*&UWd$y;!9x~n3(vVP~q3U~!^folkJSz;t!6_>KSQvd7Z
z%ksc0prm-LUZi5~^U~suM#8rZS~m(v<KI~7q*W@q_jgl^eV=A%a5q8iVu=o9Ym?89
zw2sRd3_O=o(;4K&KIH9;QzeatV3fxMbtc%Je=Rl~V~`d*Jd3l=kOF%q5*^$CARD&6
zLA{G9t?*RyQM%-ac#4xLJIyu7Ba2^;4z#s%zLy$mcLuS031vJ?c+c=96(W~3|64F&
zfb(k^y&>22E~k4-6}`{$*QO>LsyM9GATsA?e&+!XK`p==UUL#FuH^%uZuZJ(N-uzL
zAibyjvYqoY-HeXgOX1bvk6$&?YrjUE816>7OPxpky@&mdr`AW38$<bJ>IlCq-Lkbs
z@3PQ+WY2X`xhtomMYi;!@l!@mzc6S5Kr7Bk4LQD+fkHv=8k2j(kW1c>w9cs55OzT(
z?5F4OkjH$y6*=6CA{r$ht<QY8%XX}w;I9-kuCkrHCW!0nL+%s9%nHI8*NVuEl_w5U
zHpoqA10#X=0_%VNFg8dqp0fF@X%KuTO4<8Knj9O1-S!a)e^A;`hw!5!@8XQ2BwiO;
zl-ZdcIzsmT7`3SIO=Nh&z`zemfw%lLCi=;<J{<#CC!0ee(9lDvuq*Y~THGLJznW%<
zGWT>CN-}FEf`JBb6>6^7wTBv(pz`~<>nVjR+7+c^n=dTS8>5FqVdNcrA8m`e-ZvK8
z2DNd_xJkUY3)v+CF}}Cf1l48jX9M&^X<y-bjms~u3cn@&9|OBbVFKfe3HH<?jq?v<
z-%l$BNk1r&Q~k*kTa4wF6HuLqip($S8Zxp(to`Nu^TPXWR4%b*Q7?%7W6n4Bw~N(>
zvb!t!eO2NP?9+>N%sRq5Ib*UVKrv^roMTPi2Ho+yId}7{W?j_QfG_(a)L8FVEB%kE
zTdXOatD{fnW~m)u2p1~lxc8?TAT5zHZP5sm;_sEvveIxgozx89pR5nH?2385Z_Bg#
zY1}^VrE;Q|ioSQPq8yf26&8hd3K>K<Od-v9^q&+3x*)pxTN(O9c%&HLw~|oSJ%@nw
zC`DcNuTn5m$?-BcckU3)>Odmsjz(l3Jv9gML{76dw_QYWqLREp=^npjCpe#qsShSX
zuFyH(Y4)dvc$w4geNPa5>|?nxtD;DjshS9b?Bu5U{<iyy#(oYwcTtP%px<HUBt!5P
zgXF??Hlc_&x7aK4a5Ss6_S8w$oS_0iJVnK(ygW;>rn>a!7V?ix?v6D-I^5#bw^lO9
zBkKcm=Y~X!WJi(hi!gVg?bs@&5(BJBlHM+h+@*g;1|&v2dOc@c$M3c!ON0IVTL>5S
z&A|!im@84cF<!~TjPu3~l}}?q+=h1Phf(EgojEUPlx&7Ss_d%lnNUQ3*SEdvUCLCX
zINU7%g4l*Ai0)aY4*$-SY2T0hDQwZ|(_<A;hEF0Y+{AU+f{Fb+#Z!COYn5$(D-(72
z`Q64X<A?T6giXHR5vL{#4`Q((f0Ux-^}<rcwdZy>lDR&Ks2)&Jo@KiGGUh64(t%ky
z6G%^up5(@rTD_uplOpUKr)ki?L?!nY^+DOX^@c$omw#cJ4mTB5<ICKK5!UEF&RD*#
z8_pzz0L?@4Ja8b%PBZb4n$7|(6N~d|hIZE>Ow@!}u{Z&U9chdEO57&vYzglUR{pG7
zEd+&mW~&caMd*|%Nm=dHf7Bj-d=Q;C)Cau7sts&ekqcvP)fZcj?a~YC{<~e*<<UIE
zG(F1+eywQ6N2z=cl}ZGockz9;61kM@tU;?4RXgDY^!~@8qzfIv74zBk?s4ro4e`Te
zF2K8Qua{2x^ElI}s_>Q3Ufd*wL;wzw<5YkIJgIScV&QtYg5OpU7yWEm4!n0K(9ZkF
z_71=V0V{VEOn6t>mJ@5Jewx|;M5k|Ax#y*V8Wf_7OqM0GUuYEi@vRGYT(H;VcJ?d&
z9Yn~)-Ac$Bjp<0156rubez5xYb4bJOaGUz}mgwEOerlxzN!L#L0%M(SL0wB5Oaq<e
z*~3ooxHHje>K_Bnk|*i9zq!XPAB`>uYtq##xBgBD@_uPmT%Kg|P1>yCEB77M#1<jm
zZ_CZX5p)w9#@$(b3=`3#B2=`9%+zx3tl>I|yA$93&^@EN3f^fb{xkM8)V*-sfBfur
zU+CQgF&3%RH}3jm&-TYM<K7iL?~w1cO!=~2yk>Ri=5zof7Ak#2v6UO&bZ9|D71o!^
zGfu5VHFmGP6vjPW?-8Xyw)%n2kt<DACt-kH?V}yidE4$I$R7yt((U(XpbzbWz1w?=
z{6;OQb>SI8wOn8MT9Uj~5d|rVDu^s`>3YNi!4^qM6-Dzm8a!`dBOk*KHyLahU$Qiv
z`fpwvEVmEUUgo{%FYSeOmImg~J$nqSfDO_0ZNOV7^w8wxca{L>TxWgm`;9u!ZbkZp
z(=5u97@)56E`B!G)!~=r#**L@bw#dazgQB!3J$z^9X3bwKKjkv$HEVj&^h_tLSyct
z)bWISTHL8ULFEVT237h`7Q@S<bRaUHdK*_#)3L2x>}i1Z@!$UoAS|$s_glPvHcXy%
z7YIf7p@Py(WI|}Tk9dqmS21)>H;0q_)`ykR$1ReRrKomZ`h;8!CtmQ(u}&YmwI+tp
zGg`f?CAOh2I)%Dvt){+J#yIrxzco4E`5@%{B?_37MJ3xU%9p~Eng;J$%k82bZD`dz
zWu{bkH2btYD?)WiwF(@7?1S>(u#Be^K!5dcH0Wy#Z*56vkBWeigQy=SKbP6f4!>?W
z1Ti(5rM{vN`yspil{C_7|EA^Z)|dxJxyFn)l`Cvs?Y$mE{LSN$zD3!kPf+Jyw|te0
zxcF67z+pYAU2i$_a;?rKpH3cpMIT^UCT@3KahxvZ#6CpUeh3Z>?_7MP%}+gMoW1eu
zXBV>!PWB-eJ%u-PtkNem3||%TWJ!oyzoNGEwbEK_2EV%@bKWbMA3G~?X&>jg>0Pu7
zZ>%|}4S1}zph`u4latBmWXnC?SGC8Y$>K&qpjGDLt*#tx$Jm>4HQKt$kDaQ`6Rfz{
zBDFc=S|;gGwn21MuKI)>n_qX8pe3YMN>GJ-$y=~Z_6}V-V9rl0b<O*BUQ(Dp6Aa#Z
z!E9%L?j@x@X>Wwoq8p7~CdI{3n%<3m<u?4JMPFA(j^}>O5p#!$|DV1}w!SMmJvPDK
zx?@+Xq;n*67#eII@Rp1Eat(LYRt$Y!6Shk_98Nm+<9(c;LUg$)JfFHZ$P7iXLT<gJ
zh`VwRsXrThczmz4)Fz@hLD|+|Y?IPWJ3Zha?Tt#jl}6%Kje~i?`HRH9sc$}W7TlsQ
z3^gU<-c}9yyb(%1G>=VNX&nSX043pd<uc+SqK56kWK=H{!qWXS%G8rN;5kd1c@$NA
zXY%BV`e<^o?M*om)lqGe;dObDnz-1MXFcliFQ4a-v(vGd2nwy<D%PTl7Bl2Z)gaFm
z^yp!>RIyZu>-WQyva~JTMz<0Dv`o*nKYBmmaK16C#Zj<_MvNo6kL+3UqI*twu@B{F
zG(?GIvX!Xh^3_-W(upq#^uo9wKbiSGw3@?^qQVvVrk}RI1nZ+CZ?vjwE6<0=)W0>>
zVv6EdF%ROP4!tETT~pe1K~&Vz1A}1Ch(Ht%lAoV`>SpvjF2gcEm1;TOd9t4lneI+Z
z*&M*p>M;-c+#Xr=tNwc9O(~4z0{WGkRo&!nUSWi8JXA_VOm~b2L&3i3jz*^R>XQ=F
z`;MRFvb&*4=YS(%^1Dg5r!S@+m~EE{tum@ZXefSjp+s1>+<1FUl{|9R#+h_3J|{Hq
zQS<*H>b>LH{NDfZbg9~#;6=?6TVfW~*sFvDv1%pMo-L|IZDP;Zd(#TlQhQd!E{ax-
z3aYItT6Fl{?fdt6{Ql*>bMAAUbFOop>v}$)r?N^WdSwJo`{lE<`lcTZ=JJl%WvDAH
zKbqb|enpz+a3Tu|6n8uqT49wK>MEO--`^ckEJh-Gj=Fsj+LTnu*RIeyF{;)9)p3KG
z9EstZu;nRiT#Cf6j(%=v#2>iyrI!q2AqmDxhy71SfEjI#5_4}f;FGAK)Zn9FV7P*k
zW={l3wRDUe;c-^p+?&Hrv-(`D&`Q~e9u4Uz@{TyZL_{O?vy8jZYO)K!T!YZjJwOKX
z)g<~}(}I5OB?z-1aZX2&o9>2Ya*h42+WMHLNtwNe+o?gYN&?d*N|npdT52KL+%*9%
zW5X>~mMIbs&Z(%904a)tDWkHlu(732^i3g?F(`3{b-nM4dDU(lRZl_!p;Li>?8*K=
zcXp)TPqMKw<;$5r-uLwhy&2&SI1<`;XD^Lwagug*e~%GA7XlmIm+9`IQ7l(%*`|L|
z|I#nL+7Wv-2xM}`86R(OqX1#=^x02un||-@;BqZztC>>Ie|XwZihdf&NL{ku!kYF1
zdV2(u(fRq?RwMOi-U5JRZEnD4w20Pbyy|QO2PU1qSoz~RO!53j&N-LakL@xCv#R=B
zTe84cmYQYd<C|nF`JP7V@a6Si)Rd)PAB($tn0DU};$pXGR~QoH+fqzhrx)fw%*rJ%
z)x&(X!AJED2K6Z#X2dR=n3aWchJFR>V=w`ZG#LSU4TT<9oHyxmh%H0d#la^H7rACR
zgRVRVU(X0$ab&1Z0Ydi^mM6bUI(pNH@?rEvQx5)arc1Hwp93B_ev#fYj7qEiI3oHf
zqEgQ?kTbMj{E7kQHSyN~nRD*b>=+iQ?&P^%bgTJISL|sP%As}EYTjN~Q_hF}a%<_H
z!KjwqsuBXRT4ujyUlHFoOKUif`@=SVbsz?gR(K$(YKnLrijYxuODY$6IzKoQSkdym
z-la&BP|u;Qpg^}@n!LV4VD>kjVy(_&c57cNk;=&=#M)h73rrMt#sy<^F~y6kx^T56
zaog9+)`<L$(nFp7d2Sjs+EN1<6?R*ix|xTa7{pO=_$Pnx^LI(FMg?Xo-nhZwix`QR
zjof;%M6Abjb#=k{!Yg~Z2RX!#Z$q2iYWku*H`B$utY4mMCT=VXOii@LDnH3M;Lu(i
z-7aqTk`>5HrhoGGFlzHI_D%!My`x2d)90!mc_GLQ!AzhEkv^Navcd}e@~Z8U=zvhs
zt+U$O4o#o4tw2^W_H3Hnyf0mQ=`>nCS1MK0U2CG!5=G7I<Vz+lXD3`%o(t|<dA9t@
z%AyfBbG%t28z7OOeJ^=-xq8c2Pqw<?ruBLoKR!n1S+ndpO)8tg@awmQ^;bf?D1s2?
zj7gjeV(!ep|EqKt;;**+=}E&?YB7YHp_B;O9QShU#$=Cw(z$(hNzfoNNU0Q3&sTGs
z{(9b(qyhmnt614PtC<~sS7M@-$Sm(|iMu;1PZQl2grwe;T~kid`ry&ba&4UO_D?Wh
z_Auw$l~WkBfPekf31MsZb*N;C6UfeFVYraLmZRqlRq@aXxcyk?>k{nu!d)7yf8E<3
z;i1uipC)rtA06%UO6I73^)rTXr^Lboey2}`PLK;c?)HXUpM73c`;$_MHU!i!t{!r$
zh?IUm{2{yb;E(5<ccoYj^vg=8<w_*T@}13FZ0w+_MWYG?-Y;ML`QgQnHV*YzmA%^?
zjTzS|qcjH7UBxqtrNnH5Pr3UTJ0(A$$|B%+TDeS1shI`~(y_{cUMI63XTYV$=<7#S
z`x`Dlit87<-(}$R$brY3(wP>rrymzNf8@(djUE^-2Grv)--ICPGO4A0cESd^j*5ap
zj_a;4=W|cd?1`d>eQqa+j$W57f<EKmH$&l~$x1{5h#lg_UnP5V>RP(*Ky$GHQiD#e
zp4Pc+1z>o>xpL@#{Mk3_7UuPk!8LIwiBCAO^5aHZ3$0jZ8<`4AHt^NEM+70;0P;M=
z7xIVaU4;^+DoLZ(L0tzl=J<))*!wFZi)J&8QU~IA?)c%2B|}aDu6|Yhd=rzFpa4&n
zksWXDUhK3*wg8=ey{Uh%?_8I=VlmBFk1BQ35-kTGZ9ZK35PGKZ%y*b_uY*E>!y-jn
zBtzz*NC$qsNx2do#kJSHel|@0S-dk~j3OYbO<Et6Z;RB+mxz8yBC5;6<zP3x2jXNU
z|C@VNv8;lc=XT5YE)moN4BryOUogQ!1>~h~0pXdAxWm?t!GXhd8ca)1`3t$+acS4;
zdM@c<Xf&+$YCq}u89^P~P(rLVX~%f}EHTFD-c+!KHM=Ap(~*-kEVbCf7U?1ijaeH{
zt$Gj;vAI^Fy==a#rE-Pf{bQmkEnTU{LUPKfd<?v7eLbC!@e1R2da>SR+8tvnVk&6H
zI7Y)!v7^Pen~_N(o>^LEJhG8=k4Oy~YWvrC+?i|z$rPIHiRSWF^l6dnB5N;p;TEo!
zp~B21J-+UYBe7+&*XPjuh#$VXRZnkBs@h|qVVP1&6XO_jY6fL&v-DDKdNQAq3XJ=X
z$e4{}!MKa+&DShl(F2wUW@5<n%}{$>`8a}*s8havwoA>~P?!^&M!_8x{;T?KjO>@l
zFEs@HE}ZtYWH(p2pD{>ZRMe<P`-e^BNEIQ*#L`W=dWMKaL5Z$6dUNr0BunpQ?wvQe
z9@@@m9&T=ch+Y|#GquISTEtZ*HobbuiKSbJF+tX6U^XpwJ*7X|p3M7OBFooc9P`cq
zlTG5Za=!vw*q=qq^TrDgcZ7;^C(0>C%v#I`X*Jl$JAY`wEWCyG^xj><;cbtZ69jGb
ztN4Z5;AMTFLi;;{P<`i+ulfXz3QChIzZU{hrDZraZc41$%o8=<Y@Qu6NUQjyhLZ%X
z*CzuNGnR=W_bjDmq?>=jd_B*Z4X+ux%105-jzUmXIr8NW&$>+W7`X_&bNy6yx$$`%
z>qy!Vh|_xc9V6ewdj`_4(%wOK3Dg#Wr$&|<HFdJ4t&lqz&2xtb{I=aZt^QVV^AUut
zJ!n8rh!FDNIB0&iS`d9_TBukAaiz(UwC$h2fTfC2pGp4y!x0T_MoU|^4s#G4L7xe5
z&JpD^j>q`t9S$e_7AQ$;CC*&~$jg&!I4z)@SNL!tbOXKr@}ogH2i;hepA<wQ%6ftD
zCqc{VAqR<7xZ#ZK|J!PTl=AeRy?v==`MF5hR{FHPXz^&RBDT?DXAkXc4$^o}7va@s
zsl%%weJGvFLVQ8=LmMPz2hs}-O1NWgR<%xjDSGj9;hE|rc1$w}JGrf~risuUvVJIN
za#l|54S10f$h{kR22pq+rj%)nz5R4;8A4O+11rvtM#a`e%NB{m8uB^)i4JxI{dUZr
zNt^z4p`X-XlTEyH$Cg0M<TAy_gv%PWf>FP|^gOHS7iY@3nu(~W=`y}%$iag{$U8Lw
z*>bTOJmStv&&|DeHVO@GCK?8GBKml^RhfxMc9QEeUXgmqEL<3mTH!5oG=r0_Bj}5X
z+%)60i3$di%DusF4i>*9R2-VgBt!?U16Sk$gd@gFjiZ?pOb1Uz5)Kc8-#ys=#E0hO
zjE{kTHY{6zM##^cI9ttYK@nPF-9&hdcRKAL_?R}+7MqbqQ21;>f1Z-I14-&PYw(d{
z(sn3~3{Bs0J%zF(B>(yKyx`OoQ*Z;vXdX_l8Ip@;Gq3PceBUUQIpN5tq>`iSk{HaZ
z>MgvP9_d^_e@P#+kTDm=PYE9y!p%KMzG$^nTg6uyTwKpJ@rCuBNJ{Xd-!fSPpwJOc
z+nC4{yGVPo(3gA12q3xQ6wVa}16<I?8_jlK`Muu}+WdMOUrofzG-dJdvJam{^$uJW
z@stLpKfB3fDzm=<0ELX2@0Sb9PPFbvM3a#b&D*&AJedo6(2M!_*(^W2EZ3#Q3XW>G
zMvqt-srG|flI<&d(Cvsi*T2nzy)5e*s|`kEItez|GUNR>n$7(eZiw~d@KBF!yz(iW
zBqa^|3Ey2%4SdW)r<Wejof@OnADM~d>5i=c5P|52JAe$))w;&S>+$QlS(3l7Xi>4O
zS)@SiO!fK5ix8IVVWce*RxN#7Zh*u8mOD#1>VgxcJt#6Rn(Rl3U0tg;=S4Lp;;CJ7
zQDu*L9%W1j7i@*7<hPiL2*$$Gon=kMAu$9~ku15U59$j1|CbBs_E)!6u<~=qeJis6
z)xh<xb3*KJayW_<e!1sOo=FRtgWghmQdWwhT`(X<!%tCAo1c#gOG0QfS<gnzgx7i0
zrE!-VcpM1NPvdH_(tl7hF}*heuq;D3nZ!=UL7d=-%_!08)9f<4#@R&>SK9R3YyG54
zZwrZ*TG?Y;Te6du4?7*C_r_gEs%k-6xn<5-^*4k%v$FUxFr#@x!$oAaX?FD-ZK6Fn
z+qdA0<4Cd>tCc37Ah;w?JR!YSocib*Wfeb$BHbh?Q&5jZ6XB;=b0r5nCs`amcPZjA
zfVNDm&kJty_%j5QQufO8^$eX<V!^bm=yRB^4NVy}s4zB~457q&ZJ!~@ct5-lIFpkE
zt0-K0Uyf(&HN?_DC;RK}z-J69rK>smag!svceOCxilXeeXHP{V5o=Uq<@nAMB{8jN
z(;l1pANP;UAB&6~VYSVnPuS(Fhy&bh(fr<m@UkBp`<yX;RgDnN-`;AjxVWSP5eJi`
z(~KD1mhl%@$FjzHte6%#jd&S@=B&!$iG6Ve^vD7~Jw4t6KoM;wVrV%U3cn&daPG=;
zxSrb8%TVY8FfQ}nS!zaJ`sl}Elv!<=hf^{a%x-rP=fya(Qrqc<oXqP9YFa70+A3|D
zo<I(n)?PPYA%R9nn)76(hICpH4ak<&-I&`s8d$^3YeI@T!ZlaYuE&=><#5a`+?h*V
z#T}Bf)8|O%I|o&De|FYaFQdFB*e_`Q2?2Ez)aj)+Td*Dgy2!PbkSjptsv2ugHvQt!
z_k!g~UU03=2nmm!NW>m#DfO0ui@=9V@I=I>^ho(`QIW7&PMMjJ@C-Wm^PEwIiaiV>
zeG7M7#zxKr2jgTGeyR`cMOMuU&9}!q1$;g{gBy-?=lboeK_GqLG~N$YY-~O#ynjt#
z<}i}*1>5Ck-xF$2moIk?J-6-h)RX}ri~nt2qZKp%!Son!(9wEf)AW&t(@sc8aM`dO
zT25X$*};?HB-~C{G3nmtjicU}QZ}l%<nRIH7yD_M8E3DBM>BCu`QX(6o_Ug_Y`yOw
zH|49$0x$Whbz2PE&2dWV|6JHssow`8hQ~oirLXH2TwqJmhtCmD<bF_6Yq}e(wX#nr
zVqg31Hl@9}(02v0NX7rC@WPDeLgIX0^ui@zrnNboN*}V&Cp&%MOvQTK^!&yXLas+{
z<yV~asqxGw4)dQ=tJiEJ^`Oh@vB}|e@&lzeML-Ao;vf*RT>5+8`aSb)6^GwJKwzo5
zQp6juNrCc&mvRBKWc2qTQT*3dxijgZi_aa2=qCJJZ4i@Ku7PX%qUuq%M1J1sb_A8{
zx=A#Xl_GaKMkVzENS*yaci|+^x-~e@w{LZDPNnknX4!3pwdfIBl`P^L$8Gu=_?=X_
zBCNT$<wc=r(+=m#7Sr@uj;JsbR=Fo1zL86GA=ThOSfZ=8z&Qhe!1SThB6MTRNNPN@
zJ565i)X0lL6z?MJ$^5JOm>g#n2B+fM>*laOV&;KO5j_>PHX>|08F!!vrsN2$-P1x&
z5GY`$^`UW~Y*E+~@JBDXRxlGMEXJP9W@m^=(f~g?5!v|f5CusA>ouw$slzybs2I&t
zodO5fsu(z5eOb)lj1NbWCeW{O&PrLe)TpVJ8s;)XyOuA+54Z!xZLDN_D}l=E6?Pg3
z8N`Chp<za=Zdu-UJCON!JlvNwM@k6CoH6TR+H^%Y6SPHZg3EP;0Ahn}w;m>doQX3)
zJ<+#V{jj3aT2vsv0j9r~J>QxyFWycc*$0>2yXDSziyl9gbMj1T95cl6%o3hJ0t5_l
zEc{R5DW-VFNq!lsd%CUw1T{WBQZcYm=?OqEWqEF;e7JtlC|fC)*WCWVH|hu7?K{-h
zf$W_>PzO4aE0UP_ps#{MEfW?7J%c#|{(yRC16A*eOly_6w780=>qf&lwg8lRu4O)P
zIo{a-&DTW0na{!Z(}tsCFQfq~lnchqMwqPrlsnirju=w-i9i2kHr8=cL=L-VI+GQQ
zlQ!<Rk_bBpWQBSb1gnyDxtq{z=!)-}eX0ZNyh#B-`QN{QW*_L17ga`P4(+3I>#myw
z7>#cc0<Mku!Pru@otQ$DE`lyw&cBu&HA4$Q%jBd=TZT{XJ$T>A7RB`&K)v6x$s>y3
zR6|2!Pyg$N#ULpRvRSJN?^Mmz1*tG5a6o4OHQCF?Th~XLt7WNym$6GYur2=$6Xin%
zzz#kRkeeZV{v_^~I}b;N{qED<%pIU<i`cjVL+6N=4R8ATzYzf5AGnlzM`CZwCM3}%
z)W>OV7Ob)I=$r|BWUj*GXAP-<qwP)63*>Yb5>J8plV5A5EJE4&x5C#|=BJUYqW^)e
zGXPxZW6bUA0>yGaUt~@2)V^P4Q~^GI(Z*8j@CQzox{8paETg7|fXh=W+RhP{NFOR0
zr&y{0G;&`ruzk0Vi~NTcpm~T>`;zm_w<jV{^<i>?PrEiK5{P(?vsTzL=w>NLJh*-z
zq)$Xt1j)<E;r0270g;S_1Y$AoL74nw{gDp<3@*79oQUm-wqLj@S!l%;jm#Mn`&=bU
zw?re}QOGz&-X=3l0V+_VZa;5t5$JNo{WUkiUdXpUfgC8!uPgnHI)JTv4qsm(Kfpr9
z17GC82w)_U-H&Bzb~o5|5x|U}3<$N3kG!4DdoaGNJ#iqmaux-EgpcEakgS_%Ix9zZ
z2f)Yj52fV+U>u6D^y&1_r4<hYmiGQlgv?7^2L<aF&TzH7dt`u5()|>0X8xJ=!_2mi
z>#a$Ap(o|7d)Wy2pJcP3dsLF?la+NL<|1p67eH&C<^#UQ9k`0Anto>}33dp++}iAK
zJ(zlxG`wkh{FuSI(F-V6X>m0|f7u2qhPHfvs7?RK5{@AH`?vbHLhC=i5d)M!r=5OX
zaerR)pD!(e|IxBY{^_;H=m#A>ZcBC+Jue(l&s{6JgS1hyA!3`J|4C$_$~wUd#j#aX
z!vn8B#CR-xfd>N+cOLWhU2o_}NQMkpt2JULd<x9#ziu_V;QgebI3#C8n#v-etcGuM
zOhi)7HD&0k`s~9U?S#f^Z?)|3Vb+%HD6h~jv1+qmgPLuFs*S$BQt{0?R!|@Gj(E=a
z+i6^j@Yztv{o+fHqFdu6mtQzWcU<EgdSw$Ui|XcNSG@{0)_{(*A6qeo&wdDQylZTl
zYLq2XAQK^!IDFBTA})4A=0UdzVC+>)SFxJePst<f5i`J|@U<SKCoe3h%Iol0fl0Ja
zI1a|Ji_L*EuW$Qg0~$9SNFGjZ$H#rZRD5@GEn{Ul4C!V=te6V_9aJ%Lw#J(0v>?&!
zcGBPRRW5td`q2?J=Z=QcX{c97NWIO7>1%+9taC$`R@k>A`sXc;9c~Er_WD3a87+lO
z$VE&mDvC+C;I=A0w58IJj-GzBJcy6EkBdye`!&%u@YQ`kHQkxLR+Rv7Viv#p;oV(w
zmwX)|sfl=CR$Yl%!R7|5X8Y!OP#lxCvygUR+}Oo}xeP0QyfbJGy`{Y8fc&B`Q1CEr
z;I?hoVcgB1GUo8})a&Zf)X`PIiemRfuRJg5xdqg1Zxqa2(Slk+FyCuLA)L^KvO9J8
z%8H6ZK$q+F?W)f9m~*l}zJ$Aue#8_v=S6z2Avh>+yoJ3aS^ALJ>u?$~;;(7}IXMmA
z4ssY%Iy?D*?1#2pjEl8dWTpf`P%#bKXzF1ZUf=D`Sq61VY~<4bZl~V*^(+9Re&Uu8
z!ZPug1WA(M?W$a&m&!toZTn|U#KygQmPi3oFC{q}%q_*N+Cr6_Hf@CW|M=n<7$~v*
zTHw0Tn1}Ci_KlCr(S5AroVNUYEq?UxYa!LFRHvuG@~~(R3edCw6iahc8Q;?05QJf<
zkeVtjrFx7%?{GdPI5DGp?^tQgh(8s<9ni>^Smea90YnMKk$$W2PsW8M#?@5g+HqHz
zC=Wp(TTL0<H_HiWvQhxk@O2Py=6<qzxz&kTNv*bXMGSK0eZmh?V9AuqO1^b!o`9PN
zkG?`+q2unSnlPL_@D)N~iOwW$pXe~$g~%(_my(Ga0l~jqiNA_0^5$@AymQ0XD`myy
z|1(6&v}#LREj6wxYOku7c<;H%lngeof<TjilRo@<0KQd4sE*>Wm6fMbj!Oh{;NG8t
zoe-zahW9HYMg+iiYZu<PCSpTjPEo!%bI9g{i5l{UG;XRGz%waEn=Z-tE8}my@o;|R
z2RZLs-v#O`96{WGHI~Bvi}7Qz-4Ttr0b5uQ8MW6Y_={>zM{H<8SI-Auyata3wM2&L
zwn6S49v*IPZsM*1tPEvxD{{ef9JU(HwL}7N*1z_h_mc7sqDR=QLFm1Q$nTk3W6AUp
zmD_ZCv}lvEa~*rMRx2Ex^ooCf+EOW{#gAdrL`%pBLEH@pvA0hH!iv$01w=(6_Q>kj
zyXVbLYiI!e`*ye{7EEzms3lDeNpy&k!MkA)ts!hpc|jv+3{1K4W3z`mbAsl8L!&1Z
zXqpj{E7R-xFqkhy;tvq$@D&8J=Z6DPPvS?X@vDO>0Vpjgr_`>ez4iZ5=H96R_Qim;
z$icZD(cHinJ7QB<nyzaA-K6xTNNN*TlBr)quy=>eB&J237NlN)LoV$5;RTwSCbnV-
zMN)#v9%S3Ue5Xe_6Q?eh=|JjI2*~Cmsk0=aP3QsNf@DuunwkG``h*IVKd^_L8KUMx
zCE1fkfq`gyTqCPves-^59+xjg{}KQYoFDGmNx2_Q|KJB8+b)gpZTcM$>jZ%N09k#D
zpmxI;<Z^BvG#(H&j?D3eZZ;2Ei{z>nXg6DqH%~S<z(7tZZg}m2%56lJX&nolQ};a(
z$a;rnls1Y(^zQs>_%2a{Wa*;osCw5Di2iPT=?Rn|;4SP^z!A`CF<xb)2nz=&;$>a^
zC0j{u-|}OO)qjhoSGC0IkMp=bCfYLt0Iy5U=p^{nfO^YM=Xw+Xf9I&%rage6;wIoG
zX}UoDr0v?EM`Gkh7lR`8r8INjeKUoDA_`DKv^t&h&xbrb_wh^oERHhIhnay%;yv|U
z#<|t&B^xW$2VVCnlKt)lP@l$M4?+U|eeuFlV}o=GV_~_-UrH6sLN28x^UBb&j|cyF
z7x@E{M+^ExLz<e(x%JEK4jSMo3~(f&J$`<oQP(J?s-hfMj{nJ*cZHIGRw%Whpqqsm
z|7p1j+Ig}nDCBR4w=e?(%>aO!$5)m}z9PAiQ7|JHVB72TO2t<G2>0OMeuo?>b0zy(
z+AI5f&+8}Ay33yRi8aT|fVOu!M?ig>$oWO7mKSU84e0Mm3Qppp09>B{Fxa>;ZNnv!
zA*vaXHvqTHNWcp;qq#=PXV;_}Apqm)f4Bhg3l$uoF7FWentMHu(zSg1bMF)W%+8vt
zRD7Of&Ohe|^G>`7Q<?0`2F#F1Sc*M(<MQK<v@3O$EREyk?Q0hSS%%54fhA4RIXHtc
zOLv#9+Kk(Gf#%q|?Y;qZ+DB_&Vfrpj<#4bmI3P--%#i|g8+OaHOI!}N5L)VN@L3Fi
z?LbFRve+Rg)xBTM^|d3pwUZx^%U>Vx+?2`I874gg3_~}_xe|e-u;n-4;HCyeRyYeR
zsqjkK<1#(Cr|!Jw9eu+wEFs`K@iYRODRI`<!2%S+3Z9W!Erz6@(R6BNz-d4sa6}uy
zaVR1vVEu<A5A_X_=W^+uO;5naC+;XoE?zwrc2lr{(IMhee$gzrZQJ?f7#mQ#prOf{
z*m>-boP5BD)5T1ymPrGsBKF;UwVOh&`F53NX12QV8aE{y9!jUWOrx@hImv?c_f1s{
zj9U9;hFY5~Z>7Y}eu=TCVE>G^*`PV_0JvVRDfI8y=m12XqVe3ZBcjYeQmEmy_P0W%
zqgAsBcKSa#GknZw>(Eo>&cX|q0cMfS#id5!Bl~C`$~b}Y_z>}kOsW{amP$4Qs@^(s
zW>c43#hZv3ob9Y)Hk#mXdOt<$>bSso9`3vD9rbN`1)xOBDNSf$G6f%L3vPTZuLVU`
zxrOwY5Vu)vdllL4j6MG)#+Dj`fbCHf)R9beV<xLD6%m|vvHi(wE|gdk_6@KGB#I|d
z+nU4S3P=tiIKHKSYK5q;x{YHaVkxnc<&7(*kk%~1`n{$!qtp8bULc@2J&@=k9<<5z
z7p_`9lP9=-4O}X)WRoB%x9?VAGa^)8CQ89BdU5Y^6@j)v$MU6!Z3Bkp^h><ly(>19
z+ZXJq&*i>gE_iO021w3NvGUBY@rH=9jh2Q-d>2j3*Ux2n_T_H!cOs^-X$I$z{4QYW
zTiRP^c$Rn^oNuxFyM;I#tm(^h83A`ZQfI8O+X`L9>Kj5&IquoXT1R>Zl-}jKB7juq
zs6|kK{Qr=XpU&hGByJ}27_yKit6z`a&~JP`4YVoFl&n3FXHPL*4M*s?P=)*+)A7t5
ze_?JNfy)|V-?y4S$#aGAB;V&ma9fBtQ^(kJKZFvBvyYv0i1>hlsA~$1oL@p2AG0Q$
zj6Z*Jvao(g)A!(S<$rH<v#WvrN##LgO4fpv)w485j`wfU@*BI9Ivv&njS{t0{yUZ}
zD3ee-vg4nzs!;?z%^F9FiNVyWKl_2VPab1|b8)mOc(3n7cc5<n!?&+%Vo#8N-e>L@
zFUaDY0+cR8efl=`Plb9vXU&~ZJZbWL$_5MlJ~U)p?9guOe&;B}qx|*fpjbHgNK2fJ
z{-w7fbA&}D)aVZ^z*2IP`_shEByt32zaWy0ab|y}@tP%gSbZbgLe{x8$DX?a@ME{1
zTT)|?O?kfG&<n9%qtK(%h#m$l-@lusy0t#$S$~&o^C0l0uODN_KBS4iJn%LWp4(~I
zjN(AMFwHRdr{t$La+=x&Z*dUtk3@1icprlU(wledv5ou{yPOs7PO0XS3gCifk&vF+
zctZwK!d$uf`HWl#$5fvGCKo~^N(~S-E%z7!l}aSecIhCU1BwH2iCzNkZWgO>PA-Y1
zGl~125HS`);%qICC7#&s;SRl<ZB||_U1KtXYqp@(N}KS2cl>qir2;J7EZMU;z-<jx
zb!|<1WVv_szdu^Fy#A1|q<G!>r&M(M%w>l;hD=T070VCP!N+SI@+IV8o=q;AQr?Xg
zO<3%;WYFi#v)`TCaK;Szv(a%s5j;1x`E`IB-YkkEILj~1JZCr!zVzw8=goh}{ku?q
zEsDUmZuh;M{v!XUFQVpIhF@ffMv2ygM?#c$-iq`ic8xHJh%l!Die1N{dVx7k*4Nek
zXUOK6Z6}O$)~nKec-i#YG{dC`y68b!)ziI@@akL1S<z3)pOGUTh7#kQ_wJ*G<ao>M
zN1lh1V^KeitD@SM>y30VJdf=ul1;vu60PbQvsj!c%bTAs@jYK@PsU5-r*MW}uW9lS
zrfR*?>DUnGj9@XR-<+ZI;-lR7>hsf}@gnF3r8px!hR|(?8vgTDYq9-ot=48?&CbOP
zFW{u_o`I3!p+EQ(>Cw(&ijP}Evewt-+d)LP2v*{vNM<KHC|mEz+18tZEbodwdFYd9
zjdF3l03)U33rAC5zdjXQ-(~N+aA0XUhn8G?>4Eh>;rBnNlx<%5eef{qPbs~izz8e=
z8tK82`sn`t<tQy6$&eHIV2uP~%OVMyL+X&cPGP{Iv)^?ULt@EwmJv@%j~6u9c?s&4
zhrzfL6sLvhKrftC#HrxID@mf-e>i$x;d(@c=#NLA+z?EPx`e3PFg`syIJs)~{1^zl
zM2cjf*{DE(V+-u*orH3>Z~85bS)NDj-)K=Y-vUHMkT;WJhkYzFFoLk1nEtYLOPX-u
z3*3Mkh4aZ|iU#g`<Go|0{P2bqkuhGyR#?5EfdtLZj|F4pnt4-a6fV?}{DHkxe-RD1
z;jM8=l2gX(m+jp7)mu~n2$8(uav<UUZJh!1PC6P%F)araV8AI`)LS0SAA+191u?Q@
zJaWNxo{+Kg9m#fW{2(YkY=bss$?1L<C3Y7Okp35=-UiMx8i?pWt{8tzQOD6e1*T-Z
zb)UM|b7OB4%d4PAj4?sT#9`+ls1LU(Se<^ToUil4Hz9r3`j34jN{}oe)|Z3qqS+n6
zrr^bZd07Q|N1QgUL<*(j$-~<h1fUx4QDQHYyN3u{kUoUG>#nE06s3U==(H4nYByIG
zqMaLrOc~aobXj9?aCZKyLJ%U%Lp@hzf}|3vLVAR6wEb4&{ZfJ)SwcT+{M1wSJ44V!
zFiCssyLof#GSit_aT&B{5eS#Abcf~<vusxO!|FctMTjJv+N2y`!nDHml1Je)lsPw}
zQeK(51_fEt#c+U*%wha<S_V7A8F0QP8!v~Qp5Jir;j6D&SgGs|H--uks`RJa39r^o
zYQmF(Z4MqB)6|i!0&$=5+!3-mO)3k&IJ9{Uoi(?Fyh~v_`$HmABAZndOz&hb&=yzk
zoJG8Rp$P*zi@o#Z^h7(vTuQV)eOljbQ?BkaJ27wX;f8g7wd@Z=iA+p_9cz`e@c3k}
zyc?~T^E>g<Cf?MdLSicq9CCQ|GPFcY41lEEMszRx%5W#s=m{)&SRu~lhI%cLtj`ql
zXbddRXsogf1v4*2(SY7Y0+~ATxfpyn_qb3~WBstfRpnSYf$SymtYC~OxHX;l%Hu^z
zongk1k8Tczk2`0X>&cr8;zdr+!a`zTaYbxWN15aIZ$?fEpO)?@JVfVfSckq>2jBu)
zGuZ8K_2h1?a<MVKU{_bc0zLLK=`B(zWI41`QH6mO@g4N=G6GQfPt<m#0ojNO8eolk
z(~4iSqQr9LI_b7w=Y2-Mu><$K`cy^0`|#dj6-m&`V8|FYvHY^wP?Cfa-pt=vx&|$t
zi4C?@s7Fw2a%Byjv_Esv3L=F}sd6YKw4bO&*^^xkcONgBEnSQhqM+D8jTx#<w5fGf
z*3^Y4TXS>9KUM2UgRqV-f9v-Vj1JhjpROC=>SH;yyalqmPRT-3St&xF6Z0xUJsf6`
z$T-WgEYi@{a%7}}6mgPg%fMnGd$$MaZ<h)RBbX}AMbpN#&z&C7YLx}G=K0i*Uj9})
zvR_n^r*f2CgIBdpb`i-srGJd~#`sm4cH9~~?-XQ8iWcw_&fN9A@hHX4c!E94vW>o1
z_E0It6zs`D1Vms8X7sdWmGX3hHnjpkYa$u65NhM543Uum_7W`0)`B&8HotrqGt6=3
z8ZDd3Ld?SxIi&<AI+tS8^&K+6eVPc^bJbrz8U}xD2B{3<WP1S|N0UeME0y{`g&w!F
zC@A6*W8m_+GY{>Q$Jt*uQ$Qg}TF$;AcE9-&6Qzj7VLCV5FJ02;w&D2?q|7pNxx&Oe
zTpKS)nK45@ebSwyv2H1@w<T+|m|UL^PoEHJtgA;j%*ib_{l-AE16RKe<}nLX1z?ba
znz!Xcmd!X0KMZ*o&4~iK_!T9D^jFEejgjAX$nr%M&f8oQ+T&#X%sH^~G-dfk=3UmC
zXJihpjbpB>-Y-0M)+_uUzv5Am9khBL_LhS$wIxXnC<+;G$*LB;co6xDPOE&zN3n1m
zLmg8*sa)aWdbYVz<@*)Myve@YOvHw6&;DLx3Xqje<Hik3SJ3o9^R)>OmNCZz!S~f|
zSmgXbt_mO5j3LzBz25htcjdET=tHfVxzL4&bk(v@S1@AyMGo$%gR_jk^|wz)?wdLl
zoEKJb3(CFit@UXOPpfWpQ>$HUU$x0-8pqv!x?=a@V@m?fqZ?CI`ZX>EB_w-EwECLL
zR7q$dQSpp9U6(FeAU#ygLh{&42o$oBGxQ}#v;L#gVMokCZIsNf_D)7sx~mzNXh2;R
zexDr8x=h%p<nRb#u#kZ0klT5rG*L=>9#eKvLo{WVWavYdhwjf$<l{O##hK=oN)8OM
z&8xPLm7a^SI}S5Y<DciDXB|d}JR|4W^f*TjTM3rXJSh`X(`0saRO@2W@_W6Lqo|&c
zCK=)HL^<t+kYC7=w??V_0>4c^r-y+Ga=5Nu$6cYibNov$>+Me%r~XLJ`>sr-$UmmD
zRhA+j{FFj^Fz*(-+Y#w$y6g>J*a;zb>6CQ3f+;aMom+7Fp`GJHXVZ+Y6IZ|D?oeTh
zq~R&);Z`D&;LYv4(nG!s<=#5#k+4Xqf$GIXFKyy1T3MA#KN`=#6yOx+TlN6+YwCn@
zFsreSuiN`~V@UjlMN4IEqMb;#d%K@+g8RaJP~NppU)i+rY&f4%G??5UVMY~BHOBOt
z^{H9<e)orwY!V{fHA^zMzG$n}_Vbb}u56$DcB?Eew9Mm3uI$CL(1ZCUicJowO8sA;
z%dI>~n*3uQ>_u1{L2LhwCzk)##kQI(s8UN%Ti-2K%g$%SbLO~rmz~a=K@4I-)f!_5
zEbA&+3?Nl9WOM+Vg~-e>hvML(9{sqfApgsz0wG1pZU3I^_!!yM&*wA1uEmzDoiq%W
zFK~Ewn#BCs&tN18MHnte1Ield+nu>L2J1e8>AI%UPC)At$+pf|2p2au#?DMK_uDDX
z)a&(&7a||k?qFC3se*+p#8189S08CD*@(JFyYul-$7q<s64|dlq68pP83{gRu7+-y
z$lFi&v?^M31>NYpNINNN5(Wg0{jevYYWe9BY!e@oohp$zM5)WId?eMq1XmKnH61W0
zNT<PxeXMWIm6sahS%J*CBX{per_MumV@kgF6pr^xs@Zdr-!+^f8!V}0$_@vqa3>L0
zKlffVSkIb#E>cAU+y~*}uY7nK9|O@=sbJo5Z8Ler{w;VSf%qx(+5hDNmbxE{&<KVc
z%x1~ur;oOVY;rUq0j*agsdK{6Il<@6!y9g(3yZUFw8(F9gjH$}$Xp<_>O-g{zq|f?
zTR?T%<kKLSN*Ya4yh{&I{&OiygDEqW6ioeier$5rL?vl>BcSXfy2Vl?cV+*ruJQe-
zv8Qh{!yx9=X~ZIcTO)Q=#_>MdVtDgf2&IE0IAXg^=6*{rl&I`*Bb)KOieS@|HI{QR
zDAr5}7*Zi{Dvh8FY4y;@eA|CL4JOZ2V$7bT`bl&j(j`ZErIl%`72Y$iKp!{c%>Q;g
zMz+q?JdOPisgWzm{J!f4>G+nFoewx3=z%4-l={V>J3b?ley29VB~vg}l1rT->KU@L
z@1-LscZ~IL_}jF)IMbIe<!aL?#g@ZcdQ3WTPD_nh#P0!0Sc_|T#}><(c$X{I-N#od
zBK5_W_uezw!5X^Ifgsjtkpc$>Ck2y7;&8lpVuCYhbxvFG@XH&m$vcq4_mm@!dPN3X
z7ZvZfh!Pv1{!9JNFvih051+uLsS`E%xs!>z9x`_+U3YQd@t1lnimdPrq?#B@VwLH;
z=Io>HL><gbc7q$;@ZWo+a>U1uYU8z?GNRczFLc!;>ymd{l5C{S&}Frx$!(6;xkQ#c
zufk)Quh$D#uTW-B#$I(A3lc04BVXj6(iPz@OKRTRGOaUtWihFqq*<wHIKt6>y|hF&
zMy9j0<!Z!(XUavm;LuO}>?CBh+nEjIg;V$^0}OSBU};GYI}oa+h$m^VOfjW9>Rmf&
zMBio@NT;-g8KH<61XA$!1D9+XZp~Y3y5hz0H>T$=_00h_OFQ0|ua@*MJvLg(MWQ<)
z)7FpPWD(gINnMov;-$4AKrp=vU{|uH{Z9R+J3sngWOi&Zf${4MjO;%yuN`*mu@uST
zl$^e1CrDX7LmB%gX^3N1AtF}`=74T_rb~_jIuDVnfc>Q28b?;Uhoo&gw&|nfl>3u3
zeTw&GP9m@T_j`60a~&+h#5tVtm?@ewUode!o|}3cHH9XKkNL@_>&_~aS-xUV8a8c-
zI2|q)9+zd+N*-{%ETIYz!jpHMN$gJS_$9UyDonp2rjjLMxS~kwz076kR6jip%}6<E
z#w07oGNbtHnJHQ{8(Cj@T8GoVl4+@#AtcJ3qcL#?HuXyyWezCY2MxFSjk&fz5!oT_
zfstTpd@$}Y_!4N}T`J?$=@WnJJGS>v>TqCpJ!r1U;qVS&J>-X*>jwRQeWKLJifQ;0
zap8@T`yGbEKHVne7CT6-<JBY-UwuSOrK@FmDJ#{pIUi$t_-h*~PkVb4R8~d{cmB*I
zg8Eltj-+Plicj8#W!4{7X)DG)spTZ+9`MUoX+*>IH0w^XutH-cwSPCm8O=jLcM1k~
z5O!wa#f>I3?<JOt)>n&UnFKfuVi3t27P?FrG)!AiKSSJ%Z+fiNKO|MAa|lPWGAAOn
z#R{t0t}B@A-Xz-d;lJh0jKn0C(||%Rr<2G)a4yMb%ko?0$c|+<aMq+O{vNhnS9`^w
z@WVs;Fswa$47WfHSPCt1bXrzhU9SxnNUY~NcO3~en|SkSq2y|aTlG1PDNj(hJeaRs
zJs1$4)}@<?X}Juoep8<{6=Y&YJSmv5El2#Sgt5st!}(lV6+ka^xQy6;vy1`Z*lZp6
zrp}pKw(q3`>Bo4ZOJkIm=;6{)-)EF$P*rZi{O`DF?i`RPz4LwNG`X_gTt56hJlOaH
zTj)qlW}B-!yM0b6tOt`9$>=x~FMQ0GJrg7}(I{rBDJGhTFdJ-Zo18ILbI!mx)$%U@
z^g#vWm|_8Nrb?}XhcEzzEv^7s`r+-TeF4z1AjMd_(^Wt&!M2|{OAx#m8Ipz%9DW+;
zXW!^xgn?Cge1IL^YV4oQ@}Sf^>cx);UNbfWMNZoZI;nm9>d-RBTypArZMWKy5zkj3
zmldyLB6%oTcmN7WZ;5?2wp_tkn^!$8he)o5^m|_L$kGsk#)FkezbrCjlo_wPGK`6T
zzma|Va$e_B*2IT&O^BIzwv6x=)8p%OwAxOt>HC<I^$SN?&Qx(yJ^5Acoihk6gj}L)
zzFW22=G_U^?#QC+5@|v+FJ%AJa0r*%UR5uB_TShqh5PACJUy>277|~W=yGx;xcF5C
zRQL6<B*k21a`=ThRtETNYRsCq*^;jzQ9tF3pj>seBjNQ+PQ#X6>aEfb7&Q}Z%Evrj
z@pC97kBDC$WV}#H#gAtFStowINiAO%YpV6Zusur*CMA7l2@}7;#P~z}2B@fSi7CS1
z0B5$Ji&W6})V7>Uj)fottWVy*=`U#5>H0zC{lc+%q7G^oQz6m+md}zpUJA$4#`!eQ
znjFra@QX-k=TXL*#MpDWcv$)m1L)IjL2KflO2S&(+0!VypIn?c;mq~W+hgR!cYBnd
z?_`ZSIw(c!k_CWrOR?ZrrtJ6{C(u_KO+wYDA4Bx^4fF*&-h8O39RPf1fRQWs5qu$8
z-#J}3zCPy2O7v3rKkcuGFL1$zYnjAC*5ufo3`5OCp%^ABwYv-W@Sb}tBm4k0Exqo}
ztG=4QH5X8+HN%)2;r*j@2UB#CCL&%-BLK`9ZweO^bE|W<>Ef7$6982IdKwGec%BTy
z<-b)R(3*-SA><P~QM#^CBg<`PU}Hqy*p<pQS8lk8dj3_0$T)x#G!>)<HzlQyJihWz
zRkbi$*WB13MwaGo09&eZsP$r?)(oo=bdh-;X;c&b@a;`a`^TCxhD^@rtRS9DO+zkf
z#eafaJ``Imx2uY-N%y2WH)g}ZgI|XwnJ@FPFu@I-S;uAEM+oKl^_>4D%dKu(I+2Y8
zI>1+Vu$8Scg0nmK#AR1U-*~us+_%cX(e^asoZDd96j5&fx?nQ+ao|J#2GS~}M$k#*
z4Ia43M5o=B->E;|S%Q@)9olkNQ$QDiY8rFUhCy=*X4u2v7dQ2irQ|deo`%u1{ZncK
z)gK_Wxi0CaNVXxMm3$d;^QL8h1oAs?z6Yq0Ck8x!fZYB+*(}hD=xky=GN!FOjp4{y
z&+sYR6~PRd6)_!ujvh(|KsphysSlzXX^zp%sC;T;c*}T2h!4TS9PkcSdF4jN(p{x|
zhXYrT^uLRE`ySUL@2?O2`Y`sIa2(ZE#E~K#%OBdy4c5g0SK$pGEj=x!Z9s>$+UZi?
z0lJn2WKaJMbe~B!k#Gno_O&5`jrcrWPfw=vV~}kB*-Vf;u-&MMG&Zmudzvngzy<w(
z-E*rXY+jWVS8cSUlzQ)n+A6MEBKgTw8mT@Jl&T0neihHg<DeD;JRk5+X6*WoN3|?r
zPw2ViJG~|GKnJ%!1IR6(QHUQ|X_L2Awd@>j)es{K8@l?J?hEwz;zSr^1ud4%nCLvp
zBj=YZ_cq;D`9@P>3EaxSJxk{AgJ=I9eB4llly3{|BHPx`@icd#<!&TD<CuLNIi9D}
z)}{@n!hiq_7Eo(cS69j)(uF<n{s@2f{me5O7WVmD+5!+){_WG7e^)RwXsYUBP`?;w
zt^Ru%|M#!|bORX_yNxj@70y{J&X=!DL@q^`|C74AtgFc^lAWCU6HlyfW0@`A(i1Hd
zFYdleEp<e_YozNQ_=*2-+mL_CXzHc9@|J8P#LP<{E1$Jqt@BU=5c1>cPgxS;5t~+S
zK0cdi!a5X8o7C>s>~k)|v*J*(d$zRqno?|?|Nk)xP0^9<q;p@oaO_C4hlW%nJL**#
zB!X8w<J!jWz9@K)dR8wd)Fv6zW<Dxun&2T@E(3~K_%|y~a#+V)3rv^tzI6p!NSUFt
zzr(HOA#SK8(gsp@@QoH|2M8hnqx06|oIUg)0`Kl%hRdyhgd{Iks&f8UW03sKz^^{t
zO82t)jP&fV&|-&A{GcO%{soA>Ju%_oLJkpCAL(J(tEn5c%yq4wEBAkTWIoFCNHUNQ
zQ{zjCfvOTr)Ej^ZF}5WMw8rwUty`rVmYNt;I&NMMvvj&K`(ye&5{p)2!+1V2H`uO}
zcrQKV;qIgi9+A8l5%q7RyPDiyJ65gM$YKp8+|?ep6!%A(Y$=Yk-x5o7K?OpEg3;Z6
z=!SIM-;WCb$o+ry73Jcc8;$Ee4Is-bP0`jO*|fCLc;*t;Dnhb_#B;BO0{ey4H(D%2
zP$`!tP(B6OX*hVG5tRnrNbNM@i@30WkiW{DIr<ZoX3+0u;F3Gq?0_on4#mG7NVPDJ
z>6&&|c3;&ZoR~P@v!Kz@k<NLGC-R&f>=G{l0Ve<@i`S(9*~XONfFEC-4qDsDh-%GN
zU}gnADIvIXa)MoF(bG>lyK1?}itU=gohn&VJW=>g6~qk9b&36N-_@V|PgwEYEZvDw
zRn-=7U!4SNH&tuQYj6*zWtF)ZenM#cBU&x2g|?!#?o-lvSe~~)#)Sx=W&)__y+9fW
z5g=C1g3zunZxni!WbFf*-#>lSNOl-LLbty#g(~=eJk2r19|UU)_I%@*pV;ZFN;6;L
z?ma|eQCGywz<M=UOEHEqQ0b3<Lts;rsVf{e&|)deV#UE7^z9Wcusdu;#F}Xq(h6ps
z7WBn#7Y8o*jOPD_e_R(}I(=63@7Dk!G@*Fs|C2?P+^`q4u9vN}4L*c)^4JwSCoMJl
zRruW_15=k6%L}AgX757=KLXF|{BwTI)APFRS=A7Y3dU!7HJ-OK4qI<%DIpJEc}2ta
zg#FdBRVS?C05d-VgeQO!wu@?tv%zjXd~r0DRH&R&uk>~XnB}bjdBmJ1-bQ^4bIoic
zE5}PpkmSFMv!@k2+pOCFJ)+@E(mkW?O0+Wly`mZdajI+{84LVsGf=_+e%1YvRQl3u
zJKYM8oFXw8?Y+JGp8FOM4Z%wwc7V<b=%oJlL{qle(zJS;aOs*;qdiJ@C1g;t!Av)s
zINZ1w1JlO@)SZ$&D+$1)TE_l+aq)jIUh&o<=<j-@-;LAo6Z8mpK2^Q7v*y+?sMg@R
zZCQoY&E&syY`Rnz6}O^`q5pjXbEilL@}qQrH_p<RU0h@JSwt#ZS0^_~_s<^=8t2or
zb<CUHCV<O(soiV4k+IdliVOQ^$9EeAx>z%SB=zXzV0VuF<Ah#=&3t}=(s5|6Dfl+z
z5(vN(06p>HnQ~H#cV15;H8?jBtG6<Bu$(ZuIugLr%pAfOJzS7;<pu@_xYzgczhyAW
z;b4gI+KYJKu4`FM4HeE~&6}atYy!`w+<JiB#LRCp?HZj}(+ZX!ciyy$;%Q0_N!9?A
zocsPaqqt)X${ze*E?{jRk;KwWa(61&VB4Q_RXX^!I~Dq|q3z)N-B3>qyx}9KquscF
z=2D<Fh0EmRjP2k!)9F%XId}c(Z7~fiAz*2K1@sPpb)RzClOG(@rd#{$@an3ZAh&7o
zZ%@|%KCj(+M7SAhYfT`NW!Ca{;H)@sQS_R{KkIl>SqbhzZYH4xvM)rW{#!j9DJqY=
zR#LJ7B<Q!-9SS{vtTYKD17+W*WO8C*qKxIbSbtUkVIuW!9PN33XL=vn-(NJo`|f)2
zqtCZ^dw&=hPmd&MY@h$|?#_7j>PfoCV71)y?$@ptOgo@VITlj98^D#y&aL0S2DR_M
z5qE$0?ci%n9TQ;Li~lTJK{xUw_19R(%T=Fa_pr14s?o1sN0v9*?<Y+z2Q9gEn#fzb
zwYbOo+KNA$yWi`XMYIdq+sTZBUZr;da4dWO`XEi^)WxEG5}Q52pYQW)?Nlmkt3^OZ
zvRbxaOV&`ZVd!S~5rr|P&3Ehmd$I%QEBK%JVmJVv;Lf+3yg{e5xlhU=OIL4wGunIA
z(B9PbQ*KfIQCz(9Bj+kvKZkl)uiGI2$M(7T?}If^@&e&!+waRc?w6LEwC{am<qe%O
z7*AAFDgfx=2stf;ke<y;M-vuywro1MV1b(d`X2B3z?+X-PVPB}?qp6>-6#BX=dn~z
z>;=#Zp1&^qa!U2C@u!=CpYYTjHtFB8t3TEQw{Xedx9teo7$Vu!_oX%(Vm_?R9Ns!~
zFKIee^X~TA<g&XzpS<W5Xf2o|G!z7Xg*gs2cS<P_(q`}ZT%3ljlKr-$8MG*M9T;eZ
zzur~-sme)|Q_1;uT#{BC7vj^q@IuMnqiXi<&22ACbJ?D96`^HI_AaBx+2aG$58=v|
zFv|?09T26c{0nU^en={Lc(n3faj28b+w*nMM>k}J%M1G`TP%lq*st9Zl9N3zCiSPO
zCK_u~u)>EPtI9GF<W7vvtAJ=&0az((wH}k^N@V*lxxcef=<jS~V0nMKV3u9yF}hV?
z-ek!}HRgb>c6W->HGQT2veHK+fc&;nTrc--`|1mW9MW%1DlQ#~E>xLG*LhrOC~%Qj
z|NGD9r@8y@x*m?_(2iS9WuxSZ#IT1#T4txk(<k2!?;$3Q@s~J<iBbM_+~>J}Qt3zV
zN;~Pn<`~G&vAXHRMSj3GqyKDk-5EN3e)6dz^kHbgiShgMV)plbm;7I4-<0fKUoPtX
zdh0ym{jawcyk~1q-VKMuL!1tmLfcKc^ZXot-szF?Kbgi2z)$O9`I0@~vF@(=jDD#z
z#Jpd+nHf6QfZg^>xQx0aL;+f3{MT#BIJ!cFT#@(r{`=p@stR)6!S6Gyy}QW0zdzZY
z|JwgC`<<RQIQE$85uz1uqio?CnwLHO#!=UrOX)vj$}LB{WVVhu-Gd`d-IZsm_o@gt
z=v^vR6=t-{DyN0mXlaEj%0&Pv^u@nkE<!!%4_>dQ<!Alplp0yDDeC6Ue(@rS$tu4=
z@=0HFIeaOm16N)z(alPKFCl|x&NMU?Jf&~u0!3xRe#8OZe1T~;i&*`@hRYi2^{zlF
z%Rng5ReE{+S<?m3a@4jcAQ9aWFHDmYv+)*gbno3qRO8K!nc8Qz;@RljY?iIJhE{Vc
zI6dZdTXyfflA!w|wUxUy#nt-Dv+F66H20Ftz%_2mpKQWB1bGIYYJ+?f{w}Yt5=5sg
z;tqUeb|a|We9z#!)&TnoS58**jhv-`p3g}0xd9)Y!+iP&0sgwJnMB2+UF0D5e_ui_
zFoQ~&|Jrv=gJp~&J5d}V8Rxe&JmED@fVj)*cUT{!&IPJkh_^Ja^BFA><nF$j`0rsX
z#xm$z^h3B63UX8R#r?`Vkj+FPt;K)~nG>MC;lIH^->s8cEj#{J%G0hF-o04>M6t@R
z#=zj#uQ&ZV-+8+ZI&BqfUpDxKiv+YdnwxiWkuKk6(7J8y;j*EqCCW~vgpz?bw)ryK
zHgG9afeUW_34O0&m5jW<nL_rCHK71~0ctvWm(o8TaE$qomM62mp?*{+DFIW(T}}Xe
zgZtL)B||$yhQ!%0=?dNN?RQV##c-X!3Oi<BJ!;qw$_(_@?K!bP?fx+t(G<*>WY3#}
z2rQXCqQCdKieL%TMC1Ve1)yeFTcXDkEm6Df_c->r={?LnDm3FLuY!u_u4jM)Yzy;B
z!z;cGT-Z`(Z9V_};QYw={QiD}_xr<i`ah}pSATu3>HP{^NgiYH{Z~cHXrjw{qP@Af
za?`k+oIFQOr%iuHIzAa_HJk7Az}U9_75R|w&U0zz=9M-OuEc1KbcX-O(|ZTP^?hyM
zL`V}Q(R(kW8@)%5Ai*eugkVM|(OVFLV05GRKB7eLEn1AxdnbDDqJ%sr-~0W&e>-!^
z-rFwMy4GjeYI&o$Szamh0Y+?~i>qXoiNo(DA!{0m8~6O!Udc*ygY$&3KD4pLU|6^}
z$Uat>YL}5pWk?GgZx4M65^25OKWsb6uj78}4Qx}JJjh{Sa8h43+H`Uu8-bx2s5f)@
zAc5>#3oikeDp#tpY7L>itap`XWvaUCBk3ducS5S8OHy{B)PB%k8)5fIM)!QOF0`RS
z+=PTZ{7pbCn6RTH929PP&J-;<vIzy3LZ>Xp#sF8S-=3nNCOMh*=V}i-l%7!}vY)p$
z(xAmj+;+?4ZYXo!Wxp(6tJEnHikd$+?Lk!cC1?q7kfijlk(Q=Msd|<eSe;JPA?y?@
zsSd{wmTvMX$-@Xg{W6gq!;-rXy&~Gl9FK8ARi)ru=h)LRgBv<CKT_72@v{K8Vk7K#
ziao{zRJFeIVikWw-6kwM4-czFcfp|o)vX<>D~J-07a)%EJ<f>wv)p@A*5Y(iJ3yU4
z*KTV@DC-t2;xR-xoAso-in`p$3i}y>E<goQ;$Ox4MckO@6a*==a()O4VHFIsfO*T_
z=gR8?JG*2@*P=Xp*Bgr(^3GZ5TRPH&)Le{2dGacs=;Rlm)DyZqglMA7-%*O~9UWJ>
zqz|swIT{ZD*?y*Y`>V$Y1yvmXvPu)CZ?y&jRl$M@YBfz56W8u_m-pvDX3?akt>pMz
zHbNI~RjZLiZQZ3TiF2HGe!5Ck@Ajig$hJH+`E*$Sv~?@cO8Eth5lcWAXwJlNkpZd1
zob4e*61sebH>+RH?RNcxdx_#}FNGZWa`Kb3&(Xk<W7L-g%=RhByu#ug|0G2%SrV_i
z{by@vtfJPqQ0`A1-rp`YuvbDfIsHi)KS??EIA-LvCdg#se3dHmGv4PuF(N+wF^w`u
z^#FPFw-C06X5366%uYhwx$=0lIgp-yv%t_TxqI07UXMHQ)9Qrs-fL1}RcD{7l0Bw8
z4L`~0f(SQz)SB$f-W$Uhn>QK=1wx0o;K(AWBt+1*pa=yYazdRq6`l8_A&qo&&siik
z#+oem)%hY%F0zw0F}S)I!WJga!V+Qu=+>aAbG#4e?Y^1)M7%0++!InTMj(*)1;8u%
z#TZe>nGNK&_-kk?32G84z13as4olWPFk`-nCIJaDUvhqW3Qurqfc&&f(xyVF1&&}V
zO{j$x7fFzgp^FQIxalP5`cf)`C3&A(%Sv$C`;O^CV&hq3VkzwT{du!MGjdERgJhUj
zi=Y(fDuq7Zw;1#=$$c8&+#oGKgWzo@mVHKrHNI-cVq~fbt_pxQeCx3Lm;!BB>fp}o
zk4MI8w_3=j+u>0=k6rRwON<FcsM)|Ybbug*tC|Bum+NuL2zDF&jEZRh%cGv8;femW
zb1u$6WKcQ^HM9FpW)REEY@jlx6KXEBI+_F3h@bHgc$!O}t?&@OAb;G+HE`@5D*9^^
zS16b<66;O&x?4CYN0b)m8*!g{0Lu<ZGTD;5exff~=|<G2ls!dO!N=yF#j!JTnI#?q
z#gy8W36HnmYa~L_pQV)TrWB9K7FWRR_|qv@8C{vj1s0m^15N)}ma($&qm5m79{1Sy
zO%o}FI)=w`e-*Y2EmZ^sE>`@|g^m2P=S#FVKFI>!iq};}|C5`O!^fek=JB&-(&HWI
zeJ-;alcu+nQwenQI26AgV$qQHGJ$qkV!MC!_4HbeQ1oxctpu?T`DBYpX3|konQD6f
zS&rGB@oa5@E0sSGMh-~n=`vNJICkQD!+y!5pG8!&d`T*$4~rR0lAD4@A#r`?_Vmhg
zEu}pO=m&n1g~Olr2xMe5dyu1H!;JsRsY3-;lf&c_N$U~{N<_Fnv7ayQf9_USJjOhB
zY*DxM`3mHeVquRXwZcg&gS6T7)A~t!AQ6#sf=(aLH-|oLrygEiWx_OXzIn^^in6?<
zp$XL(gqacN;yl<De83E)_Bb%CFPk?x=ks?r$ffj@`WA98)fI~^>BS~6Te0e(^%tw1
zVvrp)k4y=2hI+5#L1R=#CAF@?rP=;?L>vo|77g-OKYSYB7;d!|r6#|J$+x;GomHIn
zK*vq|cAU8qqi)Z>y+cc671=bD#FGY<{igT09?SfTzGEjmZCX4+@5(b;OQh$IN#uIo
z%9%0Hy?;Brq>8t!4<IJs1bXV5WSTpmF?}HAErs^QKX}X}Ph38-_chNSN;f0CswlsW
zKeKAK`Vo|y68cf@u-IT-IRz=4qkIPyK_@ph;mnq`d;#HS<`^+QuhYmEbeNwH?)Dtp
zF3<nY*4#R&*~bIt>7c@r&fW}@Hn=XzVjh&p>4kh1R!Py0ZZKv{<a<M`Dmn)r|8u`=
zzI9{5-PnF1&&R{d%YlR5NLb`&TA(W4u&&++f~Sn5Wn=UVX;=ajVo_+or(r~tFLktM
z7<(<=b@<(t@>OCjGnT&U7U}|H$!@=3VYV#PIc@Nn7~DEr+gj<px*(6rlfCjFx7;yt
zUk|QpJKl&{=^AaqdtNb-OJD(36!gzP?IoG4A0306^V~WI`wiNgFD7Lx{66@Ye*G+6
zl=MP{Ks{vIOkm(RI(UcDU-pbGR=|AS%GDag98>|@c1^|8lzu%YTV-#`!E|?PUWJP7
z<YSMBVl#2-kJMlIsM~_0J@dyvknU04-$c>O{%N~9gVo&BeKJ5U&3PdkwNI@t`qduG
z9$>BZazC|>#CKN&TDgosa#_^A&Y;_l(7?#+HsRNihl`sUH@PE})7U-m``@m;&vB=l
zn@^PI!c;HEgD`9ADfG>ros~~_dzjz%ZEf*Bj^&`50#IzD81;=-dYa0`{qnZc3!;7G
zmywk&^!k7aY3+=0>ti(wtOLN;HwZ+U$_((W8P%*byTPrWJ@A%&rMY5s{pP=?A(X&Z
zvv0@M0y|wQ91iBuZhG@KOTPPKlNS&CPK8Ta7xe8fPup(&d~W8JB+ovZc(Ycq6Nf8z
zGEP2L6vXle3cv*(0QT5b%H4W@IIK#YGn03N0;~RY8&fjue0n(9T8}Sv;&k2dpsv>B
zcbF|Tee>;!?p$4ogb!xxaeMiGR#$y7@{t^2JjegE05~8RVZ8tlZ!K@2a^~r*LUcp?
zmBj7#*K~biTBf$WAsbaIC`egJ^&f}=YVW+fzHIwFg!SgM?aEI?Cz<=@szT`dIfV>B
zyTS?pa#_64D8|Sn;FIZiLoJZO&jcFtoV(St4JIVo*tiftRG0<^F0K-m@#Uw}=wWgh
z03tCsSPuaR;ufJwu-M5CWhJFtTRnfQF4b3+tx6xUWS;nwZYK#72&87Q<ANEwDw=(5
zAV?Leq7Z6j@N8d1=0%edAUg90`tCIQ_q?(kQcwR;0``Bm^L>FSzp@P2kHtq8!Ict8
znQ_93*CUX*6Y?)PzX7JtNh6k7HZ79QN)m#;k!YIOd<y%QJU&Je+%d->AViC00*oR3
z<wp@UM$&T<tw53jwpUi?GpH&--7NMJG(H8-ECwyzSf*o`>jO95ZLG+rt`6(D2oQH2
zuu6Ay86s!Z%KEL~8C7P@Zu>-;=N{HS#^r}6T&Xp6ioz2EcuXHb=>k|=_Y$KF?WkF~
zKu$qPU0%3=;)G=b$Q<qhn;8`s$|BnQb1iUcHA}3)6I+&DX<!IoSpk^~^FM8#jw(wj
zs1RWlGQ^7i_cH(%g!9`*G9x=#MlOV?FD-TmhE{v@?}q>WQn$;JArL=^W!QB}!2}H{
zQY=W)6`Uk<X@7wAkO4qf;w@6$pTW=ame})OT5=0N_^cHUh;eklUl12+mRpk#hbfeK
zB>sDl1h6dAjVW&<+-<v<#<6sPX9WQI9acJU-aE7|cL`Q1!sh;Jq4}?4f!9m=tY4!g
z(HRfMQWOMU7O2l!1;G9~Ia1SyUg<|6^}B>q9Ruv}J_o68#QX3Dx&hB!2BJ<!wWs38
zt;Tuz?<0P~iG-}`wjRd+1eCaMz>f(HX(zwh;l1#GmaOw{++_i7&vteXm1xN+QhNeh
zMG@zQ&fX#XE<o&v;<us&@Uj10WeHrRe;_#lob)WfQxc!vi=^`m!}y75Rl9&<VX7M>
z|C;xoLVuK+5G>4;daf^#TAtiAs6HrYMf|^;@Budoi5`&pj5d?<w_mC+76jP#Rkd2Y
zRX8yiPTE={ZZ-UWjXn$POz*zfZ7`zjvIYG|G+HaXDA|&PJN|3_|9_Be;RjG&l9{aU
z4Z12xKF|^Ak3ZQqi+oXz&z57!7V)$=RafNddyl{<_N%3^9lNcEKZdcF7%6Ii^zeg`
zjU`vC*Zg|olB5-$N0Y~{I5A>@@3KKN?Ph0{!F(cgy_azcLt1u{K7a6^@E1q%aE00D
z34&st;zveC0{aScILoVi_$Vq_M4K|GqVMZ}iaXW^zz%RpQ<<Dv3Z*IW@TyRoG^Jsl
zKwtLANo74B@?gn*1z43lSpbt%ce~O**%r$I5Z#ykq*7;q%H=ku_y7s9r#Liu;5dRH
z;=D(|FkRjtoiXxm(#@L?kiouu{@1;5U>#tXE>G3!M(n`xy}GFeRF$d#OV~d{Qng%-
zjUp05T=Z|G+yE&>FW$E~D9->FT8&Oq+a^TN3}%$hLWLube=+nZ3W=r5zF~D%452+5
zaTr-ApqB*`MZIVB!a4#BxetlZ@Ym{nZeCltpM8ghw@JGBL0?B^NS6xIk=x;DE4>Cg
z4SuSvI@-QrhmioS@E3A?GfBBwPY}4@q6x5kfz+N3Grvz@i>i!l3V6%%LKXwrmluey
z7U>Esr}Xc@y%LmI%ia&+L}ENJFt@`b_0wnM3$DPL=V42<Ve)^Mv3@%q8a)mpx843}
zhqe5~>JIybMTvBJ)%mgt&Zoqqk09G7AgUqAt=5xW7ZUYU@9aVGyrYKnTUrG1AlAP)
zFVUOd>0#3t_&2;B3OV;T$dZ=G@UIp$Ov#73JjL%fHMYJ3Bi*3yDONidK<};J6CG9&
z!RbAgpUE1Xjr%@vKNI(zOk#4f%+x!USADaJ>Pjr9VV@2EYi&Y$*;kwg7#2YN^T6Lo
zdXY6_mlf3qUk02xHN<_x_cL9kVh}^D=F6OuIaF{QWd*=92L#Fd-GNT|4EI~HCK+fa
z2K=($Awru!i-0PId{nAkB{|U55rkeLQE-DL)-qsKCvx%mSXB`6UXIzNY=RO7ygOU$
z=bB(f`T+w+8gm#(;hQqn5e-1T{5~f~k3*GhU+UJ`+pa`Fd-Qo#sj7QDj~p`51$rRx
zPbdT2NZ1q{sig>8u3v_$okdo_|5&L_jasm34^f|K=w}avHYNR7{ijt>tp({*AcYO9
z9GH^~j=Eg720h}G8GPhcXU>FhzJDI#sPdE23x~s-x+}HiSpq?j`&B!pPsv2O7=X9o
z1sn{xK9!U}xgX|PiYAI9wo3?;4hBSN`$|pOJSwZ{{U&VNZm~Cf<Yo>aFP;XW8h()A
zJmd#{7H&siH80WXu(S=Fqa*d2RtWC{9jweFPwf&{!;>^sp{lAys@$~Aw6*aT<Kf!n
z6QpQznV2kj-;4TssQw7B=nXT<+kR_NpbpMmRTw#b?i^AotzSN`AZfjNIX{NH!43ep
zmCMh7LD6h))VlpXejp=Rq8p2M!X}%0*_@oX@1E)y2iJC^@?WaI$wH^K6;sWxOz_`s
zh~(a2G6mZL7Xv9f8($JBGM61Mvk9J>uxWpIj=8Z)<TzngjG<S!u^OA_35)f2nHmmW
zp(W`QAvjzXz^K8#xLve50Et!ZW}w$o8*aY0m)$wL*T?n8kD_`n@#N}&j)7EF?VQQ6
zXp-YweNh9V_xBdpfEm$GD5D0lI$N);%j}pe8sY5%4oL=(01JfDXARo>b}Oe4=q`rA
zQt(GAODH@I>@f1Q@6Xgck=OA=Jw-QvBjg~vXtD~T{BjS--H7i>*c;NfKNPNWTyWq{
zuCkOQ8~n@*EN(?^GVG(cz~Eu!sd<O*l#L&Q$#tnJ&ZqiIsozse+=Aeu>r0Bv>}O)0
zNM0(0qXr*Z_4vilag<XM531Y6Qtq%+J>FE%`(%f@%E$w%EqN2x&3A>jJ$hR%`ov1r
zYWOK2>Iom^B&XX2V@C{Y?{+hgqlx;YUaSi#>3Uo;g=y_*3*%|#9&&w3g)U_11aRv}
z#aX-*WTIK%mrw1o{eY<|;?~pUsJd`(GS(|soBSo&Hx~4aYGRllO`HZyGjCD{4z4JM
zDL(K#HNm&b2F|ou3psP#ByEt#rpov_@j+5OM+0ue>Aw63&Q~TFelFX}m~lm@P?@LA
zY0pbq$3rb}s;jPdP$k}0%YHYJ$_F4vQqEqaY16!Ko1se9M<6LkF#e};fPO1UzMWnh
zM*!tt>eHh3D$H?izSC7~`k4hwA0u<-OSlcV?vXP+8h#qYxd^1d_T?HTHVR5)pt&cB
zRMf1#S^_6Muz%y8%aF<lcaq^wD@D6JB@>i><dGzdzv_Mg1sbNSfcND7b-IAx**dy|
zF2|H0C|*HX8@x*O-l2Q$vlPJMvg{R_RfqK@5u52pD#cdJF6F4d>sy1YN|=~mXPq+=
z4Q1H_%^fjK2_UGU!_)M@LtweYeO?-tuv6ptdXZlSPzC(J$31`AEA`4a${qzUP>V-s
z8-5*jjcP*JQ7kU@e?(~LP_9?tz26&UhMj(YXoPQF{n26L*UNzO&mss>!!4Sz(JWwV
z<FCAjZ<QBD39G8wE<?m%)m3Do18VJrn4pdng)_<oT%1p|N-$W4Kwv`J7n4^zjH3|W
z6-`s1W++DTt44TIgMEX5P$dx>NP&_Ov2Zx8-mrTT-GjpTvV1$QmCB<etu0og%JiNb
zzwYi~++w%~RLAmX10HECEf#6I;SCf&z$<+dtU9S1UO1wRm+J>ndXE)33Mnlj3sXuE
zcGSj>cn1;Ov3{>+z2bn;29U`BOwlK>%=1}pyK=YCjWgyFJ??|t@#+;)g>k7c$D@*-
zgSf0W3jm~A%St5D!(FAeUXu!Z^OYeFmj)OS&LR(lm{PBjZZj@Fr)W*SZ|ctJ0&GXx
zy7>^n9~5tM+3=(btPLwv#Y@`*0n6l>+4KBrRTlYfp^j|LTd7!GYoZE=xl1oV_Y{yq
zRs{1X&=tk~9}_abwbyLg=%F<dhc@+BzDP+NnFY{?12a&klrVU*HXT5De$+|+EopU2
zZOi|VyNbJDc;*AjcvRpuzOllD&;-Vs@>EoYgg}Rqhb%%>IxS5vxnnB@WcO4LwXyTm
z%;o!=Ns><tjYm`|w_k!?M+5Ky7(ST`_9O08>0_KxBKlmibX}2tGr-OX0qsb%f|s#-
z0&5}YbwoT_Y=ng2*Nn>_@3r>KOzyH@nH%VWzCn3+y#c1+i-D-0&kd<@g<Mt$|CuF>
z_DBYXC6+7!<Iyu<zlXpM>(0qZcoKB)2Ze{>jNJot9cP9TlU8zBCvjo0q~XSH9nQ)s
z^*5>I6o^|N`*#C5Tj30W>SaQF;9gB{gr1PxbdrC{1f~iJO9U<#8A?JA$Y0fkVYTXr
z9Pe8RHHxwGbfxj@C*@%2RrR$FI6;?mlJg@xYNu!tJb#zk3Y3iei{0+Yk8q0trk*82
z6GfKYH_+@^g9>B86AGM%hyc!Xcr1%ju7Fo8LYb4q6{4JrrR)k`?5`LdRgNUA2l9qX
zhI)Oa0GP}peA_c=U;vV3S&`kp&`FN+{>2>YngbB(pPc#8bqhQc)77m4s`$J(_F!V^
zkFlx-ocj>bn~q~Xqgx7bQ0`Ne#PlMA+Y;pl3=D;^Wlnu>kb4MB`_=6mUSk|7o{0mH
zjn$QKTDNvWrzWMUP7h9#pW>rB6$X<`*>p9{I9s2M2lrYtQwT#){$$~bIT!k>t1s;W
zV>)_l7bTmW2w@_6g~mO`00k?dlG0H4nj+&2+tAsx@#?E5C`I5X3#K%p38JQ;IX402
zK7)dU!QfA25fJ5WVCO1AtP_}w4(m2!i);LFx3{;a&YSp=1(}}0YpjX{SS(meoXD*i
zxUbX6pS?YoiZ{b{f6#A)OF&57^FKv1_r5d$SP1PiN(bni{IJ(DKbgik4^Yj)FgPcf
zZ^k<Ouzw|-qGp;-iF4Dr!H2P2yk%qB$6;kVAE5qU8jdJZ0}xx{sF2QxXXDQ|>6QTk
z0+9S04onS>6pMq1uo*$y6zGJQ^6$cbHCW3Ve2%6SMdBP~?ylA#8UOYe*8s6!uD{5t
zR<KO?;9fv7e9;UrZ31u)CMY#WuoeZ^nzJ5GW9@Ou^hpQ*DEWQkis-^{hOi1NDYEd%
z-6Ej;L-E9erHm+E4DUA(Yl9E)EkF%gJ2)8M>I{I1i&BLKh2+wCizIWASf1{uEqX%6
zco~2W!(FfFs3fX}@D*8u{-*^1lTolXDye_{agdbrJtaXI?T<3$+-+w<LP(RMq^I4-
zqEz=3r>c#46%yZYkVN$Kjh+wNi1cQDt3fBT;|cI8Wu8_%GO{GdT#!5l_yDkFK95oN
zbPZ;l#0UcZL&|ACI7n;;qq*xtGB7{1@odyr4cHKtjwWaH!%wf8b6gCWzFFw@dB|5e
z7_L%0Fu%lkiVZ9KDw5fkXC?s3>gFt*@##c=MD%&2w$R^jQO0p<&+g$mIe`EM!;tCa
zm)$qpp`LM@#XhuNIZ$$<cS7dNdVogZX!z;qf^K_Uof^f>Y8ywq`m6|2P^=~)?6>l#
z!9`--4zyarulIdwEl_X{wSDg`AUy}jO`RL_N=i#xpFOOocxJjTri>POIn-MHzC_O6
zk%+C)|B~=sv@<P8LRvHq{_c5oHUeJ>995Nx_WADXGN&sT_P$xI=U(u;vY`#Zpk{C`
z*)C;RA326z4ODKBOGb?_uRgf<kYte=(B4=3Jh-X8CQ5Rq0`(@x`rrWh9^fG12P9KV
z%kH+AlBv7FQv^QHr-mc17?7^d`T`_kO5z7#;Xwz=f{`G&%gQ>ROiD$ESP!~snEU>{
zqLTQHO*N?a^C<SM$}_Amj>%ebfFM~RJ_A%@a9;`oKm7|R8&>qXm=wA|G6n~8c4S}n
z2kwM37r-oItJ?rUpMhebB{?&rWDH0SWH$3dEN}wqjW){D>zpN7wZ|;+{xcB$@zWt;
z^Ab+VxHy46%@M@ssAXMI|41o;i8Yo-;Tlb00}zp|bwlW!bKj-J$ct3f9*j=Q)m6iG
zG7133*5=`=YC$Qe-XdE|Ai<FgSc<}amW2gurM##_b^cS|21M0W5G3Jo$L<jc;c(2U
zXXxNA6^(!E)xmpNq`(k*QxHf5<avA~G2+D*H)vsa7b*U=G6C7dR4Gtd0s5p%V5ZoB
z-=4#<-q0}fK`fD`e!72_9zavV|HeMo@l*$&K9%amak<YU*Zku*3O}Yq_sW<z{iUtp
zX^n9c8g1x<hK@IvNoBpGe2SIS(7uduIlgj!f^*+Thj(=^0-pCAA2D$JNU9&l<uUN7
zndy*?g>E!@U0Xu9(~x9MRZlNoT>@5!?d}L+E6b0NE<*HRW~}hBcEqGD?}NhxFeZED
zqEGMq*}eQV|B*lLG-0UPjo1d3*tacCLmyoJggO&qNDB<gEvk}TB)Xe%f&{Tro15IA
z?8ARMUl0GmX~%XWON9>;0(nVS#&Gzx@henG+rBigHeWyOoGVS0LLNt;Zx?c{clP$G
z>wpUFLaw|u{L_4tzm2*v@NvbzgiGzaAFv3%Lxm($GvLDtz8Wz5>K}*RNQCA0h)&5Z
zC!d4ul`X;6LQ8<x2$C*DQQ=_uiQD3WW%V$7>R_BDxo-S+%FUEg>);${)Riz&E4w6L
z4+y;k$U=w#Wk)w3;J}AKMPcCWh6YN&Eku8+Bip0qHoEZ$0Y7^Jtd5p6-vv^LXG$!Y
zQV4Y@O|me)yGrFHuap7!vBv4C^R{{lw*PCW0wvB9fDwqJK#5HQ3{~D2C_88c6no6}
zm1^Di)1@F<a!(C}4eb12=W+VLz!1q}hwavfSPSie$wO4@3jDx1bvcRsjgT|8Bnr5U
z4yaB*hSsip_058$-G;2Uaq7z4jSPj)K=el<lK9`bs$HNNS9R6A$f_qR6|Y}@6{lG^
zpdz0V1|-K!pp%RM3>vT;>I?T43L1(6AT?ku0o2}QXNum3z5#&qP_wdXS}3qA+mKQh
zLq)Tk4Vm1j9D#5+JF}R>&3m4{n)UtAY{U!`*@(WnnlY>RiPi2dxE?;YUHO5R{Y?Y@
zDn$o9u-vCv6gtYl0HWG1o@~Bg`4Go96bPxcP;ycb$Rk%d<02D92gCAhH=mwqHg%Zt
z3MTC1>ir<{MCNmdpnvCJHm<5Hegf`NUL}NU;b>vWW#pu*;lX9jC`q3tMtb0ZkORe{
zW{se86qrX&ty^9qf)0VTsO*XOVNftL?6L%Ky`@A0fBE?XmK3qQc9*T4kNF+g%>dmd
zIWUD63Rn^|RAIm=Weto@Dtsf7%K~iFtWtRictz6H0JxFI^K}7p7c-eHPXrKz&a2D<
zobVs$t~Y+irb9%;#L&h=0AHXS@wNm7hm{o5s?HVZ6#y}4tnwG3b|~}bVy_?4xWMlJ
z_Y3tg2%Kg$2m)_oY_)A#`JG-|Jj0DAaL;3CChda|D-%*zLNvk<N(5{{#D+AN{#c0h
zWP#nZXZ&}8@l=2r%oF_W-g#JV%-fIEZp(puzh{QjD@*{=wKLP?JqHMZhHlKU9<e*m
zGLN$f;LMp(gYlZE&fW>a0G=*#Xtnu%yLn_mG`hHE>Sz@}7y$)B2HIEu?^oT3_Zn3M
zZ$L(Rb|<uv-LVI+VIm=XIdAmVcaYx2lX<*k;VByxdK_5TDm8%BzGU<zbx%u3Vaz}?
z!GJ7QBQB3zW3ML2*_pb>sX_6-T$#g*s}EftTzohrWK5DOslFU#+%(7JPN?M>fcUYF
z2oR>m#itvW-UFt!mNyhQj=+(3D}lX0!M%rCx--Yo*BdXj<;Tt)1YX7NtEQZd&;reg
zH3#yP$w||^g`ZDu-gt^|C8B}cRvZ9Etn(@XfK*Wdn~u68GGHSh{>{3RFtM;QA(+oh
z8Olo6S!_TG*3|_>q5H^w3djdHMr#Z3;SZpm2yf+>Xy#{o?3b|S8zyZ^m49gOV=Ah`
zZD6mz2yAN}0cd@oZeAons=9*H0q5FbCAaGh=F}PTFOcAaaNUi^ajqAy-&X1gx4y@E
zXPPG%-%kcRL9eRlB>U*U)0Y=H1z=SE2R4R6M#BCbc(p<fmy97l0RMgxL@#J`iZIfz
zp;AmQj$;`@*uKw!l$IH3-j4Bp^I>OEeh9)LDKfIqfd3Po0faJ!-@1X|94W%W24qZz
zx!}VW<a{jl?8x`WTRj{Zy0EI1txJ1q6G!0za@J66|M2uzC@CZW_~(yW)@ds$TDOzh
zwaG4d3<H-)?=u1)_jXDsHQQ=3DIEpFlxm|WQ&B*I!S2eyv8|@azm~QHLkR@1K2%h3
zMrqv7=ZC}C3x826Rnn25i+up71%STF;>x8*bp7bm8fw0)9yiVwOZ`1M9juq_=*wR8
zW@7;bi$|yM>IJWaM`*D$d97y@gec|2$TJRMwIfSjAo`L-!{&MzdRU)|TM@q1i=?tN
z=9##?jQ+V8|I;Stzmhqyf5?%HI%|vN$`R}hdz_mg^((Q|fA^;<Hw2&#-p)a&Rp-}6
zEhm{`zp?hSL6j!Lh=X4|a!f0LDW>jZa$FFe(7&??!xL#Nh)zcI_0<y#Tj%Zow#MW%
zH9+$D`z<JQ!F%VxXiDIpOUnP9+(?PEMqvUY5*It_U3?cXyJ(;ghvFRsI#Q{kj?c76
z%qu)(qLvu2raUn~6=Ti#9CJh`Jc%9P7s!6_pbAfI05EWy(z2;=y3Lz^+o!5pp>#u$
zWx$!d?!=jHa~DDdxS6Fwc^06aU^*3GB4Iv6_QM+|LMz%X=rR`h>5OC}ea!&^)5Zgt
zpYRv{InY;o>O4<^eqdn0X{q{p3(reRF;@U1gmd|Krirj!1by>&H7eovB4uqA`^=Mv
z%#T>U$R!2U%8BMTxzxqq`Q6sYZt?QGwX@=MkxzQhBInQloFV*+x?tM-UT?zEzxom?
zT2dB$2`=p0x5YM^g>gC5m6=hkL(-NU6$ZRI$FIWRQyEJ9U|wa|{T!C0a1F3j?(5}m
z36!VffZO~)5DX@r0^=Z9YSFOS%S(_iZLziAWzA#UT&5)K5%6+%K|?_@+mSzgPjiBc
zx6u=nx;t68Fc-5CHh(ZWiHb?~Kqpzbk}`Lbnydr=D_t18<7@Y~1YEyI*4og#{QSbg
zJbrm*(}ykPZ{c5#AKk<=pwz2;ElUF!i81~~IaXu_{3wi7VZzM*+dM&qzP`aK=u`JQ
z#%TZRz22e-21kxZNHmEO7>79tTk9X6FsUiQg?|%ijZ$Z{Q3tV$_L_x8>`vc12I*Z3
zuo;5J-Uxx&0w{^>Nd~T;d$bdpXBaAjz--~&DXFQJB7k>ofo7LIiPC0Tfpdw~6a-Wo
zK!mNFxGuYmrE_NM)~2kHU8cZUDLpl4OF=OfGa4^7*Y$3FB?Q6F5f?MoHpNf=BsB8r
z^{~GqT(nCtT6%Nn(lvU7BR5}U=W=m7H&lv$Vk9773zONEEo#{)8OM5(q>gZ+wufMH
zIzEAdzSQNz{SOuM%o1Yai=Vy3JiQzlH`x6CfC^9IBQIl%^WO^Q-d*IeL1}ICyi{sL
zIRiHB*%WewVbyO>dOqbRN*z~ADEEr$)BUQ4zuqYO70>b@anh|tq`t|qBHCA1sgK4h
zFKWp`0wEiWF(nP9t5&WGI^T%P_qbiFnwta0<1KL8`K9tfw-Q3N)#4(D)`EMN(IaQG
zgP+S!ekoLmJbnm|`SCfty;fUDlJQ6t(W4Ig9P%E~51BMMh*d2>3|I)lHrHSl6lGhF
zyDHk5{ZvtE4zZCr^h0YV^WI;azXg9`b66Yh=%f(qdj48BwV`r?=2E@teKM}M4G7ZQ
zU;TheNrqLp^G#+Hwhpv#X2Bw&?i3vfnW8VfaM4RMkm2UKUHgr@SUuTN47ElnzuQHe
zsekL99G~BEIu;fu`q-O7)A5H+N^gp>E>`NbMiYx{CDNWV{v}o3n~g(Ljk%7U+LL>S
z9_DFp;6Muh7L$KR6v;qB0`3k0yAtpkSG_5#p6YX$&k_P4=0|MEiLP@B#DG2RU5EOC
z&GXJD&d8PgygU|GR$*abHy5gkDc0!k)y^$zg)G(Id%;8X;WcX&3};h{tlyQ0JGf6C
zns2G-Hf^TBaYzO#AE!vp88-f^qD`jMNvC+A4r6+!1BDxgi7>iW5&KfAbLC#~Ei-ou
zh1xUYlL3JfXH889Z*Mi{@c6-c1hy%+A-PKOu#FX^bpm3%qYe^k(cxilX@3R9E+1Z9
zLa^p3QFL&}-cuI*MHO%9q1-<@ihT!<x7g^l4e3!25tlPbj30Mdb+JfP6)^>U({$?D
z{mmcSB&e-ZeQjX=DpgM?Zfo7h1e(=5IP1BbWSN|B@iI4<Gw?WmFgDK6FlBC5Y~udc
zufDx#!jtXU2Ft}eCQ4L>hlr_a9L2`f%*I{@Llkb`La(^_EkS%akE&ESMF6zxOalGV
zY^$_*LC|zWof?<r4iMEMleW98>fCYT(2c*mgz{H{#G458K!;ZJhWw|yy-8!{E6lBG
zhF)QUELDAJ$mI02Sf*plB1|9a2k2;-o-yX@`b%g_FkyWAMjPTs7ESSfuImW%XP20?
z|7iim=NRj1E9PKRvX7tWTh1K29(9ln*bsgbd*;ESj6!;%VLg`%e5jIqYyWT;Vd&fR
zW0@ZNf-eGxd}SMxZYX5mLT>Nt3-hxjUBRWc@Z1=`8P=KDQ>VB&R<}AK@pPd*fBvvb
z6_am>_gmNVx_4Tb#IgD{mpoz&Q;~ijx9N~_j$zIT!I0HsW1+Y(=u72yQW5ul(S{1h
zu`A<5bWP8TwZq;?1+Mlk@FPB<Rd){tJk~sJkAB28ajcH}B3hl2A)|s`t{;W6NXjp2
zCleC%dhG812vpYC6Ej#ae3!In4$rhqux=X)wT$U>#W1bMFR41z`GK5&D=~hyFQvWY
ziUkJpM`vhNdt#iXfHr&2MJ=`$KignXp03GTGVh_Ya%6Ycn+O?{^)_x$P;xR9UZsRB
z_k)8=^~t=DYvyc8{sfgc1jDp9E=9Ji#ZtLyzfmeYX?=xrhUVz|xnx9rn(J>dtC38g
z<A=*Oq>4ao<6T+ZcV^t)=qf^5OF_Re+yK)G+^|xF2OL7ac6p)iY}-`sm%BM)a6`&&
zLXj6bK3-c}J6Ws8J^?oU{%lLsoM!8|>00qci3*`I-rd)G|3(gF-?a_EZpdn$65>+-
zNHCo(us{Yp7~e(QIv3Hkr2#9&CR4436j16#r^ckjCTD=WUlvTD+B$sFahlU9bj&Xj
zQ(qQaI@vlp+U{C8^9w!Xe^_mA7INtB>dv%_9Q)(VUun)9W=aPAq+BUO&E-?~rL-m?
zAB7WfFE)mJEZ6^j5t8$D14eFjwN8s`SH*v<XDwSiPDR)|1TQqOm6wwf<+QuAv$JJo
z>$sURE~jcW(S?8Ix<K1_U6N+){5rz&D^URSzH8kpO`45DpK_XIax&6tMc3v5;~9}*
z4u-y24h9^2mG|ng=w@=>-PF9wc#>Si)yO!6d^z1EWkG|i_0_gM_Z0ftw2HNlM_Rf{
zW5;rT|IG1zzz@ftNv7KQR~chdH_h=goJgTI4`q>XngD3tWnpC;4D4!CnEA%!>9K=t
z#QC4mvi5#p9uRe}?KTVP;cgOdU)qT$>2xu(bNo1svmcbglCtrr*G|OJ!&Obp_Hb)&
z=MC1i%C~N->p^V?-IS?bee2lfKd<>EiP6pWQ_u6kiuZB_m19jnrx~6fnTpfJ2s>$o
zg1SC5FEsOfC8lCcMH$42x2qzy(G)C5SA2juCx7pi=F5S;0Ui)&@aNA;Lx4VO_POb=
z(IKU;z3#g0SGPK4>v-j7q*Y(Vg^^bqMRe<Yk&bCLMiHz@T5@6F6OehKg86a`g>+(^
z2%zFR96pwk@r|2E|6Z7|0@<jpc4-i&apTN#b*+)48P~#=6>>D|N`8Lw=l28($0w}>
zX)R6Bf(v$Yxc~28)E%_z%}s=xW@c2H&+%1DE=AI;Kw(vmSpZJ4rZYSbp<f<Rq&vd7
ztuQE|q@+Btf0@|Q|GuuS27pbl2+3*CJIr~-6Kg~q;J*e*Ug?)^dcxS1e@>lDbI#z$
zyx<Ry_ti-*cbMFKj&;bvpj%pyQ;pq-A+=l+nX2XNd?NKM_j6CLqvNBrMyYg)tE3!y
zk#8CfD3o<1uXkZfRc>zQ_6H6IEe-k%mNx!6x_xc_%I6CtuMz0!DNk5Nn~!uACDRvE
zGR{NU^VoZMyEyrkad>wFn;*n!gXx(EC;i%mk}>j>{{8DtO*pLYL;k$@B`N<!o{FDc
z^Z7=zA`4r;s<+w$7#PQP%Sr0y?jvp|Ly{7@Oxl~2|Gu@JyCD(t6PIbpbUcR(=)BXe
z=rD!F-u=XW&JOPOdzx``FF~DI4ak0;zo&VAUggX$JX+nso_AC8D|QZrUUrJfsL5bR
zfPckzS*$=C=OjC_I{Pdy?J%C1?=##VKw#BUb<chnHXSSSeUZA_Y@t(^QMIqaV!Sft
z(_@t%NvNB@?0zklo~d^hU>r0Pl9I6LK7W}=6Q`u-^5K*{S?bsb$}FNTxmdOk{KmOs
z{So}}LvriN6z+_8wlVf+RG(;xJEcNg-08r-ol)GC$;7Z&G=6ByJ&MEy)*1Du)7c|t
zB6Hk&O=AXrr)D|E8&2XlgwntG$Byx1n0TP!J9l0I(ZLkIo|vbYX2^?x<5|7|HCO~H
z^sy99U95zf>~SU%V)Lvv!~?tKG#cAcn1}0?rkXrDa*(uVqm3%~D``R$D(-l@BN_rM
z7T{F|Bqf<79)DvGua4Vj`waI)!n{pVe+twrTc8gG<1aV>eYw~VGV)}a4PBw_v;Io;
zHzkQvoxF@GmGT9=Sa=2=@7z3sBZ>DF+rHzL^i>5Lr}@`VC#b*5OBny-IFd08S$MZi
z&8(fs6=R&B0@Z-pN5E!snmVUDfBdek%e{oP&u=XfBN%k<^dolQv0%hWAqe{=DAyQn
zu}95-H~qFiq)GB?+yJ+-7|=Hj+{(aqr`_Lcl6Sr^CnK0B$?MGs(|QWAC#S|fftsaO
z4+_@Pdw^}GfS+zh_Qc%x{;Z6fCXYhN)<o7tzm=l!<u36L^+s~z?MaGHLC|qfM5HNR
z7XtY97d!0(B@iR0rWT!YJF@5Nl~_>{8V;iCf?Xwx`B8C<8j>mz&nKR>hi<{LC??q}
zp+X~pLTp4Be}mC!RAt<Qciequ`yX6TMc_N4tIv`GjU>RaZP6ojUAi)5v@%74ctX`y
zU{{eymbkr|giN8bxll@1)YVnI{*B`Ommu@@s3brzHhX!*o|<nECz<0rv5keoNcL0`
zqhV==!C%~Sl19yICr?LYt6cxGRBe~5U`dKI%aFiXKcb;)(P*=Wz<EU=18AoMY`<PZ
z%m#;LReL%`#Bgxdb7rFUP+rFt8NAl!0v~B+WRAW?Qu<e;o%pkS#Bo3ParG$WG54M-
ztO8IIx-$N69A89RR9O*>S{*T-Y<E4xkKI;`C>>H+@cpY(_(f#N@0m<n`m@G($M6h^
z=Q~|c%XBw#Y3dM7>cAKXnbAYI++IZ!ODYOmQV4X&5RtLYoH=0j9up<!w}C=p2U?um
znEd@Cp>+LYw(rq;xI=3)-hdOE>#ysN8M}P$L*OgvELcfg!z)I`47-G4j`XK7d4fHr
z2&MaA2DTdUwZoP<Aii-4^sPsHKaf-dmmoHfC*WF8xNExIwE9cQ(byopRG(Ch`>Eo%
z3$u7Q{I{*(-C;BNHzXP4{z%nFj`}c{J+nIO3N&z=<#oZU#~A{${syoeT4dwj&Ih6g
z#6x(WA!K9I&T{xqPKw7svE&(%p^PUuQafu-qgbY<tsVvSTQhPLJIs?6r^9t0b5*#y
z0(yAk7AVJKQMDFToU`<v%!sR%gSOu1=@i%uY*xp1itp6e*0X%0(Z8@Bi2h3Gra9$t
zDC8<K(@a%>Js|h{;k#lTnAqR^i2`VCtYd}Vdxn)0X=@rX%3Sk()Lf=TQT1~C3O;JD
zD-E9xhdO+f(4Z_Euh>|-m+a;`DVE~iv=`ArUe%-?k$$kZ_St0Edu2QC2wrtZVgB_`
zI|`wRz#{tj<v6Z7biv#0B5BE7Gv2yT%UZT3dJ^XD8tfhYDZGx|r}8)c{y4-|O)u=w
zMD%B};~3lPWD!_#bLLxbnXQ&6w#dv94cT*y`Qr+I(_k@{n#!ctut{~DV|08Pt~A_z
zqIKru+Q-BeRPUeYN~o8%O;d~W)@CX$Z{oJE7DPhe9>3Vtwap6UW_%=v==oB2=f0CZ
zjriqtYB}Cr0cUfbMw?UjdMms|+4lO?a}&DT!3fzu1N*Y!E+S)#J^ta=jtc#B>FmFt
zMdS)qm+28DtOB;>ZLuv&QF$GUd^P8Rv?r(ZQFr=E)57}iT=$Xs)??2v)UWsVWq(WO
z?KA%k>Vpe>HidKJT(nY4dY!58wFye|>|3o@^y<rgTAQw@jA7R2Zpw1G{Mu7cz@7nZ
zu|1>{7JA{9NgdYD*J$7?Q+sVqN?G}smY`4=-XxeZstoOyEiZw#(5s<kI}?O!U`y$P
zlef}zv38SiLYrvib?K#&e(R`tF`!&2f6%H=ZL06(*ss`?CU?K1MA_TgUiIXyy)BQm
zm=IA1kE)?7$JXOwb-(?d!`EqIN^BsmsKt}9)M{40Gg(<aZVoSp{T+5a*<vg?LM0_u
zlfR>N;g7?c8YOV}lH*+#aW_rQLL_~?|9IqwN%heg{)uKOsM)CbvJq}0Xp%}f0yrV4
zaYh%Bio`G3`b3<6d+MPIxyQB>vsfBffvT?ZeLpU02O|q=vHv3b`P!~e`elm)7+ATl
z#6O+H)6btgClxRR#nI;NN7CKMA1oeCytcu8JtI@e>YX@lDt8~88?BlUBlICv0?Z1V
z-x7cyQV?7vLnCU0uac9Q0Y4W$wO({)CNkj}CLF&gzrT!0S$l?*Jo6cb?RC;o$H4-q
zM1poulQa%fTY{-<)k*HL=tooBbZ-zk?7tO#;*0f3cunB!fkcy?YC1*l>m-*2*UbLG
zzWv*1zE7cR@$un&tvT7*zCcC6md&Zj$)8JkTI=Q+-W!jS8(e0Tri_0#_({2B{^91N
zyqirek49r{ZOwj@MJDQh_<if=yV+8Q!zb>35is;=C%p2{;oaFQ()WfmqfE)=w1-?T
zt)t2yFV^$3+n!&M2bP@r-1MZf_}<?#-IfLQEGz$vhLA1ao{4SllgnOLbX8f$722KZ
z4gKKivl)~SVDnwBU-wpZgXRSa{Rl86GgsFR=65$4Q%dFcyx#L<lM;SRnn9(tc8z^^
zl)4m4F=<|)Skup^Eqk+I4^nq>R@UU^8hTY6)g3$Y&eazw$#o<cJJ2(9c_wxq5GL$U
z*Hln@@$-0x;HG_LY5T*ts1OMW$>m0g!AIze7cqK7aZ&|Ab>hyN^s)}xhgZ&<>Dkh|
z9<IngE@CuSSGcF-+-YF%y9zWjp^Q)FJ*;$+HFEU~q4OEx*91xEFWfp3m1jR-i9f4s
zY-}N2R&UR*!|7X32Xf?Y>Z%Q+`5bV6z7=d!>Fqy?jn3D=H|VkrI|{WlF5qshu#J%4
z{Uo|<_IB_9Ht&$^)~C}b^_Fmfoz4~al<Bj$aT)&wJf5P!)p)#MeY3bwI!Lh8s$c@W
z#^w&I`0nBm4{__MFCknQb8jr<By}Fa(5`uxIlW$NI?&TsDGlR18IZTO-bSEw>U_R~
z<wW8hPe=XTY!W<PFZZ33O@hHT4N4|cQdSLrcSlBE*dbFBGx^5uPUl)qS%deNHn(St
zAO_sBrF!4ShZEj@sF1oI`upcCw!g2Spy0Ztt}fC|KjlW+EXuC~U6&`tmD8c#FLFy7
z<dx=HkYB(teE0Thb8Yjf$*o27&`E~b{HL7b(7!Hq3G?i9lVa%|8DV4=Q)t!UVheQn
zJUg|;j|`$<)6m(wA8&{-_<7(W)5+Ui1>ctGbY9P}h3zvLqLtqNX#uxhBO4sdG4<<Q
zF)y*=wpe99X$|Oe#lhAtrfq~>w7KFSdZ>bLNhI>I)oU8gw4b2eBv-p0Tf>aW6k6Jq
zhd;GQnRo)PghYgG7RYZm`^ld~L_B3(ym~F$Vskcq+^=s88f$X%yp99($^CiSyH-{#
zeycm2Eo--^CCb}KOT&heHkI4ngs*I#ubw-m&6~WyjNNx?s@Y<F$`sN`YC2uWc)jlE
zIMX0m<l(&Ct#4d=f}VFV@~Tvtg};sLXk+DxJwNc}3{i>pR+L;)XCx!S5IxPj93{U=
zE1y7DuT3_EuP(2#PI%kGj)!7JxC1utDQhb!b&sQT9uQ-MVteml4h25U&^sQ=u&(|J
zFE?o1%aOiu12nq%+rkGhO$CM9Tf#*pRh%rz7Qv{tXfKembG^@B2_#v^n#t5-Gs8#f
zKVtjWWv;$|tY6rE`K(APxwwC&Qd0V`w8qx|-rHDr(`Q2*Y<ggFgr*RX31PjNaUdYe
zl5MS2^*!odz-3%Ia>4wE`_ww^p_rs(VXqFGdYV&D@}^LokmEw@dMv4a^Th_2_r>0y
z%Zbbs*+aloj+HyoBSGl970&<o!~`+;;R<a;G*@#InBFAiTAbeGrut&<a}(V`1!nbi
zce|?Qv%1*k2nSTQwX;v|RjT^pZoh|L9?Q1R?dz>@APG-{%1;f+&5bH4<Erbb<pI{1
z;Px3e_3nbv(b1IIjx<{R%};u2YCD&Y;;J7Nc79y$`~+QOVRP^GY&+ICADq(UA2a^$
z15;MsaJJPiEG+0>Q07b!9(Q-CCSN1vQ1llObd3scIoapqXZRa8P`zD5I>rKfIr$jg
zr<!TA&gt#x=P5?Z8`60-9mnoGmG>xvAR@NQEqzPdV;jxIu8~&htiSiEJHcXq^>_Bd
z!5RMP##P&0B977-G0@R|ZL6C0zbxCD24p|I{dnB{E#p9Dm)p3e@@)t~hCtc72HpIy
z%?{ZwRSv0P!n4ctI)$1GmFE1GjBPguMse(~2L}6Yf2x#O+u6j2_5@!`drO<l*qoN%
zZLw2PQ&(TLmOJsaUWR=%XWyHt+YOzFdgnEQ6!|7B$<8jyt{-5m@%H}f+}Coky(x3F
z>9@w?HCJ7V1;0t$@W^oRNJe7tZq~wsaP&HVyyJClXb#2fZ)Z_l+RSE9rSK)8wvxpd
zshSi-0xXZP4)KoIgkEcgw`}0!1+|5L<vx@PXIFv!SrKi^k3bj2Y^Qs>+2VY;9HI}q
z4(@b3pcSvM+fB;TH*>51^V#p5JXOY^-r_Uxg&(dm7%6E3Dc^VitCC~e`L*XJA0ICz
zZ{1*IWMSqzR`5Ebz3<Duqi2VI*fTB<9S+Hhfce<Cc`aZgVZ$=RPwhZWgjy0l54B9=
z62%)JWDd2^*pK8@c@vl_oLRq2_~_}@i`|!7)FJ#Sn;GZzS<e1`(nl1G**k;g+4v7=
z)BVTiU_eoWk@ZlNX5DGmL~Ns^v{w-1P0P(|0A#w$8T?f?1o%3uOLo3DY#r*w7OlUM
zL}Xeq<9K$E_e?W;rNNybk!1T2F#D2SC2nJU^4wzeW?<XFj_c>`_R*4#ciyvw{no$R
z?z#GhtEEc+SOVYi`CZ#bi4RGg*3WzKU7d|Z$y}}Zc@HfeUF<sT3TFO^^P8h*_6?d;
zWR5BEe3N)^{MxDu%o3kK_WDsneSQ6q3hTvL{fF<hc^4%d!$6TFLhBX#E%WkM*6Kf!
zxVkDNs^y_k{v<Wd7&os$w<pCzYk8qMY(c`(UTCYu3We$~1#kOAj)ZGIRf9OllOiAe
zVN`_N?zz{!{G{IWH91O8ROiTPCe`p_Az9!e9H2PYxnt{pMX6VdtGgwlH3?SAO=G*^
z0?<9prm?xDwl+wC<WSA;>%-r_gea|}%j&^fkd5-08z$hDBU5Hm2;Ce^+!mEcL%6P+
zd#e4Yy$<$pUkx>>CPZy1VeU0!N4Q;CTQB{t?=iHJB4tS2T_ZKXi9s72u58Pm2HARB
z&_Opw!^_{Wn;EUCg1moi>%QQXLY0fkx){nkOCbBZGi$}VGTSM}rl-$(dY&dzQX-MM
zDqLJJO_=UP<l82y)Ksd}lpSj7_?7cAL{Nnu8GTymO{#3YFsuvq^2+keqv+ekKqPY%
zArsP?B}v#VMIH?&<NT5wm+!K%({`Hu`-#*l0n2)xt#8+TRT%uxdjF-KxbO8ewq~MH
zQ*_J1;fc(@&I$Q@T37D3JtyjO!Ijy1aNYijjg^(YyexKIckOoLBJ<_hXrr*rEosfK
zq{E%jKsv6`eQ9UzpJEkb-ek#;o`6GXijl^d$o)B)%jHk2&GhRUq0dx$qtf%z(-tkG
zC)slR3YhQ)Aa8mWAL|)8n;$(HGOjjIl8fcx6c(N^6Og2dOqkTWdTLo=Fgi9`qW7(T
z+wO30Yj00`h2P<9tL5f5*B08YzZR~^&+e^E;PU^Sg&1kRV5^EearKb$R#EXIR4Sr3
zkH+Ip1SGY*HV9ixNt@Ip{r;NJ-{{Fr57=y0B;w%Vg1wLHShF)6#TaLje!7_fm8j%y
zzx38-6!*Cto;z$N_K-qkkM(R#4JwWfn(T~ZC4Le4X_yS@3y8G1tCld}{}Y1q2w9ce
zzc?$fY?eSWry}E3`grio;_IX8egpTv;VpxY#>=Krk8bkG7k!TRm&rBzF?tUPI=JsE
zKZI*3@P~UdraNu8h~0x=N+yYh-ag?9$z9sDi$gQ*sJ<O4z%VdD2@P2Xw#Bb3mV@G&
zA4Qx{<?tDIV640{zmxo7h`5cB+He7K*$A|bIxq<t#rQpmZ&@E7EH>%1*8i4XqekcV
zUWL5}R6nA-4D3h61B|7crd3dX2wY?r+B96ov2d9CIA(PGn;yI><(k_$NKrnWZ|Wr_
z&j<N9+_j#qNV)nmhgQP;7l)K@hPNr5v>462(oWgh1WOYRvZ-_ZT%GV~{d$H)(Xdd4
zpDS`{*deu3zxOKtNe~hSFEP6dp#s3l_Fx~k=3a^)U+*Ht0x>^TUH?A6TQ;{$!vaBw
z(GDCA_WNu0Y~k$l7q*U)f`xH7VYNCUp?|B3LR?D~CZjDENB;VC#m_du<sT<KDZx^T
zEdGp6F=!XoAhkeudL=)=L?D%4byo@9OXw$I%H<40VN9Zr)hnT{I{Jm_%8#-LS2H0A
z52v39gqh;CD^x-=^TBA?R!5sLSq)@^`R}~{OiBMru{B#Nw#3mpSa?(hV|{btk=|EM
zz)Zz{&XKOgt3W6XAbB-mt$spDqsbOvT!zLpP2XFpuVYH8k^iuBh0%7C)2O{cY%;K2
z1A_4+mn|u-m5DuR6zckX28bxvSw2(_NRIK~-5H<@{fBpwo_Sl)!~1%h+f-ILFrlAF
ztJN1Va@aLJ_utEyaT77v80QJDGA4DC0TsJi#m$fQ1ko_!b$Tb4*RT}qs$`aznj$zk
zfyQvTaenhB|Bt!142!A@|3*hqR1~l%C8Y$UTT+oOX=#a}hYo2J>Fx$;1{h-KR_ShV
z7zQMU?iyf-vw5EXbI$di59d19`{~^u1l)VCz2aVX{O(x49*NJZD#Z7X@Ouk!o=_v+
z?2+7kJ_rJFetqb0drbnqff+M<)RkP}bxDe^%61ro86Tar)7y27UcPnIZ(7BG&LgZ(
z7Lvl=IWXre03vaYeic8ONd$99wVb}a^P*U<pfWih42BDxi-48~8Ifx=w?8BzY(hI#
z$OaSt`UtKe)J*pV7-F^GED&nsncm&se)w5Il?@=NL9w?dCV6@VxkJxf7-iq}eYs7t
zzczUP!!5F(egjWVBQg@L)Pf%YZUIwp;cM!hHB?lLV~TBcXv*_~aIyjQpQ;8)?VXRQ
z@8`O&4ydjT(izT<RPa2O1sB}U16QSp)yKTo>XH#`ypHBl<B?F{TB)G=+7IT_jXlB7
zr2i{qQ|Hz=%QJGX{nXq_c64BebnUhm=vA)`XTvOm)NP*IA*RIg9~=+LFc_8(xP~?#
z`aH{RN%^>>Z&h~vZ1*{uZyK{o5H3JHfAv$#mTRVhO5~2fdm*yhcY^UsCT((*b9eGQ
z$Wqi3V@*Ym7E}Uy0H}JTicm!JlfvjDP6qJ?1!<r&#4MfHJ!7g7w}LM3Q|gm_Euu+V
zm*;DpG!E&Ylu@pOd7dZ+1k)r-PR;m=DWV>6(gE-JjBd_Eaei!2xMhILzIH35eWT$g
zHA3MY9MSUYQ$WT<pTU;{-T)bR9+-srPWRj-^nIP%<`A9J^y&Jugx*<%k(S?A?SzuH
zeNqu$6UFmtk9<Aizu|YSRb%l|kxoo6m>FpRzh6>&LaOOeW{zXBz&RNVx$bD5AG`2%
zZB#1ruT7Q3*!fXOg`9j1J!2YXSF|3ybkFLeO>cM*$s4tI2-ASS)x7*bY%>V-OZFd*
z)*^cIhd2<0dGm9G?4O#bAZMwYYHUFM>Jy;Y&j0K7;}WjI=PV%5;%zPD9Z*NH?6p(&
zh44YoN^X>mCJ5BQ1!&sTwGpR13TLu>IG_%mMy|l$rm7&&Qj87Xu3;ACj-mw!l>1|!
z9PgX<eFbt|0Hb?4++zm%OwN-jVJzFvrhY%Nf8DuBZ%&qg3p6qxY{2=(S}ugI%3V7D
zHfSxk32IaM3C5T9-o7X~;HOP(da^SM$WKL<&*Y~RXhhjf4N<-y{`JYg`_HwGHn+qd
z2>^Xtq0qns{a|@9Ok<?p^;m{?%9N`C72gl~`6Ja$ozmU(8T1jznQ_p}QkdmVL<G@`
zFxKADNhk=^)qWSKIV6yWD18j{)}j=cCJsub`0a~zCp^$+Qq6DL!S~IwInxF+ZOnFo
zG2;B#eFY+o=1I=KdE=iM|5%SIJDDQxOfdufs2gDF1Ttzl$m5uJMcPeYB?km<6LAUl
z#Kx*U2Z`GOVWAw<mdtT|xL+0dNLADGr{4gxKZ3Kp{EjvmUsYAExU(-{0I03#XFDdG
zC<Xuh<M9A4yC81_aKa`C^xBR&Zl&_~=O+V!9|%OPfGYPO8T&Chh6Ma4?P$V;c<Vu8
zc`b8k!zG^7c;h`O;C4q)>x()DHC0Evn$T?8<bbc_!Net#a|p!dxf#$G;DLzD2wh8D
zWNaLnKj)kKW(x~s5@Pg|sqt?R1D3mvP6;<u)4>$iYq}rV+M|)z9{ibD$<e}t%^@*;
z(fO?&L190-!TtRUL44r3%Kl{|K3!q{l1^iq58tVfJg=5Nqrcn*?mVUojRJmvesBY{
z16*r2hjjwiTOjfV_~ADM$O_>4Kk9am=}*XiSit{YHwTJAAkr7|wsO6gVN(0bjV68<
z?>|3)-Np{2T7V?brMng$3*vvlrni82WzZ!M)d~9j<1FA(LJydd4>vpXyY!%b+PSC2
zPmdQM&;!6X0=geHbcvrqHHFD!hlV=>uL1i21Ts={!mP}3%Ys3mN5MBw6;e{XxPh+4
zIe?k<vp?7!kzoV~;@gLtMzs%Ta8S=~*8f}k-GW;nBL+!s502ZQ$4_tQ`DVR9BZT^7
zH!Ji1@Qu~vTR*AMW`Bso`%?`v1${p0SiZCJ3FKu(<h(zcnesn4EL}(A1;2x249yTr
zODbYBO(432d~Gdt(ALf}5GZ?zoEvl>fqodOIlwI7WE_cy$}SFsFYYkPG0QVM_kYl;
z=}j8EAORT<y=;1siBLcMgX|^(QQzb!-T!sG8gaVZ(0<4bvHD0CLSboZU!B?~4@Z~f
z!4HSo<3c=l=J;N57nTZmUM5OB9VpZ11M(J=HIX*HdkMLi)-S+m>fcOmI1kA0>zk~E
z>%z@KJq~W)$CpHx6lK=rLQGgRKcV*cq=uH_h}lqz+8d|k?0lBK7aKzIhmLS=)#s0^
zmQ5VHzNgEt5KZ#9ZNqG|fR;XT;`n{NJl){b%2LVsy|BQm%U)mYJdnI~MO?pruN-w0
z;`ID6`_-WtTKVcQ`!?uKN6`)Pzc;%aWS34{rq1_+#6ZCL<Pq*|PPRh0a|28Xta?Ay
z%WGMJj*9*+XpM@98?-iEA3GtYFP6_EmX6;ip@F|kg)ofY-Z~tmz&3WphX<qHy@(Qc
z!|p=ATaAot5;nXbO3{zAIiZ)$pe<D*@=x#cnn-DZIxQPWze`{lU#MM9)9uoY8debH
z8yHJA+EC{lLd7l?^*Bv~>ydHGWlS~w@zchvFmAAOk$p+g_Qghv5Ks!?AMzBRUw(Ln
zZFAK5qL#8U=~7eHRo$K;?I~7mKYKdrq{qxBGLw0tCq18L?Jl>P0EI9YI5)D|IY+uz
zIjQ>#!PJUPcj7eQrg2N*c{r;DJFGl)Mak${wMBtXBdZcq2QT_h<%n!!2Su@~n5e04
zuOD~)WPq4#@p;NthnWGD6y{lSWM8_5_ATOy=lt4*6snagWm89Pjj^}iaPUJnAFjig
zr3B*9ohSR{Zjn%@{Nn~c$p%IwbGZys$JA1jQ>J{${_yLHwcUIH2-L#COba?%NQ{co
z7v@zCNSk<_F71fJzGSP&Cpfrr@rk)p2DUXhbW1KwI)k{0OS!W1=VTB{4zm8Dp}@q^
zTMRnT6b_w97~N7zF)e|o7?<`ymmEID#t93vujgYni9mnV0m>DSbO=Nzvh=fMiYWx7
zHPLsrdYf{{H@+BuBdJ(G7ZiF|nmo}HIp(kJSl<4&+iaMtDWQ_LN$nc-_OPBs0-vKN
zXg!(R`g={~pIMv8j8SoCF#^V@9?~rHIj<l2HT`SSw?QAC0U}+g(ad&AS@XF<8rOgg
z!S#=tNN>rVl?iGR*QSJg4!-jqk<l2B5lehWqa@iu4zE!gwdo%G47AcD=I-XKQj%kn
z0%K$}Tb+xJYX0DJ?%Xue1%RZKbal$~Y-_e(ucqA+=MU_^2a4JckgYS+K7yWUr?_it
zT32w=((N=pns=5o?{5rL!@Z7f;;I@Bz_%?#t)%T(ZCRY}#T!^TYMGrhR2XenlQbwz
z^liZuS-S}u$Qg^JY~7Z!MOeEDu`A@xE42;ApYy%K?aBM36+|r#9O4KwypEoO`~Y^g
zcoAah+gNO&T3PrtIfmj2h|`z}UQVT=`m#DDvFklDm0@K1ey49hl!Q+JV(K**LxQ35
zMvHs8V5q6MXxzYNSr1=oX0V`K7I#gKBNc<@J+jw(M3dUp)~xM{ptBd}3)551H9Qs%
zs~cl=QI*eGA32g+QSqFO^hzs>`r(0|QUZE>PLreAirere<tnWROS^GRQIEBY`vxn;
z(9V_J%y&NS0>SM}A_rvCFvS={bqZ&PsUw!zOdl4ZKNt}?MO@b}^gE~@Qc2HJh1lMj
z)8?ZOVSUl9K)3dVyzic(sO?O(7YJ=q1fs5V08R}4&M^4v<<P(hYLKm`a^}@oluCUh
z`n9y%!&W*b7#-7b&c)6{SweZGO=m%^<%Fa{XMPPusD2_`hv?zlPHe1-TX-dyff4-2
zk%2h9K5f~x5%`5+HP6B+bfD}|HQYyM^xjGA(vWlA2`azWR8e-2jl#UYhbu*)w%R#t
zGF8w^-O4r_u>xfv($O)eqv+@D9?+NxcOp+6D5zc8S=>k;i+63p`uDNj1%&{{8?{4*
z80YrpY9=|)tPSTXae!~I7nPPZ+-~Hq<>^qbFnYRt_P8cc#IB&8Qxo@EU;};%kP0YK
z^di2*q*vdN`I%E}W4PF<bPda8GI!JXwxH8MYHFeZ&nqVGe*PJ0Ia?z++pmdz9dx?K
z&ykgnoCfIdmdJw+=w;+hs*oss!vq^m#PVqcA1+%F2oxi(B?Wq5<z*CGelM4So>x*b
zwx*ix{liUbS=IYQ716{~{a@r2V;Y1aKE<g)pz91y^BF|r3K=G)lkSPGL_&{T$WKmz
zrH`!?2hqI&th_tNlTMBv1F~|8nlYw*YZZypcdGK<Fgz?F<@~*&N2#~_L0f@XGm!uH
zlmPAer`87EJ!4shRUTdR9bK2$(EK<Ye4xdvk>jh+x5dBxV4?N<;5;~6I*0QMylf`9
zbB8-ZuuZb2pk5b;UR>TG&gI|<ky^o@t!}-<+#zw3&jX4Z=O1)z(u2V&Wj0Ptz2k+P
zRqZIu$J5w8hEFBKvM4QEm{w(%KzDXO`Xs}wfT^d#-kTc~5(2Et!gKRaKJc6$n2XYH
zTQYiDjrW`!a(gXZc~3+{>nC0tvn5!rFd(-3nx{wI;0Zd~rFmS6#l0$@EeAPV_!?Ey
zW(%F`s$RPl_lk~sTwF|uER{|&^O2zic%X@anX46p<T1@B{!>$Ib+`RK00|n=_M$b^
z(oLq?gorZ)L!7K+<^&7C=rU;t$%!Fe!fIAYJn;~<sN^8tqGWoPDnY)c{=6BK86>^y
zRh6}p>a_XT3^85zoP{S-?BD=vt_}WyT8aWipP8HP*ucsD)P^LJ=a4)?*Vt0Ea^QY<
zHaY#^vA2!XS*Yn!cJlh*Ly(aX^Xs%y5VetMzRndk#mHNf$I&b0wi4Po?QKiUK&f7@
znYm4d67e&FUBQXfixNtKsR>FGt)Do4*`N0aK_TGv4xYPr28|sHQySre+bJtbK*h>^
zmAlavfEM+%U(iI22-Lomi$^^QnBsKNi;v{9%#&_$yf`cByQc}nK?1@`hI(A;!wHb$
z>1hkzaMab&mxb*tEAdy-z)yePmU$i1VoV4k?fd>pqWVzpcs-IZtlHAeyYYet?ZJjN
z?S&*faI!54Rcs=kVnjAIWo@5CriuO95M;8B9pwCFm1Pmp@~m2~&$%ZB<7(dUz0$P~
zQrFV6QyX48)$8-p5=v!e$qcVHO+kjSvNGe6T?@n$Zar)=UT1y?;<!<y9^?rtuNr#j
zsC}}&gB@QHP#UO<6tpFC((5E(josdHdBP2e#1yWoeoo4BEmg48suX87Nf;V%YwUA%
zPEc<e)9-sjGq`Z#%#GOW!CW2b;SJ|aY~_W5p+eH1UTACuCoFx$5WWFKQriJAKd}lT
z*i4rep++~gdSx97T1_~jJdN8;=-avVfoT(CX6FY!&wP_D0&ImuWV&X;*3R|&?t`8t
z{d`sBv@9?C#_gic=Qz_JBD0r1&fl~O*skKYdu1nK86;lTpJ*Y*=H4D->6d+fzA1xW
z^qL86PwkrVvEU#_w6Em4>tAR|MRQuGd7pBcyXsnvHRnmlGDsMDu+&CMP>5B49(zB!
zx<&mp?~j5UVRmgG@4<8T9IlFwK)yldD`j=5ni}iVFp6gzv+FcOZB}~g!?ntZ->1NT
z?SxHs1SU3d9)cQgR1;G{?AsJZnS&3jAq!;TE6~V^cX?b9!YY|%;nH}9>@MNu&Sq~>
zG}7O2wPt2cLa<wB1mKRh%FUEPpvU|GQ9ag<%&xIOub2I*Eu@tbGO~HCJdftkb66i7
zI>;>}U;TV7K<T>DJSkW_WZ5x5R^Ckm>c9tVs1F}MZ9F1aB4YWix_b}-vwK`qc0@>V
z7s8hI;#<Z^j(6m50!*|4-PYo<z#YFYzyDH!o~9y&78_R9u4rrNbmgq%<fMufitO*p
z>rUxsv324}=+D~(qqzocgET_Tx*A#$D`iiP%XoN!qo<dxv>H(mSx!WP5$U!-wHrc6
zXGUm7$aHae6YCAc)7%0q5IUagz#sh!Tk*QO(k2iI9WxIzpV~pbJj2+151mL(Wx|&^
z3~qg*p6_y59(_IZqiyTcNwM7d*!8(+X~fozXPU2;7ZbAsl&F464j3Lk2*>P8-`ZE#
zR7&E1<@Q=#CM_mGD0%*Ao#0lo>mmeD%d)+#a*4><_91dGX_p`Y8i$^$L{yFJMq8j(
z@v>3sk*J=gDz`4PR`o{{82bN#<T;SI2HA~7q5{dTb4N4A)(Dj4w(NDI1grAz6o&tz
z?#}j#U&hIQ&l4QQ3hDr=h4_89Ux+^%e$%6wZCwf>)kD46lK4Yrs?c0Pm~ZjDl5D$g
zc0<m}fgZ{sxHC}XNcu{JbQ#!gF<$ZNYs)4qR0elJ4{myM6){lhZK6{4;>}s=ye*--
zUuea2{UcQ#<o5l;FaAcpzus9m=JVD6*8W@Ul274+zY^wG!TsCeHC5KTi9WC8b`~n&
zobr9Z^rODg=eH}W30s+w%I7yvH;`lwH!sE42|~_nC}}Q?qigw^exH5o;tXE0U!%&(
z_WgeA=P5v8i+Yxkkp0u_$ggu#vm0V%ZX7)-oE@dJN??_RB~`N~p>%cui$<!TgI{Fl
z7E}jM*zzrKspo(t?Pv%vX&;w_<>u?tC<)H4;A#nU2RS$7TbKoZE@-m%w*P(n4j0r8
zB=Q71aZ7z?O0EfV)n=B6$R(BPB9rC}w_(sKWJwq7vxUDf?eIcHwSN>7xO^~uj|}uE
z?4bfquv6|~`#28sL|M3z^jH{qm7_)zm-?vys=&jI+#palz=u3=)Bjl+As2`gNd6H|
z?^ncEo(3hgLmwB$D$+zX3jR<cdH0)Ek1E~XJNnkoiW@`sLy|F`li-A@Y9S($2{3QF
zFv_6EPYPzUBR@?0y9_vhLC;E!*x2-AUt~H(2fjiq4{*2??=kW5XJs|^!xZG~_C3gN
zi(ddqw4f(3JmzhO?XS9nB$>&(KRgin4-3e1hj2>ypEjioD!b%~A}BLsNa<E!3Y;DG
zNvj20$T8lFB5ow_$5i<1B=tY43QA`wHt@n!ie5PeawbPLf?)|W&(?;Tjxifm+x)sO
zA_TXnuK;O6t(y1XWfJUDh$^nEnvt{7Mx?4WO35<>5!Xb{WF{SojM<7X$g~9SW?DLa
z(g@Fhkp9C9$Zqfy%0dJ)8Zc=_Z~#l-o9g89X}5{zGz5mwC0mJeePyI4d%n1ScREAJ
z@ypytEIB0%2vbOCAJyLHXx+Zm+3g|e#EScT5Ooi<->v?UPy3emg~wGt?PN5}r){0z
zx>&uGGi8ExTB+4z!JhZiwfp7TAffk<9P2eZPx1XqgT~TMKabLt1(6{2WWBwlc0ABx
z5<P3vN1&PWj^;PKJe;Y0JnRq{Q?Fu*P9oWbTB_B{k|=UzC3%CIg?fYSt9Q-Yf7g@E
ztB;wv>a-!64Nw{mGv@Kr-PVFeDIx|!h>a@faT_Tc73en9%JIS#(gxis^W1Si+V8Fj
zS)Fd>u)Deq79R5w(;@jCeU!1C84xw;cC}_Cg1pRb-KOrf-e@%lD%PRDET$Rp1_qi9
z4AkKUfBGuin*YmtBYD;Es!z+%_YkOR->ba5dU3Zfij3QJd<w#)qORwKX~Fb)K{y}S
zyqxn^Cf?aiU^i$`HF($Wav77y=&r14xEr)g73({V8NPcm!a{?&g<ak3zR+qOcFTc%
zYmT7IR@bd}Q%!);AU`DTdT#>9rSI3?qbpzEF@KB|ov*FUs7b4x2NNw9*0RChRhu7w
z`iY4bU1}s(XEwH8$o1CVo4$9w;~Q>iC$y(hc$-pxCWgIfj$c~nkq0|@$Uj5*B?h97
zt~)svDR@7)zY$>mCc4({ozX%<l0L(;T&akw(LsK@*}d9>+7SAR-j3C_y}J#)9f5W8
z=f79Q=DRo5wMwoA)A-r>*_Ca_GOzlxu9vSz!pXR2bdU!J2l=<Q#jd|-B<w;?OOZN<
zE&bilkInFw*6wshO5cl_P0{@c?qOmQ5~K|uWF?4dCvFmBS3tN{*{ykb)Gc;`O3=U_
znTsJ;WBtD%abl+*S)Q3|iB;_l1l%LoN}^yDlILqG#iEl8vqhM>YaSrlq$4R?J|i4c
zYTXdm9@m%fw(8s*jCJ3;V;5e!mg)DdzZAtTRCGLaqRtMyzaID~{@7+f_#a%=*gZ3C
zC4Vn=jbK$4JB~k~tUkE>cI^b_^|odf(($p9t~qVf^<}8b5OR%Ah?+SalA0V&dxYJ=
z@e=@WHa~HK3750^N!9N>ko>QnCkS)pR4z%g^PExEx;f_Twew*^c6>e7%A#l6`j$0V
zgAY2rt+-{vc_Jv=UE4v-C-J3+Us|cvRfS988-Ms)SD-zX5eJz0`5E(*Xa1ycJ421M
zYkgS{$GAF1UGXUtiEuS$S6ADY6~-!ZkloeRK=p}E>IL~8FV+jGV?3%_Z3n(rDs)`f
z{f_tkB`m=ADyhY3#&X=dL0(A4Mz+>-r&0bS!?i9yzoB?znSSV8;aGJ)4o8=vx+bwN
zd0BZITtlKl(<%!R&$`htZnFx=a=D*ow+$x?wztugBuKNh9Kp4#R$tpeezhgit1K^u
zX<4~TS^qsRWU}1q%WVztrs<w$*csI`aPOs8efdBS@{oNSCEB(k$VAkKdJx9|`GOI7
zP^8l<>HdCwIEl6Gr<Uw9$>KkCcdP$E74I2xhTS$CI~iQxubmdYZa%=JG;}Cc)^Uu3
z(TLGsoPMh&r(q6dP)c3)Jk*IOsjl8S=ATcbV5|{^Wv+PIy<eI2-fhvDn0T6D6D>CH
zAT8NRlalNGjvBl9Eq|58j_#1&3TAxL$5Q?pB%W*^35b(SSA!H+zL+T<-^Gw_-}5%H
zMBGLmw7FsygQ7u0@Aqn3@8Pkbu@n)vvg*Iy2|T^HV|oND>72m%N)J?2>U=I)Vkzlk
zE#0>DU19nLnwo5#aa1U;@e9E!up*j)mn?(_{^V+YP;6qQN20YXd8{5I)}$~sBSs>b
z(p>V>4jW<s=45s3A8adTYC_h9f%|*pd&j{Ap=J6)ZdSW`wz{=8F@nz+J=sDJ=Y)1;
zMq)9!u#9Grl;|veJ>M4gw?M{?z6Szqcs7=_+yMV}phlc{p1f-#>z=sfeCCeHaI<21
z4tmT6V8+yUT64ZWA0(g<9%(XO(H)zXR>@e~d>!F~X8p!0>|_L<<lLr#f$~L|@jWc>
z$iLLdQHtV<><~k1xy6296pM>f%QVD(bA1|f-S#J!j)?eaOEsm#n0OYyTP9ysS(&Cg
z3&(-2_a#Tb#8ZgDQ_&i8O9G0wuQ!V{Ogx;cxxZb_)gEm2t<8t1r14FBOm~#ANKg<|
zpZl_eFQ_ymg3&v(`dRl@^;Mi)65lpUMvd2>oMy7gx_j)+76HxgJ#~@Otv<QsVWlUq
zU#50kZCeNZ=*}9z3-y@zpP@bdQf<}VPI%b@ZGgIU4ivV9BAVR~fha&jJ?!t`g?9RU
z8O?nW@RHEW{7M$+Ppz&|ycdpf4-8SVneg=%H?)YetE*nckyi>k7~e2L$<_!k3LwqD
z&K?q5RDN_<%coP&es}#XS#xAuQ}0y~dtJ}>>H~Vx)2_;i_wW5iALc^a>R>UDlH*75
zG7P)5CAr+}?APUlSNd}&dC%xSL<}Sy$Nn70Mh8buO=&Wj_bSUOI{G~j{NojcTa+xT
zev-h6M&6Tko7VHpAYah=n<R~{_wX5X;*ur+2?nC6<Jq4)2T?2hqmX$w$x8;tKdHX5
z(|M^?K+kYCbZ0!Z>goGx@<ky*>DvRpxrHOHfDJ0c`kn=BL9-peJ1qa3j6<_mEz{#b
zmdJ(MY@n#TL~X9jqgAyxkyTetzTZph?#Nh@g0TI(w`1H2meA*m8b)I72?PBPtM$=o
zm{QYb+j<WBPvn#-*eu~WVVr(qRu;RRF4viz?`6sU5@XK`#Uos91ZsvY@ms82OAaDI
zWs?j!@+Ubn)2E%J?X?*Ft3GlB7>owD&Xxoi^+xD;#FrC!5ov9IIq?pmey9FE!}W8&
zqR=zdDV2vsF2^qLJ{I<d4+Lg{wm8k4Rg*ctX&k9cK^*rRxo!tLVXe0tXyY{M&!pN$
zcFsKlEK&Dy+=j=cSd)kkTQIXFgAar&zCW>85~qCoMSLt+y*E#@0N<e!d}yW}bC{U9
z`*KZr<@)#vTf_R}xHn#XFE`EZWS7bO_1F2@L`M4Jnrfcu$tg2aFxb@8qW`s>6cEj(
z$rvax5%?5ZB#_sl#N$@dVaCcK4^w!*w9KT&*0hDUeF}sl7vS@fDI6W+10@(L={OOc
zNd~SdQ-)es4_K>uW9+9Xd>_CGi*5cW1*zeuctsO|I(Pv)L7)yT)4c_hgI95vz4A}9
zX0?Mg9!HdWYrIt4kKmsZI2_>4@;PU+?6;zQeZ-#{z}J^meVm`b9)Vh1%$c6|(tXLI
zoZ74-Kkd6EM72%M9r0#;^Zk_P@};P>FqKwp*?XQ^fkEF6FQ%RzY-w?slANrM!}ddN
zv!Upe*00lTm#AIT_0M^wG*QL(sn>06QMR-7`-!@CmxmN?&227eZ$?b|E&Q=(Qzg<h
z_KyLT?I884z1~`g=O;3;ngOhUMop-`#-4VI7VFdfybirDs;H=_p`oGbbhu5T4V`n4
zAz&t&s(B1o8xqCZApB<dN{iq63^j!DwN|M_DnLVek!#-gxW29Z@x8IF31bF|Q`7v8
zxo;f`Qlwt;sv8)Fes5{wwQ6Fg=gqHzN&Gi&|2mrXOL)3ncX>OlDt2@X56dHtTUN1+
zE@wKGV|%QutcO%M?E<20rNXE3mzq>%8#cQa*p*tW;oBT%qA?`FSUDxqb2!ysPKzon
z3408t#gitus^Iyp^GF8ieZVR;`OCzrr|eo<LlQ@l8?+zp1ei2}mIE*(_o+h*ds@u+
zsuz@QAXRj*?enYgE0fQpLA`lpLT-6@qunF~YK<>uk(3|l47lmw2A34-zs3R8aT)0i
z*v>jDA6c>vo-icb3ibpbmHpl9h(W80(5ljTZNAgKz$deg+sg~?Ow1qJ9pmg;l!n=e
z{5@|}p9!}XAFpEp!J>(gwN_%BgL&_iGlZ2z;K37IzfVT8{e0(St00aKiWFrtnyc%%
zs*^w72tYnr%1$*xc$sl!4=*<Y+9f>Xbk$167Zir&vN##)==gye-&7q)g1HH}0>$)Z
zsCxiB0LEwSp&9t%HpR5DxQJ_3r*Z8kRtng*)kmLe$4gJ5^czd^#$x~8GU*!BFJf)l
zLzKLAksdy)V0p*Ty~{pra&}^)$U5XJo5qsdSh=v%>8_~f%=$AYjbN`|3cn@dwY*;2
z3DLbROB!FeFVCT-Vi<Po?jLViCRv6!XqCva*YQteM3fyw1r!Y;y}%K_-C!?w&QBaL
zvN+7zCqGPSwJEqFv)KTxb$BhIMh!wVPX<Mqqrv9*4gQ7$mJl1Lm;uSffhvoqt8~e2
zzYZV`EBcev%Ac~dq=qkEI)6LIxW>5;s~~)3Ot-(sp>{0FAU4*N)V46>_{m7uO8cYJ
zThuW(@LbLqIr4WU6Sq`e_)s0Xz?INneST-g(0bl6&t$8o*_t@wBk0u<6+0Eet-h>{
z@b4z}Evf$#@!NnwD^8WDG<^LFoh$Dc=t1)tbjAF#(P#h9RgJFo|M+#*roo3{Lz&T>
zCJI9pvwKlU0=h_(V+vhSn@?>`=zV;^bNPe)#&ekmYpCo_uO9gRvg#J;9Z?~`$;!rY
z<1GLG^nHI#h9!dBZXE>;6M(+o92ENXk4@pDcsowyb3f`m#4W$*PrwI!0bhP%{Gu}=
zp)Q-rjp%>w?CCxQ;eM7^s)d>oP2)X$*d6&&OVhwWT`x8xAt9Z7b@QdSYf?=P_ygGU
zotjo+JE}@8YkY1>v#Mm_@A-zl^4qs*8qG4_Z@&DHBpKK5JD=0ZR)f>(>hkiInEl^1
zphgcbZ-k;^Mn(qSLLB$`x19CqGzb)jjp@PmNLroNu9w~|&{LpVCFrU8S&<40drNgq
zKBRvN=85qxdQ29eR^Fd=Q5l`-=sbQI#6Oo00)>1p3kO994;ePv^i4p^Tdr_p-sI$I
z5?e7pYd80<t!fBuBm>bsXEp;xf8ye<Vr$qMizL9#kQk~5)5)uL{dq{WhVrk3dFW2A
z2noF;)KNPO8a(sx=uMv+c0nNduT8+h8FqkEJbd8*K>TEwn>KQ_w5F$G`f{kvC*X6?
zfze4XuTAgTiHq0<!@7cH%J~y5b1k*q)xKxaN^Ls8Xm9~g3V0K?wKr;lt{Wi!4-2qs
zsd-0pFcvhtD>9xMukA4eBbJAA>FQ?;9#e^Kx(c3qd7OoZ5!y5>1C8JS-dvgItL*wy
zqehGgl8SOCe?(VxZPsJ^;*k)$^2D4JMC{nAF-5_91Q-t#O$z7=(U1G2BT~6sm_<l)
znf6Xk2c_pN1S<H<2k@#`VZ(Q48Pc}65Dvh@pno3LH1JpllCZKLOR{--&J)(728qfw
zTd{=~546mZGAaJ9!~0FUnLy&VZ=lPIG(k@#Yx$S7OVZlXORaO<sG+jlm%dKU?RKh;
z-HhM_UMkQ2Q3K@sI5?>{5_q`wHmE}gz#BT+8V*+=h(-;XMxCe=m$z9+^qPfzlRivi
zm%@9KM0)N*Qu?wLq?|;-@3!N07ZmIk-gh75P*zdF!6+2usC~ps{wYrEY)NE@hg(~%
zZ>YiL=W65D_JMOsG)0~1zA++Xa&i(6u=$ICUZ%ekvYoxcx%WJ02r=pCwb^3zaXI9`
z8KUEwwe<mL+Zxzp!A@W_S~`kcV??6;YSmioGzl+8STb|1iKR)|H3#T5Af^F0D`zow
zBlX4I40Su-q63uJiO~Bcs41uRr%cB_mWhcTB_KASzDp3Wm{#Fca3Gxb`4KI;e1*1r
zHC!iA)XN80uDNOcIN_<$`tswoz(5>pFA-92Q%vtaFWy*@0!iuVvj_zA2TO=<O_Nry
zVt~?ry#y+J-R$`c6;2$`+LF-xd6%6nwgnG$v_5X8kj3Y8e)Ka8GS}$RKLydPvsDA)
zMgW&1=&`)01By4Rd1vNxV*CYz7?s!BLYvr86ex^U#IAR`^#DCly>r+)gPeizl}wr)
z8g?1gU1Qs#(!HmC!{Klc`|;MHwJjF4jR*1@xrq}gOcpdbKX{l327@89r$Z*n!q7)j
zswvNZwO+PR-KpBM^F4m3Eo#r9i(Ql-FHqKXK0!o@o}4BChXJ~8)~1XXLXfSOo?`W9
zy7SEr>#?0pn5_(sIVZBpVbmV|e3j^B@2057Bw)h}t%yAX`2j&qw?InFZ(i5$%ve+U
zF82Bd5x_pRUMz;O&DQO<-#uJ)b9HGw==12M@fLx4{Q@!ty>wKHFJv96sr0VP#YAru
zWz9RtW*6(|{{Gm5=M4cf*__-WOQY8phkFaOz_5w{QU*T3!d_A&0KgG;Jx3**hC<gD
z^kGASs|~!?T-;n@C!-~HSnv7EBQ9>W8N%(^iZ=I-3-_g!OwKceK2_2E8OK*(@5M&z
zbK!A?gHL~%we6sm&}n_F!(EV{60ouS;x?={4-OowoZv5CzUYpiK+VpUDlo`e(9_c&
zt_*Ik%HA`q-!x}08n_rw)HBi8#-41esJwzIlw=>DxDn}aSld}oH*(=Ncp3QkL>-O*
ztBVIv<lnr@djvLKtEgRHtS&1IVrdD*%(}JFRquLXb!GXG{pHOs{)VjjqF2!9V%x)w
z`D>FF2}#*#^VGX0KSL4g4~g|W6^HNk_4Q4O*3GzSjiIQnFOq85Tk}Am`%eJ!u@5Z-
zuoiHCVs-VAH<izty#N8FaP{^jrfKU$B8d66@a8d~{k!fo9}YLJH5vAvA7^Pz7h8;U
z4PvsMSrJNQ-C{AbYq>ljX*=MBc&rSNiJcDB9X>oDqUF2|`h6po1Umn4nk2G{7&7$r
z_fM62zhmeMC!-a^xmR^EGnke+KO1wsG(1QyBo8G~?~rB2ZkPKkh?#FrL9$Oilc&>%
zk;pP5o6L8EpU|!hr_c&Q4p&%#HKqAyP0z<jY)2UK^cci^4@(SZ9ad3XG%AX>krZwy
z)O1`ITcfS4%JF_d_(Bz9VewS12D9qLJ+1ild>~(M0oYJHX@hTVF9e|3ynMVEgU{>k
z^28b5t`Nm-eGH2I!S?TmiM`6eB76qI`+#UWo$LWI?`<R|dmvs=^=;e$!?+Iqwt9QN
zbW{ePcd3Hli>S7PKl2hVQ$#<+cISOO+1|aRK7F$1uRZ1#nL<~_*0d(4EWf*DQ#WIy
zR-llWlGehWqaUFYi*&M{k|B*lPV~mnrS(cUTigLXx;d791m?CA+n6$&r^z5Dg4hb<
zKO!2Ky57E?DzP|2N)Y;PG+NWAS)$={g(+tiCVZl&Bkf-e?SUmYTpe&fIpamv+QyC4
zETG)LD`WIw*O&9s2M31~u1yLT$G?ImLc-+wzuQF~7`U9bHtj~+XsYTRwNTBL0)z)t
zNeBG^=5P*n{P}2A-uPg|?KeN(;*YaF!>5gO*~k2Ptw1uUU;9^?$xV}KZ&mjaql2pE
zYUkgl4%UV`jH8>t&L6EyR**lB9Ye7D93m+xNPwP3i8gFJ0cwDO9z{Zb*uVjvTb?!N
zxOv0mxH5OWHedRCngH?5=*rJITIA7?V==KDasY1*4<!SMQ%Qt}slLSm!@lQR0KnN&
zH<520$#%ZG_f$E7<EBB2A=<z{I_Bo)j*jq9cA#k2|H5^r|4hVZB;-G?`d|Lnt+^Op
z@k5-(tam3a1BeQ6hydu-VQ1u*f4lS}tzd09)|8PMB(4XrDDiY;o!jo3O73&x#4S-o
z2q1f=0jhYsT3k}{^2Lj;2#Vat{-)i$JbeEOi5p&jiWw4m39#<6n>#I44!Qrga2(ui
zNy?0o8hx|U!xl$Tch=$tM6umCRH$i$k2{{3vkI%x6x`e@1VZ|L#wO|mo!c*~%%<Vy
zw(g6EQtix_KYo~)={C0zDv|a&>6W<h55OG}vKUZft*UBMm?diXYtNLwcPLgLfc!(g
z0y9V#je{jjcj#KzMj(O+sZ=<aWx=#Tgq~ZY8v6Pf|EUt<dD(4l!*hr#^Ms^?@xsw$
z;2Q?6nt^%nl@*4&AQ@6XlFGb^9jt|*-Wqr8<;xG-0UW8MT#F;n!K7Ocevs2n6qNa8
zi_;1WindU=3yuTEwI3h#qUK;sURQUf)&|w+HXnp{9wWnNa(;9aUR{{^W%2J<9H0YV
zZqySXur8C^ZLT?eD;;2b<RXsMjRggjP-s=0qoOH2Bcr)Fn27lKBPvd>qaqc2eEi+!
zDx*WsT|i&S0d#VZx{=YsABUyBzW%UKc{&amn~%YCA+1mSqO>#sn81F1uH_%KA^H#S
zE#UgWU1oxN^UMFqF{b}}ai#x1gJ-LX|HQ<_aa&ESJ;|pH3k`L0bQ&KYkF(+XC&E+C
z1+fi-!SIidyQ8!ypaNche_jO!;u6u`tZYIhP+V^~o!5G%dR<VkfryAGK|=#j`|<H3
zAP|Ualm0(ZyQ+L?fSJz9$k<fz<40b7eRXv;koJwNg{ARBtgIm#U1n>a8R+2w=2<PD
zf2|{HA@dEM)4%+Kp5H9Xox<j3o3Za9;{}S|*zGz4!?wAeyF5#{RZb+VqPrJ|{5F41
zcM23?FrefQaJ^5;%;YnlDm^<~Z8`n@u)Mihi7fVsKVt6*t!7zsUPHdi<x4xhE~WC1
zH%|v9WW+h0q?ntU<%u0n!~wdY3hqDQpHf^-E2YX_8)|ltKlN8N(?UXT|LM)6l<#3E
z&y!Tv#3-Mm++&yHgoK1XnQ)?kA>qx^s$mhgNfYHQR2`tk12M6mG&CpxOXx2g-LGKg
z)JcOAVPy2<GXvCSXVyJR^vYCGG2%AxoZo#5TT4XU^-uRO65UeGB~$L)J5?#%=CUva
zRWineo2G(`fc(SDdxZKGHkO{cP4CWmQWI_gJ76(1%4<2rJoA5^x*bCKRGcnQhExUj
zb8skvciI3m6&R7Obwl6OR;ju=Iy$<;I`w-fw>cG$@it@Eot(}=R@lFqBw(vZK9!&g
zm!Sjh2_~bLm($&@&Nk=2sQojT30cw@nODC)tjn#Ig|D*edmOD*qM9(Tfu=#hjYE+H
zC7r4|nvLcd+k7e!7BkCrK<`Mu0#@dqWpREL^Wj@a$FqO#9TLB>u-iTVyb6Sc0oU6~
z<aP>K%KEzHTZ5^A;v;Uz%n|>bhi+%mSPbp3=;i<!w^=wPFEhW^YGg5K<N0~ujXs2c
zgD<V^)X7BwX$5*5<+?NHva<eg?#niB{xj4!?MUgJU;a`JV<#gCiIL4asZs3O%`!BR
zGL1un8G@cu1H)eDYV0u2vuxjss+@0MfEjvhN0(gssa5ZloWD|%<`j%&DNhza!c|>&
z5haViLm#rAcEakyDMjRHd?F}CHpb*Nr>3TM5dFLupaYAFvJNpVB_(jU>iWC7P(<)p
z46qZJ+4K%8OY+kfo3ICsyw+2tbJdnhmAUbn#&Z=5wC01Ubv6jeFk<%c6|cjt@>Nsw
z>m|c$6_DQ_E%i?vUZ;CGIXTVE&84LS6BEzVCJS;pcPi@Y+<16-rza;V#C$H+MsvGM
ztm8S?n!w>9mqd5ZZB0WMpQ`fNO_|%gzk$y3gND6!&fVsa&+qAz<!dsqx<EX-PgvV7
z2U&MpU)nJay&FiW`iq=D8;yr@S2wjaT@nrpW19gPRj|+=sF=#*Fk4@#os!ZglbV`_
z*+JDgt(N6>M>2_!y7rSk!?NJzG{p4x_pc0P9{=>lFpI1a544_T?1~<&nM6cH0B4Q^
zbAO%LRBg!=@4eKuNwhe#Yu7fd^%lFe+V=Ad5S>m8is>9qD+4jKf!1#MgIW%!GU!T^
z8W)#{2*rOnh-BEHnY_Gw|Ikq1a6bzfU#au*eZ#}^y_j5}lImOoi-(p5*F+*G!->}O
zwWgS=swy!@G`bBtSe`)X{LoD7eE)h5Pzfuq9<;4v=O?AG(K-lTDnn>A=xTqsu(}Z;
zziDuF#(sP@dmDtCU0S_0z^y#}0=~VyjjZ#nupZtq={^!n$rEc2Oi&;fGuoKwg+ify
z$fw>*5p@I_A8LbC6l};$jD02F@$kbtezSY;2kQD9w8;@R-mUsivk3)vIS0S`4-3er
zm7eppb8Fag%4!Iu41ZuelztZ@vS$c6ubTG#%6SA7p6MZhR+$f~&;9=06|rkG(=17b
zEKT8F8B8mg#G6A_Yq#R7$2@V;?MnV*sPZ@?;v&P&d&$?wxoXVcHkXUdz;W)SU2DEE
zqLU?YICcH(b91xpAP#0eJDN0-LWs+9Y(gcsyU$r)A61K~0}^Jw5)ly_ICO%Sy4`(%
zl;;y<l*ko;i9dQI#$b1V!tkXG7R1m>%XNO<`oo#f&8&-@Q9tci`*+Ge7}17t4-0ss
z<k^`-*4)3Yf8sZh!U#MDXkAl=4&GhEJ-AHz`HK{&iw6R@CJQt8j4tY9^7HSyyIWdX
z_Q}l5%vfz~5NN4y%~iQ=0{ww_8cKEn#sXXG>HD-vO%09X-}0NrWlhrnUeU1Ie!0r7
zt*57Vu^(l4c{Dz}gWZ!LBB*Trm;7UpJ&izm%p9PhRfj01@iEgqou|Z5;DA0qrVS)C
zbXYhzOnfsmJgkPx@UBw9mR35`y^GATuC{ikGigfXaLWlWNHrF?9TvYQkieotwyCzf
zP7tf=Hn9w+^Hf)>0VHf$Z{5exN%{v98|JR~?tA{Hf4I6ju0p@b*qG8%C*vE~+D7vI
zItC7iwTr?=-U5y2n@M$<i(Wz#NXkccD2t1}?6xQ(-L{0kto__ynuNiOcDA`c0E|yE
zAOMZdEl^6~@jNMokBya-H>%nyi(C%i_+IKd$%nn*f^t|u5N>nsyJ#&#4Nj%hrEM6*
zX>}+u!SN4;1k;la#J}tD-GTPy9l&nzORig+t!i^$ny$GDwVrC-8*m!7n{SmMOTN>2
z3A=}(5;#3zDepl+)e1{L`TT<CugX^l+x6zmqppII47JMx#Z~7!Neqh?OIS-_!8{V+
z$*Z&BYx43k&Frv#RuhG-^4ItKrT7S{00CCHb(nRzHOPM{u8OcOZ*c(pKo^_yS3`fH
zrTp&g2es(Ie&(Lgo{b(kC{6v}Z~1&B5bQmnrBYUw5?U7e5(btcTzZ4LaL&rMoX=}7
z5dt@QSx3dLF9xY)=$)@{aYg8R-pg7ihcDOp#{CeE2Y<!I3cOc<3+`Q%?39!QybuoV
ze37N`rKzPqT<IsHJ23xF#v?H8OW<f|kl!czQS`-O;>5&+&k}N8|8k&;neE>m^%mp5
zN=rycwA6C<Sjcx_R<bN%C}CoGc~SM$=wA+pTNe`n9Hj;lS2({g7c0q!r}-RR8<*`G
ze}=z>tLpGQtWjP9Byd@?mV4;Zeg}Bc^zLLx0>0|2f7!yXzkKkUC{R$aNZ62w?&hyA
z{lmTv)QL^(C(@d7nu_jNp1wZZvr^e-jN#;*&CrIkn(29U2Sv?~nrfPwnt&XBX8vzS
z-lKYOZ_;w8yG+eYZ{!8bt~=O4ljV@Hq#(nNfrX`nd_c`?=*anUrhcCy0aQIXq3JIE
zpyuDbK?5<xxzUavn}{B+D_fdybPc+LFJp)%x-8>0DD4*jcHf(X2H0L2pPkAB@qa$9
zttq@08&dmk1HbG{O%~spH8N$18tpT(leK-;v65;;7`qDU!|(@%4CkxQqX_xcCvmUe
zawlcDA76XXu(DJQOS`qT9J6O#8xmDFu#jXp4Ti>!(n6rUfDfRgs^r9eGO*iF4^zkJ
z?;FEDf7tenSb?xv!AXCq&F3O%yW9rA+CIv}Ni>BX%~N{F(EHt^@>naa8j9EOah@~*
zwkv+ca-Qt7gu<bduX3bt_|1+W67$&l<k$JszMoWW;zUbIsw;Q_)tk4t7gNh;qHidg
z^KG`L>qDmkRormu<+`D-E|-RfYe61Y3auF6FId%wud!gRK2YLc<(Kx#63dg`cI{1$
zF>J*8mY=O_^%q3S%gM*6GjPYn#sx;O>boy7mNlTQnM<t*G#G4{g{(*2`7d{e(S@#c
zHWQ=`EMi2UJ4T%W{RtT6F$Z@mZ96O>d3=Hfqo%N*!%|n@u)e2j$=+Fq%XF!?ZOyFd
zd$Oon_)O@%$04l#?}CS}Qbnw%OrkEZ%D$&9uAat|zTikX(s#C|COO6h{=Ze)*;@A-
zXN>~9#dJiy5UXMb3k8I4b&(pcXKm|Ra{IR(&xWhroN*6lmyag;eeEy5-yN?Op7KXn
z2|`Aj5iCPKyD7)a&k34P2(-Z2TjHt?nKQ;^MasFe?9gxrpd$Jex&){M(d2-2a=Xwa
z`)SSI_DR%g01-Acz0=o`jT1BT0<<^`ASV68=9!)b^pCU=VEN%BqPEpmELOLmsDhe>
zy9(MM7%uVWaz(2xnbUhF5rzZ|!1LbCvJ6h|bGKFu4ww#rAp78p@N+<yIoD%&s>^T-
z<%XdMxEtVmacDTzdKx>c?=cr!?v3uB<ekiFT9E(MCgXfEog-<^&&N0CZHEa$2X2b7
zI02$jmOk(^AKa+ZmE)y|#{@dbAT}}a<b2bv%oCk3N7&mD#@^yJ7b}^PQh0QPtad+)
zQ--ygq9v=&1%*E9ic5BNaGMb&x=bfo6Ka)Vk#XghSiukx60e1g#Zg+*m5O~Z_mG%L
z`!n`{Be*_<;`$OHvMYQH$IJNsvtY@^HVJ9U$*VruirG5XqB6*c&GbMIW+kQ5sxb4?
zLXHMxvvI2k=dnNAXwlui2a{(>?laG}Sz*{YMA@sQ63n&puFx)ve~RylcG$3?EuZd%
z`8hl#zQ63!8HjU0JC=DaG~nAc6L*x%ed%`U@1iiMIyy(9hww3Ft<2{A!(s>RNoA)9
z6aImZx;sr5*b*hS&5V?69sXJG<H3^Kts8YadQGL(`Q77K*G^cJm#vQk=H(i8G(7a0
z?RpW_LfN>WyRn1B_3{RZD5kmU`1s6ahla`k74gn^bIvb5SW}trnucL8158mKz9i6A
zu`R}|KXsy6lX0b`rH(+Y?9!`Ri1&3Mm8e(!!O4uOQBFP_*srI%gqIRKa?Ei}zl2q+
z;k&afn*cJ5aI1sCwn^H~wpX4NJ{n9HT)H=Z=4!25!n0X(S9M(V(r|esTjE{qDLA1}
zDU+^b-tZ;Qmaf@|&vBTp`LP(YKTnHk*l`1|7XWJ4SkQ4oYs-|7zx&cs0|{TA>|To=
zOy5&J*`4HrE1cF|)U~=V1(3WsoUgqSdhZz&$DlBA^+5Xz08EP*IL#bc0x<hDkVouV
zS6Zr2485{bz^B8*_Af$gEL_ac_-2V}X;km<rln2><Mo?ex5K=5=4VoM+yeld+xw_E
zid@8XpiXGn?*?zHyWDXl3cbY-kf13CwlAsm<HwJG#a7duhGNqc1TvIZ^S0-Ge-sqB
z9<8aM(fM_kSA?zfo<WtAWN*ZE9wsd;^+T9s`*epqj;V%$DYNVqwnU^Pc`ZGYh4%JZ
zGUcmv2fi2xT#Lz?kJE@Q87T0*Y7;wGa`Zg=RVd$;2wnlF4Xn(@-sZid8qbm@YEaTM
zNddk3dmQZLM9Zn_bG2S|of}Ta&wkwuCTVE{t9f5CnG>3=F82)s#e39<hmPMgn@<m&
z&;0OB`;r^)X4R!Q3~QB56I^n#&ce>l@sfD2^Pw&I+*MO#vV7Y&YWOYW?@UtSo$j(7
zR@ZSQqV{3Pmg_!fS+bBMB?PM0b}>9dwk|>iK>$e~xJKtZ!*&grxv-w{krtua>NmQz
zCk8dn-OJC~G?b!+YcGQQFROU!2VC*A!4J&Fv4m!ll9C5iTngq1M>62|Kv93(s{B=i
zjV6<}g<FZWHGKlu+*~$yoMZs+@DOc{mIz|;8XhwaIj~;GmDSXq`7yJBVS1x0HRXLC
zGC9A&L}RPwzgU6vtlsJ@6m!qu>8`Qt<-_TEscrD|+xJ(NJMwY*@bn4zmTPwmt#{V9
z*Sc6kLXl*{=yKF?KGOr7G$1@npO(;)o!(RN1l29-ks#c-wpE3kK^`6)UK&~<ryx2q
zq<WnSlGeWX`lS4DI<|S^nX5?x$FuuKGF9CE*kF8%pAj~nDs?!4s?HuOh*fl5-t~a8
zfg40SWtA|5xQv;ADlt7VE+h9*mkp=&SqJxDX_G3ut9=~lw>mR)$+CEGdPeADms%H|
z$%!OI3N0QpQ(cq8NUeGN?RD6;o7X<0h}jHMDBZP?4<e6u#(I|4Y_I8>ZEjeP+MyL9
z{63??T>v%%_YSkB@ln35@ckLkFBKsQ>3Rd*4}3gei(MQ;o|h*d7bmcup?z&*^PEp{
zu3ckS*J+jK2KQDPcZ7Tlqus<X>Pv|*gQkHx8%&#LJD&1$8w6$uHGiFrp~Cwpj`O(m
z!BThc@V1aE?sfb(L_1zV(kE`4NMg^yslHUqIb^TJIn8Sf9hM1pd#(KWewia1)y`t<
zt;E+Y8x50MP?{Kx)~zx5>d9TT*1B7)hI=J6n;CsK{;jdDXh9rNt(kIFM{VrbTgzW!
z0G52+_p@f&OV2h|fq=4@RA_2k{{0N|*cVijdAZ$8o&9FECJ{L#;ZS*y@G7t#Y^vt<
zdpx4bJPhHBy`yZUIOF<Jg1SLz@z*M#6#<nbFZmBJtyoBd<v8}l`;&oYaYC(W?{%5S
zmfEyF%XsV^I%aF=-`0Cq%+Q}Z_A=no`l23;>Qm<GX;}@Z>T1d>#fxw6x3k%O77iWz
z53aPeeD-Ni@yzouNe6tf=v57>2FE`YPhnzte2jEPvpomi9kHEZ7lwMblb4O4;b*ET
z#6vYnW3|Q4`>KQb<mIWn{<b1*uiICCbQh7^)4tR!#jVQA%j;*;XR4z-qz^eOu(q<=
z@%?Lu(;9!loKA%5r;wqHvwwvcu&G*ko+WHSr<QMa?-FgqZYfAMeZ5eS_bj9g21TO^
z4c*V9u1V$Y$o2Os$Q^shEaOj8icl_B<vlIB%)K(NkH`?><!vATkrZ^&LK0E3b0mte
z*_Behmi14!<WomE$U|cej$QWy)5+%8GnHY<DBZ@Rl*R7zq6GKeXIZ){5B1#)ePa@n
zs@GiL6DPB92Yijz@+yP#t4W`EQ{1&S=cPBw10`Shk~Jy(enh-E_PYME_xCGx5__A)
z`<1mF_Sf`j3F+FYqHhlWZnWMbs+UMjwr105oYf7YTE7lHF~USwpGY59&KZszDH+b`
z6)Fa18@uj}+;TBK#>S&X%(E*iW$_h#p$b+Xel0&{N|Jr1sdMP4=HtQ<F(tGEtD8@R
zD|qNM`mT1p8`l&Bl$5r+fpBoOOVWew<+rep1%neSL8*hdrO9`DwLWcD6&4jpvo{g-
zC&`8xx_$&tIxua?#E%)g>w5=Ou{vI>V)SG+QSy*5F;Q|o$#6q)$2$$Ef5#-54L)Sg
z1U%LF)4rNb$hkQ-C-t@8HA5rs9{z^~#DG2f6wnaI{%V`bs$reiZqscijk_+UYCwqG
z(~BmqzF{UchX1R)^9*Zh+xk6r1rgnf9z{R}L_i2dh;$VN=~ARalq%9hIw52W3Kk&r
z&{0~X*U*a~JrpSk5K5%?L;?gt67nu|pYz`5et4hz_1>G0u#(KR=E$65j`91Cf$1-X
zQ9m`it^D3r0@|E6Y8J&Td_%5^AQU&|_8BKC)UvH}w6~VFZs}=vzi6z}RYJ?X7K}dj
z#M~X|YJfayr&%VtKi3_WQt-Wwf=IdRKP9l(eU&pK=-i`t{{FzNZC_lLo!xEv(mSEc
z%N)!lj+Z6vJxM9i@i_|T@>iGAo`o`Nfpj@Z(PJ)4LjP3khn$rVhWQO8YZ4g*Gjvtd
zk>LWn<z-2Ka5%1TO4K$#(3dJqkhSNmQj(k<KCfIannrA+Yd*yXxOAPzcq(Vs^-(&e
zm_~gq9cjsQ=UZ__0!<cobq<|u3aVG2`qkIUeSPPE+|^G+^h8}TOZO_*Ha9CatK2)|
zHSl3UcexNzK(P~CrzHs(TWk#G<?AlL#7!pG_8XWK|FCjc;w+!-P|PnV3`_^Sh`GhH
zp~pBPyMwM$_@oqVIwCl-goM0G&he>keGL|JlN1sY1AO_mx9LoRE)aH3OGl!l&7mjB
z!&hA5&{)#Y=c=$`ol!m*y0X%Bsvc`A)0O$f+v&801Y1B*qN>cZe3a9RO0sK4^vn&@
z{rT<H?30-;x=j9pnxz)DK*pzZ$Du~j47yCqK~3$ohQ?2+){2H}A07l+xsPQx`bUxT
z6NHYefzmmYM*X_xc})X|vdZ<#G-VnUG}1uMV@(BVv%~l>BF@ZbDDQ|w1-(`NvDwEb
zOSb2}<i-egX{zh2GDsB1gFVGvUjoz9Gu&8nuD7@MuOXObw`G^J<d^Vc8C{*7bR4)b
z?XtMKlkV2L25~%%81YVe+mG*~ot&be(|};zNCxq7+=U#;*X1hy(lPUM(i}j&j)rnf
ze2Q(Qe;@gdd5^)RUhdWxACsab_yp6XHKDm7-FQp4GyAb2T@Jlsx7LX(uYGs+SB?xU
z$%-!L?{wKi8ki`3Roak)jdH?v{Is#y(4DVm!@6T|BU5=#XLAB{_SbOSzu@y*r{e;r
zLB-Ybo#YWtWttf;A?L`+;5#IwU18yUX*_EV$Eri1dV2F3kpw9uTEehp@@^)x%5^hM
zJ|mXC-@~G<)lKuQ%&?m~-`EW*fc`tN$Be(GA&UIn2^|a2JsoJrg#ir)>@=^W`0p8w
z!9wT%RX165+-WISYr>1b(7*S!Fc<cG5|ds_#Pe`Uh2POCFYm`UI27ZgHWBcep{9k;
zoa|ZaTyuY)zzdtxnqKvNuF^`EE`79^M#~0Gl<aSV1NY!n{>3+5t;c@`>xdVw@GO7r
zKO{K(p_yObAR43Ue@3}bDOYFfBzEO>vM#@>`thoLy0PMMyMbLDZ~cb$n;Tw=+sqMT
z#r=okd;v$#)-bT&JN0$3bw!O<>>p!ME$FB?A9z<kkX=*S{RUIl2UU&*q$;D~ZSZNJ
zAW>V>J_F)6=4gQGMrC$H{XqR*CSHmU=?_&5<#aa>K#x9xv}vU#jmgQ^L2&@|N}%+^
zdlQskZSO7tv1A4{qR#LF_e3qNR}FHP>0!)|N~h~Qe)$3_<DBl*oY+lsc{024tXKl(
z+Yw4C3dGt<a{I$c?I_5yvrE5FA9Gi?QEqz6QU8lZuNLykz_p-6nZE<y_-sA)b0aBM
z1>SOeIUIH>*EEgbZ@Hez+juFQ%|gRnOW>rgal0s2>`I-rcQg}>3p`hp4UMmId|J9(
zDbmdw1@$_?;4%)a@~zeAGw}{K^YY<sK+qvI#-RcbB*uyjWEmKB_^dkawE5%BxMJhY
zDxyO6H*{Ve`M7iuZFq=>*Tb!8KK^4vp6A49jV6ChD%l@wl?~I*+)l-%?1}1^IFvmy
zG0{&nDf5kz*?*HI=?JG3B?yrs-3P_7axc070cn@y^?owv)v$Z=xdk1LUPCC|I%*Ed
zWvXm@rwZzC+!?=Nsdp`5BsNwcE(VEfD6spY#tWr)V?aZ4on78BdGB%hBQ1j=K7?&V
z&R{^gvV#ty$a9@LmA8%<gRcPn*t_wjK7#CO;wSAl^Zwj-JH+GmNGgnSja`BM*?#xe
zw4x68@K)kCuesG=Vfh!Y9FFXr29|@0HTlG^#l^*i`Ky~pGfvI6E7FE%%@#or`=MG%
zVK<9(85q82d5Fg4&+po5b#M+g1k&LTZ|B+-ngqU)+vYD#N=o7p%J2V}coPI3u`UIQ
z57T#<+w|LyJgWmrDN|}9N~2Y4o5pcrBGSn{(xD;{+DJKY@^H+Q_D1_$9rw7^iNsgB
z22aoz?*ND0-Kvhza1chgC+?fk6SIN`{JCo@ys+nVh5ma~{nnUUXkxP<_H3*UPd;qa
zY=w)%W&SX7`X`%0V^P=<!=A%Fc3U!q3g6$vPEB)bxV!B%Wuy*4yf(Qwose;Td-3{J
zg|$?^#+!!9iwTAP4jn;x!BmVw<_F(Beeb4=!EhE8!9o+qfgBX-n86*7icwn6Gs&iO
z2VbS(m)btY?cI5-SXel29L#Mc(+8bdf+LH^R&!Ill<%)rO_aIyBJ<)4EoEl&+;WjR
z5d*^M{#4HCkv8{}oKmKCoF#DN_vJ`Xr;E(^H4XM@4ZDo2>c?CmMdHfLPmtaEUSj0R
z{Xna!P}+`evOk{KK(p6Lr|eVK(*ZIO!nMQ8+(Q`IZWbpTV}kJYa4WlQn)$O==Bix5
z15NiK78YBX$&Dn29PJD>_dyo>YSq$OOYjM3<*W9H%jLkqBKv+ZR;7qKiXHrc%&EsM
z8Bb~CPQ)dWpF}#$Q;)|)ve&uLXpKKsdH<e={z5{ywU9TMUz94Y=>6&s|FKWrV8_iU
zijbd=A%f+(#DSR6T+YHmceilj7<NqBv8C0fLzs=t{|u%SN}2)%&O04CvmdG2!+YRn
zt{p2c=(&B$URoOcsb3Kc29JzPKM{d%TQveUV?QZUyj8uI__6yHH7T{&Ek2n<oGZ77
zRKIBSzG(C-vrE@pfmzYE$!{f>+P5>}vL#TlXVW1tnR{R8vJ{z5d9P(u)*v8vtrRjL
zAA9a$cTPkMJy)A|687r{r9s$wZ>{lP=>dxgex#I>nrX5E!Ml4@R$ZWcWW+d<PF9|h
z!O1I*YfZi34TgJw;gHE!B*|mfCV(75_u$~ikE}Z+-ragaQem8cLp(*ci6j`{RJLf`
z9n0nRL^0iKC*otiYCO?$mSNqt!=`#*0`rI|f-F}beS&W1Gxcix0|-)dOL4b7DL8Mp
zg@=zLl`N`%_LA|Iu<&ieDJ;qDkmIK5P{Cl(PPhSYmUxcjys=l*&79s9NA8#5tm~es
zQmlKtpWI3~r3$&y3IgG5r(H2yN`AKm1yO|!>l9`B{I@qm+xdnqO679%)1IuQ>+=^J
zy&<*a86J+VtGV|TY4j^DyP?2ZURi~9%A`87y?849p}0%}Jur@@&Sz&gN`7iL&WK&}
z9AeT+acZ91<^7u3kM@_*pu(8NJ%sr6F*n?4UHYo~8%eJWk<1n8pLKHE!(~q%y?}FG
zylB$1fC1HQ0fq4m0&VPH)~Rw8*kNrD%9P#nI>>yv*nBA9Z-}@x8)&rl7K$P*Hlpr_
zZU2?`dqc4j7Xg9du3A^gUldbNxk(|8qf(FO#5E-)oBQ7;%o<8Cts-FEU42oJLleUp
z8B1H3ejt2^u)E|}^ilvK>I~mby%zlA{fEp23(trEGmA40<~I4DggBkc$oL`HaZ62=
za@Hh@PDSYrfw=WRXfo5T_c+RV@927~EELJOH;1v?5HC@C?;qw_OjoT{mZ;9S@>ygy
zZ@j5u#oMh&eypABm|OUSC2acDqeo+%QS)}0L9F&9ZcX0!F&jE!fx*rQPbf|mt@H^^
znx|T2TMxP9O$;?n(Z*+g#j}fMqZY&pT_GC;A{iN=Vkk^tx7?mc)es3QuC+8LyAnp^
zRK6y}ArblqM(`%yNLN%sUS1??p}@8Tu!3;-<u4dllBI;a%ZeeS+zMYUFjaIaxG14Z
zScJ5)Q}yj<WtgC6YV9%abv$Faf9i)#X=G*eToK^%n;4jb`=Dr+aM3RBl8hEt(x6zp
zR~tam=ESta5C%227=<ePaOcapg)Z_@N9I3(16Sqop74gXJ7iKfW=|CpTN%%c{2PBS
zsgd~pP_5+45PgYHt@{8Jr&K&I(F?GFD-hn8<#XRd)2nPtZ)b|$JhdKCM?6Jt`;Lyv
z{OvoIUh2_Mi--jQbfk!;+8F@8*a5<#6l`^EZLNQR!|W>VuK(6o45;BD*Sbmu9!S#B
zKsTF$><$qoft_S3uA)R!M>o~8J<NR*6`l?^)1#g&_c_hc^?)|T_?g|LbZ+jGVW6*x
zunk#4++4IAq)<nBHSfd>blvkqL4Li<A1YIroZx5Up7gqwfD{JO3vI^5mz90;WbmN@
zDN`_iMjm7myu}s~o~S4*gdKX*h;AG^$@mxg{${578Cj~V4X(aS&*r$rUGPZE$7Gdd
zfsEAi8SEZ}GP~Z0QjE^J#1erj&QiFKtDWW*<kHf-7&fGORF5U>`A%AcLz;X0uuzQE
z86s)88Cw_J6p`p1_o;T~U7AkclqR=#`t)_Zl|7;pzm*p$95~a`K4@N{ETsg{kntjJ
zGUke_b5#$fujd!k=MxBrwb{cTy*u{Tn={<3l)9|TQ&v{f+IE9Ey1JV1m)lYzAhQ8H
zZU^0YaIU+;d5O~zl}$D7@sABT+_@8BD0J`%!K0EhM0uwE61d2V1>k7F0TQFO8JxLU
z?HO_B0eYX@4`+55Umb`4yyswys+=jya@Hbvpe;rQ2mNs^?=~0x`b^DgZQU(h3NNNt
zY~W7NebCyX>?j`Ni1-3dy1KPWZo)elJp8hh*$fWOYxxvH5O+5D(3K@-RXP(PPol8X
zu7d<}*Or0jQim<IiL0rRHMaC?+jN5L{`!7z#3*joK&F^=Rh2TbC<7d{2`^4lU%ox!
zYWw|T!?Oj9S>xI;beJ~fk!9^YPNH#3D<x>EhKx+aeJa|UUSynLKAAE!DuqEFGme9c
z{bqae<F!r1EpxJeQlgUGB9obiJ9c=-$SqvW^~15{4v17KQ%$=T=gOYipFN3~zF(q0
zU){CZACGY&!3^I$z`2iB6ZQT^@ZPP5s+<g7In(9=r}i6@n7I@FJtH9)<AJ9T^Uawg
zED%f=Gxz%T&Qc6@+X4c95=U;8wTJo`dLkTPzP*F<`1Dt#9}a1ICaWQJkp8;oWB2$*
zFxE`{k=<0$1+cXmCZ5*lY2FXtGE_X?LL87-o|{MLm{!|i1`+fphfWUQT+(z7l{@sa
z?h8e?9)2qUPiyI&=5XELUk6Xn(#Z}AP3k$eyRZyn#xDdLKSDI%7X%YB|CRXWBGg)z
z0hHZ5%cB19zG1YpcO5FM$$1+uq(+IjI?zE%PZMmd6tfK6zUNj5JvfgVxWLx$N>|#B
zigRwoHCGIMtxVh1@BvOTe&ada<6qI^-1=faibk?}hc!fGlAk8kG|mgW-BmUE@m5Ya
z(;=?m-zK(RMZkq*aeOO`RnH9x`5eMRVQ(UOOrp~wg7gc?0{RevZumrikS(?4Z#S)z
zg@_cbE%0ujflcOcYE~Rbmx)I<EzwZu=VS99^s!Mh<L7l13xjx;ryOo^mY0w~$=IQU
z1MVpa4Z210%8ql`BF89l%tywgt09c`ch2dacO4ttg!QvN>yGW3#&^1`yHKgrb(eLg
zk+k|0Glbq{0S(6LmlFa5>d&8bM0|<(3;a`6roe<dP68(@SC@iHiyj@AsNBf)3a;ka
zs%=tCG}nJ(qEx@5f<1vyg3(lhxwQ3!ebrG`%x3E<^B9%J9(>qlf9JM$m?xh5FZrhx
zYp_Mw`h!8m5C{5@15*vz7{N8=tL-WrrgJ85`f?=SkIeian$4_oCz?4#gO0t~Eix&L
z5B)WA=H9dM$_9wJxv`O%oYzY1`nb>6l3IGJNv;p1SRgx%mudi#AQZ>&GR32S%HQ#v
z1RPvEzhEonuCd(fx2#e85<;ntHvFe0;;6f<Z2R-a2=o5X+d~A8;H<*3%01YXiTE1Q
zo2J|n*5wC1ij_|}8V7NoPdwOy&%ik7=#ETS<5NOU6Qco2+HLpa5Yl}30{+g@7hKlF
zqvlIu3*gvgJ#q!`;4U_6@w%}0TCP*F4C`7;W=}*kG!fT*(oL1C4QiBp*Bg{cvc3Z&
zMX439jQn+SjtV1(u=*p_Fh*TJVS{u%jYq~4@b_;zAvK&`8Lx(PI3Jmb8~EH}c`pcR
ztRSxB7g?0jgGx?FeIGpjJf4%IL<_r-1hiW$=;?X>T_b{<E$@C#IQzn?E@zS9MeToQ
z_ZXs5??r>39esR(@u7A9b&W;0{BEcbE2eil#bD)?9E|O516yZ+%OTUjor3BMJ*q&f
zi9{uDw^2%yX0h?}8_TQHyo~$oz2$(+eZsI>ajzUYmjhI^B=?l}tBc3T;P?<lc=)rQ
z*Y8<R0=X5lV0|NnZ`Nn(GBaj=wSG7cbU`|+<zZB(gCsAMHbMJeoFrRYgxnAjQMPM4
zaLjKGiw1WB<HDEw5HvxBv@Jp9>E!a2(hjGWI)NaFr6r$7Q7xI3aMjc*EqlgLoNMf$
zkO)g_G@lwmX?qJ;-K{o&q$Ujj74m!q^M#b{;_TXv+{Vq9@G87|oKy}pP6(u8jj;fp
z*Vb%D1QfEUf@;7+#JsJwJ1ct*4^d`f-FQs56ULxj0(IX9poR!}V(lUo4SKN{r(SqF
z!XS~=m5(bPAe{eBAb*1}0r<=tXX;>8G4p_P#P*n-G@#XpI|5oR8Am)d<}NN$2b5Ry
z;I}?kW3aKmP0?oyE-`a-LbCnB07JmkX@sZ<aMuNo5{pI85^`^M0zo7I>}9dm^3cSP
zTz9sfG22I)02{x+iLwQl2D=9Ujo|lf9w_MJO`=%D+D+Bh2p@WpFO+{<gvYn*;rJgA
z<|nvJ;y^(1UJ=w(wy(_GI338yOb!%(X;|}7zD&RDrR4PkyrRcIPEH;W8Sq2m9qjDW
z(7#Uq_dNiQ4V3caAGm2yRR-v!4AjA1PNR|F(``srRx&&g!)!C1)H3=FPynEWRHwsO
z-I}GPrFoTq$gnc3IS4RA!<6W!F`R~JpGq1)zsE>z9s4uJC;uMf(<b`18`_ydBkaq$
z_JLzKqp$<|i3QId_iu+qSw5|CLZY}vshSt_?`9V!733UbImLC=Bmdwp|7um0x%PW#
zS{a{ks0}U%a|HqS^w9Egx~iCGVRT=<Sj$Lw*zhJ^UTzLU_L+he7Zo*DR|8NgGQau{
z_;L$)76;hI{|cM1AJk>N=UlhAPjh2XK^5*-NHv=v0)qm!DRRiHf9^N#L!e%AIjw4%
z`V%Tn`OJQvj5BwWPl*6Rf}(PZS2@*ey==1&rtCL{65#fmPHTPwU?{J+4<>jDQ(OSw
znbc0FZlR2<>aBsLc;5SK#!SPGj0>T3^Jnvsj{JOc^KfjHprT^o*RLh@&clF<WZ$3m
z)W|Ha7rwIWz_Ytb2pO!1CSlCY%<X2-+ithbJo_eU%I)NoiU<PiPh7lgu`66xYyqPT
zhWlUrXAEb-2Pn+(;>O17V6fWF5O!X_wWa6p-d=}VBuCoZJM_22;{@vW^nLnLUWbuI
zHN9TolfX*ndYL9juk`bOQ(A9|Z*XTVEG%U4C)W?}jS%iarxOQVHMMntf*gy6x9fhj
z%<Er_JY_0miWY++3vyWXEL{H}dL}YuUw{F)G2a}isgbg?#ufM-Eq{CC-(Mf~cy%s~
zMnsNRIHI)Ez4321W>w?kFU|qyu52MbM<=KJ+<bWpy;5lZRN?p(p>iF@X%w#Ad(5vU
z^bC*x81e4vnpF1oO&^G_<0Rla3FCnNS+Dn_+kn>@luGyEvQLw)$b!#TVtw&{Eb*7C
z?JR(eO##|``+o9KK!PLYZ@+EBdP;>-Epxr&@53xA_=|5U&Z}JYhN`I8xVjcqjN%lS
zEz2lSq|5}GmpN+g*2DnROnIa3xE863``>`XBEf%keebxgF1x9;>3!*2?&W{@o#%wk
zc0fHWX6SEHKUWW)3eaqmlszogV4JNKc16*9HUtd7ff<o33q7W<X2Gt5Im}&@JmBA7
zVEN{IRR=XR{a9Und1-01&Ij^ZU;qC7{mv*pU3r&0%zR!!fquJ;(?Xc0k(GjX&%frm
zkJ7Q*#a_N0Nlq_bEG?}Ws+?W@=l5I_zDDYi(t+#@YW_wf0p@#iDyR3gLT-Y9C^?Ex
z^#HKV=|H6KE@d(eAG0(ytoOCt=+EYXnC*~X?)d?AbY<U8rbS0POC|#9F>kuBwyM3V
zl`An}AT#?NGA(`z2ya-INKAyVizLcJDUU?rbrZyuWM!$oUcJcx%ni7e3Ul6dEm)TD
zwm(1Q_kF6kQRhlP@6fQ<jnUx92`cN-;2_ZZe0cq~O5592IWZcV0J7O{iQmGk;sXA|
zvHA?m*x`YqHOzM(S^GqfvSgOyoySZQ)hqeeUH$yV-kv)Dk(I5YPP@04GZbOSBX4AG
zJTf{ujKkR@tV3@(9?Qwj1`^owi}P`Soyfg@Xk?#5iL6laAx*)4{k*>JifqU)&6TZB
zMTgb@nZiBSxwW-5goPiK6u9Y>ePS|b%t6VAAy0B4yNr#ZXIj_*&S3<-%spO3r+};K
zX~c0>cLxA31z<cxj#lcINyg+l+!shZ1Bwh)TYG!^EEJ7+ap6)dLO2Fw!hZMm$ADFz
zU*Ep0;I9yR;(?BA?BGix|IA!(_-%I|;+iSPgikTRnKrLw#EFc{D;VD~E+r))EE$Qq
z@NOSt4TnFJGoOld`<v(A)%ud8-Nwp31-z5o0QM{j0?tr7#A2<Xudi>f8baSnPfU(6
zcw(4<j7g45jf+Z)k4>>fKXiL>Cv<24JBA&^<Az5KN1i}D>dm;izM=B-^J}sN29frX
zKmSAgF7_p+CPi25<)UH_fL|$xzNFXq3RJqEQQI+Q?d2IRv?R-W$6O&Hee<P(uhQ2X
zeKfv&o|Lb=@7db@ABGiDKhwfZavQJrivjLUeec^F#wCmD2W@PQxo%K6&1)ne0ALMS
z-B+@`K!C0i{@Mx<ir#U=cJ;>F0%;g^b?wq5(eB4r#ZZe3FYnR13|LTP^B<(~S`t?c
zpsPznr5nl(6k6YG{FM!A+Q5ywze-AM`riO|u-f%@><Ac;Pd~%Ni>^YTnKR;1r&(sg
zvG$r}_<Ck}QsKo<>IqLPswc%zbi#B6G-T4lvx~_t^(?sY&pdseRTTq)<TtmD`AlwH
z%090cJeKH?DsBC6Y}08(_yD*6(SJ-6$s_xEDSX7rKyE-v-3_49@fEqt%VE@mTL1UJ
zf2s2)JXX-#8(2R))Z$u&%0_YU%Fus)Vf~Hk``@)`rhg9=@vdh!4kG$sx)4ZH;6B}N
zOg81y!3FnD{H4kt{a9SDcCg&~rktFdh1d=d&>~Ki8~+v(c#2w<`C=A&>%57EwS(}A
zcw;LoWMY&OZ12wR&)4IZc-Zp(;a}NcmD8EjVFO(;d1gI;Cjxca0KbCu)U^YV!mT4e
zYD6+~YHDg4ivq{Ub~Fm_QrHaV(7`wG=d7iqV8j}BfoDEd?ocJkqH<J9&(zdWGP&Qp
z-j~^|VhikpK>b&~+%>YM7=YrhhjYo?vJux1KhGI@#<T#(7B5;@Q1H^#QSacov##Gm
z*<;KSvn07ef|JQ_f)dI0<&;WFzOuiUrjyfCETI1cUei*ry$T>VPwg4f<w6<dNN~n#
z8y%MlXnh|i0&;Y9v}Cp?hqJT)mP3TxlowoFlj`s6c?@646-4mJW}I#};gr($@Yt*)
z)yE)_J5eIVC1$s!(dd6vH20PUhlcu0#F^2bK=?Ah%}fN{cqT-WhtH@d;Pva*7t>&r
zpkpYv@k-bt(eeZbkN)qWr;y2I>gR9jB+G0AhdzH8WAFG8pAIQc@u95$LAYZ$c<|;I
z&N2sz5gi@x=lAccySoFxHqgwi(#0I?h9Ab^^TI@r2PGmd{7?<QqL|@ntEcC#<Lc_~
z?;qU@_~n2d<cifbpwZ|rjr+SBd3>Cq99Ku(=KeC}D7^qUh=3qPERpl~b;bvNCt#QV
z2Q4Rn%l@a16#rNMyH;~`kA>yXz(FkF|Jj@T|L(@dm?v0Rn9RhL8~cED9zU4eBP{bS
W6GqkQ^furxEb5PR9u_@#7W7}l_vJYN

literal 94658
zcmce-cTiMa@HU8|paOzK0Ra_6BuEA&D-t9~&N+i5ksO9m5RfcL5D<nSIp;h`&JIDs
zkcOPoz`y`A%zPK$-?zI}TU)jN?A|Ki*5%Yaefo6w)BW_h;p*=c$nG%QAs`?id#m_H
zlYrpHSKx=~)^*@X)7q*v0RaWU+c&SYeSYrF-~RN#&i5&{e!oa+o!P-7noYTi%?N63
z#aQvu*`1!YuRHFWH6fgr4L%(D?Md3VNaJRis>VL{Z;@X@C@3lU9^LO)BV=?sk9Y2`
z;&CXk`qhXjD#Q3M6loL-E2w#^u}sY4Ap?7<8L9qx&A5}6gX00#6%0Kf2yoTJ_WgI0
zSxPbV-`xypJL$i>%;Eo!A6XM!&GVuC_wV0iqH`Y>e}5kI+MB7e85|k;W^q60VTCE>
zjn59L)z#JcYLGx&<HlVUDeQ<W`7jJ7_$lw6d=Fai>IIv=-cV$;_ncd=s_1-|`4e)f
zv&DID1Zaw`t&bp;;NNO8r&@PRq%Z2~+njxTUicxi!pNBdj|w+3{P$5?f`Zl6+Tz)F
zD0iM{Kl&xMbT~4S#FOT|H{-cDz~$0_Ge;Grq@=(CE(9UiRfNE&(ARu~SM!?G&wI_P
zwW3>%>Roa#^E3P|xV*t9X$WY(ItO2a_TxC8?m-vOFjKvm+f8X-DbMY{5YVob8D?fm
z|JWJv%FAV;%EsE7Z9aKYyL69L`B{NcUE;8Hettgerxa+p3;F%&J3f7u8&`|`#C-DE
z>>{_mWsQeB${K<TgGn7OdefJzt*5yJV8}1csbNz1a~OW%0QcN6CTl5+(WL>oU0lAk
zb6{1OY|tlxJF_B}M9srf42V2m{U`p*v>p-AX1$ch#Dv~B4sv<ki$6cccVyDKf(FyT
z+ifjjUKu`EBsp$?81^p1Ci=Tlt|@XrZ{EkE3b8vk7f$sQ_VcB<pt!6Y=V0BeR8@kK
zS89>wxr>jz&+)pdxR(<P!-FW(lX+qm?7Ap4V{q;M-&_AS<Gt+Dkk4u@AHv>I_&c6z
zDBlWF%!dYXD51<cdrM8~+&99cFGfp^>ZQQgGX<%Ou-**Gy46o{aZ72YsBA*wvbjpD
z-X5}?erru?-m=O!(wG1#@ILl0AkbZwz@zp9kgK0x=t+iTGaB20!7+ja)zZaIaOl=p
zXiCYwyQbhvM>D*i$+!c)|0%=|d$=^75387-t+F|uKry<n(bSmLMBs6*c(2W+F#5mO
z|A|~AXEEe0*<>^Fni}@TAlqp2mNpmWd+g=2+^R5UDO45$H~(b3AF!3hw1u-!Iz)hA
zakn?K&mxH#ma<iL(uy*?ix_;KyqP8s-?dx7jPI1E&7b#(%7s)}^=7o<KNIKW<ryf@
zGco!04~rhatJ6YqtDB)`H;Hs)uQuybt%k#pyYZVUk!*AJX97B-(-#5DRFH=4?c!%|
zE@5Wp6G!*lR#sLHa4=~@M>Z}6<SrHXq@Ie3sw7!m^4L3YNAy{mB=T(KAQ0UQ7i+mp
zmu>+|OAEGP9Pz+YwTc+elL@_fx7lKcjjenL4wa9~c;)%)4W461sO_SdWv<%pAWN3Z
zEYTO;j5ywh1i%0XvT))eAdrzg%h>2KH&l*YS&^5Fjdi2mf!VU0<(m1ObD1Ks$QAst
zUf{6X&#_BapLs_xMz&1~>da^q=4@0CMUs_6($d9GcdJX112#SryEY-^FsFNr^z@DB
z1%CsRY;F1cay;rB?0X8|(0?lKy^rk=4^J1bbA?ygIE}A&s!9CGypv8hbeFjW*M`T!
z%)pl?+~$MT@Lt>jWZripJx$aZH(3t_ojS4FSpcyY#SZhdx1u1|7_EX@ME`SN{19y9
z4=?yo^iR6DUK73-al(4w3sV!aW@l{up5_XDOPi~}vXkZR7SW&(%k1B|W2W4{-Gy9%
zN#iAoN7G#c#%rfc8FQ=p``t^9ZK@3hY@5AJ<l)>YDw4-T8bpp;E#^Hdy1&cF0eKjq
zC#9}(iIu8pB9{lT0cRJ%Q{%W^{PK#~#hA%e(4Bm$V)H!s#q9vdMB=a%HZB%*a&ifW
zfU!`_0q^|V!d<2VA4bQ5;xe%jN4S%hmk5NnWixaKy+4nEgU`ZJ7fu&XrrIv*W*zb!
zH4T2LbNo#I*|PmR(WuVFL|<Q~-&&RFWkTE?8?&aJvgEeqwKNguyjiE`$?tOUI4!VR
zNL95R47-d0-zx;9F~1Ce$(C|waHLI$<snTDE;NdMNS^#12OoxkwVRH~%KdpJ2K1@a
zMbgq!_6qr<)mUDB>}(Hi_S&oB!BqA#7ax^s7XB4SoIE#3I>60<JuYtbtQEK<4Q_aw
zc)?=^y`(;Fesi8B)t#armM&nBpQ0?2_Axn64}Y_qmu99?Pu;tf6w-)oCx&V*7;g@x
zyj5~bnEW<+jey`i<qfEn0jZ_RXwA0&XY6cpn}mb}w%rU9J;pf(xB&~k4a^y_v&UY=
zfIuUT@s}QIC)XR#^BAR3jBO%<g2xwAtz`qE;WK>9fc3QnRyyw7!EZ%-@58GZRT-w(
zs;B+0>^uXo^P=**`UwL;d_}ECI_0Lw0{aiF%K&!DBuWso-d~9cl&>n%bzcR{fHhZu
zGdWR{-WLtVjjrbk^bi|GpdJODOi6e75rO=-(gM0^Fk6g)04g=CBV{{fHQccn7N1X^
zycgRXKSuTZ@Rw*!ro?v6W#%EJ!d+!=q?t?6Cm!kbqe1kqu`StR?sT`q&|tu#BNqCf
zN+I2@z|(PQCoxMfa92(`?>&3kyjw4m2PUz(&9G@BbcehwUobFnQ+9-SyYOUqGfkyE
z3c56LqZ&YlxR7GSsa8|?bPt(_xbMD1B>%<sren*|0N3VDD~1dIC)M1?$J#a&Ob%F<
zH)`|VWQrxzm6v5)pMY1}1#aUpg%^<~ki~-yJ@8&Is_d?te((dpV#uJ8+LQE~PoESy
z-l+ck`Ey!F)sSc#NNwwnXe*Me<jE%Ci8f!3>k$~=h*v^<xTu4{V0uz#08nMk_L8&M
zo?OJS1QO2&p5@@fx*0*y)I*y)&YFCfdHhM6)Ws4xc`RugQq}b$7mt+Iw~O%Q6IZPF
z1|gMq9t0^`?2dGjw=Mk{_Fg#my8_Km1805)>Bi47IF_?^(aU^1+n_|*Pbtq-mwKmp
z&A{KHK-Lh8KZhj83|R|+PxHY?tKZd<Slo98O;4?)aa5sMa=grU)zZlyyr5{cPn|?y
zPt3;nbN!RP-u;oDa$X3*rSvlU*I+xDULK(iu#>Jl=Q1!!Z|<h!0j~02qWn=eTF)gB
zI1wX~%U_!tI*sF(K$as@pAe&Te5fEF>d2E!GrUX;UJ-TJkZn6HZpzZbhoU}jcB-nu
zDi&lA))%^3>EEDxSNQ_xgGNwq3={{2H#T0OmEoKl#@QR}xrR0dUEABhW5E91rS&)@
zByhJFk38ATXv0QI&$c*>qnQI&<)+Ng6XoC)G=7m>nb^#KPnhK_1bu==Uv^3d?z>7E
zz=B3m!ee@3LN64}PWq{y0zS=YWw90IS>i)n&FI4?E)M?`Zb8oCw@T&>b#pqly)r!-
zx%p{vrrh#Dv@!D@?9U&$(H%+rT3gFeVtLg5uQ#ZsskYBYvm+ymKx_?GUO4R=S5pv2
zBm8-v<Q}1q<BePz&)1VjBG=A~ekGLHgYh(arza<)?WhF~8xtt{<HZLpEiJCVjy2zS
z>|cL`vJv$m=To7DER7;<p~$h7rKb?idH3;1(=NlWQgg}B7Wwp56KQNry0}-8>5#P`
z{wRbOimNTBr)Lg7jb)L3g>D0E(AaygwpZ-|eieb2p0w|`Ue4w9Ei~Ymb4P%jm^O`6
z0T0<r42H)X?nt^VvlVww=$Qd|!zDVJQ3N}mf9Ab-FaRZ|p5D|sz;u&qQw?nvU9;(f
z0Jhv@Gq`?Ka)LdEZ8cpqP0hWcKcJI792`wQ@R=o-uiOCsiaU>{$4Xq-Z+&_{qNfDR
zv~7E%IwfT*g%7Jh$RMs=5=@`#)g<Xp#3T-A*D!zJW6G~*g~P$1l}@GC?j(~PB!Z1v
z)fpy*Hj0Rt(N%kv)-1c1=Y=ZkUD|8p8av1duH4L{)#IhufQ0vs2~dtGGP2|G5xvm+
zkhMQtuDQ1qTy=&O&gY~9lUxpbhMCGi^E(_ia^6V`Pf65t>RslQAo2<6`;8m3sG@>Q
z1<26Ip`x&-pww`QC111C)bl3Leq&_mH2H&uc%3D2@&L3R_);`!?!2cyz{~+J3cj2&
z4LFW=gtA<Ga3rd}b1??0hoYWn@HrL%V7CXa=7MlZxbIFk9-qKwBA^qa^{qj}Mm~?w
zD$!4yVx@6iPx1R&R#q(n@^FXFp6K1z;k&8D<N;?nU>RcV<3Nrm$%`{8ZDRjDChw6y
zIk8eAg5u&*Ql<kY)Sn8A<UIwOaxXPWn=dEIFW`{C^6Wk}$rGXCo1k3c@@A2XBF4=p
zyr3;K7*7sFQgkc+a#XSnPmJGihhTa!Q^{qs*@R63lS=Vyem)<W!Z<NkQ2btdn2IAL
zmrT!@5xn-feNfcFq4Q5_wZc0Hc3n#=7J~Yj=sv%xGg}*&gIWg}h1GgkZinj(-mGPA
zdqW+VofWmJQy%D<P{`qJBS>GAXd{raRrsvPQm(dev!XMMJbBwZ_YE~oyZr`C>a>!@
zk5Sq=dfS!juBvfRl>s#@+tS2=+UD)Ky1ZXl*^Y_(a4l*}gVWtaJW;8-w&eVHhBD($
za%}Q!r4@1UjDO&=G~n9-i1@51$Yn41;>--ElX#GIL0)h8%!%=`tQEV4IGe23A6IYO
z{Y|4sdYAN<Rw38vftea#By_@PQt4q%PQb|gkkfFmM2?|>HcRAwiiG$6esi1dxJott
z(!Wg->N$G=TFuGn>})$PW)Y%{1Us7H2Ikj-?{D!b+1R#YxApL>O&h1PW~#($Dk^`)
z^7t>5a>|=Nb0l8XVo%>a;GLJ1d)Y+QUP7~36#q~iMQQA}X(%H6GDT&7x)QW9J?-9`
zVU*cBA9AyetH%o1ff|*?a;BjIUHL+%<LGAn7tL>3RAO4~MfcJK;US6JhT0g;+!D&B
zuzi@&^4Z!zm_U3vz88!|vX~g_p9?~89?x7786Vt_^2*+Z$4@04G1^E(1OUb1!(tA<
zr`o1DPV#P%0!wi~x(g)o^vx7|Ni0JhO>?m=I|>~bp&59S^G-Z>eOIb<c~;h=9<@l`
zx@U+6i-cPB6Bd_^nDn+&t`=@BCHt}sNi_Dj`FZp1jAOYJzs77q+qMR$e}AM|i}%4A
zb{on$+AF|w{FxX!xJ?Nv&T;j>xdoMK8n&$}d7f~4Mi?Lo{^J4$_Ho;KIayKCN1X=^
zD>1X#zjdD!P3|`b@ahb4q_u99B48Z`cIE!VOl!T^>E^(*A}(LI#Q14mC>~UkXew7*
zTaLpdb5tb4G>f^fl<$`w8m17424C{h-ZlPZNDtI1EPe&pPg5<YwH`8mi;%9k?Q-#4
zHLH!A)p1L4Q!V?Rv-PfR7%ns4#W7(PA|hh&BBl+$ci<CN#u(2w2gZBjP-^(qv*TV#
z^3q&ji;C*K_;wgs@(k&@c3wUjSpHoW9o*cjOKRIcnh5LJ#Hp~xlsolvR~>7O%LWH~
z6egD;amUh^?%Jc4bP<O513^d@rtPpCf6-{Rh*q%SA76DAv^L;jF;XnITq1q$_x%YA
zKf}%$&ddja$0nM=YaPi$ilI=ci?3^=F^Q_SIo_|kn>NotnA79fz@_S<4hCu7PQDJc
ze(rf$x+(*b(&NtbG>Lpp0h>A_vy1ri^P7|EjG|5rYe~ub3!W)uCcE}y$@~7p&h=W_
z;sIy<nEf_s2=8B%RF11B%DG%d=ZwK4$+^1dvQHerFH-lpV;X>j;f~w3qYve0&YRm>
zFM-s>4~u-N)T^E0a9WAS(1pBS3JYAsn4JvhNnC7N<zk+tB`(8RW2G)I_>I`W(|m-o
zf@WZjKS$rFvxBsuN`um<9s_7%2Q3O7CaF`1eGpAK^O5Bo!Lrco$}64c-n8Lu%EyS1
z3dHQyyUsR6Z(Aq_!7&SHs9wwRT1dds8FHnwQ&x1|gUaOm49SA2bVr)b0y%Q#3de0#
zWnRexZBm^*qjPKRv4p&ZHe(>7M7)i7jBtn5Z`f{d*hu=Gg=>;UbWA)2DuB@sZ<?w-
zq$kQ3E<mo)r^+kj&x8|uB$GI8*K%0&WVg8d$mta1Oz)GPXF#yL01&3DSC&y9ZptdK
zfcPIzQj9Sitbot;)^cbEH+~4uy_cmwXgt6zEiF0E_SiJm5rsO6dE>BI3e5LzT1=Ih
z7{cGrHyZEvjpl?ggK8$VCnc;HMc-%*>c8-ca}jl#yPsQbp9hb(nna00u>Laz+^1{2
zxX2Q2oDGk|mK&zntb6(C?qR#^RG%U-+T6J8I0z1}{;pl}Gd&%Iic?5#;r!nJE+ZY=
zDSeSc%;Hl~&U+abi^DB060oNN8v3iKUwvzZmRsC$J2+YU^@H&$!S#q<|D<Zmylf2P
zM=WK`ie^SQ?SZAl4;ldjbgE-ndPZut-e~Q-^!YSIgTB-Q8(&2Cq>?va$xM0g$n1PT
zFD53YN_lo|{2HTZOzG)u^)It6z9hNjo83q2EO7;v@>}~WVB`ksv%bD*j*vYY<)~5O
zhG-p8)=_ccC)q?Y&c%e8wT<I*55GOQW84XhKZm?`a^nn11z69Svgwg!lMsv{df}z>
zlriXJ(4{p*sqixez!k0UAkJ*(_vDk3IrLT=?k2`^kkOVF`Sq(483{!03fH%#y1*df
z=rWc-yP9h3k2@UkttZ2-xD9}jm}*51k49?CFy2)##~mOr&NJuX5NzRQ-%{KXIY1{R
zEL7CE(yHjza-hfbh9{j57C_RcEBF+hlF-WzUa0i@bTysYcMcQNzU{jqbf#y)(r3Xm
zW+(OFW4$)~XzUw8Iy+n2z$K70aK*Ys0Wm}P-W!Wy2W1l8p&{m%lBe18+1&DIpE_}G
zfK#ge&czIY44|BuOp&<I2WBoG?7wYWDet#n5cu=~t>lB&pH(AvQkM=h(@Hx(G%`8O
zQcFHIW0fGCzs=3e5I8Q{G!`HRwml&GWUR?=WpNz4d4GnUfjNsqpTYAjOKXI757;!3
zJaZ5ZR2CA=)I)#LAw}#zTF=%Q+b#~w43Rq26ZTdUS>$?aak(#Tlbpfl2wsQPvuIb4
z<7^$z8qW#iPGv94fpR`jvC|nPoh$|;Ow_3QIA({ERJV;Z9wqA$Pk5L$z0lF&<Dw&~
zkoLi2a2Td~1oONs@4Lwt^1BgSr;N9QU2^E2#f;fRT0cJTZ^I3$ru7*2W);v13#6oE
zoVUgX)C6={F>P|$ECDKyKAKj8VxDGSBJjcZ>Xk9X9Y6l$VXtL@ag&KeBsLd(nlOAH
z(Cc4CiZ8-pX{+ysGk^@mV-twQ5m}n0QJV06SBVsm#oANEQ1~;Rbp0_{ry-wS8lUbC
za;>0A&R}ONKZ9Fms1L{qowaePX^_bMaN7ipy&V>*<1I~Gmdsky!rbmMe>rKT&diz?
zDCnKF^5ttK4v@xDq^U3z6o7zUR&igB%q~cY3m#i<0{j+`xz8lb*>jmW@NkZo79MSn
zML|A57MeVF0Akhbg(qjzMprl$K$P?tuDuDKER7%%I?ZJqk+hV9F@Xc8$_5Ld-XE85
z*4;&w+Ah_%9$B~_9}@-#cgl8ZY1K}+?>AhE%mgk0DfZb)tU~bp9NO~(FaoCfE~C8a
zW*@-E2tqxLe4D!qKiCLz#%Qo%ux;3#L6=4wd!L4*<*7lv!m>|LP1?YTk}N57BN&T2
zz<<61#aw@m#L@H;LQjk406?Sq<QfUs+MYCZkkdBu`?`wP2lS5_yJ`CG?`;wW0$e9-
z`?S=4mN=MH8OHKv{SuNCmJ4|{prPT~WB=Fkufs}jAoeK^%PaLN<obZ}=qmq!#u_Ul
zIY40pGdgMa6&dsAJg9ZW<Mcu=UnhYXP<06<*>Fb|T%SU6i3L-??MIEYBQ4&aoS?g-
zb~Lr4_`x>ZtZ=eG4ur0F^L!&CC#uPDs*IQ!yB|`H?4LD!;SE$msl6pHYIiG@lUK7j
zCt0vdEY*20-Pd=4kjq0m>{R#XU3i?y(j8k^GS7qh?84&>ul>13-{U-1h1jYhIT95u
zP?U*2wB(B>yg6_+JysI=Mp!webvv;<lT?JC|DH|JQBo8MNz3zj1j2g_2U7cT5W!iN
z)5)b>u|-hyPT`e@Dk`z+u-KN&6Awa<o<h-W_%hyrI8$sT9=npR&lUOb2M~CFKe?e%
zvd#xX(!NvS`8&oM7q63-(yOq5CpjoSoLPHh*UhP`-4=10+>#W-dvfd90i7l~pZa_i
zfg64gk+E^awQ#&2+xyH_&M|+yh=%sQ|HbHc&YhF`7r8XEhJ0FNnBG{mX~YDY<$7__
zvBl_W32@PNwJ*T?bFtXX*yP9XSnQ$reU{$7jYN&o-MRB)o#%X#b#drhzDHZEqe?c~
zPcVP+7!)Gl=pcs<akP$q(_I4tP(;(I86aFas(Boe&5qW}=S<duY)AE!%!D0-TK&-=
zyVXEiuQ5BOV!|Led&E@Ol~dM)KD^apzit)pMVtxwn<`7sawplRY3U+Z8~rse1*r6|
zcu$~m8ZJ5CBpeO1k_?9S12#_w-J?-a`PsK|1f)&cZbcH76~=4f)<Ac`u|#aGl#UAl
zl>CQbYs&AY!l3dON?SX*<*CBMDq;9M9nZHVCU+&Ve2(8#ty+BiHXpG`ToK6ORb81>
z+Q;8hA&^)xOxv<eebPR*gRZU1Fx!TOgFV|-0MxlLm8!D#;txQt+iz@F1q#+KbN#pk
zk?kneD+2_<l=9U|%`RB*D>%%4T1LkHoLdz4di(B@Z0yLM|HAP;Q0i5BW{QGgYS1uX
zpJhA??pCi4J+W`z2CD!?fapAQJ!V!JErB}BIxucxb`l&3%Ovmedy7(yfi5K)BweDk
z0vc8l^-TH23^xcQI5Smy0^3b5w#!Jvy#HtVf=5#GUP^XYnr=UimE`@V9e|Pm)H!wK
z9XnT4>RNerN#dYQHGD2!^liQts>m+mrEZhm@p`4`+_`*@)j}uatgH8`{iXd%(;CrX
z-=qIM;l0}G{>3sK0?4aO-MVpUu1%GHudiNF=%VvJIUFK80<8xa)FXY~ELUF8cL32g
z8KLX#b<V@X!$1Ocm`HrLWpzCbe-i0k`TQjQ!w5Gh7j**Qr8$io#Oibbe~=$|q9?7`
zza1a1_d8jWRM%834sm&u+-BLo1B9GrOF$fTrdJd;a-QjV#tWe*Igq=TQAN@?po|$(
z!w;#oU4{i#P!F-Qv*R{n@u&^lEUaoh)B7Du&<W+mY1N^T$r{o&>+nz(F<Xs3lJxg7
z1D)vTobGLMqdZ6T?8HStx$7Z`D08`vzOz7De`0b|@ZsXCB2eWAr8O?I?&O!?&}~Z?
z_ug|LMAtc%wbrR~NSsbvRa-ne9!lw#HSWwS1~wFR7v?E3WkVqt&#he5@gArJurQ$a
zby+QqKa&RI%#^%wXF%ZiM^e||(RiujDF{}4QhDJbNfiGV><cT@%7-45x|SZPTECsC
zaC5@rE_uo6$}uSEfVzw451A|mlZG|)FDC(N4mGX@krv(ZE9fjQ5)3kEjJ-riH{%vh
zigkXAIM1K}vR6lJaThM=ic@p71=Lp|)o1IbWyZ;R#p=7_@4EWp7a-@2Rxs0_=+Q%`
z$>2gK*uEqShH9Z2myF-QV`rv{oTC+qh=?e|S4(;Q;lL)YeryC^VB7vSEqFLZ$HW96
zj23<><z`3(oMpIzo7MYZqJExR&sm>b6dP(wu`hhsNOuL#&R)@X$Si<4e=hwgFpFF=
zVAI(Z>@Sv{mrfH4DDBgB2pL??0~UMRK;zku$|eas_L!BG71P*ihVKzozC<#Ec9HND
zIHPO8XlgooY8BusaifrcQ-EJQiGTALnbwAD2QC;GcMS9&pE~*(T|8r>3J0#GxVUIW
zQJ|86!~6R^%RVp>YjgP@r!6QJ?gC|j89o+&D*)``^8D6yqT-zj^Q1vr^lmGbiUr?Q
z-*!@}6WhPW5o;27o&gJ37p#E+N;C)Eh#O1kx*mF5B$5sJTvD{No8)`Yie3m9R|PsV
zv(^5hHq~R7y&0g>S@c}Jg@^U*WNC>h!gujA;%wwV0`<Xlm?cXH1BhI#2Y3<{K<z}f
zokf<&qeSH#bf=;>GC(2&wt7qr0?9B)B&fXmP8sxqQ^}^NNRtyYkldz%=H?!n6=5$a
z%Q_Af06I1@&Fb?&=S>@C7**e$%vkrSJ+D#~d{ikt4_K-!Im^X}E8b;kERa;x7<{Pe
z8X#NhsHVk+0Rr1!$8@BDJ{M+@7f%Tqe+RSx1rIK_s=s^2OaSS|*gK)TIOLPIf6X^B
z7yXsZ%|2xps4pyIp4+L@2Ug#vDt^C9|H;4ZYk?|-$tt?_!_!+vk7ccH2Pr1r{~XIo
z(|r=lXS`gME-sB7jnx$K$DJW#15o6H8)<U#@}aJNqmg$XG<@uhVPX`GV*lQMRCa-?
zhH1Us_<v|s67AN7|8FkfU)%CoVk;hWkmJg36b3L5MQNjdaF-affI(#)x!lXAkbrGu
zXP9_4YaftPmFFRTd}tMzt!#5Y0I5k|3hmKFuJ7)02Xp>ITmsaCqO||B*BdVttsY%K
z%(^E5H2+wziR6<eTwHnsw&7pgF3ET!l<cg%T=u)dzuW!!nVyo~Z(Eh*Tn|#`H{l-9
z7M@RLW@cDu@g0w0nhhf&&e7Az+Fc5R>T&!aEi940b>)f#lG}uBC}mgQK_mN(!u$-}
zm3!B8(QAJ=RuzQ;k?b&n>+Bh7LmGdMz|13TqO};t6)!NDQ!_VnScYW3c6_&~RI;?!
z?)11Clc|2+8?^ZitN%Hl;5X%5KYyxq06Lhg*dXq%E}y%ca1F#{T&KNm${wfK0^r&e
z$mA$`ZT~Hl#!UCV-;Of7B;G#Qp&RIlahVyyM>|dPDOU0%YFp<n<rq22JrVEqywixC
z!(vhA$98{?z;tFi7?PBmSlWp@|L@KY<T;!g%Dz*Q3bi05Cv%2Z`2w{qaaqeU(1VdL
zPfbZVAIg_L?pMR{I5NDAAKUUM^q4d#P){1RmE>kK5&vgl1dICtD~wmPPnt_pc)JpF
zz+rpy0Tffl8yHvnh5K#4^_U_X!^F4h!T^Nev+rxi&mSAK{&zfMF&k*K08O2x-=7JS
z_hxEs29vI=g{c;_YaFQ&@@@Oe|Lp)ptz%C@(fiaq&WOi@Rn#Ke*8CKQ6M_;`o=m-!
z+(4Z}v=eN8#qkpmjM!G*n)`Q0(E9(|xsd<k*olhmNWiN_|1!oiDa4DJ+t+FNu0;9t
z;@*#kUtgmj4<l;cR;l=trjoXoga<5(QTI#0Z2k#bNq3lfeS#c&B>v=Wo)7y#1jpkn
zVUi#NEp<wF=SY{U%#1)LEa$tCsY68sHOyKk=Vwpm=%J)DA7}hauTl4(Yvp%*9DLlc
z*%fD${|1-bc;%DISwZto|6HGMDv?@F!&4i^K+;|k_n>%ldh&fa&45eXz}3))Nngf%
zx8FZ4(f*RDsv#^lPA_yT$RPN}XB}?y-N#oWP`5Z0&!G8R;Z+>OC$g87*8*U|Brksn
zT>WqJna6dN{B|jZdEx6paKFYfEg_Q62mj8wd@`+UIHF1?8t>;zrxXMZhE#iI4H9~d
zt_rdNFhfA#rwBjnewe9c`FD8ocDobPS&P8`ywmpuzp3br>I(z8DDxXvLl-x@e!PpN
z{|m_fE=K1~J^9tcPn2SkdEc$C&W98$G(>nfv<hfD{d;pmMVM4i!USP^33H4|;1hx!
zk*o0p+)XHL`l1kXT|t<;B=M!pzp=V9`2);iLX+=o)mhQY4}1JJL;WyDu5;iIv%eKJ
zN3Ep~K~W)BLVT*DygBox_aj~2M>QtDrD6!)bhO5xb@PjX0EN(d)~KihJ9S|MI`W*m
zcyQ4kL5}Sj^k$y^BKG8J>aJ8+jC9~S3;tr(U5j3qPBMj7?&rxQL3@cv0&Z`{X!usp
z;kx(yQMTRzjWyN_01^TjyF(MaznS<&IoMl`Y3F-k>hofT;G(zTI1M5lcW$m*@An0d
zJEh$*?RvWwlrvwhrjhBTcw@1%KN`(Q1o7GQ)fG3;pw}jAFCn7t-{wfZJXAvjuJMTf
zJ4+=)JX2xyVLUIZx6Q~%BuCKBK<DPQ#PIizeoXv!PdB7XgziO8A+Swc{~2HJOoONT
zhmeifjKZzbHyV^r!e4pvtrZfrhjbqmJ+Kyk5g)ilZcMi*@K3280%BR9ZnTN=(|R2y
z<C%7)@md+a;#XVV#RCN=ga?5kUtL(P<Q+MGBlqk3?E4t*bWYYE6E`ZefENY|O=u5Y
z5XXy`GhET?1Oz4)8=qAPgZqWaoAvogDvVvpD2CpvYf1M^;YL(RzcXD;nd$g-S6JFd
z>m+Pybf_g6SjEFbI@vaLx#8Wa%e4R2KnHL1-n(a!tF<=PFQ_eRt6sZk$!ye2oy7e2
zKb6pJF^Uwuc#qV6X@1LASf;zgz?v+J?n;EFi0o&isf0^e1_3HwHvpG@HXTr<@VZ;r
zfS`coom(1ldx^oJG6?~}o+rx5&9W!vNWcGsA+u^f>ofSsn=e8H1vEhh$N#X+gGR|x
zgUtw8D`=2hXAgNj)4q4ROAvUa%+<-6P3D9FsNV~%wf2OOP4oZDb4sqfsw^ovovwuE
zg*Kyub(hAYgDK2=3CnOCf4U1Ge+?ls7|=vh`;oSMoRgEj)*6kHg@+wyrO(}OTn!qE
zn0;i&krkQh1J(XePIjGp<6{H_sl-=^k;(W#%z$H0Yo7s8kesb&<Du`XnD(=}Fv_+$
zl1KKA#oJPkL#XOSodpe&lpu5IU$_%9^;ITUveDaBsccezJ)8dRS>mwmPx#GzYM4^Y
zPoA+*2M6FRVOW?p;5adQoXMq66B9?o=^4j1FQZ(AbRXQNS5-DDMX~}s(6xUuR5M8$
zMbUCODspm({>>i||20cvhUx3S4zdR#d-SKP_&x$xN-Rc3i#c8|N-NbB6aQHE)rp8;
zgyJ8FGey0((P)g?Hq`OL6cDz$D}jn_syC^C=}-PstU2$OwW<oToc7dk^i6n@K7ZOg
zTIDXBl)yawzZFeu$B0@z*w)iO*5EWk5^8X!J$Ec5r!Xp?!9=h?kxU+g1k3;FOG_>?
zN=}v9KzW3ifzfoyN_8k(meu1^Leje(2O<jPfAXYrGW1TTel+M;hg1c~u&&8Q+1>yc
znk)4D^iJnJrrq$XrUB<8o;H>o`fCJ}g#VPFr8+cC{ax3oZ&X`$iza(f<!(Fa@^d>I
zH5jCyx|;N1VCsb4l|81uuQZ;Vaf^!6ew`;|-<%v}GGxWU+O;qh8~FWN7fldg4l=}!
z2D7ok!{!{U1i!_ueiO(jq~68wSBV(7rP5!30nL-qTuBpSJriiu!>?;@7zh}&+1F=p
z6NC(Mj1cGum(gQ4rfbVL|C6n@frVA37d~BYG5dQm`qHX1eCbyb2Uurv0Jd(&PRDNc
z!{35abeLd<>}veOeeT$ofim@SykGa-KzaGvlTwXAy#&h<1D1Nu(2obx(5$Y-_r1Sr
z*_>y?dR%9GS3F$S`&P%*e)`5=t0Dilgn(h{;Ga|#KT>|yCe>Kq_!?VWZ|r$__R3^5
zhfcNmgCA~4JJ7G)m~St8qdA_9F@oP56`LntPwF&E<IE-;Ft~42HtRJnOBI$OhM^|3
zC;q4W7pdH5y4;bPjX~lst@uBkWnE13_`ATz+Ftr0Q`~!FGQ|Df<2=^tXQU*c-kl33
zImu6IR|nB^e(=K>S7~q8o*}+ZlmAXsex)mtQ>C*?9Vk#g-QDVVU!MM_F_b+UPh8V&
zlat(fairHzc|doud%nS(@j}Sxhe_ZM?twCJ|JdE9cI@_yAdA(|y{Uuy3zg3HvuJed
ziK7BkieJ2)!0;A%I<Uz|%Gs+PSbod~=YtQcPRI~?M%Cl2lhfEe&@gWHS>j75hD8C2
zn_x9F;!i}fitd>qafNfJWC(VkJ_eL_Ds152`FU!OdA=KX<G(GD|6?o3>*YSsVBB8%
zbKr5G?TBBq=x$*5T6t!AW5?VE%Q;qXBUa~y4}KbYryR7sJC4V0ZdB_gow_2xvoTqF
zq?tPZd}Y~^b7w}y94T8^(s8Tj2}c@}n1PH)@Z^2f*o8XuM2+l|s^*NdF_plz*9O+;
z&Hbg-k+YGyJH0;#f41!)d2J#j(&p>%6T#uvh(;*?xl1J<zm>G~P6c~$PTF$U%jyel
z+LZn#KtcxISy1uAifqUE%fC|}b)iS?nBLRSdJGqfi0kvYOO&1@LW^x}a=xDLQ_??2
zx0fE^i~Y&{%OhNvYOOfjy&E2-Wh0Tp3K7f5G13(uu;m?^Ce2K7nGU=RMRDu}?4-ED
zXx2GdBvKjRVhxF2&l%xxSCpQV52rZIu;{En#ab$l9{;EHe+L`wrHgn+OJ{}xLmPt_
zom;M-zP9){nSD7yX-M6_*>_T+=LKxkCj2p>eax@a77MH&?K@Kcz>9O?SYF<QJrZTR
zL?%h}P_-6}pBe9xIYv)tFHkc`Oh8~S$oYJ<C)MF?n!jIV4XpuZyBd+UubYce*`n|V
zr2T;HY^aXVNSJNI`@w6kD6kKGHdkdGnN|9WB%(AF{SVK)rvkYAV9g5Ng;jnh>&480
zOB96m>^B5Ixrp#v!B%Nur$<ZHv7-qR@$r=-6fz|el5kX&X2{Z4ZBeUX4}@T2vS~(#
z)m<Uuzh=nrakbUG+6@^~{yH^E-n%p+)F8w(l=Zs;XWN9a1+K7Kp=`Rw6_E$JWjo>o
zY~FnMWB6!w_nP2=vff(QxIl=IaX*p0_=UK$S7Vf>L7~*7AL=HQ&+1_Qm*A(KMknk1
zvO}{X;Z7ZEGocs_3jK-(=58Ek5d8`vL#!s>&iJ?yQQglB>0yFYqNmmb^PztZaVH~K
zR>u?BoK65*0#81yFIc_wct>cTb99&9iwbu?=dDdiX-tVn`Ym(GI<lDYz4P6_yM~g|
zeWzJ_vi<EJ(94{ktw4;TC$XjHb>CC^Z@Pc>>Iv(mml1sQ<C+Iegb{U(Zoq^(L_nlu
zR9?I$m$Hg8ay0D?vIIW0d(B*qYOQ_9`EX`TxKw&ld-MAB=vrTMs`-pmah>6II=f_(
z3%WX61h%j6r76ek-}>-tLR0`1;1Ro47?lmQ+q7Rt2uy!$kuw7D+H?}N<s3GCboQ-j
z^~Wzx%XbVi-_@B4TM`lkO`2Rf7}%r=qe9Nz57?Pv*+wWLevy8;+|U2GF(vUMrp3wH
zu7N8d-hcvH;k~j({s3H2F-cu}3_sSZ;*!_w1WX!m&88davpjEYRv4p&VTT1Sw8GX_
zbgyT==SLO`TX)t7eX@-ddtB!AB$u7KKXra0M^{^@*~LHTT8R-PBgSj}4v8c4gT(F|
z>^Hdew`wuW8TvWJy)7@*>f;~g)oA}20K5Qju}#XgaqZ2L{fP8ux;Y%bqRAXQ1iGSG
zb^bROAe!cxR6i6W=Ew5V=+~Dzu!;gbnfYZNFVkxku!kBG4B6K8N=K*rg3|CsVafFG
zBy{v^Il&u(1^r~R<-B{4bZLLTC6$`;V)+`a50e~Tw}UEpofaC{l5f*_72USYjW>KP
ztkmvw(9`O0xvaG(`;^6&;Hv%`AuBNUTJ69_UuYUMYSQy;uhwBvF|jE_M{cpi^-sSI
z6HIm*7d|0k3DW<t<?35t_I6A2<aRX9wzHTMna-<3uIn@MX}i@PLza7)b1|yP_x($E
z54x<r#}xyO#(2o(q??Dlr)Povm>h3b;Pv+^8oT%#b08<4{Q+6;eb6%qz|Qm5ujWKM
zVOO#!Rc}92-&+`~AQ{t0`xfrL9zpU)Q=<7G<$;Z$l09it<io?k{>LQQOg(A}*TqWj
z@wRYq|M`2XV`ubQ<UaXR=QrZ7JXAc)K2*wiQb66*XW9<EMqg@CFb^WcD6+-r%(|z(
z*_af*F7J5aD3ee6?2ZF>3r<sv+c1;cu8BsMGm^ZBB8I$}G*c{p1D0?q*zM#XeTx?V
zflUMT{8t`LE1ziP1=smX>;{I)(UT%Br2BfB8STMG-8$?zp}zFbch@{5#45QwJsA<x
zXNf^Qq6{8EXS*aJYjEz=X|KTy>MDbLicbBmV;zdn=bzt3@^e#kFlpS%(IPwem|OWu
zc|q!q*=u;(Ew0vcLl*X1<EbpU!t7^K#~~!%W9!F8S$Qx?qN54nxD73t<cW5UjP4ID
zmNtSf0V8OqW5zE>ppEvIg-J~E><W~U**@yxrq8YXMRpDLJ^@k4Y08#nYhbzW?O@}y
zF=|Jlt)GD5&W0udQ@QqYM#f2oF+uZ2dmpyMKe{b!;7#kL+~j;diDyy;W8FD)H~H%H
zS17w>?qn;nYePaTpA1D~1(RvN>s17_C-c=IXHsDuvk!+{mttVbUL}Jb#+-!q2~KWq
z*?N$SKh%PW<bm&x>_f~?QLE!lJRm=_n(x)4=Y**Mx@J}<4%oB^;=c8yhAY_>Jx=P;
zO$6Uf80JHi@D%)h5>ik7yK7U<^u&_uSGi`!mg)6a=g&1`$uL4Aedl9ZD@O3>v3N<#
z<jq5lYh)H;w(ZZ^{&v~>q5fjG28bak(jY1E+DDRp{jEzQJLAXs`5%G#S-0-dp4y@U
zjLAN;cdW3=*a?<)KMkLsH5}cEs$!W~OF~G0_sp-9^8Bt5`mI~$9-+w*RXilA_1XlZ
zdP~jn6C1?00M(<dT1z2ilIL;=T7z5K{CvM2(g&h1I$h1%mUFWYGWy8vK?bF$r=$eJ
zDMLSVW`{4+ieLIT7;x)9P`^a2#=T#VxZoI7xM9x>V9g(q^cA-P-{AYnIZk!Uy{SKH
z>4m6m!Z|{p*p#awiM8w1PB}ExImdHILka4nP-F={hAZvdSoY&gWyI>Q)lo^0Hnv6a
zIddXT+mVO)9WhKRva=q(d!vsP*kcXfy_jRYNV}_LQ1(OI3kMfQ)Tyb(o;d$Xr?XY#
z|78150g+9s<&EDwtV*XXzeL#HWSqiHg?tR+{PI?1Iq_#;cdVtp{!n{Cvo6IA)1<#_
zoF(VlZ%M#+A}xM=OpW?k=fY}FeS_>{z=cnZ`+3jcl*BYSHXp{c=C6^K!<V8X*c=t&
zjO;`&GC^McAxOOq?0K-<tFPO7JY30gnzwzsWA)$5UZ2Qu2dN%WSv2OEooFik=wdVN
z-|BFoVNz^TumAN^UOGprdrg+5^BcR!V=lCIWXG2Xovkd3J2CVV&3Bz%st+R-p7&IA
zhfU@`jV(LZjps0FJeTqKum;5v?1c3ye7bx3divC=pe=W;sxLxLP(`qqsGCRb(DT{X
zI|3eMkc0q`TM$)OIyavb%8maQ(vl&h=7iL5uK6vZz7Sb#+%>+Cajujld>8UkrT)?n
zQ9D~^aJ<;qfkmcJ)lhvYek|pV(_i>gey%$e%OXUL^Y=ePSrCm_11QfF#c9i9-_wvy
z6KRV&Hy2tNxM4~k*`W{F&Zm)n<ol!J@79~1NC)b%vsj&V6MYY<WqykH*veByksL#M
zUB2L+RKR`$<ite}8XWleE7p+;9h4~#wZ&uHWc>(l3iePfey<LB`9E`UyJDQ5CCmLy
z3}wseHhwu^l6s$wtxfttVZ;3%KAB3!(UgqGhY(NBUG$HH!aLi8mbKD5rhT@GHY216
zNt{WqJBMSd6MAq`;;d^Zyb&w02PB^2g5bKN_IM6x0IW1hdSabL0%<}t5^%LNr@T^G
zVjbU*IB#F=p$-XJ+TIR}2!ZnKOo2(QH=iA{A>S^A5I(^Qa{8Eq#{;(WVmBRM@K`-y
z6_TACn8(bu)>QkNj~Am`-w&_E{#*&EdT*ONUw2R!M{Ne(U9dZ-HmP9>)xAPa?a|Ek
zx+trtUr{to#lx$9-l_D73Z(qpKe%ao`Rq!jZjb6Kgp-@DJ<&>eT63q3hT5d*W0u!N
zgbVz;CBd+p^-+p~sZWB}b4104j=!0~`66JSwZ>c#cEwp2vyNpAD^+pnQF^OTG*&2;
z|8-=hBM(ppx(Ukb-#eJ06WPx(3gsXw{?<uT<{9VvN`_A7ftiP%(!REV-_}|oCZpeT
z+(T6<4ag*zU*IwyKO+_~YXnk_XFMmvcF@FUwz?8yA4~FK%(rz}y7&?v_;qI_JCo8q
z_ecHBA#eNe^;%6t!X}H2I#X|5k@Q*JL3746q3E4zcapMSN}=qPBK$nyM{PAylaOyB
zWHrt+MqF>NkDtAUy?T8|dtpA~QQ|A%H=mz9zC1eQV>x|jj>~Nmi(uQG$xNwhGxw5p
zbty_Dv)U7|hlay%8^nvAM4xPJU8bGRmR*I$<+ztzMjm=nInA~^!sV^YF$sT2S`cYI
zKL%__b&pu^s1GN^TnwT7dL*%l1WXS%ZkYb=)E_088?*7yVbGjS8u+?*y6I6xa>8%+
zx}9?J^VG<%-*hQdx3p#4vC6iOP3tB3rG7Ds8EkHj(QDGzj1j`58`Sk1Jkg~Q9Ec`N
z(xnxK9P%<?b#Clpx}~vVmF$Vef@mFjdzhH0V=|`B4vd*@?d=GRB`Ez8ru^xwN`krH
z-U|7htKqw#@ZWFEpMF<Ys1-)_E)fh%Wb*suQ!KQOyA!sbp0AtTUsjA;KP3byz-XV^
z?#4vg-PVz4ko>Go!~=j(Ts4WE>zwa+SzJ16;gX&)?kIWRZwtA#k}qhNC!j^reRIm_
z!DiOi0hw&D5b!ma`QV==ruYV*tYe_iWtPC1mqk4JL%?u1_6GsKu)$$zLyT3nA-p=D
zq{L3qGP6o1?(D%MoWN^(p;y{6<4@X8Z-`UOk(j(bbs4KCE2f6!RlDSO2@Y6oo?hE~
zeY3I|(&Rt8I9XixU|OoiByM$3bU%y7uXN?5>7sJb8#J$P=SDsRyo_2BB(bBHNdw5R
zu9%(bEz1%uxK^)wajS@!_ik$4N9z89)U1flUjxx2l#f>&c?zz%-xysc{BaJUynJN>
z>;wR6?k?D3J4G7`V&0+jZ0FybZBDCI&cU-iL_J*}1o9t0TN}@mL_myRi1VYb=T@ok
z4-(7(y^)8e9Es_FdeJ43n((eh%MilN1Y~iTU_Hy`4$6r=QiUeqjetD~zY|Z+%^}K^
zJ(73&k~zPrN{Qre?``#GJDl&R*rOI0ptQ?p6@E;9e6O9<Pj*L0Vn^gLorPHmNs~4v
zlyWe1#5;bYp+B_i_hp=}mN=-r5b5kKEfs_ec`Ym{Ehd&GS4^nI)>$+%VjFNlf5|B@
zNcB_30~_fMb9s9ludOYcHqfXOT2t8(v@e$GNPcI(N6(C@m3Y7>I>HVkvZXJ_VCl#%
zs?13El^?*|`zZrWUdG8F7|mSjdZMSL2$g<jcni8UN|C7Yl>_&Kxy{)i^P3*I_~l|+
zM|(QcUrzG3d1hc?FL??hmK*7JQs{t|>XDRZDT<k61z?{5JDbu1=b)>Bw7r-dAkThV
zamW~tG>*c5ii-TIJOikh?ag*YcvL->S=ZpHI!AoC)J;Jm3hC_M8yWq9>efMf<pHh1
zWx;QfUvDP+^lhZeZuM9|KR9rb+{{oY-ykWx9V7$(RWo5CxsxgF4$z)JUH$cDlkR0-
zf5$%0aC+LklRd>JtCg=3U5b6F7HGkL@{DxpF0$pvJ`U~Jj!w&&pl+5>kRjP4Un!AB
zm<l1I&ZXA4GJf0lqBrr^CdPwCx)-wKyw4AWTcy4?zAzAquq)y)ZhmWWKVf}naj3;n
z%#nHo_}U=f`i;OQx4-DV>P}(xv7H+4PYVKmpp2j(343>>5u_8E3mkbq3vrj?s9YTD
zWl-WO{PJsH`8_erHob|}pdSQVHTCo5tb?oEyRN!iD?mhHMV(vFvvw}kb`mgamB%$r
zwmsMGZcL%xlymu|i}IO;a)fA^5#Qxat_q2axd;~-aCZ<#)UUHnZ7gpCL5cl;6@*j~
ziyU9@eSluFZ%ZkeJzTIK<T0R3HH~^r_e4l%J^8Or2*eg11L5+S@Hi`=q#-o>QMm%A
zl%WHXyHW3ZmXQKKR)}JDnxDh0*2)ELutx+;8XW72ABc7ZuEhIu{CI2ma4?(uhISE^
zfBC>q$c9<f#z@^+Z8@KM4Z82ncWPW@!IK{)MDZO2nRfwX+@nhzOfBk&AK57nFWu@h
zkh160g{zo<estdSMUlwu&0Fpn<Js~<aiwn4QFH`!lbGj@VnUDcOb3Z*HXCQe!@+p&
zaO!&o=&GY29dq4RnM_1nx698>j)q6$KPTOaC%olAAPnFlz<zKfre<jb7&@CTiRqXI
zl-%S<b7s`F5;%QJs+AI|O~k)~`Ml;6vp4&$_K9N%Z|aWL{LqO}I(-1FUP6o&&8DHQ
zt)cNO$8&a3z9^Q4_FM0E`?!;7p9=EJq$uSG58<a;z!z)aB!VK20!4|nncQ`GId+k5
z`o6lf*G=wflbU^bfyDl<lbl`G5zu7~<nKk_L@vL!<B^B7=%Ki0^=OK+-quw9QOL49
zjoP&MvD`H3{gIPbosV&5w>Qi0G};dOwjOSobghfrcK><}{EY$MAdSSNJ=Mn0i(dk?
zfw?;d9EFeA7To9bZq{6Ux?kzUn_Pc<bE?qW<*ALJ>fu`5X~pe=IXmC;7U$HM1MgGF
z^c=n0Hk+matA>QQze<GdW-Xl@&>s8B1NgibCrhv5N84a3>fEXVDl3%-lCyvACC2|I
zUHEjbR^Thig$XycFC%lW!9jU$SGB>zTFjLAE&a+(T9sZm25?H@O^zrHwn*8)O{D}M
zL9OeQyuaV`CEUwQ&*OFOv2P|5FRU^FFB|i-*H*=cS4di=*{0r1{aSZM!JGG%KF<RD
ztHos<BPZXs=KO~yW{()k6%q7TqxugA-%!Rqt|1OaQm3~7d->lt0<$CKjuB-8Slx}z
zBm1yxR&tSHrIvAsKX$|CDxXht#FK$7%BlzDG{_KDT)$eH058)_uikxelY*8Oec^0$
zr)8l@>9KJ57NsVAm*VKrkYzA$I>%$3rJx{%{*qz%kSC~kli_V`@O!o5T!8^AD^?KU
z<sRfQqmhP8v`eS!U%tH|Ug~#0GqPr%5VNLTD<Ntp^-E^EUB#hP^A;;Iw=v~yvv6);
z-ZEv-ARqhi@JpB3B5!E@=Z9~2-2xk4IQ|_MyA{-p$Gom+c+W**HY@=-OauokxXzG!
z2h19Y)szSLR#slo8L5<pIl3V(8HGQalWQ4V&psQ{cSSk-59<f1&=B&P*CB8+*6@sM
zzw|K@Ho@B0Xt{y=7_aCoZe5m(eUn*8rn%Q@WB-#0!2#R;Yvk#uYXF%U>>}@`949B2
zZS=BbZD+4f^ZxIy6Vi&t)&8{n29B1AKa#0Ndpa%Ko{zF}NuT8^)4XP2dazz8|D1H5
zjYnU}|E203wi=5sKipbvFW+g-4=w3M%|M0&+5~a?5>Gi-jDsH2PYm2IA@8nEBR7?Y
zI~`$PpI>gMDKdIJOuJ?bd`RAO?Iw>Zdv=jx#G5ol-h%Xs^{p<{4B=g6VWHRUDy@94
zloM~xk~z)Bg6|t;n`26U+U9+QhJK{)B5(US{?kl_^PZN75qE0g#|l^C;E1IBD#!Ba
z(8@?MY8qy>7Cw`vu#OLbroTVQfBFbeiM|E5<oQ)}Y*dpvnBLMFc_$%E6WYa|hw|7N
z^4zs0eHgl#HRPT)(WHLwdRT~D_2{)p_8^YFkHpw>x!YOT45nH6ZvzZ2y^~AXYY9`s
zN5}U^Zhg3YL-4D(YMii~W{y!xSmoJN`$MVC<eSAwuOu9bR>cCp6A5WPjK4m)F!+K&
z($xF4UeA-ls5|1+kMzY?Rk<AOOZ-Pgy#lk;Q(fib8h+5l6LO?p<9^K-Je{?eI6@8G
zipc6yks;j?37u?m7dE&>vHB>Zz%og(?>uP3SG8YFfMo7eRdC$XU`i}=ulERUQ>tc@
z(2LufjUD^LWm?nL984dwP)T;VM#w-y0)$(-M?YS1tJ8D81@y3`yTa4*fpdP?@MX+B
zN$H1wwEY?czhv*hy;gdKB2?2l>n3|?gj6+!4K{xdzSsC@UaE7)Dq%$4U{+<=c2mT{
zUX?7&DhKp^gHB0KkP9}I)?+XK=~fVZ4Vk3PQ{lu60?no(Peo}P{WjY2=h0@|Utj9b
z*cfn(>7p2BJHPQdOn#&meir{MU9j4{|3!~it;MhW*Ge`e&!g`wQV(SW><fX|%fay4
z5{IO6$;FwVUyFAb2mt1*G;cstX-YFR{_n)QmW&zw%iA_tixs8<QYBTilp6fO(>at{
zuambbN4+ElkrMU%Z8fDs@+kE(j`-{`_BxRBPO5&0vefM7n)VsH_s^THl!t}?7f;{8
z2v-+&OOPOf=)FZ9y+-dNI>RWVGe$2V2!bF8qxatX7;Us55xut|dPG9Bh!!LWa?ktS
z``te<v(GtuKV>~@t=)2n_Y2xLvvQ#4yt|9>>xQ2Zx?{M?>8;=TpPlH1Td?J*@EhXj
z{2(?No{MSlQ%!Hk3fdL4RPsNrEdqdZ3&zQN3CL(t6@PKq&KbsIq~q|pUjGF_>!Q^q
z1(%A6x;6syIrU<nD_*;!j(%&;(Dv?}s%|}|Lc&9n2ps4pOSsr!7bKC<OpsM!+a2!e
zgcDCbSrR7!t`f=mo*%injI423G+q%XMGCTv@BO8lCM=9XIcH3{ys+Nzxjm7p@s5R4
zE(OqB4t^EU(r$g?=kbR5cy45UyZomGdJ&tTWx{m4#p4?z;B}m>KiQ48sU*{ToGO{y
zVEZdnXvZfQrwM?U7z|P??<y3PBhcc)CGF-0h?X~NmZ6e)ja!4y1!-iH1>&(Bb{XUH
z!q4Sd=001fTEPFF%(JF(#;0*=XN+(*Ke_(eIM%jBL8S3uo=4w++Kt3%?XQsHSQ4Gl
z7t$(X|A17!%n1wf$*hxLcWEVMF5o<h_^q@GmtOEBL<yDGJLm;-<|mTX4eXmL?F14c
zX1~?MXjp#Ie-l=y@brWib=C9i-&MwZ&N23u|E8?5+Cc*>60Aw9e%Gtdm++An>pZuO
zhs}oiS~ON6SAK`d__(H1ckvuw5>ywlhGY;~&ZA!kAt(~*aXAQ`nrt$9jbb#oFs%_z
zEEfmY9vZe^ExkUc39q*1ws%i=k}tf#6a7j#l`>PpNQi|>-2IDp{!TR$yW4#7Pes`^
zF>L=$uMgKyHFMZ&=`Dd9{;#jeLW(yCZ)_APAYU7^FBKw2qZ@xljJ$X%Mb@#+d{(FR
z><N*NM00;m#^LSw{Jd11^@Qwe9AyGRCqpGL#RH>ZyYZB62VI>th+oh#v)r+)#MPjB
zypvrA#n80N`U&=qvrvpifM-N4&)Bb^Dux@CBhyoY1YTjAy5dm0S?hRb#8(-Lymf!%
zV6=#74Mz?=rs;$C_B~^x$HRZW$LUU`PgyKp;o*RQkRQzHkKirTJOHW1p|MBu(o!jg
zEXAXK#`_6I^h48g@%GvJU#MeF<8Q;h_|_(v@>+naPu+h~<UbI<KWn@ftS(2BeI#<4
zyAGXanBThfjo$t8NQ>_nU)<>tS#|x-n`RCH#C>uVkv9yp{wontqMw{g>Yf>|W4r@H
z2Hzdbb{>s7WsDC$Gd;XwM>?z;y21svgH#$^s0D1aTGnHtCD!0sye_<XDl;X%^w!CC
zvk;UOJlMUsz~;bcKJa5kOK9B>zIM-_H@G<4z##$UagbFe-c<;dsV`DwIDUCGGW{xf
z(l2-)?F+J0O~b!tE>HZ;yi^@UL;A8Jp}j}v-@U>LB=W1jhk<wa>T=Ond!moitvd|!
zyT6W_*g@2+)6?7Tnh11Tp%P9BP%fC`6>^brC#rY9GP&Re6<SMvc{!7st6$*1SZsJC
z|E~EO+8)IbfBVZpv)s{?cNN>(daatb^)QQ#fnqp7<xh)zAF)Va#~HM9xOJ;J{o$9R
zK9iXZ8i9Yh?d>v7klkddtcm{06OkHRz?8@IX^xo2H3hMTV7m#O_i)3`sYjN!bD@z!
ze4cLB48J9rN!F(f(G;=e=#;FE0t<duaB+v`th%H4o|6|F6`p7>pVtV=Nn$GmE0<3x
zRcRU+5ODkTyJ}&fQd!VPPf^8HC5ehzHQCU+p50dw27ilK8=8-TTD@Q4e_WisC7-mT
zkC;YXJi6rr4@)k+E9sh-^VZVUrRA=gx+L==QCh1<%Z#frC^+xNn`W{n>YE7KlIPa2
z<*Q`>%C!qFd%J=ttgVu)GH_n6;5c{HDX!wnT#>w=)Bf^~H<c^Zme|y^hiTF*oG=^q
zQa(9gZ_z){E}nx4Z;u!_1KbIY<+obrzhilb<y(QRl0&g7`_M&>>g8HP;u*o)G#fbF
z#@Kj;!tc<|4#t(}RcNA`cks}u7hfd<+eq4##7bBtEUSrNZny>(;PjdQnXoIKSnkVR
zq@>b2Y6r?m5G8(uZO+5;wKTKny5Cpw?LjOGwD0Ua9v+vD#>g`IQQ(UcMyGmI2-ot(
zIx@3?O0fDFQ@mD%?^7DHss#pKnv6*Gx6j@V-Gp1uT03u1uf05EOiJ?p%G7T8=g|g5
z&)TA;*k@5&KjN$p@)ezazkY~XQ&8c~EY2#_Xc(P?C)7X(c5Mx!o}GPTLC(9q4%%aK
zceT0-Qy#P<q5;0UWJN1fS|+BW9#oUaB==}W1y=J0oruK$p;<KbL}{3a>GcV#?d}`!
zww{WuR{nW*Dv-D7zn5;y@AQlMi<&DbBlV{FhrJi?{5K5O>lL-{pQj$){$-VWNoM(0
zq(bXWZG56yAlDS8d>0Pl!;cvKuB@_7(iJ)KOr%UHY^2ULaep*nzZ&W-(brg0l+zgG
z2CFzMRLaw)ijJz9HSKzfbZOr*R&5c&mr|FEB`b*kBVnESl<Wd4=w8Yzo}n=d{#L5Q
z-uSP8<(|?BOt~Y5<GzZaKo>6SX0xj6sK3IzFJH-QriK=k6xp8l>#;0ar%4{0(ND7P
zd=yeW{`U4nZ=Q$v$Ofkxtw_Q<=BD*5ZO@j!D}X!hO3Z!t3nXS*t%1<MH189lr7ldq
z=SM1h?_onSUmtTLu-$a@h2Cj_3qXNYmb<*+z-Dt1)uMWo*dFh!2sLT3n%QBWioeHb
zt4a9=RKiR?8Jr=2WPD%@<=HByvy7a+D9#xzD3IdMK$Kn2{C*5C@E&!oD|3F_wX^$c
z*rbQ{=#1M`C9r$0Z(;+_TDZVgB>QtMQNP~WyzrNmmtK8gdyd@hUAYdGI!$JYe;~D<
z3QD!icz^e^?kzhWadNftW<IvopS^oi-P6yYoyxUZqdwX19j}FGRh@njA9yc@6cMC~
zrEPYEEyXV8H26cmjU}Xa9E4EC8vuc!43$?puCW4k>nhP&nM9T`u;T4oG_aPe@ky{o
z!e&Z&PD=e8DwI@c6U}whQ-2mc5no`UpU&AFOQc{ZJfE+9U2f6vQbPN&l())|9HHF%
zpy$RGhS(O;Xoa2Tz9_%HcPd>x&Ox1J+5h<t<WJ2XPbzDdt{s*SU%wX0=+TygsPez`
zy(4tzzV=Ov$&-jdR>4Fbwp$-Yy$Y8u`3Rk$tPdamqKS}vXfT)=g=%_VY%dj`xb*R-
zg=u$}G5tZoG^-#tVPw_lwz2%4rN=2Qtv)t@m?rbn4<>11L;6UVx7ObHPHB&+ly!w>
zz*4D}X?G1Df#-qngdZ<4Jc&{&$M@1g$kX*f!5rsm)@ME)hp+FhLP~0&;S~Es2@42i
zTmM#ls2W_blraX)OCWB``yC?tCduyaJ!?>31t!l0Sy30#08upw%C9@g&+hcYAGuNe
z7NIuN;{R%8;(_8X+Kp0&hw%#5CJ)lIR<BNYJ{oT4TXnybuRpg!QueQ~e)~kGC{k3E
z8sF}2A!NP4Z_yARc00>P==32{zvL-tMY)QV;0x~@^zyY~Yq=n(q^)ktmj86SU0?*G
z07_kG4fmZmkyKVFE=n<1Ea<EJrB@ePwHe}ryk}nPWqP!CK7fvPgdOSp;m0`Saceu1
zJBP7Rh4%ewjyhlEgp|y?JkfQ?7`eQ6X2NTcXs*av@IFs?u!g3C;hNKV=Y`~lxZNPI
z(xSU-dpIXj%lZ+|&S|wsSD@Q!lB>+kVu0x0;~z10i+K2o0Y328n4@uxP(`3vmF&Lx
zk9qJA<vUiQy>_~9Kh?hf+d&|X*d^J((QEywuB60bBGbt3lU2blbJ_lcpgk-%6@DTn
zmwUdR(?m`^%V-6j{>MW%QJ8gPIi;PoO)Md*%8j7Kjz*7c0Lm7|n+)suT4vZT+XYpp
zpCs%)am7rY)JJBOxNjiQf;N9iBg?kHMD;E!;Pb~3KvnH81I}tE{geHY)h%(n)}zKi
zi{2N+Uh7+#ereS=Mg5^*KU0-qsHK}!&q%fV?CY=>!{@zsHqCo^=jLB>b?om8@Xm<`
ztP5ZMFBXt;IG3JY%1>nd81-KIkVb!+6~?Q7%-q@Y-Y;Nkxjwx!eX7W*y?|G%7HYB3
z>X3TRLX=QMmcXHpsLqkD`yG?Q936;DbfM%Kxryt_XIFC}2JhpyWcl%b?}lz&M#zMY
z$SSY9&UU#7u_YsYCtON|{ZTtq{b?5R5BilufX8Vmg*pr<W5!PzANd`p<}MhmEH_C>
zK@Xp6qpGnqhuLodsF3Q$^i^F=8~nBE7sa&L*R*$Rb_DZPnv2W_HM3^lz6-4V<}KO}
zHX#%ClUis@7WkMx?gFnpOmxe$r8I%K&Pz^6OgUf&OQ>9)yfxq{hjNQRUkjCB=oSVO
zp7-ZWJI8;Mn`cSdb(&ILKP%>|&_e%x)5=SzrB^DL7pF3lc2$<yQBdIeDkt~;1h8P9
zE{}JJcg4iC=xyG#dg;allw-y?D0>uS&NAmj%k-*Jgt9Hb@!R*-y&{(|3lhtd`Jn-i
zX%JPnXOm*)w7`hYD>t#u;eKi1jngdc;}O1Agf3j&L~_;7T9_u@6np-7rlhS5lsmA*
zp?*?=$tjp!cwT8|LUH;ijsQZ=|17?SP2+7Q2p<2(>Rs^#3z+7CkU+iGMT-?yC<m(B
zBIoy>M1m<2M$4c}4@7N;d?Ai6FB}8L6sU%WpZ=&cZwrHHmX9-XwXUGk`2z!ne2pcP
z5~GO(6^%dbT?ypxwuvn!){Lv$G8Y<DQDkCPfI#d!zqq9S_iX1JoBQ^`IW}?Z6!*>2
ztiF)^RR52a-w~nMl4py)c~$dHj6|S9i2MM7z6<UbA1r{M?`?}qLZ~R-b63T@7<R-(
zG+&lxWJ*y~h6b>^+bg?fmL=T`xZY*Bu6p(C8H(21$-N_4o*<v>Lh43iQhO?@08*r4
zZ1cBTv{h|_RK8DtRJ+DN%p6slv_znU-jYOjXEU|+-psZK=!;vOfltLd@CrIa1D0Bp
z|Nds)c*L_&+P0ty+WzwLnzy=nN7$>KLGn8{1yrsD2_D(MNOGJdvFR;Pu29XLuX{08
zlapf3R9^Fg*y5!hj<xIBm4?}4{3jk3;&a6%6L|y^+XKw;Nm?_Kgsuwr`_Qi{Nc<<B
z=U2}O(GM<vf|`2O7?dVPu6!@B){`%vIs4ukwA+_>Xz^k7?9H$QBI)TDszKj2<Ok<6
z57XdgTUL4<&+0^Cmo9k-swfpme}YRME7wjFW0<tG%&62>fp}qSI82e)WtLDrfj~Yv
z=)+Sth#99^{4g&_`{B|uek>1&l*gZoULSlK@{wvz;K7H;SN9@eX5`Dmcb}fy=JOZ|
z!Zf=Owdg3t#iJ<QK95Z+tW90^eUsn+g|q<wmlc%PM|;1UxhEP9J1airr~WeMO9NYU
z{_rCx<7HqUY4;o<R<n43HpLhH9&JB)8dREakx=9RfO_z}$^Svj2V68alK^T?<8Q<9
zZhU~m=jLbAtihC#u#t35`?Wn~RZoNMYOC56jf$cFmas=HXWT;X>^p4n;%LSC?Q|Q$
z9M12I^V_z$u+5-eT<!ijcEM(0)1-Qd>bDn^GA_f@SbFQ96|EYRy{F;~eDYCX=Hzh%
zMQ)X59tR_;%w23-lv6ZZcC>7{coyh|JY{UATQS_lDKX7S*1)%Efv~K}t_tfMzAmy%
z8y}8oYp=ji^gu0CgMS0Vo=}x*O6_>LNJEiw@yx{pUCraqldI1feI6;G;skBI^P=lj
zcH-v+!gzx;9;x0`%uwbb<QldeCW!>pE<~Rap5<&T1nJtLI2kkgphI5~qA>Lh((o8!
z;Q-E<zZ4C-&U$k0G!Mayp3L2Nk+27h`aDvkoN!E(&ecy$4T8h{sR>Q3pOnvZ#Shr_
zll^p7R#6L?4PA1AC#A~|ZDto}yB)RW+E#n&cy^NuCiJYt1Kh8I=PUNMVejM0Y7Xvu
zMjWq&<UDDf<;D+Wu|y}wSqJT?ONz+qRT$-fjOo(%Ox5LHg=du<{CdMzD78WMD=S@)
zss%i8Mvj%Gi-bK(Q@1~RZoBI8`ZCV2Q@}!2K&%Ji+$`FIHKg|O9Y#IZZFRVKb-X-g
z5!=A~S4+~esoVe7A-G?&5(=*EEU@%@n5_4uMO4zpMwU^>lXdo4vc3}2OczW>g{qu^
zq0%dxgCSa6aT0r~kgVcOnDg~C7d{zJ!*NjdI}*w13S!M0O{e>qIXlWya=7O<y6Mpx
zPVK?tZXq*|VUpkXW5I8kR$Jm8dG>%>Mq}XIAggWEb_O)3N0E8FIO+6~Iq&`1S337n
zN2AII^HzPn-AC6ng<V{fpj%MWD&#+lf^ey>n=n)bbD<*DTN<_n@*MIhwesTD-5@CV
zg;miUFWTNz*$kN%6lkA4bVP^N%r-lJUR(KmFN31tFo6yj7Tt>vF7RT~gosSU7-MyH
z!3Ru)PR!i3bz9}PKHaJ^qMjOZRAZYWu|6_A3~l=+M->MCAL~Z`T70g+icmo);=v;V
zUF)LgRQ=B+)>!|}p6R8v2fyp3N6-~}!=bucNKOYjS#g(*?bAtrtNb6X4ZCH#Vb2~q
zC!O{oTetjwrp=c1Qsv$`flacYT1HfH$D=hdxPDD8pjA!V{<DEvmuQEEJ--9C!iEUD
zMXl@f>#R~gUGB`xjAVF)FMWL7x+Mj`<TE)U_;smXb+LYS^^UElvuc~Fp45wh{e(*l
zfds5o|2e2*Ddr$j{9V!I^JMdf;ff4`E;MU2Y?9x2dNB@B?1^S`{bCI3?-~y5-@$(p
zP!06U@0@Pt%=&oN@rCluIUE`FCkF6FiVEzK%vN$jm^6R1UWF+W2^x!}&N={EAb7$#
zkJNd!`Ax>Ks8Od!P2;WgU;gC}f{;!Fc<uR8Fw~)J3S&L-OJMDV+z<T1v>cRn7xz=g
z&}H8IM=s^bh21<|&SEdq+HpgpR2dG0j5L=nTPN90m~B*F1gVz?=joWqq|UDj+r=-4
zDE<7VVlS|xAg>NF<b+i9n+5XE*9(ku%)l|aw7<!Fae}E7q|bRIS3@>tsL;`onH?gn
ziZ<kvvI9G%=gQ-D%}`=-Ksu$55I`o~YDbSbL9fg2*~MG#X3s-&rMjvRGAzfmeUugo
zwBN5Xo7iF--df-Mi_X^}eQ1sDw^^nP#1$AU<KO@GDNU!YO+Gm~RoBxG4`<woXC;;E
zWq?XOT1<u9!~}t2xUHS1<S}sd@}v9`yw|@$tXNJr9P*{>NrJuNnFEbe;35S9gd*si
zVt_=$MA%0(yp)dv2dY6v>1V3NSO|9{9@15`qIl$h(<gAW7xMBz^L6XdD|zr19bB&4
zg9x=hB_vIabo#@T>k1c%pADjBrK~xPa*~tJm+?E8t5^FodnIdN9d@4lk;>x6_BngH
z<Q+p!FYEYzf}zQ!6;*TxZpuAdj3@R*f4U09>W0;uJluHTqU^X5^lOK`@>N-LlF+~1
z6YGsFHC9n3L}-W&E@eO6aG9I=t12Xs?j}ShrQ#&(F2Us)d4CD`^~-Mx-`ufbcsLBv
zMe}dxh*p`hd0MYRu>G<Hp3!zR?&lKnJ@&JPTYur8dVc1AzOahCvXw!<(hKn^?LFuk
znZY}vA;CL}*DDtvn!@{Swf>RqW!lW12eA9y;~iJ^^HgLa2RpyTYO(*55SW2&*I%CA
z3>qOFECNw{(ZX*V?F?yUDw^ZXl>7a5Vm?wFZ3;j7$9yUxfuPQKH>g}<*@NAtS0a3g
z-<6?4%hFGQA&;eXo7`5T8ET51G~bsBc}e?^;9mFl1;6)Hiw*ef@2ymhZN3U4?E$;Q
z>Ta-20x6mD=X>Gpr3du`p&?keiBqwwP1RDDZaSTf`-D!X;MbgMPf1XTIj!^Zl|)XW
z#nz@?Q^51Ju0+~t?1tIwJIZQ1*gvl5Z{-*Vi~S2VzsV%5bB-9%K_uu;DcDHC?LQ=3
zL5S*+25RJGiTaNQ)=oZ(7@W3f)Hbjq&-v7C7k@2e?yrMeQ0j_j;O}}59OIIQ(^3|H
zsBFk{3x>v?(9FvlxO`K(I~aOx+}{oBhz}bXoNL3~@At=zFz5h00-9v?QZ*i=wNiUJ
zvwI^Z%jSI)l4ODIQWwaZ%|3=lDJ>?MPhm$nl<s#cD2He}DO;BtO?M?!q#!ByMH#MZ
zPe;Rp?&qIMo`3TWj271?cEU>jD>?raox!DU_IqIB1|7{S5<^*KH7vwuF^=iqvY`7E
zOQj)o-#@NQ*f`6EzqI(D1A!D(CcGRauzrnw2zi$*8euC;D9jdR&(Cyj#-PS;&nXCa
z0`H+z*M|EXOZSX$1>G$g-bO9@5jy#NQmGaAaf9XCqSJwP&IPThmg3@}gZld8WTm41
zoiTmfPIi$Gt;gPH6WVS3_Hv9bx~*pKv4(_VY2q=6c)D##ix<(paB2kb4a#!k<J*>+
z?#6A28%3L%xB;QelaJJ8MxKUYk4w%sHmPw}BVCqlB|aZJxYMif-qOODes;WLycNEo
zB@hE7PF@cQs#{GBU#s%12Qagj^0y{7`z3X(3h(Gn#0R;r>c`m8$Q7FK$FpS0mK{Fp
z%wV5!G8K#${A41!^<jG8BC_zL_-*u?rBZa0X~I#dM-?xzfm_JiyN%45*N3#=P3nhD
zfC&01E^cyc|DJW4&8a+l9=^{-;KpSvHk3WFp}g`@rc`j`be_~3fB+t!J*|xZ&{0x`
zL36QB)w%_i{$rRuF>}de)VG>J7k@h&`hg$4Q<T#q-G*aSm$T2Jc_g`X-HBrwaB-B+
z0MPPCModoBx+X+-KTFkOiCaQtPseY0`;s)$j^;^W=D4=37ZW_{mt(Z66QE=o!b2rM
zAPGxD9&689el0#UzdU?7DPlDd-zL#zvabY4>u_93fF3j}*wD;1l6EmrwcG9e@nYzJ
zwe0v~2C_Z@Az9H(upqr$4J-U2OILhL=T=r~NHpKeil>)uNE%j9JRGPUubNlp0ufCF
z^mFKe>LUe{PD4|AF4@(Z@BpB?j&*M0#&0n<lx;E9*spB47F|T@|EZOBlA{@Fj^Em2
z8!k(6%Hv*`a<oyIhuVORn*$jDag}4~*U$cYR?$!m+A8Ci0&OcXzNP=K+Pl9qD|fZL
zKJs|RPLI&(aH$mF{U^hiWs`jLh8%pnl4wUojGEO5RC?VD+6!mS{Bx-@mu4kQ>OQBF
z<KTb}3WsLRbP(_X1~6u!L3{qTc5rjWUx+DGJm24!AX(LdYNmnVn9-asA7Xc4F#1g}
z&GJ}P#2uh&$w`rb3bV#_^IvwJn9p`@(eVo-oM2UmZ>h~X>W^5anqcoyMvoGaE_n(5
zfIiSIn|#5>{Q2dVC*l*v^o3`Jpt`UU!;IN7OJY|D*Wq4nf%T~z9irv%$$hYNRIAM!
zyG8x7-u6UN-cuIhz~C<u%#C)hS_tIE;auGvZX(A=|BD51nvaw@(7j>V3Mz7?aiQc&
zrO2!Lab66_o^f${!4C;`0mN+kk0Bi+ph(oV_b=%XY^>0mUfG5-XNUN$_A91{TYp}E
zY#L>^sCaKpcFw!T=jO5DeK|>IAp-|%_-29YpMGj3^XTI%@O(w$4<~!o^4GGfGJvf1
zA!As^N5F3a5HBoBXUqn?W%rcY(w#P^*4La}Z(d@{X`8C*^Ba#{S0x8*B{}F1Y|f?4
z?fqT%_!<s6y&`ytx5bkJ06FP73YcVMG_tOr{J)lr7$AEfGaG4@L{oEfq&9*kOdVT}
z0F;MiAT+Koqi-{+e|f8#wyRCultS?)m*lI_`+rq%TH>H_Clu-cs!Rz{#>3f@0sJZR
z^TxGn!ZlbCQ$Og3hLYDqZ>HbCp$hQXO7h87w!&GU%7+!m%Vo+1D2{Y7D|}IS)rDHn
zoOZfdFDD63JpSvXK7al^q+DQ2g#xF<?DMPrPZ)p`{xn+=Rirm<(eh9~I`BV4Pur#A
zC!^DB;`3>&TTGP)^U;?0q{CL<R?E6VK(phfRrC0h;zHlKyyu6e32q0Fb_A9?pMcl}
ze~S?pC%A8mGIuUa?-3m%!b4MM-)K8E5u!)7g66l!E@T-YT>tJVqk~D#H9_%i2rQDr
zB=~#A?OtusXk8P-lK<J&=g*(5xLfSjE&=uXo)biF(50Az9>KXt`d)IhU42_OaHf*-
zTZudHF_Hx0fE<VP$$O`oihgE9Zykc-%LJ!Pg`b`#+LWdg7w5ywb2<d#fynYSxD0Kz
zIIfZ~0e-Ota&9qLe?`24{tNtw_A--_sZLgI`?GDa#ls)^h{xkjf8^i3@UaUc&vCN1
z4-;w;@m{;k1QsJz+0N=oKlsjSy9<!s{o*8A$L&LdrOtUME#Au(gk8nGK(7I2nLh#>
zj-WI_0pluCZ(><530g#yo@S2;Ns|hh+{5vUlO}Pnid0M=Um?L`=q8JV@pDT0S2Pw%
zo^tKY<bb}$eA!mI9fQRi(Yxb2it~<a!4v_vx$GH)LdS$z4zLP>${+KFuM>pIjX`xc
zS0yfs2=d81{nVlQ^4n&&fxxBG7wKmUzj-`z0cl&1|IiO`y&|_W1AQfLe&`jSK=^&y
zprZUK1g+Q$Cw5lAf?&^%r<%5S6K*8LUpiB*ibbEhs=ZVeaTn5tuW8(`ke0k5q)iqc
z{1Hjs-E?%;B22Z&I<u#Meto%#<Q8WMj_9Rm_Y`)d0VdeuH(oe6ejr&%hi^Z{Xq2d@
zSN7(IU533P?G~*V?;CY7G!AVZ$x4j%Z%W4}&UMY$my@PDn1r4R1Y33?^v*{4^0l3T
ztq*Q#O39tsZRy#_K?(n7oXWRGaxrv(@vrd3{w&g=9g0bcA*jmdt*smI$+H;l-$7xM
zKqIy8ubo^!#r2zj*a5{$r49<z@H<8QO3>`YsYPF0+mRpGW#WrGm4JvXTqm$0f68ee
z8JVi-V!_ndc@L)-S(a<zSM|7VVsX31rF|7YG1|27pYlVt9La~p7E*IFn^8a3A(e`z
zyoU9^&D9z~LxRMvKUIsM)YyPP7WYpDt$E)C{!JKAzy8`42=<DND?`XOq-%0hYH*n9
zjN#$*y6p@gVV|9XGRosW)qMcPR0kLW9tKWvYoEkue&5)M8Z!*OtFkH(B7{hF@5&r3
zTGt?Zi35#OCht+tQp8mVY>CnUqS>-C<Ik&M8RZl6&?(Eq;B(c!eS^WLCaM=AOm(nL
zskVg7N2N*0K$wslYB45dh)^boR#i;5ZbC1&DG`K^%TH1rDnR{^hit=cCI6l+^)7t2
zc|4FQ#G5JEULG3HobNkw&ACd~t39cTeW@V)jVn#-K29N<&g+h8F4}d@)6J_c-dO$~
z(CT9_#0+}B(24!`7TuHDD2aSny+e$vll8qmw3&eGD!kj%CXnw(@{BBO`d7KfFiw`t
zM?1@g;!mILH_q^sGPQ@?MAdN2vA=v_R|+iM-`l1uCnk(RY9a^fl;4c(sJVTHHUMFS
z$yO+dEHE%JFz=ZJPy4McQ)U^#GL0u3yu`M!F&_6PVBd7Z%MKo>q)Z?NJhE(jJDG7d
zxoZ!w`avv~7?NQwNWI6$_wDzYqx4gtu!P`*p<L8gTJ&G`oQtTD>_oT+d<gAsM6ZTL
z?;><NT>cL5fzyO)W47yu9`0X9Ydwq(DWb3d<z{i-wBrnBbBxgj(48k;Cc~pxfVP*i
zOe|DJ`&s)zM;OZeX(fgb>7+1m7U^RCPj`A{_Vw6hWr&Yxjw^yzdP+5dAmNA8C}1XY
z=nG`M0hJnpSEmud?JgrPtX=n12%QwzxetS##PzFzNiiu{yveFqs{W_gTmRB>AEWN?
zv;z`XCPa>a34m#th*Wxq^TT%6R};2%ys9_5IP*j2Nk;&nrYdp}R#z{d!yl*?T3?p~
z0jOi{sgmSKrw>|bQFl>H)KfL;Rh2aV^0c?;vH{W|&5FK(;Bxxe-vEzANeLpLOybaX
zsNT^9NIYkH1p}M>3P5Q4TfeBDi8O10IrG+6P#77HNCa%03~|-C0GTU44MlYuN<Bey
zYvscPcjVp$Y~}VlqwC@2fV?{|oMWZ=g-jR1IzoTB>taqy0C;1!pagiu$Fn_y&>91J
z#>KqHGl4e;%O(|dFQvAuCrWk=vAXHtaSJGMxhf3GVd=^AgxN4S^Xm$*g;RU4fw%Wa
zBj_iPg3y+;T2RSdh#zLDxL3C`=`HZnJ9RmBG`B0&6u#xe01ex>YVBdFKw8V{dm*M)
zo!3T+AA5zzg>r<rnil{pz&C$N@J{BO$5GqwDny@(>sHkp2wdhLovVFErgzOdYJ9Ov
zJltY<MBAuSMaLHX|NbDW!_i8wHXNWwBQ*J}jZB&sQ#9;7e1|dC#TRJ>+w)m-O~aZq
zsnPLZ@h=2}u$w7cu_T`zRZ#hxza)3P2SGM{lN0QKOTj@v@Ry$$sOhb4%B!SFV1Rin
z|L*Y$y8K&I$=?NRT64xMA%Qs3Ib;4Z>HTth>`~`)&PFmrAA!~5HhI$|q!VAFN@MA&
znNc>H>ED!arC69VYzQ4f{={Ti`_EdINy=I1e%OD117H0D6coU-z{Bna{k}D*?WRo0
zGDOm&BQP|cIsRST=l}L#T>?fV{9TGBV`-onSEvTRQVG@aH6<p%m1tFfiV7x4@&>54
zWJ9(_GiC)1`u&B4qdXS(MSc;Nh+=Y_7VByhr8119$Xuwp$^zK@EW^T?ddz{UUx+ZW
z40fUbxP>WyPz?RI-=Kw{8e44HbI+J^z=R8aBJM*^d=sWDIpj@-c&yES{MC=h^2{Cb
zvJ7O#DM9=P4C^-E7M?CC<v%fd4(PHiUvEi_JDn@^(cAI-M}1Cc<rWDy5vVN{gb2_m
z(1L-3kq03x)iYTQQT+=j?ST}<YrMcb!|f~>%#)Z`XHfeyE{^1l{u>!5oWxXspBF5X
z<Oy?9)fdIVsUgUW0n&QM3$`Z+lnW?K0^cX39CACZb{^9LtEQiLxc<U1#>;!<>14?Z
zfFmq%KX`i}m`ZR$lam1Vlm*9O>JMC^^!kg)t0s&Sw*Hx9!x(+tO%ZRAiA@l%wgVue
zUA0QYtX#&5DyG@ZvI7!a20UtUbF#H|mw5^F(?>YXH25s>BlGL3eVw~N4PFii(y5Py
zZG&Q?<H?#ulvmp~#@nKgWc`i`J3PSY!}<~KH#j)Wc9t}FII&MRk|!c7eR9-H{>vS6
zn`(kKr<t4l3=w|h09W?@vH}Y5bwH;hELFn6fGq@S?zivCFO`JTC=E7d{OUC8B;-<u
z!x!hXL;9f_J9FV|>320mI8E(w`}f@WwGjY-*G#IyP6KX93J3PT*UHlbk3|o7=sKo}
zt2J|LGma9+&NJE8;@&v5Mc1aLb0tQTX=kf14;a+n!@!K!yL8|<iC-Ngfv?jhz?z>e
zp1-{IoJbo{CwUVqew|e6Lh~A!$8P@53FB7jBw-jjJ3#~g9~0;LVoafZt&6BDV?1wl
zt0%}%B3=o<#Rgk!m@<`z>#0-{Ax{QaQ-n(jG~Tpw^I@L_0R@+u@qclg@@o|4EnB`M
z6Id((9(5nNFkTNhB}jZU>T(I-xgLWZtjtH#Jni<DrkZjft^XdZ1DMU;i812Wk}&WC
zrY<<lGyWfh?sP~aOAZfogwfEJvQO$A@PSpsVv72m&%D?Q%(P%erlle=l><Q^de=~@
zn@b>%J->ebpg}~Wn}mU+lceNqYC8WE7Tx)cX=Z6P^p|<5+1>X9uqB9{tTGd-YT>L}
zE+Uoh?<Br1e&b#GbylM~lEi_i5B&@xRX#^g^QMvUKPI<}G-U9^7bjdBCF5PHOilfc
z7a;N0CNVHXiy|G@AzYS`NGG$zCpkk@k+9>k1Fqxu2>yksCYF$Tqdd)RvHP<wWl?}B
z$_E!GqghH-jQ627T#q)RJW4}SB7nW3(of5TmeqA)-a;BI7`uA((m2keGkreV#q{AI
zIgoG5JpvATzC}bu+9yi(eG+q_AOha^p2AM#4><?+0UD=@Z=wcuf!i-izkp0@6WZ~I
zTJ*j5A?eXx0(b$BfKNrMC&S1p3Y=uV`|iNCG!EoXB;q*Xfkevu_$pt!dbR?QldLl)
zVBI~?;V7nN)OYUd>$o%6*-vPeN_wI<Lj{!P@D-`tzsQWevj;JFwI*b56*9-o6S<zb
z0HT(!!_O#=Kfre>Dd{t&K_$@NcuQP#%JZXQEa|v;qoC_fg1$eY-Mj=585#Ejk{g4c
z&l%E7tW;tBsNPIai<OxWriH4YKKh@Mu#rBez=<!LTLJ2fm&~$er5li$G7$Yvriw8z
z<IoJ$z3(DFa$z;n!Yur>`r5S3`5LNQKAG|qV&js9?fb4Ayv<`eLoL>#>cuW%^re?q
zLEgp#n;bbKTgnA5_{NDN^w=LCQ2Pe{<W~W`p)qv4e!Hs^9&;*R+@FJZm9#}LNE=$$
z&ar%=4Dy~9b-73U;mMn^@sZ1-6x)=CoyrDXp#u>pI~EnZbDrnFSZyy?dWmbiq!b<O
z9N~_CY9hT@XYV0nYyr=N=S&;EOcTBzFqK8tEjvo0#ALjAg4mP=n*DCs9@nPvH+Tjj
z;@YCS?yfuwGxyMc-YMeM<P6aPxd1JJN!?rly0xPEBI^#54*~pD^vd&bktME|dU)o-
zBNs^U62^Mt<M*2nNxm@7(mFz?ZTWT^$w~~xH4zQ11pmSOOg63`AE3;xpqc^LX22e@
zu{{0hZ${_ROITmJ-^KAH2lvy=*=^Z=URDcd8W`}I0$<Nxf3hm-Be=V!xiECBO@f-L
zo=);@e)hL+iiH(?%Vt~zD`?mJFBYJ2`V-}|dJQlfK4b1#Xj8s0U6Wld6I5)?se)5H
zQNBfHxx?NYwr{#02xT{SS%hoizS`f0_glPmMRE_LAG?!_tbs1;$Y=yKRk%lfXlzXC
zl^^I4WIs9wnyTWqMd0ozu%E`;9af(hyZe%{#4fE6k$5*3zqOi_s_vv6nK!2PYdeES
zc#L~2#6Vl<tmkBL`!yaA*i{|GG&n@kD;FZcJhsnk9NJfL{j(=H+S+mG+lMUwc%lPi
zQ*<wenly`Mgr)V}+Lma(v++Nm<oUd^FI$|=mnrC-WLsBJ@nPrJlx@%s2?oZzM=bY-
zP7O#;8E!5D9#)Let<jN|p~ay{dp|}l(N+4UU$={!YowkV42Oow!Ryrb|0@&(>xxQo
zpS0$%5mHU=y(YnNdlrp(@A~Qv1unYCnBYJet?en4I=m#lPB-BGyM0;D?G3BiTCV%B
zNNuifW44wEY~*WW*dQTAV|VcPiDZK(`3s!#K?Bmm=D<oWKxD3|0N@kATc62Hf7he%
z^4F(7MfN5S)6?#LX1wwk_jHplX9`?5Mf~B_zL_<ONuBjC#8p0w45vow2OSJ;FT#Z2
z-*DdFwKk_nu5=NV<>>w%JGGQtIkTEaOK6IgUmyI8;hi|hFEowm570JBopSS+G=lvE
zi0)gNF~W_~NkN-3ru<0VB`=eg$>US;&U-zCo+@Tjlp2w^%GMrh{sr2*+XuqgV2uZq
z2V_nhm6%WAoWouPA>{bcA?^LRK{C%BOh3I8lq@_?nL^P{Y1or{1I$~25XqVFtFU({
z=U&_2S1&4#rQHWXOOJFXs0rAa*0^Htv0keD)yf<ZUj;hcp%&+A2JsF-CXw2CK|B}H
z>w108<{Am*b<iX~KjZ-jOgd7FB2`~GLe`m)25R?SGpU##te@10#3_zD353;{?p)RV
zF0mDh_3>y?XRNbMSu)?sVtdFGc0YfS)3F7#9`yXln`Pi_U!M+cKVb1>IZQbLukH$;
zO0;iM?zmaEjFX<2hegAqL@J3m#PPqaiuxSK2K!Dc6_ZUn9|TEPake`{H8M$7dF?9_
z@W&B27nDnR1$?pYoE;XcN9dDgiiVWmQIZB#RA3$MxzhseAIn*uwERpd5aBBplv|-~
zw6)9k)miAnM^;)XABH@B59-n!<kueoAnDeVz^;89faEENv}dt4dV#m}$6ENrDqAdP
z_vsNNV9Fp|iQM>6QqVWar(HkZwIoZGih!nojFe9O*-qAW|EyFbYc5JJbnXa3&n4y}
ztT#_d)S8QHP79-PeX%Zuu2<c6?0vid5+Y&HP@PW`$O_ru&k<x8q`Q0+w(3tDvpTXn
z1d;lCYS|ICwdc`T-)_N$bfg<x<^u??CK-c)Bxiy6mY+{8Xa`W)Dbec1O@akj?Ue+t
zsit};7GB01%klAWsdDPgrRUpsDG07y-JvEyMrG$zgqB%mfqV0!QAp{=<BGN-3IcA<
zv`{3)d@23;J}q&s-G$iVwVY_yd<>2G3tmjk!LPyxBljt^-LotX*=~upfm#eP%l;fi
ztRs_jEM0VXm82Jk_SBJIdaG&?*!}$|oZ!f6IGrnkrN=d$Gh?E}lT%B((g=mLZ^e0}
z?EGEv?4h7MtwERSxOF#@6KN#2z!P_>fGvaWbY;f;6Rcr=PO3b!A5*GfaL{pr`)U|q
zDzN8g+PT4;fvYa3|KPC<GcE1ZPLi23@xu?kcj9`QE@L4O{OBS<YGPN4tmH^j;%pJ^
z)94ADlE>;0O$N|H6){2gih;G?(S~>YLIpM06u5MgckmBK31XYM+o;mV=F#V6B_$Lx
zL$?O$+e|-psToPEo-u{8HE*;0Z=g+ImE})^-%><_A8{C%wGC_E4OaMs9rXzWES?S0
ztWC1^g7Z;jG57U&h*d!g*_wlX?L^9NH<#on&dr5r1Yb_w8TlKB*!Mmj1oaoA=wphg
z970x-IdWZ1#{~&wng-2n%PN%{+%cv66K{Lf-~1`c8U6givC3HoQ1LPY?ZUIp25&57
z&ekuQSkWh1^?%zc81nYJxV^=>j2`Jh!1U!zr84*sU9R~!P9u6{W0ySL3(6K=8qbdA
zL*=NZzYgP+i!6E^O;M?)3+BS~$HDqNhCW2N&8fx{c`8d(*1Jka#3NRcU!JX5zvbqs
znzD&^hODHhJOFxX87N<wI}$wZ*!=T*U!aDOqh3cnhdcY)Z_l0htdiQYs&PyLZqlq~
z8YdSeUxiqB6@@x`sv%$LX)4<^gS&xQ+z$=Bq#Eesb9IO|=RAh$ph~glc>4u?d+^{n
zfmGw=sk~AND7Q)*$zfcN9)H>i5DS2t_X;oc2Q(@$NkE&e#xznb??l5aTt(IyU(=ML
z%MFg8ju)JA5-4zYrcs#q?Qa4Fm|7~1TKZK+F%j%sIQ48=4jk+Z5e~2<#H;qh#oL1F
zSE|L`zc;Z72G*vOaXr#xwvHipkp{H_grLev8LpG9Kj6_c^;F&MTJ%m^{eVg++${MI
z(D<|;@BqSle_7zmljE!O`4LyG@llScLv%TfGiE1M8Clf$il}*uI(tg7h|auXVBlPf
z(yrBw|1--Sex&wTYl(VwFL$P0f#-d_Vrd+1vZIB`Os;CbCd%Tc+%-NrWhOAJQYH{4
z^L$I9O*czj8z4<WVP(F&0Q0$-lQ&0CH-CNA=pPV=%p1}3>^c5QBd38N{(xmTx%Eq3
z&KfW7Jn+2tv!e6QY`e1OR$eZ|+Rlco)=!PbGSGG(#KPNCYn=qobUYeph3-?vNPOHJ
zeLO%pw?IA4sin_3S6{$j-4U7V|5@Al9ysm~0KxUrwwG?^2+Sw(O8vUZ-h{QTig8JR
zN+9wFc~KhCVy)ME_XwS=r!gO_zF-RV58u@=#&Bv?!JZfVmiM#BI{q8bZ@9M~feRJ%
zh%f$5ORG+0jq4CGF5F7rrP@5{6EbrV1nrinfOOVuP%r!_5;s{Wv7kSQ0-GUCzqIpD
zkv<1!K~_86as_}3ZBD4BUgq6JF;dUE@SsWyNf@Kh;uVS1G=57f5{e<~iP;xCRKYX#
zFvz1vblpUeu&4YMUOjd%y+HB2DDCR@p)xH-_Xi_H#FMVxQfK|R(rHos*3Kmd?=!|l
zYDw6NID?I_>Q$$qJqgtZokCm^wr#gjL#Utv>YNnKDrzviu(y5hs%7pyj_p_D2@5NM
z^5Yh?ro7-8*gdKSwGtdJ+4>w{d%1k1sxj3yrRtTK5tY9~-8qEy3hmLNQY{nNwY9OY
z!u}J(D2UB}N=-k90Oea0bWsxE)Mf2HsM_}n2F1@lc`24#HV4CsDRexteT)!K?=&)U
z{h5ROQ8=-hF%@H^P4VK3gTYe@bra})oMu|7>vT$_$Q~hTP`;2y0#(*&^YuD}$DGF8
z5vI?1En7)<v~1dk{=`(=^By+jtujCc+&IXYg-8_=Ga@Os3{D-=3ew~^W2xiy6D-IJ
z{$+dQywHi*I5ByDJgO_+^?M`edBPW&H$nhd-9}tx?XfDG@5vT5z<}s97ifQ%9yS<o
zQ+CL8E_E~ZT~HX6GxWZYd$u;l{^VP{=<(!zob9xR*<<AU-Du5!oZzmUck=%nG|%LV
zS)#bWW+vsvcf)*{+YjAa<BE+#8;P!X6YL`giJ&xFq6v2glW&J>?zI;^t;SyfjMOql
z_Cm$>WC@+t`A*(AGy`S?1jv3KJWGrtEbE~C`eCcb%<Ok=g+{}33z7A*18){{St)K?
zD**~^4*fq{6Kt}!Dsi~VZ&O00_F`9mEO039L8#hJS_>LTs?zYNq~(j|c`FI@>DF$B
z)|RcMUlg<%ue_&_KF~qj`!{V!T>crTe*T3;%iRp=zgGt<J-fd874%j`S;^s=b)(#}
zxEL0#<f!z~(A5FlV`nh+-JC7<My_|4@$4Ac8}kU^*nLx0cw4=T{G%k7&G+ttO9JWG
zal~ljY#Ox;L{t5&E$kWofyR40Olk^Z0fQ7Q^55yi4K>S`m`~uKHyL)}fp>)tbG^>V
z>b@)=lpYQ&J0Q^D$n8xK3!i4kN6%0jHyCawh^=e>h=ckyaf)RMhDwm)<ryR|Vo5WX
zKJR@ln*Me5&ysl!rG<FtYp3P@+Ckp>gj$2hc2XlFhf`gc_#1bC19L(cHw0&^gL52y
z^LFH3`|zKNUu5EhITH^$@jWtIMARG`dqTd3ELM4cZa&*t3F0>%%JdumFDTjz!Il7&
z+DIikIVe47JK-gJb>PmjlzV20tE*Yh?D7-mpzS^ZZFiDdfvi2FE_*``9Y6IJ51iON
zmSPAufyp+J4X@6H&Kv^)vZlR#Q>D*gfeSs1|Gqt-l#o(ARgmzQgeKWB<SF6enZ%K_
zlmUYO!`m7pIF+sOvOxf(%0>u*y#1)}h$SsHn3}M;$C^6&&wuFoqooTbRDkUJB^_zi
zw!)>xrxjQ7-%~$rHcozzENuB4$$WCoA1kv~>3#hhJE&|_x=Hr~{sE7Nay_ny)!eG~
zw)T;*VlRWryo3qF<I8i@a$aiUl>1%j7>6g6sXRWwug<z=B6C>OZDRGoyuG;0Gn%MJ
zw|nAP-$=W?^O;#_f;Ijg9h8-!75t$~pH_z$;a?uoBHgKNanr~^JMLkxY^m!euYEtF
ziEb6YUH$`hcXBs#drI9lO?Z&TicXKVC+S(k3FX*CMBSzJzpvnp;^(Kb8&#Y;vmY;$
zI2pEPwseZe2eL9F2P4b2-Nu8nmt+1zqzXA9DO_V0o6BjUot}8^OkEAt`!VR6b_A?_
zTT;A83p4wP)JV%3<9p)@XFtxuEV^yc@qH|`{aUG-e2PoASFxepH7qCWmN$)4qBg7M
zxcYdmh!<)WS0)w+`Vdfx4(gX4p{qM=UiT3g8Rx?oetV?Hmt)rT0;3j1QGXa%ndpzM
zK|ccq^Xz&MM3;IUD2-|>{<ujWIJj|lF8+Fx)W8*}VUl|gq<)5pNz2bNlh%-re74dG
z3{q{@Jz=HV8ukL9JQKPR%{Gk7vxk;s;x0tQ@PgFdmrNyZTzZtF#X5iVMRcW#En4%s
zD~t&3V9qi>YU_|VEgbzk(b-m83lLmu@#y$lwQ`o?v|2UR_}(3bMx~*~U5FM#|BJH?
zwa~WeXS|EzoG|TCt;9`w>KTu<GX|J~F%`rtUv47)7d1f>Z^CwbQ5J<6<A~-+2FUeR
z>xQ}`a{5WG%2StUvRReE@ITfP@7?}+)EZ{#J{tAiRcNpnQdRt@(LrWOQq?A;i?A^_
z#q>jmy9#$7M3<@M3utv|<fD0WBEKj+*IsJl)#Ri^?amQ}JWVz?*H7Dy5;%}ecFve#
z5PO%(kzP6>$g6w7=nF`v?2jybn96~h`)J1zw?wdX(TdVe-sDrgc{=aBWB|kazkUH6
z^vb*B{RHFJWd!4>U_AEH>Q;3O<-h5NPFcRNZ8&eHp1(Edg;nx1G5*D~k-Wi+_f~!4
z@ktGQdE5~CM3vnEgXVm!t*h+Nuc~z{9DVRa8>3PRp0D+DlKUMj`xJz6p-V%xa{M#=
z&EJL-=ahsMtZe)RAAcY!<ccPH#HmGbd*{NmlZNX@w+_bxh^Y%P0$>PbZJ5^2(Q!4Q
zr{0!B<0IxA`9}?p6I95lbl(E^R5R6RLzT<t<>$*Lh_(9-MQ+ja-_Q*c`&|Ossy$z+
z>hGf^Hhk1U=Zx=zSdyK=ikI&fha4sJBqU&7_9kx9mFid^0}QwRxZjtSM|WRTim|Zl
zRHAAh6G=LR!>n-{#5s>*>E`{fiKymfUM&?Fb=n1@UkJGYB5z5rb`oPf@26Wwy`Cc%
zdHkR=QjdK>1S;!lKihmVa1i!B!oUJbg_ZE^sAI{k<EcSu<R8$r!)21TWZg%giXXF*
zzj%2KBvUIk_%+`u9O`5TESBA~kRbEqt+XSD12;#EPQXEpX+uGML^$TDbWLH;Gy^5&
z9S`ChRSo?2co86ag!qew?%_akoiYoUnZloZ@YC#$U;wS*nE36ncAjn_76<l|1-!2f
zN)l4FYcghu!PPEZ?hS4m_5Fz2?cP5F*hKkK0)D+-%D~cuXJRs8V{gj<R!b=rNG7o&
zhD*$3o;qU`M>eH5s+GT@kl|hyN8K3oBd@>P68^>?%u1&u4}`YT&f*Y-1E(pp`l11{
zd{p=aaTdTPB6|RzjR3G}VA`@OFeN#ViwS%Ad&1iC-8nsL?M`RW)-psj9s{Bt`Sd)M
z+yvZL@plZvlxaj1EO^haBAiR1^y4)t>$l}0b+LLBv;50Xf8Ogl4cpeWnEj~~8#(p8
zvMGkPb9Y@9O~L%YUuJ!3n*n?83nslx*B5?YMq}G;!ot%XwbCA~i&%jQMGZ*gxi7`K
zrUT@((gIl?{);P=Sz^VZJ3e72k(Na3Yh+4V8!%{~%7q8t0fXylw2bX)Mr7`hHlo6?
z0=oEOYVwD%h^GK}J?=l1T$yGo7X{MuRr|o(-xoXQ;xGzolez0hf>!c*#4a?#rP#!U
z@{7Tvp#wPa?UTGu&0E<x;R|2By*VxYsV%l*V76t>({kt_)B)V=(=eLxhQ4#nD0la&
zD$a{_VY50Q$s3TKFaRBa25b-@y%#n9%8E|fHMbE)ztX4_Q*?xsi~Fbc5LN!Amh~}%
zX6be|z=bh4ES7`~6SHI)VKvAqS0pGl5P5IU!<X&6JM!Bi`B;sJ7w5bMPqK9aw8fl$
zZ2T^AE;^gWdg*wD{?~<%HQDYJ^8+Q3uVu}ntpsD?o4E&9r0ZQaPcyMK(%cheARRH2
zhlpn1MzG9J$}~+*g_*5~r7}{-+k3Jq;m*;d%1YKOBmMM_RO9$DS8yC=17h>yC!8UW
znrnM=a`get9~zPVmv5BGFFSwAD^S+^(815#QnF9v7yPdGaPV9JA@RE?Hsb4OYLO77
zSc<$Y0xGOk^*~j5oV=}88bypK3<_YFt^{eE^z6eA?k__%U-Y}>9XKe1-xEeEv+Gtd
z(PSxznm;aaH=Nb%c0gr;=)D^zs?)i;OZ2BLLmi!O+jdL|?&U*n%a+?}b&-0-j_?6C
zPl4YK%P@vT0K~7`6eI?J85Ir2mKW??vv~FxWJ-Xzu%00xO+Op`F`Y6@j=Egh=m9+P
z(`>b)qLS9PTj%|{0Oq7fhDwR3)__uDA(p{@2^t!i)A0MVCcKFAPKP<lD2pODXeQEe
z|LC2p+Kf1qzZ?nM9terhtLs_+0A#fR8;UL?-i8k(d`(S{J0iWDm<e}94F$ERI87XW
z41GN7CF89RDq>x~zR5Z&KM0m@l!Obs>opj<A}|bl5}(#vJ*Fiej-7CrFpaDtr*o2!
zd>kz?<1-Me(I#;%+*{D<looi;@`eZd2n5Gjk7YUh%f!Bo$&2BbNK4baz`nshAg;<4
zf7mHW_F~9R`{Dx&9j5*OIkY4)U_RAG-xZ030i(b-*F<G(^X+rCiqR6PL|k9tTLbQ)
zevAuCku}rYCnu(+&ncsZNQVI*7wY{O3bV_Ie$C-yFW5DTg3MK{c-k>a*oYmVmhEaV
zExo{#k47i+o(fc*oYwpwp58Jb%I|p}UPM3|>F!v%yCjxIx=XsdQzWIkySqzTNr|Py
z1rY)1PHCRo&-eNL-|eftPt2J!XXcvgVwyHf4&faIbrC-KRv1NFm?>`;u<7O<VFN$|
z)*oK3P<Ym)j^V%lTM}v-Wt!>}J3#jQbDKg{SO{cN2sea?2SQj7M$Td-M^(<+_Z=yq
ziw)D>sdeII^n+)B98&@DcYZN3&Y!Z_@Ouc7U)A#y>p7DlWMVutFkVcYzFlkg7Gu27
zKfVS5WgR0nv}oZ$GpSHjegkEuqVi;>d_G~|3-54PcUsj|%_Rt-J~Ed9-mdHJe(lTV
z0@zv@&frgD#k5AZ@o?`j-x5-^WxClJoaeE@Y=oS<2r=sRu;UN^G`laNMNNYx$`A3G
zYa&d+9_RcfE-XkmJ?ur_%?4D_$#l4df%?EZ=5sf!Q?;VBV&cod>1~{ANsqFH?fL8C
z484v*2IOdi&G6rJ5qO+Q{js~4!TB;tEYRKLMdG^Gc^wnV$VRwha<h|olRvX@TH!xI
znfhRZj_16}>3B^aqRYn$xQN1hd8+_+Am*GrfD*nC3eK<e$nt^NxRB5LnBc8@KY^<e
zdYVxBX&$E&7K`m(1rmjPe~B{P++>eZyN!Mx+?)cbzDEg59aXQ_)fk0zC6*i@56VTG
z>Es2^N%^q}pLX43%XS5*>-~PyE0&m$uRSNPtg&r2%c}o=I^F>{tI#&NeoTly%@YBr
zmS%PdRH_(lw3#~NvG<gPjSQ>~=TIIrV7HINjtm<5BpK~VW3xOH)OC%U;NjKp(Z9*5
zXL*jPm${^830V5@qkwMGm|&&ptUG-8B}R9I2vq&HPEp$)C%`XkR@0acr`xHu#nB-A
zX9z{D(OpyN2mNz+ksro|OaW>XQaa!qJXW#CFo22kSJ`+`(OBwxA`jF@7C0ew0RgO!
z{h%3naPqaF<Umblx6>CMy=oGQs}M;s9hRLMK^_{UEOPs6H9E*!JcuG;pJjLZF)V(4
zc#CA8y0Ta<o2jZ=$wVOZBn0Q547&{*Y*(u}jD11qbwYs)17ou11_$f3yL;!IT^IX3
z;DQ2bA{o-Oq>_COW5T`}E_;(EMDmOtW>dxYEGp}gYic3mjCBEa0sIwD%qD7J{fC9V
zXHE!Lb+RYaZdOq@J!{%p7f&Ocj4E@<&+KVWCdo31Z&0<;X-BAU%MYXfxQ9#si)wY{
z_hd;^CG4gT9_#?S7a%b(qQRIf7-IaeIf^@iJ=V%nQ%iy%kvI)qZ3if{%W)^Gb(?D5
z_YgGF+YyT|Uq1ymXC11CC-aMYk+J79#x<-lq5?foSq=13mhTXIU;pE>2NBEv^+{8@
zKCDcx>dIGNIEl3w+MY;-J_KorGVP>ME~hZ3@xnW&6<t*6&BpW`HW7p=E}rGN<Poo!
z!r2?4U@RwY9Jg99+L=urn#-Aq0zwP_{*>me3|D8p9H2jav?2#wcP)wB(CYhuFRw}@
zvsjBYmsmt_)n0XZG~;V6f=ll<#(6Z$(S#|GHeT_5qG%J`S&OSdaaNPvaw*HK%;Svd
zBDkcaZ+0<KxsN=rY6MO-@QK<F2IoINi>e6wj%8{+RHQvG#+TwumNJ(bNmTcybq^5G
zD=HWXWw2~^If?O~`r7}!qeNiL96THL`s}8eTCI)4CQ2jyf{LTRPauZHc7!^xiOmCQ
z`%jM`xQuOD<*GYo8we8}8HBgEIhjeUuQzH_V~vNGqr7~XYRnl2PaH!`=-(){tVj~&
ztxS&vNyva>8it2FH$HARn1T+08W}Li46usjw)D<rV){hn_Nyi^9m-}U4XvK?Kv}UT
zU<(gsvGs?4+)=gg#~qUX-nqE?Va^QxCk*hrcu`$X@Dn=;z{_!u4codZp8ivu$~7#}
z4RCODsJDfg(n6|M3CvJJB#TzkN*K3yEIvv|6rmL^15E57(AQ$RDi(3)JTbnUqh%Wn
z9znrE$lsXcZ1V2$zYZ%M&DPR8^gX^SKkTTKv3Q^ySE)bXm3MuLScFftmi=Z?9|Cmu
zF5!T31~3IIm~FmZ^7wlZ*L<&?n3G4rp#I{C)R}wPhYr#&(c$Mx$`~yiIcdM_^yCyD
zMly3(Xy1s=BK4?#$FIpzlZoEovfTTO33~faG6M9${O0I$uc}{D>iD=IWI1(#+1S^7
zpM2aZnsbN^YDHi&A+<s}G3yl;6<vY(Fk)pwX0cXTE~!V^hya@|nnnVp0(pG^hv}I*
z-k!Cqz+Rs@{yANV)Mt@Z@gx-&>WO#()2ran5c_$q4tMET<&w@PwyeZuXwEYu(?wHy
z_sJRGO}j~T`@Eh|iMcN(Ee!6r`hRm2tpgZN9?C;Kx(B-7gy1BQ$9R=&#4GNUvI=JV
zA_#gX&o13jL7OKfsYo<MDLG4C>k&<)!hJ>gZ>#)tl&fk#4t~GT(YqUH!6awu-NRj@
zbD!(tEd}7C)9hd3HMY;=2`8C8g^E#t8d3fe&miahV?~@ijz6W+lICGAhZ^#g#Ue)g
zlNLd9NTn+Moo+bcKNg#RbA_aidu^*^7?)x#{?KffUJm0~Wx_`x>OW|TY5!`)i^(ht
z{}q6e0ITaa)tJ&*>mtwOzvFM6L9tY+**+vBm0f}U<w>V8{W6d}!@z~CdwdHX-vT#1
zZ5ERPR2}lqN@t{of*sqNb86Gen}h#Gnsi!e+RNc&)yPi@J+!4qv{G`!__ick*RBwm
zwG&QOeq#6_Lj=-9{ddp{8RS0A>^4&|2>;1tT7!jXrjH3_<<?atmq%yQ+eWvpXx8vb
zWrM5sn`#0QmTPavZH*<EX1vO)sGzP#0Z!i<oIY`FqB=+*UtptHf>cTVTN}2DTimhN
zYXoQ?O=o<IJYMXoVtJU-woy(b(|0S2w`WJ1<0;>y&S+{aXk~d-W7<BIJQ-jZ4iEU0
z(?`PSYV?s5rLvp8DW6&$ZutilB{m(KT|2Aeh6*nJ<p2<Ob^y5+Fy}U&gzL`Yoy)>P
zq{Z@PW)n|EDRsSX9=khrbl!*(SmCW`TX8$UJnV}V(s;D=S*K<y>=X{tnc11wq+m*%
z5kKf)N1L+0saU;3+PkEPUudDZdMq=>Y0i?S4#wxo$mRrag+PV_*cKy(56C8R-65Oo
z5qZ}YT<RK3C40Qw)^)xBwxRW0f!Lgh;t;Iyz9dmQXfk?>i4NkP_i6G-laoL1Xr7q|
zBT6#6BB3jExsmCNx8xE=S?R?>4Qa|HwZLT|K?fcFZwE!gfQJ^<cC?$Gf@<hvvZj}p
z!^*+`<pS=197Q`DQ>BUCUHjLlShgQSCzm*0C5E4mGzU(!UzRtz{zzn7m}Z*vDsj`c
zVrp>_;~wUUW~=E+-CNd1wN-Z==byeE*+D6QFL<ABa@K2Ck<#RHwAph|LLvsLrT9-_
zh98Sau~Q^DDg)mMoQ5tus>m(_IG}z>)*7{{N!O=+!J5ANB+555@cO(}4r5;w?z?PC
z8frvJ(VgVxo`*Y<Vi(2gcRRxaMyk5-#6IFs>8ggj8ex0&E);;00Z3^+#@{9QDfN`K
zXG|5tRg;&YS%MRn2eHgjq1k?>q~>dRR3(Wr!XzUPir)7tXVHfm4}I47Zt0fI`WBpC
zZ$ZTWDd`kyFm6b54H9S@vH_U_#9f>HVf@l&$~RV4G4UGK6}O*)c#9hN(;&(4EAcga
zhL1ykTDd*Q3~pffG2z8os3FAI_!QlhxAotF`|W?$e`(VL-&a{DMpS)W6{|F@mu_Uu
zq*#&ap&oU!oHdSX#HM0t{eCyn`HSQJLz7ZV;`I};n1M>69Dd;`HHZh94WM)Yd7ypb
z9K_+%->lSPOiQ|W8#~12x6RC(!NZXTozfdNLwDpJCyL;isgQX%RI$wHx6#-i)?l}I
zxkjB%qxdawGw`VN#mWP{ilyc@MW|~7{vA${**^n^11HlNavr0&dCtE3kWq>eZK1}r
zMF#L|0Uma(_3yY$S+k&DLHWc%an;=SLSw(Crm7?Nf<S#mmOl4o&q@VtjYv$umL(+C
zAs`!}{|=@u4x{$DS4;@*0v3kbg<OGf=VMSb8+@yy(p=x^)KmdFBA=s)n^Iks1C>2N
zoscZYcru5GPg8tHzShE?;%c*X<&|0LcyZvgyE3=6L7V4U$DsBtA2kuE_4R*7q-12%
zA-CO-J@|>y87tY~eZclQFZ7gxk1zf&tGG<6sM>d2ZtLs57_IW%zK0LWRk2qUi_bjn
zqU+5zm(lGyfjT2a61@wgA4RvAN;I{JYqInj6{=zpz6}I8nj|q_Xy2B9{uBe60V)Q-
zx;N1v)lR>~F%}&L#2L|Ps;Uvo1Sjx!rY)zGE%JT;<mRj1%f`}CLH{~be3b&wZx<TV
zu?|TOk^C?SdjTUpel6ZZc<rO0VsS233UZL$Mwh9ayU4ih$pKZIon>~Hz*=Bl%UXJA
zbN~I2d6~}QoO_aQtfiKCWTypa2B2vKM!;EoC%N+0qd#Aco|y^41)0?jaBTXG%aE%s
zM*_<wC6q^VQc7>mvbHo5o)|d5aV!(Gy$<8iD`g#H190Sg01P|dpYsgu#unN9T*M-;
z%3)NCL|f5v5p@8ALXYtc2VnRs|I-9}D)x$Dl+`?BTCA+DCz03Ft`^CcT!~=4qA#}2
zQo;(Dy>ZY;EZvsnV<`<!;~BknTxDO$r+rhUsi6*AGx5z|{M@&VAgG%dNRfmFTKS)L
zS6&!uujrpHCf@AyLOJ@n)T(N{*Kh?mJ9*++;@5_3#3zJt{)TS9@1?S-W5&Z1@ofPe
zpliwW#p3TdY>4r}O~6K2{kIH`I5J#nRie0Wisd$<)QOH8M;Ot)OP}U)Tj|4jmS!|%
z?369zzt>m{drIqrf)W3V&}?{_;>zq!gDC)bJ->RF6-QAg{3*B;@BI%bs_o(Njq9DN
zFVn+M>w<c*w9Z#0a#rJ&$#Cyt|8pj-7<8QD=JG0)B{<!*V}8_Sj6(K{n&1hqU9Rx3
zqH2h6L5l*Fqr>jm6!WMfH+!@qfqgw!X`Of)M6n4{tzwyvWsypmP#y!q68~@fb?>&b
zT4`uSn&LIfz}58?xLTISsvO55W8MHUfL5oCV0Dtv*~LV%X-DAlxKMa_wxqtB%a)%y
zZ11K|NIi?avG!>94=4)_v<XNd09R@!ZUMVO`NK7uXl>h?nMP-R2Dhjc7iUt;$y+)t
zWwd#14Y^ArPXFids|ZKM_$vA|HQH5<UnYJ{<C^J7PqiU(Knd`_=yQgpi=os=?Naaf
zwK6}ND3t=)rBW|#X`V<xrsPVr`<yh){5gP=Mz%&@Hvi!ybg{IVH3KuvxVCu}X>ptj
zMUn_KME2jgEJ0v-TaQz>@M~2H3-BuFG*oZm96ElO;m)Dxc|D%HJEV<Jm1)(LIHVW&
zSy{yV6z{2$+`_7E2LyCf$npVGUjsN$fti^Cx0G*M?TJ^6{4Y3@&l5tU5%q+AAF*Di
zAM3T73+He7O<?-(?BnFL$Cf`NZ+lx^YSSBN@-n{h2^~%A5^e_P_-Ze;`EJwz|K8;e
zSi8dMqwu<598mNGSS0>^0j{zq%`GgIVF~7xB+C^#jEw*>O0g{ooW^t*oo!Rx=~2!V
zc*yF1a5MRMpymD3<JvPr*89G%fSVQH3tbIQPlHZbOZQV#)dvfuOHx2@p2og88yb}i
zwpUb<OAq5&VegHmhK2qu_&2Bj)Z9K8RSL+^HJ2Kw<S8a;LFKBeM})#?Q6kFAQ<wt=
zvciAbIa>;|IYK7L$P{K{o}{*&-_r@4?w{smSX2!N*_J&4uKe_Q{1VUuJp9i(7vwQ~
zx*>xEVJkHjxFa4kcqv{nj@ATglMX@9;abMDz>^jg0MYC853>sTN*3tncKY1Ji<y%(
zzV>mtrJ=`iI{vx!Wck->D0No;%yrm;;4%IoO_V1eJ0pJX=Fps=Z9FAFhZ_1e7Bn;b
zU)cCVHt3KUcQQg&<Md^FdFI$I@(Eh7?!VqqP?Cq#fBkd)@fT*Z{u`y4xUg~tNK@!4
zYrV}@`9_X&=g!f7)rGKzyrV;D17SN_lf&}mfgVpG?i_|FKgB{Hh8`EyHYz#Lj`#ZC
zL76!OC(n)y*!_t7_`u8_2&?DsyI!FiRV_RGD}I$$5wFy|0w^peDJ`d*+jjiW)iLrH
zbeuRPfKV0HAm^QS*INs+Lgh$g7IfCRq`w`lpNw&Uf`1&g$9Ms*v~8vP<B{^Zw{oir
z><IPciV$x`p#cxxN_pqyjGtZJQv79$y=F%=COKE>8WST9$PgQ7=%rccDG)Q+r-9R&
z8f|WhYp~HklsEq^31QlI038+1+lu-4QyiK%jVZ9XV6Gv4**7if>cN@jNGku-@VEc@
zpx1s<CdHC2jhvK_5IN_!w<&E+py9^7m?0~Y1|iUvRum0uS)v30=%Q$rfb{8aa8B=^
zr8SD@;|A5)*zmHJgy)-nlV0z6ol{|Lp@<7zO=e;Kz$RW1NZZBVlIrYo2D~!Q#iAvH
z%<PAb{@bIo^4TINN%87!Dm)+&y&peoQ=kqDWG8(16~z4SBmXYxJwdgru9tl43IcB3
zzN_kQK{N%d_%Up#^UFFF32FTsTe1uvkKhZ8o-u%?*06`BQ~&d+^QJFt20Y1T)Qq?n
zpRyV%o<{6mO&5rH#`CQZ&^GN;)paGqfS7Xnavbl}kM95Nr$M}!sGeAOEmiRw@7o`D
z!X}>A-5<eh*F@`>axaBH#3|9acLY9}U-~R%CywaHtHYF$9!dfMynHU+-~O#dz~rU=
znfyD<yG?QN`|yu`vAm<OOH_)NNm28XC){b>2UT)z$I;f@;;qj70y(xR1|8f_e14oL
zw&6-k-kOk-x}+GxjL25)XrS)%RxBhH;O)Y3m^Uz?`<|(Y2_pMX3epc@aeQ0@maa_F
z9`9JV3e>1fCjVSiOy~C>FXaFiZrHEEs<BIt9~3W()_dtEcSGVo-Jd=k=kQ&%q;oqi
zw>oee3bAy_!Z`SNz2BR6y1d&OPL)K4djAaB;?hpEh#EI!O0bS&DQVLMqBp5&f0Fe_
zCi&AH+aS;kP+J6ClFs9G!8*aQYTx~X_;cMhV~yD3li{dS*U4Ar{uc&4UH*qTesbsY
z;E@o^U1edN){LJ8T?ay4=nl-nqP*hn5ti0G=_c57m9-;=(`}?(_PfSy@`GeK2U;Cy
zY3eY33P!n(Uk-@HA3C!mE=fUqgg#$ifr9g0UOEb5{DKk@%bT(NBE=tYoFBIOAJLB2
zudkO7xF@_?%G20ao)6HE5VSP-oh@6{)Fzv`=683j8N40Gk^Ag{=BnnoB*h3}FKIbu
z70Y!WFvGfEiclhx{#99LR}o=XF%$OxGdW~;4VX=&f&sdUWfDn)@K^m96iau(79N)-
z;^J~!gArJ|>!P0=a;>y3=cVX+QMN%jI5p1d=yRfW{&?T>2N}QpxP!AzO7(jd)N=FH
zAfc)Qq4z#O58s&p0`Po#|2Mpq=Fc=<F+mQHHpmn0e`nBAk+qlv{GM?Ff1KrJ9LmMC
zqSteh!9khWEgj}4HA)^oDZnvtD-q*s{X@8X+3cIs^lq61w)Oh|S6wYsL}1xK1tOwB
zs-WHSmfCJraE)*pD+5tPtEX^DTx9Fxz}3~`kws$O5`;USs;*~sG&B-Fj0BU|KvqX2
zxmm9W3|Q{F$$z<)cO7qErC$M6HMwt_>Z6kM+~tS~EjuehOI^d=hSTi&Z1xyqatf=-
z4y#_%o~WoTsPnsJokU}X92Ua#RB`Gs%PpB!0ATiUSZj<dhl%v`NBx#xbnKWF2+QO@
zuPF-VRE=WUMmE!<K{ItS7P;V=VD)<boW0V3)EkLJA=qO%ACaS7pt%%M6kAN|1C6$t
z^mMGzEj6Hz+8k;6utgYHsWfYtSwLWIZNY60c0{$s9aE?}x<lsnzQe0pGhptIqC^RU
z0}TOWLkw!tdg-)!iF?R07O!yjUOe!dZyluAA^!Okw{YjZUn|JO&qSWFUv@dyF}(>v
z@4NwkMB4Y{6BO(90a%M9+cfb;!OQU>#qF^;Q}2%-?GL<3bZR;l)vual+)1M?5S+^<
z8TKMLtQwn?MM|^6!^06=t@Hu97<YaAIdHOCC(BBO=8fTfb6?;ppu?zKVn>9ZgBT3p
zt78zNb*fpyI~BF*vWf{XKNQnOJ!-#&$fpiR7$3L?PG5?Sx|8*7t>zyh)JshdKE9tu
zH(a)VOc4dW<NgkJ=spzIaS>XI^?LJ<pmsPQhx_t$M9_DCU|@X3(0};}5A$}b|6XYU
zy+2IBTKuu4|6*ym|G@g?a#eTYn$DvOTc^=s2}|O`YPu!f-Ya9?NK~1Sc6GTN=wwqT
zQC*^PJ>DGn9FNNvqJdYpBX0uSQR+;>{Ep)Gv42h4+@T$FT7ss(!;nCm7zrAzkRnAL
z9;2lNaIidX7jD``#>~Nlj~n3~k6xWi?7n`v<GH~oUtaNA&s)Hod(IAc#dMkMcj1+x
zYYz`DyECW+-e11F7xw;m_{sU_%M7!L+h8($rFJ`Q8U&m(TeE^asR<!I;4aNg<YjHg
z2>LCY`n`myC+7ch0S??}hm6*Ebm<f`Yu}V(&-IMe`zWWUNZeaws8Te40z`xeEw9WG
zx)2%VimMrM=c@1CrH&g1PMFO@6f6@2%tP5%T6PTfvvU<xd(pPJK%a$y*4(1`*U_Rv
zjwow(GGFHJLG9#-FRg8JF`A~_WaGAc{hqZU=B9GApw^hTH#e$JOcB_IKEKHnwf)9P
zNXX>rusdHlSM^(Np+KMBtFTQetv1^Zo<3cCToY>FDCqAYTm<H|lnxgcO^aTRu3#gW
z(tr!K`{UntJY#?#x=2uAjNbc+u_=VqXMoQ6kPfF+Z<TKvNVsNL<HvRq(G)0G1L>e$
zzsc)??K;#F5<QcCb$}!(a~$#CRTLRrBE^4N^GKvl$jt-cw~&`+3LW{5Ke^v|ls-$P
zHO$DvLmpI<z5P4Ax3*iZICT!YHSMIxOuyY`=SVU>IXl6R7{o)i-554nW8tQHy?0{C
zuw6l~WAmJ(wD<90wEqtJKrZBS-8bP~$6>u+*Wj;(`xTr9Ap#f(J$8|T9uj_C-0ML8
zw$kOO9qcLYAuB@(>I|D!5bygA)uJYw>Vg-^$6i-^0W#O!eLHk1t$MMMJe)Z?J3BZn
zErCua&1;C$Ng~Ncw@kF@Z_HPLm>xXad;fJ<^Tx%?=5~phIlwU5ETV`oo5j?ah-V>b
z%X)vQxi?UlpEFqIKNx+ozQXEPM4NTD<65onD^?>+UkI<>fa2&cFm9=}#)kCW!*m_P
zy6x7TR<!*cHNgf!yX#M5&UHSIS(lecFadkKXzC|<8e5z4ZQXXojuWQNG50*P*+0kl
z_PghD_?hZh3u1>b6$aLokq+HS(Xa6g1JOijM|<-|*mLRp7>tWBa9W^qz4KL?PQxt~
zt=f#Ho)%rTm7Ez3gO!v@lOw+dI3BGu{inES{|}g!M$^eF9t5Ch7(rjt8b@1_xMKk@
zck}Eo-H;-J8ZlCb=Gaby*%u5~Oq*+M{N}Kwmq?@<EY*}qh#hf#m4uaS+NB<5?Ttp+
z>gSwXmFvG>sH>JzjC5VT|1_4+6t__^!9Uv}&ERa+yeUav<;%>65p{EkaN4aghTcJ8
zc!6OluZpLqCf$|BnSr(x3B($s^u<qfFb6*;*Q9$7u5X}hfZdu{rG%TR^CRsy66>sb
zUY+lg_yAo$F=#;!Bdm20)w0$rx|+yOUE4<oSrI#H)xh1X>H{tv&-CAz_>Ae@W?1d9
zfblVzw_}nDZOhP#`T4>7roI?<!q&KE(>`YF=8K~qF;V+WSm_QxvZ-MCa$ehfe$5_j
zT>3^qUP+r4g6~TcurOLEvA5~g>h5RfCC@Q|KWSs_%ZXkHbW|30-nxwT%|Zi9d{=Xs
zEv%#U&^%rT^Hyonxl0e$JUJMAsIDfFQAlPJ`-Utjr2*M}6B6vb$m<&!{|(ntGc7r5
z>ptLe!13C0<`ub3mBLOpD~m*DpzTVu1Bo+fbE4MH4muE;IY|CZV3Av04?x8mx}`r4
zw`}~t!y_eRIwM0At6=S+_%Qoa<{Ar#u<y0Karg%UgKi?BEuW6lX@$14I!G-ssiHgf
zWx5Blq#=S7iTV=Vr0e4E(<yDTO;wX1hI~&nM=wpBv(XhjtT}wSV*dGUIj8<WQlBOJ
zTba24o_ukfk<FJwzaW8WW|zPMzG+mEJ{;VzLdpjx;rwB+lYGGSdkIpKbUsX^x%^_V
z&?Tw?;sXQ$$G;Fy260}^_2{beE>M{Lb<5%?XMR?;a9~h;xcjt%1jauZAE;SpdXWtp
z8)W(-P(P&IQG&zTYI=7E<$V$ysIjpF$+_dZ9c1?`J86MeO1F$zXwBr=IEOfQC4U@j
zhlh$V!KCTl$f9<=zsV1^mUwR^IJT@;s4jg8Ul5Wv>MUB_H~S(W^Y``RJ&p68uBC=7
z)gwcM7F*Iw0uqM=E^QEli9*Bx;TnY_bLs#e8fUQfzTzGLZ{+@11h6m&$aIM-ShD1f
ze*-N6?dW<+6;mH%JZUF9$%3HCou5u`i?>mnzOtya2Ewj0_nFC2Nmb4RzU@wb`!w--
z-P)M)cH^>y<@KYlG8%1A-@sqUuNo#*X&sACY@NvAbe7YJ2uAqW8+8j8a8y@%=nVHZ
z69zk-kEG!|h#=7@@<8?acR8B=72-k}%h##pBzQ7yYE<7bGq_fD+vD|6)5*GbqL<n%
zVtwk(@h{u8rWe^%-ZZ-<W)Ng>rx2#qRWqqT)Er&K(QH#Y6@(=PXu0k;KK!BbK+#HL
z3{;-pbyzKvBtmFG*&?i}*7n20=MVK9U{`I)wD+VgcSo3TM~P4LhMz~@iLnC!OYLTU
zZTR0Z#1=a}+y>dLP%`?`y%t=o!@pE2N=RZPD<rChhz*lzKDCa3Tbgzh?M5uKH*QZn
zf}R7M$N@?gKP0*)+5`)w+TQsB+OdcvO)c{_{<2Zsmc2hQ+P~ZoL*8wmDw!w|V~V-m
z*5w!v6CcC(KgpH_3ZKzib0Zs-DLY-f8jUy4vijwDupfMi!cz0vw`yt!JV1BNY6`=U
zA`X4uYWa`*IqOybT+@oc2)Bm28eJSUY>L%UcLb{oEkv&ccOswiDY!Tz&s%rNibzq{
zrBt4K|CZCQoyqT&V~h6H+@^Cl?Q3}bnTEMK@j|~RV!941(P5_I9!Ak-PF^l+D~`Um
zg@<FNNRQHiWM_D3)LH7Ta<B3fp}WxthXY$@;n6T&lGf3wOW7{*=bCBN;iK|Hj7HCx
z5w`qnkr#%KcSPg<vw5dMyAx!~ITfrXN;Y;M)elwpf_CJ80BHri`aX=?^zUxb&NnvZ
zxWNiwo3suPW1AgILuMMLS&zd67+&`uVTYie+-{)%xAbWO90ajXU6<)SXRl1l<w&+l
z^a&~WSWz5QFJ;j`hHg0X07%z<v8(5j^Eka47rTvsZ%u?C4}xLq!1_x6YczWeEhGM9
zw_!cf^y8^ZO)F#453-OVX?4ak)L*CluD6k=LW2W5kj1(>a}scVTE`(cb2z19N<W=j
zNJQ1o9mUA<bUiCS%N*}`wPk-P=O)#-G{6R6knV<;H_{>DMhNc{nqb0(_M9$j>~ob-
z*4*+%>w#)kn_Yi@KOgqB><Q+}DDxl31XB!s&Zn5c0^ERGSL23<mPUhc6h&iJvD|9X
zSu1Vby}3*y=Z3S=m$+lE^d;;E{-aFho%ifYdQPID?jTAhk6%t|GlxVhlr}>0@^dRK
z`Bv^blD`byDtI|8lvJ7<ZDe3agX?*wrhHqzM@ebx)0a3Ex<=r%r@84q)3LnN5-{_<
zM5C`w?>Ck=kHvb8(FpzZbS;-6$q4nqOhjLa!S=^Lo2l$tGvC*8bh9v(m;$ZDSRq6U
z?DjEwIb;UEuUlIOa8@G1#M50;(C^!b7c}7g?AjY$=(!!uuepOU@EXI|f!cYMXfpCE
z2p1DK-O#~~&9;)Tfvzc~hp9)41KxZ^yvDmObL)$2^p%G`*Js1NZwX8^QdI`dU60TP
z;V&z2ogrz8KNyWHJ<kIZ6f7VU781}VCM?}}>a3$tTP)FcKedcA9A0jq^Qf?-XC8PP
zp!?n?wwA_%pwxOWajD@>c>dQ->vBc?-(r?LNi>H0$k@L9fyb<)*ux^;H}6IZtCi+(
z01S%?Qot`K&Z_;W75zKpnky%Q;mKPkh9q@2)MU%Qj#xqV9`iUAEs=l}-83%zy%L>m
z{qKCyek`&+*VfaE2|k$z8mWw2Pdudu=5@ndx%Br3;ulZs`=?t{nU$&|OX`2&i+2Uf
zvpSB=$WB9&37tE@RLO8Wgp1>R2^d_#BY^0~h(Y6!tZj~Vgy%;jx>hlE#s=o1*({ii
zn~MOaix@wDR?hWI=Ud8OL&F%iW@LeMwDL=FrPV~9f8H?3l%eq&==%Cq3v$UAw5mXA
z4jasuGkR}iUk(`*9$p?o#lLHJI8K}~h+VU;jP1mj^uO$H!xQMF@U-erSk?m~VpCQ9
zYsDssuh0x$gZAD4J(|+9VXcuBscLKMuu*%Pdm-#>@Eh~}q9lu#s=G^Ws|dJvk8*GT
zyvgHm|Cnl`I!U)=Z8JM!PCh9L6``fPBRWLe0$S*KsO%pv=D(AVlra08WNvL+Q*O9a
zz=NpH+lo|puRA;0P2l%!aR~pe*rGg48lcjX2LcMb@@Q(u^&IsPjbD9m-crR=2=1R*
z6oe!A&<&m#cIX`&@-^^5Hi%sZbGv64x3yj<c;By5Yk3OIi;BkYRmW%k+yyk*EI(pN
zysgPjz1~?idbw(9nQsZmDoNVlwaT=K7D=3Yz=;5BpF=l}@s(S2&j48?16*HcOjNQn
zIFJxv->vVl8dLP5+Toz<;(I4b{_4H<_2q3tX(ZmcdYNJc1%t?M-uc^#DGHmB9pm3M
z|4scKTT07&F(!xgx>}jeqwGWHU9lEe=$F3eHlvMlIAhJYYZPG9Cie~A>U^vH);Pxv
zKC!gXSAw)W00yhN=Z0WUgO(YHk0p$b@ln+i)dC1`#y}vUbPle*0trtPSoi_v^V-K3
z($Hug#vk0jkI7tc4hh$FU7|;Kr|`*I7m#e=f!?b6%B6go*T3KjWVzG~yWyXO1nYA;
zeimC2IE;E_i%Dr|(MqYIM_W`&J}mYiJ9p@^=vq-#_I4umN*M3J6Nq|zMGDrwQ|Wlr
zzD8o0dqS%YjV5Z1+eVJG{=;CseI4tp1ir^B5vF%<NrBl?RM3G~CA6}_7|O|t;$xUX
zDAmd5ufo8sm0wD}Ux4sxlZ8a3f5dNn>D%s#-%=xs<6FKA@#{8M?MbCmOQM4$<3biJ
z^pYTHH`UMMBGYBqS&mtr0f<3A;KVC#uQAb)0P#uSQ1CIwIg>6vk?;x7$Ut`qLns{-
zFfoY(8Fr@r98<#wm%kmvxZUqsVU139AVgN?9<W$OOwI7nn$=3TB6x`L={xP}Be=z#
zF)UD3LJhbd4FflxPpADo!j%5hTuK=o!V*1OM;p_uyBqBA%c&{T+o2}Dqij<b7{nV6
zm$#t87(l+tPzi6CUB$*A<(Fs4RIv7?d;uG?zidYVRH*<u#R0P6Q82UBk@GbpquHrU
zE<Kdjn%8@jOKn*2v+iCRc4e8L?Dj<e+Fqqlev5E#N|_7?@*o3*&oVT8_dSezYNxxc
z7V12&xrNkVKlziFu&1H9H?Lw(;B3$YvF73v&kl(ED#6*Nw3cP<!`)rjqPehiJ(fQQ
z22ryptE~95PH&$--kiXHjcb`CxfND6(swlJXe09$X4_xfcg4n*#HM^l?D8%cJ|6qG
z4FxIbaj+^z{JS@-RHWWWREc3%zjAO^qx_9Jjv+?bH=-r5wCy!5BU|3&=YEH!m03CF
zxbZ2I=?5`*P#aL2W{DI-`Gtq|7cqP|$kVdLjQvbi1a~sMW4gkB_45C60qeXjl+*;=
zGH*cY4qdZOvwG4<0r4;gjEY&Orq^U=HF-|$2C<OV0UDy-r{UM4ly(=b+Sfov^A*<Q
z*J91QRW8~S(ziN1V-wk$O^F*Cd=iFpLf$VfDj!ROWwJqun=`RYSw_s%$*vgP6B{1N
zQr(clc^;@u2Vo5EES!mo*H_G9crnnsH2~+Ln8JJG*Wc=>E8-sUbA##kpjH0X4xg9m
zwZo~4_blr&=pa#XI{<|NpM1<GzC+k3bzFdan5?|ojs-t@w7AxVcz&>$9Ggh!H#}$o
z58zmMr55h*)9?66MX<?;%_co4Wn#A#=6ypUSBU~2JPD5M#G9&dk=)38_7Q`@0i1b}
zn;06nu)Sat%}Cueb1ItTjUN;s&@~_!Ry|T5?88BwJ4-d~L7*z+9(}WYeCdrzjxscW
z2BQD%xuYhSV5pR*$RYH*n=S`FDVFFMA7|F4@{3mtS4AXk2|TbP!G7T%5Ep67T@uI}
zp?|9w+Q#nq5#9;}sa+n`Z{+u#ali+20{uhSSq9tD`@!t6-1iA#UNMuI=;?*h_~<nd
ztsR^mSJh@PP$_@62E5x3S{NuvF;FYKXm@;2z<Hkcs}SR_YEz)kr9?@SdYVX&vtBXO
zE3Dba_$5uca`VxGVzR0H)fTRR*8m060?VVonI`Hw)BathtR*b*Z~eBCNety1qzHea
zcfCw~Yt-gmz=pXYi#)q<7|olV%ZU)rMhjV((Zb+NBvNoeAi2=~2GwCNG*o!Cht3w9
z`W{Tk+KE%Dfa~cDRe%h-XSiFY)J6akJ6=AGK)km=u2*D^Y&WC?zK=LAV(T2t+_T1P
zM9D%7PXL?=5QrXtCm-+;?w+pMi~DOAuVtM+Tcu1)Tyg`eEJG4li6qkvNxQ^dhASW-
z#mHFu<Q0RcrByte2w3TvHwF;hmWIDJ8jN@i3PuC2q=R9tlMS}j1AI$M_df2^Cydhp
ztDxntMVk>+aGD5A&c3+$)Ov4IGG9kquq8lGq~j^0XPr1%CS0`zhWCOS)QZpw;DMyB
z7tqR&>M_#$i~U;WuEmPJ^byhE?&xH=&fV*ZLbdIc(C4qMF!x6OeASGpf^UT`A@Aw9
z6f8A&nFMsBLjHL8(&psBnMe7s;G;4}PoiY}zE*8sqXza5^arR)*o_u7x||vVYiH3f
z+8~r^;Kt&V)l%1h>d9SGq`4$cT8wkmJA7&i5U5xiXL;8Q<95-Gop^LXJihYpo%;aE
zBYicpGxIU87|vE82nd!0T%R)X*rWIjY&wVR)MY!Z%@Ck&xvVvUf8afm&>AS}D@sRf
zfbu=Zfw7{p7>@WpNdz4+?P>|iZY0H4+wpY|Zg`-+dZs1>{<TStg?I_|rAKBr7P#cp
zGTs8WTcOJ>H(Hy_BCG`I$ljV>=u&t*Yx*R6oyY#~SBWEeW$qT1C4N#7EA5))Z6#Jr
znc}D+n=I-;L5oc#udf}pK<h{M{B~ovFWfPHR=I7H&F2FPzYVA;I60g#S>C4O4G1(0
zm^HEVb^`<E%KKwE7Q64vId^3FopEITkzGVeG~G}ENlweg=b{gOpb`ow4&hK{iorHx
za#XlAT>Mtv`wZyD4zP_dCr*4+hFCdmj_5(tPt_L0E35!vAud3Y0re|d#n<|yb=PL+
z;KfU;xvg4Q@Xf>4_Kf_9%*+;^K)H&-fVg*y&8+lG((lp|io-bBjUE(s+<aOe2@fGd
zukIA8WX^JMlnoCxgBiq7n|FovfJ$P%i3$!>hzpoqy5nBPCX=_ific;ll}`?y@;*8`
zcP2h=eWj`uhM^Mg-FLBg*THzU`(ON|hP{<3i_9GZ54iQ8<>;f62lv}yq-caG+de$l
z<sU{+7#LPrBYg9KpcC|NAK2QsRUz6D&6C*p*9D_&3%L<qTJwn1aES9Ec4nzVx^B0{
zM3c?2=0Cf38+`|MtLJSt)Z#iVBsUO<<(mcb$Xg98Mv8cKsmbFYgLZ1i_*)_5xL29M
zQ5GPOsvltG4>yQmU+l!atwahCk=#kFzh@JF4kt=AVKP$_DPd<yvLqh0spr_&<4xeM
zwt%1;{;6cy_YnA5{JF!gWX((jKW<nuTid65*aGP>xOB`W8Q_Ms3>D{6CBTTh8^u_;
z+>cTb{)U=uC8%nUiO-iKP*XQ6qTJRjEjh*$&#A>$a(!5#MU#=Mxbzl~+51!#y9FHb
z_4R{u9?G=+E}70CpGtmgWZdj=o0>>S?`RRmkEC(HAbZZd5f32VVIOx~j9p`Pzl1Bd
z_+m7~@6XI}=syE3RE9)(=mG%!F%y7}$bqeVKL7!5nk3JmFbi7d4@cC_tp-;-eC=I7
z#qt~emVC9XCdNRDKzuMu;?SBz>1G)XDgJdl6G5x|&5)~R#l6vcFur~PNeBeeLf<kd
zj6Xs}VZT;j*quckVpAC9f&LJ5NtDRSg0zJ8O0_~6y|WNnudX27hE)==Eh|s87+*B&
zi_SVNM5cvv$-CFaiq?u}oz$WrQc={ati-*dd#K!FEcG7+q)kSml0M`GSO9l809ZSi
zXs4R})}qDQ*`gOZIKSa|fPujU=4Q(FUBhq>HcRiV@gp3vnHTuD5gEOM@GUFW0xg!7
zB4KzS+E5elwhHACX<9CO!3Aql9rMi`scM}><z%2{a}Audt`^gG9`g4C5kI9&tnT#(
z&viN8nyS9n<e6|Y<Px&qe<adWsW~>!Ko+_j>oH&zNbWQw&-o+0?p3Zq8v`jR+FW6!
z_rb^FZ8d16RIuEE!_=TyFD12o6BarP|4#Xz`r?&j2l)Knupv8;cV$_$+;?dwU$i*_
z87)n7HJt0cwQ&iin2BmTw$Hcy3t}WXDcbq#%vrepOs|-*0o`{CI3m<pkg{r1B>#wv
zDe(*K4;W?^asWP53OH%x`?3BzjZn5BVMD>2KhpUoKe+7eO)}!|=v5KN_ASCa4V7fL
z642oZ_QPv!n|x^TWA-4B=FgQ#uazY-DC~25RM9U-7X)M)R(VgTqrw15-5IA8j&n3n
zHR?09MBbdo&8>vL>Xea_i+uc41RtWRI$xZ9%%yVFD|I3WSHkG}%#Ucza$A}1;f;+x
z8`@HWUvT2I2a#keg<+c72o8LlS~!Z~oavsVTj_z3mHB{Ql<trLRkBrPN<69a-28xh
zu)N%Sm0`a8W%wAAzBn`q1fSVVU7ms*vghJ^#D`SlUtKLtV=DM|Uhf;kVNn2_B~zs|
zcspIqRns;``Xy5c6qxQB>yL3$exd8AqJ$8<5~_k)RF8oDlRNUlZkKm@{RGQ(!8Wt{
z4_rz3qXyCFxs$h4Xg@-gQaTPmqW0b8BlTNWo-{@v3EJvZL7bR4UX8iU?EadDu739U
zmIxqyBw|g2#b+%7$E+F!NFa3AC!XzmIB}497`-I1<_I>65(3ua`Bip+3r5B0`VTwr
zg@>=h($wUHL~jrg_g^z7P9DPZ)r}TyezDME^+X#C4IH6T;)*l>8Q93)*0YlU(3iI%
zX$669^b2M-HCOWlt*XB`#Pg|`JKKDQ!wpfy9}hs8-p)gF;ES9%-uC^p$SX>o04Xu8
ztHii<mB4)CM@n{PAL9EJtva)e!ZpZ{NfF(wly`S}VCVy=QVb}X%A||{_sB0H{*zR<
zqe19J8-m$Jrut-)eUX^F&~obU(w@=jsNy|0{?BGc6dXFs*Mz+@#cz$+zpNEcH4!>{
ze9ZuCF+z1IdvQg2c7k;2i^p^92LZnNeQHF`SMS=SIN&*kv`)^Y+GB*aB$uA7^UZ;U
zaoArS1zpTgUK-P_%Z*(2%x||Xdyhht=QpirnR_~r02?eskS=%oY{C2az+5b2@Mu>8
z=I~PvQk|AX$BSn6I`{yH5;^QBN5t11h23T1?J_5JZ2t1xe0WD=0iok6Q7zxi7#En@
zcM;BYimzE8!L6<yGE0(XQJ1bP_Op;%kP3+yA#Y<<%zy~l!+vI=<q_7TNO?f7+1L1c
zc*~^;-;oVI5PW^>|4K4P!|-UDv&gc%!SOXbF%^6?qFC17O2d3hlAN^-w|k$WAOlXu
zXwsO7XqzJm&3FU|YwQTQr_6E+oz{C51vXQmf&g^JXf7}Oz|C*_<|^oyQVD+q$8;DK
zgU}=?@?1*9o0_H}2X~iA`w~Pf_0ru^CFUyNG*(-&Z>J9D!uqyU!`z6f4FEbK{z9SQ
z$H@Zm5zMOn-!!T13}Yr^?v!IUeSd8^*6!{D5U9=BMnk}daZQJW;J;1!UL9*iie<R0
z8AqKW^P*Nf2b~{#$vStwKoZUBA1T)1iq5h>w2a&Mx%W}ziJy4s3+LE#&j_;LaXcIU
zdpfDSujeDLemy40woim4{}6fM0+h-I{UnX7m=swn=;jUiR~PUIqrMNm?X3CO+MpC_
zf92@w6w}f&EH7T34oU@R^uMZU<^lfanAP1JCeE#lVdHRsjLsFzNgi(hz5BX&aNkQ%
zw3baA$eX5qmNlPk)HehaC@`b_(2nuzhTdr4wu5cyva%Gpw=$galMLxPbM>;s?hEWl
z6MN(gnVN~#Z)Y`1nv{PdxW85LbkiR?z|<P~p^H}1aMcn~@-&}54o+}9Lh-m(xi|z@
zWHHQ5A3M0#9b9Dz#=)f`0i*K?b#=N-{8G%g8$7a<r27V*_!C{i8(8XZvO6+9{ojy|
zj`t62bA7%d<VAAnEIGKbfV-W;2FqxM@DcZDE>0Tn^mnD}7n+OgXIf~fK%Yn}gmT`_
zfSZs#LilNNT)8@Ru~M`IwEe-!mO}RH-|@ABaK}!J)}biURM1IVIUCh~=P%{Q4Exl1
zrI<nc6I#A`Ufl8O!wq+(vscM9Qi0A>ggHj!=>ElmX>*~SJP&cy=m6xXZytfVSdC6&
z#;Iu%Y|U6T19_?3Vbs#l)LJGi*0ELd(}0fWQmc3cHCLv`I)o&O(4km`C<d8p*`J=J
zyM}XVc-ySI)E1=S(A89QV7%9-W8PDkwAY308+5l4ouerL54jK6JHaE0LR&DTY+pyV
z{y||<RIW<JtE02=9{zqYiV#Y_o}l}wgV=Nj;DHL!+aNpRjSq*gg7<7Xbj^e`;(kJW
zW1iKL-zsrGbN59vT1g6K3i>8<3o!Mdno}wBypJjF46BKNIa>KAM8O<r`M!=<eUa3=
zVJ>B7Dy%bF3G=m4#s0T8B%jX>B8Ij*5qYN0JL0dxI3g-A)S_ZhEN>pML+7_W1q`p3
zj#+_7Hdk&)cS93+HQ~$9GKX7iE2@n?7gg4RWf09(%RDYQ$zI;jk4i`5&Pk&<;4W5v
zO=oG=JIjk~)>Emp_Z(fhGL2KzkMD??;_|dCm6M^0PJ`2$J_(>V8{xj60+j=`O2$!J
z0AKSzz5vRS<%eMyFsPN+Rg1@`!=})KSSj8J_8o3V6I|MkhEHAzx}r&pK(N<rIEkiY
zS-VCpb_|YB>H-HdHVY|~<3^}`z77_nE*;J5o5K_}wcw%3T7ErNSrsK?R^wwDccI%|
z;V!VWypfgDmpg9L8rG~=ofRbir(irgAbFJ0&oD$;<N#f)h_GxzS`u}5K~=L1XD1nV
zh#L$@&j-hj2=VL)^vo%lOnjg%{Jph%|E`-mD9fEWK&+-KmppQQ@E~$((~Sim8E@H%
zGYQy1NcXU0rX>eWEZqzL#}6R$N}lXOag`C;_F3aI$>w~k*E}@MQN_}De5OLeL+X|e
zhUAK}S*+z@dix?Ro|OJfmtThH8+bTl%ebeDPg|QiX>rx)BU&{@x{q#eqI8n&Za%vv
zBq9TipM3C~LBN6Q;arW6|9YMZ?TYXxTo8&zgSvi8mvt!=rASydk*y<$^NN|Z;n8&X
z7ntG8(oTfh(Q`0;W{f8K&cTd^Vuog}OsK9H8%r-Y)+ocNT->O=G@GD_bt$Y5m5Ak}
zYp#3Ix))pSUr@5Y>j23cNu_%xuZeNJH!3Mygq_G))`iTJafS2Tmx+J0QMrl9fjKzE
zq!2lhyH@fL0+&i6(Cj-GkZ_RNe9YBOE6ZK%8RXbvYv>*_!5}Qh*FCz`kV0gcT~BA0
zWW!QSfQLEoN^6X#j2v?(l^seL3)TRo;JCSE7Kg~!sp^kaHjIqQMAFKNDHQV%&+Spv
zmpVQ$Dmd;1`N>}*d-zFB&+iO4J{>YPw)qQjLpc?-=cxC^=XeEZ2@pD!2#Qb^^QK8Z
z5P7r<=LD3EN#aPY{QfNBRJ%2_%4bG8cVDU5**u@&FqDv#cn##SD3O${4<E|7tt?QD
zt{713F70!;1*=#R0&%9c`R)T6g$nKLL;x2;1M&R2EJYp2iAQ$EP<YHZF``6e?kp%#
zVL{88`F`i;(CrTj(UwG+*gooHPPI7YEHyBRkEdZ%Owi=qojGt?Hgru?Dq{|8t(Y!_
z4Qx8~taGkH{?-=+(4vNenNlr@z6ju1$sO7>Ye<ryjTe2+7A-1MZ1Wv*ojbq>jKHZI
zexRAYZ!G_~chTORS3rcO2`h9((sYu+{g;THkc?D7LV=f&Ze7WyG7G-^khve=T^OU(
zXr;P`U6U<2$IYUKeh@+sKcMeq!v4HvC!D?<%e6{z7(3PQ>7EdK?Mm8T5<Wm^$#Kuc
zo@uu$$3QP?=6PUazNMNLYiC*esBX!lV6!F_74;;^^$i#j5ilfU<D(?D{mEGb3oj{q
zO8fza)wVEmL-$<wKS@+a7#S1Wb$1&v&9gx4%CHH%XE$VNh>U6IwdO6dLI?x7$IbRk
zFqbN9^#^hbtX?BcSxIv<j=iy~bs#MkKEApoY_I$HG!&zx&z94!nI69hlgyB-a^Rrc
zCEd)NVkuPP6Lz=d4!sWsOfTaZ+|N%rd1<-o?)JIeN=NFWMVN##7Vnas64OLd8@Q*l
z7o9IBbdje7E{L|al8ZTavL(21cm__q(}bC13)hl6Sy==Z@7?tbj=8e*9xx2j6R;X5
zl<?|%`9x{eQC1y%75-;NJb6n-zNAx|=6M|*mDa-ZI2C8IAIlWIN4H+7QwMOsg7g{h
zr|kG>Q5_oJqnTX3;|WHl;tj60&}5zv+|CoDz40OO?R%ZVRvVQ+9;HkBFYUJIzS%>L
z)#d|r$`4>{PEOpCp)C=KFpXAq-)k_Id`}xIMG)be&p)8YRW$oIIhKYn{`#2g7uR&Z
z!_SLM?5wNL);PkP+I(qcB{>pRwf>av5n4sqlaB^I{$Am>2G~PIzAes-Q;H+R{p$SP
zRYSCZ58;j<gPn}uFlKy3ZN0?PiYD4aSlZAK=$}2H8GR00J5efcUU6WoJk%E<M@EvZ
z)Yjg!M%T2AMY%6j##HFiZy+OxGg_1uktyOMMF|f%_fg^;VJ>bHT@ct3Sgw{-dA8vp
zRvFq)d1Ev$m|rk%P*yxf)AXFLsuN>h{#|i@Vt+KLWc5&^v$jS&yKhLSYLfQMFjV$J
zAUsUr6JNvMurIZ}J@!BLc&y^`<38R)HSQW%VD<sh^2k8Pk!mnM;t-^dwC++k02(^`
zHgyspy@%OHUryzwj0^0z-PyH0P=`kfXpNZxsv))SaL1C#&aS&0I|RI9!6kl$--lx#
zUsn<-xczhr8@CC0hsTq1-ru_iFOrQUnzPzCc{KVx`4U<gyR?zjUG%W8$)6M_OYvUF
zw~-6AtQpt+MDOp1+-hrI<DuHuX5)J3K#UF!u6A#@R;;jg%sa&@lgV)A!2Y1>SSh_k
zyzAIG@MiR!yul>dp?0UTnm8t6^W5fbMi~@8xmC5d-Jn!CBe6;(5j^$*qP1uqz0<z@
zM5tPcN8H;{sm4TkNy-2_!kyjAq1}04Q-G^oo8Rx~D5r*fao6##4LtuE$|88+{PU=J
z%1bfBUMTzMO7x|iG8L-rb<a`Wqzzz3ajkUT>HZqJJBC%maf<-DMOv~mdWyLjZfU-+
zjn8hg72Iek6xCwAVm73yM^I#kn+m@V6l+KFa+P!uCQKl2eQfhc8O1;+DJUGZtQ!km
zW3Ob)t{>gvyx)|}WzCv7@{$!JBO5JiKA92gFX3G*;`AhKaoujdk`gz-x8zQc+B=Ba
z&Vq8R*GBvsjKh3kE1&<YQu9OJuML|-i8L(F5^efFDEOLmCHh2Kle*|halWdidhc;v
z^@jJ3i)6!ulq_1^iBxF8iNlQZ&B-XEv(<0y3dGW91~w9tfX{bZOn8vWT?Q}gNR&b0
z;&x2S8FSjYh4r{9X1%M^92HQl_>xQnYJ?DTNd}2`zj&P_{7HdMc1OX*@d7O{g@C&C
z<AK$$49}re7H94dy|%>I_FItxW<vo|wv5$LJA`ArF-_W-Fs-&sA(dQyV*jDrt{97G
z2Q=N%r?D`RMRM^6B(spOZT^k}vrywLb13LYy_fI(CqGHcUEN8-Z5z_&?2D|ovquh+
z?6TZBz&)ig%-KR`?x!=NESoVQlzm+5N65)_>JTwz)rRtIGCDW;x3?zjDlM}Z0}^vL
z)Jwb{yUIhEpVVTrbA~o5iB=1(cV#{Qd7LXck~Cf`5ZEKYSppwa`32*X+9&F)^vaef
zi&S&-CSB^cz#}fbxW!E5|6}i~zoPoWcSn(wk_HD*0qG8DknXOb1!m~(E&=HrVCazU
zmKKp3N<_K@q)WQt9zS<|*ShQea{qyQei}As_U!$hv+H@^_jy{6ipp=q<s5AJcX7nD
zIeWp}rOXN%v;h2<3SQkN^ArX=Rb^UyWvh*IP_0m#6YV+EZixo+x0zE^&$x#XtL|)$
zwien}u17ysO*utS$|rI_-CVj8cHuSTJtJ#b{XIw*B0B!K%WDeMy0;Hk>TRE1qSFDc
z7<FrwHxvgXa6#La(sE$GR6>F9ezm0WVn7r}%`ICZ!wBq81yh9*{dtzpmRTV#5=k#z
z@S%P5L(2GxZL_EYxUkPRz(QiKvg|#wLDgJ0&<#o-0#OE%vKi2bN0-U)RdN&UkEZDa
z{BS*Ak-$vl9pH{5+Lx=SJzMshVY}4oFsXVgXKk)*^VjbS<#ZemNMac+>KMZ6*JONQ
zve!`sq<tJn{nd1v%NWrC0Mq<@H!YNu?si5aexOdwTkx@P0)u!w>nyi7@m_CgXMnBH
z%bc*{+<#$zGF_E#VU{?rfIO5U#1tmbTlWl}lVx@;!gH?4#(jVpRbfEnIn5SukR$Vq
z+xCR9Lv^gqmN}|mX5qW`?Qvl&`Nf2ldSXnHp4zW(=QB^luD$(PNMfyg$cIB608NVl
zGwa?|F6|M9ZgnPZRgR#x4`&$p8SX5w=s8NF@%;-WW#`HEKe{vf^^pvj8<XNI!h9eZ
z?r8$xSw$jkw5n@9Y8LTi+k^2{_XejEMlC&sqzshG(&jv;La?9?yt2RK_)P8oe6dlX
z9SV+~ko)p!U5c4#h*spyFC%on`6oPPcEU(x;P}BCRTC}r!b)fyYy{BEctu;n7Un|!
zD_?5Ss$KGE1h-`JgQrrA<!wI`tl#RZO{Ni_dJYQ3L{43Q-a4W9u?PBhr|NRWigqST
z?CIL#XGc1&9p@9d0r53uQJRQ}vNys!zeq9BpDRN#b8u!G9U>^I8?=Drrq$K_)%+eS
zJ0MvtG77dCnOMuI&o#*}gJpMI2ZRnUUP%$}rm@h61ShU0=F9O{TFc_Hybq&cqDGW3
z{;b`Vm2U8pF?ZO<iV@1=)8YlT^J^0Ud&NCqA$itAw65|Bwx%NWO`}#Ds7J))-ns6P
zdFm(Gh=}M&3r^#shKf!PUVX~}Iz?K7;IDsw{7_@zTPh?5n+qAIv~Sz~j3S?!L>oXt
zao8q|o474O3ev?hc1{*vUi@5q%lyPD3?u2TjW*(<nA`|C&XIDD-}jWJ3Lfzob(Q{4
z04<;PJ8YI94TQnai!WJhH495$%ahBI!HL0YR-b?DSiE>&LICMDik_KUc_y72+5;j+
zzDdL|C;n6z@>P9W;od4o#pGKY)%R`J0z)(oro>O0$1EINQX7X_{AIB&2*&Y(xvn~m
z*S|m=eJDzi<*tsn^7M_cmvTQg9k!q2ah8_KAchghe}V5Y+OL`7)FWA_*sokCYfI6k
zjH()Nuk7~Io6nqupxip@4hvS!F)nF?&V+@e00?FABD!xa^6D^WVn>e`2=~bzpu<LU
z@%zC?!05lAS4z||jG{DE{o;dibQYAaOS0bgV9XR8io?{OTcOiW9+7aN*t{!r7+bv;
z3HTf^cf-!`ekCWeFxc2gN7xBU=_-|dwd_25FC<;B_ltmCo++c~+w5l}k<uU%MJs?9
z_0tPejkaQHFjt11wtL#0ym!``DM)j07XttwwEDCi9Muee4__o|SG2$AsnlSAd)Jq6
z#hrS+q#Nolk7c2Mvnu{xcCKEI)_h2-`SbO&2!K=j{;aW&n<+(|Hd>~)yr7=xech-o
z+}$w9njk8EI>p8sTsZW0GoVCf@=iY_eg&jpx{#3IkJ>%SjCBS6{M4m{tKZvSSvw8s
zX7oHPJT$lm06wMb6Rbw)UZyf7BUKRo6NZl(z%Dwrh^xCHOr`QrPjMJ>tsaN-EL^fj
zoVbV!G{{IqP09Y-8Kbh<%g`)#3iMiNpYdtRSMeC?m<E>EJbv?H#N$7&5s%Gap$>q_
z5>@Pn_Ite{!9+cAY?HfXd7-X2MrRI}@Q&g7hb#$-fO(BEQjjAJRs#NYT+uQ#iE?_?
zXE9tLhStNNWA*2#WbqYfp0@UUqVY7!vbr7xW;)LkzCBSe-&2bN#Az2ymSmZ$`9#A`
zH&vjqQ*b1Y@^iF^Z#}DbnvnYS0zTRuc#g`ZN_MeassgkaIB`M9cV06kqsk;8K{gs3
z5YCED=a^zY8SVm3^HIRX&JZi|<n^tr{u_24!A|UARB5i<tn+(&9=P@-M!%Ot>*uKd
z!2(zWxfbc^*SxE9f9vHMQ8rrZShZP^a;qdW*)nMo^WuZ^O?A{<i9n@qHo*<^F9)pZ
z<!5zkXuN8lC`eAuT_l1-8RnhD8?09~zJwc=jcipF19-WOlf^4A)eyIl75HURqj7{y
z_IlF!$F>VxN5mK5VyQOCTRrd6axgaPn-6}e*lNQg`7yi#ah$5#=_cF&Qm6nMaEj~3
za%i7?Jx`vJthqt40Y0*mVXDY+psv&N^7>+;b3zd=+sevd9YLwD*QgWx>FI3OYE?3y
zDU0S7p0rL#j~Yw3Ln)}quF+6upbXpQ-{F1e8G)fE?SS52KD;Ox)M8RkGi3aMjEsh?
zf);L_K|)3z^D&gATLPl=!xy~!NzT^5ZFU)end%`vkt6#U^=<z4*0+HS<pgoh0H@UM
z#{o#@IvJ$C3^TMX7>^93V7-@6)eE=BQfsJK{VG=zzQYE6Wm8F)!wPqfIlTgC8Yra|
zA#o8QG~RsIYF_?wzt%(Cb9GbN=S8yJzS)iN$F0oOx0xSAqf=QFi3bCFdg&_XJ1Y=F
zzSM~tDQ31}4&U-ITA`n8LuVmop?V$(kdu`1GZ>##T`%=DvG9O8-`;aPZU#nU%PPzq
zOLA94BC-QWo3b*YQJBiH;va{jBvBFY?pfaBjxV0olTD3U$?p#M_ZmPVrM|6N5uF0>
z(G$A5gl{2Ssw;%+c;fsw;U)`ZES5EXrE~z2RrHzLVFsh6USL7RC37L(R7anvjR6j2
zCUqWJKUQpJx>~nCyT-t-urcOF5_E_%SS#?xxJEK2;w-6ZLSpL4vzMnIcL8gDBZE&c
z<n;YXY68hq)v$aA<z?XX&#f}#mflMCM7&YB6z|IR%18Uxx!Kg$w{^;OEV3-Favm+C
zFI2vhrO3HvCD#Xh-ah8hl4eq*HCz2HC(8ZZEe=(Rl~!jmPmenjfWVc{2i^&V{Ln3X
zo6Z;|(TXh@_N08K>&NH5Iv=T~`fPOdyBc<&OLQc<ttcNH;^-HuKU6GGtGID9gaPa1
zkNWdlr&eLU%w$Mr^<JXfs~nStC?=+q*yKuhRj!)=bC?xRMgk$=LQ<AnMKfD`6(wmN
zqt#4ZR(Y5=`CNR*{v~qatY%_|kiX+bA@BXBkxjFfOybDu8HcSVG1TI-Sgw{#Sp5t6
zy#`$<6Z1QW%6GHb_$Q^J0P{=CD>!9Q1%2w{emxqPHBaZaqmcLxW!&En0t>fg6HmX#
zc3o?3Xz<r0vBKq(me#FJr&Hy=%REKN$ngD*ON{i{*RL%PXIClFV<|2tdwiw_Z7Y;v
zGEXS><)C8vlRlBz_LL^E1NJtw4>$>=^j)li2eho+4MaHf498I9qYM6=-yoVE7iHh%
zt2yy+eL%+a%0#!RGpyqyu?e?6TbG9yrasZ4jIxNJk%P*TV-HI6++AHu`ZDBjmj2^7
zfY#a1=5(S2OEzBb7YP?Q7$v$;%4KY!*0dx#Pv862?D;V86Gd+xQkObcu2jd$Y5%|v
z^igBV+%r)y*?CUr0^Z;X+Lb6{`3zVgOar2;nwZPE)ZTRq9Qv`#$@@P)O$n=XMwh6Z
z%(TxYX%WL8NJ$Sl7POVen8T$VJry+}^taS0vaw<4&be|nrmnTtr#x!AqGUbD8Ou?d
zajIM~tOu5#?uI`8;pMjcEo;{g68#)hK{gVJ*kyKEhdozBnd@TN*f2{rdze}_Fbg4}
zrwN6VnFo~9M}Ory7;I5vXwZurHo*}r>!mvV&jrGhbP~!3gMTMfZ=_Gz<C<Vk`{$3m
zZW9uAjWy4v^WAG{7aG-)*?u-PIzppafn_WU(x%Dh8ex7Jfd$oKGuI5a)0yH(d68#$
zQ{cz2m#@bkXM4%V$?(x+^#HObYg}VOL<iH3^s=+CcxB1N9l?&q;g?v4Hn4pdCh5j%
zEg%X<&dz@LF)|qy5=AaPHM^MW*xe(jUakczunXsm)y4u2S24}8f8;Ri5781^9P9^d
zvY57p1kd^oF65Kk@n|VA(IxX&vnu+$I~S^ddZIy!G!UHTs=WbJ;_hBBRS8l~v%OE*
z=rnXn(6@jd2LLUq$t;B1%_&lW2U-do0|G|EsUbSGLWXC3EJI{zWMol&-vnl`qXegr
zyWSde{4{mJ@_1q*;DaOF1I7DKM9<ZT4_CmHpVrO=nTXVlS6(obatAyB`XeuZ$(g)N
zu!VVs<3`7mCcg8pp$p#~zI5iohIy*gMwY3mTB@t+4pn3R?V49g7oVG0c218HCok)U
zOBP(n>1oi;IZEVVkWF$qY>PYJ3aX&Y0%0g**HIaSX#?~Xc^%7SjnI|x)Mxo~VFeJK
zR*C@H%yoma1ZZ2aI+Nxfsf#H9C$OD)^HgGv77(lf(5~fG)}80TgH%QMtCw4MF_>Bq
z1r>#@&D)~Kcz%m}yNAn9T~a|0>o4gEQhFT=#|Y~j^_AF&_S<2|T)l#6KMNcJA(?4U
z(L-<S9GidqIJDo#!!u74PBz35<5z%A+r>FH_ED36KAO`_j@6+qk4jQS!=0Eq+&Nn?
zpl8e7GU-oB9+gs0aV;_dmFAUrk{6=cnN6iUYeQd$c@!L-Z8%3N8xO4$6uXcz{Ki4s
z*om}YysSPtv~%YBQn>&Gs^X87=V%hZyvlF+`y}hG)EZMSOO2_WM#kpft+37BsT`^C
z44Q^4;)r$NgwQQ;l$T31ak1)ZMx}p6vtu&zeyc^uJ*oSaW@tTAK8c9+B(D;r=CS!o
zM({&}wk${C&FmM+D8zA$21GOTk28jwES7>*(LuXjsZg$f(*dF(akLVzr*fCo*51x-
zUXM3(ykigVe8!3IWz^}tdQ~6dfYL9#g}leEAPYwftkSZyX*ylV;POcWkwfEzD(x>N
zA=G0xG93-$Q;f6rgLmChR&72R1sr0V!6o*MY2QyNe7K+LsoLP16YuOsDz^!X)T-l*
zt`m(U^uHxS86_i$(#X<O<j1b(r+Gm>SIP7$J(%u05qzpqIdrYHp}vz{h^~F+5UYP!
z2=7aqlT0t3sBbS`+VF6tY$9RL?}Qv?IL<sr84Ej%Z}0EO(vSPbx%@hz#`rF9L3G!M
zyOetU0_6mQ@q19}>3lGg(1<C}5DyrR{h|bSj<#^5vecZNrY;CQr<wm*LwQS)<KR*0
zVbq)x%L}-za5^Q%97<#@`yPHAt}0;&r0p$&^em>;u5mTuoR*-@iDMw<efG}12c<02
zFg3J+Mwa!Z<ZIT><gVV;nEnE#0Ugv@e5SO6{fc5!K4*OMd{RrD^Rww-c(y3fXeBma
zbM?=W$aH;m)MYXv)uX|SfCJYrWez0p=to~Q#YLv0k)JrB4OYE)3ebGhI7vBMrK1L0
zE}ym3j3oyk09tYa`>TS-g|cm7blEV^r#e1U@xs0jGa%E9eX2TX*Vx&t)jl$m&{FQe
zHwL|U@dHsfVt=HBiI9m%2D=M^1SGO=#|<mwE9fhihn6<S-fpCd>+pAL7_OCtsrIZ8
zDE+PAIv?J~AVI83jbeEQN=FJNYW-%V<}eTgH0pyRW+CA43t5j_s2LLqFXNhDON$+a
zdA15;gDPJW&1^?&M;`Wgp}wS7$poB!YQpBG^1zxiX}OSKG&IHQkXi$uYC%IJb5S<|
z-Zi$CcnEe;y{W0(IK{Aq@say)Qz&%Hr8R48S2P4ed^DXuE^$|VIx9>%(T+)TxO}*C
z&zDS(065W{sk=A3GYouJ$?ZL8nmTeQGFlf_=)a_kTkpt`fpN;<^?y~na3>JnYs!b;
zy5-SFE*vy3>~)@Co1#u}#U-wp>8esH&m8T>1GeJ@mRY5WcM<y;sfD(S`{9DD8OLp$
zpE!rH9O83HE6=No7$U_vWSOFmeR7qj)R{Bc3K&|KsN}!xdju&Ufq*HZIvr}50#pcZ
z+Gz3>wpHU>;5cm!SNpf?t`P#F;5>h=3zI8AArylP2W*+6`cQo7#8`dE^uxZo@llJd
z9CR`!hlwg4Zw@;zgzMZKTbfl%rea*HKgmeE?Pg+f!Q}^A_ft18tfb3+yM@*66P97K
z(K%unNPA0|B8(qd&`Pz=Nc|ekmNuYKLrDXV#fIhTk`SN0&kWb~lb*HXE6)s*cn#?<
z`353(@{-Cv!{K^u8MvM$x)geRgV5!h==Tpc-|}jx{OWwA<lL5T#z%Qp$XV*>3}4_%
zSufg3uv2CmZu-JNEx&%JF#T|4EY|ST1VdXpBp6)A@^%{~Ne7SpN(9}v<!}c!ZQdf(
zVVt|<U=HFqkT@P%d93{L80r8V(su>mb$^r^_6y1DZUyi0N01n*&_N5$ZlkfL0Tt;6
z!Ru1weta$zHEn_Z6A9CiZ3ac2J|ag1UKfzrzx(?&Kol(o#+4~J>#K~|g&C`cPVQKM
zI6CWjkVm_b+JBusoK?I#!koG|MxLCFO!wUB_B$N#h;uNL3Om1kF1@u(Ht0-d*v`P)
z{!)+f?{G)@^@dr)93}4arm|mdqhvj$mbYKtjR7GtwxbTYZIb?yk>6==IfDncWyd`B
zC{Gq>6$)nd+}oFgBgDKxleD+1!y^czGhVWUl2#wsgE5*sjdYRb{#q*DW;z5VXYJf_
zIIppi(~PvfuK|&h8m#t}DfD=_x7wKvG3<utZS2%`Kke=R0|zq>o6)BE2mJT>Lq?`<
z^A<k5Pr|>q#~jw|V<cOyss$h{GP2)hX(#GcwQ~qNsB&o)^3~+jIXAHL_8HPQ?$(K8
z27CUf3C1h#TYWy^b0i$T+QAI_+LIR}0crEUUrnrC{H+jB8IB1h2{PsD#Q$m<Q||im
zrYL!#!C!*`%PgX1$H_EkiXqN9HgaEcn8J%$ne{n(1QFeWga5bvo<W;fk-6mrCfI#%
z&zY%=SO&fRo%RpeU#m`79r%$l1)P4yxN62r!B1sy$WR+U0Xlf=L>Yb>*6ZX(0vntP
zQ0%vpy!b}eXbnn%ZTPdrFG3*KuVdb$356G#XBJjh1_sZIjGlR?R!(oy`*l5|w{W06
za`KUykg$LGX4UjfqJ1&H_5+$-)7(K}QIBu!IKQF6D*{E6oEv8y#mO(xWQ-29a-@xO
zEN2li^>Y-oZ!`px)df*%2^7@MrbO^dOl79Hv8<^gIN)3q3KrLZ=LsS}Z`)9J)@_4f
z4GlNdQGw8quTgBr_*Uui`^z*JkXwQs+w6hpSsmAXL08M2cy<Mqk_ADOxpilzhL81?
zc`lXX)fDki)~;qc`M><xJ#su$x=#~7y_-{{A>$2Ds^U28@$r`>^*^G-tv2S5fMAO>
zNez({Ig!Mg)jty#u-Jv?#(%7w&}9(5xiHiDIg%hF1{<=5L0E{i38Hf3tcZ{9^@wG@
zA-}iu#KfMA62BNnqV-hTy%iolzNgD#`yVV|fcot`Wn+yM?z`D~fAF@am!F5{D=HZ8
z$K|QadN;E_{51pPETLG?Ri{_OSo%!xsp?dj_&LvG)A7Nd-ZC6})C#fYZt(`*d&?7t
z*P>}nahN%8B9s2u*Us(NS<#Zz?4{0uHWJEo12}czm7ik`topgR%U_2oOY1%Y-q8W+
zregsd-$rPtsg6gonC~$;Ym9f5s<1CCuI@^UXJN6WB~^6(a!9xadN(q<apENGm{?68
z^(I217vk`IX-qWJ_|zQQp%QW3PmC@5G_iDM1N)=-W)gx`c_(wgDw~?>UU6mrQvVua
z+ahF_q#Pw}HlZh>!U1APRO{%-wkC|qxWU!r0h8}NCceFAceA-fiO6CDk{h`))VPKP
z>tCo>86V&&biQbsLL6Y45`On+d334`T94I3D6b2<G{2AGYaf2Yj-jj>N+Su$Sl<Kh
zr8Pd&UFhV-NunLGJEz`%Sv+|k`ou@2pD;Q8e~0jz=~S$&yXoDJ#;#|nw2W?kqF+Z;
znhIixGn$qZM=4#fiR_GUo!*0wEB&0*(p&^~1ysh@8|gbm$<f^RH<lM!*?>2lfW3A%
z%^aV`oN5@`>@z8hfg|NU0V<h9Lb|(gzOeY4SM^x|5mH9TvXKYO8|S=`Gx0vgxWrY)
zmZpLr<kgqO<?w!)_yHRI9ji?cX!6x<by>if1M7wUFnVABa(`Pmb;GdKQj*hQfTN}M
z^}=be`C?Xh^HL~~JaIbMk#NmmqLLP|<sIF@1K?HrqsIWyu-bHUZ8|F>-9Yk~-}Sm?
z(t(gxQ2BXTOsY=@0VXdQIpuf$hN}GC<+W$VPVFMN5!|p(NUV9jr$l8JvM+w&uU84)
zANW+h;&XULLlLNi@~ojA!IPw{&(iNp%5kAz(>Y0*_|fjjOSFB!+!ei|_4y~|64TUU
zr=KCO1i(5w-^rq7){ga3i3>ug@OK&Dhzx(K_+bYsq@4^`dXbnRr@)5?{)$oX_rdZP
z<Ie#v)1gzpd7amrRB>DUpf{!~#XeVA1=k)T8H4?up00*B7&5}O&@fXS<7An7c~70c
za~j#vw)^J+51*UC{zaQSjSh!6x<?El;rzKf4H!(AZ6c!4i@Z$mkA-vd8~{`)UfvF@
zxsyY0J^EGiIhrkuBb15klk^VEjl9ec5tBPkYFveOB=OR`eo<&@pbq2m&~dtng>$QI
zirm4Z$CxlaC5}uq3>cKB&4lZMM>Vj`GWx^Sf=Nv?-a_1QUj|s9J&1=A7q^z_kGhxo
zupXN$|B_Z&?YBvj$wpHrhT##eF!L1TUxn<Hg;i7DbH4sLd)ylr{%oRgv*YwPg+dtO
zRDW?H#QhS}pCh;wS-I==^o1q)n5myNxX7zQWs$HQN3F2^R?{3PfXo=QSvbVyEFCNt
zuUc`GYt8*-GPV?@Tc6A!eAd2X9kwN~^ppk;6@827uM04UrLM<*%N6Gf1D`Dtt18g0
z&9#36{Sw%3(i{B)QLtpT^re3|DEb2z?b#m`mlfpI5e#(^*X?&vP=pRO$C#@t&kT$q
zNkeZqh_*a&x2|4AjpfYnht@R5S5R2w4Btsz_)xH%U>eeb)f$@pwi~ROM42mffxzo*
zmF|@lt24(l1&zaiau7%-&+_IceGa0l2B{%bQ0QAY%g9QvHG<sS)=Jg?)(`Lgdlz2V
zIc=G_9ywp{@dOZ;iYPfZ&5PH@%<Run=zq~M^gbpvJ&8zFYQ0V_l{lPEdGoJ22ZuTj
z>?aT_-QZI^82K@VBo0(4;f&M%ZfdQuPnl4Vt2jVZgPB{F<Lz_UtS2kYzj-7b`Su9)
z8z@fB%Fe&WO+hv;yF<sb*NKNrK?=hAm!3<7Y8|!b@Jw%2JCDJImTb^P@l6O7!H;6}
zI5Wk9OOGf^uD%AZr^**k7Wo{`m8^STcaT)F&BY%Nnlv4sBKrmZWP0zH+M#U(o9eKU
zYeLE$_;yf1WDAt|B)o&MabVR*mB8E7W&ex~`Zh0Ow&CDmL$+MvO|{)N5-e<}bpwOz
z4L(JHIE*hdyK9k6!OBH~PlDop0JJ-WMDY1^FM4tGeEk;3`!>C(>07RwG2%GQ*^e)j
z>pcf^8bG=o^MuG&XrM#m&{I@f6RHfIehX8H6YlIeO(jbxv$nbLDm9g0Bl_fF%J7$d
z%X*va<r8=L?G#FNKk*ORPshVo)Tq1)(}JO|(&59+ltScRiTI_LST~GW-wtR$Cmm&g
zAG56Ip{o-CLgEP+3eb#H`<F~v)gS(#5$(xQ(<}Gt>6PMT9k;&pUvE`Y!jW=Lz+^rV
z=zBsR64dnj7*tzY`fU!?XhgddU{WpxH*9uMl~^i5g~ttE!^sQD8j87y%dm^X6}eO}
zLlQ?vV#2v7eu2kg%*{u_mj6_X)gz`p32#X=HBbrDf~JY(oMJshZdnX&)@A2diuHhy
zol?t=ovarl&tOl=GweNscVAk?;n96RE{tg7xEcJcK_Nk*RVCj$%RdMs`BQJOrpgf$
zYKmrRlri>=YpZT!)|}AmJ%JRYX?jI?{%9o0%BzRKQMCV8{m9mCx<1-QFS&1Hp|1>v
zwVL(`ruq7-Ob8Ydni?jH`t_$7Q$vLk^1LTiIe~}9LJwL`ZuzWXB$Vv*!N6F@r}}*i
zmcDAw85#A@vx(3BZp`2nJX1SyhYug@z!uzlR>yPy9eaYNP%Ww>XIvjBl~nkm4L&yo
zC7kR04I!3M+nz(`EdS37R7{<=h*}&NBcCoy5m8$gNcPo@pXsBspEVj@`Wy>^E-}vd
zpQvL2>EMCfchTQCC_xp4{&fjiw<0MIK7zE0erT|>yB}4{r;^$YlrWIy@Ygpn{T{;p
zDX%dK7!(NZRZFa%j6(`NRXTkRuHQkb<V9wr)bmOxMCPP!f=S>^a0El<^-|I&Q?=I~
zkpr(}n0w7p)KJ%kp2RjAy1%`-wI==iMSr!hU$1*BA~kC)8H%dJiejrkE&Z0m!;KRM
zT`BZw3<<1+Pq2<Z1xMenIlmU1R^?lnmLcW+r7s#7-vEoI8fC~ejujEA`V?=Gi){90
z)yipadPlPTt*H&UR`l`hq~J?MYx9UE8Ld!tS^C-?Wivv|p^x}6OzAFs_Ay%FWzbZB
zZ(5Dg>X9koH^qMIWnHONF`ZCHox-3FTg6#*ko;8r0lF1GP+LtMmfTH!WBI(ElcZLK
zvush#FGiS%afub-^=fSlqvhn+qg0NjksAPqEDx_FUpigVs1`E?Z*for(-sF_GW(9>
z^*j|3i<yQa9BJ)2Q3IRvnw9Rvzk>&abhH(<r)w<@W8=n5D^H4QB@n$7w<wqv4fO>#
zwDvY=|Fu!M0IRTNIxBe;$l3d(p(L-gMcoEwJ*oO}O5+*mho*L_A@o<4RYXHoC}~FH
zb=><fWrDA7MZ>kDko*S$w`zJSgA{8Jfmd*Cfa^Voi7-V#tmJv?vbnc$Z8RSeX4m$2
z&fw1}{IMbrmaQNDaHTf$r7k#ua7=#ON_LC)*PMbCi&Nd%cGeDO+51=rMmF1?^pLn$
zMPXVxM*n&oBQQ7OIKG4-#ZiwS(k(8OFFYTH`b?|DY{%mz3|VmuCg8<I*|3N-)YWl;
zD{eCu65o(20wRXjoY&N90kw*JSg>?=9fCLG*GmK%5O*MCp;WZo;n%2N^I~9&l<_ZA
zk^I!o19-wUjf!pK;7mi>@DFP0JpMWJh0?;O^Hv{)PTmix_tI%raP9TAPPFrT#9yD~
zYBEL_*<;gIzfnuDx?G@f<|Wg{ACH15ElXP7F#!ynYH)&b&J~v2LMa8AWSP!NoU>RO
zg$9<5dgSHZU;w}M*#J62jh484JiE6-O>3<7M%)ek9#nRwV8uFTvz`*ldA~{3>6he3
z7d0EoM3ZKe$F3yIjBDQ})ABtJYt<e#Pd^N*^5@(Sjd51`r6$3~FbtBxNpU*KEYi-h
z^-2b)zP7qiE{zF7d5-ss&2<eBCV!K&ftQRdrvLy};^(wqWZHAagXQ-_lxNn<jc??q
z1dvd;V`BXK7!YWRN#J<ID^tcc!4G(-Lc(4gtzoBI+_l2xD6!v9Uq%dYMpzMk`Pu!a
zk7a{PGHk_yhj+omnK+c}38*|+z&fhSPeuKEa1wo<eTbG0iW+C={P&lq^%W1X1`{rU
zJf&|ldH80}7JGe?&~xG#BMGKQy+jrkFQUfTxZ?~`ug3}qX+YxcoX@R*5kLZvz2}a-
zj$>;#CH2;xq;a0okYt|NErbEtaX1BXn@uy{8g;`i-|i1!#E}SA_20mM^BG|(87fcf
zz3P4&3*(Efa4Fl&gd&Xk<0;XbLU{gbWz?@li@S43ht=Fy)5i-+gP-Gq2PsYC-B&yn
z;D#1aMO^34N0`!uwclg#coY$7b{P|sdOvv7XY5plRz1>(8OhNKqlniazP5YL15|s?
zWVfg5R4;sDMhFS1MQd4rG~4$QIM^=u{*?zBb;rM)+0|PgTeo|<m18V1;b8<>^xbwk
z<;Ji6Sv<!GaFC{s1_NeSa~2-Y?Yy`XXxKVIJld%PR06^Ns-pL$#mXyZOi>m`oez?V
zB&>=i{2a5M<NltRzK=)k50Z8g1Ps^qc~%oYe`bv%7n&Wp9kDlfZca%`x}D4epPY=S
zbW|TJZ6ybikI?cR)<`KT?g?y}qy+eGM?s}$+}3Run>y>fhiOzrdXW1wV%I>g40dG|
zOj3F@#4_R&BdOZi{m<Y2n<!wfuVcFQtQ<`|AFf?tV?Or1;Sp4UTIyO6O96)vOX?OI
z?U`Vdc#-oz`MnWyDU8s7OB3IDYh6R19c7biEM`3IN%JTsoi=jQ3H}-3uG3upA+ckY
zvJJQV58f6tRW@GZUmDDq)`>TfN4!Q!c6>OpDG%S$x+a!6U2iW~TkiHZouBVW36tCo
z=N|c87j4lSJ>0pfPVB@7o|vSuKvd}4+VTANUYhXC+@0ulFU|ja_}Y7Uf8W&&(8VfP
z+1ftNMu;s<h-&Ish@9pc#chrAA5^-I2|jiQTo*1cQ|Sbx8M$m2uy=Bi_dY0yIjpq8
zxqc?~DVDm)+}^nP_}D-RlRuD@WV=jTm*iac=K5K>RjyBLl@Hk!(-vk3rcQ2i8>(|W
zs94uYvEUC~GmCny)2Ff;^_;l&K(=x`FXl{cE^8X<Tdx*f8Q~M=7NX#t#F4Y2nt*=c
z_t&XZYCczL?;1p(aaZIKtu}82@Xz1jlw^C=(?&KvEQ<(Ty1S2N3T=Iys@NROepguN
zf0~&ogLX5U5=ICWraF#r`10Yvx@0nPdULZY_=)S#(&dt64jbmpK2vq6vra#aCmfId
zMwlE3<Vm}$Mtv8~7iej=#PY`VEI60u$gZCevvt<4-!l7GzbY#+yMD*nyd$RQ%m2Xw
z_C$aDcFgk9Ve)^`-s`*r)y2WXJDBZqUpom7evpn%9n16`L3zA-$=czxR5W9F87%g&
zI&;=pXg<w7E*1%pG!viYR5<2oc`P_S?rrFrjC5_v(`TLZTn5HWKMsv|jUz{tpbH*$
z`3cEgSr-qZ1SHw*7cmWb*Xm5SOO)M6?q?bAgfuTW1|}>hl#{n)CsL60i#g89G&QZe
z*)tvM+01EGvyB_dIyV1ic@3MZweNB;1=bRGtMzmg&7L*D1%geF;nB`nIuC1+FW`(t
zzMYU4IzV4YT7fX8Si|t?>hPBTE<>Y9FLBOV_^7=@_1e6S(K8Jk+V3xmkg!;s22%Gi
z`+D>%rV*IX`KfQZ*sWm7C`nbok;I|8j=h#PC742Rc7Zf)W09E|`QxvX;&5UKlFqTU
zpr~k+<&!!UckjY6eO8;(>d(kwRpA|;Qw@Lre#?=l0v_I$EI%aq0CnKW>S3to;<YUr
zNbU8ga@BBJb;o0V_m&d$<1~WTc8qS1twd4%bu=6YHB(*_F_hJCb`!2UQz@FG;w4O_
z!xuei1MR163GUk5)JX+bz1z7#e3LgmA)D>8>r*Ih;H`)or*bR>(^vE}Aic9s^}K)o
zo&b_fN0>?n2@~O2g-0oM%PVaYC+}5DGb$;`MXG4iY8h7uAgpt0GFV2osv=Xu_9Vyv
z_uC_bjEtI&eJ(y7X5Y<g((M6mRgr_5%cbGs7>zl`Xo}123Xk1kEu98OV-dUSIN7c;
z`fxq%7t+p~BM9a+)`doU-&8vp;@ZI5-L38KvSI<6J{+gKSE%ayM@PI7?EPjFXw$R5
z>|(A|O{gf1mg_BNaBu3GnwIXSLQ(EXjorwzZ&x0D(NRF9;F=jZUJ;Q(Ny4(<+zwpY
zfsbE1FCTf&3tQhBl~?xc*S8qHU!hlqe&jN^iPt(bpIq~w2~41)A*XBfqgU7|drT6G
zm1aLR@wdZC&KRKO>0TM<Z-$*?p7otfZ#$Y6NqUd49hbGOq|`I$5r-hO$&zKK79$x%
zr=fAnP=Y85IPpzRhPw^h2OWvBm=k~xb(_ckaq6JOajEMbsmRVfUNn0V))(D<TS%Sl
zJzwUQu{2N|X9G<^w#_l=#GXBc!6HX1HhNWS%O#){)zxf*oE3%Umpzh|;xIHta?F_Y
zUed`l+YCW2uEj*dfR#?qQIp#3wU&-p6~~2UL|035qsZUC{=k$EaBNSDOQ-imr#17$
zGxuqk3jRov9?l6oE>qen-ejrUQAX`<UvJJ7z3!V-K~(CeW1F;zQgmu*YsMH;%Sz~$
zVdLRVUOwKRX4g~(GUlGE3P1d*SaGfbKlk2$>Tjk(ozL7Cu%=AMm8P8T6~v`bPW^C&
zb8UzsqUT+WNeparCtqvk;x*_@FD@!s$DSD2OwVcY%%Ny8n`@URy#E~HD|5ISl<Kzq
zBOf}PO8jC(DP@3*eP)1{?RHM}p;!3djAHcV@F!(^Gw;=X_ubsV$d#nfS>{4uWC9up
zE`2+?9;HQ$z_o~@T5R?=C?@{dOSbgQdKi|1)F^RBS^8B}*i`dJ3@`*II^NFa9F!0{
z><0a$ZKm-p_uEj;v{+A08cn(+>aO8(mE2;>NBm`$=tyDN6-GE`DLs$~FK^&s*Ucqx
zSs7@W@Z?WP&kV<*)UGV+^;UKMhdbKNKE>2rj~hsjn$u+F%jKKYiX88UAxfd<uC3k6
z9KWB|fa}SW*Rk^qD@uM`<WcFys(&ZZa=ptja6RJP;~$~P9~<!@(~geaaF<u8)l~~E
zS1&WVE)Q~J47MCE@94%mwBGXtHxyAy_k+dCGVB|ZWOG*eRq**Ew;<k|*OJ;mQndm=
zJIcu&&X3#3!<$Jzn}XBtU)9Wd&XJ;yllJ=u1~I4W=15Pz8EgROZSHH_2-k_VqD@R~
z^^3#h4aK*dH_jhiTDe;nvrJ+7p2r3vR7WUyD_bsYI|DD6QgQJ5%qB?O%9!H6RMLqN
zPZKMX4#1>lrHqNb=<|=f5}z~l7=mxs_HPzXw;20u?382+*hl12kZs@o)D=rsr5xFR
z%Eh5pJ?B8wKZ2Dmz;nD~nX8oDWKpL+T}UhQdercwxuwg0C~4z<T%->W-Ypz-R^&CB
z){e3Uj~@?}h9~Ga;*XdLF5ZngX3%#5Bc-UMhMB#+(lIY^@8W>EZ8f}$z<;r+&~}9}
z`e};OjUF-IBf}q7J@VPF<*{>j=8*bpbmqkyT@$@#JL%Bw<Ab9wFj@`?dYSMDk3&GW
z9x=RfUA-qO6F#~DII`K@fme;yu-0p!+CH%Rh&|2Z#zUUy<=ul!APs73fKm<{Bhoza
zV@5&~i>w=O{}x8p%<DIwpTtPI=abMRH^mt6i-e->wEQ?yh%Fd7QA}eo{-z)@I+8^X
z!<AM-Yp^T4XMo!;1bo(e_rb@w)k`EtI54ecI~BfJDWI*o95_~*8*8S?nJuaMfeA=x
z@5l*Q4f|zXI5kirc0Y0|n|gP?>>E1~lV&_UzbH`xVZ@FFdpV;U{AzXXx<{1Tr*#W&
z*&NuNl9Ofu;goZ1V!n#~EFN|%H*3$wa{_z%4k)<+g2(73&m*J8gfXAvFw3#--$`+C
z2+E<2z{iD0dsUBH{_7O(F_EJJHHNEr^rL)g#!Oaz*eaqVTiL`a!$d+0{1R)p%>2qC
zpLW>FS)eCLlaV1`IqMg$TCUa1wWsG|f093js!$QH=E4nE>&Zz4yRj!^K6WRwQ7=t6
zV-B*Q!1IX{KEP8I)cQe@l-*X|W888w9XU94^d+_H#Mp@X-Ex=HX7E5PYcIJr&*|gD
zY0^MS``RXTAbsw4UVFeWQU456N+Dyixih^9!-B!!BZen4w}(Yxx&iZg8cD|2Z;>!|
zd%>^eg!EK@Ssvf8LxoZhZ}E<1?`{tWaXGTH6@MC`cCA6R<x6D=QcCNTLRY*cceWT-
zP8u=?SX&>dJtt?r^B&#b<{n+&=F+nT?(|uj_#HzKVkh*EvSRmmXmrxvm160pVTI2%
zBnnMo7huUJIJ>eORy+|_j*hu!i@t~LnO#3Uzl`#ZD#GO%z@Lv2<-8t)s}Ia+aNqhI
zol_SaU8-D&8iJOrWQ?q+%!fp&?@|06efJh7Ngob!x@)cL9-4G7sAtp0GhAWgA_1e3
z2z_nh_wUNB8mE#lW2vk1c;7W`x<VSTqEM7{QJ*!~6qW1qyeJ_&{y6aouJS45t8?nZ
z?^Z|CuiG(!yVjfUM>L*~wvmU@8evL#EbZz$nHSs101UZ5o-09VfjwUJVJg-YGXrM9
z;3=o{v|H>XB$aWfNbrldb7N)Tf_8O`a@#91?WYrqvO99n>PS3ot{ielv-P;2C~Cc>
zR88J{#fsBL0e^o#L=L1=>7oeieAKj3*6*%F=X_5067wxV9bI&qI!ETL=f{hEMmQ^^
zaX;twLEr7555ruGZqlVum508T)u{e#Zfii5>h>;86gtMEST!g1Be37vvd%@tckhTd
zj)pWg?9t=M=(<w1W$S8Pg=OG?lOSV)`{P4i+I~WVDJ76CQ`{Z+`$3k<!O?!H$@6IN
zQ=P4-u<+f_ioJH<Hgt6KcHeeH6FDafgxsLb%h{$Lf@uqFdXIC2Y5x%CI=%2Yb#fq^
z?oy0Y<f`QjuoJ$>)y_Uu@OdblVmuI{6M~O5j)dZkLXed%Jgn>K+UDq>+iPgD2prKc
z`0)=o(%G^s<5<4c8DHjJP74?&Z^pf|->i}U3VnQ7SrEHeRSo=mPwjhj{%#jhqNVOH
zMNo8@BiSg*+--8dxuuu}w!NUtKWnnTZT_{$eF~aPK}PKnTTc(f(9~=mLm=IpkAB1C
z|HdJU*tqDU#kCLj#re6z+)22*1D^fpvM9}Yw$BNIz2l0fb4UgJBb_NRmd~~a++g#y
z$xY|rMQ*VXt)962%@@}(DD<~WYbnor_n41KpQOzJ-C7C6(g#vhb?sP5GMNH(9jxbD
z<14L}c%e~iQn}kkZ}?*_b$F+1p0yBD4*kRgpU%1G=iM7CClitnlt&im^_T*ZUc)@j
zh#7Tu=42%rGR8=GvnN9~W^%(kdn3Zlcx^%weVu2&Z0U2|!I@k)p#c~3r&}XA!<GS}
zlNILw`xt9=5kRKd;x$nZ>_Vg)IBBxG_E~jVAa1|d-c0QUcn;W0|3b#3H5U^L+SC=b
zLWkBi08$dmjfaN^VOt1cS=~o)+=gM5`NasaZCq~nLNfil=#DJzHud)H$xK`Zp%qo#
zWQuja=|qn2S>K(mhj$78Om*C=bmFgAJ$Cc2(x>>COs{B-kiHt}Ov4$1-T-(7?NIBX
zG2M+ysxvEeZVTzWJjnx3iGZnF5-wQnHJLq>_2q{@o@5&RG4gow8mAai7J?{J3l2M(
zJ=F@3H~6`@Xv25L?6P0*VkjxOkmc?L1PDZPl1o|`s{C%XI=7gy8!8b`={O?xQe=iD
zrOu+N@{he35R&jrlKjc;i~C5hyc65RHb&C;JVJxK;p=|=h$TftXfPK!Ry_5*f_7!u
zrLGdL|DTawLxyrT<~dP|cl0Hw1yOTLFQ7a@WqC`NXId~e1oG;gD_=^S`g7={*bh~c
zh1tX((t*|9>+2fp*-ndvnA(62)Y}Lbh{z`fr6F@9q*)6Fey9&=|27xrE?I`%jshi!
ztXLOZUyxEEPy|mfT1AGKf{XNdONuQFC-)Dn##9TRQlJDWOeRe^ey+FXo2QW4@_v%5
zp-l&1eQl{~bG7}~c5MmPCHj{7n{^=@R*AV{%A<ViPdDmM$aUEYL*RPN*`S8-{-hmd
zUt!Ip0gb{}5k0XWI27ANYl6GhOv}9V2|WhCl*M_EIhxwhc5l-vf7+lL@gy(ZWDbY!
zoC{*YRY0*7n|d-;@$WWY4B$*y4^Ve`Y7jT|RJ||85*x(yq-+H1FM}2%pn}2?euqk6
z$k3w<b}wKe$u=s6IV6s&u`!p(-3_Ly#_?r!*(<wqL?}DWUhSWAlvlaq4J3|&im6Y6
z+|vu?$+Z9qIS?7K=G^azB5os1?os^TNfG?!#07hE#cT`=X>c4U6?C6nq^PjW^Oiw^
zE9Y2XfawCAU=WBt!cIoA&<Tvjzb6JD#vqz)$}9!T;JTlP)K<fOZ4VFfI0mEFJ+q0<
zF??laf$#a_T<62~`vkEPcKSp>4DTrED55z<zkR3C&;~$H(+;V6Hxk|YbK%P0{QdhI
zT-atT)J)<<8Jt+c6<(n@=F^Du1HNYk$S>s1AT?2na_;F+^rAK(Qu-_HcD7+6tM5Kn
z$}kg+c2I%TW-X+Exs!Ht3`X_?gF^)W2@8ffdBt-;-$^ON!`<F6mF+q;+o(U!Zw+bH
zs?_-Ng$qL_lzr)gI1LD-g$f=3$nJJm5D))@1$;0^04YOny3KAkAj424Sq|osU;O<^
z)QUb)U_Q~*LH?GoC>Vb|`B$FbNk_ff5y{UoS4M4!23D(TG5~juBD_oFN&0?P)=s4Y
zl@`S)88bcaD~{VAJyCfgcuZ?_TvRUOpHfmr$v`QDvebd4Q<tJ6&ztTxgA8?yI8y2i
zDGXkciM!WB5A)RLLKQ4?jlx|ZkRr5a`Zi#5g^MS#iO*!XpQac=AH~0ZzTy&o;}9SF
z-W&Mc=;3HfRxM`RF*b9V8517!N;20F@^Of#sZ#29Ib!ZcP%weub>%vllK2sha6h&I
zrU=+jfa(S1lEW~nB>8Yrjcv{7MAoN1GI8xy1Y7M8ko0wt_Y;DI5)p&>+UE%D7WHHu
z&cs|<*^)l(kU<TJTtg63u(YCHE194u!WgIiRV$c|c;E^07*bA)*|~&*jYJ`CaPeME
zOw(V;#?G6c<xU&^qTn$!uERzsH6dr@cFS-4JM4`8ra|g?>^OF^JC#x>TO7op0MEEe
zAa3G2e5>#Sh#^RwXZ={k!1)XxW5XLPCBO3bC*OZAKN&~i)3tq6SD?K^)A4mK_G0zm
z-FZ0+Z`Gy#F$w1p7X(}r!8i=KZEFHS49r+4A;$=^Wd~*$4;;Sw`mc|j(DLFyo*gh>
zSshh})(Cq&R$f<O=PAtc+fr%ij}wfP8up)rk2^<evJy7dpM4(y1L0`q7Ti>Gm0VU0
z&m|xlh{?X1z~k8Jr3kW=*xxqdc7thIpBkQqJxw%nv@@u6(^*(V6fpb@2!3PUPpg*}
zt!UxHPFiZHldmON#-f?#x9<90-VD_co&lAkwIGOLY+MENRg6z?Et_+@?G-N^xti(o
zesz=Qd)j09VUkh6?>pIdlW(IA4VbtkQbM&fp_1&P_cHwWAHtINanY_<^##*72UThL
zzX76AAkZr@HuktzaQ6SynSj4bIsQo~0ap+fkU;$3r~h|RkPX!FoCEkyMi7b;Y2GIk
zB@~eOHTW^pR)5U6RE99IGZc^}t3*dnAERc1q5js}mD?2rDu13=Fn1T9C2vxi^8}>V
zzg_JzKgRv%E!W`70oOK|@VHz5Dg+H=O3Av#a#p>)9q6)^FV;N<aGw=uv?Ci&M_xIW
zrV|IP*S3N{EKy9bhUGfgl<G?GPjXO@wCPsst64qN-~GE5gTR=bmI6dKb=h;S<9LCl
zFwr(ujC@Fd0FnS$Un9w`F+ry8u${_{tgwIo#1a}u1>Cnm3^5`tKW<S#U%%l#T%SMC
zdvF2v`BZ1LK_fJtfNod$)T!hBBu@;WYgJqPd-G7FMVRpDIVW&W%Aabk1HQ>I?$D0c
z>BQlrbU3oyD4<#@Ec0z72GF0zg^@gfMLR5!HZ$XsIV}w+s7Ni}ZtoqHDIgGxW9ZU?
zc>k|ulBkf0%>+WuRIo_&>sSx~0EE>8KO)%^1JL3X6?w#4N06_RJ@0FBV>4I7FtV(3
zQk&rgG|`ARjFy7|4Lnm`!11+c+=yf+3bE_imWMSg0Q8Gm6dHhiP$#OnG$1eVN1|TK
z@ePIB0bc`woQQ@t@j2Qn88BedN&8-7fbJ*=1pc7K&QV{fhXLzr5X#z_!>*$ESDsh>
z`3N)_$9X`-%|H?|m+~Vy9@(^M9rGC=Q~?FGCCxu6RtwkSleS6|)7Glq@Me1vPd!!Q
zT&Y`n&G<B8`sQENYE^C`t;|AgLcV8ltOLhHNR9!^UHlP+pqx**6UDS^3UB!I$0>d5
z;~q)>-JXX8FIjNfqwDfqgiM6i@c?&*=EP|U64J@15@x)yrHFI+uNzH~^o{Gxb52A%
z1QHy~bUrro`?xUA?Tq5msA`6`_l1vcJm~+r5XAJIyq8$uG*E>|`n?ntGdd7blSg0i
zeSxfh9^mi;fyAlsJ^r%+hza|jxE^rjeFIjd|E~XE1aM%3ICv!r8_xTA1$6h?&)wY_
z0LnCw>C=C6NIFxLL7hFyp{6AiLVx$|{bykG1StWz9Uvfg@eg%-%Bokf>kf;4FkoSE
zAd&}o9iI9~;M|#8{@=wE6S19%=SzfXlM;f_|L*=zHB*g?=JG(R*X4%bCXocF8#D+c
zcK~(EJRc6ejgR_pR_NiT1xzwQk^i1pUdo#qw}E9c$}e*C+p_;&lU87p01}VHS!ppy
z)4nMHa+g4$lc4qg3d<xXzKVHd(vtyYe}Zjy4Euo(z?J9nU;F=k`aj+SSD^l=U)zZ)
zkZl9rnRcsiTa|{wA?8*);Q?n<qoLEx%e{<%o4S9C+jbk3yjAFX??-XFfz`o&{~l6L
zv~UT2!KWZ`P7Yv)k!Px#^YbEgU0=my%@S2%aJT2->m7OQX8ff{w>#~N5{9kh{j{9s
zUxr_9fBfE`M$4q-2x2;0Y+eoQn0}lg^##T^(LbfhJP@^T;PkoWxZSZrCBt}k-4UEJ
z;?7}<e89s&hy&j;^5wE)2j+_NElC8-fTv=k^<5j9<Z3br;QyO##m=)iN8b?25q4WB
zME^(FD(l4C2v~S<V~uxI?DlJY^mOBw{l1xcx9mMC+-eca%}~|D&4c}1(J$W&yL{aD
zT-mAo%q@?+_h6UcxN1QdEOej;R8G>Vq++n&efNF(!PLz1U0enTl<;yBu=k&fCQr66
zH)kGv(Ch=8o-G1yOYetsMSAOuoPcR`Q8$)xSAYKrHM!y`GV$}w$+a)nor)@uU#I7f
z3w^)}#;gU{ABaV<dhClx%k8d@gb&K`Q>f5xj-JNa5}G|+A%{g&U<Mowh+w)hCAD;Q
zt_{T4D>3FxuQ9#dK<8UIj^clv1O0o9T>7)CcXQ~e6D1FoZp({H?SX&PqE!)Riw`fH
z;{rFM%;)vo=Zij#4>woU|Ei&gFt>iuSd`?Kk)rpCsS=A(u-n9bF(tiD(RydHqrU%L
zbYhs<3RjtB9LJw^^Gc+3FI&|@4UW%QX>7osEX*#(@1EGF4;ai%_xE-2k3P@Cd7pwT
z{>fQ$2$aL`Z-7KdJ~+bI&%tY8RkYpy&h+F<hTe9r_pX4kPWA)7y9jxMs?YRX+?D&-
z&!fFGZ6(s&D0VLaQBNt)ejasmS*9#L6@i}S$ERBt9-@QgsrBx~KBgxcwH&@`hCZL*
z6wn5|ySvd)NoQa<5dIqtN{3^r)rQ<PXXNq$_BnjNhw7iMfRo}DhRa9eLzmyd?M_p5
zKOsvxv<b~EjJ!CS&-$)9UXKdwU_C7vC%suYFkX4B1?8*wb^7<bv&S~DKJp3Z>$7xo
zpg)n0UA{f71F3e#5UeSN#vE|0NX&aEW};(R@sfWzyfdp7YEq)QjuK-+r`<CV;ojew
zwe3gSY(Xo@#63g)(=ar{7g06SuRZsx3`-PG=<Wg$+YF3mGhof)0VbQE!bb0pj>c2o
zbBx@2Wq_IIUyoTTi~RnRDUnr(#f7an#@x=mhO`{@kNP5^k>M2!c}Z6-COeI7<<S47
zlG&v*qeT*X3}41ehnML=*pP3bp)@hj-jN|o9EBJZMDuR~iTkoCwbE_$v);xVot-GK
zwqEI1XH{cK<`xoMqpLWvPwhM)O1BbPgCX1yFk$EKH^v+(z?8W!khhmnyj!l27`q<B
zU%Y!)*W62BdESUH3)@;<^w<i^j^UdtmP~g9Y=kwyi2~wav1#(Rs|tifj4u2kq>F?H
z^Lbe)jB^Jcz7XIX-!WRX`AoeMgMAQ-_L6o1(G?fTY_O<vJ-CT=_)^EbymMmJuF!=r
z`XYQ?lC$Tv*VavZWtJmDX?nJTV)>M8>1_~2d=y)JLm8a(`?jg$=Od1F@5ej3r;fBO
zY)za63r2?SDen-xIT2?Br@XhzzFb1BlgB2ict_icfbY0XS2~m(1VV0v&{gMl6~=0i
zXJ1?mPZ3S*%Q@U^<d2F8esK<Dv3U45!|L<zAW1Ae`rn=ZFZSLutf}tX7mXE#S5XlW
zX(}Q}mEH+rp%+DZmk!cP=uxU5MWlledZd@2bP$nVLhnVSh7JJ&gpfPq``_o;`<#34
zxBKm`4?GHM%{AAYbM)UBqrs;XUtN6IZpGv&_5?ccQ(o(Pp~-Y!1i_bn2DP}&p&DF+
zTMO&ofnL9SP`C36XN&I4=ofpXje1^D{@{qOtR36ulhOY%($H(~EU4J)MhV#4>h$EO
z2NdQP<5^)@iDr&9xi<eSAdJ^vkxpE$%=4$d_VAF^u7`PE-czrMpX`}T)nuV+cdy@h
zNyTfxFXrPIPW6Cp&`pDuD>_suZroMEvNOXU{nRU?zbk?^MALHbY<9vu5LR=z4YW14
z2zN3E34)xr7_u@PG3C-5$VgiRo$6~?QIi-jp(D7t{u#*aO>);d?krTOxTK5LW+*gQ
zmc4&1K_UwlqjE?iJn3_=7nihnbeQ-96J{T{AKZH(b9!$3SjYKA(!zld1M16;1ebu8
z{f+zd1rJ9&83($!=x=k4B=Iyi))}_61)YN=-Uny=s}T*SQx1~v_|ohgJ7F$c{V?~_
z9a_64V(~~2#*$&nI-|si1I1qU`m^^?|H^Phxg>!Tr^MqMp_imH!|CLK9N^2Oi<zrK
z(Ht&uE<C40eDPd)YXizE##xdx+ZQM2%IPe7%JB$$_2;dwG+kV25xJqkG_Gk*cApHw
zMh)zPcVgeZ4j+tTBS966X=}?xz`PQy7dyq2+3&{RtZ>euXTDl-IqUter2_@-C}Wh<
z)Po>i8Xhza8C@V-0b{%uW2AR~zv5@ZL?E8HK^Bm7>hYK^u}acTuR0(JdcT{o+frFK
zLeoOy&HJxkHrj19Zxp@Y;O|P|iY)w8Lw7{)r1)pZ{1xs^9=a(%mxUQMhIO0*$Kvze
zPtvit45;UwmupXGLukZri3q8e>{}3r29~c;Rpqdn`IM&vorJ>t!p{rSVM9oBe5pgw
z*Qu4OD4V-{J!o0M)_vQVDybuN|5vosBfa0ZvbPE+w3j`<T6;b47(!(ZGh2y80um)v
z!-uS@q{tptD(cR>lLUQt|E(SP@TwA^m&4skvzr$GpaK&yml|JZeXV(IAvT<L>9N#c
zbZ(xeCRbkf!oq_4z4bo}_j+gtqViWSDZzF-@0V=>2A%VYr$8m%lW{d;Zf9^z6I}tV
z5TsXG0ZWwzIJ5M$=hmasoQ;?va-W`vm|kXf(R{6K<$IB%N%wCX(a-B&&hUMv?<0cd
zwHSHkhNAv_f15KG%R6oLX6&IA>jc%7(+hN&meHACCT1vOq{!6$K#cX19R9ddtKD6h
zJOsJ<vZ#CSt$Yi{-`Siy5(|gF)r?R0A}>o2owb0iF+^3I<3bAvg6_)IQ}_(jW#B~6
zyPtkuL<3^|y0yhke&oXY!M94^oQB<%gbD^J*Aue^kZbD(jgkU43j6~&Adpz{WH?0H
zx7s*Q+(qM`ynkA$5;y<cxZ*R^+ya`I8t>9D)XQOVfbO^oY7#((627&G&_c8s4f7#t
zASwn)j|A-9oIyn4hBS400(-qNsS5xo=<rUg+(y$g>h(oIRZIOZq4%a4ht_!w-l(Z~
zG@X?;c(irh8yJS>PAM!0*df0Xsg?d0UpOrWsa`0*L*;cx|E9~-SC_N8T)tZIGG2&d
zz))v>@JOxPHXy{Z=!=l*tN4$*?0LzNKi|G`voD#b)3cr_Ijq%~EnNy<%S=%exIA}N
zN<{Wf8pl7!haOZ$%CcwW%1*JL3`?Wl79=wlor5TW6kf<sbhR?I-=I29m;;||4fU9E
zmgFw4`WjiKt%dp{_rZlMP;}UJ>`&XDgAmim)5~OuSFJdI1RCUTv!N=tCxRl!JT(S{
zjV#|5Or0i6*dhk#`{;QM)Lfsay60b7iG25GtSi|_uJoc*&4Bx%2<Eqh(+@+*q9^%_
zp4vM!oRA-`Kb=U+rw{*(HbsjBPL59f=wyA^K_@<ZuBY`(R=N6lyB`IVwSldVsfuQ}
zebnY1E>|-}iQo5%OpCAhNmpK>emy}hEC#h#7LZl5r|)x0wex)PhFx<qN5)|D57i0i
z<6=bv1=EBHxn&`&2^~_m9);Xb3whrZ&AB{N&-)AP=sBR`Ni$eGzRpc}$5_T{m<kl2
z-Ns8rpb{blABA|~4)l`OceV>k-!kJc_d^8NPWMAsz9auoFh%jqAO%=<>9hulju}62
z=O{iGRMhgw-}KbZ1D_`SoJ1E4PI7TyEv@S6oFW;ys^}gV1ah|*CYzY0)(S3Q2FYjK
zazFN6FrN<l#uDLF@@rXwO58%)jpp@GmIzMi?I{q^BO8}q1)-Ze>x|Dp*w2&5`;u1Z
zw1oNOKavZ^&od|nT9Q}@ysKjAw{-f_N&nkl*SKRO*G;h!c|TY;*cBgB_Pln%B1osK
zS3Ls#^lCL2fpmtYX{`h7_l=oT&en(+Tt+1pl^-hkD98q8eH@H?%yHTF`|>=6*Xt79
zw}K_I*oNdp{=!>H@J^&AA_TPZCe0%~e5m-AkU2~B=K(JfL;v-cpE(|7Oe=KRS3fFN
zeZ+15QtTj4xx6KradZ`X4U!(8ew_>Q<7>0`RRtl?C_zM0rC-xONye)^W8Zr`wm+^<
z!zt}HDmWm&^d)!GK?X-gK{CtN?z3zPcIp!^D)KB^(k*7WD|@a7Pn<8PpsM(dRg-V;
zR})~2=m=dEuVH{lCy^Ay@K@Av4R4~y+JBUGtsMv+<=#dQF*0#nuVL@!Yg&){6?>64
zvNm6*mkssKZ+N=s_)X#Y_bw$9V@S_Js&3AGiEO!BxBq$Oui+_Y4|!MqQ|$%hoqS)U
zDH^2mMnBrnTRX?XrXG8epKBlUs=PITr7r)GSmAN5AvgbiUfNTefK0tbo<cXEo%m-a
zPy;W<k8BciFs#D|{ycc()*9?Z77%bolU`@&tcvFSRt=pjjTdUmxJN8&Vscv471Hne
zZwqIODpGgfs2R)hI#(lT(WkQnL>`OR6Y7c0^1cKvP#azbu$3Ce4rd%*)!I0Sj`lWp
zvAyQc`Z+!W6Q_fGmdy)ByBwS{N;Cn<l9>r_KP<glVjSXhl7M`apu{|X#>1j1;x#_-
zF#&MRGbEwyiz57K{IY1-a%Yp_HMzsf^a~q>*$RF^Eu!hMhm^7%C8d|H_uS$(U}rwl
zBV`tCZ1H~iUcJxC^Iu`lc?`WS1Jza+z)B$BwrXO0B#cfnY}_W$+;5~!vxh|4--Lo3
z@i-5f>IE(B!1GkiUXO$wlq#>}jeNyw{|4WMxPNslRp!4BBN!=V3x)N+wxx+SuIkH7
zy2W9BA(viD`^%Z4UvLpHt><d4kzp2vu77GCTSbUkP{SDqC@fc}rB+zNGXXP`AbpaP
zB{y3SeTvoB(&A08x?lKcmd2ld{;_QtWkfEMfBYHe&X!e(ZO&&|I<I-+sl7tM8uP0D
z(-{aSC}s+=nOaTCq3xuOy5({BuzE<6YoSxP<L=xmnyR0-z9!0lxizdvYb?-8CSZF$
zQ~^p!;WuZdmQTY6d1r2741o+)dG_RpzKYkkB1V12Rg_A{{A1Cb_9jOIY>EG`*ecBd
z=6ol8Yt|y_k^%J7>g`t181`Wba8AnAfO2qW85X+~p`t$IKeDV~aOn@Hn$CT4j-B@A
z&qgNK-_|9wVVIs7SmtmwQ5XF|H_I4_B*m@*f1t6>SHNf@QWT)Au0bPi3Wj9m(k2~h
z$0;W7#g~4wNya)iBIdO}J|2#wVR^Z;Y?5a$ooCn%fy4))5kOh?ci>(s9UAluYSFp(
zs4zQzQo$$ac`0v87pr#13d2eJQSV0bg|PSEjwQ}RzDj~uL1Kfd7D~(Qf`xvY<Vbrr
zy9RZiotY0if&JRg)%S-oeX-BxtC6udgPg?G-Q1!d(HG^AI6FxHMd`WFak)!*jMlo+
zcUHLTW7E)&>bik_^iFcfwR~5Bg5l+R5a|sNl7X;M^in4PtIkG6yu`1Q%1qF*$TuP6
z<G!_FbY5hCEQ`1Yv(?KL=ZE}>)oKd@nvypAo|hnM-hkGCR|gT5wl)SDqWsG(@AA|?
zS&V{DA1%<G^Y;2#ZWFCS9}{!l-mezFZkkd8wLA!aL6(x-{IpCwP2}+vSY3s%IC7%O
zXwaR<Ie96B5|V!4$d%d!nlfy7Z6hpEk7~Cfenc^CJbF31g?WnaBp#&YXd!rGsMp{K
z$vp>Ry<0Nw5b1|<$&bKmM0-aMR@HhM%hGT}fAsTv2WXC)R8SNGu^HWGJsKNQW5+i=
zl}yh0Xcm(-c{0{|8u_9vOvT|eAxzfPm(2UE`=kNSzTXk0UM?|`28P1Qdghkn3gjua
z>!kG(m7nBnK3AD%Z20l}5=S(&jvgGqZxkE5XCUR6E9{_Xs_P~Xe7~S^%D2+<Pg4k!
zC}u%DabNA_;<g$mai95pDSH9gai;4NP0^s4b%}mA%>zH*h|N)BiR-BY1_g)p?RiR+
zOb}^OolZ#mQb`GA6kXFHnhAf10{H9U5_oC@!lyH@jUM&;TSUsrGd*v7QRVcDuAX7G
z()ztsFI~|=L8F6_$^pT|YHlh8uUH)0zOuwezw3mVp^`2c&3*ASHjjVC5NTT~Ow7U<
zF5a!P)8S4TL;9X?UgZ=$nG763918A4-h`oCGS|8V4jcwj?CdSET|QG7?mif{q3<Fu
zkDz_f(DR4(=bsN_<Xbx3d0uq`iiF`AFlb(^g(ZBXtPstOO;V-wwFx~ExLxU-#3%)M
zcPDrWG>#gttMcB>db^K1NOhWcRIxQVFmZgqQJhYNUFsorCN!SxD)N*sNbz0}65Gk3
zgeNwv{8Hp;*q)>Gwfek<Su;&absdn8P*&c1jvs^)OAtATZ(jSWav}pmLrUU(m@aQ`
zuUEp%iygujrQnM)njb8`hf`9*Yw?@5CAFt%@Tu9E8E*N{)sDDL16SN2Y|!O+&1mbm
zb+jS=IC^see~LjoG(dewNu@Hde6ltRpM~~{5W?%daee2MDR0@i*KBDSdd7Kja|x*S
z&3kY6WqcelP(m&Sp485s1T*qrb$EBg_$Bjpg?9}5o^H4B__i#%N9d^_Xi68_&M!4T
zi@H1QhaEhxtD>5*<%3Vb&A3o1N?BvDL3>>T(@N9oUg?<Hqr!*8(;|n#(Ge1$x!3zB
zE<q=lPG^@y6{NDH5Hl29B<(aS>Auxyyu0IQu|citk+W`M*o)bdkxI6kzS~ckvKjRG
z%Sy`#1{1cb2A4NjknWBcPVAp@i5g+3{RMUQ-#PwjviR`Lv}VL{;LB)!Sm&&V>3sHh
z)H>!e>g>iwR4!3YKB{45ssC0wK8>7lX+w2-+%?0|N?%GKXKT|^>sL?Ov73q)s^{06
z+?Ao!9vxVx*;GvarKHX0UZ+Ue<uOyO9Os0i2hnc_O8kx#z1F*#o@N-UsyeLxiOKcK
zKkTPUQAxxlvzx|3dkO?g0;xTi&p?b{k=(uG;h=EZMOKA}u+zE7VOve)R(tYdbY=ZU
z*nA}PJ&P>`<{M|&{RD#pO@4HucooJv%-tO`HPo5+DQ1F|v9k7Lq>BeRA$MS-S9AXk
z?vbp~uexuPQhSg%a!gx`VnPET67sJW9YM4id*W-{4Qv|n%yxy6-!62IS*P_jzR`^I
z3z#qFkE>8uY@J>YVf6XLa!xg0MCcKJb^l2E)=j@xPm<H_QE8=ld83u|EII~q^5`5!
zs+PJjJ_koMnD<$_2pv_$X(1U!`}z$bew*abNTGK4v~$-f!Jy*T$-8%qB_Fx#-mx(2
zu)j>9MzJD%K2!Vs{dkf`OijYYFiA9}eM*oxIlFn<+UOhM-e;|KTBX5ZosiJ5a(-hv
zm)pE|K=kw%l{KZ5hJ4mr>DsQNZrZHyXK~krHq!i#<rSiCc62i>2EN@)fVubP{OQnY
zIBAJd6-nEC<oi-N`2H2UKq79DCrNRoa7ayQqFNPU@B$|$Nu$hPqcQGqF#9mJrMq3(
z2&19wRi#eJYe!qdUL(R~HfTFJQnbW{EV)7_)c2XCD?H#&A$*aVT-VjR+gnyRN~I4+
z2R&?h?J9sofX(8NI_QrYFvnaSfaxZ!n&ypvc75d4hrt&$9tI`JfaXxIf$)W}N#|Qh
zKSve&db4VFzp~A3Wh*Z$i>w$#e|}!duL8}g1+AOnb>8uza~QlPF6a7Mg^A5~irge>
z>rRK>VDPP+WT2Ef`5+p~Mi7qVkdHh6oX6!E{YE;%^^g40&!#7)xl}A1HQ(}_5(8~Q
zU)=~&#lFfdF7|b0>apprdhf3J31fk($Oy*--0m5Sw`q}Ay^Q)SuNt?U<{g>FYKia_
z@)h`0BmVk+mO_H3n1&d|#?>;j7s`_U3HrykYJ#mE?1sXR%xpds9_2NaoAEXN>Eyt4
z_OJpe7<-=G0;1+>Mg8@^d;#+npBXWsXQOoNs<4!>^ZxHcsZp^?)TkI0v5xs2spD;C
zltpiLtc(teTXcevXOg@7BkJr<5sN1Q4J*&`H=ogX+7Sv|>Hh4DJ*P30?#e5S&hPKn
z>HtXhbzzU)N65soPb}&zEJ`&2m<zn9bjum1u=Kns8CEMEg#VNLs2tiGd~Q5nERyWM
zhkh>-<@<D>c6#C&=giR1N$uoTdP==(VW3s!qH81DHZVw(q8vq(7CDbq@<P*$1JmB-
zxu9Nmv#}#P6ZbIZa%ydh>m$?VEPf+hFrNFrpHlYS@H*S)l9(2_cTc8wvbk)aFMmhQ
z9|8#?8RK_^=?Aqv)o7dOi58pl1J+^kc}d1go18({_(QTEE~~v0ofj}g607D_({%%N
zIv+osV5XFmyUc1?nE7!Ei)%z#R{|EF(exyqK0kpy?(JBqN$;25p_ga6_nx!*;n$1?
zX*L?*bBadvk{shEpU>teF{(GOb~6nMPw#a(qm-peO0s+}N}Bcb^thrP#mt@%wzzaF
z5;yxln?247ne_RPmmXVVG$<O|Pfsf@!S~0#*5RaGc18U8GhG=<o#m<C*PDXPj~8F?
zOAfS==Y<s<`Kb7QkbV*?lX~<km&fJdgK1g*^s85|3>f&WEhY@cB&AjA*x%+MFTB}_
zleq{fy+rbn-Km60+dES?+RAyy#eBDsb8CDISBfC#54mo^lxFG9g_K;H^m9w8e&B5y
znimu3zjiD0M-Gno7%%O<F{x-BNGiw9uc!akgWy)fylmw0B)^}Di#YAzXKH`OMd@LV
ze~Hgg7lwJU6R0cIDxT#H55Yz!u|CQVl4)vse<ljOyyMaBrp=cnbVxU*E&dD@*ADp6
z(!QCOHj+`};S5DskA-orE^Sb&c~^pwQ;WtD7L{chJZ{5>SV^%te4=Wq@MiB?BOvSU
zotiz4?(P@pK%<#m>=#qDo{%V^La}{&)(#pz;0z+cz18N0=);(xZB1c<Z4R^ij@i}K
z)ysC8l~VhmQ7O|m5#F2CgQ`%%jQ3WCuMR3eCfEL!MFMnU6j|>xF>dGJ;0-uwkD+Hp
zm+dAd7uTT3yPTM0)iZRhJTw)@y5S+!INd`oP|{M3T9$*6vA6eatYg+tqU%voC+(|(
z1=c3{JIBfh{E34f9&f5ul>I6GbP_X_VB~j{GJ8Bi;>C1y!u{m)-^0hJc-$IWH7Gt-
zjf?iX*+XxF(zR0QI`%?2g6yW{3%R*6<K8m_ZtUGN7};lXm(QP-l$3n!qA1DjihS65
z&+Ap$=NSqa%Fc;zw$|s8Crgn?Tp<eW2_!ZqNnVh*hL$R-=@YkGBA+h58?xIr3!kz&
z)!u56oYY;M;YxV@;EPCMzt7>iiY(_1Q}q`-W`O?>R>k+412f;f=ip;wLv8@|T7oJL
zG&;@*?NV>9dF5SJF)wbZV(CTs&)Q*MP4yAeD(tJ}UHVHzKi@-`D*YR3jlQ1VLELE#
zR*Q1OlzM+N<_^>aGu3)vp~=ZH_3=x0h^l=1H2x~;5&j2LE#*HPq<5J_0wYdjBFWoF
zcE`8AM1LOP`kPkcMx@?1zItOB<e;~)cE|(AQ3QVq^~yBTE!Omb$!S<EX~}^08hTb%
zm0d`Xx{*dShf%8kVRfB)k<WnQ?L1)CF_K(e4M0g|tI5$z(K;DA+9*sWOnS%nT5)<j
zwhWnlL1PxDKGoA3T8t{ktto2tB3Y?ZlEY>{ei>krGKz6vzxUa&Ztn(A3%;p13dX`(
zMIq8H7v4-5KNELLi=keOHMQ)<Y)cZBq=)y{a`RgnjcV6d`7HooUt5H|%^cb0HkG*q
z)cd{Joj>;Or<$%_93G7`?)v<8CMnY|{!5z&X^Do{&c96e?g`tCVGSAGYWr)WlTI>?
z`$0!oE|YNWZ*rxlsM*1loYdb1Dk=BKec19Z-Y;*Vy0byc^JOlB&Ib!E5^-~4=1^l#
zeCd(cD=yWNV(^K4hG*hC%VmqVUR%#q#+js2np>UpC3GEWKFv0WIOAHc0g5?ib$SNk
zw(xmz6E50?#(G8+WX7G?DQ{k+Ea0D$7I`c(B~<YAlY+~6b~$9H%~sQ9?tw)uYVVvN
z7q`R>;6Lc*huS2cB2=%;Hi`mUZ1o&z(G$k~c7ShSnY;64p`+(?!$X8s48V*<e*SbW
z;Jw^q*(om{*#$}-vcBzekX6vk3^K$VW@*XoSe#~!809=-kQnY;nLnCK{0@_zab)vb
z=jGB$lL|N^?Rm0a-R!WwiQYTwW1)338u+z9uW87S2gM@Q8}kX>NxX~a&YY93X>Q&@
zOg9oY6TCpAm>x9kgWLr#u%+?V>~XNdiJzYt2#Gjb%BeBv9c)U63zw*u3<S^=QsWqi
zv{3Z#_9_-`hjZuN>2FV*fv{b=`uGYEssIXLLedaP7d1#h|ND>s?N^_!pyz#Wq~G?~
z03q-54j`C3ekqfSAltEI4EaP>2VC>y_eo)0rB4rzxmn-r?LarI6x`{Z@7(42_Yu-e
z=_Zg18}94sXK#|1FhJh<8?yndAGoB0NcuPFdVL#Alypf4k%$MP9bF6pdMkHQ)!dXV
z)th(d+b+|iJq)we|A9b$ydjy$KXk+8a@mq|MZa)&%-wt-|NDYaoWS#O6?F}rc+-Au
zfj0s<*RG>U_x-(FhE4jB^Un=CM=zhk*W;mK=KgX<LLr0GeYdY%_}O&*W%&*$9tXfv
z0KN)-`seE^nV!a9?YA&B|LLUS5MTzo7;>zUd)XhjS|OZ}9w-?2##d0BxqEa#v-P!5
zu-^s3{bRRQo(m92DFmE$$X5x2QEJgSySLW^t?zU`Y5d^FKzMaL3`S2MAk8R!SKzsm
zH(hRqW_;v-`x6PB0Ac4Gr#0fQ@ilYr9S4Tik|b9V7g`ECg@YfOYTn;dWX`x-vSu{^
zx|zoPMJ0hb#bxD}D?3*al#?_QMNM0`;NFvP!U>HyY{P5T+hME`PQ>yw?DbX}QAf1;
z;qa5Nt#SUH`>Cm^OoZ(a%_6aphvPS#|5Puh5l3JR!kD;_5Hc#~e+;C-M9cqzG1!$x
z6BisUbWB>p7AIlrRroDj-Okcd<CNQIC@Ui|2Tqu>Eoqz?9K>Q&35vOjp7m)2Jf+0Z
zf_k*0*<zUKXrYcI#%8YoLpo-!K`$HdGqJe9KeottcyiLa`{c-FxjSR9jnVrpNP3vu
z@LP$NMR=bcjiW4-y`qbYi=&8L$j05_lC8A~o=ZP7nx{ej6~a~dc-ZwEz>i2j|9fu0
zkeIWG4Q(`?kiFOMrVxAlFwZfb%;P<=(!mGY$-&*YK~q^ZT}(Vh5IdZkh=&J_=rl?1
z`Br5p;fN<QdL?_UuOyf52bd!}ISHwd{_{qeRadwurxrdUh=S&j?vBvgi3hA^$4>jJ
zpg^im*NB}Cclkj$|46aq{7{Ul)YKrMXv-(6(<-JgdyNo+n=FsaIS&Dd+kagq5O&$Y
z*R@?eSX$XpSVg6QXUima?H<=M0={|T=_1LfDnehg8rFqdUt7gsdYpR<@HmjGgKA@_
z^g5mLtaaZ=u2BAvpSNRWH4%vbOZoWG3By@{BAgd_61S+-|KZg*LnF}+riy+_DLF7W
zS?e`ihN#61R?a%Hraot7OC<bWVscmgV5xYEr)KWhHY@sT*M@G5t2O5xI>yUNUIfwx
zksyX)z(GqI*5hGYX3|9}zk^)#+p#JP3PJQgntw_O-TmDhHFHwGHM4ib<3n6xn%%+A
z>U%U@02!riP6;+P_J)s%iMbY87l`fc?bEm^>@G*i-{D1Fe}efcklZm~cu(G25mj_|
zSW`i9xZ%!})>lc^U@vYCYnJHCvo^r7QD5zacoQXwClq@v&I4}8!<jv;fA@w&f$6)i
zb=<3_R2-Urp~NO8A4a}bG7`a%dxl+<eG~0?U_k(P4ubY$U@uii-9#C&m99#bI|}j-
zg7LL1wE<nj*KUA8rXCkEf;*xzquIv&pAz!(ORfJytt2Q_>0gjl>3PFzD^ah~8xzQN
z3cFXd`gk&pEKgp6@hN_Q$PeTPyT{B2`RKk&!=<1fb6i$@&RW0PT@i`9AMQsQfL$7S
z-zX0NTlZf7{OkdglgL2-t4Kv>kqh!S*h-aIvN1LJdHI}OWmcSb<~$ieIc&%en}2y6
z8{f;@^KO#&+Wzd^&S5tg93OJ519_6@XLJwa&OqK#llbR5YT73XpAvb$U$0*WcHlwA
z5gC}+{{wgZzhSulAO9*8tbcm8uC6W(x9-@uXyv#1`le;n<OY3PnN60JjFy$VYK8f;
z1NMnSXoAB1n;WxIQ~OF=@wFNx;S0$P{tqln!K7!W4dL-eJ|ZHb7Pl_xv8_gwhTpvw
z-Zo!TjLQFmfWKVJhu?Sr>lJ*Iu>qe$`s!_2fC1D&Zzu?arPSvr%!Q}w?v1dwV-?oR
z#Ri4R--@dmJjZLvYuYnL{k(rK8j;TZ8xxXjQW{>=(&u%UIk8OhZJ1!DRUGLgS2j0W
za@vX_t9>a9j&3ICL<E{iW4(O0ywKjk!Lp2=du91_B_h{(YHsNtPlhtzjvG@$2OC|W
zl<2~~na`~J#@!gK$xs=|9%4vrUL-+LAT8JRuN0A%$1%3k-h+t8txw~J)X}BMeHGh9
zX-P;W{h7w2sOXt1v2Eu=9L&&9Bja;~aN$mC+y2UCJ9AG<01Ecq&kO@8Ae%#N%*EX|
zeddA^w2K_kBGv<oTpYzI@FrC{nuc#qO*vogV!|XaHf{7UQGnKCBdI8moAbLI#kcP;
z=H<M8v3_d$(4d#X-Ozd9vY^!GlMZ2wjY)m95C!RO`oDL-J=&!Pent2~f19>l#|)EE
z<lg?<!*2z?5h$m*Y>t&LsX`QX^x(VH?vf-R+gLS?{&qJCJt|!p<y2m=DR-Wd(dSez
zvp&OjKjfkNshq)=|M@_7@_bZO;C;b9T6pH+_NIJ7)VjCp7BexkRn{kU`5D<v_*MHZ
zSEmWi3MVVLF<;z&`2wg&>i~L_1E8Uaio{O#l@y^e-J4P;yV+gCW2L#Ri*iP|0;uHS
z2`mIgVD4(Mp6`1IFinu4A7^p_#Xz{YiomH7)Zu1+TFYdmdr%z8-;*3)m)cNnq#4)j
z>Lm7rZutb;n{j1$cD4;Xw;K>fT0P^r%ph<S%>@<I@B7lho5N&ivOlIEt*QEhNuzuI
z<#A_S-Fv}dy;fk*?9E6&whJwkcD-I>yed2KtRjOXxMu!p1CXMP4Z=A>VeWptr!1Ik
z&p-w*0{~_WJ|CbNc$j&mh4k8BQ46rR?=B*Eu3akEm0c|Paf+misveV^e^5(I3`O;_
zMYV*$LMR(0D)8@zF16nL-`?R~3;Nrl#H5{UjqwJ1E#$H(AB1j#{cWfFyT9+|t0u&Y
zT|4^!*ZWAMV-6#H8|}kIMt=WdYd?0_3Yh;-FqzeVNYBKMF54du)ll$syO`^`?B|;{
z0-lX3L|OE#^7tI&F2!45WuHF`8(gHXoFGt24fW5sPbCZL6t8|8H6otSG>}M~outh|
zIzN_=1V^Mu;g5J0^kbZdEFF&jDMCml)}I~+lQDX&<O8qvmSw7^g(|RT_4JJ3vt;%s
zD|q{=O@l3;wgU!n8dgf?c*YuT31Xe9&pLuRx*Z00<Tp46zOVE~MHd<59iQ$u8x~)*
zi|ZSh>Q?X-I`sth4-dvq_d+I7qoi%+q@X4NYNbYvyp?m4KqhE-CrFO_{J;<hY4RGN
zZM`!m@yZ_p7%K<8dM^!cZ@pZXyf>}854$=gafJCoess4BK?h~=D&7<f7as_H2?Vq<
z8*Gt(kW*EZ!{Q?icO5aU_PM-*(b&`gaGdyw?`PfbB4Xk2)9DS+Jrd~Qpwu~#T5ano
z2$`h(m8C=Q*d%Q8q`gfl`gmuwa%NzByrVA^pnEw%2P?oI<z>AmuZ$X{G-THzExjUj
z4;tu-Q-B6I*E}sGuUq5M5wwiJZD&OR5`lC9{}EV*)eTI>)`necUHN9(%-SsebkBt%
z`E`89i6{1f{7n}5=*10jn6kb}Px3HLiJmO=ckxrl<w70)+5KLazQ^1V$!0KqMEa@r
z;sx1BM9N4}?e95R#*9JHn6Xujw(>HO1OuB$9f2FuwJ^lwyi=_~Gjnr=+0m|fh2vnW
zGUtZX5Dt3yiMDlRYJQ~fXa?38bOr$LNhz0LOhahZQOGQD28LNX#+_0rGJ^O<X9uPF
zNPqwL&7Tyt-d@g2mESDW$}l~`#6u)8r*GKJn7GuV_x0+*wrLdQ)qnb`W1IXAvk;|a
z0Se*<y+b$RB~}G;_&O~b8}{QVrw(6&B{n|u@5^G#h3u!~LJP9$H&DX97H%T}vg+*k
z(;g_OT49l%X>;2bS0kxq;B;Y8Ak1*9cCKbf%r$u+nUe#oThIJO?pH$m=z6fJ{c&JV
z3g7)lTJ2&Z9Q@YEpeIi6Y2E+@O#NneH%SRwW`LbW57(gmmeh?1<iQF6klaA>+rG0d
zH<{06nmTFzEN}vL>MQTx*+C3OMI*DeE*PvvLQi%;^lLhCz4aw!*w{0$PRsu?jvbFF
z`^vUAW&Yf8s?b(lng2!8!1#ge3f;JL=wo<M=YP`lg_SjowY9y;Cu+OQ28pXJU_CyO
z0I`q@E2|U2wj)aa#{*;4rpvt8W#0BMq3d>Rr2B>c@_1=De73Kz@8<=I+h)>qA^-D_
z-5e!#bzX}K7is%iGn7fD6Zw16TY@}&30?_pL7C&(R;d5^rwiUE(Xzb~^8%6cx3e>@
z$fN`bT_s7NPrq%f%)tObD{E`ETPxZXR{fjP-nYZ6xBanXWXA~4V{0(5+FcSzIsG=g
z5x@BY-kgU_>%JQ*biwZ01Sg=CbVpL$S2`M`ush8hE!Tq16J%G*k6+}y?f)4BubYp2
zb{}NDK*&i*0Lb&qYvpd(c>Z1yQ&336`(WMNEp)z$f=8q=t0>}?&g0w0;MV7)IPbeZ
zFNO4os|6o#aY-z%qhvC+fA?K0V5OkptU4*L{O9T(5tj<f)C6OyH<5Bkz;o)T|3e)a
zdHF!E-Z`gh-U}>%kb_?gFpQP1{N=GEu?XGy6?2D<4w!A;+rKkT-=9j~y&cu&W?(rS
zJ}*)`y@~bIOV+dKN%rhM@qGI9X-VBKU!)dzWzOGiWf>V5sB!H7+1pzU<jfT*rsv5v
z&_A>n6vGmj-%A^*s%nikq>8&A;BbIVyc-~W73uo=n3Rr3y3+p}4xhw!{{LSAx%K~=
ztny4#^5n`D>=F~d?ZNu@19!M-*5u;n2ch#KU{}DkuRQ9e6W<)&zTKzhpo(rfM|Q9|
zE-AtHGynYPKy|oIO4p*U%gIh#vHtkbSVf5~Tvb&S4kvDJ1JJ#OSrQ}UKf^?j3uQj2
z231EJGjeir>g#>&m%lV+GzkmYdHE8K<sSSj>=|eZS1_|Ilw4a-SMi*W=mCcFWNis4
z#RFUmmNQemAfKMzdwn;-&}U~Hi70nI(^J#5zU~4FH=JOBn>S8twDHz=pC7=v0WMqT
zT76b}_>??r>fu;cl+@9$`R>n!x4SKRzqpN0a#LPxMoZ!KsUyh$y}gSscs|vsW^}Cq
z=KzPguG~f4CYi#8W<AOC#kF(6G)7*FNtS65E%X1LE8|W!{q?c37@EL>k_ImitFN`S
zDLSFw{KqktX`Tn;%QJ4cSx{<&q!58iAs>l^8EK8S&=_=k*uxWoytK915?`{519~~#
z9j(P5<AIt2E@|5H0T~8B9>Hd+{n>O`Q*>Aoi*#J*hdbHgOaRD<bj50LGS1e*X2D=L
zL!WW-<wjfHdhD`P$T53*;Jwwz1YEGBEBDNEO7gompR$ENrYL>ZvMxDlfcv9ZVr=;D
zC`u{Dk8egk>lML<YZ-Y4Y3MF;SXd%l>>uBrsdA$Fm$DLHkRDfiU=pV}XT0QKB?1;2
z;d>zZ@1{Q9ApI@F_$Pb*&!@ELM#pKAyTg6m`0wi>gWR{G6f;GTD3`W_jY4O39bT7e
zeO82XXTh2giMxP{S|&Qs|8fhJrf6JYVybKBqcZI`UEl5gL%A|$ItQM<_E81?A%avo
zi}bb5ixfO{zihhJ$5Ci8?A~yJ7CLoud<BQCW4S5^Y3UcRv-0qmZ72qzN{Rh$7qYAL
z#-z8Xef(}W>%N-D3dMEv7s{~T>IO$%IYQYRr?V(GsV*D6er!AIGE=?$_$zg6K}t&U
z%G%-lNFC94%XfW;b+ZcFNb=AD90}!xm`Z(T-k?|o2Hom6PiYgl^|;3w#NF4;1m^}6
zxsMNo8=bm&v9v?QN7!Wpzww->0RiHU-ICzhcgcezBf0I)Fqm*bV3<a?MNiuF;9#@O
zPr<E*<jzNVOu%N$2w|$*+8;IA*p$l7ClAPHx%5W1ty|DmrD{7<5iM%Tpg7Vewci1^
zwz4{$N1Oswne@J`tzD|9%L_d{TXoYI^s<Wx!)G>U`nFEsNzi!-ig(|=cANgr`o@O1
z>x!d;5fdty+@99<=e*z*_J-(3X=-wwg#FIFhYKJLv`oQ+NG5f-dOT_a9G}CTR;tqy
z_2$@Crjy?(B@Mf01Cm{Sh9dnAP)0i6ed3PhL47#{Zkl)(NS0Lr)7EfvQ1?Z@^v5!m
zkK^)rf8f!ZD0iEjYYx$2(RT0BreZ9yew<3@38<JV61rL0*bt#1)8aplgyO3kPZmq!
z?lkGJqb$*<`$d(B3{qd!+y{|R{~J12K(Wal=y8ya*r341Ibpw>*d7QZzjuJ;<7lCw
zr1t?QwoUqR74gUW&F1NI0Rha+@8twC+sS?3qC2DVX)_<xd?^mTXyl@<-WDDyin7Gl
zWz~*?bK&FL99%S+yY*FJWSnm#u+8?)YaeDj-JO}!0}l9Jz!pm3tM+4jr&gnTS5ak0
z==lN*qmxl|(zMi9P50?<T6g1yB|0tORakqJ{lVD0s?Rc%9b0n&^6ow`qeKZq>OBnO
zR-6Y*bSafvV@_XXf+CeHdK1e$`ZKB9xM5=SoYkzyQxrU|ZX1@1uc`G~leayT129wV
zpL-7aK{UO`!6)_a>WmTzDL|uwYwj;|zvjko*foOM*1r+Ot(RKGoWO3J9t&qtb<Yr+
zD6_0U6p4BzU}!!{ulaLO5D0rM?q8uRs-u!|3lJ>O0sxv&iy~u!ZOI_=eW66Y?SHmJ
zk}k=w%Tj8e#|RHMGKo_wD-K^yg`c{hwP2sC*STnzDqB5FBzAs1Z6xfYX@^3ZL#}cf
ze19`jcfr-m%F%I<&Vl58D*Zk(Qc&zQnHfZZ*`wfT@W9P(it1;?+g`wIZe|#$rY)}o
z{HEm>yTzF}>s!T2A6hz)H^618>`|B7B=FYExfO$yJRLJFyut4I4r2oXzc$!k&6G23
z>1ln;_PqjG%a95Fv+o3pB-~r_H8^N^bmhDsgTO9#NPuGRhwo<%2Je@R{rK_Y{W-Gl
zTVvHu^SQge?caVUnsV3g-AH+`zjq*Uyh1fBIQ5bJ9$Er_0#q_Il=$V~`vI&Gzlz_i
zg^zAd7v9YG`gc*(Mk4f`K!R(Ec;%qP&hc6a-&fW=S&4mm@TDJ;_$~FlI#`xdy;T$y
z`BCg)AM6u8Hi#{EixMgZt>i(mHPa}l(<}kUB=)*<x+h2RmXSL~Z{=5t-uE_LIpFL2
zH%CBX`^Qrau|FT(n~09f2<`@t=`i!I;<`V(-dp&#p%kW}*7&lA5{856^mOCoATM`x
z1(!mq<OoW0{bwp)t6E<W_eTx!BV99ZPRHDS|2Wnfb(pDha~N%CXgHO7kZFAfbun$(
zfLqJfwyUnUx+{T4@-z^{5z!6DsSd~z?@dA*18hcAK%hG}oc*7rhII~5=j=}&Qd=;K
zVF$kje|#r0&EwCGE7D9SNg*^n{(HFK+)nbvoay#kpnA51-&>_i$-E;eL(IK;7W&s9
zL)D7hy0|$?_y-#`*JHrUs)_H(W<6Z~E>cD|AXcf<g_w$kG3qX!>cdPofM;mht;6;n
zE%LzKhyj#kkF0F%>h}f|we2>#l3{`FPcg*=j4DxY>Ltw9`9E9pIpQtDSP}44f3+v>
z?nL=64I;8%9{}&o^kILLFYxf{h{h?0**~6sTeIUzvl7`iogv<m`#bX^cd7gU*n^?5
z2F_`Q8g<vvm8<2ML#zL;vhgb2xERS!f#i>kHXcyB9R7(SVl9n`IER;4!Zf)4GnO^!
zIqjFd;-f3%eS?$OALrEBYjvomAJy2plJzj>-OB!6`R^L3kGIGFRcY0V*lND`O<12h
zcMj2jaRKJHpC;A6(|Qgo`tWvST(nK1a}ek!FJmNctf=%GWKp>aV|th1P06$Wa;BU0
z(M1<Y+H5*Ip{osQkz3B=w^*Pd?9K~vrCpKTZ#7pETL)Do<5;40UpEteVT$`1%uHcI
zs{5tpg_om71=#GF_5P~p()-m5nQlv$T0w}sRzuQ<m+J2aIV&+wk4x};bM5#uj<USq
z-(-pKem^Ww6F{2CfI+V%;rKsH@@7pm7b)unBwq^%9Yas%D9aY=%I_3_mhQC{y~0`I
ziZD^c$3mU@<OYE0;}C@IecZe|tt{l8;F6E{m)@Ub(2e{5yVTv_^x7U67bba{C-pH1
z;03_Ds&~U_`B$2E0rxx(jwrm^H=PXzP1^K05L~nS_Y8a@zWDx-zOC@hQn9Yj=9L5<
zG4q_k`K1en>fg2<9oJAL)3`zL5buk-jcI~wDvielOzuZ@F=@4gmIx@Zud%Ey^>D<c
zw`Pfp0c)wKBHrc{>hb2cG+Ge`JwDtbrV-;#uqCH<JC6#=OQ`7Sj|NBmPM2bMP{)J6
z9q4Hp?^FghMCo0EJkA50ATi*!1F<=kG))O?_#lRxcvM__m7!B;++uuyWslG!EHo+~
z{eJV|^f;BOMB3)zT=N*8rf_Oh!svX4FgaGB-o`)US^?#egPE;NOCeu;s^<y50ZwJk
z4hu+lMaz}3HM0~P!wp?Ft@KUp?IGqrt5v?HaII84GKtWyN8Ctu@TqfYkxA)#k{5n!
zV*NWU#ZujV%%~BzN450x>egy8`t^&EG?!B-d=+b%=F)Ivx?Fd(H$PFv1aPahdpG8-
zP?VA<a>^=PDIdTjb%fm8P})_-XMATHOvyM>*GlS_=Eyd)O2qw$DUk<47Q9QTf?FQ9
z7RUJ10x_O-kx=^{;>ivr6pv;~F>;+)-_&N^ooXKm4AZ$#(VOBl&RSyorC;o*+QqUM
z-zV<g_??9@vRtMw<h(OyhOO?gjOZ=&a=CjYwv)%lapw_7kA%=w9`d#{mw_Dzo!V0-
zRg?@{dEvuY=27PDo6H!kz6gm@H(`#b+$1|zBR~7WLV2MrCgLnQ@qz^5SJr65R^qqi
zaK?+#Dr!aHAPM}PL?YQLi3#aUr;FDDpUg@madot@qe4Z`wgA0+<$M6kTN7NsmM?5S
zKW<u5l1|uOA2t_+sK@XlKu|I<t}ivGRtffH)6c<ZHhV4Bv}-8CXx2;7R&h<0xVB6Q
zJ-$r<ex_yLKc>W~(OKMkI%qO6P6<8l)?Y)RVL;gF$-+w@4i9CmJB~*UE%)ysBHro@
zGjuPZ5wMm;2e;}ev?T6iUR6qThf{0^s1bd7)#x=vD30WH#Mk3U8f05h(h2i<mkXMV
z;HVaVbE#;Ma7@SV%n}JnM9+6`(9f9~YJ5*Qbwx~HF0WFkcw-!*s9nE>%B>R{2nAZ3
zp8nL4GREmJwNY1<-@)D&M`nq8>adw*NAcOyMM^G-9qq7JDp9tl$vHt6QPXRc*_7En
z=uxQOF7@(2s1;k?TAZ+sr_cU-qkkAzr;m2&=Hn?D3l~0O7Y0W_Hnyk=lEc@8Jw@=4
zF3-v$E%F63T5|uFB6=B>2lebaw|0xsW9291X`o-#&UgF_W_CLj=7T9KXdsNzX`!w(
zHtZU0iIv+sXM_Y9)$FhG%*O5OLa`r1Mtd$t)E+JrACDlQj=S3{R}xS3(Wk`PL*_~q
zk+oKIsUAELdwj;YF0QTE%G!EU%rTuF)OoMGE`;Hj@DXKI4gS2vFPoa;!}BJlaV$#T
z(K*J@MxqAgngC>9ZfzqbqJ!v@c&_q*N#uvZFD3KY#v@sa`bagQu4VrvZv4o`q!clT
z2k967?EWmFsi&l|p-JBoco~fj*Olkw65ZE&sK0Pq9>=-5xh+<=slq&4%FSJI{2KxB
zK3z9Ayk`lTxdiU`sr^hYA<T#z=+$H)keMj(Sj5WSBwk6G-?IA<LBwOX?1@ip%w3oV
zLx<vt-AJfs$Mdy;O1tB8CNn>CJ|-kK`fE09*SWMAEO%;fK(Tr7>nt57WhhikejY|R
ze39=;RKne`GHr?dIzk^AF*LsPXPgZ)^47r9lkMgxmE*&!dz5{Gg*xAMf#aEsrC_M}
ziE1LA$!8@5dVHDVSuZ$>8noR2tw~uaP?^mmYP*pHfOR)D1fNcTNHf{Ri%aMfXeB_w
zLyxR&dO}U!>R;^oJfdK}lv(|`x%Km6A@bA%n!_iioYXe_yZ%Idbn=UPZ5OX)i@!|3
z_)Wr*c;oIj0lqZ+77;f%^q`W}zOmBu39>Tp{rpjD<Sn5KuVdHrzqJ>(zkD&VyKY<f
zkBZ-<=N^HM1|Fy*Z>o+xq5-xC9o@y_D6fEYiCbB?-m#ZC{Y&whx}I&{d!7b(stPK-
z$Xm!8HuCx1z>`d&1^+!qCRK{fP=p>owOALT%?qzmZP;lDaS#}7w}rE<Z5dduJ9v&v
z?<OH0z`Od3#hgS_>F$^jcN!^6+@qkv6#!C^eyKpSD0^$o$N=4Gyu5TJ!)=YRA;O@_
zb9}6}^LD2x4LolQs@P)wJ*&?k*Z2hts{Yv4mj9xHE7PV$&ST!VZ<VkG&v6PK38T-y
zqNA^4+d$1}1@kLcq$V&*7f_&XV?r130mD~cS#X+Id)Iho)+*uCm!=V~<-h-<!HK~G
zr?fi^XFpbvSBXT{A`_@pq8FXK4;Fld^<``4m#jO5MCY#*sa}3BbA4lTkXzhbG~c|V
z+!=V<<VTT31SE87W@_N=X`+Jq&5MSUrSBQ<h;`Mmdkw9WdE;tl<d@S>?sgCE*xA^t
zH0CSQ2`Amls0yP^DQ>e}Rj7)7<dmby&t!y^SK)c@WbLlJOR!sYwm0j_9|_Zuh^_)`
zROszgY{Pc&T5%FTGA1IZfIxPju7btWCAMszby%XxnroAL{H+eQ)uhcP(-i*dlUZfi
z*%sz9X`<S4Sdd*?cVzf^Vd%b%2@R#J!%_Qa8&_-=uZCvN;OC;>DY5qBv~7YFcX}e-
z44_qR4jJbJ3zA1IZ@xA1UTi6@_jWFx5_LG;HPsq?PJYP(deR;Q?bhc_QR5Kbf}Y|&
z#>QTKD?h8s$1R0#k4iHurX$?jIJev1#b`HIgJ(2M(1q>cW)5#LlLx!kJFhkRJv#bW
zezOm9*XSb+SN2wlutN{={sywgUVG{dcH&0Uul9q}v}Jz38^ke6Oq>eSUSVwz?fZL;
zouc(sE-&Imx4@x;l|Ra;^#QmD;jPo`<dkqpnd5f|<#Drb<rG#OAo}zLTV6p_U`YsJ
z^8Rx0o9H)+800uNYKUb#&NM48u_gLnXzRN%p_P$33S64GDoD+%upk}3?%KCA1bJnr
zF16dIQ_6@<D+g7hvFX95la}-SwI)aDx-r!ZV>i``vplxn;~JyNy^dd;o-EsE@?iHs
zM!>RrFR!9r#S(FPe-vkEDR7YeK>Fpl(uKy;jV(6n_Ar^avV-s6hcsS(eO%Jk@#Xch
zPQzPkJ;egg5m~8|d&j#+FWO9U{>YwE_c}ujpQ$|XG29ZLJ&FXDn@rQS)LfQAX_l$>
zJ<mW<h<MQ1+lwao;h-TdZEsHjUnM&==<L4Ko8*FbfD@V#Czh)&5nuj2KgJf7<Hc1c
z&c}BuzkJqSbp<w(gCEShw;;3fr*lGkYlg&&xxjK-p3u_+X4N~LuX}^*pb}qxEaH5&
zp^a8_imuVpE5qK1Ivf)IMd7^jQN0jy=Y9sAgd^K5y7lV~tJ8r!T6+o={kgr{;(M+m
z#ruO!L#ZF3yQKK2dqcTrvSRci-<`_aDauR^m5mEVsVBdWR>H>ZT)0nU@kXq9aV-58
zn6wkf4J!S%U-9!K^{>h0ZM=7*2=RWEvR($S7qi2f(>CsP%!emd5>I^&Rv~vCP?mH&
zMfC>wU48heM%NU-?Bu~KAzMk4T-#t6+CcB2!O^XW7N3;?3Lce_IZGtMv|;Q@?1*3I
zjO5O_<WLMp(pq;6%h$vt*mxa2hHsfOJpBCFkWz9dTT-886A(ykqC6^#d=o)A^`6-D
zu{^QF4tfUM&yPH>bXqr@k(BnF$({*q%Hwjvaa^V|xU$>dqw~!ydg5>W1-tmQrIG+H
z{>6_iTR2toeokaFKUbcAF<!s;$E~7GmGas&1^c>MEMLj{&L{IPIwR;%vQf#)=W*NZ
z9~v{}Xc|w3UoRz=@j(r98)sc+o!W}3cg}4I!vRcPQF~6|TeP+JfK2?<V(wr?%Sf8%
zMZ)18KRUNKL`cv#2_3kX5x(aOVrY8=D&k4>iLl#WQDej_j$20o^lydS10US%mi#_4
zGc3vT%~X0Dh!PO+Q9iE@ao$@Tv(L&oFCH+(Q}MB|bv#V<Zq}3Zn|*KRZNZZSA6T>;
zyrG#MuVd%m<3X>^oTdyK0f)m3{%lumopi#>-!QmL@r86H-ePIH5#qj3%d}mf>SOum
z=eS~2hQi&{OM6$g#!G|Z#ycFuxBkHWMt}X|-qQ&G(l9C`R0}|;GjYkL--&u~L*Kn$
zQ45Ud6&p+ryGwQT(wJCQ!tEjy!S&D9E@EetEPmQZE@!QdC}Mi=+`9o=m8*rTYinpr
z^ZdA+S32Ze8H+I^J%*Fl{FZC*_9h9D8>ihzBZw_Ub5<-i8CzVlT2@;um9VWC{9nF+
zRY_M@f&FZC?GnBc%T;QAEVr<*<;kU~x$;4roWRfAyNc{xsEv@(jqy59iVcNV3~xsY
zb>>%%Ig^woCdJv}Uh>X~6HoV*9U8``hRim<N5(7<-NACFz~HZ*JJ6yug*F@1<GSfb
z<o28CiW?6=2=tMalIcO1&cS7ihZFBiOs&51GKLAgl=Y@7BK{gwRlnXkm4=ZYbH%XG
z_!4Vpg;bGJABDU4cC@=U9nBE;ETqU|*;eoxT6J6+Ja4S2`7PeJahP|F6m2yu9lP{O
zt#tusnS<{#G!0}ZXjZ*WPCkB-YwO|CrRfq$YtTpkKy)+dllfY|4o5s!PC@1up&gtG
z`|^wLg?I82Up{OwS?`N^Z=8<AwR@i@$R$OnB-TqSF_tV3B0xK{2X=;~^gSP74K+vM
zry03AtzRLPv#{PPS;B9(jVY;fB_e_%>K6i;+a&sKYDBU=sEwex5Kqrv{pSnS$CX^G
zRS}DWa{eg(5}PV-<4J4_nq1F)X@|?@MMw?(SOe0*VVv$MmxPmOPD!ZU?G%e|NtR_3
z^YR=CNx?d2mIV7}Mtjq0Z*dbL8^%{Ql^ZQ8L#la>q6+MLP$zD~l~CReBnH&20&b~>
zLD|ux!l}|Kmcd>5fbk-tmtgHi1FRU|5<!{6Ged+|UNv-{UyXEE(1A(1j~)WsAt43T
zKh>pL9Tow_70bfv@n)v$uI0!NI;)6mUpf0F10f)1el0|s-UQ&rWG{B+#*=-AukRlB
zLATrIRqJpywrv{SN)@IPeU3{2XV4R!M8XOV*j}~he|O-Eed}R7W6q0x?-Dl2SHWXH
z(%CwVd##&wJeRLg&_Jx;^4r83wezPeqO>Hr8I&g+{UZcp9L3gCQ4vUl4#LcoS*E9E
zYR#0H>k+Nbn)oc;XlzSt^7^lbdk^KWNGcOIVAF(3A2A=Zm$_}W_w}4FcK%k24w1{*
zeVr%7rzmB}IsWtXVD@z4#r_+4g)655aK+=!`Cz`!Py(9RKU}O|=5NR_pLRK>vpSlq
zKsO*MDS733CTrWTt6_OzwBll@mo42A*U3Sfq*>zAt;Pg>AE(E+4@>m?I&%9PA|?^U
zE@m2^-|V&cc1xMpPbYT<QrZk$#T5PS2n?ibon)R%fi-%~s?)c*)t6xxy%FIdS*Hg}
zI3L3NM^yuPYIfvk{q`@@kC!Yg&Jp6xaB?+vYfK(q?AA6jt1T*so#KQKt*{av?`qDE
zO#v-Rn%@OX+2(^2Zl~0}aesEqI%0j@emya!!=QjrLfFo)hUX$K;&Qh18ODtNiPNv&
zeBnM?6ca9`(71H@T>Pu2+^mH@b1eyc5H{A7QO!Q*_&dWVNk;S<ziSGR_!r+DT~{$x
z37*bV&Q?SfA<H>`Ds<L@`_R7cZt7B-z|xrYU_aviqIgVEx5DR6?Oo%G7Q}N3<`qQI
zvNx^a@lIscZA0|w&pF2IT9=Pq^IkVK-3OpUhsOD@0g1p{b>uy(obyfmbQ=JB>^3$$
zFY+tsycYEYagJ`zy@bXY!U0FgW3u*s_pJO6)kyo`oCHH(LCNHSO?(IIm&f*O1_HO>
zI5*)$r22ay>dPx$+Rn}YS9{kL&{Xs6Q4~}ZMNveWh=O!TD2A#cU}#DaloCn|MVitB
zp(-F<2vwROMY<4ri%1V8(g_Jg>Am+5?!oW7|JVEQf4zCkp0l%OcXoEC{APN~dd>ps
z5j5f);-bFX{JGwxWm-VX>1LI5{v~F0y66jFMhI9)aQeymPT$fLJlZb_O3rEx*SL7;
z(xr>^8dAQN>p%T>#~mvmd;Bqk&a_Yg<{`a8{VMZ;T(tt_H%i-QF@QUz$AT*8iQk)7
z_Emd#T(<6t2E!(`1~aaMwE@4!?Q?=%g2soqy&<hv#A$S({b2`1ux8M6E}4yPc8zu1
z`^#a1{HVM|^J9zw{LU@u+OPchypgRv)vcKN*Oe9%J>%oDaLw$ZvdGg09Z4>_w^a~&
z-qVdC8lYR#+6)ot{gV~P$?6SB2)a%t153*c>q!?H?YIjvIccE~K664Kh}*Rw)aACL
z9kg7F1UWDOY{9aCed4%rafWr5xy8$EC~iD*#2-j#xKyYok=lzXLMHd9H{Dc)xElc|
z01@ZNmz_7MXC3?>rzP?8_ys}1HwE!;&rd3LvEO3D4Ub|{!`Q!W^AxeYtPp{`+d3BV
zvdq?mu+;fL>>#C!X%Rd59&V!xu3iDME*Z-Fbqn)?cWggSGV+<5tG{3I%DT?@A`Sn0
zUj9HN^7=QOoX~r8>gFufKuMek)Sg0A{`2iGRXJ9>DYE=}tTmpqh2nX-_3JZ<$6F07
z+J}|i<i6w2isf6uuPE5a6_D!Kks3c^1wyFy$IYS#b{7&7aFz-Q^1bs@Mt0+Xd+U@a
z@gNyf?mS+<?(u*w95RyxfMf#4@&gSwSMscsQ(dOJlD%S4Tl32LPc5b){K5ljeiBPr
zlH*VP$F``{Qs2w3>xe1@_ZoP{i>H%?4YFGK{Zo8TOfp-jEQ{4;z~=%eAekS^-M4d3
z;!x5tuegzRQx8RkM@JRtuB|uqHmlNetk~Hy%X1?SyOTNghj~h5_URVlQysYsbhpof
zQ-^@swlp*}-Li)^Sgfe{#4iDF^>WJH>)^f<Q_RYog^m8mbYi*Op_FH)mmzRG#3ebF
zK<N07?Kb%Fvirl1&(hs;au--4ut_SG3V|NHqs8e?tl&d7<NY<iYq8l{1Y@iRQAg^d
zQ{l^}`+YK=mWTC)lCC8s1i*j-<XH25Df_fbRFxufBR2FNn<9#giqVuJR_*i59<?5G
z?-s+DvG`~ka{O`F;Rd#Z#onNm>P!C|o&(Sz2V+rw1VA?#yk@RZjoP3?nJ28rmXOhs
zC6LMPD(6j#Yj+A}Gi{2NKS%PWBOpN<pP^SF!pRh0^w80t7LIVwJ%@oLPrPhtM42(D
zaPyZYAWGi7ZN6LGA%NTk7u;?|j3hWijJSdrbU$9r0>$b&rx~eL%i7q~he3>HOJh6h
z_JRxItD=<KGHOz-{L?E!6Kb?9BgRQX&&1&w*Ge^jm^Zm0CB@5p*}v>|iDT}BN{r?C
zfiElGYn+&)M%;D&^vG|7F1%qwey%1eGtA1xUNR1!4CZ-ZE}E$l9i3dicU*5C&QP~X
zq0Q-ij6L|>%AVbk<r@EG$(8hmixMXNkeP)A*TyY|vQT~|$gh*YUKAU9Lvvy%1=$kD
zad7)6exc(r-ZVF*z`(Tuh%sL-z*a8<F8LQa1z7naXl_=H{p(l(H?5!tH|dSM2Bd@M
zwza+`u@Fjfh2y)HmoiwRKE(haHFd@hMl~*peLp%k^h9p5R!}N)%;vwc@=Wha-p{>t
zafb3<?{PK^NohVNuLP7U#gZ+5cV)xc!RNa4L8~8B@#%UYS>GZf-}1$Gy{i8;&5^vu
zc8k8GHld<v={hvW<}f6&_p-HaQum9Ht{}%P0)7k>*Fkf6TW&4n;GDTti*vPwRq{&f
zXZ{ja1?JU*cIDLrC}@a{(5iC&(vk&`6&7$|&Lx2@V6!At*27&H?;qlg(uK#$d(TC*
zTTzbX!`)p=4<;RBfb-~6mw3w%&$ukTjT^7n>>LR(xV(EjZn+;K$N5<y^-|rYudxV5
z#B1nTr?|bkXFk|Jn0XYjxniNu$w*&AI&q#ZP?_!Dx8(z8#xYziktsHFSqi?MGwMFl
zy8M)0{eHEXl54`fRY1y|Tr3QZ*SI1wg!hk^M$hZ$=%uu-cNE^n&78gyqI8YndQW95
z9PmaEy3|@V+(F6RPBR&3C)WeDRHp-{T_^LIq<I0`Sg31kcS?6Iyvg%w7=M&ylb~kk
zsV8TC@;w)L@q-*<!FQeU{+DluxnwV`b(!E@pJPvfUA^5p4@B+sABp*%jQyyZyO3x-
z9avAjz7Oa92j3<-ne)mBF9jB7SnQ*-(A}Pa22~jd3Hwn#K`ywpa{W=L!vr<ft!;Q^
ziBI}H3by|}oB+x!nwGiuMKm&N(xFL62qCtGXv&xG9#X)%y<JbI%S){&!@JDM^z#y-
z?a-*adl=?oTL5AaA=`7r_?5<0yoAS@*p@Zz*<jQE%`GIezBI#0hup@+qu~`_)*#w4
z&`%<nBEYSPu=aMSBn<mAepw;?GfEY*>N0!T{+Wh~OD!+8HB&@JmC@7TA9?2L^=1c6
z#eLd=_rkaAQyUdZe(BNH@9o7n3weEt>Qe-PxaDamzNh9@3v=%C5stcNpmY{OlsMvJ
zTB5KcT0jSNXFTR|%mXV@@1Y%sw5^{gF_8R#t!<=i25Y=<=m-DW*GhZ2)cB#X@r%Xw
z#hYK1=xe6XDcG+3om$V4LEb*|yLZD@TxRFu)4~-DUz4txsW}?Q)oky@D~@B$e(nEh
z6uLQSzYVeX95U4xnY;j3x^nghtHw<7XIX1q72FFUO7ekw7gJ#o+&tew6M_mqx&x#*
zqZcOq=G0tRp|ieQh+6lZU4<PjM+LA6X}~<~v)<s%S+Y>Oxt~0qw&&K7yImd_YlCfu
zp9ekk_m_1OglZ*(3Ra57KvU%e#B7cN!T?R8pu(`)cn-z;Rp&03MvJXgH<vkEKtT2F
zdwDw>(!?}Z!OaRL%2j6OX<W*S7cs|VbSmG_&G$N>7PE^yxjW&w@p0sk=z|?+FE4FJ
zv}WZJZ`k~U!8T`S=WPJ-li*c$l#&^Gc1TxO=jM8QynP)JZ!K2llq8kUD)_2nJF)2i
zWHz(2DJ}(hrA0Wj9@H-=A0B4tg~C23@CHijK1MGi9cOJwwN;sA%cQEPZ*3n9?CY(%
zMw~ay9x-v~*2`xiV+>dbgnPv2I~CaUp4owOHMXz&HtJ1g+VsP*P$s;)_d0k3_XnMq
zy0QeX-%-Nr{+_F`;-4u(?eTP@y}#|~xXcXe$yVE~{Ti&p=n37Dgh$zQ_z(-QRm$w$
z($Sut61&Gc)f;JAg-{N#b8RH<1J?UTbTg*!Mwi2q35MWOd+@uQN&dMkr+5qOo#~B<
z5^_2kA`1&Gan<m2A@8u<xQU*WE`8P>e=t~W5pD6}g)XWTF}Z}?)Yjs0t#MR%ujsPk
z<vee{Dk|+v?)2Z!4=Fc)earhNF<TB35iu|;gXLLBQ5@|u6t1Z&uyd_8=(K7HuO`K<
zc&1PC9M#ibGj**LnXj3SsIPD|vTG^0%uglzI#eU$nY!!I6{wlf2T_Y1-^6rbuTA^B
zRpk0;Q`pY<UEcReUg<+J<gJVCa7UPjho;SkYLOl@<)|)QV&FQH?QpEa4zTxB$&`6F
z1shML8QWZGrFNr>-A^qv<c2;DGvKCU8bYnc*(M)*K11Zz+2@W(m-VW~{yq(_<DP`V
zE$`jG|GjtKPwhNsc*6CIvdJ+$Fo(EBhTU|;htl`&jEyS{leqdtkE$Cl>k)(*qkH(2
z?>L7(f#4H`sb7VQOvGRNS*fHUA(e<SmYUw!Ruwj;KPF%){p&elR)pz?%ma}PHn3Z}
z|7#1Va9+ejcYsHw0g2POJj?&>$ct}&?pBd-z72<+c#6|l+8j_ccMOAHL7<4zt8bya
zypy8?ZLu_}PEJnmGfj!*5v;8)@iCg|{Y3j(?jQ{snsAQQMS*vt5+zp1#r)8*?!kW2
z#*x8Q7Hh%O!tt???JpJB1JkLG@o7PEl_3*}et+@@?6>SB6qy_7=#R$on@;Ikn>>w(
zdzFY9&2QVG<1)yX2uj9jYk0bE6^zR{HkUHa@*whU9J{6UXK;8zg(^EPtUghvQI1nt
zZ`EjWgo9-kT9|x!b*a&%wb-l-x71)PO=TqQu=Ns&RD6s=EqsXn+8WMZQ9Vzr(n`e=
zpQ^BVPhqi5sO<W~b=PaWx+<|hGs)dMqTCWU2lg-YGbPIK4m^0<v}VdYWaK)_mUj@3
zV`ZhL>u#hApLUmC>LU~jfmBw^V1cmG(3eMB7+isS=@rMo@`WFwr2~sWSCTKI=BM?f
zYImcIb0^#NjInQBST}2T@2hV0?K?>CN|a#e$A2>kuZ=D%&*@f#+324E%L)vXbzK^q
z@YM}6MeNUp+l_mhOcsuf;<lSt-s5Mk3mg)1^Jdh}hn$OhI55(yulLH)X2@3%U)R@4
zY&@{*{~*e_d<w5+;C-+u9FwhcBMwTn*|m+MG8~f|tDh{7sSs#4T-pIDk*SXGn8yCB
z8P3kn@6@tqW@Tq*V&N~^;%5@TwcY0xbT)i8U8pky)yj_+@Q;ge9-&=U?D%or=x%WL
zR_lIAS!o+qQ~@5E_8kx~J3I!-E|%gck}e;uQk7dD;CQNf+p-iz`X*m@M~+*N3P?|S
zhY}-XG7rrAF!mh^RYcn3eLopSsvqhn;K2s9gO{sCuNHBPx5tDakoLLfD!+}E%*#f)
z8Lt~5rz_vVTdRAMV>Cf<g^ibXE5GXnwlX3a^OoqoUVkNR98sAq_@2_oF}s*oq_IlC
ztQG>yDuY2RO3Wge5C$n#+cSx*_%@0|^oC}kScw$_5PY%5-P}AoXklwujG9lDH{1@C
zrvz>|Yh{u7@2LW$2W`q`W|>r6T^_%|@zl7Km6hcPK`+)!D!U@#HyzhDH_>JYg$r?j
zurB~;d-ZzHF7A4xoI2xsd{6CIoxU4pD3jL;e?~?EQuh&)?(UoQ-#Rm9T#2#R(^OQj
z>21mJ{EC-=1-s5>{_1pJ#zS81;FzeIu|9K5Y;;U)j3@Z*51-O@bTnP9RLuFmjhSzG
zv6xZ!9?;z7Blr5d*2xbNcp|!I^rL6P*ia8*c;i?Ir6&RMZV9=$3s}m4SIpk~-SIdn
zPR0HEyy_RCF9E#0;&R;5(t<`JOWth{^iBCY{zIA&ccl&evu13+<PEdq9~AOo#4SS7
z-@a1S4ay7gBllS%WXOwCQ+KBwqtNIKu>miJuZ)X0&M@_`vuFJ`%=RbN)_{OFzEtkB
zDhYqt#kFn|F#wur+TZYD7cYVQopF_CvYSg|o`>mQzaB64c<&a!1M?~eNA&_<-`D&#
zzY9<jXBw5maXX#N;6G;Yn23`m!Y8xL*SxihN5ZMGqCDMkv|FW-T|q!Jx=+QyC<o9t
z0UdGNZm}YXew@L|6$AB^l^QfFj*g8@dGJoFoJlBY6&>db)ztcI^As3a$fC3{y&zm8
zN%-=d5m(}slkgH@?w;n#to4S&)x%MHZ*)>pMy;-cLsYa0Nsn7`TP!9hphXE;OvX^t
z^7HctUS>&2sCv53%B!M+KAow?Ti#ISVI>s!@7M|>)jyt$&DCQe!6Mbop-lAI<R)JB
zFwdAmS}e4Q7JgZ8v;QXyax;^4sK{jLOJSh~rK`KUcqIQ?OGK)?eaZ%>RygCmOsMYy
z(adOy`0r3vxe_le#&5%{t@E&0Spv<OGv%dj<F{Pq#37R{0jSIOsYHB%l`@~5A{D<G
z2%c7DLKyNy{7g@OPfO1(PeFK@Hb{;~8wlLkB;%s6DQRhG3V|(m@7>MHFpQBCm*tcj
zbBnteT}PQoEbMF;PRN>>sXlNg3}ZaT$@`mG>Z)<eY|^fLt2}Jazq0Zc<W}qBqRout
zNr46}Ne_(Kf3+$}u=u@NZJ&<_4~`0B;QG^@BB)bo)5a_*G3D{_ln>--e57X9E&z8f
zf8Fk9J*(Ou*%~HkSXBE6iEM5qx&rXSoW&OzMmh!tELT|_$}8P=Q|drxc#g__O{pdA
z#}?|W`49K^5#~Zsrl$z8=@~#uIc`KQ`$pYA(_WbusqSww=mGGel8CBmq6$z*;y=U_
zo_<IE&cwFE%@#gD(cIxI9*QUw3OK;#d`@{$%&WZ93d#n0hhJ)HYU=1XfmZu}13bto
zn?=g4&f?~lQt?tH=9fbpEugFFW8}H7Y|XQzD`Xh~Aqkh?Kld90FI9}>g9L7~J)e(L
z_082o<sdqPHm6Um*uLJp4Xl`*o!vpS7@_TDtxaP<*@d`E|5>nmK~i?lq+w0w7+t-g
zCrV0BBW#I-5kSDWkY^>)d+jpeaCeoExGYFb58@WF*inODUBlsUOG~ViDwlx$tW)=g
z<zMcIP?Cu7`NgRaL%&&M^r=o>8HveV_{>sd%*g_U!sU*f#;g9^@$dN2Zw2OXn;2@@
z(Z<WTQpm`&R3aP(A!G{{5tD~-_+*Z@vHuy`)}|*Nd!}y|J`4^500|JntoJY}N&?v&
zjDRae=q{suR!L<w#h!&#3kwT!LMe*_{|;hE$%P^Sq!$`4K7wbyFE^3c{cKIoj<dD3
z(uAqHPpxw)bMx@D?^G7+QC3G>i6ikBezu-Hb4G4w@Ax8{lwrC2SUr3)tLp-liLQic
z47=?|r}AKYGC%*J`L8dJG&Li?qS4uEP&$^IBP5ccbqRz7NQmsLY+-})*QDWMPEO7Z
z@zsv*_73TLt0l(yFN`K*>Ay*qheF=f%lrU`*_^vTuaO#6zKMPoP46Xoelmt$-g{1u
z1ND87C`=O*#}9L-K;U*QKuJ-`#;iQTU5SG`2e4BfgS_iK1sRZG3$42(1Dz%jUaEK_
z6O-pnpEw^qVzL{5s;2g7W%Ro#6D(fN*uW#}+qWr0s3HQP-i1_suju|GrRuSo6v6kA
zZyL2i;6-Luw(H_|T$;Y^?KS-V-QtnCiv$Vd-+?g$Z_qHbhwvcCwj=)9YzK9zWJ&3o
zU<GMw3hu2XWl3l5dbGDfO)HPzrBq#u6?{dWpx$L68neoihv5<IdjbXxvueo_n`wdU
z%&DMuw@rLr>d1GikkeFdL2GMkk4#O&CE@AtsHm$Mc&1x7ayy%}>?2nI<--)IST)&R
zeQ-cYwCgs||GS$f+Lbg^)Z#zOO;5+cbWVtO#1>gvmK0eQ){ZY9yAh3!x42ppK~Cki
z9RUh~^wH6bV4s<R*B@<~K30~N<}ioEF;gP~fc#QGboKZPDypKZS6O8&e|?#lFq!4y
z;<{rNa49VK<4qa2?^~|#AN!rAK0S@_7&v|{);MT}k$9CEf~1i5aSIC@CH7JRO+bw|
zLp{BraaC|a!9QDTgatX$zvau>z)~{E&sKUCQ(DS9sm)_ITnXJj!z@{IY_YqaXwGf6
zg$7tSJH;!Y7(}%Oqo%!h?$V{@UpeBO^Pc(wu>ndIqcVMh_EvvSJRjOyNFay~$nWGZ
z_iI*#*0yhY*4tCcab9bhKO;NEV``W!&+Gfd$o>Vng~?@UnD^!?34jv8)ZLvo0M@#7
z1@!O?&6)e);<8e);4CF;O!h2A0{PEk$`IOu&VQ9CFwPe1kuc+40dCa5F6OB0>U@Pl
zk!!0kJkL^+;^S|_aiM8Qab^y5&!(T>PZEigT(f(%o$AN#85$M5?wJe6K0Z|5-p^o1
z1HgCP@wU;|U&5@svhCWyS`C`@68|2yRAFIB(eVI2V{10mL&GW^9N(29?K;)=L6BI^
zdjc!?W${j_g@Ez*a9!2?JjaTMIIWqyd86|3z9Uen2xwNi6LjWU5RVFnEu9+w;UDV3
z@87>yR#y7`1YbC5cZwH>9}v>Ptr2Y62bT5JZ}5f5dd9MXW^GsgB3sybOrM<ekQvj>
z0PY#??;jkL;1m}ZUX2E>JycY9{mQouzex%_8mOGoUU`cN9_jMHz(DoSVwxw&8y{Ne
z#YmAmkx%B$gWE}%LC^T&w~q`B^Z&jZ@rmk==#!rxL8rRnK)2oiM`2zrh{?js`M?RT
zjXrtAhr%fOx=mfu5G%^hFT9!oI;DLEtf{4yPCmLJP$?mg_4!+C=*#g_zMA!b>xYgd
z@?GtkGbXVn+}(^fXwJ}>3&Bu@r5WYr8h=Mq)7;#Qdzp{{3hRIxcRp!QE3*KHG?zF`
z<J?0sOH0-MK6I$|Sq$i`L(&|PV3FTB!GsopC8!ya+NLE9jSUR27WlD+&$s?gj^{OC
zcu5dUV`F2<pyx|Nlx{+3l~U(L;BrYTcPJpmw-9S!M}Og>fN;@w{er*q?JguB<}?^O
ze-cie<YC!$xC$jbpMke9fN4Fx)tQfNF@wX|Wxf7P1(E$8|0PlgRZ**SAjRb5@Ip>b
zkg~qcxXA>mc;?3n3VpqO+B_Pe!J&NjWwiD6^<glWk&*WJFB6PDab$$?WC}YHQ&Wvi
zo<AS{;mg3FU}k0(aG4_|UL?09cVjM+E0CVO^rZlfRC_xf(nh7P1^l<Z-WYH>;$vtu
zL;II6w;`uahW%q&oyI0#*SfA*%Lq{1_1(+A-9KLJgNecYCC>tIV&L`-rTqQAFW3J;
z&WUjWC`5p~`3Zm$V8c-05(WG|pWGV(oD%p1^G8Kxsq_yBuj}M)3d997|NqPX)r1+J
z8NLS0BOLnVk<NeB(f{%C&M`pc`1r=PHXv6L70n4bYATu)#D|}J42{4)R8U2YCxwqq
G{Qd`byEu~o

diff --git a/docs/assets/room-zh-light.png b/docs/assets/room-zh-light.png
index d4d0122e9b8d4296bcf74e1e65a727f32bc748ef..20dce42a23841cee88e712c56cb782bde87948ce 100644
GIT binary patch
literal 78205
zcmcG$cTiJb)HWJKKm|mlgMy0EtD#AYfPm6_Z_=d;p_d?vNSEG(Pz0n)?;s+*g9NFe
zLujD~2qE|2?|tulbN{&ieavJgb8^luYwf+(v!7=j!qin2$Zs*+0)ar}uV1~?1c9!9
z20nLgTm!BU`(YYEpgW+~FQv7;zi!Ww1R3l3@a?(xA5G<(l<F2c_j4vWDwPF2RTjv{
zoM+13yLa!^!#md``aWF0mVN!;o($V{Een~OE%cU=PQ7$`4N8?(MkZWuy=uf;W)E8Z
zhIc3IJo_>N`|<1h8$)wVPM)48m+Ru|;s;^B1qp%vL7<@dyY&CQfR3nw|NHhL=1~g4
zziUTy|93B?4E*b6ZE#><-W}NyvpbJHT_%ZP5`P|W4i!$fyrc~KNJ~!6!^kX&nblc$
zF@~W!(@983=w5W+V7oU?cJ;JBdcEyp$HlpEr_7JZT)lTS+4SgZG5j)zRwA7M3i>yJ
zAY{PSIdkAT7LuBoxhhfzIj-!lHTAyybf{ZyEG72reuP{q{@ZwJe7qLP?FT;4;npTE
z$@=B!rn5`A2x3#rW^(K0v>ty@tqlK_)nL!vpi3KzmfdWs8B&t*iut6SkKI3+KfHsE
zASWm1ePGn=*m-(jZCP^Y+<11v7qHqE%_OcmlkC{AkjUpVA5rF$1c}#oN*E6eTpom+
zqR27x_&amP!mUSxurmcc$d)3)XUPBe$;#rU(+wM-!v#{PCU!*D53@a=telt1c+_dh
zD4gllPPB!ZP4?(wlfs3-FOKAG<SX0Gs~q4BxI(hcv$<&T*3+6T9|=E{Qkf6B=`zjZ
zQxj8#iFds((?6?t8w;m5;ZFRRycg~Ux<jp2n%(uv4J#abmtx!BU%HC^{`x4ne|UgZ
z^=q1h_vuD!H^tYlUstevjdtUSdZr9v9}Td|Uqz4GDFV(H6;8%ZNal|bBF0#I;;8!F
zb2RK|9G)9Bn2vz0$f6mHDpP7=xR@&D{OixJU-kaNx-q}FF@K||=&jfru@ANPQeHgK
zNFaKB@8x-n$Itl|wb|1xqtlIYr8;BRsZQEb(}u4N?eAq3c3aW!{RaA!`R~-PH4N*w
zUEW9BCb@k-aMBOrdGvQbY6}r~Ad8-=erGa80QhJA1lzPbf4q>{eZnjm_&8QM@xcg^
z)~puV`^m$BZ^n0V9PW8GR-v&5iP;X^mSjF(+3h~zV>CNQsWronH>pb=7@vRMneCW>
z+__q-eH>|q+SH9UBXX7OL{C!746w7FGZ|jU0Em<0eEnsbt+UxPv0t-mzk7QbVRg%k
zbMkMufTbpZL+SlMsF!Y+y5Rj3t*O3CVTPG`(^WlZ(CFq%KS%=#F=N0|*1Fl}V0JiG
z04bd)AM_YQ4H)5vA?ly=98VgCFD$n_z;zIdnM>DW>g!-&<AT2nCh6V!Y$f@!o%;!i
zTsHYcmD%ON+FTQ6w2RC1qM3_#>euY{kRKYqIP9Di6~#F0*G`(*X}CuVJI)Mco>D5@
zZXAXcLGhF%w*wB4t$*yEaLMg&OTw^g?z-hxQiq@Fn$s(%)>O9e%MoxZp1lE<+9(P=
zv)FlDD~2C_wp9l+w^&-~G!oJC-wJ4AI$tGkD?ZT$f%f=|;;bWl`fSL2Lw8~4(x2Dv
zC?Ku{M$aH8F}ARyv_aBOn+-z;`xS>n2DrbMY%xrdQs8(|bhA(i2mJJi)^oerVY#tp
zGGG_}p*^SukA+;W!Y?Mo;iBFtH9_+@BP4G0^lzLB<B(<G!B<<yChPT#nB6In=Rz$z
zZ<8zXy-{~(%0i2gr@Sc|yXV7Ot$s)x#W?9Z((y@{DJCN(@S^Gn5mD!8*a*D|Y-eOo
z@vVtII?)dr)l}CTrW`$IoV=v=e&#}>v0amGNkey2*~o4mm7DnuvG|>g_Lk**FV+>3
zKyT!yyWp3S+vFI{u-k0OiL*TLvoR0+5g**v>6e4ES_72pkUYGe)@l9}2|1mbZ;2^4
zty%giL_SH@g8A%(TildwCAFcdV~^7~T1uvsf|WHYzTaVipKkNPJitzE`{d<*i-#5Y
z;-H`ybxy8_iO(aa9ffC_Fkwc{XOd3ptL@;z$cXM7uH+bG)mFP@H|wWR+Nek}p`%^=
zdH}N;s}{5Oq*1vKV!SjXq3;scZ)WS{vEI_f&0%I;HQL#M3)r6tgiTt;NS>wXwS3RU
z9B;DJc7_&HoV{abq3-h*PEQei{q&hTS<_`w9qfzq7-AiAc=y{g5Xg)pM|Vv-VUXd$
zc*@{fE4~F@n069Q3mGP4p`*=_xlR-`7qbJ|TUjLKo29$aBaGZPn#Av|89BFE^%F5;
z7n({lkobMR8GSA;xv2pcONKhrden(Hdaen*ug>p18p7z*nq0?Rp#m|+_3{luzCWzp
zx>V@%3_NZ`C+ti$dK^AA>gyJ{JYzKN27!L&3Yw_VR+8Q4riuKECUP5B5oh*Zh#h2{
zY`d)Cvz<RKMPF_#&iP%1tqDDssxw|b|0%e#+Hl}867r_>G4A(!*<qivEdw^(nga4b
zhwlq=r+zug#Sfh$N7#0{FXGr5!OT>lA^{8rTajpQK}x7E)Z{6toLrf4wCm#Ev2|w{
z1d_N}^K3mAuJOd&L2hom!1gq)c~Zh%{7~?m7^R%tI;F%rB_SxNk2!_o59$*7z8l-*
zJv-=yVef76pHrD#*2M@Qvzn53SNzbh&%1lHEm@a0xZx5Oi~;rMN!=e(6Z>k@0;Fhk
zJ2o3Jfh<M)6v2+fpap^O{2XxW;XZSG#_=GNZ;!qtYK(`r{#{GurxB4?$Tdj}<R!8)
zBQGb=ecTC(>r0jxo^}U9j$<CURpp3dgYwKi0NfbQkuv(gnJwjP<?hTzN6k$v2GZbJ
zy5$G)eV#H`xAlnWyJ4Xh?##b2w;#ci&O7f*0Bo9a_M%&aB3bZ+4D;G<W5UhK2tEs`
z7f99&)L5M{M%l~8<^)K`Sy8km?ly9TTWuIh1ocsvKlQ+dY9JmG7{2S;I0Gbdd**Gp
zLJ2O^!CeXy;?jIvj{oR#F@wk6acAQr0ZSE@9BX_&+HH20XTH-;2Kotxs(5)cZ0}{~
z!g1RkC}?yo{D3MKH^+SWqxdLDr0pz*x8C)G$I1cqvWxF{P4<X^<uzN%UOa}+ELFlI
z4e5W@4_BImoR5~D4aRoL!Z1T^&DbGqsigHO!J_(Jzgg>L>ae#Vs-S5tt+*_3=%iAu
zI$&ni-&P7<;FX#trh=9lL3VFu!>Mr1*DDapRV)f@afL@4Jw2O=o{a9W3$wP<2^Rz$
zz1IZ^oWsuV>kYiwnEB>%va<3dV7Whe!hY3jIG{@~YDcYwn<nBw639@(hP-~8tF-uj
zg-brC=EDzoXtxPw3Z`)W@(7g_9rX;BC7!yw`M_&d#S1$z+*sKat0G~+<2CP&w{7)*
zU;=5~(nUzMwH#w$XLV@5&ImZB5aw@&x>RPxCZoOaxqc@Bhf4TLpJiW!D3(GGa_GjN
zE7&=`5(PV-uG{uaky?NQ*<|mA*tqSk0&45>Y*%+n<ZDOnq%6hm*;w*r1p3>{qY3=Q
z?bW&#zs%DnFaK}b0eWSoT_T85GuhXLN6Qkmm|px@JKqMYT;bT~PJ`a?TD8m+3Aa<a
z2g=M*ng}47j}#bHTD|M!s~1#@!?a=I9i<i~RPBxq;|xl3rbauuH_id<0rqol!Ko@*
z<1fQtckDd_{s`?jp>ccQT9f@h{k%59{;OMfT<<WQdtK{+3p4CQN6j+hC6XIhaw4W!
zWz6VYmv;jI>+E(Kb}(KQyg6!^X}v$Fhxl~l&c!I-&<g(8Vc6%8u?#mv0rOmM!5r?W
zv%kVJ`&yxC%dzFjZF>#FJ~r5yR~wD3_}&kruHFU?l3S><d~<m(za4YL1`EQX)OD{`
z1jpe(Gi>gUm2`m}wzA#6*s~ScORsLPdy6-_MB#Iy@aOX}J`6Av{!(d+Mc<{Scdeu5
zxx-|cX_IHv^Q?D5?mQwyRX8lg?B149CT7-F5E|n$R~ZICZtkp&+CFQaJXdak;}ukx
z_M=H!vT`N{BjF#S>=WmNzTRsq6)RTKIvYRsTVts|c-Rv~F}c7KgB9b4>srqUi%K=l
zbNG|`8C%p!sJt%aa~m3{7dKkA{gbG<l5vB`=EWK0<$k$K{VKv}cSXE3=C$cr5$)_=
zaXP9$tB;X-)f9iOH)`Y~9n+eEi(&quC6Wu*+cEd_U!pPrfMMiR{1DxosM+bPt;W<M
z1!mi~FV6^dzT*<u@r#8cB_s3o-?J2L{ra8gh5`2u7ndC<f3C|35ZD)y-sCZmz%OOP
zd?;fWri>(&oEaaAKTJz*`Qf+@3pg_?-9h6{Y0=m{$Rtkm2(?LE#c;9<3(hfNi_@n+
z_xS76J(tVUVW~u;q>0O}n%HYfL+%I(o`0@U=WJRU<2kA?J$0>#2}DU9$Dr{W1rVhf
z=0G%(3G&Vj6{k^@xPMOPbT}(_H`>(UhsEFC-onY&#nPkj;qkH`$C@FXfPXZ+<^u3u
zZ5XhQ4*mo!^&8WCILGX><6!E4W^I%*Q_q^B!HJ!vZJoE{bdae~|KmY(qc3=8s2RZK
z@<qCB7V?GL*<oyfRj|o<tx(&;!uRUi7o&;85}2ikq)a28bV=WX1#O!o7cGPsKR9;4
zcF3%<ak{|n==7NcelI(6VEd`-++=I_K+)viu}(O4b~3q~&aBF}lU!uB&q3>c9*gPq
z+=J;*$i+~D3xYd%w5wZcKhwn@hpleka-j}oP0DsW$;7mV2n#!l4&O4#BQbVE5h2v&
z&x0!TPrd3c0(<}7$g8w_5;weR&|<EOSr?LYN<b%ZJC}t0!e2(z9g?@QR(e!DSGzB9
zw2>LWl@!Bvuh-90@>RhPXwtCQCs@@5WBKBSfMp(HY~Rg~X=d0Fi!;HrUaG+KgcJ6S
z%r0SSO&9mlncFW5igj;cj|c0@ATEP_tK_zH*zd-*w#a1)$;P@izQFeU<5GX#K)u7J
zmQQO;723SH+Mb<H<@qglI+z=e;sfTZ%5&1IE8NaRC4*oWhm0JFqbL2QP;yAz$$c@m
z0b`HS3V|qL=CY_9?UTsj%*vdVb&t~?jp;CR1cxqXE~x`K4#6SUNq1YCrkN&g$ZEF*
zo$X)t!+Gwx><8Swx3Z&^h7t(mdiOj+9Ya@?sKMEExR-merp$XB%HpSO!W?!|Zcq(f
z+}FldY9?88rf1=(x6GrM+SF0%@@~M13xW@cF%;o|8oVq1v%l<K5ZUajd!ozrOJgqb
zF%q1)Po+zVf2eKh*Kc(Baf!zIS7LE84%-Hc8dPWsApuwMViqZI=?!Q>C+-0^>&?q%
z&0aw;ZMAjFA&JyQ)c<k;SaEc&;;(e1D-ScBe8G?Ap1s{Ryy)D;WK6&pMP>h2bj%y4
zd%G>Li#0FJ_aV2m(B5qtdEYJ$6Ja=gL57M$)Tu~++df0S8e_q)yu14w`;;XS+ptDv
z+|s1~i`>MKoY*}j)4i|o%L5U}`B@aSyK*Q?VRBiG>3oV07T-T!eBI~VxZH0wf-y>&
z=Kt{3G7B9?W`*$7@d%4q<F2po##pUTYwXx$`uzSSAxX^MPJz@qbsqXxsJNy%cGm-5
zb+-9oFtk{uSxTOW@yggUm8%zHbz`c1w-X-PVM}2+Hs`m0H=@lEW!mzpnQ6_7T}Bj4
zq6f3<Qp@30@q&4kXn#xr9ybT4VQ-{Pq-|L+a5;^i<fVTgEldd7dy+9hVWXCrnPq5z
zVp18;lnA(}=w+e)Fa<=(&KOxN7jdb4OnIpz%@i1Zme91@2+0`I@Y!rZ<G48O_i_Hj
z40$ZmcoEp)r%C)i*VIK;_u`^lbw;m^Qa8<5ddk#Yt2d-~q!6)EzsB-%#XaXeEPkap
z%EK!Jrz_%m9sSu^<hs)XtCqVMUGj#V19Utla6Z)3x!pFRjt-sR{yO|J*dyk-*Otxz
zu~c;IZe4-NyZr_S-O;yPa~HXj%>#-CW;lcw^AwH_8Hho`w$shdX<GwU{{9Y?Y6ll-
z6rP5vT^Jc`h1mb+%}N7HdHBTHhbM6y2sxg>#tE(@NsNJ>hItc^@1ml3ZJgw6_b`&D
zJ$!)yV4cvC3_lEHe^D)Pty!qp?Bb$$*rcj*R73lsY|YD$8~_nMiQ7QzCUn|+Yg3x_
zq|5Rz-gi~0^^}jf)SHaCzTVM4(v&YN9d;It8Lz1cIQo0NYH+P%f_45wtpAX*S>o-}
zaU2$ICGYL7!Wck%y$YwZySsK@40@4|+?8-U^2Wb_8SrCAV_>)pG%i6n)9nlaoK0~{
zdTqHob(a(HlbH<~A`mDufpf*?aCJQaB_piSqb<>@o`(-?I^ok6OL*tKug)7EfZH+?
z68)>d;eb1@Dfc~|{mpbs55GRgyxMWMkl$KoLXpcxcQ9NtKCz@EJXPqtf>_ZEe^E&B
zBTge0Vcr8f@3Ce7F-nqcF=upnPIz&u=D!r-|3Tp;_R(PKZoMCECnu**MwR{Q#?oC*
zR*6PiBqa%j0ZS{QTynhtc}XGlJ~aB<0RucQ{?!woD)IT4Y*NdIj0e^Id>l?VJ+bbR
zog#8;|MPKP7!=)VhV*xs5l1V<K^M;$1y%5!<uGxBXMMY~6UCW+$2#jJri%j&JY9BO
zN_7|LHt(hkJ(?np49l*FMr)V6(A5nK1->7;EYN-JHD2BuHrl!0dX(hA)6Ok+!otFC
zy`8kT$&XzcTrH>4zo!UGNSw~DODqeO2ackh8<v}p_$f(@R6;-Xx!-eEfLs)lGnbir
ztZc?FaVLCmWvI`l!u%VAs?^(GJ&wz!$ewbHL9$g@lp$Nfy`KlRAfoUo^jCk<<!%zP
z+@R(0y{JeYlM6KdQiwCxpgUQog*~ig#d>lZb^&rpR-<=$)8sGqP@@G+Bv-HCh0Z<d
zbV(A%FL-xGj?Lk53p03Rn}0~^s!*epB)A`0EZA0&wy~~*1sTLq=?tzOM9~aRuYN)@
zphE6V66s|cbf=CbQxBYOKj6&bF>%v<esn>;u90NfCDz<Q7}b1V8OaT9+n)}Vd;F$o
z{@XZxu^j?QTW8j39}rC+Acja&XFollHIWs19LQEj8?eX4+hB*A7Q!FKn`s^^Q++Ik
zH|(4Z2NI(Rr>-{^r~1@QN|l5ua5J~QT75R{jZL3_(Y_5fYb>iKy0P=NF*FcW|GV5D
z*VYD|OMNtA9b@m1J|8k=bGT?v5>hrCu*f(Nd2=GV0f<yS9^G>NX$_X_mW)+X;j7Cq
ztO!hZUj>FaY5P%Yb`)$oV^ID81e%R7y-_ai^!9k<?^!Mv-qk8b80qtvz0V;uxs<W6
zd3VGc+4DX%EF3%I=3khaYBjXYrN3#-*R*yB#}kJL^vOifQnc+jb-|lMwo){*IF;;#
zrdKCltd_Hc#$-qch&()O820OOFg>)W&9dkkkk-1On_kcuVeohjZ*k_dTpKPvAsE$9
zP*ej~g;ltwD>O|>3zhkC)`+d-(x06GLEj&M(pAwCUW1&i_>GD%ZC2U$QED2wUuk0G
zcl<TaZBoyoCZ!xlM@B}s-<>x*ti>4DLc=o5Pg*JP?lt)lR1+yqM<_?8w}S$V27*UJ
zb(eCebX{IJ<4BK~rE3=cOb@c$QxUc(Cp#Q?KAxs(J>bvJf9PBupzj`|A8rLdJMciZ
z9)YX(ub_2^j#Pdu=B*Xa(FkAqE8TMjX<04i;)*lZnh&?Eb!UCon;>qdJ)=MlQQ`ck
z>1pn~oK_a8D{SPqYp=(r4p4NrABE-QBi<g>IhyZ-hg<X~j@i_h0fIoAD_8qu+nvu;
zNd4@kd*^~(<rki<b%Fa2z6-x88C_P&5PcV3iP(s%dORBg^Jn3M@tBBV?w&?ID+<8%
z!ds{NAXMKiD)tr@X2bM$JkM|+aN4k{^ALUZ0FA|n`2=Na=jMF`R16bU4ui7^`~ok^
zKx=_q-&O_96FQgYHLsZtbk%I(Kn4T|hz&}<vv+fRO%XgL8?&8vI6am|=(63e06wsk
zI!oo-e>#+6U|(-OejZ;Cschsab8%E)>U>Cc`tfY{=*kmQryHY|-4yr5Ds3iiwc2(x
z)-*Buef1y(_QGxd7t8ZFwI4(J&&1r$I%&x%_`*9aN{FC(;Qz7s-!U2bw!LGfQzORB
zY?ncSWqa*`qO+aSwkzE1P=ya240Xsg#ir37dY&Pe6s^mJ%pSQt5Gl2k_Zg6@c?Ccx
zQG+kxB}3X}Sx?NWk7i@-@Rsok_d=9m?20wd6s?8MWilX*McE#`43hIQuip-CQfsH=
z-0$=QA8150k9Xm*$>rNf{0gPo{ha3CY%v<qoDZf>50W8Xoqg8LUv!!*<TW;R%Kaaq
zX)E{ovoMmL(BNTHEJ6gPUi(Stiu2y!%8t@0PBt<l#20OlX7PD+4>fJ_TFXQDbjN#o
za&i^eZZk>wj;=)we9D%#Ec*qdL-#qNe3Y0jAIJV9&t&J85i!}h=6ATN^2UQuNYf%C
z9w*zn&Vt9FFP9mS9D^<rDH_k0mPkbcE{l;C<h;{L{}X^R{C10)c71{#F9B3+BD%qG
zD+F@xQ=q6unpoy!GU%S!;Iz112{|(>=WcneQ$nM+Tcnb->ZH~Zsk+sPSW6r=860S8
zIe8N$W%0ZyG5`yavMk;DiT+Yx+?d#Bm(a(M=B6vw9XU~wVjwqH8S{d|@0>b6v?9YC
zh(6Qb`}t;MXmhm|g!D9?MhVaAb1i?Q412q#0mGe8Y)>EW0sLHSM4jnRLw96Z=={M6
zh4WnF87cgX9pG!!Mua4F2A;Wwc|UyoxkfdaInW9X90aWa)<44~fTe1E8Gqhc9(XA3
zLE*Q|+_oElKIKAOn>To0*TXmGQq%9^{Pk~}|86lG8yg(kZ0k6$?I2f}?%ay|z<mDa
zq`>s#n9n~A{aosu+svWaV59YVd21WA#Hl}D90|WXZt|Rchf$C^+AW5ASVwiFdH*)_
zPAsVwV1auepcDbVpXUJvvohS^ty-Erx_(c?BnnuB?w3~wF|1(VE-BL0<x#f^brsXJ
zPUTBL_3<XmSnbdGX2(g`oeS6A(U$K@j@GEn2DcH0Mkny*8xwYx(opJAjMlwIatHKZ
z?U{qI2$69iIig}bN$0m>!0-7+F18s8@E*Ow$X%<(;;D-{Q(4LweNuE^Pq#p&XUSXL
zS{cGbr_w&2)v~q5u!Ksy>oJ(Ge8i)dW*M_sY=-A`pu8j?063{@_e`^(B;t_57wV=p
z(<!nZm;efX<^?3{e?7aox-J|j@#RFpk=|7`htreI2_ABjQn9jo0IvhEU=GYvNebL*
zb_4s{5aV=Noyr=A$&pS&<N%QP25OzBUQPmJqd(wLebSA&Hs3j~5{erDYLfP#Yvgwo
zPKV^HKlI*xE<b+ew+q|&-TQj&iFR~WTF0-uX6YhjZD<4>KbefL8GRRdL_Svcn(>Hd
zT*MS}x^9evHeR-?4RdQB9~GEL*Ki}=9C1vy9;9^ai>D$NYo4FooiUA)GB#SwS^Y+P
zaKIHp>(XMrg&3q7xLR7R06lG~(tx=PMX`(!2Yf`V7ZHGh#y_rPY5r6OE9AmsGdhB^
ze=exwr`@km!#_FXxIEzbAuqs)rnMTJC!rY2{VpO*_qO>0SJMFnYy|B&`=$ouGmLC)
z7|*3gY4Jm{uP9MKf!i)=T!AY%=2GY(4^Hny^ZBpk;(g}4TJ25sN!b^0K2@W)L7=Zd
zs{e6+fP;uQ`X%H6mgnH{;$8@?lZ5NSNJkT9-Up4-GhPaQWU7+o64feg5Vw(@=Q6eC
z*Rngohx?V>cGg*L;zCpfNFNu!A<gS8%$HBL$j%pzI8xvvbNvHN(`);I-oJ%0uE%Vs
zIkX?eVRb~EbE|iM{(hd4oh)snhY2fdWTHO1!|2H`r70uGX=|I$;vxLFOXRPUF)0XC
zX372K=?%`tAW=2-+r*5iB<!y>Th%{fx+$2&YOxi#^^7WC*DSbCKOl0o9-HLiFSW{=
zq2Athu0PDEoCcK}Hhx8kT%03XuuN!lgiDL7vu9U6c~_qYbaP;O$I0b<9D>cA<cBm|
zX>XWNh#4R!!Y}vdgpr+xF@N)!%Pv<|J<q83uT3)|_Zsb~`RA>eGxiBU7p&!+M1Kaq
ze$+JhzQ4;I_VQWc&<OlMvI&F19JlNrmzw~JR`U{|Xq5+UHHBHZb#&E0%kIU<VI6oc
zbw6PS3!>nGSctHbvF#3iAi0dosd-*Z(fWaj>%e=aDcoPBON`lw{2cF@wZz3|r+q;7
zm@iLBY;>8FWyaN4e4by&x7cqOiq)Pbi(Eu++GyJv{U^)7zMw*krC(tDLvM)ab5&gr
zZdYa%7p@geRfbFWY{p7rb$OXF^3=iM6v$IF^T^xXq6seEHh)q{^H3V{TT$F0{zGYr
z@mk}47^y(KY?Ik}@cQ)+?o|PqZYacl#nYWMmy<A<cMQ_r8U<ZbL7%ok0TA+Z@?yWH
z+;JnI<@`U1=JJ*ez|ltYnH;RUcsoV?mUGDojpXGgGrJDjV|-0T7+12@n7>8l`;sQ_
z)x%k6owC?ryfsI9f4RQE&@dD|b!-kZ^FOO^(o<_ZoX55u&oQr&5{V54Opo(sO9F(%
z`xhMnRJD>jmE!2>V}N*}0-2utawsv*{@MD!TmUXz_$y{<T{3+rArnx*gtj(|%PtPu
z0vu<wc&()l^Szq!^H}ET=C?QqY#Uc1o$3F(c587{q?NG`2o&nH6NBMJ!J7uj8g#kl
zvq?l`alP8l5^dIsp8I*CZEY;i9Woo{qCWgq{ra_e-%Ffnz9qT#><j<&Mnw1d`BDi7
zC7Wu?@eT|Ih^qyVor7WAVdz=hcoLu;tsf(?uX88B;Z~EaYk7fNk;4OqQ&*DZEFiij
zMe*TgZ7<(B_F5pQh9&+F-LmhyYyM_hPH~a^Q$fz0>_~)7um;ba@9G?+aZf%UF+0Fh
zQ>T=L6&Oh<9<*#lW2q)SPbE7yEC33FVT;>y_YXjfpAA3~`V+7l#PPy5JBxLBb9d~X
z7<=t6i7}u3T=Z(eSSAb#ml<JuDOw7kt@H|c;9HDGQ<!bP3xEg-vntvKaiX}58m$1}
zl<d^<<=XuJR{+-H#2&HDw@n-KG`@9){r22l++_Ywh*v?RI!oz!@4cVHGQ;A~%n#_F
zqk+SnF1Jyox0P!a<o;~|+n&_}0BKVeuu?EdHKO+k+1S=;9+>*=rjhbZ)7@g+YN*)~
zOy0C%z8EQB4*dPy(SO0jC7`3G+-BtSRvG?M0fKuz{TFa2kTA>g9jx<ak3a7K2XD52
z3iQvalDigNo{x`DDMN2FiGJ;^w|u>CCs=8J9PU1BFf|DgAuHLD{Ux=J;=5QW5E<)w
zYQ%e53~53bE|J-v{!dK+T1ZKjFQ8Wl9WZHDb@C3)QcFsqH!S<FxPh;K)eT(rT4lUM
zl1)toF80peeiQmEb?6(|e;|djCypvg4ts9V(IFd=%*|xd+~XV19{zzaVDWazu;2J#
z9Sp^V_c;3d&ZetMuXV+TuW`-5nsPWOb-ed~iyb85cmREUt?eTBli2diN|J)38dKT)
zCv#!|yfYP`#1bEAqR89}ytx_B5fK@VLYJjmu+t1Q-pbcE2|0TSNCALsf5tdu)Z%uw
z(enf1&hWJ2|G#kKNA$bne^V^~uYSW!o$6_PuZ{b2orx62S8;SVLvu$zbBk1cGolQ<
z>_=X%<<IOkt`iU^8V91}h8xaNe7@~f272{dcV}>+#h8az)iFVBR0o~@73$n0KIJ(m
zLsUw|{JkihAvv*f^6RVW59!E`ZRQGqmF&0ccRD)f#|*nz7`0?8P=gPpJ>a-ty?2w3
zfx%E%%6GS+cnDd43BVIfQA`M!x#G4@z3<Kcx9leDUyTb0<a-OyzpnnWy8kT$;F~Ym
z|J_T<HX}YUJAMa1ZO3lF_P%UrjH<Ho(7?djfzOqzKnoI!>UOTK=8le5tKrsLlNn7u
z<L4ghrEf;w`~u30J`82?pQNXI&ek55g;BEoD=i8VkK&;ZIIr!8yB~YrdP^oo*j~bN
zRU^ZEu|bQ0>|G&MK#L0Jq0PYe0fNk?tx0dz+?|2x?My%B)8TTM*PAEfsMgGxF%RiG
zbXWHVQPQ)OH4Y7c5n#58r|g-yGkELCm=dqWh|~?6ouhL2*(N4%&;7pvdzAaEM$GS@
zh&;2Syk2$kw+`PM6R>o6#b#f%1-f_xL<BSpZ8T&Qfq3W?WR4)N!(Z-FTyzwa%17jN
zn*F;=?YW<Yswma@Mkvx_b)467grUR|QFMicP0+Z4u@g*J2UX!eXGx&8J#Ru8l-W9<
ziUV0fH*9#a4W~#TM;!kR#}cZj%+^I_2=vn&fQ4WDg!rEiIGNb~>*Z3z?Hcea)OR4u
z;D*g0_Ai?h%;q`^YvNU9RuFRJ=AOTBE~TZIq|FHT^(t1}mTjxAE`|J+J`Y$hJ8s-u
zOfo;-idaRO-=PcOg@TUz{<YgT^7>f@C)n<OumSk;a0|K0n4<G<I6oCtBTKcc?QR4c
zbX>Uv%j})tLTY#VuM$k%%|f}LZzB_VJyrTc;9joT*M`wQe<};4ERP#WlgW6(h(2hV
zYW(x@i}DbwLUnaD_$$cCLYTPo^Pdblz|(94S9MLqQFm0I<kSB>*<<m;FO|=Cq#ZXW
zJIz8n>w_PCxf<VsWA{nM<>jPjg$=Ho7SiA|?n_+zhTYN<kg#tf5_r@MF6;0|CC7T)
za-9Db%Q_>(W#a*JAfhsnu!KVeE{vrKHn4P_@u78?)fqPPn^2lW)mL3j;-_TwL%#_#
z6Pbd_l6Qj{!dUuB8A7HR%*yYu_!8+O_4$LN#D8x48M2{W8|ElqFbF*u_$hq7idf>J
z$F%hgjQ=q;EcTxne@<+C^z7G4nvwV`rc<k$*?t?iYdc{3UF(}R>Sc$^i+lgM*lpN*
zUo2h0u%Hjo3;z4w91#R;BVp)8G2XG5#_FF#oC_l4KkR>+&l`=mh0F3g{QUiUWj3kB
zBd>dy(c<47nLkkB?~J+!;hga2KE#Z71{nCk;C>M(<CY@in7;VGou$XFT<0F{kiluh
zHf&B3Y(VICCV~6`?sl9DQTlJEg#LZrS)-a*8gKgp*mhc<l79cs^#!Ur_d5e(Pw5i=
zj|*1B8L@iW|IOl&Xy?xTtC}N_%e1?MNTN2YmLh5>wq9bEZT$EZ^AKR&``6X343qgR
zRr`c#IB~TC?4m-i;Z)wx68M(xCOPQmqdjB5xC;*w`kax;l|KA{nrtJHyF<Pv1Ogr1
zx{7x}3fjun`=6;|diKA+QxVacYEU%f%pLROEY_5$x-Bn32-^5p_ypq9Pw8Wiiy{y8
zX5yOSNOt^~LO;R&?Lh{I=BsqYOnOi+iR{7ixBi45m<T{(B*Q;|aha-%6_!{$Den4S
zFc?}L#$hS+Hw@*E3SDKMN=y1w!~lB1_Ajc}&u1<_cX;_Yud=2;-IyS0>3&=OM_q<t
zZofgbk7bWQAg55Gd|<l9<vfKYRMu5I>&G!Xw{)=3I<(RbN9tF=UOfMDjBDLk(4Qo2
zn?lCnFM}Y^G|`7Uz%XV9Ig@pi)OnVc8H=MFtu|I~fJSbAze*?de^>mO<rJ+Yq&=<$
ztkm@9QX{RnZ8Ee0k5m(1#rdC|B{q>6O4h~_k0*O<fD48nt}^C=h5u^BZE_24EuM6G
zo?{I`LXmpt#8bYOy-w&L=qt&8k9v2OjITb6XxK=tc7=r7EZpiR?&>D#Mx_ymQv5T$
z(SH8tIgVrl&QC9>fZ-Z`{MWX#30LyFiEtZ)qX-COckRDBcO)~n+!`W_>4*x{1qi#v
z#r(Ga4hS^bfQCMJ3;=V?63`a31o1+L+x^gQFwZ~=GM!h$Pdxov#v5Z<&3%9Hb9N*M
zRQloyZMZ(YB}2XLdwk~{1_B9^%ig^*(k<Cr1l#d11)hXH)ff{LG8%Z>*aiA}U2OyS
z(V03%tk{BhK~U*jUXP52nUT(jiZPmK*pNvwLrpEOAbME!zEr@ewtXDI5yQU$kFRQH
zl-VAhU#KjL-J__S&$ck(ECz-Z_w?=Im<nT;FqvFv(F01-&W%d9(LOGOu~cf>w7bP{
zM>o@`M+U*sjeo7kYB1&UC%Kzmq^9(#DX-H9v6$3v2P^5C+)G+NU;0Lxx?I(*_Ec@q
z#<r@nq^K~CUExFQ<tx0MKh)n<;@*vz-=TG#<+F|cTaux>0Y|5~WLdQT^7vOf*79MR
zucu3rn)ITGoQ;u_nwf5r<b(8>jM+Lb3v_I1ZVfUb+=j6Wks<Ep%uUs@*}UWMNpHvd
z;^d`pJE)QLpN9?Z8?mz#mT0mhs^llcN_{na;qtZW^lR}XMCo2sSTa^kQnjXh95wDa
zzdv&HsF6Dwspe5D)KSb)&{72JRq=Dq&mhZ+7~y3GJY}G2^)<ckgt_;Rs5yFn7T6HP
zBOZ+1!V+G~?(B)wf0kS@vlr=eB2&uNNm_-yj7(?8rC8^256LH?ruAoM4z%!oP~(k%
z!;-c+xV<B(E|U1J$7UqJL19wLa!#jOAmceM*8~!{z0%4+(suNVcG7z*x7!Q9@t&E@
z?e%ovP*<@YpJ6Ack?3C|9MJ<*8PCfHY&e(M)8{Vr!wI0BOQ%cgj^4sf%6SE_%LTrC
z@OVk1lAg&kDN!jYe$(X?%CL9{>@?XwdTN3ZE=fmk4l;TFZ%N<Kwi6S}<zENfIHP7g
zYo#bH{9(5quqiZyYt4B!z_Rg6?ICY+Y2&vOf~wS1M$GItd;1r+j6LSZ>0jvmixHx~
z=7(ZH-#&ZbTd$kUNX&C5<fU)5znUVmWXK->eyz6NMZjsc5?z}*;5fI;XXL?QGRcz`
ztJSMjx7!rO?7vt^O7~*@UxoD%(=fkf$0LM*Zn|IN+J2;)Ud;!eC%G~PT*a>}Tj`<N
z5>(65TcgV{QqRw<fVOxz5)62b9sc?)RRpkMz~CXGRS@9@|4}s{qiqN%^3Aa)XPBHm
zb54tYw{*9+Imt)W;b|DpOXTD$V|j{zjgN!N=_teTnkI^Qhjs7FrIH;#$L2{%67+Ky
zsFV6_(;r8{eiX=Vkl0PN1dyq4DiG%Tv=0U%mO9o@qo4BL5QCyM&XuMg34P)_c!HRh
z(A_)<C`>k$=mAadTvS9saU&I>;E;3ohkPdd<&OU57k{@arqM$28FP{qw#$D%kt>Nj
zOpz`CrtVEC_slmtP1E2k(47KCo-V_1k0FSX`$ETw&*6?``Rt|sW}nA9;t{F!$da2x
zk=bp2(dY_y|F;c}fx}NBK70CeUbB|ORhO>FgZ5Pgn`r)^XlZ`JJ%(_rqjM;(LsMQL
z>fW?3IQ>yJ!I2`0yF^<zOkw(>pkci*a-Z$%w_t*(5qU1!(r;Vwz47Cz=cKRA3=7Fw
zTnIGl?1W=Qr9G<Jdwzy5Qs1x{(eMtxzL#KMIFKf5v6FoWk#Z}9+K?{MzrZ9$TPj=s
zIUxqKeS0><{s)t7N9<Hp4T~&``6|_CXkKOKd32<4%Vv4a_WH(E@<d-{t(bjQmqgX$
zNSwSx|97ZK?mmchmk_Fr5|yvQ$<Hu=#}wROaayvcNgEOU{%QUvrQVy<gV_@#^S@lc
z*w8*{w}2ZEVTILAoGHa&Po#bU{u+(}&1)p}b<u=u*3Reuw6PIh=J&M@5H2@L6zrcr
zBUe@;v}@{(uEDvgmJS5x&{r#&RmZptSlMne`M(`p{e~*_m;oOQKfYyQ#-2G~xeDE&
z0!AFeo{=vT0%StV66r$@-rxOpq-rRB9`dZ6zUjb`{>K=!(nv99Nr=#3q)cjsyg@-D
zw{YpWr0P$<zGsPvS&!e}K)#}_^nkpoaia&+m<uLdwv@a>cN6B0_n)Z;x=6Z|Xl0wa
zP5T3b7=TzP@rxniuQ4ZAXTKd(Q-6orYs>u+P{1EtLnipN+FQF4vNcc<I}kh?Ir3#p
z*~4)yB{A!X^b%vZA={3Yf027o6wSkMDUA5jaEsna&)29|udajb9%SApXf{{FY8r6#
z+0-o4muEi8^oe;mlBlY;79wmHs%qr!w}$Ln!wfs|2Yxm^8SQi45`)a1Dv02-Sxyy3
zqaqr#Xixp#uGtDu?B$LLWku;J=d7Ce|DCNCT-%c%9=U(Z5^*vbxBYF40eOc=!@5-J
zU`yC0;rhGF!%gZorl49N%el5l+PqkraZ<LXVH!SReyu05v#gY}_|%p5ZmMeenI<Ck
zdf<5djU4(8s0r0)+?{WF$RCH%=fRRf^X)er(^yj$qu$yify)QUS-+<_cgZJLG*k=X
zPUzc$#s_xz2gw)?;z?k-?_jDNdr__rjkP0$q^^bVDtZZ}`OgOIG3inS(6nl(4>c>l
zep=aR`H+Ai*qsA}UO3bg`}o+bW^8H)tErbst03%7^?Ia`{iy~q<p#AiQ%B^+Q-mt7
zyABuIGg2>Qsx7PMDzw^j->crr4@T8`OpiqN^!~j0Y5yg`&X+#6v#uBQkW?jv)amXA
zOl!3-e--$8tQ0Bo#X7|Xy9DG~JriH@6srC2<IDYGa);l=3zBbEcv%AISNXzRA{u)x
zB6h>i_Iz}yz~PSaI#Ki$QNI|ervxo22tl-cG?l3q!VI4yk9ee>Y1wjAG01_%SD#e^
zVb%mbH1M5)m`s-B>}*&hh*rO<Uo4}qWLUF;w_A_hV&qMN*tHy*r0SHC<Ni(a7uia%
z7g7C&FUNv&Sh3=X6EAK?ZiY&0#JoD6ZK2f;4d!&B!(^6(yfisLy%YxNrKJG6i<+D`
z33ATRHad^6Yix`yj*adGTQ-0{h#oxnt$*3@NtSd{4A`$8LFUn~zD01;RsFKcwI+^}
z6~C#R9QDv)zW6XqSBO~lR`}3H4ujUTx(=ah4ogAIS8%1xY7TYw3wE=TDl4;^6DH3t
zfs>H)uJb5!Pw(>^gd0zqt8Xnh`za;yZKZ`zJf|8oRJi%@;l^E!h~WwMNPD_OFPS(d
z{<X+Qi5`Sc-xNv8KLy^T(AH!m`yOB;9cQ2TSkazGmQv3ynXTaVUKF_!V(NKobvui#
z`~BtfieqT0{pNcV8~qD5AR5=3(%K{^3ebwh)9j*OD?-J?2_B8orHS6*kJC4M5!GWj
zLKpj)Y~hCgDLWB3+%_SJ<eH)};@8@D4aDtM`%e{2g=EugT0Pt1HE>~Jo;j=a(~w;H
zorM0E(tjlarJS~(SLkU7w3CSeP~~Um$r0}j9j-KiAMb~bW#cqx7;mu?HnXzY-@9eu
z{P5<$_kz@_Kc6Bk(iBrw(#&E?Z)!`+7!%kHbto`rZ@usNnY2nfA(>JKs&Jm>PBv*g
zh<o+WB7iq28UWp{ExgJ7^_5SZvw1CpzM6j$aEBTXY)oX6rnIgA6r=JuM~X(HDb+I>
z2BPg3%LFr!DY9j{>=xF0lmOOJVALyVuwWMhDzxQ|f+A0%Oe;6<O?#i7vW(MX_*ia4
zhnf>FSZKY@OLv0wX#*Jct&J^s8YGYUJx6z~po`Fku7gf4Cg+QM=WuJ#C=ZykP+OnU
ziNpnB1*Rg-rgVl~V8V5&h!#-}a8rzVv7P*+N4G$D@afTE?YMm7mxkqi2!GHJz`(gy
z%-??Sa<qiO*MgjpT%uY|I`<__lHk!B40WI7o7V*-K@}+klA!G<tz%E&To>}yXB!`l
z1-uUDjqEJ_T~SpCNY(Csvz=$PVtkk8q@(}P(&-JS+4H|n;h!e&X9I^v&}=E&GM&TT
zp&&RG^(I&DqZplbjyxen)T5ZQOy#FqRaK-WkK<S;mF-LiZCKvX7m|ss?`x^edMr3k
z>$h2%%sF;p*Cu(AB{3Hch{%%sDDlkt!-XSh;t^`^cE+EjtnrGS?H@<1b4E=vGL>tx
zKGG5EXpC|{9u0Zh_+|XM94%GpuUFmVHrA+<ZcS6)D8dhP+2gyCP&4&gjs_JWl?D=2
zZPv)rFvpzfc8Je{t&r3o02b?Pl`(9Y$;@CLG@>tAFyJ6(=}xkriEc%zv}CN?rC$UJ
zdNx+xD6`9O68f?Crbm1$#MxAR2_GLRGp5BTr)0ZW{Z>=D_M&`te<h=Nbg8m^f71A(
zXmDA_Z-cp5D*9djL4>J$Z?O+2wj<ta?k&v{sF8R$5yWf$n?GbVieI-<FRts8hQJnq
zfnbu~?FjvSdP5nCCyl>TbVojZ<<ulEJu3CzhR;kAHy<>MYSKdo0a%sMJ0RuP0VV`W
z;ijDc04?Rey*Nkdx7nKeB%CqHvDtjeW`4TjI}Hr;w=@Rs`;`Dno5@S?HR9l}<K;I0
z8Xcw9Sr|&<ke(&xwc(4GOdmXNh5M>&>tw7736yKj!j<g&^_Ky3F49#MTOVmi4@F*T
zVPn{$UBoec?(&Gp-=Xk|-J*gF>>t8-k{H%#6;`!DD;p}OU6&&6z7M1Aqpcc6KT4TQ
zc_Q5Tpi-U|$Omc{kF*B(gUUL<tU<CFJ$6HpR!<Uj{1f}G=Z8L_xu<ipKU%tbB$tcx
ztwxw>>|OTk!p4YY`n*c6$xiwgeBTaHW)R=y@N8;Y?wM-)(V{FW<GK}z#=SaCA>|37
z*LMnwbWftyl%>u9oESZL-xeep3~VY<Ro;Ym*cj~qj@Y3GsILQHzW9h>rh5YRcN;mm
zHQwkB7F(!N&e9Ek>HB%}He5<MxxMFM;t=~co(FW4*O%+U4)otX9Ea|l4(!VoP(Yp^
zuQ(nDJ_5}FaDPFR?OF5?2pjXwf!P(?nn1#u^f_4LF}SgK<FnNW;iK2NVouW3Rf$XV
z4nF7footBr$2>nw=|%gLJ=a=0nl@w#9ofbH&_;)@etr^Ol)o0<V8#19<M|-yJ|Pgv
z3~UaDq6oTfbQSt@8nq>@pE%M8DAJ_;gqFw>w@@ckXZ=1X`ZDpd^hxIaR`0i8@ri?9
zgj0seR>q-{Preh<nkoBD$L({!vR=?{EK@5eK>Y&U2MFDt(!gm)r#Cx_h9hx;uD$+?
zQkB80F_s)wi-pIcHzm1c<I?grQ+*MSMUJqYu+9?Eml{saEO~or`irMf=y33w+hRiq
zs?^J|<?@p*aGK-!<<1_YHKH_G<<m0$V2{I0sN&qfU6O7tanLIEaVpatA>xHscZ)K^
zeC4Sl3@3O65#=-dPIg`VvtPf{aNhr3T*P|Ae@vyA<;f@|GboE^Px;mY6;!I)(<i}$
zPN$`dhMq4ehCFopz6<QsLe9C@=1ndm(_?zkj3*lbm1&b7OCA?CmT4Z1K?m#Y((K7v
zgicb1B7Y51({_o9J&a{1HxFjN)xRXKYV`b0fJKqFSguOJ)&(M0k=R*KieE~qJ|Q(C
zQvej&e#jBTvNu_j{@q&W<Kv`vCYsoyyTgW&Ry4V4mT-5Y>Qu=-9c~rkAq4{EiE5cq
zcF)3FO0+dOtd%DVDCb?`r`6W)IOmkW&z*z|A`&KFzF}3O7M91CiYP!H$GlfEsojj*
zZ{N2BckjNrVY49WZ9%lrvRnO=mod7h?#x5tu|evWgA|{+T4!85M@Xx*ZSD0NVTRg>
zAENZ4G^=?s8d};l>im5cc`na%B`ghFou*2H+kc3P;v<@xhwoeS@EfQTR(|`Q#_h4E
zC9W&QvjVoQrB9Km0GB(3<k-$#2VsG@>{~8QN;#48L|&jI>b2veOL8%ubh)QIk&6)v
zuZoJ+BNQvLXcG<FQr^5yekoM^YEGOKk*cYU`c)a(XD4l`!oK`VA}Unikl}SnWe7$Y
zZ!y>`FGFYtya4+m#=zu{SU82n_M=c9iPCOs$<I>E3le9+ipetVyQEJE-ruZD(~@&2
zttuN8l7#DR$lT<)AIFjTI<q)igHGwI43mTWQi7c+OE!TZsGTgUTanh=sm$8KWbjzq
zQG8ulcq?8=nUk;}n?GrYvuJv6i>UHvPGyqr5H}QIoiI{4_1Gl%(eryZKL^uVkUchN
z+WXj*vi9XsG;ol!CHq-;HT9D5Wx5A(eJS+Pg%W>fa_BRxItlGT{R!{mslx49i`f+q
zpBjrDM)exXqon6bv>%m^JiUKgUBc2?KGso6^@ZOaHonM~J%iv+(E5WQQ%=V2zb6Et
zL$9rky==xO?i3i(1MJFc;o>K8A-bCM3b3IlRpHy--s^6i+MH&HqTh0=5AMYFiGAGF
zztutpDtggLmX)m7El{i1lr~qV=MrHfV0oQoE%E(_Z&ixIMpjOb(|DZ56wyZSs3Pp2
z<zc#IgEuOx_E=&NjTmBV?gt$3{_J;;`1a=1kE5k-Hi%|btFyrn_Vm^9^Q8%IPU7!?
z6@N;zE6la=3DmM%xgW1@GAm5Mo^;#~t29sxHhA?%28at!LUIsY+FiZZNR{kWcLIdR
zwRtjlep~WLCVCjuSllN1F~RleZioFcMh(>hUD*5fE&xzAd;Ggn+Cl}QK%|dS-XrB?
z-Q6EqESg8vA-a$v8C(gw11nr#-4Y*k=!awnP>y$<%7)vPtX&(SeqN=nYtLEuBd?_Y
zWxj&-w`Z<Nj;$<2hhKWMP58vj16nPlb!5`Gn=JLsJAJIFz_pHs?O7bfdXXbS)N~a0
zGda1kMok`s+w1R=WswEbdm9_<7Cq=N)IJg53JmWgtQboN7}5&P5~8fL&Efs;+PQC7
zRx7mSJ^nx|?ZrfVt3KV(jU`^!2+#1X2nz3z8@%ffQ5e1%ZmuhkSZXRYkV{nki>xkT
zkhNdYw%~Sn|FGAt!)K5r5agNKDQT@AIechn&+c`cvs}}KWeV4FeB<%wa!=<~1IMQ@
z$+-KwGD(~J+A^iY{S4009U1s`mwb~^S4Z@-l-D|TnzYPhimb4t<ut<}Y4G4JfgCtU
z69@u|yispT-7U$s8oqplTr9k7&r0a`C<?kyb$pGlhy1w8^sfHTr|l&r#-FqiH=)T%
zLPXgzs}|S6LHB@%ueC<K8KHS|v#S4RSk9XUb#<Xq7PfqC!FVDQ6spoD*7YZ~34OnB
z;KM|Zp(GV9=LXAi4>0_$x*#EYh&l0XIr>PoZW*$}Oy_9JgbI6l(M0xJxPbO4tNC=L
z?f>Nhq|w06bK)lrU3LBYpkEo|KT)YQ9%i&VufjN7@3_1q*HY~2NwhjYMi9lGMvwp?
zWD;q*54G_EO=S0#lYY0is&ksKbMBOHG34Ix)8>hm|B(GfT$TU3g_iI5b|iAgEmigx
z-D*etc$kVqa+PXMQ=MRn#%LtLPl@Z`ji*wAci)hSbvyOX1fyTY@sBX~*(5@B-;`vO
zvwUu0rzHv2d~*NG?D!!I>?Azq1MV(DJR!oDZfv6pa(+6hRS>UT54^mEs)Od!%Y(1!
z-x<i7xzpwEj2q+MdR$lgkq{pCaz$N#XnjJt>~C3Ylu6(o$u&*U`>y>())T<nxHi;p
z`z*D8Sg6p)DD?(sa#tHN<-M};e<~YL(!q|)q#k(2O=SuC2{h}#uUwJiP{-32xPEty
zjj@q&VA?1cv~j;^SN@l_bDWz`jk-1|kyo{Oq7}!(2yOQGxheWK$6$JDcYXAp-Jd&(
z*2@9U@+w=jcu1;j;@{*(9vO+H3Gn>r^v)sX2k0!@M==w%ZcjFg9cx=>3L{bShlCfs
zBqBFMpETN~W%3mj<*XhUy2mU=OYK@4#96;DvZ`)3E_MtypwP%D3N!vgOVvGSs#skS
zDEh;zs3*-j;AFHcChxZ(7(^OO550bn5)jyLWAaJ$Y(X=J{iVz^(hBcLYHAgY8VhNj
zqDI{NX!|B+oDCi2Q-g%3(o~Y7%Jp@tm8_ANjMts=uOgJXHC1Q~)rLr_c$MAU=Wt{r
zfC@RHintJ1srYpIBweGSWNVo&b#!Z}lW&8NF0vxHl1>17-=0BBM<x4v{@b)7F2jlM
z`L&wQDB0=5<Jey%v_Dy{B4s7ckoMrr-Ir&P1Bbt%>KdB1jC||(wlZ}+{g_bnelUGC
z!GZo3dwL7ndaDfSb2?&`<TKhA+jBx5VYmFpG0h`3CxSiweX@F9_+zbyu4|EB4`{8y
ziTBc+9qpi_QOfyLomn=KYZD$V+_{4uTtc}tIG0($vclW)w5<H?)TFXldbpwP8yNi0
ztW{N+$0g{BLCW&!v2^m<sihV_QQnyacS_h|KP`6JG=ZhM61%H-KMIO5^VrGUDNcRw
zMPJx=L)%u418|Ntz1m<+;&Go>u-1v#nx3+CNeDrd$<~F&U9mMnSHM_gQXynMC6w$x
zM{2q&r)tSNwC{1xbu1fr$r!3qe#jALm?fxIGVRd3>pV6>_v^UhJ%fvr^^0ZpPtUGh
z{YMQ!;@A>W_ViMQFmIba`n+eE!o>!3V`B|6tVn;qif7@hR2~8k&Ho>ozB``E_y7Oc
zva4epdu3;wWADAUV`jxU$1Yi!k(uL2<ltD@tAorUWaP+k>=3C)MCvW0tnj<*^ZWkg
z@o?_@x?k6RU9Z>k`Mk7+j#3E8#i=b1n&5Xcw^HoJ*go@c{_trt`aOBpHNXu^_z2A3
zmn@^*=~gQH{m%%%h?aSZotrOzlxLHCA4Kspy;!1v-XNjqovZhWlWC*k!(Eb`Np(6J
z*!i?41qyWH!tzK~x#eS>MI9oCgf>GvXPhF_U3j=aCEDha0qkdAg~%5;#yd<>Ex_DP
z0Z;HXG(~1k$Zbb`&GJ<)YbB@nsX+;=qq_!8TM^=7wnVvsCrP}Rp~k9KXk(hZsy&v9
z4V*pRKL*dNwwGdAHT}I%P~*>0-RvI@TL?e*+z36bFi473D=9Mbop-v_SDU%^o{Sra
z2uNrPhjN-Khutyzg|S`ic<=D+p`U71wY?2E%vpO!=BLDc-Y=ZIE1KF{Pi2Iqivtbs
zXDW;dlxX2YnFA^VNtRnj5eUVf9F#C+dO_Tfa}t+xKnWMS*|(E@LuZ;Lt@)r|)9#EZ
z@@_uj2HzhmTv}x45vzYdSCiM}P#Iv(XV$QtHr#e7W|2GQx^SFiX(NH^oOzVmPc02B
z!=WsruF0Z&_r~>>%11F#Zc%r>4IB?gJ6yBeEi#+%2><U7jh{Db(^x$oQ}U>0OV>2}
zb1OQKnpdwL|G*M+FGtF^`tdksH&fiBnSRj9^C;ZeQ_qFsIS>-mhu$q>)?L5zpn~(s
z=kQNTw~5zgI<$1RL*Fea)CbP3P<Lx8x21K|7#iD!uYo(QW`yyojHRA=iPeJsNcWqe
znSK$!5ip6emYSavd|#iu#6;!V-)x(4S@bm4R|saJguU7}88LAGsN!V%vD|ZtV0gK&
znya7za(3PDG_lLoM(M7!x~<LIKzBJ+|BMQ;XS)MG(FWNY4L*(ft*sn}N{-C8sxk+D
zeolhD^a**4=aJ}Kc{0wv)|%?hzY>8Kslr4djgd_Y%f`Bzi&D6S!W%Y)DrNgdhxXhI
z&Mr=R@FaH~+5Ki|c48z)<^DN(=tsoFZM^(d7v{8~E^_4cl+XDMl4w-mR839Mg~J<9
z*1K%zZ=}GQz}o)gUqa>k%`W#o4Nwkuyeut1Ds;GCTa&{yF_XS`-hv7hWHLMqdiAS6
z%jqRHRsLkV$g*1g+6ZV_y!nzJl?F%eM%52A<oVqOM)5&lkVMxR-fY~$x_~%SJU5I!
z@V)eX#iZBr<B>`Y)1^iR19AK5%|dDPQg%9}>TFd1d-Yq0#{Ch&u(*p=u$x(hjZ0;F
zCrVzzgb=p>+d;X}7`1BCSV__v%GgVZ^+FlW#cC)~EQ>Whh+^EvDx{w?&2(J3aut89
zn5r-(=|%8OrtUrIa(wn*D-rp-lK+e>=bA?kw>8_`quDZg7Sf;L(QG^hJJpGm@BUd-
zQL(XiU}QbE5v_>#8bco~s>$p4WIrmN0PE^F=M`zmRJA%~KJU~VC)HTX%C|<!;|j(R
zFou3cba#ObCF>A7*T7>At)b3yTFug`PbaW}K#}aO^@qK9<bwL`qgjt`m`B*an8vE7
zEH~}cuiCz2yP}=eo9mGtbv|Y`hb$qSVPuK8tgv`h=Nn6BKZ<WNetQ2f{zI;eSXZ&`
zLTqQj>}Gc!&I6R|uEdyzB>J^3lj!SUU8Cq-JpFpBZ6f~xGehcNHaw)WF6_&CXhP>y
zxWH376)-WduHbcdx_htJ!>?$W85~gct1P70a?v>U=1);CTn;15)CF-1>sdo^2NUF&
zN5HZlL7jO7<~Cao%_Fka=@VQNiBa|PZhHd>;0(&4)r7OdYPce-Wyt@?ru$U@@NI!1
zUkR*vO-`MD0>!#Qwk_l&_U+WZEOnoK-YnkGZc~Vy5g3ep_LWH=E>7W%qcla#-rhsy
zDN%U+2fLAZHe<Sl_KEwp>a+4C?wwT`6U$5eABz9vVP~VzKGVJwSxTh?rfrb9sV0}R
z5Q)NH!llD&aoNW5C8k~oA!Q?-t059>SxuNhj<d|Q1%~K`u-7^|_7eXo-737zi6Kz5
z`b_FdMo<_UCv~%sdNAkKjqcFb-AzE)pv6D{jUe%w-a<u6GW*T15CG(RNZ)avWcN=y
ztW-A9{(H%$D!O63CS<W^hMn1laeU$>z!at*k>9IRG_&teR2YA5l~Z+of52Ei&$2e8
zONwHX#{fnx&GszhVDU(nCAHPb%4WH6w2I@c-8^H#XNWE*JjrvzS;M&uV{e6oi`{tH
zbKG1jUu9vwp1Hjh3*;WxSR7_jKDAKr`&?BC=*#l~qls_*s<n6@&PkQnTzTmm7?VjM
zRuo?0-Dh!M+cP-0uI@Fo-dr*58zk(84f`H=6s`}YAc%F_Xsd1ux3z1s<sz8#$NX1>
zc;&7$HUQmFR!S0U17IEj`9=Xuu7M2AUDFCOm2<|v)gD+1F7;?A*13-1O&D8-eH^!~
z`1kwiJPwL$N&w!p#}(B9D)&Z()J8*F<@jl6sFUQbm5x@y7TW{T3KNU0ImQBXZ4P77
zm@zhC%BBv}*2+#AaXLZOvokC+2}3(s3kMC>gddx+{}N2OQ+25hEgr@YBZWxwT6$hf
zq^n>FJ!LhgH)ms@gJLBnV(&Q=hJ|cf6jAWR<cvR%8aq3qh>JS|PqyMP6&0aEVU$ZT
zo|uZ4uXS%y|9B=_b@N4~mOw$2(QSI<@?ePbS0LlmmOAf5mienYEN|kZ!sL#~4O(hJ
z1*WnCdqwwYiF`(msK6G5L(I;Oy`neD@ytoeGGAA~>eBW6F}Z{YS<xKGHRy-<Yt9%O
zN-;at<!tsTYr}nJN?6vW{gW(Pwdh=;)c*dIlU@>6%#}&7LFfi2GRRR(zU#HWGjm*1
zT0I^v%TbZhAl9X;nQ!8~1@nDa)0TKk{<n4P{QDs~Z(}b|$Mx_3J$SSMC``Fey<g49
zYYlPEx5K40_{0WRJ~s2wWf#o?RBxn>*PmE9cC*rRsjpUDaqdtGkDA-+7IuC(eT`Gn
zn(F$KNffMb9zjRtF`fDQ(8~tagwt|r8|EN-fyP^PISH!K9ErG>DmRY=9UY{(Zh*g;
zNT}^oF{FLA87+=+i2v+-`0|@s1qZ{M6fY%->u118<70X<XAB4FizW8g_}AzTJdQ`l
z&cnl_Py50~cTBK+KvzA><_^iJd1|)p4IY%*#{()!XnDw+>bc>?B%XVxdc8H3O>&#t
zG&LZ9EW*@hVMjgWN9VfR1ZvkQIGV7gx1w+Jz<?`8*!rY`{x-0RJdyCD!RaO8u7Me*
ztDBoY)s@@mk0DtxAqN_6K2dIPILchW`(tvH7pT_@JN;;?hirh<$c-g3S(J7VA78b_
zrNqmHw?XXxG<}$#^JJqVp6x!Hw)<E~DZ=pENUW%Zu-kWBJxda+b?Z1;w`?lH7CtQ>
zJ_T1B3jlr1ijHbuI%KtHr!&-IW}e`ay#7E=SPtYP#<lq%c>_3yHnsbQP1(fLGZ#Kp
z35830GkJ>^@f4D56}R^gZBFuHrk}qDIvg&m#AxSHp9tR9hS~W>HsU`c+DesBfw_VB
za?S^a-rY^?bSQzwM>1@3lKn;UZnCI{HXQq=@dmuT@BXOp=`m0Q_q5)BSb*LDSf~H3
zwZjRf1UZ6GP9+hU*ELrcFrl<PifA)7W?~x2sgIr4n=IP(t&{oqWhlWG*YTx2pEi*N
zDz|pvR+-=+@9#(J*Hrt>ur0<w3GIE$Bc7pJ7L?Uu=y<cN@&<oFS9+*RT&@Jq$h-Hc
zd>xH$yzk?M-PDT0<F$pdh3^FOU$N7zhf6yKALds1DsyB}U8_HK4+VA_3fRj=9SpPi
z_cD$7XNJ!ika!F5>u2eZtB>S`%5dTq;%wq=a>458n+*gsiX+sUD{E#sg@Jm72B;Jp
z(2T3eSfYe#0C%O(7?SN|?;pHn#d`E`21(}3&54=8MQM7NBQv_6T23XAiGy=0v&+QV
zSB0@g%>zHZOp)`v-PY>++7gmNv|h5{8v0kxa5P=D{2Z-+`&O@9le7U+&Yqn$Q{3D-
zQ<hLX$(iD7-_JqLk+36BuEL#&Q&Vo3GlD$z+UQ?IBJ0YGJP^I3D4cW_N{W^C!F_Ep
zUgq_E)26yFAqEx!|8ZL{Wace%R>q2QTzoTperul?yY@$CLyO!a&|J(p6hk8=<bz|U
zVD_}W@qe*^8!X+4WGWmidgUN0*t~<`l^at@(=qjd<q6znW{7i<xhYH?O7`4-I^~sQ
z7z+FvBZuz3JcJP@aE}mOzJFh0*E=BxaXp$UzBE9hDlR5EnP5j(*P#<mG2JNH?NMJs
zN*%}`|9)gagD6!uI9DAhZ!u?Xz5vJCVrym@(ViRFJ4GK~W4KBr+8^j@L;GZ%ujt)$
zX4|A^p^G9i2$ug8G072oQ1N!7c;g1jTrKq6f*C~T-_Rh|;I+|FaeOr`Z>l-NUqmi*
zmjfjaNA%hW-H}U{2Kg!p%Nyy)hN_O#LKkw!q;?;`y=x%rq>pUlm?I?AyWkF!W%w1e
zyI_jkFfA%f(egq<Vw+&n<%v(RxP&2h)MguhJ3Q$uE(mTN*6lc~JiMZBQgav9S{SAA
zTpY``Q6>P6(i5QT^|`komMduhxP$TgI^OE87^6!`rlfo+eY6`v;cBRXy}}LgRz-0O
z>%0^j|J9ohZh)pjt1mJ3a>q~&kfyocCA5%q9I<0Bx?$s+Mc*uCVWIg0%D9>fv2;ij
z{+qKx3MWx<{)NsO_TKm=+s&S=hNp(>n63SV?(rzuP$5>FZxc-rxKDq8!INYTw<vAn
zTugvg+2Rk}I1nnH1bLiwV!+rJdA=)@ax7qq@A#{6C(}iDKK4LE3Xl0T`sC-hG?ur^
zh>gdB32!`@%N*G@$x!O^m>>WjsDS+)qEFU1#zNvI;utyDKeNKvv10`)vv~JuOke$P
z8DB#mLTu+FueZvW7T@TA+R<F(Cj7BUn1lOq*sK^cM<yM~$~&&1>lk6k>x~K5V%d%M
zEDv_*2$II*$nPfz)3D4H8fq;jNWr=WXVv(ao(8DbmJAyo#FpXPAkEwbGJFL|sPPL@
z{MXxDHW)IH_E@Cu5PI%Ivgd~NL}335Yv%VHs-^D50WFU3%uEMwr>m6bPq?m3#JZ@#
z&TdQBQ6=iEJ>kcyakQJu<BIG(4$6~JsY)eA3T+t}|7BSk^1UxLMHYUMj=19q=%DKe
zt}AQsZi&qv6r>>*-tY@zp-B1@^fq8zV~~4#>B`Y}1K2}IhikNqa0DngVWuO|nAt}=
ztgypNL8Lq!aDlHja`GUWK3Ckqxc->NSkzj4)SGn0HaOh@^Sv9XbkThBHJ)tqpjg7s
zkn2s^uFRYvM;J8~zk50rD8Uv?i1?24vY)u>@K8Te{e55gS<<cIGQ0(C7<nRYO*!5j
zm-5OLob_Udp~;Q@X26ELMCohvFuBW@aHbE>qprd(xUI>qbI{u8(o^fTV!p}&pe}yi
zQU6!B0u-5HOz*mU&}s6wMdddsi>H(`GHfA5JAbB|9?c@dYjO5mdD@rCt))2p@Q-Tc
z31#eXgK-HQ{#Y~z?Pti7DOfoDMynryPcEeiE?Tx(qxhKp4&2`>GQ=p9>Hx@Bl?N|v
zao2c%4Ht+?JXp`X*h9KWmVFhI_`0XkE&SL#S07kn*`;d#qFcM~eO+~^ncb1s`=Iz2
zV5Q?mi?UoLz!kM}r<1Y-KgxMje=f*=9io3|P<dwoh*{^4Z;)(V_*u$0U1T|!s9TJ|
z0MZk0D6zJ$e8e52df61ox@}R9k>mC8Ix$z1e7cevNZlb&ppq!5y5{($$?*6$D}Bn=
zmI-*ob-eh<u}Ui&Zb(lxSRPyuQYaY>CkJUy+84nMeKdin^6!SQEsMT!*!$PHmnS2Q
zB^yia+x`3EXpaC)_>MFEao3x$?*3*CXK5iq-7vW+f>#IGjxQYDfaVf0!E9)2V?A98
zkgu-s!En7d5axzot9&sxg=5b0sTOD?gmskcbM@S%4Jl+6DEL*dZwIMvt`EDZYPWI|
z|8{9z`qr3T<vvX$wrP9O^`Z2MR7SE;i<1;fznBpSq&zkVpVt?@@rKT?8rhECh)yGk
z$}=P!FjKa<hXhJgGIZ|1(c_MUo-{4d#M?G4BnDq+9k6(L%FwFkR8dk08K}$#nPFrn
z5wIgUU47{~*53d31H-#U@j9~G5T6<-?`Tiqh;lS9eizDmgl_V~nHNfvIWrkmtOo1r
z$^ZuNNfx=x|Aspd&3%8-`v%^-x76`I&pWvCIZ%~U3Oh(jiyE^zthqA3<`L1eyrKg9
zI2{4KoJr6X@D||&fVvmrJg?tP!%?eL@(waZa+PLZF6U14Fb?2pxC@BCOU!>LjYvm-
zJQsqfrCA8eQjFI|l3C;-O?{_*-*W#3XlQ-U*1p#xKNOo;?P8d3;cuvV`@Y<96HNLK
zol0(L1{_BAEhNm|tLG#xHVJKFcRbJ)!dKcvElbNd3mXKhDL_ZMTi;ttrDzea+oGT3
zw=O>X*2pt3$3p5Jzuy79Jt@{^EfG+6b?wZE?hQ(_Ho!%-L^YiFzz1y$fb3V?a*6mw
zWbQ-!<y1GrCwG7BiFx#Q7nTt8m2U_o^t%D25dG*)PW>poyVK8)-k|zz)QgJMvBvzR
zWT43TftgaiX?Mj$v=M;I_U>qdpi!mCp7R<^#V#9Z@I0c#cr}!1kwFTFxjc#TLH$(&
z>>2St)md+4%a;nsSb{Cry|{ZeF~rbAHGnq*n(N-_rpZP)N@A@2MV@>sB$v1W1yAOT
zI=d|ZDEP=h=eDubl9>X)OqcOpv-c-S0BSNkebyGzOSGL**zmh*7geOev8}6^1l<Zd
zd7Zwt1<wJvx2HT(I5z@!65ZX7SG*+oeGbaDTTTk9Z;Gn|clFcCzOe;d)r@WF-NxD|
zp3YT9`q53~m|v@p&Kq03PX=1K<uG{1vI|q$TuVT}{`dC7P?w=Bo{i7D52JM+j5|L6
z?^Avm<2>hixeIrn)3H!xnx<5l*f0(^3#+ZQ?+9v^0z_T&ciHhJ5fQKF-k=YVmA)I-
zXi+8W{q;ySp5xDG`wtbF8=oQeqno{$!=Qk2Jj2}hv)}Skxno~NtV+yle@N%jfIt&B
zkwqUBz40Qv**5a~=^qb^cV%gst_7X_R{d7*bCaPm*nmBn6IzO?u+7{sjs*$FC0pjc
zkvN&FT>Sck53+stbEwk6BS8N^<%Zao(~}b*z}pD0Z|?;6xo#w*Fs#$;^Bw!#n*zle
zVN>6(>5)v1_zgE?bL$)CUTmtoiR3I)>}*^>A3YYC^zMz$SqiVxUc`_|J(~QwIin@Z
zlBv9H0Q6F@%-XMmE#ht6+lDg06a?2Q{PDC5`rsY<r5rm@{1bioNnmGqS5ggAVx=(3
zCnM#v_66uFC9r-@5Ud^*&;PE3|FGqaJCii>SD2@H-p}1;c?UkkJaNCdzWw93O2;W}
zKL0Tk%+BuduwY&VH7HnBRi{BNeN3SEf>n3hT5g}7W`eO%?!h#xSkd(#`Lc@)4JOEa
zs`a-kE1tp_b|~5MO_34_hi}g~A4xosp_(YQ=A=)7ykL~cSBZ$g@z992)fGfhB;q`j
zgCcP6?I3BRDC_Y+LlXq{{DIUn$n~b-&v&RnP4@U!Uc;?>LOm*X#kk?aYVpc#eBR;*
z7e6T|VIEG(FEJt0OY0h^TQNddxzJXKo3(sW$`w?6VNZpeH_x}^hI-)8%m6BG#DB4`
z>(jhxBOY%D`r-6}G{*}2$)HXbw_5fXl@FnR7$u0kBUX3}!47Xm^Gi4`Tj}mCtA8{X
zY1}^PPgsj4C)2KP4YrpIC|BMPm~eIEjHMkQv9mq&{%)^OY`b_aRO(W}YXH+~BYIVy
z`6!&OrnEvA15;ZUSIXKPrU5n-b}Q_rgvP?l09Efm^QzVfz7bl@`<@#fx!K*WFAhnx
z1Ss%z*S@;xYhV_$!=IV0UM|x4B_&7-iZ>__$PF4qcotV{J0Agg&fs<M1p>|mA{m-#
zQXZWb#!F8hI{?G<I-R$A(l`n`-S0Y0;v9MBv6Xc;aJ6k$|JH8BKp)4TI!K$whM`j3
zK@QW!RH85UlZ+C!^Hgyl@FJUm5B_0`m9<wX_HqK(gEyiXgeS32^$86a?=NC)xb==e
zDQ<m$DzV8TV*o`lDeGz(KItc)?K4E)>0W*%bMt&c68{0C$!8a(RRxt&{9y%`YcrH}
zS;Q|X8-CP&a(mlfvuNNcD+u)C`3~aS1jVeoDKeZ!P8AUdZf9bJ$#T5fpCwf6?LJt}
zBj?OQMBb-SpOh%voyI5-<Xq}8uly9{glN8K^S=R@9TsBPA4;{4qmsrA=hH;mfILgk
zCs|VeIuO~KJl__}t=!bLB2zDKsWDVJf#p~Tv*^U3*~cR<nAdEP+-o@M6SC=ss_}`5
zhZu~kh%7)U!Hw8D>s_CXya+<Tp6dZoI=xI8FTz#MqT6JM#vPj_t2|L9O;Ap$8vZWg
zUdlONACh%E#NfJcMvtENmNH>R2SafUD{mk!@_4kb@7`bcWIyOHOJF)+cj4BJf&LC4
zE7S+GVw`1YP<iON;Rqf&5rWPU2T{MIT%o&|HllBs(_+!g7F-NWN8QpX4$?NOb0zdt
zY^|qkb{uWr<uz0cm65*yEM=V=F+5FD55pSBcxS0Ue}(6v%{LeM%g*r}DHWg09dmI#
z!1}<b|NG0FnR3n@abQRj@3M~#XmKJ{wP-Vfv>#*O^V=cLH(YKMjnP-%@G$0FB=rK=
z2T-(B$?gO#Hz?s&1)Ol|e!zz9I{K`KcaDuJj~Jf=aJk|nIiUaL?Csld=E9sv5NL|F
zl(^J7V>OFMy^W1}2SgH2J*>V)J6ERlaRGSF_7U5#^8_~Q>AwWgG66MiYsnig-g0F5
zbU5->9GW8GYu%53;Ke(dIMeam1AOcY+Oqq~Qq;^Vbm$5&U5Y2mwgm;~ovx3vCC6*y
z<A%NSHb-7Bf~ww??UO;>{~u0ygSvHJ1qJ$X-~D*1!c}?%kYBK{e?PTeah*xA&phD0
z!dsnbw7=U%a<||+ph>2vZ{$@@ku?&(#>4}g)e4)2O#XH5*PG_Ctq=;Ozu%W|zdh7r
z1yZu!O4+Qib4LS<UTbUBbl$CBjB+>LzeIJ?rZ|y;?oa{q=6&Byjz#=zXN4Cvpy1iP
zGVBN}$Tkvd*7Bji&mP)}+hQ2+<Omxu9BAEdk^mTlNbY6vE?#(id1DH}W&ryN3^jU0
z+k{RR!;*mwngImz{}!~HX6tMf9of$Gzuzw-+AOt!-;HNok4JbxWzV}G=aQn3w=9qh
z2C%;tvm@F%_5M8&1`NE+?E_!KlcUot#Bvc)89dI-L~njN5dkYuxoKg@9C?0x8DKMX
zH_3s5RqTHqm`O1meU!+H6RF9(HVmNl38{McMoj0CUDR_UXfRL-EnUTcjO$}bPH@g8
zvwksZ&|#5k$+Y}r-<t~Ml^bgCI6pth(&>opOXD%wm@Jg5q|9pb|HT4St{_*8X;GR6
zi-B{-UrtJlIOJ1oA=GlZr<cenKne3d!=E%Jvt^m?8hiWn)aB?{@fRGk_qy-(<u|@>
z@u913GqfpZ08pPgxd6Wlq*Yh~b<gAEXwtH7E&t65%x=Fm30}F+kQDjzn$|i(ew`%}
zzVtJKS4|mbFidIz5*tiIoJ9$6Y92u|4sLo-UuBivmK2|iCk99)O)@#~jW}@)Ul+P#
z0eb>_eEp<f1xS+e7b$EUe>IZrU{KZ1A!h(}>)Nzec)d>Wjr{LWn)4EY6tq;fZQdFD
z^N1mdi3@^W|7r^{GvBqLC@h(Q$bYqN8)fSTFf|Oh<C}>$Gdp%KV~mkgD);#T>=Vsa
z;k{_vDR~X6+L~^bt2BzGcE3D%C(A0uu-AFf*dJAqc?Di)Ll1m-T0$rpt4n~C<itD8
zSFa(T7j<(-rnvc3uX6wyJ6|n}h5e`$X<RZMHT3&aHrfy8nyuplgt7rpzgN<?3LEN`
ztF)+KHbfhGD(P}JKmbn{{MG^jV9>1lR0<x}M-~cPx4-m4hN&^A?~j)1Njat2Gcc)T
z4{jF{qTR@!ChR;I3S?M8LR@A7Se?7cx<T$>*8b;ki^&bTMSR7!4`EPzF*Sa;BAXwL
zD)EG2okP<5cPZ%!bV(U<FD~~0lf6M#-5aR5!D=vt5FS(}h(_Sd1#XC&D#$;W)?H*6
z!1s!6D*}Pzl(1mavFfX(ZarK;t9^U+8M6QB2%rvc76vN|nndbS`<kfQm6;7IDcDG_
zd9C&fC&9q?I}&Xd8+HZerA!z6FYEQ)@Un0rqZy0>y&H_reCe#swVf|=rPp=!a?oyh
zk)RF335{=QMO`{V$L8tzoNtpWp^$T&<Lx`vuNdkts#hxzDlD|h|8=~I)vWci-y!7U
ztFK(Y*0$k~tj^Ql65^Lq^5e3_wE=l+??|#AQ;5{&pYJ~YfBd9m{_y-QXtb=2tXiq{
zj+U+Ghm_8vDP(!DGWazBzY$sAGlgPjpIT}9ce@f4mdFux{F<TrGfN}ML({=8<{r#M
zbh)bLkHKRCOy_4?`{HlQVFN>CR~xF68fA2!3A4q0OueS`U1b2I4zMQ+TSA11FHe4&
za`J5&`!$x^(~GC>X4<FQRV%SK7RI<euDEPv^nrx(&0zk(o}n-=&IFPg7Mvr7bY%Gf
zpYMp%fhpBMb?Y%5o(Qq|rkD`<cNdBDxgMIy=Lp6jWy3T**(Ak+3k|L9=OrPWpH@0L
z?B^3xv-s3Q4!ud8jT`#SZboz^4}HXPb*%ISr_1(JVPr21p!Q#_^fK0=O_{xr5*)GM
zGReQXHTQd2#DhXXnXQc874p=;c@`j>uL(ePzyal$R#q63#zf)NR%EIs-_+F#vERRb
z!9c#I<#qD~j)V>;>9wVfGG}#7{xQoxHy)eLo%{!Q#q)(u%Kb}5<EeQ}Vlpp0ITlHP
zx?nLgfaEt`2(yPdWKV}>PIt5zNwRHYEF8faMUMI+v>UJeY|1V+3yafz@NsKgHeyM<
z-*&jl0tuipakT9#Be?IhQ~-qaLu#IVQxBDVXPxKv^LH)vQu$_*rj5~_eiAoc_Kn8c
zn?EQVTuMQs!g|B_lLJv#iO8k|PwMOCo7Hu>o$?0Nk`~oLZc5Et4(pB!dnu|`Bm&tM
zF<t<J5upvBE)Yg<r|D%CTl1Cr?)jB|mFpV-MGJ7IrwA2H(N3w?FEj_d1`FJ(jPH@6
z`Mj&MVH{qY*Ac)Xlw})K#fp?GvsOIa4_bQ_9r^8@d8rQTd(uP@12<4_&a#HW3XXh1
zq^yC$kdq@#3D-4ciQam1IpXa=3oSQ{Q^#G?%ETqO;S<u^lW06c>J`X=D?iI7ABQJs
zD$&!rMl{}SXZ)bHJdx$?atW~@vmWUuIxa0)jnV^?j($Itz7hRtwd#|@jgCw8Bm=;A
zVKa3%wUGp46TKL8-u@C%`x3Eqa&zBc)_}nGMqIKeeQ=B0t!0<Y8Jx1KqrNmCPN~Dq
z9e6L@9<)Mvf4Jg4y!-vrhIf2@o9`U>xUpmYJsrLE`0L)Lk~v5@PR5_#?+13W*y1u)
z;H<>@LU%E-;fg{TG5A&QTQF{o{gd^d%el8J`xP~wQc_e%nS@!WWRe|BtgMs?uWqrI
zF;--k)wG${#4M6Fej04709eb~)3v)aXF59>X&Apv6uGm)l`a5uMZMqjp|kjY%nAv#
z0VWAMh}FUQyxptnqbGbnB1zzUgq&DL`6FSo&6l7Lin6jCbRFdu+@RoHUu$qOyqn7o
z(<2v~4T-a(lm3?FVWG`-dOB!3`eY9)G=10`_~D_3omhz+42umXPy=&m|0R$}Z#C_!
z0|y;+?lIU;w}y?1!`0|%hCQuwkizntsekjOl<^{DOH!PdD9ODf>^GM`K_?kJzS!2g
zP|%mCcaW}RP<pozsZ1CGTve`=tC7`{!hw{v>4LMO;~PW<6UjU0ZEq)cVGS}Q%toxh
zU@%0Me{YoqR3Z!Pc~f#^&YYYWMCfo>&D3uoDn^eaDb(ZV8<14fTlG@l+{$Ut+3NuA
zwh!MUS0`rx?0mrUM$Z*pT2!B&P4c;KHO!zy<-kt~{Lpy7vwUi9bQxW7&F%n_;_HOg
zN4$pls#QS~q#q<xgpDHTbEn`PjPV<F)@+X7nLMiC8()A<_+UR)to}fb8+xw~&eIXq
z!@LHu#XS`$IDXKyRd23|-HJGD5IOk8T$M8#t2xqbQTq+zR&i713L}59P7$r1o?d|?
z^_0T2@gwQ3o*YTBl-T{NwLcDzgU<n$<3t0};49;geBt|o&dO3s&qGS)@}~B88A^6P
zFb$AoHrI#r8&=-kJER{zJ<&HIp`dtn0Q5@dFMowL?b$M<T|bXJDJdz0zaLcga!>##
z?P5O34yN-P_M*@`{J~BvFiVwz#?+H+k~j=(XsOn%jhU!j&Tf#_(9fUx7$bQTJU8MB
zYea3k0-N3}i*RO+Rur3yMngAq{(BDZwuV<l%0IZDImO+OV<T~uvOSM%6QbJnb&YGw
zxwov&P*<|9W1*_kL(Kc(PWtWoB4RPD!#wX=w0-Vifz<Ph4x4~rp=|_N(7N##0Ie2&
z*%k+cU7}oVY<y6m=x_56GX{cvwK+{|AERfAM9z<U8tRVEBdrH#e5T4GrFeI?eLyP=
zxl@BWIBC+KH76-w1N-qO8dGw0ka`lToOJy$FxvrzW11KoQP_lm8sW^As8ipyi)IwR
zUN%iAA2r`r@t1u9c~d)i0~WjZn=!1ds9L3c_>h4TCSwQwabWH+xBT2VOk9PZnSr6&
zZq${zrWgV@D6-g~IUN)v@_J_RqbVpTR;`oC5`?G_qu;mKr`EbF{D&(H7X~n#EgJOi
zuMe@~df|#Z-v{c+ugRHQA#dfNCH6-D3hg5zT<z4=d<n26+2*H)3PjJ?q#TY<oxi0n
zG2P(nq8AdKX8Ys~9P$DcaiK91MMBS<JotJga6}Q@d{X{_yuDS;K1H0sypZVClvo?C
zAIz!b#%Y%9bSX3^GzNG#rWNW$?E!6cMo7F3?XOD*Mr~yr0v6?&6{cMDpN0)mpeSzv
zKU7VtwEQ0yN>i^Z*W^x~kmCXmv?AuM!DyxZOSQ4){8|2g8rzI4HTKp%kV+pCU|?bo
z%>b#*7N=YOu4px$=L$L*z?frA!@C}98a3CVLQRF2lRR*X7+~vF3^8CFAdPMc3-Rt`
z4KMEss)B;SqbJy|S_c!b&;ZP;t)b~D+R)Ep`k=y#Ax>TwXGVu4nIk*cb5JFLL&nvz
zqYR!EVukOe&rj#P&i!K4hcHk;N@yP+CNk;Ta8ewolY4SPvj?~pk7r)GtB!5FeMk+H
z$Vfrl;deO~-$RQMOWln`1LEQ+KDhGofLy>cl$F*FafUcy+MH?TsiWRJiUDI`%XO&5
zLS{puZuYnszP`cc=B&a<;~4;p?D+U|sNkvyT^JHRq_3kGy=2D`y8b%QVpcpYfV1*R
zYxbK=KK%XPn;VKHl~q0g<A!EFbhS0MVP%)~sYGTZBf`FNaDA?RdMcylvoa9}OMG+d
zliE1v^N`mZ0$D8?e-q~x!-5(m%6IR-VM`eVAVLMBRiRx?6RMRyz9(z%%kTVzUtMEg
zk{(0FejPkpVF`oIu<vB)%T_Y<D||C-g@Q)~r<Fg|w4>m2i9Q+vT+`;TfPjWO<hQFj
zj$ttdwX?DFaRB=jH3hB6yK^0KbLfrNM(3BMtp!4sp#pg)q%r(nkdM7UBg)L`ge8_T
zu%k<On~f{Ub3rR;t4T<_TU7K)N@eZ#6OyMi&T2({vPiv{sC;tua>gN*UU{IRomANE
zYoO@Qd9Nq(^oifR+i+dGb!V6VbgEv~U^@LA#{gQc4Eyfo)?>{^`xa*-0=Xt6-Y;=+
zUzR9iIEQQ^*AsuZMKTZGP=tMIC{logzIPI?>CjrMe{0^MbZKL`$vk15Ldx@_7s@0J
zA{oPRQDnf2z8R+A`159|wuy;?JIH?AUB>^m=;|!<NyR#$;2nJ)#CiLCNIX<Y1C2Q_
z>o7VY!$TC9v^n-!i@!xZ7E?L&lV{1oXog=6pgA!!$&Z!JA4O~)=Y_j}T{27|7j(mS
z;}r7o1Z6|jK*gtU?lW39mhy$kwL2z*CCn?FjbNh7&17z&3wdi-C}C1g=c}G@_&qyz
z%o({yvPCoa117h+4Y3!-&xX*|p33AQq-f^uYOM(|Ty3qPJ}CXw_DvA&ahzBo5#3~s
ze@7e^=)~9kl)W0ZhTwlJPDvgDf|1V1YQZ1DkFK3ade#blirby@#y9G&%DT0})c{4$
zrM77fy-%ZEV-%N<5!0Iix_1J?&gT|6*Ep<1=>C8x+ob7Jbax};`B^+cE4&%|6=%k%
zHtTtn(ChSE9;KSu1#CFZT*=<b;}3QcW|Zoh_|!qC^0F`V64i1WE@5o>l2gMR%0mk#
z%tTu;VYSAhYwedOzN$;IU8-7se^GfS+gO;J>Fa)1nCh_VKD+4hY97X?0kLn;1{lz&
zRBq+1M3qzyz-b0BWC=0y@)6m%di<;S%b`VHEsw@)a=jV}!%;Se!4j1md1Df|*nya<
zs+(%2K6HLUuJqH!{2Y%4Z}uo}>d>M}S+l4@qr7c_dz_*f#kn6Q>)s3v_BOq}J=-dr
zF+Fie{8|ZFjGg`)X){Hpe|MGT>R)baqBUYD_bmAPY1N4AgI_Y=ZkFTya)~+Vs+s3v
z*b=&^w(;AFj#bN_znv6VsLswV>Z*=a!8JJ<4F_9ePMiC6m8<uqOvRJVR_kXWB~h`j
zbs<8f)0e`Oi^q_mi}?A6i@k|r2gBXFGr0<d*&}WKK&|11Sa~=}b=(}$;yHCR&%FPC
zv4A*He~{+F)H{RuJ_z!|*Z1(6ZItO~<THJT{06^KxHQgdI{29kFZlALI)G{!BPa8l
zwhlunzJEWjr=hbebtQcUzylq}HaP|Mg$ijb{u)UNaXhJax~^?{H!ss$is$u%MI;Yv
zCSg+`xeEbmntlCl_~V3FKuQVRuqU4gUDTCu`?(6S#F;l~=SRxFWgn4^Sr~FI8KI(>
z`Dq=dh?~6IQrlDcbDkeeqRX8OSv35l!NIcD;;F<=tg3LfEIoy_c`3Utm1hs}6D%tq
z!=g$0LN-01ODn49ke6?eu=+qn`$O5RYN-9(l~L{;G?}Z!<H?N-inwg+XKfiL+D5Cd
zCr*V;T;(}TYOD3TpN`3?nf8Oz_4fe%g~e};G8~L>!PQ$A4}VrTZ;iK7)Fl`$G9+=R
z-T&q-Kt$X$7p4e)A|i;38IcZ&u*Dr3%5KnqGZ$PNYRL$<aR=@@IUE^k5hHwj$qIzh
zUwaJ%J6YE3FBV&w`H-AGTA=moS*}#?IZNlufEywjt4<|2^9+od8dO-Ya)~Xy2$LEk
z17+@P;hrhl6-^6$sAHDfmp?dSNYwg4V5&}dI{e`l!I_VOeQ>KJ%X%yDnbwu8)EQhX
zVPqFWnJCb`+3hX`4(STqVraKEMjIe7H}@${#O*jL={aLSFB~gpM+?RPyU)#$4K<U(
zf7E`D^y#aLnvkDty}X==+j-Nfti3D6Mq~#+nJi?b6yTtnHkgH1JAn-hu7vqGjFx3?
z(r}~oy{9?4qd_lRu4a>dc(bdh)sr4SH5Ro~aXXB8%3O41OFa<>gdC5-_LD$d!fh`q
z<%)~Qje{GGah9IC!hqZN#d_+<%^IxmWO5_4OLv?~bs&>cN1k(FD!!an?}R$I?U9Jo
zgc94Rx@<(YnQ#p@I=);TM+~z#+;_zo);Ac6MwYWo?7LBG$-b)eaOpl6)-%+tbjq>&
zW32}$1aagD>2!TpG0VH={BXqUPWRQlu0YKvGG9UqJihz4O4-@G6~m-X%~16JDlD)h
zsLKIsLC|i!^~NOJkWSM{y}NglS5G#S=TCpXrxcN!DcLz;c&pw6IB@CeRGSv&6Mf;b
z>B+**If*(d*3C}@u08jaH)QXo5i4b-H*AYD(D89!C?h)clf1zs4$upa&}<TyH#_b}
z=aIVwlH_DosFGYbp2p7X5c4!u<a~;}xK&$)?)m}IOUgfxJp<0L5K0xDVrdUQ>~&%-
zqjS=xqq#=s0zkMJ4=F{G$E&AKPEPC%#5u;wAwRekJ~jJpX&<~`q!xdevgJWm$x7B!
z(Pg}WYsp}!CxIE1s{?Mu&T+UEtWiz*yi56ec%*}oRUUb&TZXwgf-P(m49b%$xVV@y
z{K2otbHv6f<OFSU5IDN~Kh)J~vpCAlUcbQ`R2w7PE1XUDLn*MOl?-f;#Iqnlu61HW
zP`@6_XdsgZV&lq8)byC%jzPA&DC3vC0u(9((au9K={sHVp^mV5BNtM*n=|M7gb(fC
z;4ds+QP;hjg(4}<Va6@bqRMJfCzE3LO%jC**#+rxN1WKHzJS~~GUU9`ji$#K8incy
zuOKDYIESrFy>-?kSbT5)rUrfWt=Ou_7lgp<oS||-UyUbgp-nPu`m$~HGQ3`YPfk<n
zs-iUw@L~O`qND-wQpl<W>{g*~(v>35kD8$czos#Efdk84s`gr&d;`Mi1Zo4QPicys
zY!#HVxe6C<fcB*_kn{I1$eUL^8Kp6A4P>x?%{c}7m?{DB2|W^AZ_(F2)RXW=B{dD)
z-(+AbXcFaRG@O$BR01@yP-J3`@Y<3iGqkOVqur7Tqkyl+)POUKQRit2PTz7E$<oi2
zW($N@{pkAH3o{TTJswS|i0IES8EFAGM`2+YqOH(tnuUn`F9pV%zyzItrsy04r(m50
zcZ)Pk!-rp8Psj|ZLr}{JrQt42p@yR5M~s5FVc;xw`}s-T{Z^bh*sN+VMUYTcY{2pw
zxU-Y;`rZcyE%k(^9P@z{oMT&<g_0@&vNF7EVK?56`tww!Rw-D`I22(b--NjkPfhn-
zAX^ErFoN!6x*<B#WT1StP-&J&sc9AU<^njPoUDQ1K%Wy!yghKf19+d5HjfOv$?X^K
zS<I3QB^q|0`2Tj2W0RSZA~{oL3+DSmxmsxn7L{`J1Ht+ru_R*$!aa$7lc!nT7#tjM
z&ZQ9{zvwZ%Y)r%!r#C8Nm$W5=J1JMJ)z{#s*XA;9i!RTHRhHASe%Lryiuk!9p}NyM
z$kkL35c&<{xaw;rdzW^e{Bvj}O(V6`M&9u!h~O(|B70H5uvfCoeIGfD79}W#Wt6Q|
ztDdCQsQJBY;hg$pXg5-}$PQREzpCo0U0rW6wr1kbi2@Y85+pD6=wJK1#Q}1q$PN@Z
z)!2=D_iaez<c9GatouvIu&#}TkA}N;<rQZ!aGAeAuLH6F#@}2GsH}};RAR8I^*3D_
zMOgZX?r|bOmMyyejih#$Go{5^n=TE}a25Jf?4MfRCRo1}{r#>7q5wY6Zvz%w1-Vh5
z4CYRu(Jo>f>`JNa2~sJEK=^<v35sGkBKs>e25RRMbXNFHj|5&3G*t+@Y2#faDxcDn
zQTX|7ia)|67b(udBA!EqnIAUxJ_q>oz$-tJjU6oXQlJbTfik?|N1aXE=nBa~RFh~!
zeWB$=MAzL1{gmlm1;TGy#dg(2(hC$fLjQ@`PVwfBoM2HR{gIkEErxVRh9Pz}bCzUn
zZCcrEtkeh|GWK^8hsn=JKJm`PDP?{^ahDZkPY@m%SJt+?iRANcD{oo!bA~D&bwhKe
zXE-1X#DB6@+Ei;@c4K>wO;idWVah#61~Z=WEQY0Hj)ig*;9^5Rhutq{@*CK9sHQ=t
zNlv#6pPXL0gb`Kfd&}^l|3q#|{$JaPjo3kg4#XkdQ-;HjQjHxP|5Y%ouWQ+!^VLN3
zkq}mA|6h-+NI6JI+Of^->6%ZiQOOZFzdSZ31U7Sz1CZkcfcXT7>-9tCY@KleCOL^A
zn#aOH?8#2<nCb8jk2andqvF?nQ->?b`u{23fkKJ4i=#<xwM^I8n!nfnc;~6C$nyDg
z-P$7%!SiWCG>hg}n6<@z(VT8!ydXrcoB>q$zb;5^h3A!y+euVr&IHi;QB(?1jBVID
zzlbl!Es~;}(E``yUkr+7Go(O4zW-F|KyYIu4X=9F&u6jH%H6*QXEf-6T(7xtQLJtH
z6TORX<pS50U#rvoeV*!{{@f=(Z4I&C)_Hx|WKrr)NXYLmh^^oeXvnuqYkX}Q<%ha1
zl_^m9*E9*h$`1^Q*ztQ3@8ROu%V@;uj$BB-!g6+rhG-)uU)M!1AXo11gWvu=_~&Uk
zTv1llcGn_}@1tFGTc9OpfNWKL+*jFrU*Ak9m<TFU{MR2({LLg{jy6itAKSm*R=PZM
z)G?&zqUX&Hp+kZ^DgN2W7cPLs?iv~ggnbwM``@eo{<{;Vg~i_SGY;_mF8H^_IR7Wa
zCL~}{23NHGj+Bs`wKk?_w=x-sJU_B<32yQ*2B>wF-t0DF6bXj^`tOL`p!K{$)>VD3
zwzM@OLI681LZ6P11Lx`r$OXEZDKIth%zXLVN4J8uWA|P-DUXv(U5xbp7V_7;slQ@Y
zAW+s?Hl``brQ1s5>QHwc(O1aBdMn415HTz8qo>ww@DseVLE&0EQ%bwxh_r3`cet@P
zkk$hfSpWcmlw{7dVl}{*G1<2GV2(r<()%Hw)?tw_vzGwGU7B1w|DT<a)_%g?^tO<#
zFp06RbLe{fAK4gz#?Ow!ZHudEhw!4u4xBT&M=FYIkiYK$c{gBeM$)af+%u5+F#8xD
z5h5|diAZT@U6VuYJY9;P1XS!Usb%Vk6>XJwk-I1WJ|f1AG9dzxIs<GXmw1>0cVHWJ
z!u}n4GJj}$Es%NBtFi&#p1LTD28GRm+8Wch5F9UQK|%ip_sT6~C7W5e7FN#N-}&q^
zX71pS3Lv>Fp4r=|OFk_U-wkcRj&Wup7`)lZ$|(Mgj^zeJVQ&pnq^M}<aU!u05X2~x
zd9$=@ZzFLdZnZAFZHcmNgCJdDO${pH|0_Hj%thy&u`lS>Pz_Cl6V6r-jo53TXhiz!
zFktJ}!tQP%!gM4k5-fp)8u0K{wQS7mxwfSkYvBy0WVVQ5-)&k#BFt`)?>}XiXzi=n
z7@Rlz<xx;srED%B4B5})&+O_N9Nc|?!V6<d)RoN^aEpH`SOb;{h*!ofuhUaiM^r;?
z3yBZ8EpuyHMX06!HP@|w%@y38!t-<6)U*<*2f2Q&mu|M}wOk*kQ@x=bZv5I<1B6Fq
zHnpX<{(F4i^R(MSIb;d@|9Vszu6L~!>f$S=@WSh&`JTdCpRgv6j+-w&-#q?uNAZ;{
zOeyYYG}RWj8=flMx5qIzzS&*=$YF{5)h{^8p32M)Vj@!GEW`rT;jh92Ad^~)H5Q>s
z%r;hMDd6Ic^xbI>?+rN<?BuV)q5wXh$>)QbACmahhpeY5@F64Ny#O_V#&(r^0G$Nz
zzd&V<|0|>_Gdr++=266eUH;6k72o1<pSGFInQELGc*d0LUb`GNyT%UUAWD(I`#&wx
z<cEf>Df0FZC$R0l^Aek|O3cY4F&YWp#q>w04~QRD$d}G*e~bV6ulQ*E7_cR}*>9fo
zf7}{6y~>)V=CZ^(BXzx|by)Ir%yuz*$Yh=t7>S^?fBm?L6Ir_MB9>)PacBNk_}40D
z7iPc4+SZxo@@aUgF(4ZFZ;6}=(vZnseCujl8JJf(I>+cIsd#(SUP4cp0z~uA%1z$q
z`cP>P>l)NdoSZk_)7kjO-9^+>J7e6;F#c(ZyeTrQ{^&o8s#dK(=XK-%D;XeZ0%!=v
z|Imo)oGtZNOw_<}WAoM%OXBMJou@;Zl73&EYP^ge>&DI5{+)sH*~IhU5gP|)K?vwC
zOBn#H`E)7eV8y|#-BW}w=1WVXYtEGdnGdDh<_as}hU^Y@q4f+F>}37N|5`?M7?w?{
z0UADR^32Z2$^n?r-3<zVhXB*x0Z$E@092v?gYKzkMe*lQQ9zq>6eLP=nSYctO)FQ)
z7uk?mT&YzG^02AAV>}B;MEA4)D|U%M>n#!LLi494B@yaYAU7a2f^p~fAAS_ElJ5O<
zQk*Z}cxUj_QyI3V`47{a2fjh@0PeqEEB)Wss6X;{7_Sn00NI0EyPBDKNmjgP8;<e1
zT=9Ph(+FbM|HT6G^F-QPn*=sG)I%kDy@D<db|KNTE1#Wy9|+hm!T(eN7+0_@1QdDY
zU&EOFQOw5Zx`+XHR#EJ5USX)~Iahq<D}8IL!6x3$etq?&rH!%o+=59PKb9=P@!w>T
zAHAK8ulz2B$^?u9!iqpsc)oiX<8?-mQ%n017xsBh<`df3;fCzg9~HvjBavZp@MvI@
zAR};v=0AVr`z+s?0y7G@4#Ys=^P*LJ@Wtf4BTx``?3dS~pU%kV`I`+}?E~`Meg#%i
z8E;KkTl4bqtej~bA=);6Mn>$M&*JY?3JpAdOa)wxO#QD!LmrIB&e`Vc439h0X6{|c
zRXO#ZmKx>84_+~inm)zSx#MhwJDgswU+Kr&KiuZ5ZuPl+<6x@v?NE#@&^x>TdWR!L
z&Yeyuc8G`)uu%T_GyURtx2ZQ~vI<(X4mB5+1W<8dG*-y=I|I~{8#h6JnaF^YaTkX}
z;rQlW{HMd7v56a|_N}ij-ZtZfWL&i(ewcO6pCtg-wj-*cAt9}@FAtW<0E5H+8JyZ0
zXn4N0rew_!^Q_9c^SI|){6(G*JL}oot@a9Ebb~lr!sPSbwX+K4=XHRmxcIi^vDU@l
z-P94IwEWDyfDI00{r8rBG<I@%5Lj%0lqKK_7|kBg{HM`#(efB)Ub=^^`PR@d4crsz
zA$#x3%7MAyNS2fZ^2=(RsQa(ZZOMD2Aok{a!=W-gvD>P(2Cc^C7(%kS%VdqhyaRZ0
zbMSe|)fqh8@IRF+%YT5J3}}VvuiYy$&p&lvyn1!VNAuH$Ay{okO*{Wp?1$NlKOOH2
zyf?co>jNX<8<L3@CGvgS|0T=M)6?57!XTgov%h;_Le`(j=R3#0WO#4#>|=M9*%*wQ
z<A?2>t&n@eu6+d)?0W{t*zcrI(WbtHjxL@@SaaP=$%*%^6FThujJHKhk(ENB>!!dT
z8DMh(Dg9gTUmg8m%*v~2&HUQv+zrIx`Du{2rc6db6Ecb)If?iCThi@Xg-h;En66p0
zBK{M#ol^GyuQ#OYkHzy3zlLw$dlLU{GH&~>RWIVll6{8r0;|0OZnU<I%E0cpwExX!
zdX<=u=r~!X*VX_|KlQ@w!sxV;#C`C_^{G7eL!9!nFTgn(v;zItH1u2W^V5Y-L(h%a
z7|&;8KJAetWxRtz1_=Ao@4L4qKkf?L+kdZhJoM?+k70a99aOPsq9$}bLwrOr@H5wJ
z3@^^XiC@hbR@D+-q*ucA-#eA+`tQ%xYS)0<;kR(+QigNdz|FxgDF05{qd_5NUOR=7
z+wpr8w?Ex8ILkX^T#Pu*(~26;c(vR6Wcqi|T@6BaN?-kKy*c#p)3^fc)Vo;Y8@#HV
znU{uRv!$zz@|f<185qCs5x7;|n)bV@>WAZ$VN==EwJS^qBSRHp0BCRIpG)Ksxz}PB
zyOu+*)UJWO^ZrSQ95ZS(?4C$AM1F)O0?bOZoTviZ2W|F78fUN`Jjh##Aw@bAsFzAS
zty0mdvXN-ZdsG8g?6?zvSbXqnKCsD2td8Pr^;T05BWQ|S-3k~KBPsIbuf)FiZ1|f>
z67pLo9;6P<NAy`EcpR*A)3>T>lpv2EQYt;^x_NJP%dax0hVP>VwmoHthlgXvzZPma
z*FFndTrKwn4RMn7FaDj${cU1dHoyh3L1z1Fi=2%zi|llzez%>hRZE>LMcXWDThSY-
zYK052FDf7F6_&sWTjsT#8x;c&*=5N<F8`cXUj1ymhxq7~VK4s2rJugTuRm=UsRXOB
zUMRaQz>dkcIe2GsJGNW9NTl--Cp486Pne~#q#4raG@scXNX_<@0c>;6R$%Yp_}g2N
zG<+Rz%n)n>MXWo$R;J@rZMrRU)zv%8zka$MYQ!E77d5}@?h1?N53ccYfU9zmD0Ns2
zbc$~K%tWAVN$b!CuVg2`U!2_zj?E@e#n6?}(zJHE`tN(0zdkVnes(dC^TM9!uCK{`
z9(d4EB7qqDSV;2W043DgV-Ur`EBr`Ul%@`#tTccTT-^S2a=(kq!#jT8r}?x<E578{
zd_wF-bHmJWIi|&03^(2qA(@Gw|D|4~kWU28u?Eh-lI007KW-wgOL}3en^SJ$!_}WT
zw`5-75#$EFu*@_@O@;5ixqPA|HOXU*x0O5n^7YmEubuPn29CEc-hR3W8m7=Zee&t}
z`$Avnd}%Wz1|P{LbqQrqJ=g8(HgsmwFt)y=1Z|5DzELM%Rib{NFEGN!qXk#0Vr3P7
zY)qp&pe@$V`PNl}{>_ZGI?%g7b@4QjuPZ<(WTR!W^r^?_;H2d)gC8TPxY<$|c4@!M
zpjf5=EJ>9$!pwU-dHbS3@!sC{|D)-v1ETt(tp`!?M@x5?Gz^_eH_{9(Fhh4J2uMhS
zNDMHfbb~N-DhS9hLkiL;NQZ>d@m=2g-oKa2oqO)7eb(M<EepVYikGTRu3HG67f1#L
zgR_RiCv9iu07qteOq+xLoe?V>wE=Mj!s1fAqWp}1eI3(HA#Sza49joBjESAGAYwm|
z;<t^;7>Y;SC36?bn9@eC7mRz!wgEslGetmf;gnyhRG1x$>XCNl$hu^%a%#}CKeKTT
zxdQ0Y2hO*%ilr^|_6cK6@2Q#Spkg7rzD(VAyBksZwSMm*g|kPtgNaSUl!n6GBv~3z
zidw{&dLUnc>+y7Jx|?z%9@A8!V}N2dVm$Hf&|p#rWwrd`y?tZ6q75H;(yV3(D1d!x
zPFcFu%`X<q4-^3@w`_EiJIR=IlUnx7{X(y$Et38n$i<@;_-Djycp5Z0DPlwhi+<f*
zB<n2&4Ru=x&VIUGG{z_XDb^tKN=}=uYZKRfJZg1roocKZ^dFAqW|lu&mUqYmi4`fr
zk~OVW>RsaiDUC{FQ8!Zr#pLg8nvNIh7HJB?Ev#+=&LK07^}<|9q)Q!QzLk5w9SS{o
z(l~@^iByY$k^}da&ClK)y0At%lVosM08kaRarAnSr3CAl+MHktJf}VjqC|rqg|gZZ
zl)aPf__UMAZsJ_t%&>LvVo>B}LdeP|%1$IrZ@r4hW6zwO_pU1eXIqhuYcADyR=)@M
zN>LpwNh=O8p3Zt9b2fOCQn-^O3Er>2IN7GPd;x!dJNHabB?*NQeFm(UaTRGne(EPF
z=&ZjKiOQ>xFJ|_$=C&QP4Ufv88l)=vQ;Dp44YSkJ8T`L&!vy++_|l3$6_@x18s}VT
z22l)C1|{-mFW@1l28sUYefOa6t11_HPQu0_MV;FJoQ6Wg=}D=GHRWz{)Ro<1+i_z6
zzYN7!qTK*mN@kwy5FRGn%gw8)Z5(;xcop@YUkHO1D?14UXZd&AnZ%<akAT9A{+kH^
zpMp-t8Hr>Lo3UVePE|!j23Y-`u5<?I1E@e0OD!Kfu80Kh8x{l)r*zW48*6@jt8$8N
zln6GYi!nwE4G~B`1j@J)VnjR2-bKI00f{&Brg}$k?^N-OnWEF}aOvi7OP=M^e9_x>
z7DAFIL|KXtq$|EP+aW%CT4nOWNM*V*%fv{m6n6A!Kcz;%wQa5M!|9dMWP5$*2hG$*
zb_3F4LY#3dBaYpKsI=|ez+rP0uq*xA`6?a|PCx(14?w3{K$Uis#HyMic9_dN-S9@%
z6uQRNWY0+`rvPTM=Pxt@Gf*l0NIsVRf-C3C;G*aOhmK=*nZ8DCg>!saWtHx5Qk6^K
zbFlQ!GuEre+8@}zP?Jgbm|07y($sLfX=>;9oCmTIeB{mGXPi$HR|O03Wg9CalBlMH
zE}sDI1~X5|6&5Gydvjj1g<3zer(S&w;-K|tHH$c=E^Wk1L9?qD>83c}+Q0JKcARjz
zoh=^LHDUz}07`ifgntL(9gDJASX|@67{B{zOg}B$?x?GjzA2`)7{r-E2s0W;C^Af8
z7Q`P9zTGgldr*v4`B4NoZzU4yr=PcQ4@a1JXUtLq8llM)b(#sV=|SO1teKp9&xMT_
zTq5g^Tx2J2bR9}Na0TNs##qfrE3fDG&5SHwdr{fOvVpve=<zFS;OdldgRV@)QEYrU
zNw}N&vdH%9?YZ9oZ^X6rifLKKKPbaf&|-4`xsD1r84myEhDwlLZ|IWDY*c3B{|^hc
z8)H`j<{WRHvxgF`h<8r!Zb69a`qjXV7e$aH??g2{U^PTR$5|gDbsHeUYlwKoOo~>@
zvKmglYvyVBy~q<p>?(p{xdSnCPNGIW4hpVd1F(e>-zXzag|uP9YFdWYfGzaS*vjp%
z`sL&3AD;rQTJO%qS3a;eyyf<B;iUMFhC$LSrdc>uEPS)BeRuK(diS6$=6@5K+@B!0
zwt$8d5#Ul{5aqV5!%GFBso}?}N!r?N=qZ_O8r-OMXV7uw{)lz1S<VLGG?kUgK~rpW
z2=2gO)Ct2DneSfZ35^!XpG<ouClU1?M~%VwUl=u;8O6sd{y39syHdEj8ak6}is{{^
z5Nwkq`B0YXEL{uE{&6;NS;R7f)t%%3vW7N;UT)Y9IKU1{>O@1}M0Pc^Pab~M2MA3*
zRYCzj4;KqwmP3WE&P_+_YnuXoee$mJolsZfbT)e=`V|b)+wo&(8!9J5ZX>N}4V9h@
zCZ3evH8&LCf{%NWLr&j@-sWKFMvK3z4p+S}dX1V#-VMV?GAQu|Ywc2sOdCFOpJ3Hw
z4gVIIqo)Y>L%ORD2>y&99I^hJn^2RJPMoZZA#h;Rin)SZF{fhrr5lUdpYUo5%E*Lp
zY`8+xQ7;4{0p;=CbgtC>YwSI4V%<kIu8foO*4j$4*oXN7$|63&Ji<A{8T)8{+N6A0
zRXQW#H&Ypff-4GVtY_WC2ZbYj#K-61Y&8%nn@>R5-Ocx?tL^H^N8&vdgl}m9sGuV(
z9+v4Y9V2lk#FY$i<l~{DVJ3hYn%0I=cEi%?2VhP4Nw^f}fHspdx5`4Pd%X7c8OZMG
z*PA@8o;f3Y_f>FTI*+?4(CzeF(K)hi@w{)-(riCWSz3lZIXVJ!w~m1sh%fM)obSOp
zRd7H_6%%9j{X0jKQKKMp;MD7m6e?+kwy~|!guQ8=#p?Cw91wxM`HV{C{jq_o)>qCo
zV0ViW{<S*t?usZs^l*GHZZ3DCg_T@3Sj68&dYD-L)%2<{ud3qn;jJwJyi{)5AC2rI
zlYjko1}&Hx<o6ctR(C-A@OLVa4Gj}mCTF}37-hEfZ=l@&0Htf7KwP?y_CWo=TC1Z(
zPk<sQY4bzVVZA_tdx-6qQHu{%v*I1IRZULLOoI-G=S^DcO?mUp*`MJ5st;1}O+&7c
zy}uWFZ<pBqyjj4{l50?xq$l{K3iKlA92XFLqlAJP$IM0^iSp)@;>|h8_k%tM0-Flo
zT0izsnOU=&2_`wzzo7Z1anrLl<S_aq!^5o8Z!EN!7u4GlNxC+v%9+J-|13h_SxU}W
zNzEDKuVwqcse;P4Rl*?+|Az$xvaczJ^E1(8>ELpaA&Mps4GBvdGZpSuJ7V<Vduw;M
zS~->486_#<vmf_a^kM-L<t>0AT20rnyw3u<mYyiip%lmNNe4Ul!breoM!J`kH*rn_
zN)H8BA*bbg6lmY8Df(gdo&)I4AsDDZPHG|W{yhzL0Ebz7+p_acQxQ%;{e<#IDH<>A
zL~=}xn&-cqvO)G=6<(Uj(#J<*H+a1u-4~aC-l+m$G(wTqF5O{+T8_y&jDt0R^s`ID
z65!ASfLaFW?<-&`nSktHd=)eaUOa92{Am?X{b^#sKF_I79@$7v@a<O^{fE-W?iz%P
z{QMc;Uc&(ndKf@?4rc>oNV9A6Yv~~2FOxu4<92a;%(!&>VJp_@*_W(^lX4w(hUUe=
zFw5PJhElqw)WOpTDSwPpo~Pd!6^H)EWTn95I%h6dJXL;xf=u%e?1jghBi5=cHjTMd
z)aS_)25o_2lFi*{Ie2+|9swdqk5YicI1d1IISOy)H*Bbi8whne%mt;7g62o6Q);e&
zSq1ut13ZVdT1=hnh=Aca;2M-tWA#7R1%T^yWotCq+t^Kyfs2g@BmJlMgXS4Pzy9f0
z`xP8LN%Ji7HKP){>l64la-`;9b_CHm2qX`5+rejxNM^uFK{tWn@Xdn9gp`mA0H<aH
z{y}vUmfHkNv{)|v6$1hHopnEn!$(B*rPr2d8y<^2qfu`B-|I7goamLPsdPW<cM#?O
zUA#x4TV0C$qMtf~VjcD)0I(0V4`6Zvs&jkFCLK;~ZR}NZ!Bh_5Lw?|2hG7OytpF9+
z9hkre0jzAxS^tTN);yUbxW?J1TzJ3%0LWWF-s~_!HAajzC!Fb{@{GX!$QyqIH1SCn
z+cz=ZWAXbxNiF7M4_y|eK#P?KXk*m>|6PEv;m@ZMj2^aTY>fze2Dw0K#OOq+0_8!1
z3iWLC|J?-z?h+#;bX6ALt#y#L5ProV<DdOJl4Kb8)<FLRJ@`T(`*;pbQNcHeJsUl(
zr3L6)i@DORi^u@Clnw+W1jgOZuV+&v=+8MHFqZ5oqi`Idj$w&GD*FfsgKRQOYI6k;
z1J|bt12E7G@HHKej7RGrDXqRjP^1w{4sZnX(|XGnyqDep_>4?)GR**GUbes9=;skK
zJg1ia+4|r8fC}>!y?Dj&nIh46lqklHvCG3j#fBU8(V{|gMuMrk=2t@Vknr-&H!|{t
zQ+mn4;KUsOcDEy|Ow@D;xk;cTOlE-#gHt(3r-r}!0ayEGD?g}G-CM&su>l`g(gDn6
zA+BI{v=t1$uQIEGA0_ov=yByAsjFrJ$&X|8nU&th*i<yEz$sOdB3dNk?8pt~tGzba
z^OC@6kG7f<CO#w~EowqH<m8X{(l}Z&$YN?=PAH{@97h0n_cXvDp~tq@LzMztl_R`G
z=_<-bfpJN+Z!(}Uo(!I@dScwz^6cJfEteP|g5qEKgHbRe38l2b1GARbPI{NG=SCa7
z6CH7c2m5ZfufusD7EQBQO#74!9%JG5Arp^Hif}=m0QAgM=yv+K#H~C=o_6aMVV*8P
zu#BM2vpRC0hh+CuB*K6V^`baDbSi~lpOT-tc?<V%YLXP5^iWnW-Ztnb5PAO;JpCb|
zB)&@<|8fR@Sq#rEl=^F|`i!))$e&+gzBOrB{{yl1OuZ2AUxh8{vw2VC2rT#!c@p+@
z;iuI2$2#OYh}}XYt&g<%84!dZSuBjg=j6oZa&QadwbRExB!I4zPV3o6^=Or0$-k$E
zpKeocpOs$KR+g{bQvV_Vg#wHQdH=OvA24n$O`cg;emKU%*}HAA>Vqt)f!1?Hv;oUe
zL<_z@v*3$>D;6*^uSY_$LmYr2aBJ>eQ`$GAE!jW8D?p$;Wk`lmX?$115LXfF;4xuZ
z>11M0zXnW_rvnT!_ZYcAq!jF@t2o`3eIrd16$L6g*1;)a%sgLxa5Gidi^5f(5Q$Y>
z2n+=v-}kv2pncgOdk;n9VdIoK<fu<ZqCYb96V#y|->DMJRFLz<G_|@c1ioXS&p@*A
z^Plrom_KoUn5vUiF&ITMED2Oixe_YLXE)3P3{9hGlO)hjX=>DC+tzS-98tw7+WqL{
z@C174pV&hQu#*vuv8UB>Ky;;i58VN)qtFX+x&#-kBJ=(J3MT+VPI76|j8-2c8MY1Y
zae8M!!!*_Q@}EJAEd?Qg-9r#S8pX~!`E2wv+bK_#Ir!Py(Qk6>PvL+bz*||91Q@Jy
zpvd4Ed!&fbL*$OF7^V1EW>tW@4X}iy0OBF=HWs470TY`#hn31@S;itW>F*K;8AD&q
zmHDP_*Thg2pS2iA(!qSw!0j41KkWfH&vBN1yv@U5pj+)sB#Z}W%F5=SQ%36M$2#LW
zGcC5(YKmAY#?<>|2_JJj?FOsaHh9@D7kkl*EaO+>ZwI6PP$-8JJ)yPOXUG<!W~6zX
zOrJYvzu)fUCbM6X1SlM7onhba+@B#Hvh+bWmu^e_+&OaMfmv9&wG)bnu^|E0)Qb;g
z`X-b9Nw;FRVCM~Y`}zyc5P3huLgF&)HvNKbi!DpICJiXDTBRlSU<KbnSszJ!38vd8
zRSA8^eQfW<<euHBqEGtaz{OmwEyZqj=Sz}oG^8?deDvT4hDZlSqzl`gUmUHYmooIT
zk|GuB`I+)~1+)d^<imUdO!5x!Rki{5q!(3%!0Y4$1H}}{gUAdQOFGjkm*4y+Wk-}t
z=$9Kft~#4a#38jtGC5b$#xs)OZ-_)d0jP*(Gtt6NN#ssU;+;pZ1d*z6qCn{z?kazN
zxIQUBJ&aGCjkuX>+|S!MZ6O>?m0FOn{YAgUeE-v2BCJ+IAD_@pzSvb!paMpjrKUu+
zIZ%P(4RxcN7-?HgN!&hfM}rOW0u`pU{8gWUZ;KaI12M5)FuOGL3oeAQByr=8Jw7IY
z1Fp}w&|dzF)B4(KE2tFmOi3~FJ|9^TMuph}6cwG`MVkv=w!es0-@xN3e_GYoPo<w|
zkXa?{B++5B?Ey1>qx)Z@_K|if$8fBdU;krw()usLKZ+X7Acg4pm2DqLGY=$^iCv3I
z)5%DwpIgo8ezc+70>*~IR0~|4&WiwrxH)aSeabvo-Fc}22yB;CgkBepmRWf2clkxA
zj4xQYzouqb)qo5-(Y8^EVc_!b>Q)<Yo6*Nmpj<vCw~#5(7uEuJCJ%B>j!8@R3UTu*
z;g&DGP<ex->$sF#1$n9R1bx1erS_-}`kslOJi&3lgo{msi26cX#4x8_C+p;ecn(JA
zSb%v(mvLJ9JG^1P5^YE5U2+cu+?y9xpmfiI$uZZJg$D`peCaHy|48ya8RCGoY~u^f
zjKmy-Y(B2goT%CGG3>G6ZM;yIvSk+o*FD)V>SFkYO(ruhQ#JwPNl;59krAhlSL0bx
zsjNvwRSf#K^!<IlYsj4c9N0TSE)C$1PgKCY4GO^%F(ayMss1^m@f+=J-tJ!;ilV7;
zI1(?yRcg%)EXf`|7x$qpZ2}eU3cR9$h_w~wtWocliJ<Jo`ex_UP#Z5<#F-|Y?Cmbm
z8WI2EOp?BvZ_!UpexwCHyZIi0Q%O7x6uCD1J~0JU-cW$LZgCT3g}kCJpHn5`<@VLD
z`39mb+?AFKMVE;Gz*b8C8b)8DX)Z+avsr9L1K07CAezb|lDbk}+}7iyX=a&{x!DkL
zqi(Vt5~vR5af8A|<<DyB;3r8+<If-R0SkoxEX}y&vO<LIM&N0T;AJf^j%M^v$|qED
zir*Tkyac(IR+?L5)=&7{mrEYdc2_ujpNdGIjL6F>ReiZv)UY2MSr<rJ{8@EC^vV}~
zj`|)9-*FlGt`4<NP)x5hlSwz3<Sa{kVBY-eed+60YT~`RwBV~)=8_8_oB1q699NVz
zCot<K|GXz#f5xtJpzAA8tz=+a`a-CW+Nzin$EwWPTwYI#e<(7WJ^rs9S!vS?Zsh^d
zLY=(JKz3e3HoJR?y7VtK_OE&D#Vn%tDu9lA(Gn1t=sy@dn}hFMip{XQS}I<Xw&4i0
z_1_%CCp#WisYscIk^QfqY9woI3vUYupkWa0LgX*ShL867)RNIv&Q*vhgALDMX6h0V
zb9VaF4oRt6(Z~rg<5`y)1B@}<*V#cuh}GY?tv*+$Q!?5ajT7L=0J0c=^tILP^y`_1
zQgEWVTYV9Pa)jzQO40g<_gEM{HSxS6OPa8O`7`kyC#;}Vd>oaA$dC)%(f2Q*fYWDt
z&1U5unoCT9P0vY(e0)4=<vw-p)?g^Av>TlK<#50Nh*#|hUZ6KAnzKgMNd`XyHkUFl
zdUTHX$ni$}7zmnO+lrwrK{6!rJq>80p^`>qPuRr+^Wvk#!biQHK-OwDst8ek&#k)v
zQqeQg_IzgYdeaR6owbq&`!KgC&NHU}*M*cb)(jD_dEnVn<m@f*W&V?eL$YHXWiT%h
zfIh+dmr3_2TwAJm*zHR&JTUZ}l@*c@k2gJdJP?sGL>=b&TYH#2jU6aGA5U|T)Gn+j
z6`_43RF!jN{l1h^+-LFEPa{}E598I*9>DSzs+qVih@uTELNLwhK^YI?lGSJ8gIO}i
zChj2QL!UQ|jCIO4J07YOH-z!U^!+MxEY@Gzo55CSyaWv8ROtu=<;@x|AyGbvegm2x
z%HsW>RPP<Zox(8x%JfBj1#>FV{ryxHdtrYz0}@~{M~dQ^&RTi{!TR`*I=&wheZ&``
zL0*O0iBp$6FlQ&nTd-kC;%YEf#i6S_pZU_TpFU>>_o49>VjQDI!JMYIUcR2hbwWoP
z{!>F6P9%oo^N%J37(i_9SpSrY@T35tD-hJ^l!)-W&%<+8W35s!gvb}@m6CGl(JO=m
zNvCNvbHEw$QF+?r+&RLav8Uu)bFkCzm1O05dh5PYn8A7i<9?I@1TvN!&;Klo4Odt|
z+2+^$I^n}whBu#_svLn3bzF!XBRi~X5v)gK^R;4NgIg1TL>zn}wM(w=F|dt%Yaj0H
z@bYz?rYCr6b`wrQX1vekgc>4=?Mglj;tDY4&LLgAu)#dAgj#19bd5T%0M+(ddD+MM
z?v`!asO9#2Qz;FCf>DoeX#jJDu()W>%&2+^;Pzt{2XuK(mJd~w8#!MP0HERstOmzV
zXHBeO;+A=m>fBO3vowJ@KE+Fv^gq+x3gx+)nrYmXe8Mq+Day+s6-=_G=$bj?1_So0
zzdR4YT(t2Iar*_{h$DvA^&E4gx_v7<teyc{2>2-b8<j7fl>{j@|3xXvrw#x1fy@w*
z51*?K%ym7n*Z4myphhI<)Y*wu##ERtcGXk#Joa8bDqbM`88iL+)TrG;W4HGThR$%X
zDS@43Y|qAxnp>WfW$($iE9;i`;jKS4R=j5j{^cPnlH2uGLWVeR(lC2XqiPfA3pW9l
z{nGo{!JW5_@RQEL@Mu<ZG#Z$|6S+ip%f#L{C`2fX|1{i)cS2Sgv62=(Fi-c%#=PQV
z7@|%VpSx;kU44RJEyY+f$8dtVvjYjD^(2Yl`B^gUb*LXjxI6w>zW}*gU4S4JST>F8
z`6oqNTOtKT+8Ds&U<r5@85wJE!u0a9)H%uab)dNvgFdI(!7pGkvhZU3?1(U?tqwpw
zw!BQ2Mo!VK=AoJN`;<nV#b!ZwYTg$MbnoH>n3p4|e$&Uq>*{H9Ar{Wvx!IH^(Cd5U
zBE&UJOMdV~J8IyJS5TO_JB2V3Sjg8;m?lvEowh;Dkz!n<pK!09;`!i^VwsJd8MpYz
ziG432Q|4(-X`|-SFbvR6xo;1kHYXQ2AMyoVu!k14|0yd@#S17*x^kpm__IP-@-#Mm
z^O79sjnP|uBR0XJ_5dzh>Zyn%IV>zP$jW<KvTh_wTRhT-&0S=+;E`)(GPnUqf@fQG
z5<1c@1L?|f*{ZB*IUN3Hxr4eqY4-%PgPr@%sIV*iuw%lG1S0t;fXAWFqohUxg7Fy^
z0)ktAcQj-vla)vD*p1{@>FQhu&GcnihuBi{ifFKjzf^mG_ycVlM>R+(a{|b7Dr;6S
z&5dQ7sYm`rH$brnqC5zR1RGAJS?NOEp5uS$5|I$?;0u9N-a{F&F1Mq)y7`SACHZ1s
z&^Lgz<c5TSInTq^enZ)3TDlG#()HEepvw)Jm>Z)(OWqs}{lY}CZ$rDvyOl;FaF=sN
zS2mQn$pPN*;J3lXzsAzBPu4|12}R_NFkRe8#OoD=^~^GNrnmT2CVej2E*s(a^C{y;
z4kxTt%6vU&tV0qCCNgYfFtt;^KCf>wvuZfnx8c8yHH~rteMUdRDK9_P(?t`K9BQ{G
zA|<j@bcKY(hu9AJh{t&VNu6MT`|*Z~mzNTM_^YVvhXOW;zP`cmyF8r5CH?F+O7YW=
zBD7$~Vqs9l>Q>?tH20v8XG8C@=xgl!Ei7|jo9GXefpcVMYi)c`515!e{c?C8Ccyw*
zbqhdwMg(Dd5UxlQrgLD`SwpdP_lv{n7Hb?QfHDU*elJWsr|lBtQdDR(vvA62S{r&%
z^@VUoCm(gLx_vu3Aqt34J$+Rw0;+Ij6_%J4Wc+77fQEfnz9Sy{yz2#Ww*_2CWu*o_
zCUj+^vYnz<PIzd>Y^!l4Cf7fs4**@$o^n^8c1u>N;z~f{%~Q(b5m?X!y{8Sv9=o@|
zk>lK{b&f8AWCn`C^$TkXP0op&BNSec0*4ZKX=5b#jTslfL`5K+0c3&r#6V%tAYgLi
zc_QpD9uRw-z8(iW1ORu2|C|}Mp~2xISG812jRG_j<7Qld1Q5HS22djeC4~OvCxHGX
zAb>t}qH6+qKh}gMoczPf@~}|sDD*fd+H3pfYG=e-eOmT@d=9<mC$O1*kN_J0Pc|#C
zMqmD%j0XmCKLN$Vh-|sw`n6~v)SOU+C<Zve6CaojteR~~zs;2gs*!%;TQdwj4h0ae
zaq+H4>ihN;PJ<uQE)x{@u@}W68VYHE`Vv62A<Ix-yc5utM`f=W($td8?fu=Z492P?
z_`D|c{z=zEB^s>x;ZeIO0_kWMsF85BcUXb}q<BQtun;{A4F4n=Q+}tbFGn6pz+RVw
z9?c)!JRtzdav94a^Z4+{Xu?rY>Y>NWz@dL!H{f!^P`qCose5R^<9n6Z7>_cbnZ{^(
zwlq9am(D}OCID_F{%Zmmz{zA^bL<c+(2d#=`SZzZZtSMHhvs2_72oO~YV&A`P7<zM
z=uq(kvbaAJG!5BhB#}A9PL^VA;V#gP{L?1T)8D?s>_I{g+UVAW@$4&ul&0i7?RXS~
zlU93^fgq-7F48bOK{cHg_mGnL8_eD4)v$;ZiJuA&a8O|_&>ysnYNX+4m?ThL@N-_X
zn~HOYzzUPmX9TNq!EW-0+Kfz|^PJG#cec{XwMSzb>hg+8cnArE^!)Zzyj5m2yso&D
zqE+yx@qM7r?k`v^obI0Fa-9=(h&*Uwy4-lBvt$ILUyC+^^|JKXcm6udt*Y7<#Swnc
zHg=TwNsxsV4$sa~tVJgSVa@!Q?#lIRp}vn|K$K7bbdOCLdbC7j^Hu+!T5V1Y@OW<c
z%RM`UYIz2rj?9>?9Ebrl_CeA`9usa|z3yo)*H264G@(Q`>hrfEQ10|;IA*o$;b-V6
z#|IQj?8o665JBCmcmDJNHfsj`R=dGZWe|KoBWCnRdkkAj+X+x7`YVAu9S$7U-^^uy
zzX-OTvYf$t^m((wB>GnZ)ZDqh&3BBv5wTEsf%~ld<0JLWSq-SJN52^#C3or^eb3gi
zJd?Zd{~Y?!8=SQ`EM1%Op1+-%Nr$O?0EQ|y8#R?nx74jJIO~5jwE%VrNP0cI^0U~4
z`PiqeoR!?$p!!eJ3h=qTxPlM*-1g}x6JigC6W$lZzzL=M-$iIXCO(Q48*~O}6i?N0
zi~!gqA;8%%e2q^+j+w9a=qHXTZ;Xx>v{QvVW$Z_pQGkt&X@I&R_y~2n(;vmjZ?J<X
zK+uW7q1;m*dm%U#_4-VuMC84u!}Ri3SEt-EHozyezmDxu`iSPfLaN7=;$)WR2B1&<
zzyHyQ2nkh(ZuOYKIA2wvZikUGRf7yTKXFufl-k{_d8z@WvJ_OnZ+{L4@IA=0Rnwt@
zEDfP{v(?&<X7XX)N-~PpfI_)LmV$n&l@2t-D`S-hfppa>_iow#<uFR&J}MvO|EnF<
zc%vpQlZiEVugCzB9?=~jP(gM8(^$RQe`D#-&#01pKm(1@if#be=q66h*zWRgq_*s$
z2oTiv`V{vLWjHtM72E!>;8I1U_H+>Wo)U!upuPDi0iZ&4+#AsFj)yhRA<PGJc~Y`k
z5GbMG2HIu%UO-EGI+89>JPk102I0!&d(A1oz_T|Aa50rFR-cJdgdhN+u;=2w_<qp8
z5ryhrLVMXi3MjMhqp>B?mO_1?^YD1m+h4f=Y7ZR=@R#Ry?&QM)v<uc}pI%6&k3fM!
zkyNo*VMcE??*;0wZ68^1_X|g6S=SP)3p<#YNaylMAu8#Z<+Dcrdl3@!zyFK2EbgN%
zxm?V+L@!0NDZdiWNf%=AcQ|6nr2ZP0Ghm#tD)s0QW=jWH@VKdApr1wu+2(_2AIP)>
zB0Q<?sly<fkF1Nb&OEnFVxJjL@nm!R(v{1ve=@{2o$imY9f8<?3x^z&Z3w)$0fOmp
zOGRVvC)z_38a(#AC1!Q5CNM3wh&oOg3Ax6>k{lHPD!pa&<KGJt<-qE^oJ2b9$H*xq
zd?g=(f4n*NOKs2Hj1dt59%t~%1yaC97YY;=I27G7xs)_UAF{W2Ic{T|$N^WhxJ6Te
zoC71S!R7gON0(`JhxNyoNm5i12&&i2ITu**Fv13KGat!gk(dSqYJ8`dZ0m@GNKI&p
z;IsasnSlMWiVD&d&@`2z0@fJ6xV(X~iTnwJH`5}Hy1)n8ZSU!kkN$@S<$kqV7g=U1
z2>ekvya%)x>;(kUVF#6+v!XMiYc3MkUK{3<07_F?v&pV;kW4HD@{0b?wE5dv@V&ZR
z;hP?Npy1VyI35<z<~=QPrKQdW_cs@%#E+RMeDd=S`HCsbJ^dBa5R=9-m@y7{7RL82
zf`B=kg!vKaDGv#EaTheIv5=g*DN(Vo#y~v1n@rU#{NZDk4_FX~KVQ9bzaB9*mYfOZ
z)p9rTX|<HdXsqa2`O4=xEam-{Rk$hGlu~jE+81F%>unk4mWW_pRiAQGlYSwH<p$1?
zk5W;I;!S9mS~fV1X6N4G*N6Q{3J+I5jD;r76C6jAnpSG-i-LtBXh`${h$o@LRRdR~
zPFo9#_r%^{-)A1eH{s1-!EB<Ur7-wf3rZUg8wA7$S(Az&zSnx^FVTg7Gn{>+8L5wt
z4+hpq^D(Cn7J(=%lS@CgqAwFsnLt-$3E1Eg;VvOo=SMZuf-ic@AVZ0ZjoF$MdW|(@
z>^VLauoVUbLQ3_`pLF>Czq@o=0h2))YvMY$48z9yuO>`7Q^X))d&f%5nT<k>$TypT
z^BQ=2$k{^v$$RyG$nfE>e61;}1AL_PxCXIrdJjB)fuB@nLD@^IUX%Khg{H#~YFjUJ
zaHK;8Sh`*8f1O%!pk9-blKT4kkda+HCLMq7YehpSayQiB4nN988G%&5+4U)ELilXf
zC?{S0W~ieU8%El3y}Iq!+t6TaBL3>Ss)~9pxReGvZ++FAeph|XWUOgGMhC>hBh*E+
z@qsP%r~y2bftI&w=PkqnHhaOswtZ#HZ?is-1ap5#g6@l=61cX|oTy2;Lr^CnP}h3>
z)M=G9?TZ{K+BCp%6XlValk&2yh?k`QdhD8|l;<MVkNn~_XRr5Cz@SO<e>#hYg^@AB
zhos30D#jamaM&I2e$b8jrEcSa4(;k*$ZtafFu}iDCt>(>HUsp(2Jt$#H{QeV?HnBk
zu;iqnrGM_aKEr2d1H^dwr@y_)OUXyrYVh$2HZNRc(Le6&YrK4ROGJ54n^OP2eKb2@
zsO!+ArSt`-^9MylIi|B(oXYgyw^ta6!7veQ<}4LTECR+7C-KV8-UBZK(cN@}sTt#l
z?>wyKdz?Ov26Ls`EA6o_X4b}QH0a-I?uEWr^w8H&pFY*l02cRBv1Zjh|Np-7yVqm}
zXTGC6e!Y?V%9}Wl4}=lZ|Ih7-vJk#PA9c3A(S8@O^Qs_gu8-%d;yY&D)L^Q{T!WN`
zh}dbP3`9l|zxq;5f*Q^g$|;|&O+#46&VnlPkvMX0vCc}@-(NE@Dt)vq5zCg(oJtKc
z?&3t_oRRo_rqw9UA^bdaI-gPPyjwBZ5uEXX67~@3bxb!L>-u7Jn}$EFqxsNNbqL*M
zwm+T)@jRXS!NDQ6B*`$xk=mSvicfQExRgr#U6=TsyjI@CT)&h8!yeRrW-5Lt4XGBV
zkZ!H4kgss$f(ngJLVOHVR054Dlyt&AIR(^RgZ|Vd$@%`H8dmooL{chce-+w1<FV*}
z5Xkq8h{=91JCECD;lpc6@rTGy&c{4lafOvdE?NmHV0X$7v%J~R88sa))#_$}4@M?b
zQ^=?O9xERIHu6wn3o(>v*-PP;llj-3ov9i5MFhicB92fPS9yuLEOG`y5%%F&;X>^N
zyPcGwN!m6x$EQG#;&C2}({m@Q*D7Lva#a(=-5$eUs=x7A27yRG8p_X&Hm|0&?o>tb
znw(l3bK+TU9qrQ15lBl|V((2ViU(!hrfv#}=oX*ZY{R4rZCv&nTSNGpMJ~LD>TYhR
z<@De+XM3wozZC*B;)dI$hNnq8c~NfSv;of^N8Qxc8xM{L$m_u!$$d9P1*8}}9wLQY
z3`9;AkSP_E^_ElM>}x7aiQSAan?wc-%Nz4`tDLMj9A?KS=>AJYaCG>{-h)=PKxC3O
z2<)+9JlTG8YnbkBtDyR-U7N?5MyErP_C>swzcExrg~M0;LE-aa&LB5|y1fbcCD+oi
z6zKel?<(Znivj5+^;0ml{}%#9-^2a2q4bUUZET4l%o=SugT7lYF--g(*U(WF#h7^H
z%i_FVJz_Tn&u?z5$f}y)7vq=f4Y@+2`H*u(AZ8E0F};%&QGfc`n$l@nc_Vb+-e=j3
zO_Q%kE8~sQPO|9V&Eveq_NvPra{3DR>SfdE5Kou7&%blygvFMaJ(HdZuv;-QHH##H
zUDqA|a4%;fGHUooP@@<7i<{M5jq^*r6M?QxH*smi1e3}xF2=^jP~+019hz}-@4uPC
zIInMNJ@{e+|JgdMCO>A*ib@(&->60?N=N!wP1S_N*A5URZO7gJuvTW8I7&OQ&d6lj
zF%nqRvvn_|Xeyr~wkv%y93TwmROltC&(pw5x!koON`g3Trl*aK#f<-H6Fz8q;GVPf
z>(*lF!?*0;qGODSxwD^Gv!XJApF%eDIck}842e8#29hWuKE*+lBnr(U>wK9sPNCO4
zE>O%N*iGAm*4t~$=f`(u;c;L(aTxdP?CiL>R8>{CbBd9Wn~Uiy-C9b#6DWX#-S@+f
z2wo}*;TJ~-XsnG~hmFB+uD=vTP}T<+BVL&_i{h&{isP%}Pw7*qm5BU^8VOD_%1E_K
zmr_8XPA>yFn_+5*s4;_V3QV&I6De8RZ(cb$q~?y}^z>iPhY$K}zE#*7EFI_e{|K>0
z?S*M(tI4wEL=k`Cvy?TQyKO{Bf11+!lpJl=>i4RzVQJ^ub4nOo-_^oHD<cYnU_x(e
zbv1;wxdwOQgQ|OxpJd|70vCmIFf;<qq@z`?F1s$|VH*=J!n7+8RAI;Z<vF)bYUU;g
zIrw73rBgg(l!OS4qSj@sM2j6430H}|@ArDB%_6^7B`%0>8?8DF<C%A85hAni5W&%a
zit!Wj8^+oXKds#N@sal9{`T#grn<Tjh=h<H^H$92*My1jL9`RV;#75()ECCj!8Sy^
zNjm0vdvrM%p0VHZPy}E7x$42_*7o?;TTa!@^^zog0i^lv^;oh^#?RP=La5{iDSm#d
zo}JxVgJ;#%)phmd@9|!L3?$<iJRSQdYl^FT*wAZI_RrRj0xjA85?Gdt%PP@lmdtpP
zpBv>eh_KKP46Mn-7-%iB<AnQ}|3n-&k}9+gp1fmndOwi*Ati;SAmck^cc*rys!B5_
z=^ai*VIEoLfvu`xG2NOr^y<#|gwb?HQmH3ni0B*aF>wT>O*99!2-u&#0$C!%$c?k5
zOPa@_b<Aw#!Fq5J**mZ>Eij^X@a`%{=HgOXpJu0Iec-mKtaSe8KV$CduA`Gw+hdJ&
z<l?l+ei7O3r<NCyA{JoimJ6Tw(I&Fl8@xRCKjSL%`3C!=rkR6PKUbfGw-?7g40*eR
z3TnC6@Jf#j!K7h_I%LiW5By*+ptJww*$LGI%m6~JNb)#gmv><LXNu=&CS@)4*W&#B
z?<KeIX?g44uDKMzYs@e77CP}>J`=*vREj1tct%&kAvyUV3-WQ$+|`%*l{8+0Qcw2&
zU)vAuWP1TQfUqmwtTqvyoW!^b5%kr!yWA&9%e%3FY(>u8?`xaDq}s0RorWjSGERq5
z(uavrCs@=*#@$aRR@L2{H@>HTb?AqI?<&!5;;5QWB_i)KH8ie_tdA&bS3dBTN)cQK
z;*Cp_4r&wLt=w%|xn8DW2x5(3&vHpWw^h}Y?PbV_Rw-*0)%KXE(3ygb--_q-ZbU3i
z$31yW;oO+bH=52llJp<uxw_I{pPmxB<E(as7BmHu$em^cQ_rRN+*Sir@Kgb-3MEo%
zBGtB;W_P8lf;)3=U;J+E?GDCIR;f*0Yo>@+KA*XSCBCgci}OS02Mhtn(=XcX=qyRz
zutF&r(QJk|{^^X=5~mINFLoa}^X`mb?|dN4N+aYXPjKIf653DNG859Et8?sLe1i=>
z=K=HS64?5c`j_pMWFR3fc0Q#q1zcfq(Sz(tBevRv#*g=>@Xx-!Cq$a3O_8wViwPUX
z3RtR$gCo%2-~CoDPCSaH0z%zKRXfH3Ad0f|cO}_DN|vIWJSb?W2M7EMxAy31!xiD0
zB#D%cV5$GcUWwVRAMJbgnREx_?}sM`K6RdD#4tNi$x%X*M>PS4@aZR?ZNUjoaB?mL
zGgUOWR3A})c$F|GQ;{-7BAG@-@zkJhJ2l6^#7b|QuaDXs7M#n-EUi2Nz;Ib7{VPWe
zB25GnMH-RwY{gHee-87$L!>V=DNNJ~AJ02-Jf)@sVt87ht=Hc(av+s)!_zb7-Hi~V
z^pWdD7qAq4`UpvLc82_EjA-p2HU{RkXZC+ZUJ#tbxlw9dAW9m!fh2a3hI1`S*CP<g
zt`#8=iAhvY>ABNQ3>X*}`ATbwT;#2O%3obMSfOg3V4n26OE}E=DPO!pd$cS?=JfQm
zZ(*!Zs?p#(CVc=sR!;kjn^Vfp{zLh?YAVzK;rbrRmOesl9^LlCO#8^Z_FwQ{v>V~d
zu-oMcp6!+C*XUD-27wel6EJ6hqmllg)GT_{>BzHY!0o-4_{mD##AElz(!viyMFRp|
zkHx(<#numKD#^Q9m1=}NDzPUsMFyG19*=7}enoy@gR9(kTFCvF{hhI(l!{@M(kT8?
z{;iyhZCtZ#kTz$`f`ReQ5ci$<+1pk5UIvnm^s89LHqt8Z?~vMQ-Lb)zsSR89|NoT#
z8?`7gjbh)cL&yK^3WbyJs4x?e!0Y-z#yr-gm+p5FK57zYnvpOm!~VPG>QJ#7aNy!c
zXw6N#7K{3*TSgUkUUN!`$cAmA>O(LykMZ<K?-|jW19)xh;@75$02krAoJ!$O4;f5o
z%dTI&uA8`>GVt@2RPYvdrt7e`Uqh9Rji2<EagHr&S%oM*;I9xWa<sSbqS)RVaK<iz
zdp9D!j6jc{$ohtYCQ#o+dBm<`Bs|b;`OOb1`Kr7(!ni4a8kZYO3d%B282-L$pB`K<
z!TS7p@krZy0+}H+t=6>m`%CLOuPLu`<fL@kH05{(Fn(Z$B`e3Oz{r~jPUZqW{xhTT
zRY>Myx;E-Lh8aEpvR;gZQ2KsvZF4^jiw9(>d1OAFlO5yh(REpF?DVU1se)n|q$$T!
z$<P{gzwMj)@?;x=%PwR8dkFqo_P6BSLu|hy*JAfKyHs_}6#Kq|$cTWl!fqq$jAZtg
z%{iK`40FT$3Lkg-rZfsMFpTgZ`NgdvO&&GY=YpsNQzv}37~*5|Kh2zdO)rh+U-6er
zL-v~s^Bq=Jcm6Bbqb<zK&i;@JU%lPOp}A;roAVsWs7>7j+s%G1+jN>ph0h-|2}&8V
z0Jgs*ktHUS`;~5b?Q7e5t_rtvooTDy{W??(j>DM4_m0n@$iF4uU0mH4hVCcrcBsA)
z@F|2Ob1>p-Yn~?cOAem5$?!P`+VT3$?`iK_%vjI#Gn=;WuC8ScVBM;&ms(^t9^Kbf
zodtobqh5~Sedne&#Hnc0p8f*$SVT8<_JF-;W5!p~>}%e+zZd7%6p=CXd@Exze~c(#
z^}V-W=<45o<bU%ByiXtKp)H;OK;!n#4QES@>(%+McP<(mQPy&uRsq9-fDofuH|(am
zzPr`qrmQPB;O%*Tdw&d}zB`%iS$oUt+o&JwR~&C8^`c_-6m`1!SzJ0r>So<~Z{X6y
zFdffJy9Ol}r&qa-Qf)cOZYEGdr&QH-T2B*4WVC0#>eCE_qHz9xMz7rIuX39euk|J^
zLCI;?Qa-=k$)je+gWV6AYrY{K0nvQDhx3VVZ#In~S<-=hE1tau3&*Fu3Ky6&g}coL
z86w7U3#>3kanCvL{Ul<yIrFUS`MwyJKV5eNz=rtu&)en2;x~>Ip{a6B=Pd3awPN)g
zqOXk7{>`I4;egMkoKj9}*yCldep?O4ZA5#URN}g^Nx9$objwK<{<7hon>9DKFf^H7
z^$fh7CN6mEAB`85{^|GCF|_w)t!Ke#)~Qlk_d|em*J#vr+j&fDb3{2klT@mXmWvQ`
z1VUe(eMH@*T_^7&{YYkg#@MXG)n&GMdqVeU2Xv$*iB96rBE-R4@<HGSO5^Vk<5_i{
zH@^n3Bj!>$MxvXg^nxmDTc@iknp*q37kFE`*D-_k?c4c3-1RKCi#;gMA6`~re79Of
zJ8E<a_DqbYueZzIUblHUPvtCbYq>4;oRrBh1@3%Vn4C1|npt_h*~{4br%cD9rC07`
zq_v>e#>86sW?5=QFx%_v;|qEFnOrrdE`$-zGqp2?>+AP@t5<*858C4FuRSjY_AcJG
zUwO~nD%|xbMIk6-n$$NuhB~zj!edH5$dX+oVa)^zbRG-DF@;K-1&zi}bkK;f!!H8m
zt?idRI{z_|j%Dy)xyM!qQJQP~w^1`Fb#ybtKbF(SQ1XQIA(DH|OOhQf#@9ADHd}Ij
z;L<M>GbO2LxQAz>@VUCK-PkVc2Wpd}yt^X*^`1NhEAI>(bMCYDzKAr2?Goq7e&ZSc
zE5E<JNe;*u>$%XKFS|xf!U*laK&hL{zu!i6J-yfVY7+JPao>t<s-0z1RL_K*+~}D<
z=VKEy#`nah<lh~aFW<f_pp;U0Dk^1kb#1v>3@!7V?Q$Rg(*5V{^*~yv#BBweDmQ3+
z_<f%heyH_n48ESTF#Nwc7-l|6u<N*RvD&wsh{vs|E(kL~eD)gocsw-I1m9<fU!h%V
z=8b<BL9I<j{RE{sx)l17@%11SWk**&!`-y}ir>S;(Y0bgCcStRme%=Qs*_RL(lxgg
z=a~6+dSRbs55q0I7ib!yZISWkZQCq_dnz7gUh6hnsPtQ{vLvd+x45M7uB)SMcDWoa
zEQIF^`AGSPyKR3__X5GQLrzI~dp;#tOf2(VPdp88R!i?%hcf?a1vmeTo2j>kGh|>w
zjlRs^W^b0orl)?TNvG#co#567t`&~xBt|K-s-S_+GieF#`n{#%-D17o<x0aVi@V^s
z2cVnuJ>JYeavfrRI_Vodrh7+xX6>!%Z=%Gqoaf5gi$46Q0P~Bfgk3L>)OT2f=3So-
zD0DIW?6xEfi%xc=yDJWPU)zj0Z6$VVc@|ToQe!@wZo*;6xGpcn{QRG8;_QVYplU==
zA|3{aor<}!y*2ndp|<ybSU`<<=c39?+g+EFYkG=0k8kET_DCzAqrhV;I{PwN7pPV!
zgwuwHyu^gFvgZ4;{y>L~L}eVy0T%6lfcH}BAJ-qAj8d{&Z`qp&HfCB)Tg!IWBctTy
zI-EwZasNuWqDqhg?J5~}*KapRUb#C#T+HJifcg(}pXn8A4S{PdXBKP6<O4G&BV{@M
zgJCGX=ISuVC?!}=GFR2N#?&LxZ*N0}4wbMkGk52xRzeO+&wM6Hr_%T*#jC45Zwx0{
zAyWsL$H$KkDT<OL3}b=1dgZ>ZKk}#T*41$5;aX>^p_w^-Bi3dSidt>WN0*zOUIp<6
zshF91n|kw+yrJN_vuxHo;@$!to5oK*|1P!4SA35il~Yn>Uf-@F9WWIskxbopoB&gB
zX&W9W`)JxwICX0M%}iy}W6s{CiE-m^8hxqVh2_cpwo26W+Zv=5xrnN|Wshd50t=`W
zP%*>)<170pM4J?CDI~oN(BaB|^|J%0HG83k5dIJ!bFAF1xW_+puREt#m{)toW@N_G
zV#EsncAnq7(UEldJ^f>4GxuWc=W?dy(T@VEdfQJlpyG)QY2x6W1QNVM2~}7}@H$Uy
z61Dh?YC}SWzqU_f8RTy*>)i#qxBQ^5Nn2AblRPR5on03V_j9!Cc1PNJO4+xAZ}hej
zY;olH<v(dsrW(z(Gncn{Iaac1c8cH}>D!bC@Muy{Qf`QidNZZV%XOm8@;U=dji;UP
z=O8rps)TdKmPI#a`jAq72PiC&QEE11NMhygx>bzs?qrrBb^JF;t7k!4O7=W3x|4ER
z$k2Vya}e{pcJ;xR_)Xt@KOtJ^8|<=6_=e5H-DnO9O_Jou@``(RcHJ|z7YaHl?^gH5
zxi!#ob~`|aTU?KLrp_5PX=olEosGLRYdizX+|}Q$KYJ2*-_vbudXtp*E7;iIe|-t{
zchBkkPgi#ftKd3$-(82Q6QG6Y3E^n2JCc~cMic4=bC>^i)tCZe@s@wFMFVgCcPL8h
z?sOa+^2R^y(M5ylS>17I?cG&xe&%6|?Zk1v8o|L__sfzw)bwt_n}7WYf|CD!Vs*c@
z=q~K4DFR3j3JT?)KDC*S3E&m71=e(R^t2!nIx-{#96F*ufg7mDi$0BtZl%dkwwMv(
z2ezXR=ovP=tX&s=Ej?XI=#1Vt&W}(3mP@qRwBSQxiTfEoo-3u3GO>z%C&1bz(0<;v
zIeiPEsqfe@aW_#-;v;^AdBiFaSm&AWJOp|B=lWOO_VJIQ9lr~^*PBHvp>Z?Y$2WSz
zTWaR!s3cRX^BC6y9~<?{FP-&TzJ#P{|EO$2ek4MCb9ZH^7VmzzP8#IxCY+^Pz8zx2
z{r4wu#(8KsITgcRsMEWR1%XXolccJfm{{4EGL8R+ttU}kvlL=kHytF*U&oLtuu7ex
zcWI%ap`CY9iV@Qvh9VF|(#L_uCyQEthBM=t9krXK-0I%SVPJ+z<!YH9@v8cV@+lB?
z<xXt3Qp&G281~{`UJ1V7{Id5bc{NL1p{K@AclJDH{2_Q91&h3FDPy*O_=cC>RBrpv
zgDF;tDZl<GD<5!2m2C;f!=QcVR_UDS6TI)C0zB>kcp+owK!{`9Bm09uy5diSptXC)
z`j?wGH$uAuWxETT>*%1XIO&tyHL3mUr^lrv(xk&E3;%7#v3IJnN|wXUn_ct68?`dQ
z%RCK3uAF}ETKm>dKFVPgNI3th-S@56a@Ow4lKVEM*Q|&zeHK4U4ZhgNIz?Clqtd*7
z<b}7@;7njm(>qQZ6vYc{M3hQ(girW(#b<?gu@zj5oq9X=f}+-Q+Qrita!VhuHW0P7
zZ~lWJ5hWsX&%_O%S5-+s_IYHaV&6VW<BOwA8*o9+(~oMZ`&Med8g>06w(@5H7QZb}
z8|3QGb7FK5M6yb=s<x@iK*S{W8~#J#V5L5D%vJkMOJQ%8oJ~vmet*ytu!7#RVyjT|
z`7`SuX87-s4;)$-7{UoEGghYkf-WEVt{kFd8!<@1o@!cqi*t3J&b?LegE@ozWZ7Xa
zStkC%IX9HYW<d+}SA}qWPC<#YHjOo{5me`^-O1ukr0pcq;>Q!Vn2n9*5$DXjf`V#-
zdS@u#yXMAOFE5EHGE;Nw%f8bAyFUt@Lxd7mewMBV2-OIPbM4a#H&}{dmJ~$O@$?c#
zw^B!Zm?)Eyo>X`7a*Yd)u<D;rBmMnvZSCRg9?`zysY&w470DQhsYm;5s;g)4&kPyH
z_A4g6i<QQXj+QsAx{cj<y^i^9hN~ZDYV~*PD=3B*O*1|IS*8&E_|^bgdsi(kCR9-u
z`LZ^LLAvek6AO0YNpLzZ2kNYVN=$}xT+Z@EeSU${BSZZ;>!{C(QakCNB|HvLR_;a?
z78cg}&h@PvoE$JH6v79~!I)TE>zi6QYN)Gg>1pX`m=t~rUf=nGjmy2|qKB~GRyA%K
zyBITjE;BW5%_GPw%A(W=`82f#adpY=e5!pzjs4xOJ<*nu6H_V@=YUyn*l>!Rl2ytc
zyFfK*Fd&wmbSzjw3JMq_l8JxY96}1-wgxT16xfQ^)9SH8-ssBTK2G51dJAiox@=BS
zpFiiQ$LVHoGMPb@Xi|EypOj30dEouikNHc(^mhoatN9{2HT8UQp`hY()B43j-Oj}3
zD~X^a2|D>xzB8Y1g55tae)4DE?Z@DSvt&K`^7sp%-D8-rU<Hd~%Vm%P1@hfH=ApVM
zqmb_A_8fKS%jS^!SB7O2Dd+?f4WtxqK~tA^DsQ2_wbJh>o-7)jDJ-pUy~$bnVS90l
zXHyThISy?zvhu442J@_%pT`{sc3*Lx83|agQ7A<K?Z1A5^R==n$XO0I8*^PEf`p9C
zM+K;C!#s^2XEt&+H-3GXHYQ^Fg8h5DZ(jPuHJ9kzv!1M_Cy(J}n6nnqtvoWk`Mn8A
zIUn*P`jd@p?SXt-=d2FlV^c1*g`+X*;9^Tk;s?1zUrqjay5NSWWnTRG>hyhBv&ec%
zH<3jHYTbnU9nUGhn?A=bK<%>=JL`A4&KHz9^zSc&V!mV0u-lsiO}{DJ)$E7JrRg%B
z>R$JvCQDVW!Na&`JiciUvSnWf#jAvBCD4tK@w%Rnr-0_a>GDj$$$1EuL&z}z4&s$D
znmq!Wun;hOoZR@hOhgZB5IhVUfciI^&~k*yCn{9%F?vxJ0g3OhGzV}&DHsJkT!jcE
zm;sNs`C$jdGOd3ExN@+hy{w=Kt@$joR+)z;u|TdGbQK66<<9()VA{^tSBbvS!hV{k
zA#Mm_9f7Tl)rZgSz5C4#B=EgJ!?4n3l#A<2aDT=~7OR5Y1Dd}S^5N;D@gv`0&wfkh
z8VZr36Tb%PdycA$0xx_B15WO{xuxLV8)`yx0VT8cD`C|hGJ8XQ7_uWs#y1@F#GVUI
z1K{QzKn2D*ETL}#nm*Ep0{`C1M~U*oz#6Fp;@GT_mau2vg^B^HY?$X$PM}dbE4qo+
z>^T>AAH#}hK+HT|EV>|h_G*}*`=CRj_sCN61oOIxM4-HwKW6Y>M^LJ4*#D#MEyLPs
zy1&s-FU2ajwZ)3NYfC8(#Y=D}XmJTvXiM?pF2yZCLvU-MSddVhV8u01oM3r3_x(KY
zb^hnWIoJE`oO}sn?>#enX3f&yT4SC1=y4pnpsqfZLFxR~KFVDCdU(%XQX)9}EF*ng
zyzU8TH>g<f0&K_<=6rnnsk)SCEZuV%@6>@pTfq10aDO`{Bui2bjB<FMD);#68-6kp
zt#tb}3u`h{O4@+5*s(>vVPPJ+t1&+Rsg=Z4g!iHKt>-}mrZTHM7oA+3>>B^LrX8kQ
z<?wjrcLO35`rPw$`ty0L`b`TjlJ++@F)Db$BuMq5j#zGH?4Qq{3qB~Y@qc>8S!vj!
z`%J<c_py)KIWRwH-LfAdeUaP;#3VEyWteOzmISo+GheOO#O=x3Q93SDlZ5ssRWafr
zf-`_!%@Igy;%!y<%KI<sU48%6@^p4Gr>+cw_b-Be;G{xDp(=$Fo&1WTzEAZIv2=j(
zw;C0^8?Rr#3Qlz>lrAy;%#!FY=(Uq8XaA%<#FXsK2<~v=$e{T6Ir5Y>d7~$=p+8Qh
zF8A-SW)xo0<vkiB$`4<jrEe$`1q63Kisr96tXmPDJ<ESJ3B;|p+UHH=X9+ZZsW+%x
z4Q-)gew#F?;Bf(yMDYBl&xe=rRHEgorr_`Rq9ut&?!EI*+QaUsPAbki{Q7c*^BS<4
zZE{yvcftb5M&6CnJ)3*Lsq58KPI<1wN*c7#`ZP)sGqQ+ZH$w+@-V!m}gp-J_K0|dB
zSTV8dRr)U^rXHF`0_92=dz7)m5Mef;a31LICu92S?;QT?+Bra~XykQ$F%U=$044!n
zL4yDk3Hbbv%U^VpoFMq1pp+jT{UFe9Hq6Z2ev9W^MWas>a0v15>lVH^^)89^cmYLu
zo|gVj<h=(eDZvMsO2iHDIa6gUE7^iTAvt?APlEMH#1JSQ5GXIs`;E{|(9(Z?Z1mVI
z1%d9o*&qN#hIF~Ty=VQBLIg<C`STV8T8i`T`WOYuA@|ann)QD3H06TfUMLZDIcLff
z(2sh%H4NMlrU?Q`)~6$Py7+Ir<ayBkP4;fBbGCtDvmPFZptrUF?rHoGs1xVTGGGmn
zV80bv5&2UzVA%UMh=-9iL8ql57AUm#My6Wy-L2|BDx#3M8z73vCrBi{;b1{O=!b}{
z(A@}AvJ599@oZ1z{U~YP`}aWWD$n)DsHyYc7J@)$_O^7&A^K?p_&<3_6M4<qM4C<#
zGW_SVfdCyTNJbBsJ$J)fpgcuoRsXG{qWuHcC&4c}Ic)czrw0r$?a-H`;RP83m99)l
zvQ*6>Z1G5-Owu?NOSX4;lWbm?1F$|pBCCH>o|{nh4r}Y)qx)H&=yY*FDo^K9U)ygr
z04x_t-At4jgie`3{~M5x2|M{C?c`y@PtIloT>HX)PW@w;Cu#NjEBlB2=-0-6bnyb3
zqCn+H8AFIINI4!Tk^2UStKFdY-yh41k=zwj&kM=9?sRe(5tg2mCU%*oOrbaKd8>M8
zvZZLbGkM+@*MS079z;T)|JHL4QJosX%XrWF8^U8cI+Z>Ui%oWmh!6!96!b+EGrdM9
z4Y^2&XLcdoAOV7&o!rWLS8z)#p!C-{P1TlpbL-^+oyi<3DXU_Jr0NV#Dy|J%_sKu9
zp+wsE1piB>`jpr7DPwb87Y;~fro67n1_HUixh{bT0%bk~DD(fDm(@hpg#POb_&*$`
ze(()Yj$?SKGFQsw`-t>Qw|=J3<s*RDbM6C(-Jn`Fg@J|~9Pd?KEFnNXAc5;bhW9?m
z1gG8rfd;Ni!o6Dh_B+sahZ(3x2)eqSqHnwcZ6|L{GD(>dumAlUbNxhWXqVxzI}@-&
zg2?{4X?g71^_Gx%3NVA9xBJ^e*G_EEjqCGMKTdwSj2<Vu?(Wu?2P!u~uT;XVUjr%8
z!RBmi(`DC-06P1|&T#$xzj=#ABqa!;YxD`-WSr=zvGS?3@by>{t3f9I@QJc;-wDI#
z<F_&baK@5lj>Nb;KJk+B9k#j{CFEOB&>!9|0#I<>l8sLNYm8A@a9x3|$w{y$8lDf&
zKPJ*IW*2IxPF=erbJ&Y15+l^gln2fp<pD-b5~(_0JTNb2Zv}g<=m5pGo+)X?L{IGl
z-Y1I~4A%pcRCT$sb<@u6srk!Bx!|eY7-}UUS@-xx{g^y$R30hlDNiKt&7dDoE=yM>
zbH)SEo7&8bzP%>_vhddPvD6`iHZxa~-<J!Kz}eNMBG0W^aRa>HYIDr{*0FVw%`PAi
zUXJ-45U1P4aRp@h1}T1}|M$_rv&N&OUFViRFK++Bm!IfRy_@|F1Pb8A-UXfNXyqog
zTC>fTKVK}Xtfld}_xJ-vvZ}rVQGBOm^^4F~rWy2h3A@^|fx8(Dw?IP#!151qXj#QB
zB`0f-IgyGPgdcOxw|<wc9aw|0PfQ%`OfvbhKxT}cv5j0liGnW4vr{^)AyWZwbB|K;
z(Omb1NIy9sn>&(P@@uym&n})rty?<cY%121tG0%g+treW3AAA0uF>HMXRwCo7Ru;N
zM(pnduniKXuwFZnppo~Ai*w$6T`v0Y#%(~P07NwK6+D$|^C}%FFdtCeZJbsM^OPS+
z?>fRv*nc#VD>^A1kt$O>_8Ga)T2oY{TT-mKRdw-p8XDk;@{dM<<%6FfXM~y3H@g`f
zsj?d@S{jaS5_#AdOn(n>Yel6$^4+dIoGt-6HHoUvXru(40;CvZeR22^UzWJ*%xczA
zPCr1X>PZ3<!BlSUKp^`F`8X4H%G6SGmVSg?C!ts`X=?0pb?kV~Uj3lqgPbUl+Kdkv
zJxrA3O8UtiN^5=cHq@v91XASz2=~;~<oJz<X6opRi@ML5(@(4bTtTS<tUr+LG5mu=
zVeSXnk^+y+wo1&1A)D5qadaW+cr?8paj7R`scqicR+W48!N6^h?RB-*yH$zgdIOhr
zK5OQrc7uBo1BWyR&(nLm*pwV9>jWl3en&VkQ?qxld*uh{&jx0<eA4>!wy@K~h$+kG
z*i}Gk)+BU)HLfnD`8OcxZUPMNnBCyicmY?TREo}T&k3-1N)Z~LnDD?Wfa^MxCntK`
zmaA3iHIj1n01Un9s|J;TQjA7fZi%h+$BA#voy$?o&ceXRuD5Yf<04_xTvN+-Q60Zq
z^`l4auB;Ec=Lk;r$I;==$Fw}y(2E!B{!R|>%gWC!6pbLNQ=cE93|8dzH{2{bz*ZPj
zXBDe)Bs{#G^Z4xS^E6HLFsD7cr=wftltW($TwaTZzkTcNocaEn_`3Awjb&I7z%KYf
zBs%u3vqyt454kN%Q3i3XPoY8#4XcBy4{)tkd(Jw9lyAtE|LG!R#JX$3A-lz;dq#Dv
zlQ7<|C-~p-yn|vkj=KWsBlNhYj+gYTrYEMiVEYzFt+V2Rsdboh?oGC12(>mko}E_1
z4W3|T9Ezq^opawGj~C9l5mYbFbCYD3E#T5}S5MupZ$qCl>7xQca4AB3i&HR4auIRc
z(Mr2oKT~|MO32Vp-(X1h&BOTKg^H9houu)^<Z(S+k?o2;ib>j}UzS!v;tqr?>>7&Z
z5y2naq&7~)5`@#5XAxFDH<8nC@nrlSD0|U@zK{*m%n0w2p2U=-nq>$LC4ko|qz%V>
z{+5=;nWYlC@$|G$Va{n1l9n32hd-k2_w=GIH+8Q|TMS1G5)wM;_fQW%EAaok)`k2F
zR}~~<qU@xsLm!E~;1!f?k=1j{J(ww2^{|zGpTejAXoQNbtRZQ0{VZ}sq*B(WNhe9r
zJ$-cUGi7K-G3cqW3oSorugq?sZU>yoW6+-o_0lo3xP(>vLvyrPQ<}C_CA>q!@8HUm
z&TEB+SS6#CDq5Zntm~y+<y!xkNoy@Q*4D46ge8IXU%7_&ZZ~lVJ%>y$kCM{nt=U<B
z_NCpKtQv5d&K`4%Y2kz6H1I)-kBlhsew6@(mQ|vXpa0qG^VvtImwqH<qg`iW%q2o9
z)LRAFR$h1AWQUX#)Dpw>-AXtHw5P?ty$iQy^QGAISU)O^uVVykr7s2m?YP*@*P);=
zMJ2*rm7T)Kw2yR6H>Wg(;-hpD*5gdYpE2dsGXYx*`L~fVi7rk%#iru0O+T(zh|$Fc
z_iK@nR5j!#;gOibS)u(|*R3ECpyUck43ez1XyE5M>oeBv_$-4n4B|;bO_l0PzzE1i
zZj|US#Dgg!8L4}$*{BqT#26vdDa)#&tJcb9amX{4CoyVMqrIAixlu00p{n!l`(4Xt
z)}Y15KM7=Jz9*6=Umkjn9NkxpO(AAA>midq!f#L%daJP>vym9E2_!8!<m86FhX3wO
zXD%q;w3}M<h?f%`R`IyYvYnC8*l6<Vd$`&iAKEj&k=|*oxqM(YBUic%oOMAY>c{}!
zBBzPQ!ma89xGHlzzO<Y1rvlm3j&Is6o!FJM^FhP6X(F~w4I@&dHFuc7@{C{%vkrzw
zPb@<o9x^5Mykut)QQ8roXC0?l_e9ITwISDLQ3_k3Qb?6(>+x>5U-!PnW6g0j75xcb
ze0!^`$iHF<dWt?_l^yHv^AAO|@nj^-bl-sXI*qkjmp&=`&yCiYc-^MyS>+jPe4eU5
z6+ckBPNhahS_?ZeO53^!UF&CEXhe&HC`hi!A-QyHp6#hAS$y@9d2NH(h@moD1mj#O
zXc0)Vknt-4pM=~n^={U|`$Y{LE+Jyh&g~>d$pE?;SI4Fm1Zc9?bdX>BSNJyKgKX+1
zO_CB+vw)#t+)U#h%Ul&`QHgQ&^Bqt~F*`bk;D>RXaoe|$+U*yL$-9L#Yufus8A|#*
zYp+KT`&qgZEdAwbV@VUE;yC|}>_0RK9&gS4aksXDKCV;eSm_mV*3R6nkz|b25q~uC
zPW&BhlJR}$O0!2zf;&9Hqe|N{wd?^0DH}c|&f|siB;pECJH8NK5AGKjuCt+Jk8dAk
zs*X-O>pHsM;-&AqtNB|t!V*kzkPmb5SC9R~S|Z3&q+MqFH1T_8ZT}~aS-o)&j@qK>
zMEzIbmX4_bOC$fREoiIjz_FABWXq+btnr<a4p9Ad;@gh%JJ1)#>$%Z1DYap*cG9RU
zR5i;+h`m8rRtF~82t`>+4U~I!RTuYIyV;+WBRtWX^A(y*;+2PE1PxXiM#3dUv`NiA
zwu?j&z26A9!;M4FTFvmDwgWoT;+Gb19sJE7m{}Ae%#mqBkwJ*f;(<gWgfSfkXP!yX
zuOQeiLel}w?$p}cqNq;N7bi!<%QWNPFgYsnO(lGgo7j5WEzALWO&1>s`oa)>1}+FS
zHRzyfh?vo!d{<SX!r&Dv&XxxTPxyGM;##5)bHYuUFdNmS#7Q4@ZT_fB<n4GAPf(MA
z+=1O0^cRk$>VN#SArI!_dnXTD%v?iy-9kbW`%-NC#Dw6bCz{WZC?0=U3W`o1yE$%f
zu$lPK#y)av;u+`{0bn+K)bpPPBV4_p_R}L~1%wp#eY1KK)D`stZMEG*P;mo$oXd>0
z{fUJmszr#wdhne;?G2fJKx>wv_>@2R*16eSPGQq%r{RduJVw%A);}OoQlsW4n|<if
z5yqaz(f8}uh=00z#Eb)xOwd$Nq6Ec-oYYm6R1{SedleFIlj1*v^oc1A7rZko-b%0e
zZdj<VmHkwXf5~uuJGqgI=~!S)C^3539NIW$rpT+GXhwnYu!U8RYimzvPxQ23b)R_i
z-;kkso`UzqK8x@rv<0TyT56|svaQ^wg6i*6Q*juf?*&NHqJP26QF~QE-+6$$CiLlh
zr&1KV(qt;6LZi#Hc;ed_*rc@xQ92{v$dHKl#m(L77KlE7;T-}ZZw2{echg|KYnh^y
ze2UG!M{1N`&AE$k{6g}0D5H||NOal(lVC=%2GIBm9|Nokpz{Ni=dIDYev>pm&IsCf
zl2kJ8`my5WHqUVL1N&FPkZ!7uew@ap0;|VIW~OnGNBE9Yn!#FKre6X5BXOCqAb2#q
zjuZ5n6=<gZZG)@lMzFBXU*L`Gjb=HPwI(So)tbMm7ubGmpoAd}A?l@7EF~mUR(&r@
zg@4rmc^80)jcrcU{=4kR?reM;<O1XXK0VeyAx-M{c~g_**Y8|&NAjgykG<g?)-+fN
z@t$AEv%nv^FRF`nszc#FYPz#(JF;K|Kkfn2@f?w>yUOfr?DK#f^u+_%y5B1=*1UA4
z6Lwj3e5*Uxb@E?{n8U{GXznLQTat=-M1ORJzMvlx0q==9oKF{FoXtQyQow6a*l<p1
z)Eq;{gmhLCvkrXk2Gfwr^&`!+$VkOJt!l+yVS`|W=YTFG;+Tz*oonBJ1Mu(>V7HkY
z4t&1N_QZ~@l+;|irK1@|hr~X^5V59FK2O=;(ss^x+Y*cSqw3!~qe+1~OGBDC62Gl#
z5IkGz&!c!1#tel?CWs>Klz4g~v5jp+A^uAO=OWL18EyudxqN_tcn2G8BJe+%Ht~I?
zQRMdPM;bez-hQ)iOHrcX^`>+pz1ZUUAKhfMun8P^PHs8k^Ri7nIV?}-EUnp+p3Z;x
zaWm?1sW2aif(+0>Np>|=o^geyso1@L&fk0!6#RpNA9U}5mYRW0?m^rTG?_2x>i#n>
zE>%Us0gC)u1)(WEl^Qm8{Qi~h!V1q9@xun?tweZFkAdn)K~)M=-+$MBlfC>*1O&i+
z9C_b_oObo^$JlAw=!UMk_CGpMQ{(;Rp1h<rjsuuRDChK?W*YoOllG*hiV!x-0bZE4
z6`#m4TGW$V>NRIsyPC=_4o0dXza5g5Rmy_CNCNA6j~vq8Wy!9aoA7d2`<|+r(G;iI
zE}Ol4HNV$bQOcGU%~5Z~`ii0M_~*pJvs<KAd4v{69```J*LC-UM*jTD+y@MUp=<5?
zMqGl<SKiae{Ak(7a546dGVW=OIycDCXJ-c;sP^=`;eAagJ#8v2@xq9chQqcV<4LYu
ztb{*^1gauu1tkUjs&LG>&(!f>Ux0ch49$W2+B>UWuO>$?k6qL&74|Ozv)8P}rgjvS
zDA;fP(@e4&^mpz}Pq%6GSEIo4t?W5X5J^)?;zJOaq^3kAC4Yfy;3Q{9tF}m+YNTdN
z@T}(C-~e&6=sbYbnLVzf4Bb^+qVnnd5KpEYU?f4(iu$)_)l=pGR6z4#S5#n&x`7BT
zW&+4zbWtLJFc}Q*-<UV<Be=hTP3_>;KD&PmxvM~@b#m#-SQ~#>hL$;LvDHXXqX+#0
zQlCJl@xt4T9)B)2`T`9k7na>@P?rnq@hJa4^XhH5-!}fAqmn;ir8(*Nc5dlcIx>H7
zJUxxKTw0~`nb?uszXz_ck7ktYg~pww%`vtq1XP|+V3TL;gYh-NZDCpBI|r$@O;6Q3
z*c0rig;h&k1(s8Kj#b<Ib`;pNJR=NaHlVNkvega52hkJ1D-O7tp3c|!$KK4H?X$mm
zV&vE5F%iLL2wf=jfA_bNCHufH3Zg!ZD^tVzdq67vM2~g^(S11^T?-<>@^qwJ+yq_p
zZt|no&Vq@2=KT&oBm5_vCJ#|<vuqFM2XPyz@>j7*Nu`F4=Jy@oJV(uaH5ljC<M2Li
zvAT_=!>w5@LFbNDPIf(5V&(TxVtT*7AXK_kx?~-6Vo<KLb2#YOP<pj$VW(&zNt*{@
z*9m2#V9gBmfi+m2k?PI6PsCZVlW|-WAj%C5e9*ltJuZJ83hUNW<#*FX0?N<j!|=(C
zU0P6_273qt#u&=cV*n%&FY7y+(y{!yuQ#rP>pTE^Xi#HdRZ#nMtxmm??nLUap2Nn<
zs&)Uc!?hKmCpXfaKt48?ZLH%s<j%ePB*TAC$DkJT7tEbaZu?-LEzxnA0C|v1UUYnx
zkUV6-E%p1^ygoY4hCQ3xdv2m79qEy~(&Wj_Yds9vzif9?OFy`bNmdn?7d&8;4LAcm
z{R}vbeq<jWOG*TeYJL=OEchV4@a1=9Gq!c#7G@kU>-Z?#*#BG>@<&NlH?6(&dkZ_v
z^CU!}rQM&rLD8PjM!0shMQEu0X4Y}laJzB6<wlR0EK1y>)DIH1@1~x;$bTM|?`fp{
zHO{Tk_v(eBdRDq6kLZmynEoyi9e7}<r8-ND)cr3qlnS-l8VK`7I|iy;Q-*w8tM(G>
z+lrBVaOalX82$j}lg(9f^+6Yuf3`sx8r!4n)wPA{X&4FE9&WIB15P{Nk<x0>zF7VQ
zGyJXAn$O3K)q=kBA-QkO*28ii^fwIP2rs{q!7Ss-oEo?G?(UwM{WM2?F4v{gZ}7#8
zaJLp3LI(H^6{%e0xnUo+QVa9HLzhf&3v=(LWqc4}Eopu90T-V}-z>MXX(DXSlc_6`
zG{0TcyLYm2=GZZj>odIE+ux{bV24nhJRCYUG9YR;C&Syx$21HdK%@_f51JMJxR7`I
z4acR^5MqsWb$5t{_wh9z9`2EwG?f{Hqsr>*7k(+i)XRz*veUl`%64Vu$f^3!B9lF3
zn4{@g>=DHGmi=1J=H(O09_NW`+mlv9op9ARKp*c}^n-Ga5H40|+vl*C67OZ&P;*dy
zs`cRnlQzo=0iP9RvV4!N)?^_io2l@zxVtln2u(eEsjs{iak2T2a-Z)sN*g`j(0HDD
zY@w@Li0Gr;_Y3z@-g}MoidYNafU=or#>Xl!+%>yO-nF-1X7<ukfy_Xox#C-nk#ez&
zC?swq>G7rqxuf<sKc73!qO&_%9P)4Ily)j~CZBKQFGc^(YVgbC`90NrG(p<dd-5zK
zgZ^&M!S7?WEaSS0%$0MvPj*9Ip3ueim3;P9z__@p$<#|M7qzl~za&_5hl|Ci73FuS
z&-v*F=+&oiO3<yJMgl{Pd_u64hC25X4ecmW3dkY5-ox$AiTPNHyxDxx9E3r^OYSIB
zh^+GH9@~<_g%+I$3#Kp}i9Eo0XF^G0fxvHK{;OBH6A8WD$mBJ5=G&O*bVE`KR6xor
zyRdzN73KD#HU5nuDU;gKQeI<POk_?&5lo_y&#qGi_BgMpw1hy`_|c<WOY&ur`S(Xw
z@b}&GI3{|+dSZA&55hcItSYeFuD^IEG)}%pLH+yybJEz<Lxyn;u=~4_?6!RFA9E#7
zXJ`z<2a!C#mT|#|iGsmDJIGUH`mTMf;?k6}Dm7-w>1UHTyVE3x<5FgwO53X)E=QAI
zww)$JDNIHvU7)V=ZSdnM8@)FrDMl`PyG&!2`9=2r{a_jkvPWpHjKFbLtEeyy%>qUh
z>^_ZYA?YEaw)OQ8Z{BAJ%J5hYjD;WUuLy>Iw6k{CViY_<2<}uwf_GaVphO+_D%r1&
zmfa$fE4&YPy}YH=G+g$^9mNkfkuMrOHZIzVoa-@Jp^So%?At2hCjuuh@PwA))jn0g
z;?E}Ell6+09|@Jc(t}Og;1#w9eZVh*Fs%x0r4_js^v_>_WWE3)(_bQP;M$f_)rm;E
zXsAl`_&@x<v{d_mlz+-0+8#fu$iz=ItrpB`aoIKCy7m2Ww8(B`3Fnn@Lmw*(Eje~B
zGJ7CP{O?nnHYuOd9nIeRkGqw@@w2}@O_WXG@0SDzEuXvW4W84FnWqbN<Ts_+6o;o~
z7r|IL&^7OSho{`uJTSv01`~ss_+k?0lUTGNReG(H7M(?Ze$H~%W>teeWyi}c%IWVp
zm*W`m!VIs}42G~T@Hc8xpH&TZ0}mm+ElB516{uuc7rd%G;qr*%qi=<DeIUJKa*e2H
zwm)`YH7iB*r+H;viBP;S{6<g;5a%FSdUVh@q06cDZ8hui)%ow)uCd@ygzn{xUV4oo
zxL?zMc>FZ`UHd(R&r=o}-m^TEwQ`t>ofY~Cxt_7_hwYv|=jPq4!Pn7Yh}D{UCJ#AL
zrNIX|lKaG!S*~3RIEcNE>v?phk(gJ)?0iGn<Z@$B%9Bi*iUrH2@RQQ68zs<H0*uRZ
zA25@U{Re$E>+BY<`7Tuh=hkyP%u$0=2eV_TqSxVmhvY(Nb0kw(FRLdx|B9aN()x1Z
z`xDs2<=O)DrnfO0FY9-qCqGr@dhkK!RDjJNsk|Xk>}kIhqTgAeN=fV67&r=^+u2MS
zZ`%D_#tmKHv%z8Ort>+=26BdG9LUfdfiY5-xrqIO@9Z@-k5N}4LV8&OJ~iXbYcpO>
zS+vYn%3kE~LjK+J?Z@x5;HtMve0Rr3XPkEE3!XBds!g)9NE3BN1|>0}w+BBs?u1Qn
zH?59SW(T;O+>B9FIA4a5&$JmiT>?xb*~Dx5VLYn&VAbC8W+lT?#oP-M*(LBlGB|b7
zg$Xz=^2`SvH;#~C4FxX_WD1*X?d-2*3FExFRfl#`vXVScdt?i?SEab&TB_$Z$OxrR
z?%WAwZRT%$(`aNc6xR6#iW<sWG~&3T&V7M2<B*^6=X_T1f+p=3#48zfs|CU{{K9M#
zTO<D5urioL>y!KGp7x_^CQ5cnjyh3x{5}kT;Q}el1<*Pm^W+*!`QOwNCF4j+s7ob-
z{}alY*~S^zJIJZ8$0c9%VgbGA_`p5)B}ciMv6@Vl%aWzPS_u`wzGytYqfB(bdasfm
zbsIF#u6GO5L{>b`*KUkZ5ceM!v;V#NYRvlfnp9j$hs0NqIpxU8%`Yy)Dau=3AMIed
zpISp*A)U8SW(x3aQP$>I5w>xESg>~ErgA~`xCDmm(-LpUvh9u>smRT3xd<vX6LU>-
zuyvyywa<fiB<Pm}U_VVJi*6E(fs@i^mFENB%2f}zWvkZSmb_Hdyle&j);NRAjyT0i
z6t<q%ER^ATB9v;PcA&qXqehZbC&qom(fed~f^4sydFPL&J&>vI8|+9UrYxt9;>#Xx
zztvF4YVbdAzNI`Ah<VJx+>mE1KDSvk``kyx|D??6pl&}`(=l(?7}2wJ$i&RN?B1gT
zWBRX22!ww~xRK=kZyWy%nC>QKPH^!Hm%+QhC4AGwVq8t<?<*C_BTEV`4K|WGJK0+m
z^j0=l!(PtnQCp0++J`QWCfwWgHpudP>poL?D-`BEU9mj6TpP(dLV>Z`z#S&;a<b1>
ztKVil|LevlpHT{WN_5TDVv&i}%B#12<Ecoks-p&nlC~U=!|m)<GgZkF78JifXX=fM
zO`8nQ)pGPuoyyYma`>_wUAF?ct6X^**TMdigI!pho%<H~D&J@yymLfPAFKgq|Dqc@
ziX6VH2BbdHUwe5XJWR~6s9jyy<s8l$lDd)VGZhwQsCDZeQ&~-`pE^XxrvNuFd`24!
zEDTWc<{ziqUJn?aXWbE;M$29ft(`2RDty6HWW}=Tp}ryULhu`x*~F{cPbD_RBg-q)
z?RE%LhR@%xn%*J_1^WA={F|@F`g7_1%km%@L*-uG%c9cYXZWD^PXP-;z_}acHs^0<
znw&tSe+an+cGlCsL}COV51xi>N+{uh`~b8{khDd#Sf~BKg|oCa2;2_63kq((1|s}F
zhkJiyn|0hd$3B#C^WFu?0Ehz6A5;N(CI-9oMHXUs18<?_Cg`PEqaVoj=K*(X!+P=x
za%_l3D)Pb7jSq{!wGY>Th|xL8b0Np6MmPDr9Z4oDE329s5Bz6V9*oXq;<j})P<{V^
z7Nx^RK~BXZOgWKsk9+(3#8e>g?eYcC6<r*$;bZJcFfQ)0_4zuz-7HBlQiSsa7rP*n
z+%xyNY?Jf9p*o2*(PVWAACJ3x3ws%Wup<Cs20c}CoYobA9yiZym-B`a(u?F|zw(yA
zLXN6UwC{Q(A26qIr4<96FulYBEuxxz9tf9DyD#S7e+{pS1M35Rwq~hrjjyV+1fazS
zr2L>S+@z#B^Zi$?M!Mr0TFmSpwe%A$_Gi!2j!m2QMiKGyOg06ncAGTW9OX@G7-Zpz
zs;Xw?oT+&;CFmD%Vc*>#k>@22<K@o2o?CC&B7%s?Muk+Zx(QUpTr6F6GMBarJOp(;
zw!bOH6RFzy&TondT1aVCfn;c|qrkr&mL$@S7M=XsvmkBXonDcOOI+r)Z?QNxKL4Cq
zi@RcVdmjU27{;TTP{!|Eu6P>&jfTD$@WC~w2s@iKm2+t7|0+jYA2eJwCF&|#ZS)py
z3%IFfT9|yAU9)Z~gD)ol0bjpsr=8(sE$n?qqbdM-VZ<FQ&AYw<w+$xAZEd#U1~%P7
z!0B>osTm@-L0@hH3e%Sd)i$Vf2}tm(TZ*dX4M!(NUtKP$mQ94mq%VDHvYYx?;~xVd
zt7``n=({tpj15!z{gL!$cRgwZj6{o}?e-HknLH8@=Z2Q|m6ybiwF+sHW@ctr5_-ep
zM}P;vNB{F+Cw$C;h`NGAU!L%ocQ$wQ=Wrb0vENLwkaDpczO{TGz&-q1FF-LbF7!z4
zubY>si|g4F(9?0=>$$6MfgUF&>%8TPXx1WD4_K|XtBkdlhSkt{t+kTvvSU?uxE{DJ
zN?n{j5Djba!2r*BY5-mpiaJQ&_?17D^|hgH+QymIuy$Dw?aB@so*^X~2F&lZ_lac5
zbLYj*Y;|Zbof>t#-;_%Un}REOL*BW(sK4tYfDQ`*o9<~BW=?CkB&Q`<t>VIH(*&jF
z?DY8!H$2sW!)wowwMbnp_Xg;fKo>Ckk?id3_7hynFQqlF#E!q_14I(g)a*1SWH7Ro
zu1F_dT((mDQ?ZCHYkTMCI`e;@1USI2dNjImG~vl@BgL6CPxo-Yl0Us0@$mq8^F~!f
zUT^Xopf)53<Uiv#aY;Pm5rID!^C0;Gv95>R39SCj5K1ewNP?{Zfp`FE0(zPzaXg=V
zb$J-^!J)x)fqVZF&Cb=j8bgkqasZqTHYR>!Nsi(O`X&#Ip{}kmPzkR=)l+wsU0wQO
zpL+M&X%RrT`5(jk2I#3bKq^1*R&mXznZ(kZQ+i^6Sqmr+MwF5H@D6#pv$JX(k>wKL
ze9)~uq3;)4Ub|fRT(;}KzQ;n>d|sNq)9ip2MYUe6l9J=D_9F%}B~L=Bac40HD6y5X
zI_U&XK(#SgQEr;ppVu|<?mT+j9phGs2g>0D7AWWvKf+V;s=qI;`|M~3yLwLFcC`~3
za(;3N{HYZeuO_jRLO0uZ+NgDuc4Feaxh2?Sm#8#I<u!iD9)r|c_~v0k(Cn4#!0N%@
zpjSmpwIZS-xx2r&M5F}*y#@{~0#(hUkJ8T$w*xMC<$L#cnN?5!ETN>a7wP=!SR;r&
z7O-an=1rUreJY2ItT1=zy^vqaYqDF<2iBysTt~x<v?;D<-f`hOu65ZhKlK+6P6u9C
z>oCo`(%c7NgTw&F4aBQ$v)k-XvRatVUER<y!xk=a_K|Ni@iCcIj@^Tz2V??nMWY&e
zGh#|W?GH|{nGWq|LIQiX1I7{+YK3v_s-NY62L-Ix1*+pl*L2&{PyweN0J0vmEu3Sr
zyJtb%wh$d?X`Qd9tvkziiLYoYJnLhUIp({VpLaR4x5nb+y*%;js#_h`P1&NIe@kST
zgM?GJKLC8VHG05x0>%R7qL13$=NmgP^6d4m^c7hdpdgBCKoQNKX8xjRI>F}VT=PFc
z0bybHfxIj#!HciU`T4Ca(9?#AZ{)L{6P5EV2jh7YJI#OR^`aECVsi%4cN>@|U!@vE
zkXCoRp@9eV8ag(VmY(fzIi=%9%sW*gK|v(f6GH?f!!({qr7=C&5^@mpM_TH?tFg}X
z1BmDmKmJ*a_)>0eqVOQN{#6u3LA#pf)Gl}WPQ&Wo*w9+Bl-pKUC}qY(Bkw_oTPto4
zFj^`3?cRaGr2tll@E^+A@mY6qG&9AuA_ZqJOq}Y$WOL{1)rt1wvkPFS-0kGLw#m5y
z`=;Tj?Ea}d*E_X(3yY!+xg1T(@17m@_c<peCbsRbo@>f(z58RK=ZTqf+m(%p5p_6?
z(lZJ8wXTt@-lpS9CC3kvp}s~75zeJ=a3uH?R)*X?jNeQxj~!066q=GL`$k)AJFrME
zeKE|Y97cQBIADrWQinoOUj^T)Qu5sPZTxCoeH1h@m9e7#%Aap|<UxdI@5wNHpC$V|
zyBx^iYO-slswwxo_}P@N#O$+;h*$sW@Fw)le|yd6@I32f@vfj0$=P)-JFhToQ6p26
z_JM1M``xY%u$jdT>9f76z%I$flq55zLssC09sM&1QR>Q;MROeSI~|?N#jRZhI2E65
z(8r1hl(?4e-04JMGvG3lYdW^Hu|l^03AtO`6`|A@42^O%@&LCg3pHT@cG9+PcpD^B
z2FPg;;gxI0*rOlKx{dKEGf&#}NeonxCNY;MOe;tu_|S|ymP*lzGg>UZeWDEK|GJ^n
zZ2xj%h26yeyd&@mBNS#V*A(#HSqQpA9M_ufe%#N1`%9(4JhlBXY-wd&crLxS9H1BA
z#1K3Xm4K?%o5F#MhYE-IUvHH<OZm!@UHPpPpwq&Zy1BB>zeA@`UxjdWH$X$r0X8T@
zf6XcFZaNZm{g6+?1DRR^j7%oM=W;3#SO5M#a6$)(a{sj?h>MRewYSrD2rJY6pG>*D
zyxjjB`6M^#f5;2~xriSTPWpfQRm{_=&1}T_Q!&&3;OkklO)&jBjc0cMo1X(Rk(W!j
z(#Tr33pr*_n)@|F<o_ydjtQywOs~`<{&N8s-`2IHI=@3qRaJ+G%+()_)naB*Q_BW~
zj@Y&6_!RcId*IA9`jz%S7XW1l1TeP6R}&SPz9$&$T)#fP#w)d?3_ej8ps~Bxjd6EH
zQ8!eUI~>o@KOs<8i_hQ?wF0hPE5;=9(OKTVN{@he{~Z<<h3jj8wm|)_g+(IF##Y*z
zdg<R(UOrN!qRW$YVm%lK2I>VwMhaZtcCA#%AFOiDR5^_-D?YwMv|eON0HAO)k5)3~
z{Gr1k4?&A0*P|P)b^HV<AAJLZRBn^+7gJjq;|6e$y}4mH@HV{DcR{~cuHUU@g<ZGu
zU2P+f2^BbR3@8HY+C!~CX;VN{etKV8Q8HCmSzcA_-BCDTKknEMz&8afK@;pZgS@Z#
zS21wEBO30p7QHwNRYD>G<oec=c2-eQRzOTka~D~x9ZNQO^$pkqs>)szuq?nw%mUDb
zfzSVskd^<3Xv+T=$f$mBIGvT%%5*I$87XG2smam=;$x+gIA#aHl>se8+uYpT7YuIN
z?w`5H2oAoeFcJssfzlUd*RaP(SYxC03bMvtuacXUb8DnpKBgj5oD6{)fF#GpW@RMg
zU$-Gsf^KXK4@Uyx(36bRd9K#tvT#6jO8@fCA*D!_iJe_IpOEZbe%4q{Fv4MP(TahH
zlFwoNM}WUC>-FRJ`q4+!$s9%v>l0QTp~RHD=3inT*me<GOAnd|?1p}N+!ZC|+W&$z
z`ro^=5`MR);|?->q@$_DT@O<pBELpb^oNIsw`ECkbF-{@#WOFjA^>#&SaTt$^0EKf
zN`@p8Q@09@-rFH#%E*P_DP*F(^}yLGz<NdeetpBgzV(&O&s>u^+<J9yd<>mPRU6+U
zi`&(55lNi-@QVxnLeJfCxqooF#emgxIp$?UKrQ6`>&r7F55bdu#zfe=)-&QZ>3E>{
zEbwW!aqev;H-_2_{lV+%wSLp^;}GaEU-u2$HKv!u>5&+tuL3BRA~*6U$<OlQVsF3*
z8I-nQ1AwZ)WZqIZ{0e%``?~!LA4v9Ab)^kT9JBnGLhqWIpPDlUDG<c+<Pyl>Opli?
z<a|U$`+wfMzS7S4S%D%}A@{J*jR)8b*(V+C^Qvh%z$MVrMaD=4##qx__X0N_1BC6=
zN0&TG@O67K<d5Dk#wqY<G!FBp=;%#w7&mYC@aA1(ph4@epNHLg9LAy~?R%#>k$oas
z#8TnSn??YF3&4`En|r?ZdV}TVh7D%(2+(|T%=^xw45V;p)AWJH&AzjrfgSoJ*D%0%
zFsQXfK8EUAA3NF@GXiGuDH$QP*!yukH}~c_gws!eCpYIK%1yG3*>oKy5i5H(##y3U
z?4Kx}Z}^^M$sLe!_@0K@6sbrZZ}t@(?I=nBv-m~uk&1DkbK%E?@^Y1eyR(gaPSd)R
zMK;8w>~ns&JjEho8MX*V*MJp{z6M=jz+XfksWaxk$XwUuWoJXr=GohjKF;#J(qS#C
z4@6Ac(;Txkm1;%%ezLVu;wfW{7aed=`>i_@fRcqOE8*OGu>dc<^xWnEcu#k2duEf@
z?yR1!u7<u<4Ol0ik(t>#zo@1UiA13==n{()r%Z7#j<;PoyRp2?gL=2tp<kJ@wqLMa
zlhtrYNwGuaa0hhP&vpCMg?A`XW0PfAb0Ud0S}eU~)T~nHizu@jyfed*j|n1ubs0@P
zD2lNJ7_nM<ofFOj>kP17Kw&S9WGpf|{(*N%MCtcF#>pswjsR*I8FoO57c0>NWL96;
z?KF>|Bs4Z&)|nn(xH%gGuJPs>8qxtF2Q=Tt=mUfmYr>R66RCMxXWTAVra$&4j>7p4
zNW*3$Tt}MY9m1tg7t@`wy=^Snc<m6*kqvNa^4!<(*VN1nPiPb?(-u13nbt$tpVVSL
zQ42eBvO3xtpKQ)KZUYIjL}ChZ;oqVod0kqc%gl!~1Dk=LyUnM!VC{wE`gr1Zcq!W*
zW@O++YI4nO8(5?^+1+K1bQM}eV`|2w{FO`S4bbZ_4{9NQL7S}cud2$bv@Yu;kOhwk
z57SQqnQrlLH#hkCu^okXo7FTC<URM9RjPzK_RQ>Modrwe)^t-5KFduyN{dB5xuDj&
z`io&7pA<ZvWwR!hzL>we(+Jf6Jfg0n@dC>>l+Wp^5O;}~@v*SHL)-V6G~=XKhwcUy
z^SF)c0W_yw(cT_wK}_v+de6!M`2TDtG#df_S>GYAmg-lIA5$#O*Yyh<9@Im#oW9$L
zJKMq)ADTAoji)Elt)ff>Angy?(pmsj{2&lqZkS1dId=UdvQVYi*>CBpn=Xz((F^(&
z1Nj*576y&DTaE|Ab?hyD7EfIOGfa}r?!i7|3<W=O;l0C5v&YskZJBOmykP1xjN_96
z`K}ZZlZPZ9LO5E}4lXCZGbGX-Hve!(obRo5qJujs3_2e-zRz-*P~i6=<dI|mS)BRw
z4rh~H!QEFjfwb!FnHmGYM3E{eD)89;I$vgU^6lnb8ln9mjgI!CXA{o$<G^4D%Er(I
zTHRV|5?q^9@NQcF<(HRdey6?U)A(Le*b7`h;OZz~vgv#y!Te`9ts&*&jeNCp3*A|8
zsCpR3yDcw1{s2Gl=7rmTeF3~ojLhx{xYe~4j?+!q+n~?iA$_%VQm5WsMJ8mJ@WNQs
zZQA{!E2rV9qO8$ss2-`9vR=6_hIY+lV?p+Awm(`Cn9!rE?ucZr<WKY2K1$Op(q9S~
zEL1Wo@7=?^^c?xl&Oll{KBAfWxP)U)AZzauusMee6d@Z7>Qda<CHB(Cm@$i)_1F$#
z%F#-%N+8C;M<}$Q>m#=k-JV-REyQ)@(b-H-UNK#dO--Kr%8mVd-pJ0~+dHW1xLV31
zG7XoH7TwNYiqX(eOIzC5fXolz6g}B^_abW(?wN1*P&{5^zwyfZE8#UlT4wZoIl|eg
z<@_bAZ4q!zW&3Z2F%Z$_5~u_(1_iXNY~?SpAY&o|^pD5yW;YAFCEe;Hmd5V4iaU$#
z)#vF@KiQcnuo``5*JmfbX!m)ren0Mkn8$WbFnRocCOj_0fyVka2$VZ@6BlrnmcARO
z?RoJl&${JcIK*q-{IB+Sf`pk5dVkr9+*01s%d$wDx><Zlt87fnZ~YGd8AI;$sP$I#
z5|!$Pjr}`^w&yQ}hyWE0q_K^v!(Coa!KXId%I6}w#v(vfW3%gxPd55W8*4SiIwd&9
z#&6?a1AA|itVV0$DiFP$u${J@vt5X<=|KO_=94iXf`7ZVCBEoBGP3qNlY1F@QD@?}
zm@%TR%lp#vwWqwNk|&IG%3=1iDq1H?O>|F$G!J1EKbw$AcwxNv{$Fke6YqHg<S7Cf
zfs%iBi)yrwhvSLmjOOKV*KdSyAals>s$A{Yswk7_{Oh*}w}*$6y4c)&Lj3O}4K;>1
z04GxclZ0Y1@yk0h^}G1cl-qc2?q*qJIgwDNp117~bOLTPAM4^YaD!LJh@UBtj#%Ec
z61K9jO1?QI74R<?dpa57AoEW<DgZUXyrhc_myqV=x~qzws?^TR;_OW{Jw^fVsuWu3
zMUQz%?;>VLJsad)JpO%$m$a5Q0f-8S#EQ;m-v=;VQYiJtX{KH}X1$qOArqc!_Gt2Z
zmj$FF?fiYnM%3ek97J;UMW4^}&HbnMzab7PhTST{Mt6@Xp<Ve|9d`;X^V0^bn`VuT
zz~6V)NUO60D;>N@k~!%_0!Di$GPBcC7Y@dwA_Ae<u2AhCpVg?KrzPEp-8oTSrd~@v
zp!lAW=l0dg!ET`U`N0o*OSH7}y5NN=Zd!YXJ$r9R*?tw53j+O|L|CPJ8s%;1UA*kX
zn;Jmb1hO|>gdU(ar&`LgIRlNZ(p|@<v}e9%UOHW=!<PV2u~)561MuGPNh}*DyBACR
zoMe+#KK0hwz8UGCmqN^J)@SQplVAC9`|`co5dDofq-B(!I;vM}xt@1~u2sW{@Z#H}
zxJLs?B)7JYCB=+R{~Q&~xVt3dwZv)0GbQ#Sf92;BNs7}$Hz<o{{KD`{TBf}^9oeAg
zOX`F5i%Qsv%X;$xFjk|L9dz%90li<jp<Zls?>8&eUSLvzg5xI^D|T!2!{0)PG`}6}
z7MX1GJ2d<C2J_K5+SJgVFwn@~fsv#h2s;04UszHXJGzjzGYO^H6L<9N7J2yZ_{Dm*
zbb0oMN2(v}`^}?k{uIw=BdoA!bSV`nL1>2=4CXdTo5c>RsrfJ?EXrxMpSY%&s@!K`
z+)s88^gWay)%z4a^+21)Vf@V3zNLF9<xyP5Cy~%u<9erR{Ftmzf)pM{yOE>x03*S*
zl~g2XP;BFMn3;3n%zMh$`V^yW**AiI^q(FoV*`#$SW4@kiJt?uAbd&K1S;n?y*;U~
z4X+en5f}fcHJRx(Rr7%C$`y#!5!1V@Tj2a5fPQNncs!3(0Gt5HR^3)7fRggJK~*GL
zg{E<@@`Te6e)x~SXxE_)gKk;dj;N#(by%0idD{OWew2D}^xMW{Z57dE<=c_I0(h8`
z1eb{DOBQ9H-kqw-6;Bx(AD6sbv^S{Rtq0ta9=qs*4ORI2-##|Yhi6S?6OMnIk8oU4
zfjv2ReY)jWsEEolKTF4(q;&po2nI33FAca@Ij$BksK6|2)UT{P@{EjmSbX{RP+8wk
z`RLP?gFl7m<z*F@%ikxG0<a<YSs#DwOBOuBFbXDOxb%;Yf^YBoCuU^rH`xy+XE3m9
z4Qn<LZc;n&Ov4>uHuA_4VPn7by}?u!d$uy6%f>gKy5(?<kdex=#GihLW7~StDQ4AE
z5_*l*smlm)+);6@!}oWC(jJ?=-D(7XGy<EQCI|S{{Y)=g@>W7c11ST0&!h)@mbRS?
z=EZ!FT6SmY^r~BkK!XWnV(C1LKf4K$J};jMRnOiqAv|nsa{h$Mgbw=qQ)LD18tBoU
zU&M(s3p79m4F%2oB4UVtOrw;O$S~;HI=z_p?#gaglp0d=ztPiEHQryhcKh+_8n4J$
z=beu)y$%P~TAF(S_E0%pukRT+TJ=q;ZVK)Z>bE<VmyZ9CGg0y865z;5q6hX$%!e5b
zdw4eVECE1sO<Y<e57K7)EYm|EC1@cXoiQK^Y)}+TG+aI*GzoVMT?@(Z+`o@kduo-e
zoRoyz5uUh1h>eBR*ckhEpgM^eJ^CIV_z2A855VLY!W1ukPe!AwTnh>Tyg&=!SPCJY
zoA(|ef*+g+(P5|D0_*+GU|HSc2d`~Wf1^&U?b==mweD5o{`#sw#E{5gxGP59CksFe
zq^>>I;tczNg->Tj5yA$`4S%W_JT8ArYk8t1+F6w0o`E_L2k>S4_o#)O8~%oGu|(6a
zNzv{H`>g&x2arEy!M_(@3Y8ZVSaY}SWnK6m8ZuOhIz9sm9zB5c_9_C|mgj%sQ7h%P
zftrG<9VvQu4&ujO73Anm{90yQVYA^pHLV3sh}g|+c`C@iG}))7uB51@q`D)KV*@y7
zqon*V#v*4pdQIu2PG5CAt(&#GYBKR$pJHk;D(rO_bjk)$gW;}5M4K?3WhJj2BisQW
z>77RmE9c6A0dFZ47b=Xn+s>~vLg~l9`$JJjO~>1@yR`d6r{b;E_3wn}MBNpNh-hzI
z-mZAD0`|3QuPUO_mGV`~mLE%yUz6f97EM<j)Mg%^6SlhWCp5S<O1FOw&33D;)1CF3
zWyI9c*lyMFFOP?ul_hgy4s7G;Zr{CxT%J~w20gu8M&4O^6S~r|D;0kw@cwMTpD|ta
z48B*X#L#P@Jm}=8_1z;C1A_NG>bE>ee_##hbjXtmqgMxEF?wu|H3c5<r1+oikq^J$
zeK+*?t~3Lus^%0@$G+hAhSP6dZ5_w??+3-a=W8<~=3)D`8+Q~uefEY|&^zZ(;usjt
zua?@G(EEUnl^<RVW&*t8WmeotxLR=95*luq4*2&va3MX%aU_fn0b5WuZ98ryKZz-3
z=9_;j3bSI{_bd}|Cu8Ir@{$S}2~^q^%|!)WNA5rF?vw4+k9Rvkb!Ro~rS)A$BAkrG
z$T4XCNsG~D1O++D!?VQEs8dC5)33(p9x<Ge>%<z39W!3uC%eZpaHp&@#Npj<FmE4f
zpy8^tZ~17UVZYD06?d`KP|9oA3srGN4;pnYl=;_0_nHsyhs~}Qvz566Zg3A9BdeNQ
z{E9E{D~7QtjBloew-gxNIYe&Fl{A){V}c7_&KiYV<C?H0b20i_7G=(-2?eC;y;|8C
zvU~^dgt9)Xg)`2do}-a=&=XAj?&Iz#%F(vK2<pmr)vMFDrF)Hn?^!SHzH3{Kwr00h
zwX-rXX>|`~EO^YK`q!IaZB}{;x1^+3VgF|j&!@wmSitSf+lxiRtHg0IFjM3GpZoHv
zDW1n?5Tr96p-fIvh5PY6ih!P+AG`Z=l_r7k{ZL7r0w2f}3lR<U>{+)!omJhQP2k~r
zn$(DMs~T;Y#M~g~WTTJK0|P&g-l|IN=^n1WZaA=#+J@T~#br6Nt#;LgCEEb#^>i}O
zBu<cXP7htF>55&OcZ#p={>_rTrB9jSJGX*NRH<m(Zf}#m$agh*ZrI8tu_kZ=hgz_T
z6#uYoD#x^{J4*1mzPP%aCzq5hp~1)Q`1svm`7SR`<oK*%r~1VB3c!I~H7*K=sqchH
z0AS1=N2j)hQkE<qeRjv*q?4KBHEBbScn;-9UyI8Nf&(uvx#RGcEfpU+0A9kKP}flW
zXC7JX+%13eP_4sGjoVZ<1o1<;vzrwuw~ZGFPOy&@6$jOE0QiW|#}^!^;Hdf*(9&l=
znG0jTzS^(S?wTo4d9a3-g>;+XTcK6kxJ<A+{p$3sYsZB#BN=4Ga5Fi3p6Qml<?%Lb
zak#=GH|}do7rAU<;LAw5bM{V)C|!0-z*e!!vIgZ+narlIWW7~1pg4dOIhiYaL_H53
zBTZCpyV%<zpL15er8Iz4QSoe5SiZkIO}V~h!1e*neMGY`e(?2*bprx_tEW@#1F1jb
z^|ce5bQq}|L|GH^4VS~H7Lzoyd%C9s8$B+yDu}a)%Tr+frkC`>+1q)#tIxeIECbim
z-tW#Foix%-lC~Ttqd(6|RHLrwNM{Qr*Oc_Bq%V^LG8Q6zx{ak(*H9Nh6xA*xWZ1b%
zubh#9i_1RpKr~#_Aj#nv*{)ya>DcNYw|ji((a}{VzlOXksTrD$4O`<xr_U-5qqR1p
z3+aahR81-ji#R{$m=|K;wdYb0a<M+g3AGwkpbC-Q>krE$tjUUxb-@Sdm>sc{H(Rt`
zlV4=>X-(cC`ex6!2Gc8bU<DX>_EvMvN{{V1*8}t)G1%Ke*y#A(^Z{^r%54Rz!^*3Z
zhx#J8a;>!ECu13In~GU2+xd-51OB2fHE+bVM`zsNBvlYqU=KDD8t}@N6t&k35G@YO
z*0CR#KA-e=q_ik(_iGg>%JysT*EeZ^#upS7WzxMLJb6+Y!qKf2QMv!S15KE|{H5ih
z>wJF+;dWvpAv)?xhR_QJGI7qL2C?_D{B{EOF9#3hZ%U7H(ph$dpM_5)IZm&rhm59G
z)}NmA_7bLA>O(qMD2+4euGK8yEQVQWWRbqQq<c(weH^Xak!~5|i;|a7l1uf6<&o`2
z2I5B>o;@xW1{#S-OhWS4b%~gyU$-K<&qgB;HMC-qI1Yc_M3szh^5&bkrtz!l+i!&n
zIX(Dm43sY0D`Xcx!kD=ZNb9%Oxo;tpq>LP^?~fF!)W0vCFs;rCrD23Pj&PR|irnM0
zogKWgRgCH4wU*2hKPkC+H=rIYL6}avqER|LZf_vulm{uVmK;0uf(7m@o0%BXs}$I8
z^`SanU)(0JS*w`cZ*eOMx}(;7zBRF<y~=E#|9Q3ANyx*uO}S9KdWwONT?lH;f;mWo
z89Zq6IJgMvnoUQqk&M5ZI3dyQM;MKJ&KDs|?XX!3XSb@xF7n}^qRX%KoBR)U{_6|y
zSScV^(9+yA1tNXF%ZLgMd-Dqm-v~|DTC4%sw1n{p0iD?+N_9LU*l$n$Y5#1nzvYa_
ztIET~#8h72Q6B6sT_?g?gFIY#Dh|(@N;C*CtuK!14idLW6sL`9aeah(_8sxd-oDIc
z1A1<2MqUQ8P?WzI0v<_LcM(GpU;Wf1j>{4&jcPjsfTc~&u6q3mc!SB)Ro_CA0;IQ=
zP;ITpNliF^TqX-`pb9(PugpSpz}J<BYAGVd)E3NMqhgA_Esri}{#SeF71m_a?R_5`
zJ|gnG7K&60ARr(hASEDnx^xL7D7^)g5(r&TP<ro0rAbFZuOiZW3nUOwIwS!hKnQhD
z)bG9Cv+rbI`($rU!!>iy+;h*YS?l*-3sSv=#yZWtl%uPoj?!!qmfVCwc;%0paW*)^
zv7Ie>la1>Xwe^fTUo*vI`unEk(7C?Q(GYHUnQTon{1gIOft;NjL~^9o_YIYbx2B*{
zD!iw9O#&S=EiF%OTJe$(Zd+7hc@%kg`4WW~w0}~#WXmq1`E78N#bMXsXQU6EK`Iy#
zXc07j>iIoKS*eYRscLURTHynMy=z_)9CpZoM*AqSq=Azk-n0sYJ0@m_pZ*#kG3c2*
zh#uMzne+eY?eFd(zmAKwAvJ3$(U<I%Zx$**I*EsOp6cl7c2K%Qd~5VQYX&LKPtpta
znk;W7-y~HpjD|Iu?Lf4-HjTW9Wbs`Exw%}I<kKVD>i8PeAx8o^i>U_FyIu2BYqjxQ
zYM8=@DX)Bt03zv1;qa>IPDGsbuOne|vscMC8rM%~Amyq~xNXj9-C+T7BcTM8ZuhOh
zo3Lt|LY>Prx}LhWVwkO>t{o~tS7^m86mf)4uK)k72~W&7`2)MHdPc})5|NK<Cz&j8
z^w4W<Gx8NDyYvMi$%6Wm3DlGqcO}$$FBb<oEF5MUahxsRgr37JJJx$RkLq#CdQa@|
zIMwrlV#;)~xx7x%Rkgq^ymeSRyH^n-rF*+Cp1E*hSiU&+{PD*qWfg6NLVKr6!|ZOG
zv1h#*HfTLaS;>5*HyxL|F)@}em{A3+6J}up0U;{TOHkZ-wufn}!ivEHY6C^v&-lPS
z%a_gsb?Fg{1Klhna}%uT-@SXc9{3Q>#Hg@VaKSJq)uSfpJwk9)WM{VaYVSVG5qA(4
z4-(mjHWqN+nq=iiV0HlEbkwu#Yk6{9@4<kX7{a*x<&r+xHs7Xn-6?z0?d9qZI+Zud
z0v3=!&f%bE*=p~LdpP;~5Y$nHavn7ojxj!-=8^Ev*~qTa$G5Oqx3i~TV`4S=r!J!R
z<rF?|y?qhd)-h5hgIwPJ>eA~I>%OsRcPn*qS%A9e<diLenb4D<w5!S7sIE1V#6CUn
z6Fl;xEGO^Qr_D}$K5FF^Ua4ktF@Lx_;6o1F!AZYy&Oa>mV?z=ZTWOes(iqzoA(>t(
zTrHdbq7iwNql3u;WZ5zSVgE8Jqj1A=c4_H)_C@iRU~^EWzfXA2Q>mvT^C-EiJ|M(a
z%?EvR;AAX{A%FMf50TNy9Vz~J{4TR)-#uxu6~WWT*At>jGYb_ghHnbdL)O0I_3_R*
z7)AB4WSs|PaWzbF!t$%CeO3ZJ6lP<ewtPXDJ2VM1sxGk=xN&1%r}{Ln<FmPe*|6Fm
z*RJRBA(tb^7OZ$&?d^ma1V&4E(j_42e;Ykok^kiA2bH?iUr3@esEBmRF)DP;b*H8z
zI*}_#&28zKp`uQfl0t?8`Z>zEqxG`nq4{jicdP@<-5^Z46&qLH1tP1M>8##MVGG=%
z@8EF$F3T2GZK$4}E{v3N#5Iy4r}8{i*w~Y@!}rEkifeN>8b?{SlT1`WUO2opL+Cx`
z&dV!%)f=X!Hqc7?OMW;H)z}`tkW`B2Ax|FEz1NQqsY9L{o5;%hq9h=@hNE{sE8C9h
z5e>Zead^*FK_Agy?ZX(H-)KJ4uuf`3Jh75>{r=L`-0p+Pe4}7SzV%$nSu?a`tVuJB
zt#yM^wGm{xntU)4QthhBGPN`)H4n$RiA<Sx*KkO<xQ7!)Cy6O)->~so$zG8i3cmkD
zJdE=672=Yn)4J8A(zTV?WacGKdC`!Ihq3N%5eKTgH-^v0+72hyy%8aybtiEQQdawM
zbZIY^u0lq-mo)ZmSFoH;Wu3L~gZpmIFYWHNs3Hxjk&V?1pghy;vGp1mTR~-p56b49
zBQe9-AM!ut)ew^m(WRYzvR<9w91mj`UnT(;Dn9dX8kuz2pD|7&djer({nh4yWM7cM
z_eRY>?Ll45%A{E!Y#ZmYvZvf#)oY2e4mElW`P|k+I~}9+8g8yoet}6Zz=o(~7;V8y
zBQBgPe<AoU_3`(mgV@seSVwJNY8xc+HTxJ^U3!4S9dfK>*fR~a!6o39rtM`V@$t(l
zTQ+%aKCPfdT3|h#xeH~7xB7DDxLZUx3&e4|U$Io|Due{?#hk9)k!pOmNdx7<02k?-
z%5u4``^tKan@w*6GLwYEK|EAIxV_SRe9K%=zgm{vX0AAUe77LMy2h2X-Van*2(DL4
z>k<TSxUlgG*Di;o*_VWS<(f}l_3`@jSKXrv;js9efRNl>=8CI24_zw4yGXd?>4LMv
zd3uB1{mjy;x;Z+{vtCI2tut$XzE^la@HHmHScTW-!;6ygwIZ#&6c+IX#+8y;JDoz?
zmbN~_)GRcA^g{<Ps+K+*;rgm%wC!}8FIUk}){smOHTdX1jvTVHAbYX-qvr#_$89*V
z{q2>hvBB-G1@|e}gxxH%MrXW&y6)t?ue_=<dLSuN%p(|ALDk_Mun-t`hO~PdrQ;{v
z`}HYmjh1=4&GCiFyYRIyWE*lbT%3{PC%@JaW_{;Km|hXy!QOv(IA(nv#GLacGQW%6
zJEfht{;9@ptS+l;g1XkI$JHM|sNy^CkT(K!6XtWc{dq|%d?YKxF=4a~Q%i}<%*w)h
z?56Kh5D6Zws3lTlpz@GHL{Q=d2&d0aVQZuUxbf86M@eY;y8~atwOFMgBYCCO$#V39
zo%hmGZWNTKp|fe&!eJD1SmT+spxYADHX9d}+K|2(CMnYLd8Vz$ZJ(7oa=15+a5U~?
z<;}Ykco_wIuPT8w*HPp31VvQFSqg5Z7N<UF*_0d)E(TtE!m2>Hw0OC8h8o5ZxXq0A
zcE!)%V4{?>A0628FSt}Ih7?%*+4IPuUF|P8>f;Dhu07zQSCd^AhC^#!SzReg|EaD^
zkLaVYk$_j$V4*NakuM3%W4i`&Qfq^Tw6sgn;yT9}(miKi2WMN%%PvHGHX!I9Zrl1Q
zelktBzsDCAXA*<AC>G9lrbGAcdt_Tkc_u&&^gbNThC~;5E*M2db%Fp1;?TSY3Vd?)
zLpW)=-jPv*%78{ACi?Rp$2)AZJ?2D*yk=&D^4=7M;2$ciw;EX%C9l|<lB7zE8Bcs+
zao;2gH`$Q_LSG$64>3wxj1=|2$v*5DuV+r;^R^i+*{WLN*@F607IVwv#2v!R>GY&o
z;X->KBAH=Mg!+2%)x~D}2D1d4>mjaekS0{~;@>KlM4)2<L5W0g1L;9TB*qE%VC#3c
z<^XA)5_^W}t4{XXjjNBJqpe$rqjQa@v!e#3c5iI#_A5V{WWypK&~_KF8>Bq?{-w!O
zYjM{-z;z+xeOT12uyrnFb%+e?z?a20M2guJwn{=aoJl4IK-CyeRyOge?XeX&D=kJ-
zABBPHVG~|SXIbTb_UTJ*{IDvDPo1BWnv4&0;X?AyxT*jBNiB0}C2TQAFe6*&BKk#2
zvBv?mDz5Douq{I@y;S3*9PsipLn7vE2yrDV*9kWlUq;S6e|Du`SB{2f6>dxGz}rC~
zVt7QPTyZbk+LMQ1Go5`s(sti2r?J)6N?<UU4!WB-JFash6I@$XVEfx;l*dl#YMi#!
zQq_JQml8K<`R#pL^I4F4L=lCTNrIJ&b=*ykFQWb+-BAd@mZL1enPOuSfHmQC?Eb;?
zrbVG|Z~pt$fbhoevpV`B%pG@SM;#buKh&HhI(0wD*^t}dMpQ6%1gcmbZeybz%J%(C
z@qrsE%1Uu>@=7~NjfMK|L%coV*AO@imONklbZFf<Mm9KDH-bECV|usDdWBBi=h?EQ
z6xWz(Kbri33)=Y2yHdWYv8im6AX3h%c;SdCi_D8J`c4hTdxW6quymI8txAoW+dl~j
z*80^fWlPeQuew}vn*$mR&SkAYYRB~?OgpvX_sj=(JRV8G2mAA#))ybe$-Pg(5(UFG
z-rT+SXYa?Aci}X3bjoa9r{J%=<E}+^+hUq3a>T5Mn3+gBea)1EsZF2A9p65LT&-9d
zkct7VSHFOD+C}l=!3eGgMTr9Dl;rXE7au)Tl_y`}|9ZSME5;ba+@em0=w&ADHfxyA
zF<eaO?%tS6ulA7}?BG)!zMJF-#LL#2x1dD?oqq2T+@@BuW^cwmqpRoOydj0`vD#o>
zvwONdimR@OUC2Q2r=kfWH{s2mXCV{~pT?Lor$xt)_eyN{06)4ojmsmEo$!sCT3D2&
zYOF<e%oPd|Paz6Aq)BhOu4vNBcM!y9>9Em#rq{>2>H%V#i_8Ay{bKH(Fd$$E2O5S}
zG6b(72`y3bP&IOJ;8A;g(EAV3t!ZvOs}R1!Cq+6HrkmOCcNmINcFCWjTPc@TJV#WT
zNZ)Mx;zjxxkPdk2xGViJ)F<yih9%Lm#<<QHvcTB9;>;rkIh#z6V}|vJ1KD&RV8aNo
zl!kM-OJ+_$3{Oi5zk6~$iM$>XeBcu8i7IqekLOx@hRMAbXl<FYwM-{&CutbWW_W`M
zTQ!%jA{8c@ESB5mv=HXn+xl|)7$H6cIe81QlI2J!S&P5DdkR)#(%B=_V<eJ{&#+%-
z5t<h@ZTqt1u;Kti_04`*OFA{4Z#sC;#l=ywrsxAbY{j0w6LHqbMKy_HddFu>BI?`T
zYf+6}7UXoMN>1oX?be`+kF)y6+orK?vNhva4YfnZuNi%KD2hDpq|<yqc=B3uPpW|V
z-qMU^n%i2827F_U(&ll;u5nWZ+E5T&(G@5$WnN?&xCQ78d`10}6RK<vCEU%L?_`6u
zHD{A7pr0Yxr7PTDG@4n+4zWpy(aXde^gs6zdVKe-hs6oC61132?Ty;0iIau5#ikQ7
zTH|7lJF|Y8nDCWXa@J^Ekp%2<Og?l@J#$4lW}%L%)$XWYRA!itT4E>+Pq}eRih3aW
zDAZu1%TXHVNReIj8Mf8(sLr^6yp~nBF?>(pd*TWnrzJ{HrRJe!+O#(bL*xzq=vYF{
z;Cg+9{h=FEzOCce6_~6wvyF$t{0&O|-uCmR=_eesAY-xTPK#9Oi%zAs>Q#b-V1~|<
z-oqJ}sKv})$*rG1@({Fh$ef0XZT$S%eCYMP$WZ4NLA>BYwN3d+_g5m7uVx;ldg7_M
ziMz6@7(Kni^%lm$D$ZJ&8bIaz)(Dgx&pTfvCsmvuZi^#g^{(+0mn)pOWkgyGR+pYm
z>A+p!kXK?L?MhjCkp}|>SOPf}>_J?OHzx<jGg`mf65rR5f5rT38Gl~KM##CbyMv>m
zqM!3Cz6|>vxnf6L%jsHZa%kNC_V!-jr|pu(cymjbr!I&^bIJP@S0mzzq2xxXslJZh
zhO9NGaVBde)dQg1Q%%15Av9N&nWC_s9yK^f-z$yyskrZD-yd|<|4!8cih>#;&cELC
z6oP$T9wr}df5%r=`D6FP<sp>l${OU#Cj^ZHU*k*j>e>*TXd-6It{#3LIXug80ZrDg
zbc@)pr55di>M!BSi~}+-@3MSh!AcB<FKbxkO!Rh{`{Z;Mnz_vWdi-qBM}~1;xTE`&
zroR?iyxRhew=WjpH>`iQG!buE@zU+-xC>{$IR6MX{BzAm8}fRIu|94nCBB@|rn+C$
zH$iOEHF`E<5kMB#y!{f11&*YubVQBwjrQ*D2uwnZ!7Lhe@d%<qhSF9rkkI)%E?Dbq
zx0N&l*5Rqw7vA{ozmQ~K=rVZ;@2e>J^i=Q-2}@vy$1aLqe(q;`3?x5zvbg*q4=>1j
z!ZCs&_*r&%sEXb`fyf=OwZpeW@TY^W&`qbueDx~~I59oc29FjwapY7aS_7iwmss{$
zxc<9c@#P^=>z<lWsJ|9+qR#>l>EK?z3pgjOJEt<G32Dsg$+|`oy~fNiGt0SJqMHes
z1MUYAJCzQOQAN7V=)N1AsAUu-DY#cQ<BRFRVAu(gc@Mg{ZV7%BY=1f-r)Rm@XxTk{
ztp?E^qf_b9o8_(+ayuLJ@MC$VQN(P|cvu_<1r17aYE4Z-vZQOl3gP3JT2GL9_gu7}
z8HUtr=nCsvk*ZWHd35r}`E2rLF<>I1=zB4(pZR!rB~wRc!q|%Cot9UD%v?(__=isR
zQCaXsfYr^NXXHA^vt(_Z-gmIoLy^}KRYN{OY9sZK*uyw*?Z?ZwE*m|0q6>pKG+nt!
zXC{@(d|Kdo1V=nDZ_&5q#9A+4$UFwNi|_qs^Q)_w%<C%@?Q%+w0Dm-%PJb&Vjm1*%
zODQf}TOM44@|<BxH2k5I8_)<7(_5gb>ODHy1@Ub_E$OiLgKiCw6NhnY$lpxDD=stB
zUrd4*&|6rMN>%iyJV%pU*mS!iQ=?$fC$MT*?46aUv^ZR)s|K|M;CUOt4h`D>9)WcI
z+LdQL@ACi9H_O~?AV1g<-%rlua(&f({L2TmNMq+Y22nk!X#B4hIb!f<e!`WM-hsee
zVCe1p(m7)3Ij|Fgyfg--(~np{EG1SQl4cfuV>Et{c3NTKBizt^!fK^0mRJy69F(|b
zQF^sh7Ag?Uab~%Jb!iD!>nvmTv#E6N2cPjLmMl^dF&i}G$nE+r`VZ35q9{p|;~mjd
z{TPhNSpze*GsNI}-=*>)YQ2;mS0#qceWsoGSVb+8u`8V2>1kkH9qElM$OCJ7@fRcV
zZx*ClUyl7Z*Frd3`q!@)U=PCXEvAeUSv^CysolZ$HROX&1nhN<r)d>(0P}c=P5t6=
z)4ij!J7Tphgey5Bq68Rn;R=V)mVdAuG=>JNI8ufFD~R;xS-TV^FBO^6&>>lX0JU+-
z??v*Z`;byuS9?-;jJ-TIS)|-&f8IN}Nx*{|H-6n`OgBmV#h)fLpOzt;TU#275-2lY
zUD%{-2|fVNA{5nKi;!kXzWU~5;Z<4)&1a8FT%DJ-v<?m>xGEjf8Rx*3@6{R6-t?DM
z&gMVFOe>9;L1Vi5y0G;*->S`&p8zOw`?-zVOuOx!zkEd>Cs4-`J_pTI%lgfxHgWlV
zt&d@zz=Q4~aOr|`d-_hTl4ZJk)M5T(y6ZVGJp`;!E~ab*qzuu=A!1{7Ez^-vK^6}6
zho56k#N_`aP#c$!z+Ic`ci}&%rt6@4w*E@W3Z$3*Fi|%O_OI^gw<#|XituBnkA&QZ
z@_}i8<GEjFwxmJtV^HI`3B=mS6&%b!H!I{CM5xd-a1WHsV&u5}y(BU)?2@F;8y&cM
z?Z;_|mj^|T|FR;qY|vd0-0wTzwE;@O;6bv`IPw?TM(@gd?V1(Cljx3XvLJRD_lLeI
zqr=_?sfVT9hhLC_h`dforK|)lx!1AeklJ5Ua#?BkZxrs`74Su)s!7OI{z#^AR&8D%
z2!+nN8A6>91nMW*mBp*N8{5;#t7S@GWM}6%#J%mj;YByPegjyEe?B8B0I<43D<=y!
zZu%U2R5~B_WZ;HW4*qa*=MIx<_VK_x-LuJe*>5IB3&jOAF}hAU!tB)vbaw%8%qMzT
z@siERhy;l5`=4DgHq@uVnXNsB%t8hhV#%S#FCrLyjD0L=`h-~9b3dmzT%D5$N!6%o
zX+(;%FfRNTt;y|4haCb&H<v6jbI{+u$?nJ3teJ=5swGc#hNGCM*+S!b#pA%HzA<25
ztn>ER-*Ix$9n_jsG3uC8UjiV89>yjlM8w2Ag=q_R0UBs&;`950f{$)}oYczQz!Sj&
z0{L26QE0SSY@{8wVy2d=(6~0)J=a)Rlv_wLdcs{EdHEQlR&Q$nzk<juhJGus1^xys
z%|d4<SAC4!wtqCoaME%P#d4<ktn_r{q+b0?{{fmIxk6QD^C$vqU;G)16#RB8m}kn)
z-i_=7s8)9h5oqXIEy|&k7$O?V_Rzn0yu^BGT~{_JsEi9RUmlx_m~s_>LQtzoIP=UL
zCHkiilwqm5&=Fe1_EI|lT(wT}^9zmGM`0HFo9H%4c<o)yq<NI|<&^^S+23!jpTfP0
zHCzW8Be>&|v@&DO2{dJrIy<&Dv$MIB^>HG3)yH`k!f4%f_EBmNe7R&);2XOo<3p#4
zj^Uf6wyD*sA1OoXdPjV(YnB!le021giu?KzHdur&LD`~EZ^WXyyF(@+HA+L;xY3nZ
zu<`v!wikx}S)WmKDAG=-aZjr2P9mQGWRa=6fjS=ussx9#dn5#TYd{W{n>FMJ2b#*3
zXFXzJBcg%cH*WGI=tgy<%nQf7BNW#VHR4l>!5*2FT~Sd`_pzd)*U5Yhq{auxg1}_G
zgRuch*WATL&C6@{fU5rZ@nbc$4pkMP_szezy9e?Lk;v<EQjgWuJ3G5iQL+-xxcxq2
zb~tBOy|=B~R;Dw;IrBH(8{RamcI>I>d9#r25)|}znv3{1NgMMc|BU42*=BzKKJrO|
z+uBQ6jr+B~CG>*OAIkBS|K9RA7m_q!{r$@Um{+y<sdC$#Y9}9^&v&8AfeZ?>|AxgS
z%-28b8_S2jq_vr;%V+H3f>E{}!we6Phe+f)`n5zwMO{JkwKM)Bw*8ySzQ4{5yj7@;
z+j!xCOv4t{I_gd!0NMXJ*4!;uI8`-AE^gchP%VI$Kzi`|mpkVc=FTjRdu)9A(Z=PZ
zlMV;jq2EgA<(KQ>DlqQ0UiE6Y3Q!yN$CF4CvBVn|Xr89&q;rtV2A9$Ts+po2evjz=
zj3T_&d#0dxKE)}`o?~a@j72b$ke~>^0zt>?;V4aF;5$!Zl<(;7U<W#g!FL8rmfyd4
z2YbWxG@IrcY3%*t!~fv&fg9{cbD*cxp(S8Jf!HPT@s*})5`IIKx3Vm6p4Spg5npWs
zvW#Cq|NWHL|9W>#25B<9$lhIAD%KXtK?PY?{^PfEsxd{*XDv*CsKP^888FYkH4n#?
zfaKsx<ozYJ!)Lr<iMLmPr8{2gQcIHp_`dy5v4Wr9Rx}^i{&KB23oX6-5$>bEl@3>)
z-)Hr`?3d`Mo;u|-R?;L=w{;f#OYQJfX)$8)@?ZB&-in>f0F``_KD-2~35~`L8LvyU
z*?9f#8^hlm=OE7M?*^i2?7UbM&?0mvZT496rN7vId+#Fnrz5X>{T?*d0huf49gzY}
zY<<zBdg0<lABYDWuHFkopzS@@KobPyE{Lr-;_gP5G#DQkNiX+IryQ$jg0*)_qtzrM
zJzof$*KC3&E9=rPQHY<urY04?m%h-w`*LC|@?iq&6yMBAaZNqF2CIS6mf-l%+h*-0
zACB#UubkF8_f5dw8v)Y#qj5X~m%JGeh}0NAz%c^xi<*l|4-kQj7Qv0RpqL!Xa84ND
z@2t|3htxZ*I+T=t^%s*@m>)eoHW}q58yqC%0J206&8H9xypQdiVILEbka)mqc;UFX
z6#sjmqkpPX=CQgG<&`xTtE;P*ulsB1Xn|7*Se&F%aVN6V>C@}ANRrv?xx{#@(-ySn
z`zQL0Gsu<;{@!ZPc-H^Ls;K{uXzKrdrb(6lN6HUq2jR9sSL#al6?Oib${=75!P6fe
ka<^W&4_ZD+Yx&p_!7Mvx->+&qv~ejtP`_Vv_nF^+0bOzfH2?qr

literal 93784
zcmce-cTkgE^eqemq98@3NR6Ei3IbAtG!>+GsY>tCYY2*nbm<@+q?btViFB!<NH39I
zLnoAw<UaU*zwgf6|L@HVGnsJmoOAZsXYIAu-U(G#eMv>ZOhH6MMD_ZWye1J5=~v*7
z?b;RKlg5>03nC&~qSx{-w7t`|=g0$Dts$a#>+}8{6PO)GPa@xxe(fXCFo$2&GHL2p
zmQ}9pf;3;rzM>KM_Dxn<Ht->->@}`$w6|W_5a0e4=s5d}tf4EBw<lH={m>XSx3NM<
zO&PWGuypov?%Uou$=&yLaxO=q2fYH2hkhNShod)uH2|;gA=dxB8PdLH_1`;{FJ@Q&
zy&JOlzx>gClFNCXTRS=7TR~FzWi2cXo4D`d@<z&(So@QpyJqR1m!7L=VSW8XN<j^$
zivvlfwYWxmPt1|KP+;SNDpF18@&W7Kb$H|n{BW*`-Fsc*YF`6>y2RvQG1bYZGyIMW
z+udYhV32zwGGM3A^b`hDQ9*VI%%7%hmCtyrSkBZrGR-`feD+N>ukcfc_;sCYhm8TN
z+kayAm(<YU)4%P}bGRV#B|WO66a3Luz(J(5Hx)@C7wP59frH0$GrPFu0%^a+Wm5Dm
zd^2nUey{?@k1$$|*j{DqT{%S6qoV}yC!#0P=cFz5?{Mp|=9NeR_?b^BJ_-c(SUfEX
z9gQ0m5;{wBno%8nnW(9rWXYBO`uOBHGU|rYWWCc;m&c9qtF4#El_dw+djLHdBj82C
z?@z(-7c5TjjfNY#Zdl_J+#DFnA7u^mUFn<OZ$k8LntOWgRCHs|GhTO72dX-@HkEcK
zU3wDqcGl78ck1;2tv^c0<$N2|vi2YvToH{y;ryKa4p~gPvu<VLXQ3^Gc2Gfjy56?;
zE{L$R{+qUh%~*5?+bS0=ePD61xcB$hBSz=BX504PduGmFbveIPKn6;WB>F0?*VfcB
zQzU)2J3h*VAm6BV!WuU>`!ca<_F7z#FM?_NFZUwouDW^-XY>yE8#lN)K0)g~GH^SJ
z@%f7%go$(Bi{CNkh?7B@wC7?KOR?eL(+n>omnn<_`Op+5{p4b=H3T#R{W}z@RZ!I+
ziOZsd<*AkN#LfS7vcNuKG_Bj}W!&}=A-g*6li_Vgkiee?VX0ZCe+C@2L-FK>wGQuV
z_BxiZI~RBwPRtO#MsK&-=|sn{OQf<xLNMT>wIy2m==V~!+VDOZ5;{mP;q|1D^b-@X
z==i>4sqPaaq~(xI&Rr$RN6$WvT^Z}0$D~4E6>WE|8J+CYv{(<jS2pdm5KxHIn%!9+
znvxD>lb>tWrr0=9soksN?_AF=X6EtTUWC6ddaXc&b?mr_D0b&$CyLTCKGF1`O)9s&
zhPOlbS4T<}s$q#etdy5Kz2#IvRFIS9-x^8>X|D9S(e`}*x|nkR)y4M`YiFM=2@v!>
zD6dkDfDQ?>cOlOdJ6MRu$>qhA-s!ADVUJCxJ%<^_Ul#^mteW~sSXKdNdisY0pH|ii
zC7d{t)3E2K>!A)RtxcQ4Yf3@VM|*lsRBQZBGquMFFn_L~gKN&v2?_lYA3`Q%`&Vmw
zlb3PDwmo5EG?UPc^v^I+R`9$84Et5@jD_TYzd|<b=Xi+>mMG_CAKfyVfaTqtMl7B!
z$>?GOfumGNq&$Hx^wr_pV2Gumg<J=!3^75~vD%pIRv!MQc#j(tbpipchda&K5VakN
zC&E%yYYh_>#T`YZO+1H(;FI&bAZ5e8uH!BK2AjT7V5<uB)m5Vso<{vyH_90M*#k~P
z5%@_k8nS%7v90P^YRj=G3I|3tL*6g;AD+zqbeektpiW>-wrtAE^o`ioW2vr+%`d_M
zCm27%&MqOr6Th(p`k}SfhJ&7kLeCEo=S|<;%?i8@TAFqa{Rv_dXe&0k#Fdir$^A0{
z2n2<fGZb-dwAs2-GUSEuI?+;N&(g+FI$vxof>gFP(Hn608C{B!_yPC!`t_WF8@i*u
ztr3e13W5|?)f!iuHo90Ad+*@>p!Uh3iWQL<=>7m<ja~qe0zlTUX?5-@<B%7z>f1&9
zsW^le&Q>JV?_{?HZ7GV<u8-54LgCvHmEV0o?B=E?4txo@%B4H!fg(`@<NCKu{gf4)
zv6o)na&m7v`>lcBk4pW=>FhK0`0Nmngp^AnT&(>;`sBU*`+Q>YF%*_y{6T6Ft=hW?
zC!rK==>h`E^wg0%zKn$pA5POuSp?vZ8JZO-SH_#diP09%->=HV9-zJEo3O<^_@n4~
zllntSQ+R@%WhpghY9uv{$DiabV?F7u48Wa^TCM50vy6QVQk?U)y7b`Ze8@u+NMGMu
z2<eihwrDOzFT8+;4IHo;#^d=aw!_S_Z1^JR%H(_q2zomEp89EV*gTYAGWSI5yHcGy
z4SM!N`%b)Pz|?1tT)8F~{Js0!6EcxY2edp4y6enx;}$QU{mRLeh7}#>@82_UA<=k)
zck~-UNLHV-t$Cwaazw3n24NKnY0UNgI2$klK^&#-GOzEp9G7Hr9jYvfM9}rjpN_(;
z95<^>PkV2xp<l*z>4fs`w^^}g;{8KO7PT36XI<7HeeAbsoa7||Z{mzwc}HqKGK_q6
zd&M=X`4|d+SrpN08LX`+eNh1|H06G9G`Jz>e*lyIC4Lp+w~^X>GR(2g641wEQoXrf
zRpsX5c9GQlfyUnSXiVctF6?O9zI+>i>7So|kXOlaWA~Fn5VP9EhQ9qDgF>prASYwU
zw-~95^%#!Fs_CJq9)adF!V|y%`jO$Cy>E$e5wi#5qS!&N-JF@rcogin(|Cffaqkki
z4Y_tM!&U=lg2Ztp4~sUZnPDc)vHI0v?tNu?x;M`^*X{k+W4brCS~l_<F9hEp`!OfS
zBZI9$FKZoV+TLpA1WmQmfM0wJ>otO6MR#G1lgE_9SRYg-j;f_(PS3Q$KKL;fScv-H
zQ}!TT8E}zK(A4bg1qqFmlEh_HWZ1bl5eSGBCWT~0QCJ<R;BhAbU*QW!j=LKh{E$63
zgnS*-IHy-p%nBB(aKUlflN||b0tTs5ZQX9!#ctKL9IF7q5_LX)LRhDPhS%iFlUKDw
zf97L=`VYv_az&u$YYtgZ7xSWU5AsX6l(Bt5TkYPkJ$V`$4cQ(&^M5|NFomSn+rTZ*
zfcT~V>IJN<d73ojepv2O*@B)Wp|UuY_Mf^PP9ZLS7d%D|b_l@F#{_a`VE!vJ`{6-y
z5X51Vv(Fy>CB+HvEl?Ks0g8ZIGdcaV#sIBPf*+j;1oT9POAkf*l}GPZ^M=n`*x7xV
zZ!TyGFZ&Xp`SGsHBkS){r@7r57$90Cy%ylz_dV~o$XlsgGeTe=>|#l#&*s1vzi8Me
z4e=}^<T*5=g0oy~XX~kNP@7HAy}OVZQ~$$5C03t{(;^2Eu;lZfmJSa}hLYfz0Rafk
z@C1DH`vkEc%xqP)3n9SkF2<Wo4sU}o*(dOl(*R@9`GXk*VHr+BIPZzpp2+?TS3Fk&
z;`6Xxi;KCjxSA$+xRbR(pOX6%tOi}b;!At=nK_T+6}o;^)wD})s2;mj*DgB}4`=sT
zhA!dI68vGg6HC!(>@o*|4<2`G7>plX<3gZOC;ht@7%W2zdNPq}e=u*RPE(UR0IaqP
zzUUNy1eyHc)M2f7A8et3wN_PQ2Ybd+=btEY*%R>A>+O*dywLYrX&gPfh{K?5qhCDf
zL+fjguIGhWsY%ylI>BZ<EEh5)cF*qF-#z~T#(mcj{|#M>@`E2l9&&kMYr_Lp2AoeX
zk`MueX!g((`bTLhC#QrRLX#R{rUZInd7K=tko1t6UHZG`7?pjv_)%HDnIZ}^(z@NT
zujTI7(`jfBj7Nb8Vq`+o4GYsHC90M#SHn+G`>6=mzbOw)@#l4mjJ6!}1z6NUer9$$
z6pMs)*<K`ov59SdoXxdwjuJGVNN8l5jiV-JP!o*1KNAzy%|u)_Z_Jg0*xms~9O5)l
zAAhdcSEFW8&}FT<6_pbEr(!;aYAz^DznBfPkP_N+QMxf*%t@2)SBEKcRW;byU*Y+Y
zwYYpZ1;yPO8|Q>*+z~4KkRB)-)^t&+yk1MYuwK@C#+lkBa&ZnroB<wLg2IodqY#Jq
z)4?|EL-6smp8r;A-Dts!1X1qZmi<Ur-b5Ff)VT#UySS$6TttA$Egt%QYBq7Dx+F)G
zZv7fSugon^tH5|D3_2Dq(0GW#<6#t7!r7Q}^Oh8}ViTK9Q)l;t=N+NddZ%&s<JIc!
zEYNui*x$w`3+it1iniFGO@aYhvgGV{{dNJzhUZ~ERp~A0;Ynt;Hbx74=Gurmfu3?2
zlAMp75BWg}I1v608nKp+@Yp;`@p#a#%@e+5UJY8~5BmVRSm&U88qqeUhB$L{H(qKG
z)vi@#gXEpe6VxwsCWde{k{8E@h}1rSb%!E5PMWa*dAnWLeEMa}t3r45iZK(<${Bpu
zH|L?NrRX;@Ao5=U>$kjDEZVLJwT64y?2cMT4;c7H$Id@(K3fg<G8XfV;pK&TzUW4#
zG<auLj_)@J87LPl>7COiup?fjK^L<lmiN0)py!!{I0YTpu!kIoaB3~$^cLaKm+uVO
z!n!zeD{gS|f70+lOYNS`1q+C9e;OXl#GgsvSA+-(5-vE$sqD~jbrHXA323Az|BTD)
zd+zk04+Aw4lyXcPZ26;`Y+m!Cg5s}=c=K!%Z7aq;O%;P-w>jEx%5^TSU_j41dOcAj
zVBaMH!eCBzL?#Z4@ZUL}h(BZRC4AsXXme^>Dn}<du+8Wjd?~t?(1&4resmg#Z4%r_
zM^3{Nqv`)Un9<RN?>Y(82N7BZ0|kjvZtfR70Q_=b%>{g=TV6?+vrK4R#cr0>X>jM_
z^yUsmPG2=zU!3+#Ty#Y1i041WD=onqzi=iPL+5nNQwIsY(I5#`ulvcupVoY&ag_cs
zybZ}Q6UVtP)zYM;e1;XwrRGw0cAPR^UIxrU88N;;MY_N#;P)ZKl<S?g53s-X3qJh<
zz4CBG8(O8^8iP}Cl?3i&W0T5)bbK!~JLQ;q2GeH<nA^Jo&9AacXzRk#!xXoEx{XyS
z!1&~!7pH10`?XSL3@C-6t|v?cpeOL)FvIxk-L(#<sfaUcPyT5>sbmF@hLejP)0Za$
zLxUr{b-w|-0;y&r8#^=StlOft9EVptVFADr=WY^a%IkdTBLRym0{C-L1UA9Y8Ji%A
z_&7$MS1A|LjlhFZPv6AV!UC2gv=>>Jid{{NF3O@1=ts-0;&T{J*vQ=<lQ<eF*Nf$j
zwSY5~OW?3e9$*i+fP&99kQz55FqBIyToBxWGXWnXp;><RKUzR;_Y!Wcd0DvA`4)}W
zk6)NzHK@P$hpe>dThP3Hy%xn$ApqM=Pen&i6UsG$N|t)25TAYGI+P2DjkeD2Vk*-|
zr{u`ip~Xx@Oc+--0|y5jks4<;E;N>en+i)voOHr~2x5B5EcHioZd*)r8$V_muryv~
zeg%1%(Q>M(cRgJaDk#!rpkv$eozE`PB7dyL&(i<+un+mW0GmYhHi6xAI>*35z<;3%
z<o!3sfBwh89|_c1iT0nc-DvA94e=Z-6gPpo=ptaXwr8`tKYk2gC{MPdi{|^GS5f%j
z_Xxw?ef^idG+X0TC<v0IfTOL)>gZ;8E*sDHeg+!LAM2-cyR(oPM^r(y$!V!>%_g$%
ztFFIFfo8B@WrL)BmT*8lU#dv+QLw0nS<@Dr+-_bsqx=+naT<p@#h?q28KCzs^Qun#
z_i~dQ=44a$7R$^NsN2F2V_glwo_dSV--V}p?-(g?#?E~h7y|*x`^02IOsqa@d%$Wz
zz`?Hc0p2n?l$_s5AADYfIM?#s=R@GI?uL_K7uQb-e3x$Tiw?k8o4l@@sdbFJJ+0~N
zH<L=uF3HMP6<qUmoYHD(i38z<mFkYl+}zxGOV=-bFbu8V+QDiS{Ym6w$uC$7IQ`YG
z2J&9b#N*rB+bvhTFAX2JlkAoVUsio!&kv<=YV<VTH7)k$T>7P+S;XS(zhv*{*TiY*
zh=QYQV1~&D@(Y`U794K>gFN>e`eM6I`YPFhFiov{2K3xk!Nbvy)X&euX<Ab0Bg1%a
ze7X3Al~(!~Ie(pgD*#=#8x>7B1QVLPIikL<gjD-_1K7dpdx{Na3|~tgn^lrya`xRh
zR@(u8m|^pp17s2dmFu5=9#*0=)(A+)y3BNOaPQ6{U#cl)am}>aQcJL)OI<VP6-E?F
zNI`fbB^X<ZFRFDVySLHMBkSN*Q1AqPivuhu8Q<agJ(wCas>L@O<WdCKDHovcUdB@s
zGgVu~eZaSxc!b0Sk64@`hsP7fQki`ST>5TiN{aa<^SE9fasQ2yreFL~bxg~iDqn7X
zqLc~!ilq?!oN3$=BPel%6FKX%CcE3(`cc}Wy-{MP*?B8b<*gEnvFMQ~^bo17$is>#
z+*EkI&0%^x5)=~Efj$7A^*{}$`7^1LGt*5sZf9LPS=J)wgmelph!Vbb(hDhhLH9xs
zXGx$ly6|3mUS<LVLdPY*{88C=mS-ws9uHt!!JcQvDejU^Wvup@=8B-GGAepQAhS^h
zV~U_><0o*WUF7^3)r3(EWM*6df=&hd9$n8^GP!7z5`Yd<78hD}t{V>IIQwn1%WGsE
z#8^%hH}*!?-*sa2A;?9~en5{w_cOe3+XA@9EvGDqi~Q%I8V|8h=!Lb;$&dhh(rFR$
zqMHK@3CI$_b$Chdc2fv2U^Z0rr%DU6sUc$y1Ato|>=O1-yv507?)}|hd`i8CG}|b5
z8MC24vg33;zAgZ_mIN6i;2I`ygU&6F*z2DUp|IItsF$;|XxCFfsMP+v=Hpyrt8Cu#
zK;nxi_`?O)grUs>C*{baAQpZ$BY3S)@{W|Wm(>*3-qpWiYKnKPn_=#(Sg+;CnSe3n
zjL=|UW@bK(L|sEZN-Q^5{Ai~k%QMW6AmxU#fjtlU8?L$wU@I7#@yFoSMD2e4XKB3B
zUpyB%_3wDR20_NOyK*x1Hb~Z8MaZgztP3bw9oidXTt7`U%^x!I2pj(>?CMnnmG?iO
zbnE|e^&Gl35m0feW6r{O^;zZlI(h?N!6-$T4AmmRK?E8%8gvQ-Wl?qvkQrrAqLQtf
z+tk$AnMTd*e#*k#E_)b$WCEd3SFJ(h*DiotJw#ws8VRQj8o@esR}G%Ul-9Fxb{?qV
z#xh4Z`o{y|nhci)2GXK~3FsNeKE8>tF1OSj#fV5W>9-gutM7L=^sr=Y`0)F_rO;(^
zO1~&JZ(c%L1rR+^(`KG)7jjw!?%i2$ner+bjhp>S{m!)Z${@K0%BFvixi1GwpS>#`
zSqe{=h9p*w@BJo|`w1i>Gm8fkjUMg$Qu`5t#Sk3S+1L0UK|M>UU~GOqSZhQr(IE*n
zH=}Y~CyV%YMafkAG)K?U?cA{r0?rgA0OW(7<LNEyw!C%8(@SQum@vLhIn|?7gZny+
zEIA@(8IK0^HW!PFQw77WMZa28*ZnvwO{HQsO}E`W_Mv*hU!hWI#V_Q}^{bnBJlx$^
z<&pHcZq@pX$@$Ona()V{0^}RrXD&Mh0gK%fY=>NdkR6b;5_oorL#>ldSNgn1P3sue
z@1>J$&cLJb)Uf9S4n<+X7Zrk7=#XA-4($8bAGO(oMHuQF5LN48A87If8{=xSL>!W6
z0Q=eB`|zn<Hzf=9btEB|k?Kby^_z_T?`IL;a{v<xzR-XAaA=>tOj&nhpDaGU)@e#U
zn5$RA#ktG-&-+>1B?0h3Q4l!|_^|)^N}l(@ot47Hm`GT_ai2(}<5x<hJRU2$JQJ)I
z7~fN9`g=qzXdbg18tRRiwk8}ahmZe^LeKheK^|9E`Sf+Qt<getkFF0D_?}47ls3jQ
z;hObdGnzJ^eGFlT*b!P&oqe7BkseLu7rkZ2+){ix&9%o$CV;S~Y@LLIf)BMi1vKfm
zM4>AKrB3o1{_|BZ`t>Al$HU%?Fj;|1*A#g&<OdL~+-_APk50={hxqOt!f<Z<0B5L1
z#E(X%@Gs8;&bClF+KRBeGQgaY-4O|;$r_lxjq{QB6Ls(t$hm@)n`dR3nW8CIINVNG
zOVkJvUK<TvG!59!dzVXq5~5+X@5^|*(lcQD@2?0SeV;(A{OL$h^FP8hc^bEluU=-*
zSi-jXQNVi3Q^5B62DGGNGiF2g1uJzMUvzpoBTi@t%W|U9YmG?%MZh1mo4j}W0>XrQ
z0X<AJuf(IKTD0Z(WC!0Gw2O_aL!7RzB|P8W=fKQi(7Rec&gSZHw@PTqsxGBQfFx<w
zhZI}W^#m*>p*o5WFyQm55cU8Ejm~XT@L3EG|BR|-#bVp^{mk<%u;1`urr}`7>F;jB
zLjUp~WmC*Wx?ZUXdHEk_++b!0gqeT?<C~uJR;*OZbZ#$qY#2L~{nO5S<*m<h?lzh@
zHolcJ9#*p(tNl1(TovcU#l3uR=KY<i^G8y%8PaQ~Ib;k3h!aYdM=JTw!V)Kr0v~&g
z-YVslx>{U#?;oI6vWOIC_Tz2?srFvi@xm2)myJ?8knb+p@D`u*In(qaq}RC9QLIGH
z^Z_LA=-8?7cx1Bk9DA<MqwH=TG1uf-$()k>T)A$-C^C?oi0G$yDD1`BGn+uy08J^W
zxd~I2L5cG&M=!dai>V3xL;J5^AX%TkB6^Of3V<l_;E}=ft$}ktK=3Q&c1hrMB5jN1
z!!vJe<pGzc6@*)G2H1Ex{^R^OTleo<?ERh!_TGfi0>lTq#T$kszK76@qqToJ_RD25
z?#?H#M9!H)R}|Khnol1$;ufLMst-sNWYb4GgVMouxgqlR=@0RbyHR^1bg$<b2ITwz
zWr$-i%@Q3B7e8mV4S}1S7aOp3Q0;Hj>WD81@C-*c03sqIWXaG=@?!5c%m-%}0LYmI
zr#jli%GM*sDV^bY7H;Pq9UIDF<IkQ8yI=r6V@GdKdvppIovH$UX7(uT?z?B^ZNtdI
z{s+!L^+x)v2)P3}3Z2<)gbiI;J_*1j!M!FRcsu0>+L3EM=d`79Lv=~;9ui#35tZq&
znL&)NUt^u)jO*Ut7(k;#vOv$rN>zsSx^vi1j*dt42F%Dpo$xpP03n-KRoDJwEeM!3
z!BrCJ&UZERM_AZH?I(*zm&zsw9&hSp>d^^>tU6PA1zhUYc&v2C=8_s=4-Lo;hWZ>n
zbEyH5pQa3<X9V~@6^v``^z3Z=&!7GY1fH$i#T3vtGazXGanFF$p?1@T<C)lp_ztyZ
z3$rX(Q&SiEVCFR?sgSG!pk7J3aDV5>XX#?|`ocqR<lCc=#A|@Yo`%LnOJlT^v|!Ud
zJ_MQP1n0T+p`8+#zMtt!Ad988@QFf;-?*j7kay5$Ne07#5w45N9Zk?(N9Ta{EebFE
z3I~3}nXq7LP==cpz@bn+TLM2-4>pjv2>^8WskUAsPS4a5&mNa=Wr#_5tPc&7@6hNO
zosMM^8kCv>AI<^=Fz5+#q0xT=^>b@6T$F}}>g)ZkSFl3iPX-lr_|+z^f--Gl31OF2
z2oxjg{;P3#L4dGUa0jqxDOIJxh;~x%WCQ%H`Vd9H7Xi1}q#m(4RZ5~Y1t_Y}6(l^^
zQx_eJ_&sYR0^6dI-un%RjEzl#h`p}Na+{WohpErqFqzWW;4=rH4#78J4D}FC*xY#0
zP#P~UO3>fDbe&-S>9aghKCofL!6XR2C8{4kwD<rJ&dvBZNeXk??lP@gYZ!Aspu1yo
z+?zB!cv%N(@P~f@2N!~I?RAI#RH~F4=|fGM)!K@vH|L2X)DS-&CCi6#uSZ2AUHiHs
zx47EXW3#z$+e40YI*KCT{FnOZ4_N$**KISXW9o77#zsLkkmN<UGkzo0$sZHeZ85T?
z7(&e|c`ynigz{fp#{JTiUx%@GuST4`Xkk|PRV@GF&qD<xL;vZ+*)4YOy%>%Ywo_C=
zM!*V>iKadYI;@W$(y46n;k<uY=w+8djmg0$sm#+oze`G98b|tKuMcsI^#eiPuhC0L
zpMLbxIbW4Tx=1=3jIR!`SXr+kRaK>q_RQU{vcOcwb1q#k6W6B4JCm>NxumkNE9d2v
zl=CMKWG-Rbk{to8Ziu&hR}3EF6iKBR^JbB(LNUBgB~2Pzi@IpP&B5X1Kj;A>4EZfS
zDxkcSkfDUd32tM*@As#Wa14h;nUHk2ou#uM7K8#yq@txD-04e{sJP||XNR}U19XQu
zv%#H&I>d6Y-&-gBrT+?A85|kY$Q+RfZJu1V8}E5<|Ep<fe^DYW-}U?WlI+>7CxuV>
znQ#AgYyPFdzC`I!_EyYwd2+YqkR*P<)5vw79CaAAcxLsKJAKXvNdxjft-z5}r$6@)
zPwiv$8Y@tXR1#+yk90sRFK&4npM8=-vNN$;q=zha|9@4$9Bs@3m=MHgC{iJuoRJ}1
z_VfB?w%kk5Jhp!6a}v0`#dpo431$}>b@ydgG`Rj`*t<pW^(`;-ypKz@Qfe_L4#(GA
ztN-BMe>G*+;#AzQpY*}$ZLAGcBU6#{<!n%lr>9B9QVaB=NoS%rjJ`6(@@=#fM%zgI
zL3<EMl2Nk<AcoNe`ZYDtE0p`_!sv|CD|r1p12P0JhRr#sS+Bpa9QhwDK-}NTl{<i*
zzPG&jKv02-BmaJa4(b0{3Px`OWoJ{|nJC?O#+O@8h%Gn*yM{zVo;e7f6zjpa*$~*0
zQcntV=GXkGVDI(ym<LN=oGLp;H8&Ia%xC!L(>C7TVGX|-ksy0n7$aIYLbc%L)dDuF
zI8;@Ca%Qw(5(EhQN$?ND9YSV6ZPR(yvzw8CO?7!V0~A#C<`24*{GKE}fU!(DlzVTl
zrwD0T1Cp{D(z43HSk!1D_Y=K6H}_O%&Nn4nV`F0+PD-vlsJ)#ec;ZWtF(66BcV*rB
zugf5P=Ms1s@muy<qgDIim*fICLZ2y&BT$*8rlC^b$lWksV~&WW(J3EHOBV+!wM97c
zOAi2)akGo!kNEk_fH}2GEPm&)<P#9}>2Je`fqgbA@y%ntYkakwdbj@T1dv%DC!EcD
z!TlzHx<s#;*o3Lyn6iogC?CxGrv0@Ek0NO+=EN;O-hFu!b>Uz;n;cHTLW+NWN|Yul
zDoXep%?>>%!i7+?Nx2*x^>3%WOI86%Oqglk`}3>@R%hLQ9uqDw?|)`F18cIfR#OwT
zzdGZ}+no<peg1V=fPH0B-oKhO^&v$pFIOxtk50KCHQE2}vlz|<&H#A*ziYzy|L1-z
zScoXvn8F6^4FOo3Z*BFs!0Is|-cCQ`y96?#Zx4%$Z%`l6P-Cd5kAMaR$C=ud24sV0
z79#0Ix=X=Y0n?xEZ0o3bKa?E!bRnAEXZ!WP?+tw~hi@LNNn*dRNv%zX3rzQCNz?Xk
zE)I8RoNuqe-FIo&-(NnT2>q#YiUqZ&rDyEJ6!cc^Nl68er~6~vOyTGzuLN<<Eayw@
zkcjA2&X}sM>G@*n{OOkohbC{zpy?M+O7alr>tOs^l9T1-7$Wq}G1#NenXoD#Sa_4P
zYC0LYI*-L8x+WDa|GUnL^c$>!9_^qucY2@b3z1ead)uK}Pv8VtR79rP<q)EDi@wP(
zVBZsG(^_+upqdv?3`=(BTu_<Ky8^}&|4owqlCBec){gQSrp)X!qoVB}{|o>kP>+x4
zy?jDeoQ4P%D73SBRMq@t(&qWDhtYfW@0&vl>+#8|5gSLzFKTG}i%;fH2*RrgmwhTk
zwBk?mN6oK}$v!C=F@+p~hJ$YYdsd)o^v1)K7dpUjm%X8zrF#F2`}11*!_gwapx%4Q
zI!nL>68vYOz(*g7jo3)5!lce8wdx=z{Qt%hDGwD1rauuX{PsIbHWN3SG|BwCa&Mc_
zsb#$~JA+s!o(#N)3;ef;XE%|<T}`#3U`tkC*Mkr*_FBhiop9A;SmVLm4epN~{oHQr
zDY@X2e3XUG#-@(xK`%O$pG_wH*5y)f4On+$R3K|x*s7|>CA|p9YA&N`b;^q=^`|9o
zJksxoMftV%)uH`&6jlFT(gh-!wta`u6%yxZd>Y4&RKQvtHEBZhUgHTogtnji)3l0Z
zz+OA3qPOLuCds(Q`nKjJhb5|}HThfKY&#m=axSRbu&J6V!Su<1EI;2G<a6{|H(Re6
zbD&(#L`D1GNst-);u`gucU*O|U$Xnfs%9|7Q?-^}Inj}h+CN{5G;Z{Z&u#$-Iq=-V
zK;uUHqc2kQ(aO!R;@2{4l)ylsNup@^!}wV4?A}4R2G6CH0}~ZFszsZ(?~6B-t(S32
z`RshSW<{Tzky5mNn$&DZ9_{nrQJ+7L$&H%{oBuHqw?-Xeru(s{h$5hFgvn<V6Y$>!
zVGuDE|JL(+1!OwhBXl=e$ISI$c2}3ltt;asHvCSA>wo*D%#cb_b<y+K(LTHA5sD|?
zx*WJU`+nAvv|NQT*XZA~94(i|;bS!7Ud8_SWv1RhGhO1*>R#~kQLPv0jF;QHd)9c)
zy-v^oW-{Y6Z@E_a>+(~g>93r*<yr!#gX7^KvwcC}lF`m#HbfpRedi_8rYWdD4l>gf
zIL#v?3S6Cr_OfPHE=lS>8G1x*+0hzN$R#PuOr%ZGS{m@Lw`ZE-QN{CEKJ0W+sj^|S
z+C9gURk}qcBANg2x0*)D66NzA-XFx3J>2>gXg_-$c-e3^^f*z)5;qsiyU(QaEj%a5
z5i2&@$Hb1NTb#1Y<(>nUWOG##4=7UAL3u?H_ovna?}zurx2+Gpv0GrhThQe4%J1(_
z_>sQKLWp3_<3rn&?&@bmf#)wSqnZu5U-V`$keZo4u)F7*pcq0QQXR^a+G|tWG$be=
ztz;J*<W;IAO7;74Il>|TmU9qh=&R1%<Zu5)C-~NMZTzbu2jBUW3^$7XQZp1+oX8tx
z5~4ye$sd<1YL;zq;43N(obRzg$nIJ@$Qyb-w2<U;%<GB<#7nZvW~;#QT0%UNfUa(w
zwr(lHFvsgvT^}5?kSh+c0XARrp9!WZ5=ts=CX5k}4d`;Gqa`fwrxFwW`PY0TLz(;5
zz=%J$Q8#5yx>#m6O%tUw#fvAsq`UvD{&upW(1@Yt-5-6aV8{!Ryu<;k6X|q05fUQ(
z2mcnp;3>i=V!pi_qmR?zHpGx<aHsOx714at7j=fVB8>@E?tMhD<d^g!OQ$nDqEm&=
z07wFv+4NV<Bh_-{9#jWLjEv=ZJ`I%r#}sUI_Mdlk#rIL1H|6D#Fmr+4KYKv*>+Qc7
zTU{(WLo+TD-z&)VZUc8`;2P0ShJSIU%+9|zKe^gLE~;^J_w8c})fL+QyBn^$n2zlp
zA0c4=0uzV_fIwO0484|-Y~6SIe#k2Y)%vwgc1nH`lwF*I6I8E$`>$1zuk@WGSXVgs
zlE~Tz{-d*ewt}18zrR~d*;=g=h>6sNwfh0zejED^tHRW+|LNTs7t@6Qy=+nwb@^Z?
z2ujF!^w5QkIF{_cO$*n99?0}DZLrV(X>$2t?S5DIo33UjtoQBN#>JnG*^Y`7b8EM_
z8(CBT>>WFJki10hZtwfTKYB|@_(9cb&jvfmD{k&^v=N~cohxy!1>s>E&HG_HGYj@?
zAK&6|)51Q^@V!_j2nMeHbIVudTtdIah?SE=ZS6Ib6$6*+UE2rkyF5!`nGrUV=b=+^
z)`xL!U1{%9Gj=IH6~2B88yAXanjUI;kr3b7|0~1M&(m@Gc<6MVLrtoO=sWS{HtvQ#
zc1I~$XmA%a-PU3tdBt8Fjc%|&e#toA4_C{S{z*8(FI90UA;wleR-oHw1lSun%YI}+
zdm<UB92&NUqz=0zNo;ukIgCa2+dn^2hO`xfD}y+W5=<mg+=PQ)5@>9~!oTqQ4(Ex6
z%T5X${Y{YrGovKR)C8p7EGtYP%xpt)wU(->*jSo94}}e{);esWj;41e{Jl`<rO~Au
zSs(X?t^;g>H?%B4gWK=mLwN@=RyCzN-{ILnNLQ1CJGPJC?|PnKw-=&r7qh#K-Ki|%
zm2{o6?3;&*h@K4)aF`RCSp{rZ;l(Mv07}IDDT&S9f9oX`OE_-s7~rB@aj$dd4!@WB
zV#$$Z9`i}rR7OJRykCzU-#cne9sm5aa+vLr33j=t0DkdXuTnP=W9m8;UU%edMHKnz
z^6r15v#u&1c%CR3->Vd1X7ssoYCc!IlIdBO`ovIp9pbBJp}gnT5-Pb@z?3uGk!4!s
z+YV?8rM;LudT8wg*=9MkN**xrp9(+MY`Kwj@1M8adgtF8U^V^DLsvnxbAMFvtcX`6
z!6RlM>#5VU=Y#I2qcu)`2Tfu;rsseA6zg8rB_&8Zj3+mti*~)?9M?x8XE09!zsUT<
zGU?tYG@vn|;$NGg2V<wUZoczeLK(v`YV3o<d?l=wRpweEB!va`qNYN#!txR*=y^F4
zB>$*YE~PaR!eYCY(^@9=Rt@NfvO;zp4u~8%)!VhJUR8(wyPpFuj~_KAY)v7b6g2HK
z=>Ce@xIM~%h5?E7E5(=PmMxW#f__}Vo2%*|TQLZFQkeJq9So4Fmav-|an9UK7*v{p
zo^J$M(^Ndc8!P7tT~)WXxm0h5EVPYsBF9E^L{5(0zvHWX!!615tuwg6QEaYcVR1Nq
zK!obIO%~1ZPq%h@*6y<xdqcw^x>CupIxcr|zj+cC$aNt+zQ~y`{D}%@y~h$zcLxEI
zLJm@)Ku-~AOSKh-LCnFhMRaz=^W>WqL$oqElENA%m71XoU$sTekKK1i8`g}!x0+M`
zF`6~q-@hHbh8|m!F_CVR`-`NZAAji4y&eU*jRo#Rgf!q4kR;elh4~ycsZgOPFa<_F
z#(}`)w$YDm(>eRdA0x|LZb9;l4VOONWTaSBst&T3JiijHGBq<%bR)}?pLw=eX+dDD
zc!9h20ekmv7hZk+=*3FGPfV2L&vpvT#>+e%*XKUG$B>c~vZQ?@u4WN$$L_XN(ZI%O
zBB^J*dM^fVAD*!O&URy#xlQl&`{&kP_Z>BEbCnwBhAnv_`-&px2q&ZkQWZ9S804^n
zn$6q^_e8>OJ)f4UEVp(at4mMLOcq+Tv34+vApQfS*D{9L^$IWSr}U1!lygZa9INFF
zA3y574??_VMQ%a{*ohK_O<4P9nPGg!!{_E6!TfjC4Y&LzhSB>eODnAY0iILA(03)6
zfoQhO>y(yTjT27;ecRL(12GlP5;Tr-9wxrN?sC<T+hN$sSFF8{S-J%+lk|LCKtTL4
z-(hmxRdo*Sm)!i1R&FGfr~YJqt;%h#fuDt|c0RcN=kvo?EgA@HRRiEYZ(f=_s~4VL
zq3GfLYBDM9x<NyOg26--&~GsPRg)`0Da2RR)c_B5{4|JW$g8Zl={P1NS)AHQH8t7r
z4TIq5PhhTm_m)|vrIYQZUSq80%`l7OolOlc?(gX7wD&~zfZ00%445q@@3wpz<w8uE
z=!cF1MZ!kL%*T`S3_mUjDLuAcxg!Gs!dG?ZqAj<(uGiW4jS_X%5k)M$cuMM^xU!*D
zH(Sd|x*%7!u}E=F#MPgkag5aW^1+Q9G;3{$4rznLv&~y?pB43&zU#xj&CX%^#H77E
zJupFsQ5(n*f9fSTuV=|OKb)=;X3W}+{`y^%zt?iMA>H+pLH3Wt*c#a<Gt!kU%2EVv
z?9ediX&{hr%&}*&|Bn_xVneRYKjY<uSM(?<)z6M#@NzZu^<|7o>Ho6C?&Yj{FO|47
zxWY&|;={F^oe`8PG&)`*_~14(Za`5_Csx8Vp1pK0i+H8U>98gkhug%<KDk{V+;vi3
z*XxXpieW4MF{JwQO${$Aax%};k)?6{@08}2mIRz}cW?F#HIIIf<g{*V>V32I#yEBB
zjVv}gt1+#t>Dp{7#ve-}_m&DGEg94DygheE#d@vchwfA}Mo|iI9P)nk()Sj>HDpT#
z-BECQm#;``98In74}E6)VE+1|`6BkyAzyLOdSp-=zM(E0neu6Ua<7bpAMUoGv%p+g
z%9pUNQ*T4H9`U&2UZlc=DMd&pW&FyGx(+4Fo)`3O6~rmT@oNBcXu~(B@NJW~wt=F4
z9nLrWsV+4aTH-+n`d{q(L;Y*0@87ReH#-bpG#>0_fcg^Ihm3LsCcfnG3@&#ve^6t}
zW#b^9d%Gj3`zUXUH)FDPE%rvGLCN1-eY(|>yA;N(w;A5+|5A{UWK<}im|t-<4`OJ6
zu)^zeL>ChM4#%Y5(B=t)RqZ1VA**g{J3j_!oEyTVPe^|!O~^~9U1|J5t+>zoafx0z
z70A(EkijvN6G<&7SH^OK!uwKk35^e9st(8pS?euMV-u(+MJte=j=Hhjd=Y8YX@>&}
z&L}7c@N<JSW#WG%(_N<MH8L=7aUn)q+z=CcF`s*W$Uk7_t?8<s#}i>f_iIu%GJK8X
z-q#0AdI1bd@tmSxG8=w=YyOl+374<nD=j<YZKTS%U_hU~>xrsKNmRBZs)-e5eC+E{
zVtlyjzY&y~Hfef4SxR`H&QPUpnr(O4!5tqc4iG*Y$6!~3NhXBpyJPu0A%jIq^O7(y
zd9PKn^EjRM-&;9`6lVSx@AZ%0_x*s$X4sk<-I=-au0a5N!$G5F!0@Z%LU;!1{Ys5U
z;LGcU*V~`E8>;mbWtV4PauJZfE2bl5dupLPn{p@ei%Dj(l#7UHkFL<9@b8@Yh>Ylx
zd+IN}{Yh;cztrqKtZ>wN;G3?2$!(k+!4_2RJRC157wV<G4|?UFMG>I1*CY?q!}vae
zDIbjFz^=pZpB}xH&d4KU%yAC?O(qDkk^L40_mdhH{rU1haNjGMhQ`L<plpxh1`&Nq
zGFYW<%Wpi%ZEvws|L2pe^P*75O0&;}#$xm}bua)wWsZW3UD@YU?~TGLrz%1A{?k_K
zTJet-?<6v`IQ8r%%sCC`%D*Uj6Df4(%H;HrsQR_hw|Dw;oL%p@Z=|L%NH&J-Fh2JW
zv411idBbkm`%i^=DKw6|T>7mAsw1E;^ow5ybX0@8FQtLRn!5bFcFu0X=HwchHC1|$
zX!Ck>G*KDfPAp<mcBH1pA^axy_YIM99PIiEX-ar(GOezw??Z6ZJB_F0xjW1sm)a_S
z+*f}$P@weoNK5}(d;F;Ua<wpveD2-CnD)4krF7+&{Km&-;Jr-o7VvEN468y<Y1)(}
zuU$B(g?xAK&%6KdmXDWORvTfb-@u#rI<zmKLzd+hCn$Z3=Tl}_udq~QQcTXn$Db3@
zM7DK@KYe!dQ0}!o6533h{jhFMH*)&cVkOE>BRRH$Tk225&K;MQtuQLRc()7q;Zui&
z?Bk+PTnRkk7bWs7RKfql2K)lJnB6Y}89aIIu*0a)Ay)&3sT`*Kl!Tzg#E!FK+72=%
z@d-6bc;l1S>#?fK`p=JC?)?bvd`4kw&vaA|NpCbaM(Z`a%15&uCdisgx*S|@L~As`
z=H17N$&u?-Aq7!Gs<dTcr$;FyJ`#vcLt~*@!?-ro42P;@E79f+0M&vuI!lQM?j+SX
z3`a<VBCL$q8FjlBpN#Wijbk%!Nxpe!=OIZMZc8`P1}eGZ`A(z#W;C(hLUfH>CDT~%
z&reK$#yc)-d-bXhxA{bm@_hBA0!+2<FV(wtKc)7f(t2Y4?#czq7V?Go4-gt;DEnpt
zw0bR{`ZU~oZSzzw!ZoRloU3&=RFRwi^V1vZ4lmvFIb0Ty;<u0e-h^wD9V@_RGd(yg
zgnkGXhLBT(|9VqfmZjFtRd2Sw%#Z3{wzge6y4Z-TDo_IP?p+)TG{gj})tq6YC4UiZ
z(p>IMMc89Ki<e*MfIm9SAig_iQUBQ+jT<GLg%KWf8Ritb1@Z`<*|w|Ex9ZMO3TXq=
z9u(s;Nnc$e)M*TOypY*`Hr9~cMn-hK&)CvQIyI%`N<Y8feiS2(RohD6j+i$Lor8Yz
z><X~4k}z^A5ldEc-dw&>V@K|ZhSB~)$(((SR*UTCU&PGQqr$tzDHi^Y{j}iza=om>
znM@(6)~GNYo+FiH0Yu>KRPXZz^XQ?$y!NEoW?XO{O~B?+Kwr(GckQiWM9cO;5<nFa
zg6SK`GgIV+6m4kT%gAirQ8{&8>!WDGC`4k{6Yqt!Qgqk^+b39?&<-ikcdyN@#7gKS
zW_a1I&KJ0$pBcxEJO(H-h#hWv>j%#`*dF^kkLi)y+9)bhbS+70#I>|Q6-}wj-Z7N9
z18sdI8Yxei1hn$SfY@gGh?vQ&J&5>vj;AcfS=emeHrybM;;U9?Y=2=-*Z-|Ii#2{(
z_}<r4@e$b2NX>8|{3w>EamGrKVXPM*3`~DebL6`|r{4OaGeb@I;|X|_?6lI$L>sKj
zSXYS&0$bz4?f2p0CD?m4;OdZ!cPXh2u^7kRrza69CVv_DbNgfwygyef=BU$EJ<Fw6
zDeJ4r>}kh`KL1)vx&1*~#_fXg{&e|3QAL2yu0~6qvh^#=p;uu4RlFEvr^``Pso8s}
zRw^md1k=&Ofk`(p0;LMCGPGp>3YSo<Gi|_!%@@|>qNlvr>epoc?B2|Z+52$)n^7X8
zqTsat!Lqy8``-8IpDC+;sul4@v=e{#k#YQ-F59+~p26~=7UYC)xEDodTj&nR9AeUz
zbw-l8ji{Xgt{;LnKMNjX(!Wc1;Ko__*=NO*nY>%`kkI)~q=cl;X~#uR)uHuTzu1If
z@-@DFP3L0kLVFvz-7jS%hNJ-tvTLISG_%lCyb+Uf8u1@i_NT<R>|{^4k{{h3>!r>Z
zGU%o~m9hHxkd!iakhV9AdhyD4?hm!yQ^ac-Tem6!P_UKB_ZCU<FnpAu!7f)vW5dAx
zbq=%an0hX<Gy9=)6+aMr*F@a)y5qh*8*=}O>0i=D=rD`4&{_WyN5*q8uQ1|g*8!hi
z{CwEmFJDjzP(58=NB^Bk5yutISPfyhRT6gGPWC--hVq)b<oyfYJgmQ1@m#~8Kfo~*
zl>!-aoT-!?chJM<B5rB5CS^eO6)tk@$c$!N$@TdadzT)D-#Ei}%ogpZn8)|74)BuL
za05AqMYgu*{mj`aekIGLf`MD)LtIN<8OhKd`nj@<0r`xcwCGn?Rc=N()A>I#V?a7&
zy5(##k!5%bKT)z#Q%U}^0(+W0>{oL3_NzI`0soQN=Z>t+sd;mnQAI3C3O-^aFRb|2
zVa9GsRElub==lwjS2r%_6iYqP*KEQDKe!XUv2t`_v*Ex1qka=}qeNCNE_f8Vt`}p#
zzDC--l$q&QTfoEnx>LBiO02H`n@BOTs64mc6SNl9yxw~%rQTJdBRNx{+Q~igO<$|Q
zcKVLYC!k*T@b^@yJ%`85@U$J>XRuQGDyHr$!8FTlMuLH)S<e`#oQ@o$s;)GSK=C@1
z!qsj9nj*QM8Ftrl(-ISX@JI2-M^Agr8JpE~xSGj(y_d8wc&*j9o6bi8{46@dn<Rh=
zws(i(8=bq8JNH^7hQr0SGSs#tj6EWLpe+%_SIHVD9}@w%&C|f;g@zA1DeL5qmmHvH
zTWs!Z58-sOhz?x9q*%NY>#7@Le&wsbK1b()OLw|mj$SGmj*V3@oC}c?y%GehB%ftJ
z24vrLj)l9k5%tb5A3uu1^tc-irhazZw{~c>)X5gG`>FiKdybdAsqjELgg)oql)Uus
zy^kB6w~@)aT5yWnchINoIB=HlTUs%c#2@!0yvgX++8R=gA#y3D-%Sq|w|4%S>A`cc
zE#^UPvS$?LBuqDBZoKWo#GsAsR{v}l-FD+(l4%1Hm4|KfxeJ`Fg6*1P`D^WzYYSQO
zb9vEYs7IEXpLh>=*d)_EilZ#Z02R=0J};%iN+^_)?p|ra(?HT(P6c6p<Vm|BvQEmX
zKFv6HknLR*<rO8b>dagE-0hCPKSyq@-hd8L@Cv+f%4ZoeecJ67l(P4Z`;5_uD6s~z
zJVMp7by9-8*?;#VAa8tk=H41_7M<1%PyC$ExHP12U4@}td9#u(!)hujbF{@(+&?}v
z>|=NSwnZ(e`k4&9|B><Mj+`5-^&gkc%UM<{7WHgdm(D(n8{l*$c85>d(VzS{ldt>V
z4Qu{Qrd_-w0qaf6q(WFAvmF=gO|7zQ)^0v}{AxiUC-!{~>$O`Xf!u&Ko|zi)mz3O6
zmW8!Et}TWXw7t*@?X_a1eAcQ*CNKEvzS8^s)#-pxlm<8E0B(KW40^_SSA*HjHk^NU
z?~1_dG){_~Ut01O=)PXJ#6jNlT(+xyq2*`BdjlFHA7d#-TCUj=(E|dEjUYEC{r7AQ
z|F^bg3(N^7{-wm6sgBIwZVO^Uqcu}LX<xm*g#EbU9fh7zZFpqQW%O*KpfP1jR9xsZ
z!`a7Oap$@uM^E!ZEk*mf)<|v8=-RjL;+y$XlA=(NH#T!Y#DLJPPX!=O99wFoLApj+
zDY0dR4jOFv_}z*@45jwdZ%_Si#&#T%%wQZON@FW1f*IZXGnbG8?&D@hJ%0JtQ*d4l
zDwV9r8fgmpQ4SxPcDjiOIG`i4l2zf418x;tdr3k#=BxmudBxs8OJ-BKpJSFdDy3@=
z<Zusv2r@wO><u`J9)JG1RxjXYb4+~w{ges6^P0y*k*5=frBLu;XFlfV^}<<epR;Di
zJ5jrJn9Rxk*Z6IXAC+%&ygfGqX^}(r{9zWaEWhakjCnv?GAd>{f|-L;$<l?R>+>YE
zIOPF1S(NQN62(8gce&QRG(_7)B%`XvO_lHUTYVhbHr>5zmcOz2W$AehqW=#OT^DEU
zqkG`$M@r3y)?yD$0u#(QAIJ!)m`p|td)j+yS~lTNZH4aDRDRkolroRA`c6g>U3>bC
z_sa{Wd@JaWcXRzGDvF2|l|lL_G&#KQFl|V)YLN5Eo6Ke9eohv)9S!=|37vboR3R(F
z)FfSRcy1WxGtCcLMNavoW0oWsQ@||LEok;OGQmL0ODBtSSr~$U2(Gy8yRp*QdlLal
zd^KQ~4!ib-{#)<e7jOE6`k76|W4w#o$Qobvl=e*ZdqDc!YpQ2uYYGxHnN})>TX*I&
zR@GuuN}p$S)eVc<1$tVo9X;U4U-ukt{cT0W^WsU+;G=74zYniC%6hY)LngdBe;x{T
zw<!lszx^LAz{Gl(S&EhM@sGXWz0P%!zxAhi-#~nW%qP{<pUf5r(u};N)4e%*LP(B<
zUU0yq^K`VQ|BRtzHO$+mV)#<02)p&ROgFeZvr5cM!oK?F0=b>#w<opeG4tz!DKyQ2
zQvru0F_wO@+cio8-_EM~+)aN(R4grO#CI0Up;}7(H0k;=Y~S^@rE(n-caDc%gUoJ{
z3fWlG)jf<!B5kD4o%zthrt$U49Yi9r2&1G=2p2!KbAsCm5IS}AkHwRQ1iydN2)=bM
zk~-=@pO5iNdE8aryq5U;q*tb&$hOs+v;=SzIjw%yi};>7;Exc-??`g+FBt{i2T1mv
zQmW1>>s|QQ%BhZ&hD9ur_2!qlyQ#!RM6EZbiOKjB9yaq{kCkCj6Zl>Bb9Li%d6R^i
zQuvu{>l<m&7s?D`GgJ;UY5{i)<?C>YszPzzrY{<9#BwyJX=R$e;l8OQV#xWu=lxG}
z%AnZ9{K^sm)aQzDVLC?kXx3ETS-E%5!F}&!9>_ceHY=q~ntSJQU(S7s;i$U@krI8*
z{Jmy;jO~enrB}&?u6~m_QeSO2wln5*`PiP5Go>zIe=BNDzJd&YvG`ftADO5U^vY7W
z&T=WxR;<&b>Vo&`vn!W-h*gb|SGcu&s(Yhd|6t4P8|zWuC!M~#DRc%O*bu5fm4)^?
zvHgxEYcM;^Fq>xyXaWsp3!^P%I{1<>PB#u;XOWO7U|dbrcqnpc)X1nH6bQ5ye0xsU
ztQkh<RQ%)h{UzG=>B#(NJ4PzYS4e$cJuXhp(|m7oA_?O^du{P?rrFl2n7desvKpr^
z-c-6@1T<C=W{<C-oBuZUO-m$eth2H0aIp^+B7u0G29(J{Wh{R_>wIF6Z}`YzAy{j}
zbNshU#QGWW>&K(*>0K$c)-yGr(ccq})H8OVBrUoZy7J{@0wtY2ABA=AMQF&fyjOAa
z^v!V6`mQ<g;ko!9DHp49^=DNF3%;X3&4^a+Nl<=v!FKii(c3bL2?-1v1vl&`{*LAC
zhm&3B=xgS5ee9U8H^csAA=ZlOrAFNSlt1D^5{!}N4!SIgzT7{wyNWeSh=5;?LTS>o
zkjwO<#siyH8`C7^1J`erXAys<?avyv(D+@bq!>3+JR3HlWnaSaXkdeS>!CS`p#5ET
zdZAa6+)wkgW7t_7yQ^4{ZuW=DGrt|=X;xw%z7llwADyTz|C(pIH-+)EE%g~3w5W3^
zthcId(332|iusjoZ1=xObgC-_S$NdiJj>ns>B$biu6`Zx9a0K2Tb-O<{iJ-QvY{U(
z@BSA}Z{ZNd_r8ClbP3We(%s!4-AgYewd8_ygEZ2;^b+eXjkJ^~xza31g9=CsN(-X?
z=KX!1&p)s`GiS~@_qp!tb<O7%x1Ie{+0UR=sHt;2I0n=@$5!jZmAch0uzuz(Z=L7s
z{h&#db|5r1j}vZE%+uu(6^^N%pY|M+`Shh+*$-y!BO^%SuBN*UFC&TT6trR?gFs_6
z4wsiir%4<h0O!&iwiK$d`7N$0nJxeY2r`q>8;^`n7Q0hQ5?AA|I--Y&uh}k#*edsu
z)-!Hfp*zcae4TvrIdIputh)v?L$-EK=Rv`w7KiR*9aC9B$=v=WA77k4&YbFPv`!>5
zc$~9XTyOs~O6o#J5z7kbWOj0=s2N$GAXS!1XpI>g5pAod(-{K{%*{I^zJfH?Sv==w
zY!3Mo3c|kqBCmT25<1qdw`!C*RKMZI((+^xM(SM-J}>a%=A<CG3SyS^vv?y?<bA62
zk3+teFic*i!E#jtWh~^SB4RUg+_-g*g=8&Kot}d%oaWEx&70J}>Pn?P%!W!yv62N!
z-ie~0@x;?;NlL732QyqAfA5La0!`m2-p$sOjYVdiKHsB_5~LOf5WQz|=w!0*`9njr
zxOe(%k*s&sx`sREW}@pG>?k2<o7&Ac=I0^xw}a^77SZXuLJKZT(PLI1D#c5KPyoSe
z#&$eEH-!lIu9!X`j=Z{JJVzOnI`(;$5rdSZzsCDk)1T9KU<<)hY5xAZr<WZS-wqSF
zdr59=jd*^?>T9cd?!n!!T;fObhdSXU*;aJuaN<o8`{SOUS8Aa~ACjvrgFo!_lolng
zZ)e`_zD5jEDd$_e>QC&k9M<WSnm0R^D`QpS01XQ`$Io~4O~Qy2Z&4KTkf*o*3Tg9V
zQ~vB%XuPX~G{xvl=;qHVxJ0?w5iF1RS&6fpq1`h|^C_l^yfEO!w271%<!^MS4#1uX
zz>(<lqOJ>Y)E8zi@?d-06LI^{)OvfYcl7KwmAh23@d6(!9~kOI?FN&Vmi2lC^tvvc
z!IP($&-s@tzar%eW_Suf-v#>Vf(}XghFX3)y{~v{%ZE5bLF780I~T4via292CpK$I
zIQt#a<dv-&P&bJxF0sQxPnivg!?=sY_(Em8UG}pej=bVAbbyi`(>!^N>iFwJYNvSQ
zIhz^Vs(P~Yu4bLR6vW5KXxqAvKYL+UqR;3|KTGV7LfSZTP6vC@%tN!l3N@APc+Bw=
zkU+&aRXyH-jKhpgr)AH=lCkiFvJ)GKQLDGpJ{cAdFq9AwN9%jNW1R*CT^CYSoxLXE
z&G6ZQIt$_Q0z*g|!9%V0&K;P6oxA+G>aEOt%u?`S1tQPPe!Cxba!6`SzrLd&u(e!b
zVds1o_?dYwwC>yR>R}{qUAkn~|NpcaD%-yebih1=-_*~jBiqZJH$#4udX9qK6nPI}
zo9w$aZ5kXoKOWPnF>s1+cI<d~EG9~z_XRSSaneuXuHC}Qs2zU#90T{@fp*r~@Ar=4
zhrgc&{~d=y0;aZSo)`!eYUph_8e?O{(Kj{<BS?d5IMS`5^*o=`?diwbJ^0Eyb*}_`
z#J~z~pn@)-Y;o%sn$G)b)}Q_PnqC)2udu0Z0UgQmo(FDtkujzlF!LGrG4O(X!Oju{
z78V@*=j(xOLAmmF*n0y}sZR@Egn>B|^><)DBG%|P{7F;mX;{aL2%PszbAQRF90)UK
z>KC`*=^Wc7UM9wyholiEJ9&4%Ugz8oW?<a<au&7xv=RH?`#lQi=MT&l&t>6f6m9e!
zycK>)=!hb_r4l}C=R5T!13lZfZNEH9Op5IsV?4t5vmS!J4(kohpBKgtQ?ph>mY8P|
z%)LS7A}ynjGaqySRtp{q4ZzJL5gx%oiOaHf{hh8dp=<2n8qN4-;MvE<Q{(vt@2Lha
zKAVJQ=1ZZv*O;buHSK_?83H==8Qa~W>iQY>%+E0Vy2jCh_hXlsup96*+KvasAN#~z
zN6CD`o#MbAOz1?~z3PLm19MD$R5abXLKd8OgQrX5#@OXqIjJ?E7pPZjORbb!aHzM@
zkkih&bI-U^HD|&nE%i)cdwp%rULczT7V$4$$MwhQwgb1@%-CmVl4ZleJDIVHm_F}*
zjbY{s6vF0uK6`I|ya8<%n<t}S^XzveL(1U=EZJ;nh|kV>%|9N|KC|>WF+Vrte&=FQ
zqTP-Ty)sd*JT%2c*w&%%ig0k1Yo_+TjCAM`0`f8bGfjNxH6=11ry_h$(p1CEiJ^gE
zg!+{;-Oi}qy!&@&7ohZfTajw71@tu2JWVN?G33&6^9WIC$-J=<u!^Yp;p#=6C{ZOG
zFyN<crPKcX*KLt5k?IF=(QISs_^z*jY=C+4e%HKXED$>JQ@l+&pXg03OL0>uKocC6
zD<7rq_vEu-EV`3Z-Me;7)!JuprPL+0AC;wrNSM<s--Ij(dR5AZQ)$kPZdGw}HvcJO
zd8qsotn#*G1Ygym#E1ORnH5UnTQA(PhsyXs7x5wBIAXCP>@>;QbZiH`$Irac4b$%G
z2|<_1%6b`&37hcsd0uL+^*HWKvXpnP2R4wU;?mCOT#&4j@_WFXWio|-9^gJ~njuX4
zP<HIB>pR)to^cq52=KAqo;`wZS;!Jq0$0tT|252@>g2wd%zRN`xqUc$Z!}iWR+}=O
zuacg8N-qE71$z{IeO@AhjxlcL>dBJ|WjT+0p2?A`is|?@tL~>YO|Re@2PGAZQqAY@
z+?AnD)aq|1nfosl=dOlUWt}nQMCi?yo?}^?KBL)HGUoDGhSPrV5ykhJRv*63rd{q%
z<c(M_5=$yaUYAhN5TZ_P+VS$=*^Bm)T=iHfzQ+K2<z!56FdNpK!tLM=f}x9*vN$K#
zH2cQ_kqDx!8Tqij39Z&|fq&iE>gzq)YN_pBqlioLryFJJ6P;P@Ca<sq<rD9oi5$yZ
z;(Y#6!0=rMqrtvJ?#Iy=@x@G5OH&**^i7j6!|?9#(|ZfSWg7-0fjm@|I+#3oXm2pc
zLser|j_SGyeP=SHCv=R6@P`$Ozw19a3|@i4qus*ADK>pr=9m5kR9%{{q)=M7BHDjj
zDPjuqmcDf?y<kZ4Iq0%GO^Ar$sC;iWxziLg@mU)}on|<K%ok|wSDuB!=-zZ6dRp|<
zo6>ug&paU=^DARZ88uZnuz@CG3o$JO2d3$Inm=N~<pG?0?XS%|qF#oumkOD1^acIE
zX|UbMkL&6zgjiE0ilS2(^kuiKg$z9K%Ro45G@HCckzc!SBU#7IVzv(n)6J2Vc77d(
zw$GeNt2|41bb0}BT|w7vjsjYN(BmvJvv{mQVJ2JVm7lxYGHrf2UHaY^2mQV5@9?|X
z7RkQD+jmd?ej=+~8KN*M*!>(>60CIj<~jd`LGx#&CC(t*)Sc?pCzwxJz77hC?4?~^
zRzh}*;)2T>@1y@SrW&ep&#}L=J7aB5>fzS4fO_++VQ6UQN*2%F<P7b03832)`EtxV
zV*G~_ykf$Y6rZ+6O2q3ul182vr?&5bi5wDp!L5Jtl$}U9Qk_C9vp95<94iCyboTJe
z4g+9WoUbjpe=?P8dVweq3N%6@&+!)ON6(*PzAg5{E3G$l5Aw=NfLr2%?-xf`FV91<
zV)qy7nGB|gD~1lX>m22ib`#!qrKx5aOX9RY`jF^Ms}(+PZYfoN(G!vRW^GqEj{=gD
zha|=`U&}Ni^Xf8qyYH-Hs}cc?{5!^sZT8Ih<fGrcuX-PK*Cj+SjwrmtPp-yT%2d6V
zI>A5rqX}O`;Pz?G)XKbHx}?W%5U+tAZ(B8EuOkCXQk}}VF-v>oj7Aj{5?J?2tcWIP
z%TzsQ%LbQJb$Ngj1n$0O#zF0j5>9tODWlZ?bCG)+QY2<zD~@g^Gav%_j(@<!N{Vy{
z+pLZ_lxq6^GZWfBeGO9h@9p61unErUSoo@mzS3WiJZSBgEF2=Sa+nv-KAF$UL+SFG
zZ%_2goE&Mn-Aotft>eGp6)Lxr4Bt^db$?e=EI3N6#<jr7pXy<vA|8*0FlBvQR;!!T
znx=<g&)_np$de4m$w4MfmnR{&&#t2{TY6f4RD8(_x&L|}{Swuu_|l$<mMr{xn*Dh^
ztFC({OTnjHS#rEw?7_zJD>swjcZXu=7oX-7f1@mPAqeaV_m@4xymfF*oBroa^E`0S
zPn%>F^4<Sw0f$Z7OPPwieisgWw|2kcV-AxHavBwvKvi#s#=%`DAO+LKHWvE>XuTG*
zZ8&!UMpL}hYf<7oTN}p$iVx;Uhw^YRCX&dZG~`B@jftAQoT+M~TO8?dA1Y#)p&1TA
z$uiAOGlVZ*RPeqgZ2S{1G3)1{Q7s5hQJu{VTbQshoM};<(vRmPpIW1|liCoOdzMJN
z<V!UUE4S1%2jU5kdM=y-q#g?aneS|iQf%bg-2JU1jTDpxV+DU5ZaYf39lG|BF4fEz
z?}pmJ%M9PNiOgKQ?eG2c+wT&U?vXy;rdC>CkMgiaZLz~uokz{ZxNXzO2jeH4oOBBi
z1#ysAv^2-#&`e=w!R<IYW{cW%!Hs~^=%p~Aj8c5t!L>N+k7{Bx({Hy4>?ire6bEKJ
znsf)&>;WCx$3H$xzdK+da{kW~YSCoJG+%qJN$4$i{4H=+2<(%(U(?D{#p#yHpjZL9
zaBNENWUm*)SZeL(6`R#TgMn4}OUoJL>~EuJ&&wmNcSm#D;f<EWUhZ1^a3|0eG~h>O
z=p4J3j0VV~y^{*4hT&Texg}Iq{4hIZF~{G;CE@!fjt2Ufd+8}m6HepLcpLQesIOOh
z8WSHNA*u4`WPyoB#Yrc72Fa-&y(eGA9Jrr}c=5AQPvG?}q)wH%9I}p;)U-JzimhGt
zQ*w5gGe}XPYB{S05suwSn3;^G1GSezZl-4z;ILHoQNan<QSk}=aG&#YqjE)P#9pJU
zP96032T4Ce=d0%%P)`3517vNmYcXmkFkDNl7GK!G@Pld9)ZwQd7c+fr!E{i*IboB$
zbqt^6NhG4lw~R)zi5}Q2AO@TM!&{js=eYn<HS1(m5w9oo2A@UdzSVW4;fXFu7El9|
z&>i6*CF)#AIeT!SAm_2s7V#R~U>Ol@T#A|+r;);KwMDx8D3&Ruw*L;o*Ag%FKmZ+_
zOxk)k7rh@4n3n`JsvW5gns{ZRt7ikF7P4~&D-pRH6Fbro4=L;geXi9or;y-eLGb91
z+B#FR7T3y@Ss()?s7EjUsA;z|T@sxV01HE`GrMAO>?xN~rFBPk;IIk!K~$qRZ%*9m
zFOLQLrb0aPYo(CcGuNPy*OYhH2iL89lg;0IUeA^0oLfE39cAb_3M5pR^?Ho%@<yks
zSra!};1GV(aGW|DR--?r^E-aT_o@zb{D>q1+e$~m$_$lpZTDriG+1Gy_1Vl5Im$Tj
zBqff|g7FJoAH&@mtEyGa#zDX=taPwzBffAkGm_tVw9#&J1NWI|8PlA>`rZ>M?giI%
zOS-Io#{aH<u)**R-_a&djS2la%9rMEfE|fn!s4wXi?a{8#rXXro*drXO6_Vcy?Qni
zmS+^$wQ(OW6nP7z#(D+Nlk^r#1l+G38=Xsm!ST*VOFg=JrFK!V4|u3B50JcdjjXnO
zf}BhWsKN!>*W8?v-RuOo;&P@QQy&wWn~uR3wbad3T9U2EV}tfu$&Zb)<GIPXZX2v4
zM!y}^+M(!9+jQAj&RV5CJP^ypx?Gl@K8<>YSdoB-BUt|%<}G$5sydCiF7`D4_!c}o
z!+`Qxb3a~TA)m5dQL*%VEnS|?X`AX+I4Vd9ZXaheLbjhR;F-_rKGCVTU#VRBc<ahE
z>%lt?zliG^Sm7j!t2ev0Q<Urb5$JPYk6}z(F6BZMx{Z%r^w)cK;10Y<9%f2OlzK|O
z*P3`o_XXx=XoihgQ0Ge=XG;`~^$F`}$9E^_75Y*L^0@fJ`a%}GIaLDNe_Gusg3}J;
z__=Wxdn(j)yTz@!+ZKA*va<4Og2EZ9p2r#OG{NVm-|uu~^Srk}lH3k-z2I;0c0K5i
zQ~1zF7Z;uS?lQ05I|OA&mdjYGo*SZg8dwbejz8gS_pwOdx$REUtXoIE(%ceY+B^6K
zM^}pDq+bjbJ5Qz2vUwq{<8oPf{ADCW^_{kwVl=O@474nt(YPXT_1~5^I_{E8`u}{r
z5Dq*rGP_bH#-qFu9MT14>rZSi1sk-Nb!-Q0Buh7YL$+a?h{o7?k75@6fZpA%%_~8<
zAiWxwJ9CEu#D4(;_7L~OKV~}X%01GAf+`b(qC)UwO=XYSi`vw^Zbw~2OA`2jH?Pm$
zmWCb8x^oMgojnMFgjH9WnsjuDI|1!GKY>#}x%tv62UrHGn!YG?Ne;Lqed_{rQh07~
zqJQN4s}Mk?cO>62+4B69WZ9diwD_l)>Db3NPtzbTG*;RGEwXt{x1`POQ^HqQZ)LZC
zJpE1{R_<)!(5v%gp<5u<y<|dSEo3-!Pp;YEN@6(x6Yw6X0jS=CsU16=-*e{_&>T5`
zUBkdsE~?oaPd6TeNU_}=&&)aoPxJS+OfiAtZgMAb+BM#+MV-0uj^3*G{7>^Hh*Hs_
zCOzq#i(RC3K;u^T=3y8#a^P(9V%Sf0YmWiuY%RDU5l3A3k&4%I!sIIL@u;3QdUY!B
z3Mi+l*X@IN?B@hp1y%Sc;8<z7G>IK8xikfsgRvkxvSDUQ;YvE1T~T3yOh3Wpu9Epe
z4uNk%yld{sY;?o^Gg#ibUvEDHz~B%3{JFg#Y(l|S;DL=f7<qPc59ij1Wadl&sKfM+
zwdX@!26gjM48+LyV+aaLZ`g@7%xx9EZo++#KjH#5rf%gr9v)k5w4@Keyxcrfr0hX-
zT-C=@&09r0W~-+#oFsYpg;3AkhYnK<-<vl#{MNBYyrL#Kl@%UpOs5x0Mh4&Kh^4Lj
zNxhjG$bZiEWKR_InmB^M0gE}6g(-ZV$a~<&?D0~W&#oXzlMxM0`%=rm`vz%5t2$po
z@n5)ljTns<nx$^UMV#*s=t0Y1(?uF@n>M4}LK~CtciP8X9iBoTlP!nhSO-{w|Nh(e
z5t0$`A0UeG$s#6pcuezLCkq9$wQ3^0u%a6OW-X0X2@TFau?ciz{4}AvBV!MPa7~_7
z$SL|I@lI#FsJ0=q`^5-EMGhA|={kMoR5aV4kXS6@b;cz8)A4c}L856c9Q`z=ikA&5
zUz3b7&_ai?+<EGFFH*^xf|LSlP~h+&GGxcWsQ)xVY;=c?QoaxRxc<;!R+cl>^*@!x
zNhA#uW-h~JOh{RBlCU~eWmD+G+?zbJJp5@F{cos{jrbq&45V%CIrh#_vcDXAKGIhx
zm8$Cj`NQWe-k$@i^Hkx_e?4De#i~j2()glROjepqb((^f>)lf3-ne?_d%&KAXv}zG
z@u8b1skNJ7sjSY4iE^lRlu#{D@1<tPupely`hDL4{GikQ{R6B{wb{czcD!p$()#Z0
zVGBcYWd?~3F!xId1*wgi@$o;R)Jp}1(LDkdh8Sq1$%}ja_J?wd*9b}<H9!7H-pJLf
zceODT1G#^n%<;dgJUvl6z{#fV`Lz})!J0brXeV#z=R%8uTjE=yEHWd3L>ZJuO^Mp2
z|0NNg`D1n>`IopHx^6y~{98iz^9k?SS&~qVF%+~<d;=MM0>j40s+lu|AajYywFy(W
z_dN^&XW1G`d~D(t-5H-ZZ(lw@3x!HD3#)hXXQl~R&h_mN(cbb{34UMLjI>J6e5A7R
zFa}k1+=RWkRlNw?nckn4-R!VSN4|K7)BdemId^(E%3qM{<dczO9C*mBklLoxT}sJA
zg0%?KQ(-AnoSA23hQlk`^vXYn?yr)-y{`IV`v+n@NV?(lyB6qJbvXUS4uv&+1s-~o
zv7ABkE#@T%PBhDqSf9i*Uqk*9tY>M73Zb2?-ySX&j$8>;p&G(iJ)F0eJSascjFLV6
ztX4usX?-bte?|1tw7L)6m-Z6<YpC<V)<)0+p)#LQfTn?@a*$l1JjA`-gkDTDq89uW
zGpzx#Obx`cE;i5I^>MYHNeb*!OnLmXz2KH&5Nh$}kG7X`bDSWFM!@z1kAb%+{66<j
ztRbf_LW{)>iCoVl|5g4x@5vt>wY)}5-Z#ebh-gxxY{!IntW&G0#yWXwA3sfnlGIaZ
zJ?9b}uuxO}mq-NV5JHccgL|)bXt#YU9Bf11vG&H0CpNjyJ$EE&ipl8!D5a_i3UBr(
zkIlfk7?`BM@-wvtd7O3*&nh#TkiYH)e(AWt!KdHb@Xa9Baf`#&2s2~#zp%_NKeakU
zqMGLMSb6u~U_!=u6FR#O9&2>?s@Zh&>&PtIvo~k2TF}6(cVcK}ZEb7cX<jY=L>@3;
zr+K#Rqr{Tl+S=BWrV2l#`fJn8reZ@*_B$>4clis!VZX$GPQ>wlXo7eCY5dz(83U5V
zy$wT%yl}5xzaH{l-!iFJU*|cVNNl>EE^`bcd||LYK|V!M)9DF0Lzw7w{NaINMh<VO
zC!GS!&8LR!_c7svhL^L$LxWz%W>(@m5j>?jxl~-8zR7>Tz-C`g(`s!)h+D9*m`~5n
zZV`EMcDeS~3QyrUe!EsTK<N<uG@}_2<RRvLiBm2K#k-1ifC)4eOaKz8pv0@z%J()5
z%I~&wA!m>le-?8DDCO+vgCm5b0ejg<;>izN&OG8|C0$38yy^}v#{&i|tWUGQUPs>y
z9G>aCyA(~dA@cApos(&nUvw(mu_1^9$8}in@w@l<rHfAFaRPot0#_=sS}{$H))pbx
zb)}L5Y5Nb=FWx(=Z&};cA~8++|DL{nfTcnTY~0mz@xA&xj*f!*?(*o~7aO8;C<Ig0
zHThI-HMJ>tBNwP-L}4#5679Zq&(SCu*M*E@96Cf12l2&%Rnh!*HkXdBt-dpWIC=d9
z&f|qb`30IOnNoa}n{5#|XCxNDib7!GwKT!=uERokOc!&gM2&``t7U?tnV31OnC3}_
zD|?ISEas?W8>`2y6iBhK_{3`D-<~Sku@ztv57W6^O=$HeI=z+M0B=8{eCPvHICn+&
ziO4p6BLMr|T1ynP9*8z*phcS}B&LgtTU3&AQU&=4;#$T$)^8)bh1xliB_%X0bZ<Ct
zuwv%r+(dzNOn}={%Yh;r<^x{>!x>zj24pX|m6x4@w9|H0XIf7`@3zt7cER)MHraZD
zgmBuq5DHz8ZX?f5GuIWzLgFmkCi%?POA}WZ#EOQ6eqDXzE9O<n=%m=<T<t5=D=ThN
ztV(}g`_ly6<R7cjoe~8YSu$kXIX=-Sq2K^Ao5phfx?*aT^L@OZ)Ve|~DB+p*u>^tZ
z^hf}7!T3%7_o^6fSJL6L!1dCl6PYY(=z6x3U|OmpiCp@ASW?x(7%>p~tzmJf4A)Y_
z#)`Sv3*0}AG9A4!rekCT5hGjp=GK9K;Bx)G-I|%EB<Br!^07|p^ps#yO~i{O)0^o#
z<{QUf0-kv03Q-tWYnN#BT8sQv>XXI~H<1e>?ucG+{@g)DYH%hH{#>2(1PBWHKmKs>
z5od=tNV^ms!i8$2;O00uUGX5FDsi=YZmFqfS@(wRe_FtX8oAk%G<JF*M_9(nDahl1
zr}?<2*^ndU9Q-O6AZ-KdBd!go-#oFq`2QHh3?g^HUN*m+1}K+LDkOkDBzqe;0yt=9
z#-5rz*L2oVbNt>)8E|6F#{Y`tFA1J+Rm(q=^Km%5tyrLek9sbYY7Pra&hU(NtQXbx
zkgpP>1?~*j^gE+`%RB(N;W3}3>)-`O@IaTB{hbGl1Alh!QQ3HFuvS(GzEOTB!+2fT
z%XRX2!=2v)k4>p08NTqOhGyen9Z=oa%5*~4QDf7{tOhsAg{8|fQ#Lp-UE(O#;LO-0
zYmaAS84OHcX8?N)N&86mzn_5-S#|<+%HFWBZ-ecIg+q4l9wXM|^1Z<wDM^M8G8`h=
zu~fK2f#R>_IS6~qn*PL6tll`>#o2b@nUt5FRbXe83ur~*Q)w*=HgoR8wl%oFTDzD<
z$w%40pZ%P#aU^InQb}4|TwGb%ZT%NO^}4(H$&Z9qu+c*}mPj1EvVj_|_~$7x_mJwk
ziij5z=&Ll@&6!R~w^~l)GZT8d$a<cF(d_A%#2rROyV=<p{psmxYZ$QER5B~tn+bV+
zV;w_o_jn`QSAjNgCUgnFXc;&?Gb?I2CrQ>3{`6iU<~40}koG>ZEnB9dCpbw}v(qzE
zv(sx*(VPIf3n<iDrg)-4=Dj`ukR+p{76DvD_7*%)SH~iG;e}FkNvFIn1mMHW%O{-h
zXXQS+l3!pym%dyrF24O<w)5456HBF3dx&*R<3OCZd|ITk^$%;2q?&aOeqSk=@_EAF
z^ty-5b>4p$DvG*z3R<mIq~e_%6(;xH+}zH48uz<yi6{YDzS21A=!ec6BoGjNl%G&d
zuaU%oH+9(F`_*!Tyy;$SMua<cZTw9j6<7R`Z*SKc>DQ2zQfIBnJK_2zl7hH$Fbux$
z8nD`POaE*ZAK)0RS1{v=HNO%7!1UmP7bL+Sxi$x!9FNlGS5SlYPjyI@t4DXP)a}Tf
z_LriRLiL|VC?IZHuD8-AONwshh;e9Iy(4_0eT2$FlfIB*#aL+6XbP0rjpf#i$TCK)
z(M_)y0zc-}EsdBMw-z{EdPgb1m)SnT)A*Z7@<@co!kl(?`z_MOLYnN!+q%FpEFl+$
zyN!FOQpMGuHM6J(Se1@MtEl(#;KC+nWSVQp^KKrg4haDfJ1q}$7VY^@Vl<ML86hsB
zI(EPJX|>8_Y#}C2nv`PotdsY;WIFj@{ClO#gN{IKHcP|ka*WSY#Mf#(+YbSoP$@l2
zstz+<P;TfnH5L|(diGPbc!s)Nmyo7LdjXgGl;qJpJ_FWZqy11FBwkTKr}i_m<q>7#
z!$sXJ$;*1Rjq2>NnOz<5wm0{bb7x7OMNZl7%L|>0puSw{o~KXsCw*<X3k+*I%&K9z
z_*gLoQ<~K6ucyy>G->NB!_6NWom6@fxL)OU)IkJ}ZU-q)BCq_+dpPXKtD(U+Pmjma
zK-9621OwH*{n{9qE>h!hRx5yS)6$mbE?pz&?BFQR&$`Qq{lFUTf(<jm-C^IxaGkYJ
zVipn!a<Z^TPEcy#?Q_R@$axSRtt9UTPVst4goO+%;#~`?J;+~CP2W}dm(>;9&{NJ9
z%Wr4Q*Wj)78&BSMiTQ-a-5G0AG;kqAQFs>#d|CsmiB<3A+ZkNiO`N~?w{o**lLLI8
zx5DfTT=1G)h0b>9oQv~C6yKYSk}OQE;lzP!tUh(1gG>8=nru9&=xi(7MX#nm5b$%I
z>9SRB>c$?}$B*X9)A{6-gw@gr#Bpy&C<G6Bl@k{h)|e$ZETxVikRNpQw{-^)d3Qi>
z2Cs>1u#sKBZja5a+u%E)UR~o<9fVL?^amyhil+z0=wmHh#j}3gZ39UiTL<<qW94!+
z)t?#qvDkEwjNyWs+~0S1;Rz-fX1nBMMWk~U3vAIg{&`vylz@h%J42mD8@)~FpJ5tz
zrWu<(eq+<?kPFo&?KUM6A0GAS5Qi%n5env=QsCToVR004yxI?@3(WkM<(%*+)?w-K
zwpf&?u2$EvbacI!JhF{0)s=bjA}-YGpV<ukX^+Fb$!A*vS6vLQ;j?A%hgu)tdVvfe
zV9#S`NT^>YCi}F2DxV5MR$>2lH3=QZ#qbd8DEn0to|4$zyAEEBLfOUu=8T02-1l@z
zkL?Ro0J_|rgUH!5EW-LN>AKCGwa#{~GJcT|>TTeA2_8WC`fcN}J6Lvl6(Zg21aQRa
zO&S)@cuIn}RKJFsIN3@dD2j8zzr6U;oo(|ctjt{G{eoxUMVqaVclDJzKrjR|h(cb;
z*_h9{>BYSS&GSP*%sY93<f=F8FPV}1V`sv}`6)=>`8Vlv+k{kC0@re0LE^J7h2V~Z
z{WjnoFqP#NLK)0Vc{4Es2_we%RO64z07%x0IB;mGxv<L-Xun)rIx(^TDM!CN`m;HI
z5Mz=RN;CEzW~b2`S+n=9fj*FluY{M)2%M(tXvUMK=fa=i{2H6+&9;Kg@<kohk~9zj
z0N9dmp1@sC;tZ=NWV5RC-odF{Cpr~?pO&^6!)gCDtCUCKWv+s_fr)PzzH(_TTl^NZ
zRS6EC-!AU?S^d3i%Y?$lgNdE<?cv5y#WN$_*Xo6{`=R#6vsZg~z;`O-L#0B#>SuPQ
ziP1(yMMe%tbDl6AYf5<q{r4n1^u`LPh}`r4&ryd9-s30rpc>;s39Mg%xyQju-t@R$
z>48i+^3NrR`(k8>-`}Q<i5iycK>~f>(kT55hu1KMi4Fm0o@v7=25;EJL<OP$%|IO@
zZ%nXHD|_0S!H{6>Ikg}?F=2+W2qIKdR&e7n?HUb6aX*vf7~6~~?M7ZOiyBc4)^wcn
zsJ$+*z~!g?yGLsR4s`=anox3f^A)0-br>@3_OzJ=;HtfxS3Wy)?^*TLIz|5lO6ud!
z3m;ttNe4+RRKaOdQ*w6HcP|44%)jv_6*n81w{<Y>N$?@4pBNKB6?s8DEjZo>y&MxI
zC?Jy1DqjA&e0ObEr~7C(5x7!jP5TF*G-(#5<fs?XcjEJR_K9ki8;=rv(#XgWw8Zgr
zX}GEm481?XfSslO>d8&Hd#Rab4pcC0U~E<3DIl33fd&TCU$F-zndfw)U0d*7TA_C6
zq{zDWRuEQ9((Q&KdVhK^WbFBGXlB`|Qkcx!>oJe~>4S(k@edXW4tU0lc0_0_i<a7?
zu2&u<@U&_m?qZZDVUA1BK&eVGR82Wlzee9YNTIZ->!AFTXR{Kr4UOKX?_ih`#jedD
z0sJkKe$YuV6Q?BLWWZS~q5hV>vlyG6*L2kMZ0G4KXLjpbeliTBp<8*lfN<c=0B`SR
zyK{`{F<?lpCB2+T?i3N!(?iNWI%5ISS8gaJs_x)C5iQlOm<%n+<`mwBUvL?CfqfW{
zp%c~k(VA^W+v-ZClvI(^92;QY_Qa+Zw<2EeayO-FlqSVWp}}F%8(Y{cJKcy9Dw4zi
zi23U8G)opI%=R+@qU^2{X@Bo3K(3A+hG)3XukiV1Ji%gp44nj~*!bRW9dL^TVL&ZW
zJe{SvRb=fT|A0xP275LQ0M;90uP1SkKoTU|p!@_a2M@7Sz$NxVHgc~-i{}VlCw?_+
zn+BcTX-@rae6N=z!bi6>!TCtY^C4EFPo#;Pfkxf;@nP8|HlC4c_azEoxV`|j;78Xh
zskKcZVjDG6Ss}R011yW1l|;_Uvd?qWTGsppqq!na$be(e(&Oyuqoc7jYCL0NAq#OJ
z5@UM4HB1(f`Hqyf%B;&|IEw@E16V7^lO2|LgENEJOBV?zAjbUgWH$q>81r-^hP2bx
z%`t;Hq?yGs%gt4MHTWD@AyeV`2~Z0%_umgBzlGHTkzkEZ9=kQ7Iw?vMdC38SB@@6;
zHeqq+Gvll_?(yV0GO>R$uD0;O#nMKt?#^qxlgAk8+u$1=kop8a58x@`WU?L)g2|MM
z-b0oMOz1yZd;kW=8h#w^eP76gqq?wM2)Ai=)u>DH(ZbLF>%(h5-D9z>18K71;qMBh
z;^82Q1EZ^;UEF*nPfMFHlfug)eI%YFJtUP^2D1#~;KZIirdi99sB^1o%fBP}8UP1=
z9img5-!hh<=?IlO)}MVl`}4i*W>tnEE<FcD95}fes)-aAz<VzFpPkz{Kp|^u7YhrS
zAMjZ%mQTnRq&DfUMlA^t3RL532;D9M>gnLjr$wApap3*xW6l>V?KwxTR%8Pv^oce8
z^w_nM_Q2a3V<;gxSjQ{0`7RvUT1`CRr-oo)kf)vhuQVdg>KOG9EUBg$@xEEFQ}6nO
z(NTmiJ|s+VSi<m>Zgx9YN^?3|Ictb?k{qe4jFMo<Wr=eCe)MLxy@%J);ghMZ{cTx8
zSE@M=LQw6janUB+%%z!mGR7NdtS*e2&Wz!8&Ta;j4SH@%rPGZN1hKuMvwt{8pi17|
z{6hxLk(9OHHd13&9IT#Gs4m)+_%fv(yz^;QAYP8qW?8FF;PVYr@Lo~&(RBp=!zvJ2
zGIPO%RU)UBy9karK?W)6^WA(?R@N*c(BdJoZTUo3G^Y2lh5{G%ryR&#kL=7%)H+q1
ziZ=1P^)U+tnWk})Bj~2FB~yIb;YB|Z|L~M`VWB$|FB?aOFb3D}5V~)5(-dJ;co6cb
z73eI7L5wXGX7wJj<UR15^;29vgQ6#=KMt6m7AsLN@Q8mS&8Izr)CzB|civMr?E7CV
z*!l>~iP`@kS5$z%z+}bEGE{Lo=WcOe36Y23r0BVYe&<)=i^t1Wzf0cNizzu%s2D1O
zL}c#Zj_gM@w6U$Iyx@8<B~pt`^e#T?a31}OrLcnX%C-`<c^az%6UnN?3pbIuH4?gq
zI?$U*GctY>X%p@8)>Z@PDlDDBH}oprGMO)AGa)_p7?as%&{+jtB0kkLP2IR>+NB+{
z&9dd*U@V&cBDeUWK!|%`_+jHsx754ZB2K{OC-6q3EoXbxdFO)JMsd9pG!V{?qF32G
zW2)i#Wq@tP|6jkp6S{mOEc5bBwJnWaomd=LG^@#61L&tk$L*ClL89(%#bTrq9q^Dq
zaL}*Uet{-GI;dyuqkEF@(&y+>>vh=xxZ+CTi!|wSOPNNFfQ3enz|sN|UOp}^gMPkV
z&63MwmNP-b1DEBRv0KJTE8?V&?r{vFnhnmxEJXnhtt9F>F`|n0lBGc!@3X2wD(XDC
z2lZ~&&5*>zHpp|Epq_N|#fRzyD;Gk{yB6~LIaErH8CLNztFY5I3RcFnakoqj3{m3C
zq)n34wx8B7roKa$tRoJaDKYfSB`-Pt3k_fus>Emx3N%+?yqnZYj^tAJFTr=Ht2%E>
zk_APosZ%8vgDL5|LE1VJ27Pl$^DzKR;wwhwEi<zmQQiJe3-~YbTV-*#%?c@~f(HfM
z80?&6Tl2-II5guIx3cK*#!G8Ek~Sxi=#g@G<9S%I$?E*xuL51-iAf>5e<w9YY^CP0
z%`M{E!0TPBS(P+aJ=W=`UAnM&{`<Qr31VF)1!MT8;72RX=dPC*W1-0p=YjQxrwF9r
zWpzbDN>?=~lZkN9{O62iEX$X_OS*nxDRAD1w57>IPH6t{<Lon?tB91_WaoMz88#`#
zgtkBI6hixNm#q1aTp^d?6HeCI;kO0xUm~FttBq`!amF!GE(XBVXzr(-M(yd|@yw&?
z;N!u~$sA^fOlf+8hLiK^EBNLE_-*r9y8qYajQOso`M;{FBm|N5eAqD)xDOT#fDEf`
z6EA_nR(C9Wqe7`d$(0g6g$l!vv~e5B)eGBU9!YIK`|ITuQV`X$lzbCG;z>Fyd#U-6
z?(4P@z=^)bPx9P8nCarzQw!cyeajd5Z%I?G(%cRP2n<v$r%kO>AE=l^*MrJT_IJI6
z3rCagOuWck6_9QEZ$5DQltq%`ge%!>$Mn<55b_`O!8Qu6v!^F$XEhzOp#-kR!dss3
z2N!?b&1YF7SIH{aqtIYZiyj{bE1_9G%!*Lv{!r|bjtbatsOI`ezt-9Jud8cQ-f4LH
z^+043Lwa<BsfPd`sc|R8#RSo}&n7v;eiQZBpsv3AiCt_sRf|vZjzxs@mU)qxG(;Sx
zV8(xOPaQEQ%rGL;YhRgRF7%PVF<37f*Dw@s9ZB%f719g2A&CF)o{th!Cdm}m6xN<%
z(mI|DP@!5O6(W{LCFX%K=<`XYVGUjYSsU}S%sOAk-$jW3Espf%vY8$h<!seUQa2l~
zOfj+6)T^?^Gggf594}^iuj}9N`ea7z3IDFY9n0IJ@q7;6Lo-XUnq0Xq$hvC^_TDb>
zKysVyuBGE~r!8ZNXH_h}Z}r>kX_kr!r>OP<U<Yu3k{d}20-(f%hUgSR&(r7Y-M}#}
z{MZEV;(kqWqWO+6fo#Mq-q}8II-^<6=LD6pketA)SR_?+ikEk5QbCs3nm*KYOw&c0
z!jq#Kz?)j4TQyDcq2v{tQR%Uiqc^oK_q#{Jg?^643nr<#t|{Ms!+j*&$(_G0|MFPI
zNcPB=(Q2)JpO*INcm5Yx)6`|nmFhw_vcd-#UN!PZhUoSZA446{UbZCs&vn0<Y;K_3
zHTfapy^_^kCMa|$eCPIOmlpNX&DLAyTs10Wpj_UEE+|%$1{JP3%)fb*LGQeWC7IG9
zLiZb8p>BwtiCVJjT+N%~i@^y<V`qqy0P1qK^)6f8-h34BFI}Tvj|p_HsfC-&GhRbo
z=Gc7eiPB^<fxYbHHq#)b(L+zcGFi<!u<zhB2KRKTpPPtDF>-;6fTvJ(fgmn>+{J}{
z*!_WL%*@BAy<<`ZTBAPOF}ruEBNu9N3xYq#6*1Ljd%eh{f79cFzK>L94@<bvM#m9D
z4<gopt%<#q+QAd-1<*>_Kkyyt0&L~=A<-Xlt>|soXGz`Lt1~lmM|3WsydZ7LmPjfI
zla2%smu)u*mS^mKPY0K&x9;*uxN;Dt=VjJ(VV(sCXnuZEp>QKD238RA-K1a)EbB}8
z@193bO^#D<{??VlIi8n~93;j6(s40Z<G;_I6j?7>0}f1Ua-6Om@P94S;~--#b~Ir;
zkGP_0AOuu-?A?~m!0?HA)~{GUgs)(3l?zLdum5vSHQN7k$A<ZDJ#&Ne9{c2-NrIPc
z)gGQDdOsn`sV+$%zPATX4reI?>Uy!Z=IRCout%{e_&*etlwJZSqfEi_rv;rnfE8}H
zcR<6)A(OF7MW0U9ed7)1;vC7c<dBr9!r~l9F|Fvt<D>YUTm4@C0!=>bT4IgIb<s{m
z{T_Xt-uOcro3!FAZ|~eGGLaoZV8hGYv*!J8SGjrwKRe5;Ey(KG>O6n#2>DF`O2eAZ
zro5<<N1(Mr+GG-mHTi!Pp6+8iQwiQY&bB;!V)0xKzIyNC##re3+u~W9GPa9UfmAj;
z88tz|xNJj6_5{{Z>Q0ZDE-Ha06UWa29MP+9CVdnXT9;mlzEI=a<RnV*IokPcuOvNd
zky)gKcI8wq-p4oNG<8wURj)57xaE5Lods#8iEN+oSb1f(G!H!US3AG*(Ig9J6nEKu
zF+{|NfhGGz9#Rset?td`j^VJA1~Fm4tCjI8u4u+Zg7ld#7K1AJFSFF;hvRKblh@Go
zraM`qt8Sl=t5F14CJ1bZ?9Ee%%t^eUjnsvx8uLMBv|}s!h1IBVQeFIuCiv{v<rqFm
zhXakB&EKf?=xurva06gj1?skgBm|>RgFeSjm{P%vv6}cLmqL<>!U8Y6X8<(^=}E1?
z#!4M;)34Llxt`;SxqkLo$DDKRpm?@Rk-Jw=x#~=nZalvYF5Z(5gB6T~ToM++D{k&h
z0)DnRedY4-Eav%{Kf;qWUahig+=T~n(gBGuR!FRMBL8N{<F(lTcM)DMGj|f}rl758
z*51=1UC?H_wEpl5P59*o>%QEjZ8I;0uA4El`J&iiI*;Q!u^80jI#<D@!WCO#YZ5LZ
zkLd9n_7ZeZfh7+mj%dM==eJJ>^@o~EetPAEMQSS-@ti8%Eu_?F^_<|)0od$&s@d&D
z7;hEmLB=+CokM~zziLs75m0&qU?;ohu#*l?w1)Wtj;aXBreDd$oCkQ|$2zY;bqzkA
zaaXNiv|NAp2gCtUHi21mm4PW|DkO6!qWOttC-F0eg0yg3d!Zk)rZCC+f>sNwz|oHL
zE<4ZQn926Ay5a^{N*t?>ZBg}bd9U);7_P)x3gB`>;63#s@j%>_9myS!;RV~h1R3d8
z-)t07FV4lZmIF2n@df{j-p$@R0j_be^0g9_Dx()3nlNxrLb@~zgT<t(vehg(7i162
zWHY>M{fCNmJPM{me|+hUmILf`-3Oq*dD99mWF|$03Qlu55<4HRSMSf7Ts({vDzjet
z>O>z^p`k;t;18q&(OOC}zNku~IRU7N6WWK1ZR4pAi?(G;Xb0-iQ#Wh9;mr&^pyQg?
zRPXoS4g?+pw#p+p|6HYs4Eej9i8Z`9@cQ}v2az%hBZz4DH^UlnGdXd=;egVg)F3JG
zBL3INwahx6FNci=tBuO+NYQ=4Gc!RA7adou>`)LwS(MW+>Jc~bl<9DSrn$s2v90n3
zAq<BGL}glcYQdW%--TpEmh3DPN(<hSy8lxB;+Z;9{c%A<Gu1IrPq>YP_mRhFsxx(B
zbI*?3zng}e*7NVHqAlXz<;Bdin*aPa^+IMUGk~WlxY;t@+tj{_V=K`JqB2;3`f~p%
zI{Ae<L4M-8AO9vO++4)jU(PjGmxM|jrltH`Op29?v};E14#Q~`{!nskMQ)$pUp$?@
zhzuvE;V_4FTHG?$n8B7UJt&pgf7>&kgQ$jOo{oUP0_l#I&%Kl+#;995`(-(6*RGkX
z6f}S2sjdSCGNafhMXrp<wg3*^G7@M?90c6Fejq&8rfBf^__ALO<2B=Ju>AZ>Uno@n
zvn>w=k%Hk(o*uhrcN~Cd(>%RvoZTuYXwcZI)Ph@9FZlP073tiVeEm68rpYVlTfMR;
zyuo!kRJ_v&pKwKf0Ne2G4E-QMicHus%_e?%<IWw~N-Ye+%;rQ7Z1oSbRz4B^BfNpI
zQC4VAjs6%N-TY}Jwcn?re4;gGXZVMT%omyaW?!gE9-egCviFIssPpF#UswB(20eGG
zai0y*ma#^H6hIh&3!oAEgiD!2k3L%KQb8ug7!{7E0<iCzmpoAP8e;Y7n3?{qU@zKx
zN9)s}EQ%evyp(2I_qsqL@d+$zeA*VD!r5-yV(|$x!6ua0+2F%jm#$wJ86tNjMQgOY
znSH=cK!n^R*}pFbD;9=)rIgruR(~jo7c{zucnE3Rw{W?9&(dr=&YG<75fwU2ABJow
z_FI1@qaSun+`PUd6DKHQeB@8KLgePiFl!&^@uRrW;7d2QTe@lcQY5|QJa3kr>{3RL
zi#H%g8{m2??HQ2pyE)SOr@Cc&w`&p}!GcEvG8Fw`mP}LI9b?%O6e&VTF9yywGd+n(
zyqKb+MDdA)%0`99G!tTqaV@&BY|TxA5ymaXK`Hg3s#Z4gmI;L0A8FJ>@QAhAe5DDN
z&LvJ|f{P|#5oCVUX>6+Y=XN=T-7!1c)rP<1;G^<ekw-1xM-$m8hF^M%+71UPCfAo6
zt{ihRRIN=NFAv*oDSR888hSG|QdZt>yZLD7a`H@e9r@yJugdI&b@evgk#jjVH|0qR
z{E3yxxMK0vzU`o=Du@c4`@Ll=f3+wl<I3xA)hh*WGbTh@a9~4O!zA^XD4*UM{(_^a
ztk$>gEtbn-cbUuuv%4Bzu`!{C9VGQ+SF8Qj_BCl5iEZ_u0dSEmr@*~sW&os%r&5rk
zQ$!c<!CUe*nJ$TUn0=-h{z=BV)4*<W8($v@yUSh?e~k)ldlK967r*g^@BXT%E#FFU
ziYEW%4B^1I|56zERj1$y9w!tK5wy%%>K&2lzyUO0j-O>b1kHsbu=GQN;l|*DUU;=<
zHOD#(vI?`D4dr@eYbURbG#{KuG-3=0dz;;9!GPAjJ(;q#;=8nx!NM-TWYjSqnn_Eo
z7Q=FXd`Z5#>ubj{TVR<|Ef$LMx>5uGQTNLfwODoT+p)?l$Ww0~VPsGf;qTmcNv7kp
zUOyvZ^aA^VvrOpI)Jizg0#httI8O&@zc^<6=g<CwsVAyfSg*2-mOTKa8s<a5t<VKA
z!7pznX$`ZIg1iggz#DQwbZKd>oMWOUO#+`m)l0)93~@tN+Im~^kLJ{<DiCVLR@Yxu
z%qQKwgz_cf&ZRxyp@(ngx8pr}6y@(tZs)q}Ca(q7z2AFWJ8FwVhY8;F^SAL##tEdk
z6aLrMT!YnrH0!L<;#m^K0codrByQ7F&qCKPJi&^29QFmr@{?)j)VM7&>AMC-<3ImX
z+ntFDI^Yt2QyEoB*^4!$-4n^?)PAvk@2d^l{kv*XB~X4yJ-QTO+o`Wu@f^9HJdK~H
z%ZL&a=Hmy0_?%B>F0eNP-6?TZ&D|+E2~FqL@eL2xXmC>kb+2vZVqfe(Ce|aYE~3yd
zC*7gnZ7(75dHwNqof9^ZsbUEozPR{=-DIZoWxvCnZBHXNCm&mq#3$O_R$o)9ByGGo
zxo-E^w$sqqwzkhPdUf=i1wNzi12#XJ2=PaeAlur#3n!SCiP?(_4sM-;w!`fWZ%7t^
zumKPbA41eU>KAX9_#OYrL`%Qp+e^CRqn~lLAa{@%U-@e0JJ?J{?nkc@R=tdm%K3kY
z1XZ?+odfj_8-5jStEQ(h96uu^j8l29tV<9uj%A&G)M{Ty`^WzojAOh`KkLI=m))m@
zrJaIiiD^Xt(*oKrMQLWa*1d3?$#HtO=9Ze%unSU%+yhJ8tOCKRx*im$icYz*#ZFms
z>af_!<4li52jnem*tF_7ap`{I*%S$Wg=KG1diBo|wp7waT~e3VGT{Jrd6>J&YGp<_
z%sLj1Fzpb@;H~GWdM2upmUAzX%L~b}`xf@J{1En<=ERuJrM*4VyFiIYACkIkSU1&X
zH|$H&@OZPxChiBm>?SI^-b1XsL&P2YYpe5pORN#Cuui|@ijR$=SYcKkBvEP^14a8Y
zp@S^4>bCCJd@qBe7^4L){1Putet10ZZfU2Xp4$#{|3gn0Pv@1k^Q%RHE7`n_Lm1G5
zC%3Vec6@o?#3e%|3k>UuX_%4voQUuD>Br4tEF%=P7E2bhf07RO&MlH@CxBTB_hyW?
z)~RWIW!Rtw6q)&=V!Xu^B|dVft>)hPsJ>Jfk_P)rmZo$Pp`ew|Ll#<^i6Lz+F5z2a
zGlce1g(_za>|3om7k_;M1(5KyO}7l3bPaJI=uzwjqLOK?JH6t5M67<Fs?V!6cv_Ud
z&i8>1l{dMr4dJg^=!1TKB%|pT^?y}9ewBk}DY9Er!gT4yY;;dU8cc~;t3IrGUnaP0
zZo5%;R8-cQLmdVZ@pxIyGln#avroek<aO}KI_7;ptR)dF3RF$IG;sN&h|l-;`R}dW
z-dyVe72oc8xl$d}Jn&4hwEZBpAGK}be5?xKU#SA~d$o@2>}ztj4-Cn1RX>>-1OQ!c
z1*M;K`)LPq>!&!X1Q%A9Sudu0{$hO?di2Ehjp^W#iy7E-u>%FMzEev-?p^)<sr~{<
z`n1UNjhSX(o(UK&Dc+FjvtpInOATn{JUSHadPoi+wuGB$ZMk@1Rz0@RMfDJq?|$aa
zR|$3`%<yS^)WqHOrbUShqg+iOC?8FTWwpz!WF?btr&|+o;K}3#>GIz557;u9;G}mF
z;q0>EyHNNdGIxTo-Ks0!@gi_-!W(QvfM_sgYeoB$j+1KW0D(7@ONs~+u#5|+N<0WY
zK$!TOQ_io@1vb;&>@3`J|Hy`*d3ug4Ke{%znkRSaEHw3@ySLMatM0Nr3-a+=k!ECH
zz6DDk9lu+vST6M+**a2T!QSRCt>WJrc6wQ6E^Hn}JCLWM*%oMCW2d?`@5=`sho6{f
zBDRZo&f9oinF&(e&cCA>tu@l-E4Wq=wk4Qu9k$PGro;)gaDQ;QK)Pck5udI`j~01J
zQn^d`;5fKDe>MQ3OcKEK#>2y0ua)K{Il)8a!g8crwfQ3;*x=FmLwL=RA@dOgD+r*k
zX}^XVD!zS~^aI~dEucS!t>n04B~U_X$})~s!%_bmC#crRI+m5dIw27o8_M@u79=?x
zBwEP^2E;jXE|W)T6L7jlf;lN3_rRV=R4yNQ#a6n^5atsv7q)W5E`Rby>Mh^bmHh9e
zk?Sb2r=n50om)z4R@<B{?Gk_ijKqSfi|5<0X69KM%dW)ojr&DZ{c8|!icg-YYW0P`
zuKmM;QJl5Mzgm>W2qmL*AMJDNIQ|3Q)!T8at7e!ms9Cqq@mkW2R7=oM%bvyH%~|k3
z0{bG@cDi-po-W0yE_Nq=K}m48S_{CVFrR$ORGJ^v7i9{3|LomsGaYHm=SfsnpI+Ih
zNw?D^T+s0peh7#Y5V^ho68058e@S6B>&2g+uv5fwxTAdo+R9f*ftpM>CP|u2*mp}p
z_9=<OrP!C2f=XT-O?m^v(Wlb^8$8t@!HmDeBHT^z1d&+5d&&bmASx+XJ?nb&QK27L
z<5`Y|sxGAWP&KX-claZHxX<FSt&$A?Z+m=_RSWZRqGgd`tLa6L`h-+4zZ#&O`6+PE
zcWpdZN|aC|<Rn0kX)WI!NHxE~^()UH9<~7uX6(?&(Ivmd2pLJ|cUO~9X|(-3O+vmA
zOMGfTQX}qxNi)-aov_y<ioV*wGJ5JYOzcRL_y1_R>ZmBYuRDk!QX<lw(%mg7EiK(c
zcejLqv~<_d4MTTH4c!h1NVjx{-}Cxg-+!#dTKBng<HWw_?A>=(>XJ6_^0h6{>dbL}
z@yCTB;S4wV%aXA>6z!!rE1%`^PWdZczn^$(C(*B@rSUkeX)~JzJt!AA!D`re9JZ<e
z)`+j_w;@=YMk$pBJvHV3J?q|IyEE9n{+FPVnIwTo83Vo9$<MSQjs|(^bxR;vxVoZG
z7SHomrNM1kSn)O|cU;LAjGpjjc|#$aM~1pc?lPp<F02hM&&eQ=m~z$thX8L@2Ue6N
zxWPnd5Gy<j?nzJlYmpK&UlAE<)q%Y*?6hIDzSa{0kQ-KPXaOFVGMK4rmX=r=Ba>A|
zl4<GdreN!lqJZSaZjo`<F&-0Bc(I(@8DEW1O33R~{O?ktMI#xJ73nPh(KW{Rxv2as
zkYJGF*?GtzR-TKRN><~`s>bggTS5|%Q~9+qiNq#a{_Sji)ax0v2gLnteXZunGEB-C
z%i9($ypiTVxLw-f_1uF!dg`o4_yk*6x**>mKMs){3D(u$htSs)Ysw`!f$JLqwi9l`
zfp_Vw@7M@2$Oao~Ya&nD14!nBYwP5_K3?YLmP*g_-*fVdJ`R11VDgKI>;L>nj^~LS
zXe!YI7EW=#ixgy?2_?}{vewPmT|Ri3L^k6J*I8`*EHZ;ZmyCqDxQ}?ZXI;cpMGv*g
zsJ0d$6@tcFW<gNOsmjwd7Vv--#Xfk<6ZKACl<Cy$*h|4CigLhr2yW??pCjTTd*k{?
z+N1iNT<xh*$AQgld5e=YpZJ^`c-_d4N6@Yhdx9wXzFrD`s4tXq>fo^c7nl%opv#ZL
z1kI(Fxnw3l@n^!BJ>L?%iA98O_f^H`0A|27J%Zje?GCH8l*SdyCygsIkp%P!B8!};
zZL6qD$(NunAqAuW4u^>3TelI&iWXQ}Qr2zFUj}@-8O*b>Z+wDsCetmtvLts0jJx`E
z{gdPpyyVo>G92O6_P$M<&1bhVZ77U#!Bl8a<{A8nyw2Z0Fo7!81BJ_eMjhBLBWW;x
zj#CK(U~kx2CS6@y;Vx}#_avDKeib2f$;pyfeGB*uF|EL}ogu*tNsWCNe^`|R<UEfV
zElqY|5Lhmtvd)ku_s~P2>ijB>Awe~{(q1dd@CP*7FCZtGL-Xf)uv`)KLR>Yj>X!8^
zcf^53^`=nu?$_q3&oWVX^4qkk-|3@Y3*$xqc?nQh0hJ@ZoYI`(>P$wDX?@xNXcoz7
z`%xTg%eB7AKH0UF^5rb2)=|0IPc-dyTw3A9tEWI{`k`7Vr(M92pdqKaZi`3Buqtxm
zfD;cPBO>P>&Hu(!D96_tG4GCKOs^~_lyjJrmHFkA4%Jy>tN1ujiL)i>QUvuu(E|^!
z&sE+I)E?I1ODW8M6`B_0Y3P5k(1Jr!Mft927CW>h!daVK68jL)9{F#k#AWme5t`Ca
ztKX)}GMtRbggz7Ou!D<rmuOTlZ=9M==hysi*i)g2jiu!>l;d$)#rd4zxjX)Ec%`o&
zTgIJ#uC!F1;(2n%YDGpY6V|u*Iurcx!mB!z`^zqhizoRX|9l|Wj`P!-rTT_M{08e*
zOSJ=?eObX?#diJF(bvh%0E=np$c#kh1Z`Anb>`%_&+37{=r`7vTm)S|(Vb%>)#v3Q
zMV2kMUjP}{$G%s;TK!}7w1biJ)c#Gs_Gi)E8JTB(hon%0J($ja&{Fz1N$@-F%vnXB
zJ7k4DS+g$5<bk)B4f|!7szZLX^0B3q5&m0Pf-R+U_Jh%xEkREPa9M%!S)@pH9gdtk
z6WP)20v7~FREBJFmlo~{*#?aUc}=K?QS`KXwx2`wm_+(`xWA}=)+(YK@X`gWAipE<
z#vhHA8iW0ywo-Ov;xlatVK7JUnq&odDyqzBi>$2;t!_fof<G*d8VF>lIVfN5(%`^A
zf~5Z>qL{UlVCVG<5s0(<WTCurZ)ZE@{lwUY4GM((CyV`=d=o4kV3|cRRX8*J%BtK-
z<ENxkZmi5nV9U;PT{a)p+&5_cq9EXX1DJ`aUQA+?8a#eza%!S-e<BC-Bvm6GTX#}r
zGK|RsN}n^bkAMfR@6%&>ZEeuS%V@FStpD*6VezU`XEmDBRAw|OpIQ|3<KJxvj9Hou
zxz=AFkYHrmNvozDPVGLu?-NNHr>V*{NE@H%=0&&WV*a=+I;fB%_}li-zcsG0AQBaf
zFtj5j7A{H-Qu!x4mIsg%FPmqvcC^?rQp*dv4~+W)z4Wq?hnG9`v$3L@!oSWW5H9S+
z#iaH47Zs=U?desJm#GWyf*kh*M(0L_SGPmtMm*~h*g^Uz|0FjGl5=5AE47&psowbF
zPFwMaXAZ)@oTsxIq(5?f!gu{hXkSG>!#p~5Wv6l-_`{oFI8wV99h4IEPoSlhQ64PP
zAEICc-o6UCIbrG8OZx*6us$Z55uP01-PIprxbO;pQ(V*|p8E!*4bUI~^<?1(p1ZaQ
zu$>7-=yrpxELw2SRDE$#{ken|7C!7Hc?A~Yhu8m3V)i#R_`uz}P<#fddER7}8D7fq
zCPjnXn^CfMD_1++vsxE!(0?%yU}-kd`7iMI@e83P<id@YwYo)6=>>ur;iARk)-0Z^
z6W`WfS%*KtWaPERhNe1ipH30-nE!o(^y{0SK1}TsHdc&ieb1+(i_wf2*21p1K{_Q}
z%TwR+UWTRfT?(6RPhi#G8Ovh|V*-#<9#Fjp91T)&lop57D<OEmuGjhmav}7tk}J0!
zS4YL%Q1zuWwpNBsqmAq)Qmd_7$w??rh0`|oCw#Xh<prKXf!OTH@w;sn6&b(SaXE3r
z5BcaI#*lyOxkCdKG?(0G?Mz+?458lCB*A2>)O3_RccCV+oGfv?Degen`1Sp02V+!&
zdVuU9;Q`!fKpAg<OF*QDReN3#XeekfX|^TSBVN03_g`%qKVSQ?6+#HVVJ`r_@jp?W
zCY(6;_KuBkad8Zo5_q!B`;(Gdx<d<B{Q^WNgyNgzk}w+axH_$prdK+nHMCYOEC16x
z))vNOTdC6<Fqhn+CBAw61vw?Ubt`p)Ch1Jyr<q~GVr5@25ZKr0jPSjTHh3Ax_|F0~
zWCs@cRgZ4de4#w56iJScR3ntGDI>I<?`K{vV5uzRcpq*?Dh&h3oFn6OJoJkw7^-K5
z#QYb=l#1Kuv124RzVDPtI;?3{qOWI6-`Qa$3E{;<w3X3!XqkyIK(_yMLZ(Dp0*gdg
zH_uH~<-dnKLNq)!dM=@khE&N<C&xEQxiGus%#3Q|mlRPOG2n+3`&|qN^AGPP<|pOH
zJPKSE9^rSbTo;z`j>1SNW1&w{vP6b)&Q(leS5w!IT`Xm~(aAf**4YtlZVzXz>uC&f
z(0|nX{}qj&MuUH`C!FEqInXC#@Q0(Z4VE#BwJWkzXqAmQKaCJpwB5fQat`T~7bvrv
zZjrwy^mhWP@325}QsNqIRs}T`{DoH-CDwl*mr<7F$rms5MZ`{$R#3(K-m#`7z92Qj
zN63@;XE$^+vA!1I&9V-$TrigOmW^G6lo5_zlt(i?`A7OWkeJP9Q*M5j5$ZP+2^I1O
z8^f>408yRGEHGguw$6WBq5IEcSZS(p$17g6f>TE!8oWnGY#l!XHSk{c&Nb}wYkEYU
z9LK94=&I{5uT<E<1^k}hy=%{UHn1D9w9RO<-U`kO{)!uGkmQ#NNHaA8bsd13h)+^2
zqG(N}Fkv}BQKvYeonioHJcP*_STn2|nK346)bS^03&)eUTn|L8#eoTY7H*hs?L=a!
zbOO7gKq_=CzX3Nk#mPU&9Y<VuOIe}8NIgJJ5Ml2#z{G<;$DXV-sa>oiz8r0u@&3|d
z^z3;_9bU9p#nj>TsD0ht?NNFQ8mim1D1q=4Fv)^-MsijD+nWOv-2YUb@IJ&dZ=V~m
z(xu>I@Oy|K<jLZdKx-ujv!pZ4S`VAVfGx5MTP<0KmeWJof0p1GR@yT@Y<v+dD#TlD
zJrvZSttjn(mCw#gmw!S9n)~NdK0wZJD*8O4vamF;FkLo`n}zBw10q>F8)6Er*E~xs
zKOuD<^0EmQ&uH+bHY!!X-bO=uFfOxeHmkt6Johua`ZGpe9LnIcuHDwK`1&fC;O(+1
zlOJ(BI*91Sf9HuJf1**Z@ci?@dJk53>tz`A+H(rzRs?ZrSo>zi%xikH)!X$sY019}
z=C&8~04SsumMHw$H?7{)!?Vw^_TBabADyV9jh`)YR&y$YL+dgwT(u~Z>nPGPtB#ml
z?rL$ndd+@Qfw(dMS>TOtK$d%(^jWD+21`mwVH7H3JppZn&t8-a?dAsDHe@9DAU8@=
zj^EgQd?TrlHGXcHOZJQ68ojb!iA~J$z;yxoB$4tr3&~LNY+u96X1z^S)>Rm0{Rc)F
zV*`%tU|;c%sb2xw+rK;yeMGA%FWjZNAQ*)OU;<cK-uk~ojV*Q7${MczWJ8rsKY}wt
zBd2rSSo|k#Q<<_5qx#bgX7RnuOsL(Cj?Ur)wDev|&qP_5hf-<FTA|*Ra=dt)$9~Oq
z@>Nck18osYR(K^xvOQd&LyeKi2+RF;7*#y5E($b-{?AH}<2UP#@ptHJmdT`OYAQql
z@9AeaGhuvFnWs5m_Sg&W<$4TdtQ0bx`tNv}GbD@6_G=9yL7SZEZH3U~t|#;gEdNn=
zj<k3F<iK8K{7;!Hy~VXt<VQIpPh<i__C0fI84UNOI6vK(kSq6>M-^7GKLl~U`fk6M
zBr|BvXIj7GRd_QB1u%~?nuICgBZl__>W5YUjWKXgizBEA*)+*e`EyE6rOKi`w2yJZ
zgk}POADb;fRAJ3Xom|Wr{-(lwhlq*=Xjc1YQ@M$f2RV~Hd*aT7YitNLrwKl<1$pAk
zTvB^HNi6BM`|B?mWx={`b3XxYT|ZWph6^YH0a1wmTXmxF1cL3lh9S-A2m>rBo@7;;
zWF8yFByc;|g^zq9cy?m9QbLw^MX>ft$E+!S_iiAHCzWt!AqTcm^wV^^gfk9pr-&l1
zI12P#_}}8jeArHB4Oj5?!!46fFxMQHg^p#2^VzMScuI+@fTtTsbVl{h9;0SdoBbDI
zg7^B;lq@TJ&=d{chSv5-jU88Jrh5U75AP8J&Ht&Hm9mYz!KVcdMHrdZl0#j!{v@D1
z$3>6}8@M?QW-dXts-Q2tW6c$Dt+e%;g_yzQz&ImeLq4c%De15sX)z|s1cVQee~UC1
zb>M8kT60_Jk_EBJ$k+%?@h&#RnTZuWdl}jQ-Yq<X3_a?&8b*I^j3xE?{p_L!4^wzR
zV@rV_huDBGuq6mVH2=HyRY=UZRqt3dSC>OJ=@W{0SO%OM?V5iY0}IY9^!U@dNn-PR
zU-^PF?`W>Sk5kA`uG(s;O|0@J7NFNhlw$;F3_|*M<Hns36aYB1e3_-VAM;jUZ9!l`
zLr&c{n4;Eh5=y#!MzW~q^K<qSsZO&=X@!u1pCzy3xTTWL+h7X2(-wWtk9d|`ldv`q
z?OVoa{;z+2L0wx;C%&A9yaSXhr!4;MtxX_Ik1%}H%P;vDuV1#fP70D&%1CA3aB>%P
z%wO)(o7H?qT_XAy?&xu2?hvq#@%c|1ch~IAQ<h0xsqHuBh)8C7=nuES3FMH1$X)Gv
zOA^($+jg<|UaC5N5>WcW>40@joRL4>Coh3+1Gay=Z!0mt!5Ck(VsoIMK+mMBn}WMQ
z^)hD`r<JL5j80fARd2t_Zm4Ly;aC1MdgsqsqsJYM;ENoe(`X7*+66hLBXY5n&g11t
zc2Ho`zu-rOmIGy(#YS{U(~!1+z1SxGYlEJh;Ii9p$wdXLg;Lp3)ZaTC;Oig%eLer_
zlagJxo!fkW@x;!b_J`kSH~P?`5``<KlVkCCMWr$ud8=%XsQI_IjG3uvZDz4-If*+?
zzv?zG2zpUK_5gMPTtNTZr?p~ZUiKvK2l9?+htGmXTwlISc6yRRvLCv?>~Vd0_R)GB
z>s+3qHpe~L?9@I0j;SQ}y3VOk&gR$ivwU9_jp>o8I*K*wAyShejfhHVf07T+J9i(R
zVW6z>MF-{K0(`}w4<!Y%GQ?5kCgk@$&AFbl17c?x75Jo*$<^I{Yt6a8_<9+KoQ0)1
zHI?W}R!r@WJMPt%QdTD~^yQP)ZCXy+a<;j-sWINb*p_BL0ZgiYasV$JvFLz*3`C)f
zjZe_&+{dyCK=j_i=wYTn;{#Ji%9}Kv_`iF;Y_j0)i=9lE_hbh}F_(z{lVnDU^`eH>
zdsUp744}PD8O+R>VbIJ4birW*`V_!|s76$NAJ^89^xbvzx870gT3nwL^|`k1ei#_K
zVJn2j_l~_<dyZskuHhtB!YNYxY~*-iJomC2gIZ^M6Ls-=olyYD&a+@Bnq!!{{^%fz
zGxj7vIh8^Re$>k6@G$kNOG%mwFL^@rJjl_Y)qlnFkBAC?*txbolaPpa7mu)X<Him3
zXe6YVw#<1xe=t)>=t3;_elo~i^64;qb9pNXks<kMOCfy2UmkozHtX>?7W3an{<{Eq
zn?I%xyV~C<vzpiXt!w&==!)8A6punKud+uF2OMvIK1c9%UWlc3Ny02})>kjpC*gv;
z84Vs$x*4B}1VqRQ?rfGED``$2M>b2W3;dOTACk?$n9_lZ>?uZV@chMS80d%lm%zBC
z07nn!6J<pNf1il+?=coWqq``v?4<kXlUIc$aVPt@$ONugJ$3zF3u)g6iDK2@8126Q
z%{VT1gY5y1&jCaz|FS32twW=LEn6d>r1_yTF4w=OckLg;edu%QcJhTSe#V*z6mPcX
z<jS*+(WTPF^7?RKTHpIEc$&-QSEWSh<A*oMM5@DwjroI<)Zhi1b}P0HJ5pmsuLA#<
znq>#ufCtL#`rFoH3i{pj{1nfkE?OTW)GZDDHZexKcx6u3Z+{R99+~}p^lmHieLh3;
zG;$r-aqkzYTt{E#VP5{0f*ExZANFx_B1=n~m1xRKv`9tbg7mYe{-B#UPU#qJ_*rEN
zxB;1|kP~`C=(wfHhh`)6=>jqE`rmEN-kAOJ#j!*3?qE&y`niaqLU8>7KH%`veE`kq
z0S|9}yvupW3<KaX*7I1cbuI4PdmfuGa3lVy<#B#=G$)smt)?BIDq8?0aur#0*{iNv
z-WJ60tgOhqxx`n4XTLe@i<#tokyEcP-Rq4BYCsn@2JYF%mXm5p=gBu}{Tf;yPEHrU
ztpD{p$`$?e(7d|ZVr&6-Sg1WOKCb!Ilaq++{Ujqpj61+=8*qMkbopc8&?W0+DMd2A
z(rF7I7G-%m11v7-o9!ROj^BN`ilvP*Dr^#p<)JiyxdO^EfyU!lc2{2F6BX-<oib*R
zr)nl`Gu3>%_m()wtSKR%alriq%k1y<-pB<dM>1M;?FwnQX7aT{rlbEi^6||i+GM*S
znKprxd~T5gf77vN5m<BJ^&7zPkd*+ZdAv+?aog!`*5}bQTTQ1<-EzmO;)c7P5%`-L
z);PfCgB+U1)jRicREZ(0%S~DLh2#=a*-;nabL(P7!BbSMvj|&eGa;HrV~U6}2xRjw
zX<5?fQ4>vd_7Wi4@buvvT|xsM<kjJ7!NsqM`M8$)zNh47W@TmPpg<ED9cj1<aXlYe
zzMPPFJ~`NLPC-Aa@y;s!Hw^aw#=^j_Z5VQI&B9`4b{`v`jDz)>Rd(^l@;aQcE?y{&
zg0Cp8tWDH2?3a#Ot3~-l_`GG((y^ljlp5Y)&(J3ua2F3e04PoBiK3&<=MAqR57Na%
zDMenyz^(s6fxv6=h#+}$!nn;SA`>UB`p2#kZHN4ekH6*uSoTDI{XKn0ynwM*dtL}d
zMh9;pO;mj5HmkPPE0$|k{CyWcZET(-I@e)6Ha>Aas}A9)kyApm#u-5^J4$z^_T1l2
zw<lKUem&&+6#+y;5Uj%#@1=_KGXCA(>o7}_&Aq>Fc+gWjNwxvs9P(R)v(BCpQnAyH
z)1uSdAwRJt6F}8EG}26iN}+u;%ipy`*|}A?B9!g#<nhU4&l(PpN-RG`etS_PPo){8
zT_u1i&AFn-df{9?7-M7SW<W55?(g6bo11~7gletaFF_>D$(Z`zLSVWZ%ypVwlsgvD
zYq0d2&Vs&Mp;$zGIFrW<rT2`0Qm9>`A`-Bn_<1p%b@W8}DY0F(cJ1EfY_=-5Y%b><
zB2`OH_OAmXFfG-eALx8Rfj(G>3&*Dnj(4x*SW#{xW-HOZJg$Fw-d*gvfQT&mKYm(k
zJwhM{H0p;|PSHx;u3fvI|15TF>=^yM``b@cEmSm<%)bKFQF<9<ua{CZi`3zQx!Zta
zANrkFM6BPU7)K=2kfl&{V|Mo<fl5JsAh9d#)wTqqkcc(;+@Oz#gTYmmhK`~&|2jfo
zVgIIvr0Sj;tu!vK0H*PaP*%C(#{r&u&Kv@1QRyTF60?>R6TS5+GvZk5MaLiLpbwf!
zr7Mtw)HVlc>yYHLQ}?~Sv%j~nW~<$%lfS324`e>;t~Ca3pm`XOVGw}1d^FXA)0tmC
ztz>-PgoX_)^t|y4$4<9@8Njp6tZsZ~IDf1+q|HC7FnqXiS;@;)wSQqfV!&Fc%05dt
zyH7+zcM7Fam1Wumq<DR&b3%)wl3-*WG7r`5=JU;JxEzT9+X)N|`tAm_<Vuvh#_`oy
zqG{7?uqru2uw!XBoz+5RQwtq;qA!61KVd&MlrkRZ<<y;9mb@M%kazkM<jHMtz~Ja+
z#hxg?eOX)d92O7Gcrbo=4)}j8AUjPvExpNP<uvziucI9a>GL@sK7<G$1JB^hQ^o$;
z#TtXHJAv{!(gOEfWX)rbW!!jspzO1RqcMsiK4M(^Z~IQSNM767dpLU`@DBld3;9vY
z*>eCnX(e;*wDPv~xBBXSBTE}51hl2It(IssEs`93xsIL5r3~dziq}xW@dCuGVk#XJ
zC(QZKuSPkQ^YgDy^)%Vq`Rpu@rGJM;CqSy4-r&wci{tCBNN9P;ued>_LNF5sw#tME
zad<&{YE}|?u6FU=N5P`!(V<n}-Oe}1T`ogK_-tI3`#fyjz@{g`HUQ=z&bEte^4rYM
z-5Wc%ImPB&@}w&aJVnC*gJJqM@6?S!oV<CgJyPYl?4W966czm7iia(`c-+)PcC+5w
z+JcuyWaW5=b*VU1fHT^Bw+l6>2=cS(D2rR(jje6NkMTjZ>C5jy%jDY@oB?j7864G~
z4$jgt|L{-KRbXGCrfM@#Bfu^_kEUQl2u{12>Dpe>QJ7pB>?mp{xI_Up4u+GSdY31h
zCGVhg{X%JW9pYUAM27U~^?Y_M#h#zRabn&U9(=@RF%qhUbX7$>1GOZh9{URhlziUR
zW*IU+9qL>R2}WK>q6EV%MIH>Sqnhe4@LX$*!_`#>qUAj<_gPV`6^O%e4(x#Qm9-BX
z;^ff)l%QQ4og{EjIpGVV(FpjIs@-z-;&|`s803M@5?`>Lk#oTyu<ZlT_@E+{-qh<x
zGLyxeJgpewU_S}iA=?jfm7^F!zg=-tJ<{mqBQu)#bKD1~Y~y#^xkGs)g~Lc`xtH^w
zZX2u3GMO6m^pi*HJFwC&`?XzHr_*ogi6cZ;oHqTVJkJOH0L%Z0X%z|}ZciP5M4Wg<
z9urogR`cndpfvK>pPH$55_*?Z7=15$ygIt+GnFQonbp>kl{o?h|C^ioo}%m#p<-xE
zJ^EtC^lr&jW$0IA5H2=i^(dfLTIrHdX=S6E)K`t2(!<qUzw<+_mtNT_=Oi;0=&^;u
zE06gNw@E$iMYCir&XR{Vl1VLBc8#X2h)ogKtNC+rODyL{tjC9oal82oRT&>v#jUq+
z7Xem|mqj%1<%4O?O{o3mhVo?gHe5PfH;yg=A(i<UFH36<jJ)@NxIkCmdhCkiVSD&_
z6Gwq%$rv-T;ESGe^YR3NjvdW_rg07(EglwXl-=Cl{ME%}5cikjSRV5{eVC;Fgs@Uh
zTCSn1{_&`$<WzCAz7GnToNM;RuVKf3AmiqleS?&)I@T6i1>cJ;)yumbm47~#i)dh>
z@lon)BcsVkintYVFVTmn?ngUVi*<Fg$2!9`@VfDWFcwe%=77h*^?QT5hRW%tAPh^E
zY#Xb3i;1f`4I&V8@tywQdNSjI9?));AtQ|!Fmf4J`gcgS{Ou=i!0F}kyNB^)p7^Ge
zWfs5H=MPiIe!29sHLSgQ_v1y!i^Uu3i;f;N&llNfZquHbXUsCr3MijXwr-~pOrAba
z=$oE*a0xZ%*Mz6C*S#V#sjXpRjm_p4X*WA;HEufRA565gRL)8_nf_HT@g1@BMX*k%
zc6E^)Y6#kNy<c+z#9ke1i~!EnO1Q!S0QpfqzF&{=bc*&!45w$xA<j&0(j^a3Yqka<
z>a*&E(k$wWEDCJ9#;SP-vv-aelfhZTF2Oa>55?bhUWp<Jv2|RP-pl+&<7lHpsSyjq
zARV<k7?%EfTM8Qp|BHr5Fyt!XW!aL19?H=swwl5aigCjgD6_9zcBag4`K&)}SL7V+
z_9Y9Z&7B;AP>BG{lt4MTH~K&}<xp^)M_~uKYx5#yv=yOVc=cL((JYM3o7qWt<U&Bq
z4-->=@J{sN#Y9{Vxil+E?&9qSl*!M1{-Q^kxUwCi^&fD5CH<Izltg4Px|Ho{S=|O=
z-B%*3tu$=2Y`O)6Nf03h#!AJB5~da?m3GXMXOC9c$f!1A7c7-xZGBWokHM)jTL=UX
zRkw9Gvk;o)91>WpHkG$7Z99u=p`UN`xmdg?fNJV&m+_ag9DSsW;rwh89u+1vC`J-3
z{8fu`l&Yv^1fFHzu0da5tOfMNYtEzA^lezw%G@HA<C`@q|8T1|_KyAI<ju$a%XlH_
zf;F>|w!fkQ1t^7_C`!ycHGS{7ZfpH9)*~e%svN8E2L%ff1H)d*FH!i38UdJB>x;E?
zyX-W{TK3pv&d9i_AN7abJem|tYQjyXlS?`jNO2KZM{i$gpJRbNyTf{$rGyWq&?#vD
zLT>XpJlAWyEmNne^8)dU`p;%WM^hisB3MI&yW#Jj&dmM8?aDl)rv|a$A__JQI7w)G
zUe^E%+(g!FDv}rdYRJUS@J)?dC3o!E7CgNr0qFcb413RPhGGvC3>l6==w!w6_Q1QO
zDUI-sfpLMpukjv_FGcjy$v!SO;C45h>QOq0*I-``yB*%Z4C5q5stiBXVY5{q5|NCc
zPY_%Xtf5R@|0qQaC~w2OO;C(iWE7wYnkcexEq2KEB@zA1(Qc#deW`dWdsFx2Sy*!n
zNJNnI>b;IO&LX(T|CUUuuST6b4)6)DId|$Tom<Gq`_9OJYP;t81X(4+8F86+?`if*
zN%Sj_BrX6YNr+dpAj#%ynmPa1VZSL&9QN<cbAD8{lj&sHwaIHxaew{g!Ghj-A6g4T
zA}?O7jmdhgb&i>Tq*&oye})*u+otM^|K8KkCUJdAfZw0!KicS^rKqiXht$uVHern;
z&~h8=x-DkRQ4h<04T~&t<B!t$8oD$6XseFh0l#-0L`ERo((_e7YKJo!x$M3d=6!j~
zFzOP9?1Sd0oL{l`B$TMmRar=yTG@UUrU1k!qTF^vwJWO)<*>%|U<spa@P2Xp&65qI
zK^T@f?V1b+nlTs<Y`GydO#6(7H)R2J`*emd5JE70foSsr*dOJ+emYo&&x-tGpi;W9
z{R3n+ffY_Z9~_?~mf&K$d|as@XTaM59vsU~6S8fcN1p%!Kh=H!FV`J6Mo?Cjlflx;
zz2eU1+BqMD2vw~H*t-NvOLM_2$bF0>rQytDW^dU32ILTmO_WQN9T{{#Z$|woB$3vc
zeiMB4WQ$=T{yQ_wA-&CLJ^_Bmo`A#}&Pdq9NN;Pu!cM}cdnC`o)y~XXV1h+GhXu55
zve{nfWRj+#9a<ZxrA>vYKU=|+7WWp*KaF3Or(65~*?KIDnV$sd{+A5_wSj8e@zDUb
zr<%?%kjnRw$?~U;e|pf={glr%XL~Gpap2`l)qX`-@>=KS*uGy3xhC=h7vHMWeuZI|
zZxNzPTe1S2P}4&5%pV9}iovyc8``)|%pc<wFB7@Hkx}f+*C=?vcdim$;k`Mm$STx8
z@ei?1_~^vzR|Ve}3U2k<JH`zRn>!Ywpl+xf-w*Z|+vu*~iExHRNn5PI6miY;h9R(i
zR|e*-N&7$pq?plmd#GxvJ$rX|s7atKIw|uVbGvVv@87Amp-<+y{2ZPZtLS@NxL*lZ
zMBFV{Mg7c6A7-LtHlBK)(I(p5`k$|}(cX=;%^VOLJ^ae~<Am}K7xvSpJmABn@DTfX
zlfBj%D}6-hF&-e+7D!Z}3%}17MOG04=IrZ=_ZP)JaVGG<G5_nranS$|Ew>;SvHT52
zq0i)&#e0`oGC{r<G{oIg2)Q+ony(b!%2QHst0GCn2TG&gTV8FKln{j!Gz>gwG_+aZ
zw-@g<{#|o?G&A|j_I!F}2hQY0f85;d`XmJJ@P6?B#6sHAlF(4Bq08z@y3FpPe07ZH
zZ-ByX_ZE~#3+T*{4!oNQaML1Ed#YM7!B8@gl-Lw-XsGzYzT)b4J(k2V38L`+N<q??
z=25YKOc@DH(JflpD8Fx?5#HQ&D}XddhG^N%=eciUq#lWRo&R}wGxgksSYpLgqQ8*1
z;KPO6@G9><&3bFawevTl>BTz4JS<QOplFc?;)%Bt8N&8&asUW^HP+CRUvoQHKx!+L
z<>?T)GKZS$UDM}r1~kwdqJjIqM;|5tKV#z#&qdSE=b7cdkFxn9qy7WlVZDSaCZ+O&
zkq+E>u)Qek{(ElAtz~TbcMl_%B97eAc&P|O%<kyz4&Ylc`sbd?-!EkN{ao&sc;yG+
zMgYx4%)6IIR$6&gpU>D1U7J0;B^qt3Js8R?W9$S3_`KhXg}lQG+)?ve*gn;4&_hq{
zERiZMLdsA1BttT!YR_0C-?qJ@q`*h&*qC#U(=Z{!P%-8l5%QGo`83FqG|t*?PI}Dd
z8{KnpDNu+bP$ds-xyRpAr{MxnYjMqEJa@{pR6qQ80I;o#7fi_ATRHI8SYp+ex214#
zdG)ZkoM>&>^>J`@{n_niJzc#xB;_8Yl;;hUrHm%;qOcwXlFM-B7<D2BxYMIeFJx+w
zE{^L}Tf^Iqe@>ipY4qo5UTf6#W#X`Dc|32*2frTy@?#x{zgAf73ZzUgj7($oSI8;_
zTNom~h+EGqkd-rv#T0kSkO&9u^GQQX%2^D9T&JJasFZ^bmC*iX!^=F%QpUvdTh{Q3
z4G8McS<(;=&wwii;~!a^$x`EFt$oTq50arPmPL1xxC5(()*O6|Wzvw1BKp$=dRd^~
zs)H&rVR*FR^Y!N)Z`R~tyV24OuG0d{TY-_904shFhz3v@;np$n+x&iDBy@ysgPUvS
zMABSsoA>EZl+%^dF%unh5Edu++f#GiAs!!iXk&=Pqiuhm*HH*dV612L=<5Eq`%rxd
zNVg!2U%eh^=qdRU9fhcO+ZrbFfLJ~=``0_?owsNgu9V?c1<7~PCOz(pSbNR0CV=!s
z@b@bOWY!m;20-*pHnRTx-*IQK+0ru4)+Hlu?qwOI!Qbkl>~2II&VUSRlmYUDZB8<y
zfo}rkG-WorS{f<BFSeOlm*CZ!&LpGk=MI{Pwf5x+a$U+|=u({j!{bL>gxLTEJbZWG
z&ls)A)d4bejEC*7+LPw;%ib9VPK$sVDUtP4`-?h&*Bbc*h_$t9x!qZHlhhl_CUBZh
zbz3q)6_Cb9ctin!30f~Yb~q~%c?N!*d8mSKXEtKB+Pa!B&KN5>+{fym<&OrJ3<?N!
zi^8tCRC5|3*9=-|1K2wvw;o4#@m~(pb5Ag8LXpRG33j%7WyuO3;N=)73j3~N*dxM2
zO_ud8cm70w;Upp%JvRZ#`C)3utiFWqN&p#@to~FhUwo@6#i^{RR-RIB)INZ>@euG6
z7_nk6kX(xNw0<w}4QPr3Ym8!=Bv*u!;W!ufrqWeL9arCON8rz2%M(%1ulJLpf!zrm
zi^snVt|^2NI0;N>lR6ouBp5<D73iiALNVoExk=_1g>uSw<I&^5R++F+g3zHi$_}4S
zX!m{1SAce4;Yrca>%T+JXCu(bgrWVK-T4A%O$-f@<@wp<`AG8r#{v@EM|lD{&EE=q
zOq&Ihjd;cKWw0c{_{j!H-$z2$PB3r%nO(6HMFinhX8+AwMGLS<D7SsTGJP=;N!IVK
z@}pyCYMS`RkT;uR{lz)PKolG>lLdCmH?9&p+0S00GYCL+N%#gPTDYYAtH(;gACV-k
zO!4Tu&ma&z@T#K1-6Z7x(AigqksrT+E^ld(?JV>3mDE5<xjP)82h=fUM`eiyR^P==
z!o1b$?ENY`nB);9o;#Us&^~}g*M24c$`7av*aj+cA|u4cIy)!Xdnw5{sFDKIv4S?~
z7Nb{ZXP5r$n}DX`{sYkJBlUSnPp^>c;l&@@rHe^0@Cv1NF23n#?u2x>sBw~00rWj^
zpaFiPewKmT_iF)hu$diU(!`+F!l4&}r2ry@k6eWLPNm@Qn?}94{1wQO!}RV=J1s-z
zh3l<Xkv!f9z+i&D0SPK(3m@+LfRV^l=7xtev)VwiUyA$E#OM<-BK>E0v!3~wRYMvx
zUeFLZ=6i(%vELZC9co%7ikC8izr&|#kboMn-zQ8sbyXq~C6itodwI0S>Z*%+6_;5K
zpFQ7Qt4iwRlUSg-V#Y68=1}v;@}-Z-Bqjqts0guZ@51{90{Lji3e!qYfjTlPWCdV}
zL<daxKowI@cf)9llSb`o)}L#O#({|oYEL(wf*8>x#G)0*FdTXqIEnT?allHVT{@IL
z%wM#5#)0GF6J|VBx}ggi^egUb5a>1F3a8P&0lSYLJ|AYeSm?XuUo;XRi_zU#&(Lln
z3z80k={2!`if4`rNdp>r@iKd@WMU~yfDh2&pw^CsCS%@W<HBmmQ9z&sV4>A0xc<~*
z`e(+8nV75Ot{O9iPYV_~j4j0aLz2W_y(Qokx@krV-e`CogU(4etU*<vA>&>h9g?g(
zmC3@}**hFqXWVmg<J-56HLCwTbtT>->YF(T^c@qBgCbQTTQ4#geD^VwF~)knx6)@e
zX^A6q`6kbym?sG)=<~}hsB2MciJ(x4j?4F3b0i$6?b4?JZa1Hg*d>Aa@==2}5qc1K
z64#)2S@7Q?ngc}>@{vM6x}nRrt<yos3c5O@5I*H{!p2V5ny)OS5>_@R)m62`=x5|o
z$~8uv#@s0AGiEpf?ZfGuapoGDTm(w*>ou`X@x}K8fhj+U#%0|-6Q!#Q{%&`3K>=R+
zL7d@Y{VFz6>A)%WdK~`!^K!yvhh6u*M%>bLE4iLpzamRi<4w!^*z$V4vFUx*8a9F>
zCiNf6;ZkGqn77CbnX(q#dWtekY<VkGi8Lc8uIkx}6CJIuq&eS6bBZjn0K7{8!))G5
z)jQj>fc|NW-Vt1DaJ_t@y}o9D^&dRs{$VSX2^B@c%7SHF;-0;aS1*t`ip_DoBhA~!
z>On(i7WD(h&~vM10_*0z8{c4gno)uQleiC>oUf1Z5J1M?fU(W}f0>?!N`@CNme&oc
zy~XKQn!rTvFKX)R>aNNhK-brh{!&>59a@o+bMCAb|0tG1td~|F?oD|?(~BlpKVr(A
zK}bbtw(c~wdl44=%<RC#c#H>brWnzV2R0QAuof^a&pkvc&mZ3!1j~7rZ2Qz&##j1{
zwN+Xm66u0Y97|i&cl?9%dN)%y*JO((i9=8qFvdkJd#W_e?EdBZ`gvn^4r68<)Y}d+
zR10R;eA#yCH*8#h`vDD;0!PL<v&}sqUZ{z3xTNkiPcg(WsZhBlv9~ragMgL;kFcv0
zxt?Z|fbZB&i;bTdOvGXbabZsX?j0mk!<RPB+n{F-E922-|9$ZwY^rsPhZuZ>ZQdP-
z2m~$^H^Aat9=o6-OnYq%e-OmL9Mt3qqnX~nVIS_c`T_BhF#^zi?pW1qlc@@MvJ#CE
zC{fF>s?LlZr;fXz-y9P#T0rjFNlM|^G7DfNgs#+3l+=K69Zx?Z!zAj%zgTv2War#A
zycI6<NqXHFYGT5^Clgbu#-?7yOn^>DG(^CXI{mmkTOJ=pqOkCLmr0Vam@}3uojEz#
zomUS@EuC2*>Cm@rxx>)1xGZ|1?IRr^z@<#B20$)b_|Fp`TCL8`6*6Wc^@N8=)kHFO
zPyY~LHsbnkvy~?!_4$899E>rGF6N9hr#>v#Cd`wSp@kxMV?~$~MjLD;dqg#rmkUPC
z_g-uV;PK1hh>%%&er{ho%#YNuXx>g!plePmbm+txtTWebbp5h?P~{5|asz=Pi3XcL
z5W<hKMXhJa(`DGO3Y5j_+MM-v1CYIo@y4&4-Dd?$eih+Ona<+dyGXy{h%K)%2lr69
z;HHx+0OAlMc3ec`Bugy75$X@f6-omG_Obbu|GF$^%;BE%Y^qECqUQT{J5XK&WtzA*
z{8ts%+0oR}9K5p6+_v^}b4we+79sBVkyfJM2ab^iO#yUMZdrZsPD$hrQZGq_IeHQe
z`RRkmx(cw<$&Be+^OW({3hM1HhA~0pnA3*h$elR|ARIB^R0&lGx#M;E$x0vOvr&_}
z=LD|dUUCitY+bYhY=j0p_7c?dv+@tWz`<iAl&g#uBqPjtnc|KzYaZ{_X)Yf8{v0i_
zAbao3$yqg*iYLM5-jT_8u1S$vp?po8M*JWLI2)Hs=P2dL(aj^%bGVhBr|EbpMwO5x
zHl{Is;S6h%GiN=M|LI*cG`R=OBFaF3fsiVl`2n!Q@CH2^oWU$Xfnn+dYmEk?rtU_|
zrLTzONCy-$VH(IFTA=n97C+WPJC0m{WmQ}FGhz1Zk+QLXxA7$2x#RVg_?8oNOpsNE
zDt$aKDC$xsh2~4o;f?QhB~|)oIw2&6XjZW$-qS*&gSctuXpaioKks{uy}tOSPUj5;
zS%OsbPw`*Fl4$BZZ-@=@=eCifR=Jx@Um^}Og#3s>Ii2rC2MRYiGpnGGa?CQt1i<Ty
zh#ZU7=uLDWcInaaWfroEsOh|ACvcn2(B_V=D+KQ49|wq!u5TRL3K2qHOP(q6HWPE5
z=QZIZ897!9PUc|ag8b*H#cg-aK+4e#Cr<IHbY|Xy-XE|Wz}FdmqTfr^8I-nD6<|o0
zDpTycorG|fSL>3t5Qrf7Cpbp~en|R4+nPKLATE97i<Vz05b`UbxM9gVrlyi_-)X^`
zpnUjsLFlDA;n10ut+X_lMNNku$F051*H<uD+^D#Wd904CbIuem+ouq^A$ccH+AAAT
zQ6m-*>>RBj6J^m9QE)&2`k)FBtGF}|u~eSOXOCMwcu8ndBMzr1TTs9710ySm@+ZQz
zbTlowlOK8pjM;x59lHs%@4XmR`Iah#p;jUH!+RuB_mU*+VL4enjfQBb#q5i(o6ktD
z0U}8LP5C3pPP1Lb7VmJJAy%V~K#|%`)BcYG^7q%QYV@vOy;+aVjoH(fwS*?oDl12V
z0@rpgWOdwo-k?C$za#Di8ez}9vrrjezK*_dE@Kw_7Qd6lj`|82@xz%oJEBSkH|we+
zzomXp<)=CfJ{U*e{>^PaJgXfKmT0(B9+D+`eC8^cJz-ikwGX@h+6rZU*pJz{fVm6;
z_C5B_y9hA=h4fSb1ze@-K9AEmXA(2}p1V!>xurM?U~B^o0MEZ4-eR?SW}=tGV4%n~
z=X%E~mD>FJ*_DY<m{0X%xqlzX@pi}Y+Uq)mSmhINRH$`!Iz{LcypcxA%&5X;wSoby
zn%cCv0J5a<4H-tYDn*tu0J;I;umK!eqS*lf)=}#%gE;f-QN0?D6*dEbGP05K=JNT9
z%52HbS#Wcn^eU3iT`>$&97i|4Apwqf`H=_l4%tU|G~Czp_Hu2^Gn%tQG3I+ew6hci
zM_XXl?Y_Ks{f5XYgQs^$PCd#c?0uD)YUvw+De<vyI|-&xUaN3Bef7#5F4Ae@AW*`q
z55b2u<ErzMoIm{1;l8Gz8qyaW2^k~<%cM}#YAVNmQ#9cu_kI)Fzy4fd759qnrki^%
zn=Iaz>O>6>jv>*m+|re+{Wl=qWmSw*m_7uluM5v}?dLmru)6JzW`-@3k~??&1|bl8
z0%c6EbXJQi_!Mvl%|A97f1sv;B(^MJ)hL|w(C6&hUzfXxW<~dD_w2p~H^x!_;7X<N
zc9%7mmQhniVO4-g#mhnd(yNXfY!ClcyyH6$AsI1xnr6Ztm}}kc7<8&W5zBc#M6=cJ
zmi=P5{i4(Jp_nO^Dqs1x7x+cZ^APnit+<?>-?m#MAoiiV;yb5-m#wTG*6PsY5m&!R
zd~g<a?RI&UTvmJO&m3356IaDE8#m1W@&<~3ov>7QQn-mHNOnJUO>%SQ)wRv941n(8
zefrW%RrpF46$5r=;8w?+1(pA~UyoxvZ+KDS6JRrG<<lUw(sE1^<N66i-R4)3!_4vf
zilbXyf2Fp+Zs}}5;+5_OZwwBi>|d~zCVG`8&eCWFlyVN<n-TaA7|w4V5;SSZc-xJW
z?dHUa2as-aUr8J_n%T01$GVpa#2{?F0(j**szJ^9dVKYQ+kt~^hTX)7L_yLMC_1ED
zO8eQoy1(7EeABND3hggG^eDtLtMQHygmRP^qCyB%QPhl1v88!@%l^XD+=8Re3ZJMn
zML4c(vkvU!KNS3UKZRr%V+R`;HW$Y)>#LiQjAx$KZ1?4ZJ{HJc&%p3fC{e9#lqDrX
z9)U|p@Z$h;g&=c}oo0FBw*YTbd4R%$A@cTk>E+$;+441~F>`1-OB1Ieo(9X=T?axp
zUDUW|ThM19*yyurPP0s^@0*^I{`>8KRuwf0!ptF6^9yqMzC5|r$*T5{TDnoz{N2}K
z+U&gdEyH|T4IWo^(M(BYy1&|eA4!>W>2>^T%WS6@b!0pttNllHv706H6glFUKxHJl
z1R#k!`18YgkcCG`(Tw@YSvx@zt&jUp$qtcDQS#utdN|X*5EGYL;R=v%nx%X8r1I}f
z%dv{fv=5LZrk8H9!t^db@niSWY>RC(WtzU<3du-()f!yT*FHr);|2p~D`)rN_D|c}
z_{IgnD;L*B&KcSzbk2ne*%<Rk#j1#g^2L>bk~sA0*-6Kvg>hM)JZD9)fnx=+nHLNz
zdAL-?LXnLljm0BzM9pDkmFgHzq&F`YtgIpUTY*dps{c)+tIzbW7*2A(32g`my&CjB
zYfvmCo+Dlm)mjkM4rji!2af@2eVP~!)v55EG{G1e!nDoO6<RFi+AU+EmgYoNWqwoY
zbA3W<$dfbeiOl|AZ`o`Ag?!>{n-2xzQ;RxG%TBuWoMza`>rwk8O*QW>wLT)*lhwIk
zL%4T5!zJJ(L4<!Co4<9E!d2Dqk!qb}kKRFW!c@O)2YS4nxllH$E6Gve%)lD44K^$*
z+fVwTb=pU?UFWm>lkAIch`s)i8)LyV4$NZO;$9#=fU&}3&)y<?oQlBhm4DBx{<qVG
z@c+jG<o7uVl70nDAHUlV7NkWzLw5mk9*X>D%oqmc8txg@<!$${x`$TbsU1b|xB9R<
zH;cwJ`}g%R$#2q;Bm%k@|4Yh^fo*(qjK`Iq(woGNcW3kzgm76fWA*)6nBi63)m1P)
z)fG2w9z(oR$*g*)62Sy!od#jls97C-{ars<ijV@Y`}<E|-l*!OYI1@>)3VRgo*6pX
z8`oj4!WyiEg?t^JdW0f)eSfrklm)^QigabMZs6h-Fv7!Pd(M)^uP+-o>D_S%ZC(UZ
z#{B-EC(7#!CTuj+SYo;N6ZLHRFI3Y3#WQ0-GI~lW@GvWa&_9NX%Osgpic7miCQQHd
zr>Rs`oK@EzJ>2`q_)Rn8U`{;xxz^Kl2=!jH+9e}nVa5>wyEB~TLaNQ5M%XPTc;Tmy
zI=3zOt3xtSugcc>Hzs?;vD%{ExzVDy!TU$qOx_#7JfK!AUA?n|=;YcZ*70&?ysf%W
z$Q0kO3Dy^ci#xI}*(HNrq|#{=#Jd-FZ(uqDi2o&34EnKjuJWmc=rZW4AT%V&c#}vI
zk~!2?+=zSAyf1FD=351ZB`0Xsmv2&Mo1Sorw3_|c8!gBT3|H=h1f5-n<WcRen(88A
zIifUXI_kt`MA9ztP+cM%Byh{Wu)&A03G^JRJ+|JXVW3+Zbmq6z#UhgH)wswXhNx`=
z*H@N0Ao?q_5pYr&WI6TV`C?5RI(rZ?9jk1krLp)B*vwDfb!M%i$yZE>5E^8^)ek+H
zny>ueRRwJCA&AeQ22n}MZCOgNt$=K*gsdrh)|}Zp#HTNpa}q?V_mO+ai1R<cGlW7X
zaGeKO?>Xdl<NAqWPtKZ~+ip}ul$5~9JGvRw3vlGlbp@tZ<RcQ4Kuek&GAm{%(F{>}
zOwv@FK4tS~#hfWq>1E*!VQVme^-(mEDx3K57}+ac!)^Gq85NrhyEDbD^VxS$oUgfU
z1mz|D^l0tdYSlgt5O=Q;qu*|i3H?^bE|3lLh;pU^bHGe{jsFrzBj;fpq``*?*$5^t
z;<GHKh^f}XPn}c!P)xJr)mcJ0V8)k4tL#e?@vP`Rg9m%?!3~w<Xd5u|UkI36-il?V
zH|R+MyVrXL2Jm@)&`oJPm?X%ApbhUu3YM(Jh%6U<HPcrL<SL4%jD8<AV9Iv49z_X&
zHbOY)=FZFPYxpClWU3JfIH;;v1&;DM=ud~@4>WS9<wGS5y+K^`(~9KzFL_e<-e>dd
zxcH$j|EhEOt%S^yilN6CC4F{;6&0(dlggFk^39C7F;E76)MCwp4nzEJB7%O8tR?KL
z@phvlg<NymjDj7V=<>nJrtUCtFas1Xl&_+*&zQX~p_sep#;4Ep8<_P6R|&=4G=dn^
zfLLviA#6^T_f$gzG$4t2&G$CnU(Lt8r64EL8kYBwS07mk4BT27Jqj6Inq+B0H$Tb7
z_^#`QdrqRY+uq`d71FNy-35Rj7ZWI%ooVba5F2Dgm1~|MCgsT%rNcyFK+vEq(A9xS
zu3FR8jT;VJ2=MPoWbPG_T>giVq-l!K^^7WK<IuzB6RVx*Nzjp!WM#b3`*HHOrT~zI
zo<Kv{U=L6Lcx@T~Rc6hVGd6E%t*gRv^A@)6Jo{vFl4mJQ{4=7iwu~811YI7?l8wNa
zSLB^2i~sCzB<jEo)foXQD`ivJ#;Q(cNOcqK3Sbm_6-u$n<dGHw<8OD4^5?2Vqh;y`
z4(R9CqoB-4FGRa1GY7DQ$~o_;=xEW-w%ZdW;2Id$p&Y?aJSy)?nUCJw?nkj6Qr(SV
z-SH+>Q`#7P*Sg684tN|fjKA7NSARE-mPi>~E}I$P+GwygL+a)`yQD6O)bp_RGr}Z>
z7AT6QKs*$5Pb6i~-R0xAY4hv+`I1R3sjeKcLttAROj55+QnchB-&FBJgZ9FgA+ru$
z6`=g-NgZukG5sq5NjebcPZ}To6qxWfHhTF=jZg_I$*K6!aqRwO+=1NWpr+#I2M*})
znT3XoZEcL+%DH$$=5R*HC%UR)ieiz2I!hJ<gz}ss?{|&Z-|V#dfKB71fc+}ReBzMP
z+s$;lXN)QsJv3Lb18^23FUfNDKIe{cLph;fosqZF(*Wp{9}SMx%G6_P9c^5ps%kT)
z$3lPU%Bii21OB27B^nJtr%ytS5Y>|c;EYWHWk+^3sRBnIgSK1<PS1h88B>h=G{8H+
zqB)at?3*nu^E5zez}sXv`wGOTLA>vKuOv>NIZk%ilQyUZgoWSJkCjbics^SzYGGJ4
zXi}%)l8Re2A{geDk5QinkE>=Ua@|?UYXgAQYvd<pR}B)^{j`sC$tE$1Wvs|A^7GES
z)7nFZGJKLm_JY1^*!S<?C*jDYAR>tQJ3CBZ$yv!1Fl5KZIs>Bco$WIk_@oO2q~ipi
zS))X*>Mc}x>(jrAR6TRo6UOo}nE<AeP;a?NOw@Z?(Xo<y+1HO1Sz3aQsgaXXvo?>B
za2{4_Iw+44irT&Q4i%}s#a<hDC-e>FR5WjJCPYDI_>M$B3(Y!zIaU5vKKEDdlrULy
z!c??O!Rq%t;qM2p%jOg1D-en1XBE|XE1F}$@mYgZuS~0AURxlOei<&^AaJTiw<R%y
zH!Wr=^Qz;&LnKnb25$bKhtOTWjn~JSw~hrzJSY|e5;YA2yXqcg?CH#S6(Px}ON^+h
z@neT?2kZ`n5ez-{!C&sKu2I615TY7H2+_f=oXy(4LQlax^UD~0z2k;uD#eEE2MRX$
zpq{)W3(5d+Qh^K124*QQ#RWxBN}jXRawH~Zi7f-FP}(`GMOyS1RLsl=BqQRjExAbS
zw92u@8ip(J8I`0xZX?B*JszO&O~YvO!K&jq(oCq81@!861-)UM-nlVo&L7tvmJVz1
zy7lsS1W<lH`!{uCcL1cURy&4CQ$TWf^AI8~7Rt#{afL^R1;56YZk;71Qgxns70_TB
zW;T{r`IWlE@C{P^Fv>^uUw2b;tI=|Q^67T=ILpN~g(B^0jf&yuuQHR#UUH59AA4`v
z7Dp3x3lG792X_e)G<a|g!QI^%EVu=?2@qg#ceh|+a1X%;hu{H%I|L2R>D<rzT-W>U
z{DIS-hMDf_Vpr9!U0c?&Ysj*JmRm^MN*R8tXU)n*=(jCP%FFp`JGWOZ$vGoX?*@Yr
zNTbDWQpU1K>f!}GFc~8yCnbV$hs$|)W|;v86L`)^oj@uuDA?ZWAkxEKdcK>VhHZpk
z8rs%1Z+@;NBdPKV4r@hEPLlXMzsp6Yq;NZ$uJbpx#T80+dYkYPTz`NbkQqSs*W<=I
zPMVXI8JJCr`Gt#ZD(mS3R))<)ox|oZp+_o|Oe@0MuUekeCa);2$xN7@aKQ@n7hqk6
zB*7gb`Y5Yypc{gpM^B5?QdevzwwO%SFAGUz^hY*{W170=^#DIc^4gLw1QHvF#3X8=
zcNs1!mX{V~V|_Par4TqRr@%ZlLg0+qX7Tt-=bpDTX>9JuRbvV&i3SKEn<^+?LDky$
zO!VEhCcEab$3Au?mSK|DS!J{K>vX#$x>4cx%zTcXLOClYV`tL2@MOB9fUYW9QU<Ox
zmGfj%)Q6!b-)=XzWB**jC40P|cj@BR3mSz{q}%)o-~(h7HNIr3*YL%!k0{+!AI?T?
zm3|WNHz@|X0?YpuxZZ<ouW}dVyX}BRs9C9CSNtAEitZ0)jl|J8j{_oJ`j10^qg+`C
zB5uSkyGDq?lC0lPpiVa(To<(&C7AF5h5fE0mu(!MvQ(}#t@Hh&=l3!!35Ed_f3{~u
zr=Mq+(w>}fg9F<Ez_}~DQm|L8#tz{oz+`g#w3oDK#g_#w4LNi86x6Roilyfun}(IV
z6D-qU!^X9DgB0IMsglE}JzFwvkSvRt`t5+mnNZXJaw;z{tElaZX2x{IkC~N~ldBeP
zWw2zfCs{F3(jIfY7T_Pv%{|FIVb2Q^(8!32vOWkiiQ_ilo)VBjcL;e3*d^3CQV%;P
zL`OCrU(H>0svV@0M^#~y45MSAu1I5^{<a}2UGE`dS+lqa6)xZ-cn7#Kj;6d0mud*e
z<s0YFyUHusOG;S!3^iuq&^PrfCi)!{`kcQH_lMsk-ukqzFg1}%n`Y#s0ls0O9MP4P
zmB440I33O_XK(eB!dgjIYc18o1CBIpJ&%DxQ8yGC-S?Ndo>$kGm)`e-<g&eJVWd|i
z)p+qLKcMs)nDs1_H~y$3iIkn8;&!GW1@OC61r#!gicvBZ+?G+I_F03Ts3fNF?9Lpg
zPtK(gNj}IK3RaXd%xcy__&*BbN4AUKXUrdht3a+=uLR%*Q`EB~b(#x35E4r3<Pp#v
z5(I%ISJ1D$;uj?rV~IMuW{E!U@`@?TXT0Dz@8H+CV5flQKoetF2ohZt;c>1L3bHog
zhQ>c<v=+Oi^p}5OKMW-9Rp*1LVU--VRDD$cxgZt8r4^M$C}HyKq%K9#uaeD{kSTyH
z1R?Ry{bPukne4~4bv*_b4}G>Q={>j7g{is2v4CYgCIWvrBIfM1$@-rqwZx(`W#6I|
zTQ6kJg?uv>%~`m>Ho<g?uhd!2UzyZxv+uiCZCgrrsPF{2ooRUs$q0u`52BzJ(7msn
ztgtk9w<^A~JWHl@??S$@XnF7sjzTh=^9!z-8jSw*R43Dc&@=5pa&fecoe}#rE0Dnh
zk|KQ7YRtYuFAFo)@tk8ps()XgWv!SC7Z|s$oj$~>TKN24vUV_IO23I0Z&;5$MY%e|
zX4>%Islee3zyKi__7{sIA<|FCU)W)S3$cIabVa?hS118u4&cd>r(&6z2aV7bXOQ5x
zRzo>4sglJS{BP97AdNEafknz$=`^^NzFWJW(RdBu;gsfXRuN3Ck~K}&^7^?qGoY<f
z$vX>s($cZ3DZz+%N1-~S|D+!4DdhKy-3GUW8zeVOxkt`n#)DSXu)x-aSBdc6Z9xNR
zC`3hkjnGV<OwtveV4d<`q^O)W2H-8`&Z!yl;zbD!tX<9soRMC#K07ELs<Wz6V~SHp
zAvYDwVgGxR%>SZ<`-&w~#guKrU#xci5RLHe3pZ$}6)3x|40{0`(+JIKL_y3O$S4h{
zA1t)cL684|;AW}$DJoGhrxDgNp=0DgVLqNKl%h?j%L0VUwhyjbe5X~x39-={%_i)Z
z>sE7n;3%spt<t4mb&1;vN2S~u^#JsKK7A`KfJ;R_Sgv5hOGn0&iV3W}Ukm#LiKo-k
zXYW%M$ANGZz5D0Hz^<zjm<3r6$)9^)za^<2iOdUB!8s>_cFaVgOm;F)G@K;(M;83v
z!kJmc9=4(#CXm{PpO&Kv&J;!P{J|z)(w-!&c=E*2rpr>24_p9=JULM+r)~mEir`Uy
zGMrxC<I2ldq|>exBhqrkw_=Rmez(J_`b4zdmk&Gp1jo<tSG#`T7mJ~7FJIAxG)y)4
z&jKieU@VvNUb-naVAQ!;e^ia?M%O7?Eam~C5%ojbVHygL8bANn7vK*ASi-&AfNI6u
z+}v0-fogN_<Ygn@ibZ-Kk0k(;8??MqZ#Rho^*MOJ#SSxOZ(fUYDhHKR)f(vxRA4Fq
zX(|%q0uZBU{(ikbxO@a-=R-7g2Q+yPf@(6HMDqV6zPP-7)uQJc#@$T=1e;7K$Ev5y
z{Y0Oz;nsBw+>LZY=2wHeP0zA=n0_7X#oWQ%<~(UT0y0E)_CN9+%uo>}*c}h}c=Zw~
zUuaoYEX*&zS$9bjnUt^Mi)RB^Q0oO*uI@IN48q?dG*|MEy`eTYIhh+qkZiAIg&PA0
zV-HEkQIfK0BR{>~vyto0akr2c)q}^^cAF1Vpm?dCp$hg;ZsOJ|{|(REn{YBqsdq9(
z63hUP$xumv(>S@ce7M#h3faY~m6=|eGVhF8WS?AyQLq9_J+UlHks}thwx544uZ`CM
zxLIX7aL)N#O!V7m04BQhL(s34`pE4s^P6Y4E=Hsh%=z>?*gU#l%1(Q3@LydA{7&;?
zQCwuD{!f1F!_ei`k+B;2rUa2629ai|h6HU)DGaQ{uA|nKKgpwh$2Cvy_Ab&z*-@$!
zZEdr660nE6vIFi4&k<BDq9O;GH2zOjduN~2NQ$`0`gwwwY~D)H?y|b`fS9a}5$29I
zA>beu?`HmA(-}^TCQJx`mJw{KTNbEX%G-j1-*isdbNYk^q6li>|Gt#}#JuD{D4hTg
zmFymz%^JtG;2z8t8m?w7m8`SpBi9vtyF_hz{PMkNtI&5g3T#dGUN!UJjmBkBTh}TI
z^=gOZK!WEH3}8~kB7bnoiy*gDY_ij{slG%qB-wiJ8P6|2d>5d{#s}#cZBR}H*Upp5
z)#^**62dn=*n?S7bH?3zb}x{nBvC;91C%>Lk4D5%Qjf`6O~e&dNBJ`t5+{x)DpQxW
z@S|4(9rteew0(wsRuxd%j9~}Mr8nWdot>2X#oR2(R|h3tmg=Q2e~hruK=CF^P!vEC
zTHPrJMqQjaP<`Hmp=ZC%*ZS=&EOGMA&qtMMakpanMPF3ctrQr|{n`blRXR`Z*o0o{
z*puHqzsMX}fqJ4=P&Lcc8fAa8;c|ZeSoq~k6(n8SUslYG!e!9*;zVhjwDX^LJ8Lds
zI3LIz1NqdIF!l>-A5<COV3MVsf0!1^0rq#Rr6>2(tG1Pz+~hK5O%?L$q?Grh5o)C*
z-b$JD3IZQVC8i4G=8mLUgynz}zI1OKa9ET-gGwd<hu5L#G0}l7%9lz)klyqWo`Y1v
zfUo%S7aeBJx?C#lL8oASulBabuAh&H46&XhB_;v5ynWPE$#6h#7u7CA_Naljxq~;}
zSBz51un4~_fr(b@pIG|ZfkzURb1<Vw2Z~>8Ny}|qw=U}W!GIj%lyMMt<S+?G{ZfAX
z(T8b~Qx~n7Po>(0^ldYTk<`DpRUq^!XQhfI6-}#rO|zY4gKGsU83sJH(?*p>;3~s^
z?kO&kADmPGNLm7B1)GYZuGyEdGx0A-^_!)$oJ=Z!jBa5C%e-^BNBB+CRx=lE@yR^`
zZf4w-@~&|1SbK0syakgTLgae<%<Nl5=GX(B2#z**mzwpoKDonYvU`rS@8P`R;MWT1
zB=Xm+3Y$`*UT<myf|&dv7bATNmSpu-C>AM9U%gjNCfMKZ@7YOlnZ>$5&8o>54StIG
zYI;MURkQAahi|ENPjGj0GY^<WGlD~i%RiwGU2|<GOx`BLK$t%huJ>#=`Ez8Qlf@b&
zZ7C(&_J}g_p$4$!V59@QM9jdRAhPr;i}p42o6es1@tjw~0GnG=v6N|*PJ~JA3ckFb
zD0_1|<F*5Wi4#}UWsal<u+dP|F`5hG<O{GZk|ukS)OmhydR(O_<tBvbCjbSCLq%gN
z;adziv73jJ{Nkea0CyFTQbKfRky#8?^zgcW%uRN0^WdI^!*BCp0-aCelB(h>n}@cp
zr?F382r$$LOjdp$Uamhb4IX0!HO*$I+dN#p&LX7y*Ht{QliyeKOTez6GF-1HcDN~+
zA*~`pouOyhZOJw+P&<%nYscK{B8i)xKS;%~;7Nyb3=|v1&bXnffYbt-I2JYtu<i;M
zZ!p74L`vQeF(*$Ek1$%*7Xnqe@ur7un8VHWSD|W_l2dFIT3F(=V`uMt;oSO(OetYf
zJzMoa0r(h`5AtW2q*}j&`ykv{l-!b$Z()G)-Ccw2jDJpWf;uR32V1W4nmO+?*6b3c
z3zdy(rD=?+@%XDS-c&k*YrZ3oU5@kqLWl5+EJEA|2E-wbPhZwf6J?i^!oq$1v?Iz;
zv$i6O?QeS2S!S%={Y%~kIui$|iW$n;UA>NCx}`Up*8d;p17cZRZT2`VYSz9-o7&e)
z3=r~Vj~Do7u%s?8Lr7{(aAwY)aKIv4n|=GLHEuZUCBdIIqk{EFD|L=)2U5e2HQ#KT
z-x7UzolYoPZ(`d(_}3?@{V~MJl-XH5V9t&#r@^^Pol`6GctwmDf}p|w@J;t+rb91N
zl=;^b`HD=98{|2=SGXhi1)1rYU3mL3*=tI*^Y<_jW>(Nv4iIx?C&BE;9W56l`lP`1
zE?1qUvSxBw>BU<)8ML>}0mM94rwsR9{=aOkc#fqwS$$^?zkVG>(HVWic@Hm*#T&O?
zLFnpboXt!M2<2b;_-YhIVewC|RTCN3n^Mtrmm%c}CBR@e5^B|r^9mg<uO^;#AR?V<
z3GLDa+~D|`S2sdG@m0xfStEBDF0GL!bN6TlXklfu;(M11-(}wMX6dU*k&&xmYFVZ)
z%etzJu5%6@UHVE5SxY1IVDk1*6Y0wX{t;nUE!YIOe$|%Wz$oN_3f0I+pky62uVX!;
z-@;}I9~;@Y#z|0{<&gV#KCGd9v8sp93E0i-BL;~6I^A*avt5>q7tQR)$Rtffd;)Tg
ztCn=F%1EKu7D_7B1^voeoBBOT3lhm=b0@AFeKTYcW;&OAO`mi#quMRzHgWFWGf<6Q
zx5kX;4<>lLl!a82^|0x9ej(oa+*(z;9&wEX35;Xy$Axew2}8NZwNl04)~MqKb8+tt
z92f(VhL0}p)1i&%`LDIum*-5BdK`Y!3@AB|Hyl8ebLt0$)OcsOk?IR&69$NX6c9?A
z8K<43hg;>%V<)8?Sa+#i2jM70YHy9nx0$<;Io?QCj2<hvqT59dAImU*&TVP6<|P|T
z9#i8*oJ@2)?p@lm*u%rJV8bGrEO%Yt1(CcF_QmSbqT?e!Cb7()9IoO{uUd~7EA0=b
zE-?Fktdam{a%jqmhoAR5@B!#%APJr(B5ls)nFI2j)W}{X%E=*#%5R<^P9>`W$32w<
zhOeVu(OtGGe-ar9hU^om46M2JF_%8x;G!cZ8|Y7)dzf!qfh}G-o?Q%>aT>7kp@5ct
zW6NFkM}1J#%@2;j2k^GDgqU-=Cg}n7v0mT0OrkRT&MCPlHl;c0Rhg>)9I)ByS7DcO
zCBu!zodoUJFwWev&=^@qgaNlVAMsz(4<Lns??CE9-1LsR9ssH0W~=Y&V+UqMR0dQX
ziCEz%pJ$oCw;6NT64rLRzFo3_p}_hs-k__OA>j;332ITj@U4hsZX@X=JV0PFy3f9m
zEN0up2W2wUf^<;M)m8N)DP>J}S#LB#%o33N$XPY_iJXC1dcI|f5NyD^2?oEiOeC#p
zQZSjEE7K96@MzO0<`(B@CjUU%2wN|l*{{~gGKni%MnGo<j^xd{h5_l!DUQpgUdj;8
zeDy5Ad=A%EvoiG6>^NmZ(JZN;h)XKaN-YlQn6l*}Y0ySN1Cm{<+3bS6s5w57Fcibg
zWjF}4#zGuW)FdMBxY`29Sc+0?SS%CRY5asHXAIpZ*}Fkj+16zp)hC=38teEiR#^vh
z$BlrNU}bE2<@`#&u(tup#HMb6_i9yLL*H5Vd=u^;`U@QYCzj(Sq({P&r+JwY-Mp4l
z0)h8$6eLgrMQT`FAVL)wEdN+ma@#Sd-72nYdL9>wYi4YIt<i9ZKPSreTN*d=cFm3}
zC10sVY4^A6=dv8GDeJ|LXU8c@ib1b|WCyoWIdGul$xp@YKjCYw-HtQkM5UrKMZ->?
zNMcY>K)vIXBo7y=7?0w62!I`w4S@7g*rodO((#!_P>1RR`InfHRmYs+8jf|EQ&mb{
z+7*vyNuy?ULP$B`@cTr1p$eThjH=+OUYa^?Z*=Aq&r5G36Y2o2<ASz~6&-WFEK(3=
zEq%=S--bI3?>5f6S#qy7#e09SodK+Z^)aJPUl{Y%=s7ZnksK|X`=O9#Hp+bY%)B0}
z9%(t|SzDhoF{H<q+pb)>gkBN;Qbus`WEI5miLAlX<9_m8<0n)I#9>gNGoU>?W=VLv
zS)pux@z|?!7VdtNgvzOunAfEw3XAS)%Pugl$*t&4ll<VUvrmxKatpB>Z9w2SJFl-(
z6z_z8BuMP9PiR_FY1U+goL%%Xxu(8KvqkeU;WT7zym-n--8eYLjvjum8=oeuaMA+H
zQPv`IZ~m9YSygX{t(8}<K!kZ6^O<YUGc%y#Jlm{U@KUIA8F)ls3zO!QDZS(YK<^GW
zN+|FEf}#ac@Z}E4w82hBf*0*ZuL<B5$0vU-ecuzN4mrJ}P%8yY_+AVI%)3bL<~FGy
zs{oj2n2_ZB?{X(EFBo1wR}D-0!z2vdL@^@O$7p5U1vYk<zXVB0A+s#*e62ky<ZD#d
z0}a&T_^CrANv)nV%=RaAe)sCOuA73U+aQ}1N~VTxyUN+mlcitowdYPgu{X{f2cYe9
zri<ouE!uM`UY22mIFh_h-=_XSLjSE%R=je+M*fbtd{sy4zW%+1-O0K;lHhAsI-jJ)
z(iyvQN67ppItmcyP)X@lk+So;FR%V~>a43WzjJwKStc7qp>0U{37?_=s%<YE1rq)=
zxrY^wE;^+ygi+vulFyKwzgJnpBhdr>YC|yX@Wz}8%$qzkUDw_#?58wsZCMvI`)c|e
zvxhA&QHHzkT|8;?S7m`xF8wK}<~YBoh3syijvJJ_{>^?|?M&8~&M~GH4pRB(h6*=i
zsLrdXTqLdJW_9imIcxFg{O(1_x0%C6Szo&re|X#!=|*nVMAJ#ZsiSC3FE(i}Z@7tp
zP-l<q`si+N4<6_?zFap@DD-t?*RR~JIO4{{(r{iN$f=?^V&P;eK#~fPtoYqY9sRzR
zQRI&$r+JaTr%Ydcha~4n7DBDt!&yX#R|}NqqX=QRRXZZ9GGD~h0j9SeT7l}-0eudM
z;J8zzRi<PZcidox6$*1ETtU|{MfteBrMvOdk~c%Tr-$qym%*m>YC~nMUsrEowR@=S
zzNc^Jzxdu=fJsn(m7z7_mQ<n1?cy)(;zS~T^%xs_Eh!Z8C{aoX=5cJa{h1(^VS^7O
zlR}p7e|-UFsh=R-zIAa#ch&auZz(b?*u)5deAiQ!665>WR}+e8e_Qq0_+oe8O<&Pd
zV7IP_%2Q#8j(b6j&Mm=5)=76g+vnanCV49sUcL_p$q9|Kb(OMqIj8&gil&-&^XHXw
zw!Ea5D4lDEe{UfLG>E|zuBhkB8GIx}MQi3?d^;W=#Vz`t!eX5Qe<#n}hMT3zA}UzR
z%kt5FO{wf;56IH3;$iedAVD(jY=kYQ^xVocjMBI^slg<nC`HnA&M)Qhj5}B4GdD*l
z4kr~QYa0A)ST23dt&F#yuBqC7O>Gy?ThR#I2n;9-XU$?19k4iBC(Vif5*T-ABEu||
zpwA8aAwYplL;Ou$^8?C#GS%e}_tgc(8C#HxMw-9i-aD1r&2-{U5fT*e(M;3Nx9kUw
z?|e<n`Z@Y(WCk2EN&DoSm70O=ig~2%N<)Gv?XR<Pm~rRtOLeBh!)$d!*GYkaG2wd@
zuBEY^fi@N$dL+qjddGy?+I(5cWhM0)h#*YJR#xeGPgdiC{TTJb?QlKhLND=SLAK|8
zYqjXF*M!3+I24-$TF`~5*}kakw|y9q6X)Qj1@GMXA;aFy1Nl{owTiUP4lOa^a4ap}
z%4!Gu)26H#6iL-IJKB_~!U<hYrnZg%2#IWLIa6DlKnQV_PS&v1HLHIC=MvuwtBOlm
z+~il=MMBq`ZQV3P{Gqrp;^9E?^C~9UFv?q^&3X(H!&z&Jk5>m_R(amoMPt_A+M-%9
zzDSmurT+1l4$bG!Xqb+iI=w)7@kGyagS5z;tPZ$K1swRI)kRbEE$P$y#f+cS)E-@b
zzVv)W$0{Sjp~t3EG)(d59#JyrRkb7t7VMa{vCet;Gw!hK1JU2bG1odelC!=Y!chG{
zET9uBdOckw+{Ez<Hk1#zbQ+f_WSZ*D1!I~WMK4)i_!kD?YT-33QIP5LvZQ$X4=-_|
zc(-brdR0KBu^Gu1NX4UmEc`sfLdhA=pC`Q6BQ_Dd9(CZ$V9HSE!?+2+yDmhq0-dI9
z{QkDLzuCs&(a#7Q5`QefLQTg)M5-4#SZ3c3${6hWmDJDqaLl1==!=O@`DCvNXQ!DR
zt5MPU>|k!f$iSACF{<-b%XWR6Lq2h2HfL)H#yQB8vYsQvR5{$Ia9|1LAyc{pb7wK<
z-XcD^yj+n4O$VzE6;4vaPyiWuWG41oYygMWCz|waMF$pPHNNP_e7MyJ@}PcdWSrrp
z4ODTezJ1kXWz+rkhcsVDR9XgI_8;&BTIiJR+>gU-s*prDUS5*YhF(NLpQ=6zBJ-}O
zri!l<+6N>^$d<7=2u{&t&|v+CjiG+A=os<&TH`!Q^!w3w3E8%vra};Z3EctzD0y%~
z6ZBDCIrY9)ff#Z=N%_0^s(1lcS~srNek<DXleYAiUA*r2<0kZ&qmT>VY>VksoMROE
zzOEl`{TCgJ4mDL(RT_8vOILS4AGHub4H7Ds3^*O!UWO^s{2%U{Wa`v2Rm;=2$9jPD
z(y;y%0I4_}Qf<!<t-HmPZx1H%yhAZu3A7Pr#Y2hA=tYzLBZI<azY$+7F-iQ#FKKkL
zDD6Fk7czjqoJ_Y5WKbK3Vnl@YyfP4Yap{Um@32Y`jjZ_<)x!$<<e#ro8fyk682xsf
z2~;5Y@N%YLtzvvepm>$M0OxyD$71F?Kd2%U6-yJ|v+U33PXF_p%j6Z*I*Vu(88{{#
zy1ntCH<9$hu$@6f<@zvbBivvAs=r?1mGU)070SuCgu7W~Zw_1IV(QJ1Zu_&rl&eoe
zx)%$Qi<sw#J#40Ur7+tShe>h}XHze;Qq4>442=$Ypuou4Vfn4ylLWC}x}w_#cXWS2
zm?aZf-%YqZsX-sp)s3GlP{INQlF(H}q+nZMCWmHsNe$$4*2|LZUAT=s(I8@Fl~9-w
z&7cQOZo-qhp=ZGBkbu`&p9@@rVDn4XR|nh4yRKD<_EL#M4KZS1e>5>W?*U}Ui<$4#
zPVxj`bE`zs9~AW;1C$|rd$gw3SKl$2eLYYRnRqr?7nzg5K`%K1WAMCdmaNV6pX}~A
zAR-c+BWb<ZIm4jv?^Q|FcR%ZIr4ZD6rFn9Si)%m6A9z3s1LZ!`M<ymaP=*WY{}{p=
znhOzAN&H;*O^r$*7oGJoW*5jc+wYZs(=cQ{w>b9l#Zu@lqC}Cu`8d;1n^ulyj1Yul
zYksGRijh$fEHd%&bqaG4Nm3~{ZUts|c(fWjT4>_fouVC6k!0lhPk}kroN}i-x-7ex
z*xh(I?@Lv*U@t+4QHr`sVDj6?vm%EboR6*)-6|?KlY$KCXiA75xE6O_%<@lCP`iEE
zyjSroxJ-yF<^9adWB>`T6Bx24vjXOqDrX;%S~<xsZ=L(fhNpPJ0^eJbWAA-o)6))`
zJWj$Uva<h;Tw=P__O!Nn_95>1XU!(t`zGkC>HP9y{DBRcEIV{KI5W%!Sz_jamM2On
z&wemfa#B%YXcFFIosBn&hhw31@9bkTT!F$BKIMxZF6%Fsbe~9;)aVi@9{hyRni2M|
zFH7o&5)h#n;A}K0Wb>tRXFE9vl@2uvnRnViLhg>qTM~ngX=@8YBCP-h5~h3Oq8(n$
zh{Gk*QOP2{Jq3|`cM)Lv?CS4?f>XXYO8%-B&tw>Rlk*UXDrl7#D4mlyv^5;1+&HR0
z;hi>BO)?p_u9{5FrH0M<0TBckc8@><CNFJ`5N_7Yq*!sVFT_7g@^CkPRLueJa9J=O
zCwUB0sA~}aJs<1KqTE3m8GuF)Q4Q%u0zyo<mgk$?&6rRz8lszqrlr%{*V5R#^4y5n
zZxJ1%#_V2Lq7u)L#HvCrufVkc{rD(07-A4nu#AuXS%K}BeNODI{V_>jxgFpV?C(ig
z4VKBt#|JYTwbZLz0BsdebR;=E{+{G!B05{1;XYKg<CfBbKq#`mhx12b(SN`T9U&fg
zZPP0w4;E-px&RJsQHYMFz?2B%y5b`u94nTK;MaLM3<rm;5~xLLz>Yy^Hg6#tv!)1<
zIYgS;hd54O>={n-F9|#Q8c=)5A~Z|1<D^C!fc%_%+t2hReqGvm2RI~y8Obs<J?m=^
z3ab}VlM)j+C7$37RQZo=P;o;w1C*0j>Vs$3y0e8T?;J>piy%BCtp3bwng`zoux(x~
zvelN0$ya8E>;QSP1o)=uQ?ei7kTIa5Z~yYi#YNzGvcxu_HY}IA;(n7SIFWcISlsp?
z#CIvAg9ytN6Wt*m#P>&#O+#y-qL$ao?|o1FXYW)TIj}U48JR!S^4^Gn5u-xP5;%$+
zU?z_(xU45N5A9++>q;v5+LGRFO6hOjp}xm%dBayknLV#&Gg9#Mz2Bn9y>Pb}Nn8Ia
zB!25WVhWeOIUXMM&vBoij>A{UTk3>F%e1IO{SrquN#;0hWUDxbWQv-aCZWqLo`#x&
zU{=q;+VT-BpmY7M8Bv;@NV7)d58WpEBSHmQGBwl}5t)a=GZkMbx3b|N;eXma!v&W(
z?Qj-9wU=yq!e~(YJDNN3@J=^=%0&AM`m|y`o*}@JM4GMynewlsTM&g6u*uj-b5iU$
z#;@L5JmX!|iOXsdMeCEw8R_TKsGHhdqI^i>fO@CC+x{);F~IR2m^{+VOe}+0CGM$m
zozunY;~x<NwxQE(@~u^WM8y;HRLFo=oU@XtS!^n1T6}bR)NX}5$@?yMweEfTn$~J%
zqYn*eK~<%WuYF;jgKenhW5tDj8HP9kld7zNf3;Ej{HN}PT9wFamBEpHObtNRY!suW
ze2UXhbwRPtN!hd#ioP#TH=rd#{QW|PO2|{lbP1LB4p!6`oBdu%urwAhSYQ4}QSJ88
z%k<EUAgGT&O3pF^6Vo{%P7(?N^|QGB&N%0anWNd4U}5$0J~wkY<a4mj_t8Q<z$)g)
zj<bA|Bl+9yIdz_aIgJ_p;Wb_4@Ke-(r4wqHKOv=iBj$7aE`?hNwmCE@DIl%UeBLv-
z>!S2?4`r&xDH#EsG8rqT+kv@g0>0{fZx6-Xn780!-7&Iwo06cj{zjNIqYNl`qmXFw
z$U4VB0$<ukAVR<Z8mc}Rop^-xC6mk`QiqxW5h#y*CC%MlM}Y0;c$^}(MBs3!&K_58
z6`{KI^%z1Q8Q+(^|ISXUUS9%p`@p-NUN-IQaaZy!jeH*s&^+6_cg-_@30ddk94NS)
zPoN8xCjPgb?&Ai1=(5Mv6SPtk`+l5k>UtJ%>@lMq21xNGFA=>wqasTEs@1!S8D`Qp
zfAhC}^>cHv%H({D%J6IdUp((85`4{n&!A=ksbUOrOiz;7IV!gyx)6>)vbCM3hSmqd
zvOkEM0DArjjg2Bl*7jFoxhOaNf;jdhdamJv??AVh1k@9AeRr<jE_=yGHlO<BX1NXB
zaF}>!azbO0nG#o?D!Z%nT3>r@3=Oo^8ebuM9zI{2u1uiNhh&R~6Px<fR+Nb5Wb9Il
zNd<5w&+JVY20#6{dPbJx5k7<U@npn3fYp-pewjw@%*FEO1~OcqO<px*C7qa%{rPKk
zU1i6Z<1aE&|FPzY9l3rl?qX-Wc$ev}=#HYo_D*r)A?%;tu#*!iI`ukU{kx?(;kev%
z@p&`uX_|Oqh8)wR_BrFZv*89(qRFV*@h8;%jS9&~I9m>`htwIo(pmI;X!AMX4mXv$
zkp8~6ux4@$RNoXBcbOD~vXldPc<U2T(%_%<u&EffU$kk;5}0siZY_T*nv>+fhiQ}i
zv_5efaFX(=>v@c|<`%xY`DQwdtBCCB@wYLZ{a2K%KpW4n9Cq>Z)7|Hr`Jkz=i*dcn
zO6ma3oQo#Y$J<VZk!Rmi)l$_Q0O1tfd}4LyboG3hvi+L8;x6e1CzW1)qWk8A=h<&F
zuDjLeC|xEs2uI|BH-MSz=zwD~?qYY;!QRR6X%U4bXR1kzA<2E*sPEj_j9V%6s}x7a
z-Rj!&Lw#3WEUGE13`}1DZ?^9#Tjt)yGxYqE!a3@riZk5wY(!k7!Ctv7Vy*je4%NBy
zvB&t+%D}nxS-T=r%9MMt7-e085}~q1vhzM#NlIi}#x)>n<dT<_udils|9G1OZ34>p
zJJ;<^(e8LAm*?S5r(&vqhxy}<sNZ!?;5pj<FL{MrGpY&Mhf3j7fYgmR({PE5T&7&J
zrtLuE%1vdmt5QM_^P5O+D{D}j(RthxvzHM5$$C*`;BAZd+I(1uCy(=&BFezhhI&$B
z>~Pqawf{6^>87B>Vrk`1OxEdx_ibi~uJjD?Vte=Y&hly3b91vkTWQO__|5*x-^aTh
zW4~+hs~=gaq7NT4y~kp@{hf!SqzA`}PB}W-ZgSUFLxBoE<jX8^F#!CgM%YQ<IN363
z;`T0!de!$n&-SVN*CSo3jXg`zTW@qhvJ9EM|Mdk-MP8(9#Azt%c^p5R_(yD0BS#7c
zUdHf7yB+kZB#ZuZ<&Bh?DQ;!W)X+~H#GmIqj~smdd$aj$*z7e^wK$_!v+rFq{q>Z*
z%X_CV1Q2nK%EctSz(aY04$%<^T5y|l9bMh+g$^EGpoV(%P`|wKM^I0EcnT&NS0)&q
zNsvtL3-sJwsnn@1!IViWn$fK`xTq914Dwi3ZiQPPHn-*meY9~mR6Uo1HdGjA9wi?p
zO-L;s{eAxRd`r5lSBHz#)z)TzUR;MA@osyR5PKQd-KO(ub#RLLkl)eo(=elb!KgJ~
z<+|fyR3qKNSBtWs#~stRhF#Z5gopaYSwY5*jc(3fhp{X7)+%{7hkn$e_oHEq6#Q{O
zvFFRM?2-{3Q_tI5W=+xppC+fZ$06~&B148H^a(U{K15A@f)eh#zzsCnj{B!FkAn93
z{_{6YIx=bG<cFDbs2vPnZ=nt(KkVf#&F*aun<oGM6}#cRom5~M4Evx@uuUm^{q5oV
zaFHT;Xoikj!XP<%8ASjwr4<uT20N-WGj~VpDGvkvu%v5w(X0K0&wbfg;9`<%V5L{4
z&AwlZb84?EDLG!3rLuW!gz-#>WCZ$O%{JGxoonz}CBvVtZ@$h=dN+$mTOf-^>U32(
z)I6W1kykoawR|aDSXyd3nwgcQbk$3AkRkjQ^l-cDv0m_eZ|cDL@#E=<XPc_XiJa$+
zMei4byRLwFvAe*@%Qmt*6|SSb+j^_m#!nv1JS`&lgE3vZ&T;&)Rqa>px;&uZANwb+
z(|=tpWxk5DAjd$OZ<y`M>Cm(fvOOw0Q0luy&j|vkc~dHIxUUCS+W*#@yWZC(zxDyt
zpi!M$KpU#U@YFM{_?0Zjm1%1bc1rqyq^)tnZZuv6nZnG^m6Z{<i1T#y3E9IyI&ycu
z@s|yVJxZ)h*zy(!9|-npBc~!TjIYCfT#DXF;zO0p4c=Ek&(jUii%zwOvUqH+>Egs{
zOcWbo&Ov@-0l<Pv(OorYwLjL@g%uS2%TX#5p+G!yk9|^ev7^pxbSv{eKcfBUPW$r5
zPy&3Xf9}|CXDnl!yV&|$xzrmdseo}}pZun5Wtxpr&Sk&5>g~p?c=5>E;~n_&afKo8
z>1s7E{p}kRP(GFxs$rLXrva{z*@+V0Q8{0V)t;FH6a1qX)O|3n%jdW`aPIQl5ArZA
zcawO(?EIynS%__ztAJJaD=X#Yqp<1o`7RM<%J{=+NAuBY_miKJRO1-aB$fM87}dB}
z9Dm9X8;bdFG<dmp%Xv}RbStWXv)wovGQiT(`x;;&YSfvV{v~8HUXZ+2D4T;N?QV!O
z3)geqNOtckyZ>8UQl^)sIyXOmy408iX3ZQ#$zoSTZLVoO7}=d7HeUGVbN`P2X#-yC
z-__Z9KcX9$P)flSG$-2KMfw^GgdW|LwHc+QJZ9HOJNnl1^7lh8K2<nDR`j`OIX8f-
zx(C)T@c0u~5m46}p_)dg%^_GSkcyK+cs+1Aprj+yrn-+bZt?pq+|-K*dgQN*BBbDU
zp7Y0EUun?&GDm|H;s$WDgz@hFSyU3du4=?3^pRU`%JJJ|{}7Z+8+5XP{;}`y;(7fk
zNI8ewd<yNN`?0e<d7OHN(InteRou9h3N;HMcuwTc&`h%ExS+fGk?p`b7e}YU$|7-K
z(vK}pkK3Yr&wEExXD7R|@9+NpA@%#)m>YEVX=A7L8V<0te#~ehMH+wQPDJYYP+Z<L
z6@{6yE}-&CKy;$sVr3s)5TI=gYdENHR3hEbTf^H&PE6XNj-g{Q{M$@;tR}<!SOCRJ
z;btA5IGvlDJ2+rT74(E!C>lo0AL?>w2{>THrmxJcQr_0B9AAB%q4Zjwy0DRUzS*j;
zb^ZmrsQvr&8IP>Gv8|0IYw_2DUbFjrAX2^m%g@C_Cgy@{!);G=w3tG<*VJj>?NAWT
zcS9obbRynq$Vahv-@yHPz3wUohAL{ND<Bm%>`tSG{Xhli(PSTws_<*yS@;AWOb#z=
z*>v&#zDTuJukq<<h8R{jJ<r7L^p!rsDuEACAa|2a9qV=VFPiiomzF&Y-3sE9_S5;g
z{X;<Alu_@FW;_DB;J7wWmamdK`EbKRWZ~rVVd~xU&>oNX$>)vx?>bpQM@x+t<#gDV
z8N&9fM@75TcW3AC#GfA_5lSRd#CwBima;QxLXWyZ{^>uKVT6aVnfxCg7Ss=_`5acC
zCcAUn&sp>G#5^|uXR49PCqKVWj*f(mcS<DUQIaQWR2L}yW^xK{GP+>@*zb$VLZ5kq
z1qcQ*4VE^s`N*3jA(w`kv>}{#mW6_8K}{jscbq)>IuXq917v19DQpF>JC3+ZvYWdi
zDmjs8XU)!~iuX#A=ZL~pxuAM1)N3pGPM?~OpjYscARH)|J3k!dQHe5%ZMeHx&#=j*
z$Z@;UP8%0A+DD%LH7%2-&ps;B7x-A>PJ4X*DaF3spS!uv^YN>NV_IGZgC!nO^gilZ
z+r!t>2R2{Y{k2usBnG$mg}>cbDV1FTgBP`3WlGfg&xd(|gBCia&7Zu2P8mO`W^q47
z6K5-kYw#6)_SzilE*P=R%#+fhIK2K`xcf(*mV&tm`8|A5EcxPlrUxR9Jt~uG!@fVD
zPkNHYKL6$Kd@w0&y7F;bdwdSOG@Td}OP7rHgfEWL#>H&E=Z%xsKp70LesGX-cVCnL
z6#h0P!SDIb`A#9|X}pGtkKS!7-wr(HqClwp*nKMGOGM?pwT}uIU><n$->^i(UIV0<
z4~6z50YKt%fI6pUrPV=lWlcx&8?lERLpuc(-|b4Eq(fv&O(z>Lgqoi-kC0}H2YLdY
z&(&wIr`Yg`Ivs}pP*UUdN^%iAsx#JofUNmQpByI5`)^-d5(<NN8l+M?&uT;5Rm80x
zWNXEQTzrj{XIWJr1^cM=@^p>7*aNtRDB+frH8dj>EAe<_$UKd^B<QwkVqa;EpS(^T
z$u5`vneKN{E5CJiwVYEJ2@`~ym#Z}y<MQ|!*NHloI-c$-yN1GPr)9ZjL<VRB#K_1G
zo}TuCEE!Gwwxu2P*hHM3l7}~EGTcYzjHA=oYAb521Zi2dc?~`$d>;6#Jvr@wS2P}u
zuSATDRBus&??IH5!JZD4kt{oM#zvNMecWpZpPv7>$;|4mX{Z7i0p)XJBp<YvTd7T1
z9?s7`FG4j)$0X|OFny#b0=^nvkv<Uq#1NvKxbJ-}pDK{SAV{CFi=lrRpZMfR+$zGi
z|00d!=(0piQI^*o%l|9wnbPf1l&~U>1X|H#<L~lbs@q-nB*qwW@7VnovY|ugKsop6
z2Or899YQ;LTfVH+S|imS2eUQYr7i%v*<u@|jpcAjaqEWbjjV-!;vyM&vNaW}j<d)i
z^ae7Rdq2^6kYGI}$o#eQ;b3F0`n<sWvzxC{){5_#E{Bp$pf3Qqb$;fZ{JHcJbDds)
zCd)sb5~-e+2Ud5cXnObX)TumUqf%X?e%%KxuQc}9aJ3wSl5rI}jp|iXbK+M+tBo4@
znw$n`1}>+51(*_3`DywFfFA}=?A&izRo3g}z${CFMBwq7v>EDZmHVAhU%Hg>Vl}2I
zkpp#jl?y%ddb&0k5wv{klO&Q-A)A1fU`fAGgU0|?ZDp!pq&di1I7Zv|9(S61ohvEW
zvfZv5@Hchsp9vi3wfiW4?Kl-%CPBmN`oNT#x4mZk>DSHh`8)fy1Rr;sadH2Fp#fYi
z2RnN^T~$uy3buBW1p5G`{ey&oE^fF1z*g^F^rpr`?XzNiS^yDK`k0`{S1&4@>alQN
zFx^2|+M4JtRGMM}3-fr&mrOJTld+f`&#1CKTGE#&+a>UhC+Ma}kqyU)oj*V(B2=<y
z_(OZ6hmf%V!TBv>h?!dLJcfvKJ=lG3TmtX~<i4|HfrK8o4d)%lFVkB7l+}XuGP>!@
z!t`DYQpo5J?d8(ewtdi@KKvHk0|hK|1J^HU>Kr3UALvM!BlkT?=_^BCznxOIIcN=-
zT){=J>BX;U+%cQy3-A`b8a*^@I#$rQ+VydQzuxTjUblOni~2^5`Dn@cQOR*sF75ex
zNb?|LtdKV1djL<gLB{!9YO#{+TfXLoTBF90DC_-E5m*8Hn8BPxp*YF;jpq2=+;Y3u
zMXb5Eh+W|ozTZx8$RN_V=uWhJ4Q1hiu&Uku{REdBPN+Ug!>iG7tWbTsq8H&(9EURi
zk2q!+o~K5E8z~3DxBC(bY{seuxonC7z)`6dYrl`yr(9fRMPg9*aZ<s6HhB#yv}!@{
zYT7J)n<d>2olq}1sVt|F$xETwHHe(h5Ju5n{sA`BqfWLeoodaAujJb~JKFFWrthvO
z+kk^E`l-Y1L4U3BKp#u5SSR(Oi5iF%gcd+S+h3kOT%!m^tL(o_9RDSMXGrw02kX;i
zDT9QF>|gicIF_)?P2RK0gp0Y|4Q+p8iuf_?1*=3Y6AUnKY^Q_Uf}|v+Qxdo;s+<)p
zjpr!oeijv2K@Eno2Ev8F4OY(?i1gsJ)IQdB#T3;a?%08R1x&!U`df{i6?K&pqs(<k
zA4o&Zeu4#O{cuY(lc~VWLiE|d`r?{%h9#s@JL3AGEWZRFX`5}f(AQSshv4i<?7^9x
zmV_lp%~qrME=G%Q^v(b>B*J0Fp{)-1lbJqBCS1v7_tIcQ@_hxrVW477k0ZL>PwKN0
ztx#hh$!l>VC9LxBS$?VZ(UvW-D{-*iWy{E(V2iT_H~(AmdNi#s3K6s%^WASGgt9Me
zV&3B*IOVa?A(~4Mk~Wt<I^z=F4!R+`rY}1qbDBB7V^<5dQ*Zjb7SZ2mTGVeP>0|pC
zm1j@{iPtnKb_ls)w1B4u1dkWDiFZeB4JlIT`z8~|j*s6wWW$uUoy6~AHYO`Wj=k1a
zDwIA<laA?s?n^Q|XW;u{$Qsm(<0B#bbE+6K3LT(7x;%@nI{ZDI!4?@A`|3AsnSdoS
z?Z_~;@yjBkRQ_b2ACE!%%#>K2%d$kYXHZo^ow{Dq4}6Fu)&k{9nzRwOTuiip-_QjV
z5URO9x@antgqJqb@`K7aoJWE9%SezJMUkZGw{9AW!Hk&q=N6R6Lkk;Jpsg$@Ud#Yf
zJLegcfDj<t`a%p%9)GcJC5nR~5X%L)G9e@v5$I}D*3cId=&NQ@f(J@zM_d8{>n(H}
zAetb0Et>{ZRRvcd-ViJ~$><|cyy%`*V5CDb^@4zbJ4q7Xc>k*H=OQK|8A3QJZ7_;C
zo8|v^Z)r`4;xvP4y=)rSP@Y6ftx@UBG^ra?76ZqMxda^uM1Y(<hzUY5H;V)+l4!fl
zmbc|cz)CWlBV~I61KD|szF(A3R;iV|9WV&TT&#J5&A&^FMMPtl5o4z4=oAWIQwQ|_
zizP)}ZlXyja7VNJuP*?+^**wOWlO$f3R>q<i1;E2hm!5((s@3u3FkWV-()%YMPOvb
zTpRAC*t#anO_;WEP`6+kz#6)pKHdj|`iJ9NATs8vEIAK*+{q*7EJ8GDnwum=i8!{G
zC|sGiG^gnIs4r0Zch^bn4jsVpzyiF5bysH~5HLDY84o1ablVQ-aULL8i<GT|aLMD*
zX^&36KyoXei$aiv<WHbbS%x=$&c$ZOnHZWo7ADz371KWlpDmv%b-BR`iVru{620GG
zIQ(J14HK>KNOU8WMo#J}Z$gSDKODMxEF16lfdrBkLF)^t%t{-JMl8&E=_Gp46a+S1
z_;}vti~HOzq>;V6Tk{J-hCE30vzb0UF0f{KRoMV3>gg>;1B5WeK$u%b{tR<PG!^wA
zM#rmr>7Z2GLf8bS#%_=K<f8hBa>J%})+ULzk%<=;qQslzLee<ZrO=`>iJ^&$KW9<f
z6C(FwK--)nMG;RAaVt5FnEB=Ohl6@8P1N!#p4IfQ2E~~Ly`fkG_8B)8O$JgK!s9C(
zkdL&vgxYoF`eu{aorXSDZfGO<{Nu%1E!Pk^5U@6=a~nBcdmdhLBqxzb;B;9Msc6Wi
zPY1H1OR(-;>owU>Z5j3><1B#`x0u8+Z>#zr`LpaVedNK>Y3#R)9MpP^ZWxe`9xm(K
zM$hG^Q=`8{9LBD5q4=@XnrpUvnK7Zc2(~E+3@3@ELq#KQn(UV4>0rgT{C2k>9__?m
zl%i<lAj}B473ijIvjJ=-TLSwEYj47i{^GWiJ?`UXYPF)+!%-M<TKN0dD7Sr$LhU5Q
zHa%#&{}_5fAi0U@zj>DNRG46-|NdtBAL?F!L+ZspdYpgP|NX0Ai+<hTqwye+8m&vH
z9q@$CT&*%tx7CBQ{Qj`*A6YDyR6iTyo1_E;P;jc+)TqY}(+p{mnkXV@lFUKG23QG*
zjqhdy(yRdB$)$okV{n&M;raqD0N{sS6Qp_jeSoJJ0l4SgyOe-50pOm@_k=u~b#zsx
zSy9sfzGTRiGt2y(4woD`u)*1X{Im1|G|8&~X39YT*?v&=WPkv8WMH!$s2$K?gYw&)
zeH(LKGT<@uO+lazj8xC%QsiHw#1eTjAQ0B~0e6{6c5%eb!5AT{=^Mx8Ph0>}DZOjl
z;PZi41%Dqv>yvL=pTU<)T8u?lKS}}lg#*f$Cm1MK+X--E1n}L0iOlK+HD6k1v~ET3
zl0f(VB7^eZYB61id=tDeCkKRzm5*h;<X|0-hEzYQrLAoexF7bfXCVicK;1sazphA<
zk2Wlh(%}DRyu1kwncU^*Dy^(c1K5!y(JZUASS^8GFwD*pKHpDBk$_W~wMMyRIAG2J
zj|#x!VgInk@+H^q?sOC2uwb*)7#<ZvkE@h4&i@AVi|bfQTDI#_Bqn!+St^6?SWe&p
zE$|p{;Wqd{52WW@sOpbao;Jz%?>{<s4F2~EoV<kF^MV8h*`b!Y`ctGTcDa`XbQ<V}
zk$S-q*-v;lN)H<<aPVIdf4-tdyXS>BWC9}(jD4L#hoqsg@mY1Psn392GzlhPemEf^
z7CiesWCV#lVH%tLyA4z_ZuZj@kc4UL<@-ysQ9w3E2PY>!=M}`_ci#O?$L%El?vh~s
zHzt;`xu1rKCwlaY-Cy>waR9#h?#oTWLw<*Yql5juy_3D8^Lxbq>D@xQ(!f&YL1rd=
zDf4RvPw86$-_;w}B9bk#e~f<rS`1kivHtH92pOOj`R|jO8L(CTcm2PwgaDCn^1fX?
zp=Jx9-*)IWbkT;CMExTM2mKQgrxrnTY*pUFMvZFXsQdU0T>=~s9A1x_41fR`^06#W
z-R7&3$6I4*o_~{1?ms?mx9{|OwOOvdg&+4>GDCo-BwqY$DxMrec3cR2nH@4?M{5kQ
z*#W?}{|GjRGJs~R=M62&CgXSk6#|m@kK#O@Cq-u2lLtG>{E|-D3b;F-;NOsLP1{-S
zP_79`bt)0>$)W(?R{&5&Ac<IG;YUnJei4U<1)%EW@W(BI-vsB(D%#lbhFvxQz{+4=
z*XnWhe@_5c7zD6O|GWNwQ$Sz<6GWqEG(`8w$#PtDbavF=m~GG6A{cDDAKnS0r{?*{
zhR7rnnn3C>YBY8fGs=}(DfnT|5a^W^_8`y+tD1eyxsE7LM=&XRc;6%CI9g1=TP_om
zwhDfd-vT?6<P!#*$~i4X6(2o}!z4L4gDtc~Gv1Ax)5Vzq{~j73j9{fB-?Zb~U}PgU
zR>k>aldi^!X?roRxrMQNAw)Ls+mso*yXQyuB6)5lD((BJHc?}z30zH?x9RU<5ePVn
za$-btW5fX&O8B}!0nO=api|G#ZEa{eER>R<?wLa9HRH<2*Y&ioV>4M+%6*<PQuY_A
zgZFF!pWGHDGX{a+op07;R@f@{<p7|{d4H1tJ>qrn4?n(7$68#tL!X!JNhoq?{^j+V
zez;E8IN+EqcXw$y!0FQ$YfBKr_xa(ur)W=S%NY(}yy6LfLLbnu%ahafzNuRxTuXC6
z%UN$to|q}TUqv^lxUv*lZJn=8iyx}QxKV2(vv+*4Z<^eU2OxF>U<AM%+YqTf|0<i(
z`P5n;D7(D6T52HcJ^4}C*VB?kc05}kl(6jBd}TV`TvKlCHOo|qPJHRU6vkzbd>be0
zd-IGnR-I}rJ|~>{CdKRczWKe5h`pt<L&L$BE7+?OQ2@M7f&ohjd)5)pWL&o3kZ${J
zI91p5h}*bP?^vrw(;P4_Nic!=_WidlYIny&$gfiFSy-HJ6JIkq)){0N(c(`$JVBNN
zR=;t{kq53@6WG(nP!1Ux^;wvkVC=5)6X)EY`QBo(c$DUWC#<&4>$2_>-pQEN{PSXw
z+C|T0U74;w0Fq`CHf7vqr_8ns_;a2!9llxs3l0RlRpLe7Q`ps!MJtiPJClP3hK!I}
z*TdZ-i~b#|w15DCMb{A?&vo)+X?)A~us>}<OR(=ZPQxO5m@gPrUkS0-)i}J0;?5#G
z^3)T|r94vxraYoqvIyuq%~qr84qb|R4DIb4X91}#pN>|!PO3->Zf1zJWxs^=uc+VY
zaWC-kO1Np^zph=5-B+bVVF`p;@4K-5yqKNY0h#<;;J;}K+k5X<^IB2~+2)I>6bln9
z&*IEY-;Iq%^<95spL#hUz`K0yg6n};Dso*D1XEO~Q%hc(3nQBkCzBqi+fe^A|GKkv
z@2!k8FVHmr)*A%Ec3}@Hz0F(W_WlGDi8tUD5Z0IBA)cF#f33<x3?DF)YPU^6jWL9=
zMVd1c6bAi7t9(&}=*E@fCxcNd<r_Uk9<%C%2?E{yr|YB4?qg5-aUzzQ7Aq-*I&-%}
zetMeyS-`VVbY>D*b;z?*CwpD>*X#7WmE|&glL8CTX0AoK0I_nUv0e5udVnR#=W|Nn
zWuwoFmB1eQg+Xnq^u<wLC&L!LrGwrTm@4Lt2T@jQTP(3hR}G)DAJ67398DA1B%k#9
zi?+$4?fUyFIoowlIcF}v#uWhEy~~)jlE}odJPQci!m0kPiP84$$EGr80GT<>G3C}i
zs@#iSS9G#r{p9iE_1(%roJUAtaU^8C%GKV+UwgUi-cW1_fA9E^P8CpinF4#GnX`0R
zB~RUPqQd-q9HvK3i>whTvCopVm7Xh%Z!5(xTkm}Xz3CykaK*$4{Fn~xS$?w4{k>{g
zX9*OL8USbv%Kz1>+x_cm&NP`WoTOgJ0U)@2I7CO?YbUrZnZh{eD|~YYRJ|tM2c=rR
zA;P`=j)$}|p5LyEc{f`ZO|gm888QqbIbluMPbabHJ<A-9c+rIo6c{--4@qaN24C_4
zi+>wSiWDKgYHG)9BH|hPWZSe`w~g|D*n8`+D!Z>;biE=N2&i-`1}NPPA_CGS-Q6r{
zSfnB#AxL+3H%JRecXvrHT3E2C1!peb-}jxp&py{VXa9emKa>lem@(#vd)#wOGu+<A
z=8N|AlgPwdi&&ydrJ2}fDq)lsRlf%NgWeTCsXm=*wZwzo<->q!Eg6pb^}gc73Sf0M
z&2htBWd3Nct}4#18j_sFo*;87)%mI~uXeVOc2HkH9)BXf5EIH;eLXz7^L^2l%1p0Z
z&Xar=mp}L)NEAKLs&smbj0asgY_opQia7Pf!wK7wxhb53-}Rz~r3qGr*`+_?HNxX^
z@T!A6M+#xip1UfO;m#L9iSZVTbUH&dA8ksDC?1$m3-+*XJk&K?ekMVcP$)61w%h;A
zPnTYe<5hwM9LzU2Y%I`FkDL(3eiSv4lk^iz_hWyyTW{j;*BorYcCM#ii92}7zwh8i
ztXXWdX{HT5i81DINS7IR3VnESE3nmaO3V6l>rXphf=&hx^Uo!PZx73Vr{_-@%qNB}
zMj$%Du$tTh%dhtX@^^qysGkza5oQ1DrnapT$BnERb5qslFX3(2vKExl?<z<7Wsb#n
zU}oD|1!n|y(nEn`CydI7y_c#SjHL0Mx&auAj`nNc?m-kn(c(bC8!Mc7svnZgzSdNm
zVylU-7inlsg2qoX?Bi$n*;RgLpq0e~I`aX}UBS^Gg`bhM2?0u^gp))h&Y_Qka%xDk
zlc!dGa#J?3+IfNTmIwA;!TFs_z;R^m9l0rZKxS=<*I>!>ll%2Srut%A;tlkY3n3*L
zr0Re2Hk!J~T~e%PN1yPlmOPHLUJ+GxvdK;0mL01t|D6>+wUP$qgSn3;MuEvBEt!a)
zbj5=BM2sA_3eQ{VQSx}MWw8nf%ix@5Q3a1Hy>glvKYnMo@kDQLgB%uQetR{oCcsHr
z)L-^#6Rf#HQzRh=k8$`;u;K01H@Y)rdPVa@B@1K)R`>ZmDq4R9bnevSP8_7>LyOmf
zFMABhTq&g@=Bqppe!^>J%sx=vsDK3|haR!UZm+3piIQ*p^)j5WBa(Fi6$tCQPE2FZ
z_e8hl*jPq>5}LG)v$!oyHu=hKitC)X3`Uh!Heo;n9!LK8FD$_PAzC`z{#bi?4}T!~
z^a1Nn)TdzWvd_qw9}p0QK8KC<gx9`?ydg!y8%MuqE*@b(2HLd<A-y=jL_|FrSzs+A
zeFiaq*rYOY>o%kp4dO(FzZt^<1rym;Z^>-Nd}Hd_iaqx7@?#6&W`INyQer^p$Xh2V
zWiWo>Hq4tu!Up=G-+iSTJ`O%%Q~q9hXg6V-UK2Ol+og#=3cb7I;^(->b`TTwiYsNp
zZq(J&)t|{RuQ_h8tqAOXja9FFrd`RcJww9>d+zXNQln14df8%G#|R;~`i1EZb>4<x
z(OruhurAd5qVPeXUN=w+z=!Se_F~_Csd+8@MIF((R=crvpHNIk!&1M!{CkO?>+O=;
z;^b5X7VnWPArkqr&J;=H0(s-hbO;trJ2iFrI@WHISbqk6>YvV0Kotz<Ev%5`8Xxt&
zRVP||pL;*o+TLHbL4BZ0M78zOlssW`3mG=$L>8RO`M$gn7yH^D6GDRCE3F{@4sfCg
zT7;?$qQ*_6jpRgK9Wuvlr-r77WHd|JoFuP=1!BIfjQd{D)d;Rsdk~F#Piz-&yvQ*S
z(zub--_32clQocFfm8SD_B8$yw$sWxC0Q*w_ZM^)`uSq_JRe8wgpXm3oCu;ny#gF4
zx@Q@+v4o#@IkD7a-dkDypdOInPA6x>v5GlcYOsc9RnR5G+m13=AWOs4xEiT>))sz7
zEv#(o!y1^i-gQ|uTR76EX2BPd#gKdq<KV4nPtXDw(!KIFBs21CIDxfd=sSFG>!qV;
z&cp-!h`KuqHO`XVht46kZ@IG)+4sUpY6V#QgY=U#I5T^RJL+Cs-|O==s+xP0byqLI
z&#nCypkbgTC;HX{c5J9^)WXXc!uqERNfx84LVZH4s~>VQ$VUg_Pj~ODc~VduM9FG2
zD$G~dm3tqZD#*r})M*|S@aP51QW4*Wd<Ri61mgDGNuvX$VtsdO!;x0Th|AAW`WESw
zuHnc4TrMug^?Cc~&n(puCR42etLR<&&qlCc49D`<QQJEYA!$))Uw$q8M{W#`hTQ)1
z+QkQJPu$nm<m}BQemG0y@jbzN#bo<{dzYwClx(M1rJz(4;-mDrBm@HSOmNwsB1ec<
zf-2@a4|sW$-a98|;qsHS)#KOG4{n&vmgx~pez7m}+LGHU5x++>1_@G1Y<~vJPB#^c
zHJ*P=#wxx=_4G$Pm-(R+39i3~t=`W~Jj~#OU1!iEkSB)>OFRfhtRpYn`P~_u3o~a~
zf4RP_;ZqMC)`4^2_s84`;P}eAUm_mwDTBfH&MJ88u#)2TppKzRgYlRg%h>qNcbfRh
zKDZO%`m4HsAV>FseS~0%kcSpGBnmc(&ep{6J1FFIpX=Z(%zhjs!`nD4@z2w6e9)ww
zV@YfyYbd5Z*{i3%*N6+p5rcxmoFP6UfC2la?ql(pp7?QJh*PaoU40S*|I_3(j!Fu}
zeJS!{Hf^>R{-nwhUq>}2oZBRUb_)@_YOM@(JDOq*%9EXs9249qN3{YM72<0&`VltR
z5QRpxWHGpMH7+#lO2*VJ4yNpGoAS<+4USQon#IPg>K^j8v@@KUBulfw){}5XcB6`P
zB3=&ONec%KUEo&nFE$CN7VH=_jt%7QA=%9HWAl|~Ph*NxYDzwCFy4P28@~Qw@PLK?
zvW@q;J^Yxz|FasKt9@+mS7kP5tLJeR%RpUF!|=<kM-pQf+a5sD#?hUGJ9u5_X~d}4
z7}p0dU~#}4k~13<?wS@Wg-U$bxWcV`Xv`Ou)Hksci?fiyHF%Nz3AD!3-#)_}c08&D
z<SB{|?E~0Vl`b?m-6JO}?TfS+kvZC|xD^@3-!GRNwJJ=3?$;NS&>&L=ms=IX+24%%
z?_cv}aSskRcn)ikh=Ir5(3<17$DFWf-Liw(<b)3H+K-1(pbK(gzsi$(&nZp)`t}q$
zzxN}*Ch)v0TP|&vS>m~OKq~<Sc6$J%4SXIGPq(D3zx^4z0#AHfw{P+2wMXQG-#t#B
z`Z7NS#ivAi*fU{-{Bq6B3e;CUoHFQyCcQ&OW^#kkG+ntp20s3F!Ciyt3)|jJ_;Csm
znR!HOR3<oZc^!;En%Rm^)EIk#owhBWW}j}lUO;+3`Q`&JVP4oX42U@q@H!QKKZn-P
z(gZi8mc@-+X_sJ&Bw@Xle%@~{aKy6d5{HSwjOB1~M=?gjR{Em`{n-x77`I&8WzPsX
zh(;<ESV8l-qr5`yEa3IY4DP%kqhokwf5XC2rvEZ@RFnzhL07q^K^`TueFo^bwxEx8
z69_^%un9r@*tl#}!OM8^anZopbi17)*ObKGBS3?ttSlL?A}O5wY%#K5>p2bqhV+Tk
zU5Ek<d<xQyy)eFUxFMcD)@lE##vhIwkLA(x+q2C|gSxjh6;Do8iFD!Vn2%8izwo_~
zy>NzC^a8gcWwgHrSt9_zZYpGL{M2Yo0$({t{l~}RWva}b7<lu2$^of=zW{_Ba`d_K
zHp0QVJVJRWn0r>cXpI6oZ@YT67opSjPFb(_e!S}obHyz-3AQ*s#V*3JxOyc|%3F{q
zQ2GvF2C6-mavU}QqJv<f6~lKTU!yNJlVbk<GkjVYtDJUH<zJq&?%Lj~DLUD6l|VR`
zr$1tt*a%D|55*jUx69>o#8{oh&}6T8UO+&V`Kj$+xwMd|3Qwe7zkktb8GC2ag-s}P
zO|nMB*2S(~vkrBcb$k~!RQRf5W$`!l(cc#ovPg%Iwg%Thcc@~XWw!jG298PnaP%X{
z6HF-+Bl(v6GbPd$%*%Ot^JBqGa!ilw4V_DPL&btHGU%2y((I&cOzm(zV`9e+w>sXd
z6*NXb*b`uMU}pp538}Bq?TOyUI+x4BDQB(n2TIJ^r`3s#y3}J-uM6(RY$G<2e1eAW
zjs0I|lPUAW3+-}@coI3+SyyRqB%}=u`KK*QhbyI|2tj-vqXD<?G6P8tzb#F6xNLPD
z2V)m?uSNnlJ>cBl7ju=&&0H3PZ|lntk<pc5g2_3Bm5Ta_4TshVyd#3OPL893d38*W
zq+n4<x)YqnAg@QL#jR3lf8r2)Ib+faS-}@IWb9kd6p24kiEGoTm{G-ju&^2COFzHk
zg;ViFLvS}L>QY9*gbZO&xTAsMV?AmdqZxK_(lGbSs|`wg3XA+i|7jHyrdZy{C>B*;
zxg6&0Mt91YBec6#$`^x}$ZkG@=ZDED>S6t1-`s=)-^sxI`X9*m5ToDWzH+71ipTrG
z^20R;lavi!$YU*d+oiOy+u=SxBN2PBHNLWbCibQdESc|ykz3n)L9K=3(Cei<#n9uq
za`z#BSuOZZT;|4Lf)M9v!PKIzfHR_d^3-|OCp5Wvxw~#8;8AvI>cFIMJDUNOr|Wza
z^`a}P7J5BXP`wk&cvCbrGsSxI*+DM%<Y7a6%BU}L-f6VWC_`B3!;h<r0~|gxB0T;V
z>q6}1%U^k`q~z5<J{KH87>`)ynzZb9YE4*KWWYY9EJ@;bqK=Tr5tD%S>!B9ZrxfNB
z71l!`xY)Y($#e40pQJ_PTRYUetcIEaOSY=zP1BoFrG$VK5!e;t_XoXH#N&&hOm8Yh
zt#%q_&DoZR?sHp)72Wu<OA}h*n7P_-mY7@CJ|km1JoX4<%iiI!P03S3-rPf{9o~0p
zv%fr*;1nCqVYFFh;@jWy7CL7Lp3!XD&zYkmK<(sjnq$Or8CxjFoj?ypRoxMCdAg69
z?&)OP;;12@16>1YL0AGOwiej#=LMX{n-nm(*yc!Vz2bE?_7Ek<C9BCB(`S9((+!Px
z!=eyd<%(FDoMm=>r{;$WR{kS?-zL<BX_%-B47riY0{;Efr^5#h!vV!Y5>d_SH_AV0
z<njBY=7V2j2gcBF-HcTp|6*r;=MZ~AlODT&947pJDEVSFFC2#}_yz1(L|IVfYRhkc
zW+b#Zk4^ksxk;-Y9~_j^eg_==<O{Su<h?&J?nP1-qh{~(rTTL-B<j?Rno*0i;b~!v
z1R!Ev)Joh8&{!~XX)BTiiZeT5aC6CybnfGM!OR>@ov?^1WhrXwuI8no3N~MC`$pSM
z7HMc~TPGwgR}Z`srTh@92`7o;J_Rw_=Jzo>c5E9NH6@kBrhMvmx7QK$rrK0|TE7;|
zI4rv4LOiGO7BdBy30yNe%0=>fzD;6zy71|YJdrK^{)xS-c#h$@COdP}AGxaS?8zUq
zbC)SR1t<9@Ra-{SI808<a|;zCbpsIDCEp{7sHBz0DQ_b@P&=O*G>jh_aeOEwtkk>O
zYG642+wC@1;04YohtVsCy;S1<3J9E6v+Q9bSbR3UP`&CnE;mr^cX-kUp}MWeXEg=Q
z5qMafbs}D~F~(~e!uD9@?Q~fKoLo&Ami0d8dh6q~MT2%u*Vv*+2mb4&V(qKPjDQp+
z>raDI{3RPIR0z&d%@Ad^SQR?mV$<CIq0N!BrTD^o8u6ub;hkW?_hv(1Zo!3-+_=dH
z3xo^W#br3TmGY>hi*EQ1A~K4#q;LwFbx>*cx&dSBPoA^{9<+Ze9O1baP%4(02|Jr9
zJvg6>P)p638@)B^k`TXbG?MuOzJbUZLlRTnG$g$J2l7Piuf=*(WuAs>LZQwYJV;8J
z*?mFJQZ+I}BUUCs?VVs40*lu4Q7X;Gfz95{u`v(gvooOx@@B}{&(d8#b!EDol^yZ@
zn$f~q@;n-!plMKW)%YUF#!N|1txN1ROZh6xy@|*0N2A1kL(>v$86`0r9|~FRF!rjR
zjI^7wijqzk=J0)G)tmsE+?ns)SFE~QmC|yvX9aJQ_d1c7<$S2q^MOV=SZ8<nPkE7W
zruae7eyeG<2U4OX1UKBqM){Pi@o2*xfhuvomU59}h5$&87j4#Fgs!>*rz>>$ly8DG
zLzML9e67;bSg9jaOF8T`(6&|L4*mYL>|7_KaN{3XJ+IBBl4{`MT0K3}Im**pP5D!O
zpum=bctM<w_j>HBiRmI$rx1-^qkj9hI$!#lU7IU~S(OU1zDVko--*k|6m-%`rP=!Y
zY$Go$DaNnn$YKRfUlMRz`lI96M=3;^%1C<1_EvKrbDjSB_KEjZpD6uQQOl;9a9~sF
z<mqYCWkLj=Nq-@0rug;JQnU9QvzL6n<O1=>j##Fzx`nuc*=zEpE5bLYW`IzwqNi_N
zwm}`M>y8l|<!1pyY;ig%FsVqv#oqHjQWByH+Gp$g2lfnjE)i(+^&+&E=bb!WpYIkc
z?>3ihmG0UpOyhSD>A<OOmS5)*6^h$twjeuXkKbjinwFVwe>8Yd`rIA<ax>L)`!LMZ
zV{fm6J?GWx#a6nw^o!ios_&y@jG^^smKPcQ%(1{Vd<c<zC-MPX_$)L+hK_0RddGcy
zI>$LKMD>_Mg;n~fOl6?hrcbTd&HYb6rUYjwsbEF9*RQ36CYinLa;pO&B8L!C!l;a5
zTzn^!{yR>_)}o#ZizwMmT^OUF1i>SV`+_F?&U>g6LGR4@z6jO+@hSElX6&(dnv2tK
z&36%S<(K)vMW<_5mqzyzWsdkn9t2x=Z+!zEk`y|D7RBQ^5tn|OUGf3mY{Ao6)LRs5
z{kK9ayje|I`&7#*`&q-B?MS{CZbpIWk=Y@&A*)2%dl+?FKQi?^_H15<D;CSx*!>x>
zYJQ7-G>tzbJ{J$HbFmwzt)fo&WQ6^#s)mCQ@>j9B0m*}&ot)Y4ugfL`>RR$m#=EgJ
zuVQMP<zC%-B{A6(-rh4i+o10KiDQ;mv?=wSJbkfN%uaUNbP<+mL0r>mzYf34UekK$
zQeNqh4Zm}K@ypB+`att`JQyjcSD(wH*`KACP9-5x`i0-N30~@bX3~2{a_I!iQ|>cq
zQ#kN%C4o`$d2B|(Io1MY?2E}YDsA$5i;!^Y<JVkJl0bUi%uQWiH@DpEZ`O{~6wQh}
zRpiF5?pqS{c8>z0Y7}c}Wv1g1Jxd?P<u*}#KE3FoSdQ`1VsPtW#iwNC9ZGzXEek`^
zBbS5PaVqma@|dKsBtRx~ac@-ffPW5)d3C2ojJ#CuGFdCtd;J@~mjkn3RqW02dqnM6
zwY0A1MSY?z|9%MbyjP!#x&IGN{Nly3R@`rWzYTKVAuS4o$^uJ;(j}?5vN<{BM+<UX
z9WEKU-vwNWU2dehZPT3is|K&<od+n-FkUnczr~?Qm1KS$GnTC%{wIj5&`&k39@mBl
zo3MJk71U<Yki;`u<|Q!{lUEjZ5SR9IRFhgt@D_NqH{VTDI<!?ho?hd4^WixKPm!YM
zMTlwS(vF#^I22^{6-Ixknh^sJNoOTxBc=;#JX658(R;58Ps#Wz?oN<x$EZJaewcaB
zT<<ueaqpbNY~OYd!6S%6>*=|6HB|Yzcgr9*kbkYQUUbL+v-;SV_VZ3kLBWvMgIuB*
zninT<>^q{24T&?~IkjP7C68&vF?^K#MJ@hG`!&*;WO8K3pjF(LO6|BDuPO6Y@IfF`
z7nk1@uEyg9ttA7}?U_SOA@RpK%nbp_j~C1gVuN+%5E+J|%7@wSUtJ*J4`9Iyz5f1-
zZSPGW3P<Pw7{MF*gKj6r_H&Cv`?0rihxI{3z&9o4zVA=xrMZp$A{W}_0{1J+`l?s=
zT1J9{aAaF!X|ktthZOgg)latuq@f02K(_zBX{7nI*Kew<=&nFlwP%I<A73(Ng$F@Y
z?1J`oO96aOSLNL`Kh_(F5P8r6f31F~jY&;^(@?Y4+Wh_xf>$^m7kTEYycr25!HbP_
zvH!f`{Rs@K0+TlV^;E-dj|@~rQQ4x@+4brvbLG^aK(%2%h0%KV4}VupQLWBTDLIQx
zg?y7O1_n%plBpvD6Gr_7+g3%mJ0F?O9#T7t-~XY_K$68Nv*S$H6_?L(QXzAW00=@;
zGAUA`m}mR(W#cXCox2bg0dz+~(3n8wSvtoMx2zb>>;Sa5EMM4PtY;7V+&6<x(q3*b
zE|Hr;;)H3@_@T9_Cy^Mf6d;(UJjx`y-Bgh-Y>h4SD<C=lEn_Un<GIt?4^vYl124IZ
zXWcY%juCFK1wk7f3n7`%)qGWOnCW96MtJC8TenScU{L;MXQBT2xiu(?thhH!dZb?U
z51r_We)r5eqF$iKtWrj3(C(KQN$XvR2__mFf7HRgbQ*?nITcWkl+vZ07&b==K<%~)
zJ4qx4IM~6lzc?5^S9jH@w~cDPKz~X~Jd60}4Jq1BBas=)wZ0_pPyO?h75Mo15wd*I
z-vmDY1NqsC4j3O>T_BongxEZz$|p;R{b%3frO5=c?R@m(+Q(z4-+B#BMD%%wzA-}M
zW81l%a!m6L1%}Uu!^M9f-FN@yqCvR$|IR!3E@RYw7Yh>K?tTaI1YN`!(v#%WxoPO#
zxX~+30?GR4fD+;pa##4r2@$Z<_c*vh%jSycg|#FaZkW&8c-4$nA3qUvJpc*m+nXSe
zMqhL+|BvJ!fC)o}sU&0CmExME-^Ccm2!=X~+Bbe)b!-f6Mn}8f0Q?Mr*rc-%5r`T{
zR*^HR`u3!a?YMrz!CBB^p*XsYD)EWkA9%9$Xb7b4mC->cgyZ>he~cCV=nh4b^2)2N
z)B5@*xy->d;xZSI-mL<RfAH_;`z8_3r}zuL@d@_jzTtW2eeIf(IZBFd4us<dd{{OO
z>>8>FkFGwKGx_3$iK4l1LP&#LyARgig#U_U1;yPv`Knxq_MXvqEnmGTQA!sR;LT~n
z=y^yx{A`%l`<ujHQ-cBhARKI;g7~~ehaWz-f*m`FBV8_C*T1>Qw`>Kqhw`s(%y|#k
z2Y9_gSrQC@r<eb}<7b=Fv~AV%cmoguL6?pyrJ4B-RxZ67px(#8x#|MJ&DA<^y7&FH
zxNR1M&OH6w@otusB~l!(vv{%Lm)NDv(OZLXwJ{8R&>u`RQxk$Ij!9qG8fENHm|C37
z>Djv;tIgs)xLep_{|Cg6b?_QJ3Wv2u#b@NUm*)qM7Yd4-R;z}R54-eGuKjtPxhd{5
zJ101N<S5Gz=uR$wyibgtV#$aHl3`5bGYTyhJE1oGF4SxW^R)D8VMWv;PL<e0yq=r;
zO+!srooU=7aK~CNBzeYjo7oCMlKaUY`@>C-muJGfI0ezJpMnBf=oIuL7+yd-UB|E5
zTU@U-a&<nsiFziJ5ZzpK>0Ph>xk>RFA!MrE+)?x7?ZNRrt6XY4+}2t`bxx>xuLo0f
z;qc+1EMXAzT%`TW7-Mny$zSgLp?78yIzKwI;EA}Z!}3+qy*wLJ5zn+6OlOan&uYj;
zwwv^M-)shi3R*5w3O9!Ln)?pcWE!<F!bNPs0G|5?f$1k88Tw-&DWk+OH#L5=8(iwy
z=rM7f6O*|y#A~@|fI!W}>b4vvjYTdwsF-xj<R*`g&!2(_&hZ2hnpaH9^MAJN-x+pI
z!Sfg8YhMN=@0qqrCMv;-l{SYVk_q(|>yGV2=*<bvl%Ay8g2$y!ra0HtX{Z)__J<bc
zt=5~XgY5eOO|?_!LpK6*>cVZ-WLG5Y7ZV7OBL^%l1G;CRsp<+3NS*xowARz6bYXiq
z2-KgJn^$}$Ge<+_G_t&w*DFyobY-5KR(jtWROCyK=eTdIXO2`H&xhm3yv`#J<P!xf
zhA*Km$lGlqzAQzXHDH3if(oHPieC0qaIdARv)d0_(GF<jnU+ll67+|r2nQUI_;C~@
zGJ2g0GidSiB{IP9Q`0!X*}*>#LH-47AUqE6b<WK0HKcZ(XwHfG^o-Dm7MD*np}vVp
z?Wff!>EFf!&=vA#<&{`v8uY{Z-Avmve*&zwbd;bCkuT{w8<001ihVG-ei9?ydF;c@
zZDr3Z3`G82fdH9?07@xXYs0sj(pKF{@^gLfYcLFLsSPt{=t;DIEFQ!hO>uyj`-u!=
z3$(Q47SHV%x{12TwS4w^#K(FI;^U0woj`_(Bx8IH=@<f?GdnC<NF6VpZ>GrM{|_qX
z8x5&A3%ET8tqy#M6a}!Q4KA1-X+&t8@~o3^>9*SO=?1(9gGKhG`~--i7(pt__(PDD
zy%YN1s_`$L_rJ%61cLbgfiwBPa~E0#cjp6p3ASw3a8x@vI`S`+=s$Vh$41YUVLgqX
zv`9s^^SH3Rf^}arF;LceEi|EbFky&69Q2Ll9hyT326e5i{v>g#bZ&lbHHph)^oyMl
z`OZ$kYkC>+XI*whc>)a_ACcI)vCK{>Szny@Eapj%!5sWl_^V2BtrzNz;1cwOuPLxY
zlemqxpBBZT)(MxEmJUrEBc+M$^aKOJCydcaeTaVEBFsv1>^g>Bp0|AZ8ENo%FF2}U
z?GJM8;{G^Lolo5J(BgACZ+p<k+%mzFvESw}NLT+S2*d5_2=0P-K+)<t>CrwV#~zkX
zXdGWWhkrd2nL^2EI4_`@d38X2$g>D!tHKwZ)cO8G%4A6BxHsfgfVSg){EP3s-QKZS
zSb`<HqxdqMxYzBn>B%;~i^}VR!^od|x!sztq{af>dIOGJ2Mv+_K%eNa6%r}O6B8YT
zoC?57zD_i2T5|t|D!!u)EyWFDW8cD(PltN^2D}@H2HMW~ST~+bMsz-M%8u&ojzO)6
z<d)75Ub|LC%oJERGE`CxEiaI{-@?^o1WkP6fL4{?%Zs&KIQF1*he_<}7Ltq9H`rZd
z@~Kwla3Z}c4wkJ4*JYuq*u@lJuD(A-i(B{fXqak>TW?^towf!;1MkXXPm^$XqM7EE
z$oZ!!PYizVcThRtnd73R;vssa7@IC!45$!>KHdru9*$D<O%>a4QJb~pn=%}yXCx(-
znee`}cF0H^vrLZ`E&Pg}sJ|ALt<q~@15;wqD0}Nm{Dnv^e?P?#d*vs7yPB2VXCbtM
zY|ra>izzh4&|SgjY2^UVrBxQ@)^=$`th3pV+*%cdo?%g0oK{~d*J@QI^49a}q(vVC
zjXN4t0QPHvA%lx_fQQ-2+>whG$}h_wn{e83CtDe4q=SUvL|;{qxfr0<`T%w=kOwTy
zgxQxN<b6_8nAjmxDVBo>RmVtdA_|@zj$#^3MRX%<{*LFT(9r$P3qIA+X1AR4Tw<+A
zNAnOdKxlA`oDTf&SE3WEkZzx`y@G-w{p`?Qz1#uTD;JAp)JZzyWjjU~U#0+;Nz^{*
zcQ6r2<};E^bHb4z^ekKabpRgR#&{Yz(%lOIXS~aCfYQqp|8pDu(TI^gXdLC0DEz8Q
z0OkQOkHI{wEi~a>`8FR|SxWM5DjwrD9L}?&^=15D$+@aOKh+aHZY#7HlyP9vD!-_8
zxnk)N&@DXx0i4!FkJL%m{eXp)vV(;w0`55g*;WIiymSSJO73sR)T$s~{udTNUedB(
zsE2N>-(SM&xtPWdh~R{;k;2(Yky4i2OJ2kSsRD5t3>$x8VcY8&sBO!7bBiz+ayT9U
zBf^G*=`EM%#Q<?{25_*>X~*%+$+!attzU`xzU9tV<5@5C8`;d^@`B5#Aey$xDAM2o
zhBMQoPdM{{IK=_R#~wyC^AT~yJECRsYwr&l|6g?7!~im^@C6Nb`K&k`VBEZS%!=21
zK|Y~AG`i|o&(w5^RsV*N9evXpdj09gDLlV)Jug6klMQsF3E5+~0M0xme02m`8nba_
zvq#w^H<c&jg$eXf+20{Fcw0xG{A^$}s=~0w{h+xHdnkv6h~ExQOK(Q)uCHz4_ZO!&
zm_+0QaY;-2`;oIe&*MyS&PlTc3SpBD>-o45dg2xW)So-TO*=EhdPZB|G+ammsAvm;
zv>WRw_oZH+n(q=6q~i=}^iA5#U!DHOlSj?}0p3iYnJ&-GuCm1VBzjB+{+dexr7-yH
z(tIxstM#A0o4_V#N2bs-*h+P6vYcA!n9537s#|ZyCwAASX1%3j?t0)JKrO8f&>*}Z
za+I7d0T`yg=IITUB7zUt`yt>cVQwbL#e(HxLa$nR%@eDQAgL_Rlt^*ec*SV5Cp%zs
z;^f4!&WwkmmQ4~==Cx;lac$o@s0%JIMmV9O^;C!WzFC9L%zi?5>HK7l-xhUL%{?5e
z$)r_tRcS(xB`iDBoI@1!5x!R2mEsz6G-0AAkotD&9(Jg}Mqb^AJC_SX&_e3;2MSpa
zoI%z={YEkyxoZ_9XMl1GshIgsHUo(JfBbAOu^>|iIy=REAm0rUsR9Y6IZtAbgeKmI
zO|V=n&d;9iC3=hVe#@Au|CX3}JZvImMTmPj%ANX+KO>|fK4E=>Nq}4j*o`;X{|W_z
zz>eXCSNn;Y7w~&b>h#OwZcctKIIf&(*(&5J{0ee53~3TjII;qI%paTy2!T9^%-o=s
zn<yLM=>UuVUt03_e?nJ{HF6F}7r?2*Kw|kY*;T13)Wv}8ZT!{!7+9H$)OX`#b3$yR
z<%GkO-v0MW22l!Rbfavh!5v2WT<pJp{a4YZ)zlQ!RfF2{|E*~L)m>!bq0@Elc)nTx
z7c~+>&TTptv-cn(L**SknlzmSY7+sCsGzK)p$G@N`^kN8o39VQ&LBk7ok#yJ=lFPD
ztL;&FRhIWYs<_2yV*X#|FQmJ_C|<e2J((^6CkSmY{-c=xwK14o{hsRsE+!hL4}Ded
z787amq7|m-zklqBqz$E*IP4EDW&0{Z|K)$SHl01R)Kl}5*Qb}%Y+ut<{{9_pSt$N?
z7+zE<r(11`Q9&A<#imJE^%kwqRR0BYAl*T8d!Fa(wPX_GI<AAH6kX*<&-#wonVY4m
z*`!Rk68+Go1|4-n{I`p1V}KFlJ&wXRlM(z99f^}z+jO+i@JxbJ|MoL5hmZa$(4UjV
z{4rit6$NeO%iV744~OU?7*WPzE~O5wtPUf4pk4mp;A#jsY6V!lohh6BJv+HXHjB0&
z<=;-6RH6xAW|mJ&@b*^h;@z%yhb3ywx$G}iTJ)U;Np<yWDBCpy=d&BVj||dX{=c|W
zA9l?IGW9K3wkf&XZERH9yC1D~e#`&Ykk$Qls=*W~=$pslf&bAzp$8Xz{SO53|NmD&
zT*38!J2-r*0@_T-#U|O};=N=_!6v!bt{ogqQ81n0@?mWffmW-(rZ`QQ?Y+3DXEhR^
z-Q!Yyjuy2su9l@1FH{U;q6-3XDn}-4J0GWr18T_>7FrVpkC^NKeFG!}^Oi{M)ZE0x
z!sukP`@!{IgR`3I2bp+2yN&)=FCzmj5_5b>qq}36^_uM0>)ir|QrO))*CYY=41K+U
zf$B1#9Le9fo8M*f>O8=r&L?L<|Mbr&A+=YP$B3N-wF}~rb7C|QYj7D4uAefTpN*k2
zn7gdUVY)0~77;|g8dg@9{7`RoWfiy1SG1!p{|*QXNAiMTY4bUg=gqui7pV8a`fWs;
zWv<MiuduY)y_GkYn)Be}zqfwp?^E?S1#VQbU1uP>DX628QLJBM*pZ+@KjnFjy%|Q%
zj@BgLTAST(y1YRl92`KRnEOB>hm`ETX;klI>74y~Y>UrI@ZY<>3xiLGU0=fED|5_g
z6D`(nkCAg(r)!detxA92LhgqfL`Cq1&Y#6*_#KOtjg9xogiFhn-|^qA9KcSKC?L`x
zZ&|;z-5rC--mY|6yauJO<htxk{yxuQP3NQVAf2U+BkiztcQu=yt~lckSkmBnz#jCJ
zK%6e3>@EFA7KgfdFpO6r%5rGe5M1q{ZFj{U-+x(@cAugjJu4tDU}yesqX=&MJqmhG
zAfqlq$QE~wx{juwq6CBgudJlKp^H#pNq23#pZmSl8g;>VjGJmxtMTuXZ$2qJPuG9@
z=L=zIDB)nt0RNzX+ar2LewPE!lj4rPn9|t_8#6PtS~|%GK`}p%IVV(<apOOZU-6nH
zHGXXS!TR?TQX@$-?7D6{O}A2@_4=*->-I<>cqts8qVES8BZUsbh;==KMe@_M7bZs}
z^`wP#uLD3~jd^yt>%pn!AV5F`O8`a}hY&ax@FQqg=)9k<FG`Bsw@KjeqM#>~7rGp^
zAl453pgOyCo^2MNV)b|CUj+QV=SQIW1hX)%x~3+!pEUcx`%LeHT;MgGv`}F4+7lxK
zEHU{m2dorshsJm@OLO6ij)VGo_h!2j6VU1)JqPJIAP`8-T1Q9c69fX**sM?Y%RgA8
zv{th}I+_q{vCAYUHy_I@H@H3K-&R6u({{}H;C@2{e2TNWW+0B$kMP#i_O7Ad;Zm-i
zkjYB<3zn$xZQ82r65W{f?{uf#_C6v#D?FJ`KG-MeqW-7}pSQjsPC|oWJR>i6x1Gqj
z0ZDgZ$5>NIWhIW)rq`e{huHF_+H@*}Yvr5_tGzCw)^_Q9<2N4jMVm&^!}~=2R9<I2
zJ0)jI<*BXK0DuB8Qr+x|?|l=4@<<WMv3s1BaGB-vsZ<ngC^rCo`K%_PS6h+M2x4ti
zc|{wm-PQESGmBgg8x<430ZUer2i8As`-;?d%`J@0jZT)A=DT&32nwPSrx3IoanClX
z_#F7inG!VFXTNM(kq|h)aB)TooK54a>3QCx|MD5f1mW7m73@b?=T3blq4zpc^u5Wt
zPl^epn!FP`Y!N=waygg^96!3pz^Hf~H@(>QFPboncb_h5H<cx4w|q`dG3!{8Q(Dj~
ziGP9HxYW>MaZ)c!uU4AbC8<}n?%A8MnlZHzi1nY*@YCrbkf+NkyY))FV;9fcb(vfE
z@+rM3qL=6Vsu|;3+lq6DJ_A05**JWAybmgfWJaToL2UprJXxt&XHZh-S&7R8I2hGf
z4PI=q>rJMKW%2TK=0>V}XAgsLknMmueoCnUivaz3Oe*Taed&^n{`Sh9+Qqi}2Jlfr
z0%r|Y_uuivv0fDsCr+0iS?P#rhTs#v1KXBXp>bMekvc#j@__<tRGwGxlf<aw&XlUd
z=~6FvMtNp%TFo20qccp2?g|<H&-sRcI8jrcDL!kX8pAJEZ(4P4Xo`izKU!uH2JK<(
z>NoRK=mvE<8cg~?4V&jZU1>?f>`d=MIWngpv+TEgxIF9a2WaVqv>NRC26fyu=lBJ5
zX9MV1ZI;~@Em^0gCgezjolg<3BnJ5fy!q?Q$M*i@rsDa(1z?-Ub&+zg?T@K^S}I}B
z-mDt{Ujm%(lKQ$uy5-{{;#EMIHlXWd%DOiDi(ISPw;IqHof0M4i)aPdYirPre;zzD
z5zn3C9u|IPX%*9a&H#3!hAg-vh0k|`LB%^&X)AtuDx4Fi%@n&MAm@>DC01wwM2-!O
z`PBss)Sn%9EJz`RZ`>``x1AhU`t*39TLXAf7XOa?_qk{am7nP$V6SdzWnse&jgm$k
z+`ZFC7x*xklOr>p2N+=mT2L8Y+3o37A_`VyS$rg|oVhiLL8WG%Tu0R>OBdU)+PZ9;
zozP?;M0yp7vAu><fwM5$tzfRQ=HqI5E31O(?}~mRI^<o<JV(1@LR~==HlbRKF?cav
zZ?Utdb^?@W=*s`oe_XW+@h5R6^5gw+59tURu^?}rrNH*r`EL%1W9LL;nFWv`%qiZJ
zSG<++s*3L%r)?0NPDj5g<@p1181$-Rh*si>b+d68ULzMyo1mjKWlz(_k*+;9eFfNW
z6Vt2AmwsH(&m=q5KL3w&^J?_Wrbj260X_IVId$>8OY7i_F}q?+j&CJ8mkPB<DLiif
znw&sTA2y9xws>SNVs2-iKK)Pt)kfc{V7_lqDP^q{Lli(1MD&g5yGizk|GZXIujk*e
zM&Vb<&3@Q~fn3Yg2y*`h#hi!L5kw^Ds(D-UVZ98tSa4^>Th3aPEF%z;sI?KEDupWZ
zDxa!22GQ)M|43-B)Fc7g6ZA0@8v&lPa9(L4YUr8w^{CipMZ_EIx51*|H8EmbbIlI5
zu$bJTRHxVUirX0@hNEpc-i7w+|Edw=+K6f_v`3mohe8Yr7v%4bv|N>Jbuzt_058Zk
zt(58FXg*(jOvKx#d=H7AE0&3AjKWUL`Cp$u6F8ag+rHcB?tKjQ$2Z5_Wh7uE3l6c!
z@{>JQ1%fwU=MFXTTOG#_^RD<B@?Thh*$Xg0M3F=>M7+u8eP;iWJ-F25lfQkV83U5G
zNqyZ$(-j@9Ud%wmm;h@eWn^Hq=i@#{t5Vb#qfkSWH##y-;mWTI|068o^cueCAPExG
z--IVnaH`J`zuNma9rME_$0$v1k{fanRaH4}Sx(_TE})8K&T3&`5pK~MIiz80C7yWb
zf#Zu%tKb4VtuWbPomoaqd?r^(q%RZWH{B#7Jeu}xQcJuqSIm+qNt0?^JKLTO*1_2-
z7r3^n`PFPacJH*9S@0vGj6yH2Hn%%N#}gk=boqU5-OmXf($zZ}Q7+B(rd7Mzzr^3j
z;kl{L?K-(SxG6V*n-yJEIXQ>s<p(CdU0Qv43-Ta{i)UOUgxh0J3f)9K?@Le3HFOf?
z2Ww_Te;q8D&C3GFnfgqcA4(riTeYmtE@m*DQmUIvpCGg4qQbLVWSvzPQGJiFvMtVI
zZI}7#%ql9M0hd0Tjfi(Hr@Gf}Iv=~_tQ~J_7I7eDHhlaR_m=a*kIp{t%cf&!v;Fw^
zJ*>)ba8&p>`GaSjVFKp~!GkU9mNCjYmvg=B(c!szuyu0b3%D}#NwSR*DyA5*I>t<h
z>fwgyy9xje#9&VZj}WM`exfO(sXp1VENMMm<=0HjWkuGP3=C8kI)7xfqCpJ6CIhle
zrlR^~$u*;aH$?uM=NBJmjxy!XuQr)46E4JJLAeqWnt|vd*}OQyHv@4OktKCy8D57+
z?+3On@S8nOQ=GIgbcOrAF!ZIrQHWWa4orXZBzcaEF^9d`?NxN$xByWA@mYQs1=nR(
z=45kIh{@Xre(mWW`%xeHe3iaNzQ}jeYEFn(<r=5*+Ga&~E~^ZoP9Np`qsMdE512S(
zpo5fsa>RM6;`o3`K{k$m;_>I|@3?zz_^Da6LhDv8-W_w)RyiU0=;<kVtqok@)!YoA
z6zNttj>JH!DBdzC#tFMR@HW(Zi!B{2gDn@lG|gf->~>Uc+B*!0a8pMrR@cW{sS@L_
z=b$!}$;5i+#pe#VC;(%~-pHW`<lwmUz5unSzHrlV7{@xWl9fl_2c;&9e&d>cdUFU3
zyLQ)8KCUfoFx=fz#3;?c)@wp!cne%F4a_<J(!D&PXHFD!*q%K}yt&wF!D=#d!iu4e
z+!!dJnn1pV+uGi2<xdHFuIK~_Vz=1K?Zt^F@EEq`!MlbocTe!x>(q!4n7Yl#C9B1&
zuO^{y(+VqNGbpoPnn@sMU1AvBHyAS~95-B;$i1gOB$!vkb@dB8AJeZf+nb#J6t#(3
z?roP>=8L}&T+}H%uBKh>^uEc-%{H3a9<T$ur0J7l7ri!HN*gy$T@7i)D>bytXbA_#
z`?v~EGT7yXFSCZS?MkVaI5uO52QLOr^{8Zp8<DGiYS7D0cX?d_(*y58UZj`vY9zDn
zh^zi$_b(jlqhe+O$AP#kWc?X&q^*aQ`24_~sjJ}^vGY#vmoP}KW(R168@FkLv9wPX
z4QtE|dN1$zxTcn9kB!a>SzJwfAg&aI#HZ5^%un_x>UcPhcpZkT!-r_N&Js~Saqe($
z75^S-8>N9RRR<8=e60(><qPBcX!ZN7oIzsz!|5EqSKj2#U2r<JZJup~H@wZE^m02k
zLpbzbG*Xkn)QPHe%4I>emUA*Jt=P=TU+^-)@L&yuBk~TxsYGtT6jz-E)`&PXn^v5n
z`N;#R*D+g~QVUg`SUTj2MiOBkG9Pth_273ETE&Sejm-rMUu`a3vshhx`o`__g1)8J
zd!VK1EE6PcIh_|eg&u7`^8kL*xSk06&2p|w=K`$_-{>#hTxnD|)h3`P6J7pPf8BoQ
z;n!|ZIU^ICf9*Q8;GO-7!J$sGXCx3okm`M!?<>>-vL@2VG9zS4U+K-FBzD+0Axgw&
zx5JbMIZf9GeeZgsi!{VY`>B9SW<rlkhKby9zgXN<4c5T15YIH|9PhbtKR*$4Pqh7U
z{gdwMlK}&h?+Zz*IwfI)szr1CaQn%Mn<jA9+<6m}nSIWNR?j`X)tDph+q2xzA&xkl
z5qc!5PjxTtfw)O_v+q3L^yp19ui+J)Rd({~c~HG2*X<8c<eWAcn&CS(@Y!p)X3QPS
z!-mbiS{6nN3#*&1u^|eVUsvHLC*@;v{0$65krUQ|$<yPrQtU&if(-`mbP|xI;`!a#
zm&5~gEzsYBu`=}m$?ikH8;IFVDkUXNjCXW4nHmeBp;a{j5!Z_WQG3M$weyZa7h1SA
zNYo~LHeY$#XiBEu%<8IIxux851tbmF5Rz*{OLo|y`fe=nC}{tWKQWR~19EPaH_F-6
z>*XrMVFoijOqG;hh~ht!GJ0j`*OY3In(@GlZBNf0$e2_S^9;-h0fe<`Wl>=XNorfE
zP8V%6T@}s6m#I}{Tk7Ji+z0T^kVUC)FBnXvxn--mt8faKuG8!*Ove@Ktvf8Uy?72j
zYSPsIWK&xy>#~`N1mVrt#t&G0#XtkIQ23RcxtG-4sIM<&NhA_?qt^3c#E=3RCC<a=
z7B*wAb!M0H!P&hzukK@T>w3Qs<aC^X(=ui?WSD(RX;@mgT*hm5SYY<{rk>E%oZ~a=
zpx~6(3IVY6uZrTh@)cOKKT`mG{9`pou9I^Wy)^{Ud-eg-*XuxG85YM)OnmT0CQkjL
z>^s|NkY02}dQMW8YzYE{wI=Xb?Xnk__M@dx_`8`M0fo2l>AA;<GrBm%`=g`?2GOUf
zOA8bHmfK$v%D)Nay6;qQk}f0#nclcaUr7pxdbN-cP4sC9WT{7n#@UqGm34pb+t_nw
zqs-G7=W~xrbMO7rHJHTqV!eN-)>`8TZeK5n)oQ&WUsHM^*%mb8qdBwKRig1u5?-WC
z)G;4me;kL8Y4dfhUWk>y`_k6EjM!HD?Cs6EdH!D0ohUk<)ew9l9lJlL^y;Ix$RJr(
zd*UWPTIbtMbG##Ow63>*?-kB2EI8E^_(g7bm|T+vZctPn{w6+{VS{&S*&5PT#??C9
zcXxqGvvz5z4Y>v5;4rf7#i$T_E9_B95oh~9s<!UNDvlnB+6t2#KBbS=1{C}`^SRYu
z4$TBwq&x?sJL=ElJ$7dMya{>d{!zi$+BuR2T+q-#3PzW#ET)S3Ghedb3F(+E0Mz~+
zTAGR0O}2snp=S^!a34QmA&A=1b>ApIxZa9IQ-se5bb7Gm>Ynfog*D$43k#pcY0hTw
zdfUyplwM2@IL1dn#7sB|uRze8^Wlv=5n-$I?kr_fp?Thu51Z#3oUtuuvs&9KQ(h8*
z1_YYpR+)sA2>PURuja2K=DYAc)TNR9aC_zyxlYb222oz^o{_h91bbO&0y5F%=C768
z>tJfz7rAfaVG|$<zrJjv_de?g!&;Q5d8JliN@&HBsnlL9e6#lxJ{h-Z-8Rh%LK^!5
zcf<3NFr4SX6@2Cj!}mh#3$`2!BI0*dV;C#jPqX#Bq@gT%!WZ)?oKUZ;!DmCbFK)$C
zIyWi0g%4xwTSy{LWTW4l#CB4xa9x+ZdReGMb{~dnn0nClC_b1;*kw7~v_Tb0wV`C(
zjObwO)XiC#Tl(QNhYF`0x}(-#b8UJ#<($g?zL?>&?b*?%;p(l};MyBD`>yaUr?hb{
zV6JdUi5FyrHi80ZUP(tAUyXJR(X$?`9q1@7dwM}$m~NH`B0P_N-Ln|<p6m10SsLYz
zORbpkR%@v&cbZBz^Yk2!hbB~hUl4t|Px~RjdnHYouMp~tnO%K3BagM8MjF>lQzzFH
z=NlAX-@W}Cub`nJpjk~twJe>KBN}iyN?&~${uRZYYY#Az(aFXOqbl4SC5bLd-UF7|
zP^hg<aOibCDu!IWW?W1ah@7Yf`*wwd;WS=Yf^Yy6D83CRm@pSx_=t*LI-gZzuWK16
ztmGKMLbXu+NMzCm>9#we1S&d5=aohhGm1{ZTuAu6jK>cNowr^oDE|}fJ5DoQt@c33
zG%Te$+G<i30Nfyl;N5~ONvAOCJi7A8H&6DcvKDjX(D2k@lr@O&n~=&m$?sH~Jt=eQ
zV$w7U6a2$~a_xx4H5SmEKrrN$e%Vs!+~be-y6x?@b+dK3H|ajAH}O|CJUgt1no&r>
zGm>bA(w3t>aU;E#8gp|<Noww`@Sp<+Ji%f2s8iDgP?);RU}|BU4A+lNL=k5@E?BOb
z&w5}E$t6eTFrD9JtQcKjTQmZX-c%gk`4R^=O+5K}ESJTAXju~YRl#X{YMd!1shs|%
z%xSZk1A1~6c0kTk{^z@$cGgW+VWG=`{|9%qfZfBfP#wn(Hw^aab8bDcCF!S$-|Egf
zR8}v-SjmyYFObw8%M!-HxzHMXLn)PQN2kGSw+|?%n#()aB{q1;?3)7zCQ9(x%V|+&
z7D#u~r1Sd684kRpG))bTXt5E31R?W<-9~a+J<rUDf&Kl&GJY=p{7b9TeH$wFm(F)&
z9XU?Y0?G>7Z|oIVm5DWUu0-5CdvQe)C))g<NWPY?+`H3J4Ang*oQ=xjn|7BL3N7?4
zf6w;k62(D2kp>uI*i|QQ6AMNzWQsWOiWUF9z@*8Prn=(HB$s-^;9FJDHKJC+qK`k5
z^;-|UX%8NY^2q%pm$M?5MZI2{!ml+87T46?H*?!7l2t-Rk!9P(9n_1CT1%(82)IHY
zo8`Qe*B25&Y=jv6Gt<q<iZ|-G$1GD#jNViRV@Pd$rP9m;(Ft~FTo2+1H?GRJG^2LM
zMtLm-bva~lJYS3nCV7p%Jt1MQPv?8jwjcf7cyC0dw5cg>pZ3(Jc1@|oc;Iz-(9DJn
zzwL$MQlY{2Q~WUgi=WHx7vZ{Z97XmpGw%DnMOZwZdh|RL)^0xCm#$+~J9w~NY^{J*
zpz+!oyZK`QUsG<jj%h_TO{IhE$E!~~F9RRHplcfWiS5aFmP_GaPP9Ov;<QSJ$7>h^
zQyV<p-=m)_x0V&McRuNE{^Z6uhjiYzF>wR>BtNPdtHvOUECEJHFPLc5Yf>Ppj^%8f
z-ZopeN?zL{$=^mh6tdUW<hFxVbAtClQo8c08Y#R)VhrVjtod~97+FB86#vkVAVhp;
zGU%ybt~+go(5ntN<S#j)^A+NptCji7+C58CZ1S#<z#9tJ16fW-8_(<H4XfY6FUaKi
zjgE8@YuT!0!!@_5vpnBhZqpP73+E|hHGOLRj?&vp&t*IEh3ZLQegW(W6<-bQ4jD1>
z9C9vDrt()y3M|yCaW#NjNzMqxd8gX^jn)$jE&&B%-l!i9qRv+S_Rpd_=o~v3-8qU!
zf;4M9CSpsQR+hYPloMt`RK<F6c79;=W7+VuUL;DoHZCG#z1nCna3|oFk5zZ<@w-k=
zhIrgo%IDM=L#=u<f~b<!>{|W{3)uaIg?Jf=EBFnyr`K{(ksigZv6xc&=~lR+^oJgO
zjr60agdG3o2#vM#j03QdXAtZa)3F7owQnuUpX7%m^V-rqJ8yL<0magBY<j32#^-;i
zwWa+Pj7j~RoE&gq$MwmGH_mR_4`<Y;@<-+I-(H(;V>ao^pSZv@uKqCN$x;ZP1~Kb&
z`;Ro^%&9eAwc6?NjhVBG(fa$QC#Tw^)F}i;8Pe@;zpuTTZFHJSs1@GevAxMjwp!FA
zJG`K*RzZh5feyLKenGEISMic##8{Ncw+a`Y!OM%?HzU)t@<-TT##@Kmg<StksrH*U
zX10cQHYx<Lv2nR}?D|X#PO?5Kxhck<sp30t^c$GFmJ<HP|J*qfUevA7<4y%T2)a&~
z+jxf*(Eq9A*uCx(564de)fB568rTyCGcps1sRfdZ`*~)Ej^8e&=h{J!yML_b)28+<
z!d51bNZm(EWq-o9ZONQ=tG1V$-ovSSV$67fdkfDk9KXJ!=Cxy*JH}aNDBkQguwI3k
zfjgXGHR0dnSUA&_<E}k(m}X5hC-hBBiL^M+T=Np-38V_YD#<1QULldq4l|EoXoBDM
z)f|7b)A8OmgjW;#fl#q_e4@;8JzMYVx16f;>#bG!E}ZO2O@?iC{z+jfwwk!rZ@*kM
z%N?PP?KP*kntM^KbdT|1RZ1M(FQt65nmi8^7SrxE`s{lyQ-AoRA5P3A7#L5)WrWrS
z0*LwY?n!=?Cak^wI`^e(K&4O(V+}Uta-w?{{GcEUw&1Pj`a*FhJVMc<mEqyt(|2+Q
zZ>o!;t)j@}c0~*cntm%yrV+BMl#anq&SQ$t7)rXH^*J<n9JQ`8b3+$A+hT`G5?LZP
z&-Qap<x{-P*2e$9GTEY7w~)2_^Qjv;HW!EN7eUFtcekz&^QU%bLn<adDCq~s6pTvb
z?-r3avw012tS1>&$S7LEz4gpQS?qgxp0X{D&aKY2*xm6>55`IXHjRL=a!r)<S)!^G
z|Mvw;`VL9Y7BRsb?|Du=;qwymC79PAc_K#Z#*LniDa4ZHp;3Ql(#OSbtIf41MA?a7
z*<zITn!j#PLwNP8<1D-@=T@DjZC;s`RI1=4w3@>{Ytccs!AC?p!$56tgqvA;x1t$>
zsM&N>7iNXjNe|UZvFqe?2{U7!cfFw|)}t89j9xrJJbJ|b%kC~AyQZ=8VfdOIf{$|V
z2_BZOMiiNSbg#OxvXYJH<|(WcHCT)rurrE11ekSGf3QPcx9ehu1WZPjsNIjsG{!83
zJ~)!cav4m}XjykKpqAbT_tONYn)~lghVX?j?muMXj7FV?HedM9@_q!^g(8C!@x$t3
zYEQwV%`>WhiuWj6u27y;igJB&8ei`RTK>qsn>)DthfeF1BfLb4{pMYw<Zuw`_qmyv
zDAXE~lQ0D6Mm=oAbK9cDkFvez1O)XIE%PIFhY;IMD^_aP@J|x2(gBZ_P|!-ltn%Hc
zc25_jp!a?{y9LceQ>yERpR%w^BP`3X$SzYt4A^RfOaA}S-gUM$)irBu_}D;2dQ%V(
z5ouCGQE5UbBE2J_SLp;HK|rto0SQt<QR)K-NH3u&J@j4zL3&Rl^p?Ck`kw3jh4bO;
zuWQZhYtNcJYu2oLX3nV_2mG-e4XTvO_}bTY8mV>mGq3<s24K#JV@-z_3lsC&qB(Za
z>Fs`5?BTwL`9Neavv>s&he(n0`7yhuW3=iQm+reUtBXkD{-^GqI!eKWUelr8mHi1E
z2nxHI%^OR?Y^OH(2lV#VEIByUFUIQV@(o9=gVe0oql1nm2{zC&=iQ}!j@N1NKzf!P
zhIZh4mW!Tim-YU(MYgvuo?n#^w2|B)F?wkWs}b9VaGWup7dL#=un*LRlQy(81poL}
zlP#EPRrzW#g<J%)?_Uj_vD!jmR52*d^!7R0OQznK&W**Y-g>@L2+z?OicTCw9mn^j
zIJ>1DjhX|U8|qei6Y9~lhez%lc4+eTG3d&d`e%+QW+EXBNy-cg16O(DL>6dtVFkUf
zyd)y>B3t#$eK&AJ>o0uC1-oa&mz7ZOX^}py8d2YXxQ1OvKu?Qn`w&B8Z6T*?+cQRo
zw9_8PYyW=DXb);UWp?!?@8K@a6=m@2g$4k@1)%Lt4*RAWCn&(iMN*+)L?bVLPM}bu
z;x$?(Xt(xSi9J0;q(_h+BnaJgtPpDLyn+ZKZCwQ5=mwnA5|zziRq$6XQ<pGC<mW09
zUuHp|YF9`OaVM|>IL9k*RaD{7>u$DF;Buj^`E9b&h**G{knH-Lsr%8<Dxc8crKdY)
zG^<QU>UO7!%&hA`gO)iu?~x{}&!&GIPfKBJS=D=tnM&Mj!$r<*|DbdbiD_3@xZ*^-
z^sBrZsamnsT2-1RKf5s1w?khqixirm=+!3$8!+rE8#5^F09w3q7Hf(9Bd)>XwW6k~
zE24grCw++SnjLp;q@>}Fxc`pS^aIy5Zja&nAYK0WO|zP<CdZyqai=3CaJJ_!GbyG?
z)Uv0sHn{yY`2o6!&Lb6XtdV<6TKe#y^?93!>dfhaHP6^I({!7RRojBcRjTrrKMzW<
zzIa?MWO=xgPPg|Y{?OjVWtx7B46$o&QDWa7$!zVFdn*U${ut?M7hBR3tBojY5V`G_
z=W`s#i5GwmaAeGUOZVy;@iMY}8Q4AW5h)ODQJzoEdaL+v;sD@cq&rZfdsJd8(79E$
z`Jb`{tMWAHO;vydj&lNb1!Jy}a%T1;le^#G>k1z~Fbj%)d;rT}E;SV^H|88Gh5y>J
zyPKJFh(tSpfy=Nhzz=lu&gfb+_V13BDA1QP9tG0FlRSA#(q|aPK7@{T)4JECjb0rY
z&447+pv33VGaIbUu@1=8wGzIxY;;tS@BR6f%JX`xjw%t{yv&$?S=3t}aP~3QTSNL_
zup_lA5OAtDbbFK?S-@YGR}y8hxmwPozv#q6n~M}MF8d&qSZG!jt-d_p9tnU!8&2lv
zR(qHWJ%H#1r!?XFcv5CF%egnVH-mN1LC^Jo7GO`J!e;{gI>{FD!g`3y&UzXUs9kv?
zZx2cu)?0olLc4%@s7cky7Wvk<cmlWvSjC4sVyAEJ9QOpU3jHoq@YD12I?ffU1D#ga
z08!ZJiJbFdn5TeCnd4=cX|HiKW!T3FKX_Duy|~yc?hZehv`k|<y42p*o96Ovqx`pw
z+_9vaeY34qaiGuKZ%#V{-MsVDk_rc}PCpNC-b0y~W=g8X1!%mRT!OVlHA)jkOldeo
zm_P@@mwe3T7EIxOR-ujrkb6G+6DBH$=8aWdT;P6ae8E_H(4^XGH+<RHQkyJmw`Tm%
z4j=H0|CO?q&-i|lvd&rpBVwW}O<|u@01w0f;n``pdUN%UPSu(EHA#(5JNMQNddxKw
z8wTSOB{4k%sbmuq(@B|sGky-L<V8ANkp==?nlk{xjsluopE(v8xk#PL=X-A+0QA8Z
zlXsnX1S_o>3|Z9w$JR^~Ch5w<jaBVU(6+$!A@0PoRxxUrYh(@~?@@bnU)UGD3tVHq
zk{y)JP0tE{#4xd9h|TzS*lf(mvdVGYH-A>x)^&zCO53S%_ip2UG$)Qp?wsgiM75Zz
z?x;HXcF9-0ZckF+z~q;)O>xT_qvA20pIH_A>EwDP50PY-Rid-IP{YBt{gt!Y+0Oz@
zIFB01W<C>)Ihtw61-I4Rr0sY%=YF4O+e3wvLI~l!l!({d6}y3N${?-bE9cNS+LWjC
zW!2}5AgP{n9y_h!17Cq-#i(Bc8}=kr`GxV&k~wn}>(uvyA?{uash35>{M-<%v80)b
zWr>*ghU>(^5282Ti5Oef&Mu>@X{#Z9MMA-A_J){NB4;X)*a}XEorbns+9iFlJ%R7x
z&&%ZB@0&j;%*roSyd4$>AkJ@|fAgJMNkW9{UH=1LvBGz9-8zU&QHjiHIho0{(WI}~
zJ%1)gpXaJ9*Uu}()StOj%Cm9%&g0<69ZzrDa9>e7N|${wbmJ4oU|)anSXwzX0aM^b
zY%G3;Crks-km)T0Oi$e_>D6Cqi#L~P_%v7;T{WT!RvMkvlZ(2d;Z-z2o@+?@8JBm{
zmfIyUmU*RKJq2L$E5t-g3A=o<NJgMU^cEpSTB`cQRC~kUqyg*KvO#nXOOu!Pu+W6O
zE5)ML7S;Ve>L-_EE?)t|H_Y`@JDZ=|a&6pa<UOrE8Bo}mnokk~=L%3&Jo-MDd@??L
zoC^PVx5VkEk?o?0%gK0dI@6T+*6NTKhEM0@{?|eB%H9xT-S@*cehL9R?l?y5Na1^i
zf=@1$^E%9J@Ru#gTV=dOrrxL-1%3B-o4!j{Jzcd-JhU6|_8-iL6;Q4_Th<uc#Yd2s
zA0iL+$a*>Vk8<)ebg|#8tDB69JN-R=2RDe8bDj2nA61CH&`Ahv@4g&9*^6;Nn)O&l
z$&_mxYO{{?CB|o|ya*9POXpbnB_3>B=6x8rugc{UsidDKX-Qqm#%<W<M<#aOoM(}q
zs2*B4&ct)xgs&u)SJs_YRLvBM=GE8fQ2XA^4lMlz2P))DgNE%}zWqQL>gbfnc3rRC
zQX~By;)!MyAoS-cf*@ZdGWqWlUYX8p%Jn~wnkukIxJ$UkMX4cVSNz@MjhSuF+b*Rr
z@(grJVf&w)>YWaccjVZrbv5LBCn~^aLB$}@2PZA_BivdM10x9Cl%Uvm;~a0D)KKvt
z``NcpNgCIqBAWFl;4c9y6YYwVZ%=njlNg6=Is`n@b*l=Z0zC)6GmEs{Vz1(XIFx|L
z+>dQ4@}rL1l-p&GtF?nI^A>99Q4;X#r!`@*KNfTrcf)H(2ke~fU4$!cQ!##ot=Q)|
zGIx;(r~fwW=jYtP{~B1;mSf~#sC8~;C%<D;NIIAp6k23E6cCcnOo5nD@iw*z<z%U+
z6Z<$H<lEmLnxloA#Q4Y^Cy3=J;ifk$LBn5de_d^tB~+P<A8WCk__IsHh$Ts0cNe5W
zCa?t9cgVD8yI=@$i$erf8)+{Uk`%U}pDwh)4y__S7nktdU8*PTP1SfIY49@U4QO<1
zs;-&;5dO8Ubz)0ynEAzMmub@~)0(?}*{StX0ei@zb6ls%7XzTs_|Ko0EW5PEU)!|j
zI<G-r8=WfetT^loG)8Z!xRDMaQ4K}qq36FV5`TB>VyGUu(m{Y`Oe;bL#m+K6G(PCl
zzcnn=M*SXr^5)DSE4TqU*x(xG8ImQsS|_7bRtvcwXPs@sUzaT2zTPkTD*Wo@k-Y^M
z2%C^Qfw=3U`(h~SjKKU^y@Gwj$0-&pv9?4}y;W8Q7w`L9xc5=1<Bjf}XEOdo#E`Rx
zv-|Gdpu&LMrS-@8e2OnC*spoDNfHD<N1Ua46vG_H_e?nMxyb9KNA@{X9)6eJ+ebOm
zWdC;ZEi)}l1>t-S#`hx-sopuD*Cp1PFZE;Fsa1Ci`<`mEsFe^Oyu}h^#r$1OsiSg5
zq7$xOmXmTi_zjjA1&WJbpwtUUX9(Qzx5cz1VzwV*D(i>?WFfCQuH!M+d!2$(LmfHF
zKrTyDs<*?;9-}U&dEH5Yf{>ZsVz?9Ht}Uhv`2Y|Q3W2D1UXC72m3wtC&ONV^m;CH%
zL10Y+>XY@N@nyem`BU8rSLR1)Dl!&i5P82{oA)yk*-<&|cD(wHgS?wgCJlGzwFTLV
z8Z7<D(~utP$XUz=&=#gpSnszlO~Fy7jpn64n;HL!J)5n;Z=hZT(?<1-KFrWm@;9=8
zk&5cKFqiOYm@LZJ=bzappiP5_&rcu@!}C1G1%3<D#OfilkAUz)?Q=!>SSQLU$lK~9
zgFAv2smI@3PWB29Juapu&vvq_IllPf@~q^AXVmfW;n7Z!(d-(Qu$Rx<bWc}(ufXxn
zbk3;gQp=X-nPt|Als{b39pl=_)@zxiTPJm6bT|9%Be<2-9P{V6RQN}es?HxA`)y9C
zX??ag@57b5<`NxVd_nTJs&~Hd-vvqLeHP)1PPj6hAKUXDz~2X(2F#Bnv_-R}efF>&
zEfab@UY&%ba06&o7tkBNfRuxtx0=|S`faE;ATwl<NZt#W@LK{r;MozvjJHW!ij>8}
z=U5d9J_<e>zZR-M!gbgUr3dsv@RD&)v)H)f)!tMDxLZAbjD7c8z8)XDslP74Piu?h
zwN)?CDk4lN{g+3Cio_iX4>ygBj~<%y?lZ~c?ndAgD&&mhv``nu3&dqOp)g^M>BT7z
zIOT1u913E<{CQmlh58(-A3hCcJ?7W_5dSF^YN+eL>^0|K^LUzNBJ7X6sw6FfR%we*
zClhnGW*y65r;}JWKikZcCL*K@sF(8N-l7!z0))ON<m@7J=X3zLn{JwgI7^Z=q1XBU
zvffoJ(IRgAS9H0tJ>fpxYrWX6f~<1Aub1Nbg3nUXB}zD+{5z{SV_NO7MJ#SGE3@D*
zm%)j<bOghKxX?cMVct3)tKh~2N0=?eIxH<(YH4cAqP&0o-U2qVz7(`oAeb7HmM+$n
zB+W!nqGri5nqZO)Xqk*M1u)`#*t8N@g7@Pn&#Xs|T)>z5kTyA{{^-S<0EyCx>)mS)
zvur=^2qe*?1|uculVeQD9t&b$sG8Wabh$D$%E*pKgYlNd#*NAu(X#U9#B9%tvoF5_
zcBea0_Un;;R_ZWUHB`sLqa8gd_vnap&9pHdW(w%}PCJJV-UTSz)P|{ffkfI>VY4*!
z!5kBRUrp_3qkAWD#C*RfHPULywj|;6jqc>@(sOO$fz-FC65pRkLCHr##Bunqj)nt8
z)kcMQZ~Rk}w)nae*6f@bjA9%9?8)iRr=~t@{$us~-kjs)hBK!D1=J&=)ld@^yRqI>
zj*>|Ux9L0el8#~RZ3^QQLnzsq@WP-F>&?$IVpoCr9_;;CkOACP>-$(P&$j#h{NmYb
z*p8(q!UgCjIzf>AmOP?@Ff5zr@Umt&n+HTu{@i6M4Ydrd&|G#&>#~WbCe)Ulb-Z$w
z{B)eSqs@n_&GqD2`%G0O1u4&JPfk?j<|E!Sw664`M<j=NE^U6z%X&U@B7zVtHX%lb
z-zpNcgapf^T<`IE5NzXIGZGZn_ro4+hzW1C77!57%UAk(>AO*2UA=qiC+PM_!c<T{
z8<lK)ih4ryWEATK5(!q1U$rpOLw<(wtOj~c{ooe0@iPRK(MoMhvNrl3t`X?83O=Yc
zadLoOT-KpC92oN&l=gG~tKakDp0=iy?KJEx+1~vO-E(sYCECbRllpk<Cyv9KD~xnn
z3ECPiCF5Z5_N`>9f{OUo7o-}&Ms{n=`3qFS0;nFRDy-YBj?N+CM_Fv;rM}+Io{qZv
zaI_x*6cdM9US1xmGma6BTLAL|*ksFE;yPr8@765_m9U5?W|41(eH{69WiMmneqI|q
z<J124->A-sz4rF4a>?-=^|e7SH6)MVasJ@!JR*U#O^1jm|HlBYp=B6}Isrr6+DZpm
zCBdTfvdJT$mKPrEnN<m6ZSm<oYyB2ysJaWQs}Gz;cQZ1q=evgN<D%KLpQ&kzHC%PW
zee+Uf_Hm%Y)yAiIUc36c3cHEX|M201=Qgp})?8b&(NkoRIN`-uT4c{U^9g59=-@C1
z&D16tA1w-oq9iw3P3+wMh%XqY(p&d=H$gk0J55e;^^0I)p;3d|#=8|a^C=iUEL&iV
zwA4eEsO-Xg0IQeYf9M>Rn^zqoGHzW1Y#oI&^|BDrA+9sQ*ce#a&K{ekg%(&LXfI{w
z(5C!JlG<~tVDDnIFMgc&TgANcs*NNrej7jd*NhuVc+Mqd^?-a&UDo`wLo2N+U9m;)
z`bV21uIl04f3&Cf!O4p438LNx_YtLBOa1%*7zllw?&|6zHivOq<GmUK?DjM+P`whk
z@b>M5bPXWxc+0v^P(g7yZn^mnDe--sJ%ab{J!n|1RhW?|7#SPmyC?iS9Apwvc{u@2
zt`4W{o5s(rAVNJhKmV@Uit9oudOzDH3&F-*NKqxN6e*vrKuotIf*)~v-j2LA8aRsD
z^T%0OxS!ZPgxFI3Y9PAbT3A}tUmZ@4*^xhY?kvmir6iUba91K-d)EcC{*H8bNxpf+
zyEHkp0DHM+!c0R@OEfz=J~t-q=nE+bXL`_?ylZ+(cDN-`q^}S9=@>)RRH#<0#i6X+
z3OyVw6MVogGM0tG;c&19`7<PvFS=lvBmw;|`-u+w-c(LejXq?g`uw{jBjVTyEdttf
z&P}Y~!D=A!ND#Ew#xCn4!@s>I-qt^r9Eo^a?lMsCoJ+9?ZIQP>oe5s%fB5jTNJIvT
z`VehyVqlPC)@ohi4}}^R;tUE#+$u1^!O&6bLG0f(i;7C|=Uqh!VmZl&ceCI3S}}0K
z@A3)wP2QFB8>8ep0J#h!>mecMj`s<LkG5VMDXI7(6ugnraA1te;cl!_$om$$Y(%fs
z()v2K*s^$B?wJ115ZC_>@n&Qkxge(Fpn~8(EW6a0VxMvSP;$(cPP}m8f(mVvNh1_>
zmO_>gC;W$SP~A(IE;M2%A*NQ66!T|@@e>o*OC_%NgPL$*x=a<-;*)^p!v*kV3Ypo{
zv+r82U*g7`*SOLB^XF5DwaP<_hGZ0g+y<PJU?tj1w{I%mjl4%EtSn3?_u7|$Egs8g
z?dk+v7a$2eK8)r)$IZug!|!<sgN5l%kN2ZDMuKKDTFr)l3`MFhvCpPr`tJ-V&U+3j
z{5ex}FSNYZT_1Bt$<BU#a!SypaOr=w*T!jbxEr3B7`wzQAeQ(r@qKxDWTWde{UDc=
z-NrMh0cF~Ag`~04QFk0~AMgpNg@#g0H&gf3*S_t9qlfr6FGC})aa_N}^o26@%bus_
zw)OtT3<sJozyZl@*VZVwO)VB17stxzchK|(a!No~5$fg8KC4-j`AyRA?LX0Q$lZXi
zI5fiQ0iiosD%Y~)(Ab5CgoMnuYp1G9p?ppQ5~A5<%H3IUGUc{i3~xvzd3oOp6nb@f
z28P9@Wy|^i;Fp^ZBxZ{(_g<8A$JMJYcXZ$z8X7QDKvPud4k{B*PjwR$m8JM^>l4z@
z!^2kP)<3I&ES+!#RJsRs;cfY4nk!daXXJl&E86H+>jFM6@E~k5d??^nsxOXQK;ki=
zTy_+!EFil`z+(fR<Qsp6AB$1kB|yDY{?heOoE?CQnF99(N|<o}Kk@%rfstsasL13H
j_kSvZm7=B`h|W>fupQWUClueMES{ROmQvAEtC0TyoFFeX

diff --git a/site/film/ui/main.tsx b/site/film/ui/main.tsx
index 52abd1713..1c9edb139 100644
--- a/site/film/ui/main.tsx
+++ b/site/film/ui/main.tsx
@@ -192,6 +192,9 @@ function Screen({ shot }: { shot: Shot }) {
   return (
     <div className="lr-app">
       <AppHeader
+        homeHref={launcher ? "/client" : "/"}
+        atHome={!viewer}
+        showAppConnection={shot !== "picker"}
         led={
           launcher ? undefined : (
             <LedStrip

From c9c9242f958659193cedff0eaa8e90b70a84f22d Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 19:54:36 +0800
Subject: [PATCH 261/262] docs: close the 2.0 implementation boundary

---
 docs/project-memory.md          |  4 +-
 docs/standards/media-quality.md | 10 ++---
 docs/standards/versioning.md    |  2 +-
 docs/status.md                  | 73 ++++++++++++---------------------
 docs/todo.md                    | 42 ++++---------------
 docs/verification-status.md     |  8 ++--
 6 files changed, 47 insertions(+), 92 deletions(-)

diff --git a/docs/project-memory.md b/docs/project-memory.md
index 577a65887..3501fee71 100644
--- a/docs/project-memory.md
+++ b/docs/project-memory.md
@@ -1,6 +1,6 @@
 # Project Memory
 
-Last updated: 2026-10-11
+Last updated: 2026-10-14
 
 Piik is private, low-latency screen sharing for one Host and up to 20
 authenticated friends. The current product surface is Web Host, Web Viewer, and
@@ -93,7 +93,7 @@ implementation and routine UI detail.
   periodic rebalance is accepted.
 - Browser video uses `motion`; each share chooses H.264 with VP8 fallback through
   an actual sender probe unless the Host explicitly selects VP8 or H264. Screen
-  audio retains its compact presets and 128 kbps default. The 2.0 candidate
+  audio retains its compact presets and 128 kbps default. The 2.0 contract
   separates numeric bitrate requests from those UI shortcuts; implementation
   limits and admission remain in the media-quality owner.
 - Viewer playback uses one native video element. Presentation and recovery are
diff --git a/docs/standards/media-quality.md b/docs/standards/media-quality.md
index 9249c19d9..29d40a239 100644
--- a/docs/standards/media-quality.md
+++ b/docs/standards/media-quality.md
@@ -130,7 +130,7 @@ The three recommended profiles are ceilings, not delivery guarantees:
 | `1080p30` | 1920x1080 at 30 fps | 5 Mbps |
 | `1080p60` | 1920x1080 at 60 fps | 8 Mbps |
 
-`1080p30` is the default. The 2.0 candidate carries numeric width/height ceilings;
+`1080p30` is the default. The 2.0 contract carries numeric width/height ceilings;
 480p, 720p, 1080p, 1440p and 4K are UI shortcuts. Advanced picture settings also
 accept custom even dimensions within the combined implementation bounds below.
 Width and height form one applied edit. A size change caps the requested frame
@@ -138,7 +138,7 @@ rate in the same quality operation when the larger size requires a lower limit.
 Larger wire-valid requests do not
 authorize an adapter to exceed its local capture, codec or allocation limits.
 Numeric requests use representational bounds rather than the current control
-ranges. Candidate capture admits integer 1..240 fps and 0.1..240 Mbps, further
+ranges. Current capture admits integer 1..240 fps and 0.1..240 Mbps, further
 limited by picture size. Advanced controls accept typed values alongside sliders;
 the three recommended profiles and default remain unchanged. These are useful
 product controls, not universal codec
@@ -398,15 +398,15 @@ application-defined whole-room lowest-common-denominator target.
 
 ## Screen Audio
 
-The candidate supports mono and stereo Opus content through the existing audio
+Piik supports mono and stereo Opus content through the existing audio
 track. Mono inputs remain valid; Browser and Native mixing use a stereo output.
 A stereo receive preference or two-channel declaration does not prove distinct
 source channels. [Fidelity evidence](../research/media-fidelity.md#stereo) owns
-decoded-channel checks. Surround delivery is outside the candidate; it needs
+decoded-channel checks. Surround delivery is outside the current scope; it needs
 capture, channel-layout, mixing, codec and playback support, not only a channel
 count setting.
 
-Display audio uses `contentHint = "music"`. The 2.0 candidate keeps 64/128/192 kbps
+Display audio uses `contentHint = "music"`. 2.0 keeps 64/128/192 kbps
 shortcuts and the 128 kbps default, with a custom numeric ceiling in the same
 sound settings. Current Browser/native senders support 6..320 kbps; the numeric
 wire format uses Opus's 6..510 kbps bounds independently of those shortcuts.
diff --git a/docs/standards/versioning.md b/docs/standards/versioning.md
index 236445709..7bb0bdb35 100644
--- a/docs/standards/versioning.md
+++ b/docs/standards/versioning.md
@@ -88,7 +88,7 @@ execute unknown commands. A more tolerant reader does not update already-release
 readers: do not emit a new reaction to legacy pages merely because current pages
 can skip it. Verify both readers before calling a change additive.
 
-In the unpublished 2.0 contract, numeric media descriptions and retry progress
+In the 2.0 contract, numeric media descriptions and retry progress
 are independent of current implementation limits and retry policy. Extending
 those policies does not require another count-specific capability flag.
 Representation acceptance still requires local operation/resource admission;
diff --git a/docs/status.md b/docs/status.md
index 29aea5f07..b5491cd5f 100644
--- a/docs/status.md
+++ b/docs/status.md
@@ -8,7 +8,9 @@ and Git/PRs own completed history.
 
 ## Accepted Release Contract
 
-- Browser/server v23, Native control v9 and capture v7 form the published contract.
+- The 2.0 release boundary uses Browser/server v24, Native control v10 and
+  capture v7. App and Site must upgrade together; 1.x cannot participate in a
+  2.0 session. SQLite schema 2 is unchanged.
   [Versioning](./standards/versioning.md#public-compatibility-promise) owns
   compatibility between published Web/App/Server versions.
 - Hosted Server defaults to SQLite schema 2. Room authority has no inactivity
@@ -54,52 +56,31 @@ Release artifacts and operator deployment records own delivery completion;
 
 ## Current Work
 
-The public baseline retains Browser/server v23, Native control v9, capture v7,
-SQLite schema 2 and the 1440p ceiling. Hosted empty-room retention and capacity
-guidance preserve indefinite retention by default. The accepted Demo policy is
-one hour without authenticated participants; the private deployment retains the
-default. Operator records own activation, database and postflight evidence.
-The owner is holding the unpublished maintenance changes for 2.0. Preparation
-includes separating media presets from numeric requests and bounded capabilities.
-Numeric audio and video ceilings are implemented in the unpublished candidate:
-Browser/server v24 and Native control v10 replace the preset fields;
-capture v7 and SQLite schema 2
-remain unchanged. Matched candidate App/Web/Server builds are required;
-1.x participants are rejected by the existing compatibility checks.
-Custom width/height controls apply combined size and frame-rate limits, admitting
-4K60, ultrawide input and higher frame rates at smaller sizes. Advanced video
-controls span 1..240 fps and 0.1..240 Mbps while retaining
-the three recommended presets. Windows and Linux output preserve source shape
-within the selected ceiling.
+2.0 separates numeric media requests from presets and bounded runtime admission,
+retains successfully applied quality settings, and lets App serve an approved
+Site independently of Local/public room startup. It also adds detached chat on
+supporting desktop Browsers. Media, room authority and P2P-first routing keep
+their existing owners; [product standards](./standards/README.md) define the
+accepted behavior.
+
+Optional coordinated Native UDP preparation augments the existing retry owner.
+The [network laboratory](./research/network-lab.md) covers all Browser/App
+pairings, recovery, SFU policies and successful two-App preparation through
+sequential kernel NAT. These results do not establish a public success rate.
+Magicsock remains excluded: its [controlled comparison](./research/nat-traversal.md#integration-cost-and-recovery-controls)
+established no additional reachability worth its integration costs.
+
 The [media assessment](./research/native-client-media.md#media-capability-extension-assessment)
-owns local codec, derived-output, SFU, Browser/Native fanout and live-control
-evidence. Both macOS architectures pass SDK compilation and packaged startup;
-physical geometry verification, cross-device and route-change acceptance remain
-open. Additional codecs are not part of this candidate.
-Magicsock remains outside the candidate. Refreshed stable-version controls found
-no additional direct reachability and retained discovery/inner-ICE timing costs.
-Participants can retain the Web UI, but enhanced edges need Native transport at
-both ends. Easier activation does not establish a reachability gain or resolve
-its integration costs. The
-[assessment](./research/nat-traversal.md#integration-cost-and-recovery-controls)
-owns the retained experiment and adoption boundary. Its package is retired;
-independent ordinary ICE and media repairs remain in the candidate.
-An independent bounded Native UDP preparation now augments existing retries
-under ADR-0009. Actual App process checks cover socket adoption, decoded media
-and reverse feedback through sequential kernel NAT, as well as ineligible
-preparation continuing ordinary ICE. The [network laboratory](./research/network-lab.md)
-owns paired outcomes and evidence limits. A separate field beta is not required
-for the owner's final review; local acceptance does not establish a public
-success rate or remove Browser-only operation.
-The original candidate packages pass their identity/checksum checks; Windows
-Local startup/retirement, saved Site approval/revocation and explicit 1.x
-rejection have packaged acceptance evidence. Publication remains subject to
-the owner's final acceptance.
-The candidate App now waits for approved Sites independently of Local/public
-room startup. Its two-choice launcher retains one exact Site approval and
-revocation, using the existing loopback and native-session owners.
-Immutable release artifacts own delivery completion; [TODO](./todo.md#now) owns
-remaining work.
+owns bounded output and live-control evidence. Physical macOS/Linux capture,
+limited decoders and sustained game/4K use retain the limits in
+[verification status](./verification-status.md). Additional codecs, room voice,
+surround delivery and end-to-end HDR remain outside this phase.
+
+The owner authorized publication after final acceptance, without a separate
+field beta. Immutable release artifacts and operator records own exact delivery
+and postflight; [TODO](./todo.md#now) owns remaining product work. Hosted room
+retention stays indefinite by default. Demo uses one hour without authenticated
+participants; the private deployment keeps the default.
 
 ## Deployment
 
diff --git a/docs/todo.md b/docs/todo.md
index 068c49f95..9075a41f5 100644
--- a/docs/todo.md
+++ b/docs/todo.md
@@ -2,46 +2,20 @@
 
 Last reviewed: 2026-10-14
 
-The current 2.0 preparation includes independent investigation across this
-ledger. Explicit owner holds remain in force; an investigation does not itself
+Explicit owner holds remain in force; an investigation does not itself
 accept a new feature or architecture. A missing device or reporter trace blocks
 only that evidence claim, not unrelated work. Product modules own behavior;
 Git/PRs own completed history.
 
 ## Now
 
-- [ ] **2.0 candidate preparation and acceptance.** The owner reopened investigation,
-  useful improvements and outstanding acceptance on 2026-10-07, and on 2026-10-09
-  chose to hold the maintenance changes for 2.0 rather than publish them separately.
-  Present the frozen candidate and its bilingual release notes for owner review
-  before publication. Packaged Windows Local startup/retirement, saved Site
-  approval/revocation and both directions of 1.x compatibility rejection have
-  passed. The owner chose local acceptance followed by final review; a separate
-  field beta is not required. Broader device coverage below does not override
-  the owner's platform deferrals or require a statistical NAT campaign.
-  The retired Magicsock package is not the current
-  candidate; preserve the existing product model in independent transport experiments.
-- [ ] **Reconcile open PRs with the final candidate.**
-  [#462](https://github.com/TNTcraftHIM/Piik/pull/462)'s 256/320 kbps request and
-  [#469](https://github.com/TNTcraftHIM/Piik/pull/469)'s 4K request overlap the
-  numeric-media candidate; neither PR has been merged. Evaluate their original
-  contribution against work already independently identified, following
-  [contribution review](../CONTRIBUTING.md#ways-to-help); overlap alone does not
-  warrant merging or co-authorship. Retain #470's accepted authorship and verify
-  attribution after integration. Preserve the physical-evidence limits below
-  and explain the disposition at integration. Keep
-  [#459](https://github.com/TNTcraftHIM/Piik/pull/459)'s candidate scope and
-  bilingual upgrade instructions aligned with the accepted result.
-  [#475](https://github.com/TNTcraftHIM/Piik/pull/475) identifies the Linux
-  desktop entry's missing terminal controls. The candidate restores the existing
-  terminal through the desktop entry; tray activation and Browser process-exit
-  authority remain separate, unaccepted additions. Credit the reported defect
-  without attributing this independent packaging correction as co-authored code.
-- [ ] **Gitee mirror workflow activation.** The production verifier passes with
-  the original published CI artifacts, GitHub digests and anonymous Gitee downloads.
-  After the owner-approved merge, check Actions event dispatch, cross-run artifact
-  access and secret injection. Keep mirror failure visible without blocking
-  product CI or Website delivery; do not rebuild an existing release for recovery.
+The 2.0 implementation scope is complete. Final package checks and delivery follow
+[the release workflow](../CONTRIBUTING.md#full-integration-and-release-workflow)
+and [GitHub operations](./operations/github.md); their exact results and PR
+disposition belong to the release/PR records. The owner authorized publication
+after bounded local acceptance, without a separate field beta. Broader device
+coverage below does not override the owner's platform deferrals or require a
+statistical NAT campaign. Do not describe those unmatched reports as fixed.
 
 ## Held By Owner
 
diff --git a/docs/verification-status.md b/docs/verification-status.md
index 09bb444e3..702009465 100644
--- a/docs/verification-status.md
+++ b/docs/verification-status.md
@@ -1,6 +1,6 @@
 # Verification Status
 
-Last updated: 2026-10-03
+Last updated: 2026-10-14
 
 This file owns physical evidence limits that change how the product may be
 described. [Status](./status.md) owns the execution/deployment index.
@@ -10,9 +10,9 @@ implementation and obsolete package history.
 ## Current Evidence
 
 Windows App and Browser are the owner's primary acceptance targets. Current
-Go packages embed their Web assets and do not run a Node backend. The current
-published contract is Browser/server v23, Native control v9 and capture v7;
-[status](./status.md#current-work) owns unpublished candidate changes.
+Go packages embed their Web assets and do not run a Node backend.
+[Status](./status.md#accepted-release-contract) owns the accepted contract tuple
+and current release boundary; artifacts own the exact published build.
 
 Bounded current checks cover:
 

From 099185d21d86bb0a787157303e661185451a9f45 Mon Sep 17 00:00:00 2001
From: AAA <35992542+TNTcraftHIM@users.noreply.github.com>
Date: Wed, 14 Oct 2026 20:05:00 +0800
Subject: [PATCH 262/262] test(app): omit race exit delay from capture fixtures

---
 internal/app/nativecontrol/session_test.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/internal/app/nativecontrol/session_test.go b/internal/app/nativecontrol/session_test.go
index 388dce0e7..222a304b6 100644
--- a/internal/app/nativecontrol/session_test.go
+++ b/internal/app/nativecontrol/session_test.go
@@ -123,6 +123,11 @@ func TestMain(tests *testing.M) {
 		runQuietCaptureFixture(directory)
 		os.Exit(0)
 	}
+	// Self-exec capture fixtures inherit this before their race runtime starts.
+	// Real native helpers have no race detector's default one-second exit sleep.
+	if err := os.Setenv("GORACE", os.Getenv("GORACE")+" atexit_sleep_ms=0"); err != nil {
+		panic(err)
+	}
 	os.Exit(tests.Run())
 }