// room.js: the browser half of a call.
//
// Spec sections this implements, and the order they appear below:
//
//   §4.1 transport      one SSE stream down, POST /signal up
//   §4.2 peer identity  the server issues `peer`; one peer per session
//                       per room, and nothing here ever displaces
//                       another tab automatically
//   §4.3 messages       the event table, including the roster as the
//                       authority and the admission queue
//   §4.5 resume         the probe, the replay, the four refusals and
//                       the terminal reasons
//   §4.6 delivery       per-target outbound queue with `seq`, pair
//                       generations, inbound dedupe, candidate buffer
//   §5.1 negotiation    the W3C perfect-negotiation pattern
//   §5.2 ICE servers    GET /m/{sqid}/ice before the first connection
//   §5.3 renewal        per connection, at the server's `renewAt`, and
//                       complete only when a new ICE username fragment
//                       is on the selected candidate pair
//   §5.4 screen share   getDisplayMedia as one sendonly transceiver
//                       per connection, a `share` message so peers can
//                       label the tile, and a stop that ends the
//                       receiver's track rather than muting it
//   §5.5 the floor      an empty list is the floor: host candidates
//                       only, and the failed tile says whether a relay
//                       was there to fail
//   §6   chat           the broadcast lane and the panel: chat.js owns
//                       the words and the log, this file owns the wire
//                       and when the panel is usable
//   §15.19 media state  who is muted and whose camera is off: our own
//                       reported on the broadcast lane, everyone else's
//                       read from the roster and `media`
//   §15.26 reports      the anonymous quality report every thirty
//                       seconds and at leave, and "Report a problem"
//                       (report.js's sheet) with the diagnostics
//
// House rules this file is written under: no library, no inline script
// (the page's CSP is `default-src 'self'`), nothing built with
// innerHTML, and every string a peer or the server sends is written
// with textContent. `data-is-member` on #room is a rendering hint only
// — the server re-derives authority on every request, and the roster
// it sends is what this file actually believes.
(() => {
  'use strict';

  const root = document.getElementById('room');
  if (!root) return;
  // Revealing the room is the first job: the server renders it hidden
  // so a scriptless browser sees the fallback paragraph instead.
  root.hidden = false;

  const sqid = root.dataset.sqid || '';
  const selfName = root.dataset.selfName || '';
  const memberHint = root.dataset.isMember === '1';
  // §5.5: whether this instance has a relay at all. It changes one
  // sentence — the one a failed tile shows — and nothing else. Like
  // data-is-member it is a rendering hint: the ICE list the server
  // actually mints is what decides whether a call has a relay to use.
  const relayConfigured = root.dataset.relay === '1';

  const $ = (id) => document.getElementById(id);
  const tilesEl = $('tiles');
  const queueEl = $('queue');
  const knocksEl = $('knocks');
  const statusEl = $('status');
  const muteButton = $('mute');
  const cameraButton = $('camera');
  const leaveButton = $('leave');
  const shareButton = $('share');
  const muteState = $('mute-state');
  const cameraState = $('camera-state');
  const shareState = $('share-state');
  // The sharing notice and its own Stop sharing button (2026-09-28).
  const shareNotice = $('share-notice');
  const shareStop = $('share-stop');
  const shareRecoveryEl = $('share-recovery');
  const copyDiagnostics = $('copy-diagnostics');
  // §15.26: "Report a problem", in the Devices panel beside Copy call
  // diagnostics and in the More menu, and the person's own switch for
  // the automatic reports.
  const reportProblem = $('report-problem');
  const reportProblemMenu = $('report-problem-menu');
  const moreToggle = $('call-more-toggle');
  const morePanel = $('call-more');
  const qualityRow = $('quality-row');
  const qualityInput = qualityRow ? qualityRow.querySelector('input[type="checkbox"]') : null;
  // §15.19: the tile marks, rendered by the server so they are the
  // vendored badge and the app's own icons rather than a copy of either,
  // and the polite region that says a change out loud. #status is no
  // use for that: renderStatus rewrites it on every render.
  const mutedMark = $('tile-muted');
  const cameraOffMark = $('tile-camera-off');
  const mediaLive = $('media-live');
  // The chat panel's root (§6). chat.js owns everything inside it; this
  // file owns the wire under it and the moment it becomes usable.
  const chatEl = $('chat');
  // The device panel and its controls. Every one of these is optional
  // as far as this file is concerned — the room renders without them in
  // a browser that cannot enumerate devices, and switchDevice and
  // fillDevices both check before they reach for one.
  const devicesToggle = $('devices-toggle');
  const devicesPanel = $('room-devices');
  const deviceNote = $('device-note');
  const pickCamera = $('pick-camera');
  const pickMic = $('pick-mic');
  const pickSpeaker = $('pick-speaker');
  const cameraRow = $('camera-row');
  const micRow = $('mic-row');
  const speakerRow = $('speaker-row');
  const rawRow = $('raw-row');
  const rawInput = rawRow ? rawRow.querySelector('input[type="checkbox"]') : null;
  const shareModeRow = $('share-mode-row');
  const pickShareMode = $('pick-share-mode');

  const DEVICE_KEY = 'meet.devices';
  const BACKOFF_MIN = 500;
  const BACKOFF_MAX = 30000;
  // The stream's own ceiling is deliberately well under the hub's
  // thirty-second resume window: a client that waited the full thirty
  // would lose the participation to its own patience, and come back to
  // a fresh peer id and a renegotiated mesh for no reason.
  const STREAM_BACKOFF_MAX = 10000;
  // §4.6: a target whose POSTs have failed for this long is treated as
  // unreachable — the pair is reset and the connection rebuilt.
  const SEND_DEADLINE = 30000;
  const MAX_BUFFERED_CANDIDATES = 256;
  // §4.3: `full` is not a refusal, it is "not yet" — a member waits and
  // retries the join on this interval.
  const FULL_RETRY = 5000;
  // A stream refusal the probe cannot name — a full room behind a 204,
  // a 500, a `last` the server would not parse — would otherwise retry
  // for ever behind "Connecting to the call." After this many rounds
  // that produced no `hello`, and this long since the last one, the
  // client stops and says so. Both conditions, because either alone
  // gives up on something worth waiting for: a count alone would quit on
  // a handful of fast failures at the start of the backoff ladder, and a
  // clock alone would quit on one slow round that was still going to
  // succeed.
  const MAX_STALLS = 8;
  const STALL_WINDOW = 60000;
  // A stream that lived at least this long was a working stream, not a
  // refusal: only that resets the backoff. A stream dying moments after
  // its `hello` would otherwise reconnect in a tight loop.
  const HEALTHY_STREAM = 5000;
  // §5.3: a fetch of /ice that fails is retried every minute, and the
  // warning stands from the first failure until one succeeds. The gate
  // shortens the *schedule* through X-Calls-Test-Ice-TTL's effect on
  // `renewAt`, never this: there is no client knob for it.
  const ICE_RETRY = 60000;
  // §5.3 step 2: each ICE restart gets thirty seconds to prove itself,
  // and a connection gets three of them.
  const RENEW_ATTEMPTS = 3;
  const RENEW_WINDOW = 30000;
  const RENEW_POLL = 500;
  // The floor under a renewal delay. Nothing the server can send should
  // schedule a renewal sooner than this: a list with no margin left in
  // it would otherwise fetch, schedule for now, and fetch again.
  const MIN_RENEW_DELAY = 1000;
  // And the floor under the margin itself. A list whose renew time and
  // expiry are less than a second apart cannot be renewed on any
  // sensible schedule: the delay floor above would turn it into a fetch
  // roughly once a second for as long as the tab stayed open. The
  // server clamps what it will mint, so this can only arrive through
  // the development-only TTL header — but a client that answers a
  // nonsense schedule with a 1 Hz loop is a client that can be made to
  // hammer its own server, so it declines instead, and says so in
  // state().ice rather than looking idle for no reason (W3-12).
  const MIN_MARGIN = 1000;
  const PEER_ID = /^[0-9a-f]{32}$/;
  // §4.3's two untargeted messages ride one queue of their own, and this
  // is its key: not a peer id, and it cannot collide with one, because
  // every peer id is thirty-two hex characters.
  const BROADCAST = '*';
  // A 404 on the broadcast lane is diagnosed inside the message's own
  // deadline — but a POST that spent all thirty seconds getting that 404
  // leaves nothing to diagnose with, and a recovery with no budget
  // decides nothing at all. This is the floor it gets instead: enough
  // for one probe and one retry, and short enough that a tab which has
  // really lost its participation is not left looking live.
  const MIN_RECOVERY = 5000;
  // §5.1: how long the polite peer waits before offering. Perfect
  // negotiation's answer to glare is a rollback on the polite side, and
  // in Chromium rolling back an offer that added an m-line rebuilds the
  // whole connection's send streams: the camera's comes back on the same
  // SSRC having encoded nothing, on an m-line that goes on reading
  // sendrecv with a live track, and it never encodes again. Two peers
  // sharing a screen in the same moment is how a call finds that, and
  // the gate's mutualshare scenario is where it was measured.
  //
  // So the peer that would roll back yields instead. A remote offer that
  // was already on its way arrives while this side is still stable and
  // is answered rather than collided with, and no rollback happens at
  // all. The cost is this much delay before the polite side offers, and
  // only when the other side has nothing to offer. The wait itself is
  // unconditional — the check that reads the connection happens after
  // it, not during — so what a remote offer arriving buys is not a
  // shorter wait but a negotiation this side no longer has to make.
  const POLITE_YIELD = 300;
  // How many times in a row the polite side may give way without an
  // offer of its own going out. A boolean could not answer both "give
  // the allowance back when the exchange that took our turn completes"
  // and "never let giving way become a habit"; a small counter answers
  // both (Codex S4-4, and the Task 4 re-review's item 1).
  const POLITE_YIELDS = 2;
  // Polls in a row that must report no new encoded frames before a
  // camera counts as stopped, and repairs on one connection before the
  // pair is reset instead. At one poll a second that is two seconds of
  // a live track on a sending m-line encoding nothing, then a
  // replaceTrack cycle, then two more seconds, then a reset (Codex
  // S4-5, and the Task 4 re-review's item 2).
  const CAMERA_STALL_POLLS = 2;
  const CAMERA_REPAIRS = 1;
  // And the same shape for the last link in the chain: how many polls a
  // tile may hold a live, unmuted track that its connection is decoding
  // frames for and paint none of them, before the element is handed its
  // media again — and how many of those before the pair is rebuilt
  // instead (Codex round 2, the branch after S4-9).
  const RENDER_STALL_POLLS = 3;
  const RENDER_REPLAYS = 2;
  // How far an element's own clock must advance in a poll to count as
  // playing rather than twitching. A second of video is a second of
  // clock; a single frame is thirty milliseconds, and a tile painting
  // one frame every three seconds is a stall with a tic, not a picture.
  // Reading any advance at all as health let such a tile reset the
  // budget below for ever and never earn its reset.
  const RENDER_MOVED = 0.25;
  // The ceiling studio audio asks for, in bits per second. Opus is
  // transparent for speech well below it; the number is picked so a
  // microphone someone turned the processing off for is not then
  // squeezed down a pipe built for speech. It is a ceiling and not a
  // floor — the encoder still spends only what the link will carry.
  const RAW_AUDIO_BITRATE = 128000;
  // §15.20: the hearing watch. How often the levels are read — five
  // times a second, which is as fast as a bar is worth moving and slow
  // enough that one small getStats per connection costs nothing a
  // person could notice.
  const LEVEL_EVERY = 200;
  // An audioLevel below this is silence: -80 dBFS, well under any room's
  // own noise floor, so a microphone reading it is not hearing the room
  // at all. Anything at or above it counts as sound.
  const FLAT_LEVEL = 0.0001;
  // How long a stream that is arriving must stay that flat before it is
  // called silent — long enough to cover somebody simply not talking in
  // a quiet room, short enough to catch "can you hear me?" early.
  const NO_SOUND_AFTER = 5000;
  // Packets count as arriving if one came this recently. Wider than a
  // poll, because a sender using DTX sends a packet every 400 ms or so
  // through silence, and silence with packets is exactly the case the
  // watch is for.
  const ARRIVING_WINDOW = 1500;
  // The speaking highlight, with hysteresis: on at SPEAK_ON, and off only
  // after SPEAK_HOLD polls below SPEAK_OFF, so a tile does not flicker
  // between syllables.
  const SPEAK_ON = 0.04;
  const SPEAK_OFF = 0.015;
  const SPEAK_HOLD = 4;
  // The speaking light on a tile's name, which replaced the ring round
  // the tile and the meter beside the name (0.3.7), and since 0.4.3 is
  // the warm rim, as the native apps have it (SpeakingGlow.swift,
  // WarmRim.swift): a level by decibels between GLOW_QUIET_DB and
  // GLOW_LOUD_DB; lit only once sound at SPEAK_ON has kept up for
  // GLOW_ONSET ms, so a click never lights it; the level rising over
  // GLOW_ATTACK ms and falling over GLOW_RELEASE ms, which is a CSS
  // transition on --lvl, with --on going out once it has fallen; and one
  // steady GLOW_STEADY for anyone who has asked for reduced motion.
  const GLOW_QUIET_DB = -42;
  const GLOW_LOUD_DB = -12;
  const GLOW_ONSET = 150;
  const GLOW_ATTACK = 50;
  const GLOW_RELEASE = 300;
  const GLOW_STEADY = 0.6;
  // Speaker view's stage (0.4.0), as the native apps have it
  // (ActiveSpeaker in SpeakerView.swift): someone takes the stage only
  // after SPEAKER_DOMINANCE ms as the loudest speaker, and whoever is on it
  // keeps it at least SPEAKER_HOLD ms, so an interjection, a laugh or two
  // people talking over each other never make it flap. Never yourself.
  const SPEAKER_DOMINANCE = 1300;
  const SPEAKER_HOLD = 3000;
  // §4.3's limit on the list the hub will take.
  const MAX_NO_SOUND = 15;
  // §5.4: the tile key a peer's screen gets, built by shareKey.
  const SHARE_SUFFIX = '#share';
  // §15.21, the screen watchdogs (2026-09-28). A screen that has decoded
  // nothing new for SCREEN_STALL_AFTER while its sender says it is
  // sharing is stalled here, and reported as `screenStalled`; every
  // sender repeats a still screen at least once a second, so this long
  // without a frame is not a still screen. Held for at most
  // SCREEN_STALL_GIVE_UP, so a screen nobody can recover is not a report
  // that never ends. A sharer named in someone's report asks its encoder
  // for a keyframe, at most once every SCREEN_KEYFRAME_EVERY, and rests
  // SCREEN_KEYFRAME_REST after SCREEN_KEYFRAME_TRIES of them.
  const SCREEN_STALL_AFTER = 4000;
  const SCREEN_STALL_GIVE_UP = 180000;
  const SCREEN_KEYFRAME_EVERY = 4000;
  const SCREEN_KEYFRAME_TRIES = 3;
  const SCREEN_KEYFRAME_REST = 30000;
  // §15.22 (2026-09-30), when keyframes do not answer. The receiver
  // hands a stalled screen's picture to its element again once,
  // SCREEN_REATTACH_AFTER into the stall. The sharer, still named
  // SCREEN_REBUILD_AFTER after its first keyframe, rebuilds that
  // connection's screen (a new transceiver: a new encoder here, a new
  // receiver and decoder there); still named SCREEN_RESHARE_AFTER after
  // that, shares again for everyone from the same capture; and
  // SCREEN_GIVE_UP_AFTER after that, says it could not. A rebuild at most
  // once every SCREEN_REBUILD_EVERY per person, a share again at most
  // once every SCREEN_RESHARE_EVERY, and neither unless at least
  // SCREEN_ESCALATE_SENT frames left for that person since the last step:
  // a receiver cannot be failing to decode frames that were never sent.
  const SCREEN_REATTACH_AFTER = 4000;
  const SCREEN_REBUILD_AFTER = 6000;
  const SCREEN_RESHARE_AFTER = 10000;
  const SCREEN_GIVE_UP_AFTER = 10000;
  const SCREEN_REBUILD_EVERY = 60000;
  const SCREEN_RESHARE_EVERY = 300000;
  const SCREEN_ESCALATE_SENT = 3;
  // The screen's timeline, for "Copy call diagnostics": its last lines.
  const SCREEN_LOG_LINES = 200;
  // §15.23 (2026-09-30), "Reconnecting…" only for a problem that lasts:
  // the stream down RECONNECT_STREAM_AFTER (the whole call); a connection
  // disconnected or failed RECONNECT_CONNECTION_AFTER, or no audio packets
  // from someone unmuted RECONNECT_AUDIO_AFTER (that person's tile, or the
  // whole call when it is everyone). Said for RECONNECT_HOLD past the
  // recovery, so it does not flicker. A stream renewal — ended on purpose
  // and resumed in half a second — is never said at all.
  const RECONNECT_STREAM_AFTER = 4000;
  const RECONNECT_CONNECTION_AFTER = 3000;
  const RECONNECT_AUDIO_AFTER = 2000;
  const RECONNECT_HOLD = 1000;
  const RECONNECT_EVERY = 200;
  // §15.24 (2026-10-01), "<name> is connecting and can't hear you yet":
  // said on a person's tile from the moment they appear until their own
  // report says they hear us — but only once CONNECTING_GRACE has passed
  // without that, so an ordinary join says nothing, and never past
  // CONNECTING_CAP, after which §15.20's and §15.23's words take over.
  const CONNECTING_GRACE = 1000;
  const CONNECTING_CAP = 20000;
  // §15.26 (2026-10-03), the automatic quality report: one every
  // QUALITY_EVERY while admitted, and one more at leave. The gate
  // shortens the cadence through window.meet.qualityEveryForTest, never
  // below QUALITY_EVERY_MIN. QUALITY_KEY is the person's own switch
  // ("Send anonymous quality reports"), stored as "off" when off.
  // The bounds are protocol/quality.go's, so a report is clamped here to
  // what the server would accept rather than refused there.
  const QUALITY_EVERY = 30000;
  const QUALITY_EVERY_MIN = 1000;
  const QUALITY_KEY = 'calls.qualityReports';
  const QUALITY_MAX_PEERS = 4;
  const QUALITY_MAX_SECONDS = 600;
  const QUALITY_MAX_MILLIS = 600000;
  const QUALITY_MAX_COUNT = 1e9;
  const QUALITY_MAX_KBPS = 1e6;
  const QUALITY_MAX_PIXELS = 16384;
  const QUALITY_MAX_FPS = 240;
  const QUALITY_MAX_BODY = 16384;
  // The longest stretch between two looks of the event watch that is
  // counted as time a notice was showing: a suspended tab's timers stop,
  // and the gap when they start again is not a notice someone saw.
  const QUALITY_LOOK_MAX = 1000;
  // §5.4, sending: "Optimise shared screen for". What a screen gives up
  // first when the uplink or the encoder cannot carry all of it. The
  // first is the default; sharePlan says what each one means.
  const SHARE_MODES = [
    ['balanced', 'Balanced'],
    ['detail', 'Text and detail'],
    ['motion', 'Motion and video'],
  ];
  const HAS_DISPLAY_MEDIA = typeof navigator !== 'undefined' &&
    !!navigator.mediaDevices &&
    typeof navigator.mediaDevices.getDisplayMedia === 'function';
  const HAS_SINK_ID = typeof HTMLMediaElement !== 'undefined' &&
    typeof HTMLMediaElement.prototype.setSinkId === 'function';

  // ---------------------------------------------------------------
  // State (§4.2, §4.6)
  // ---------------------------------------------------------------

  const state = {
    peer: null,            // this stream's server-issued peer id
    boot: root.dataset.boot || '',
    admitted: false,       // a roster has arrived, so we are in the mesh
    joined: false,         // `join` has been accepted at least once
    full: false,           // the last `full` event, cleared by a roster
    stopped: false,        // terminal, or waiting on a takeover: no reconnect
    terminal: null,        // the reason this call ended, once it has
    leaveSent: false,      // §4.3: `leave` is not idempotent
    kind: memberHint ? 'member' : 'guest',
  };

  const pcs = new Map();     // peer id -> connection record
  const gen = new Map();     // peer id -> pair generation (§4.6)
  const seqOut = new Map();  // peer id -> last seq we sent (never reset)
  const lastIn = new Map();  // peer id -> highest seq received (resume cursor)
  const queue = new Map();   // peer id -> [{seq, body}] outbound, in order
  const inflight = new Set();// peer ids with a POST in flight
  // Targets the hub has answered 404 for while our own participation is
  // alive: they have left, and our roster has not caught up yet. Nothing
  // is sent to them and no reset is asked for until a roster settles it —
  // otherwise every message to a departed peer starts its own 404 →
  // probe → reset → 404 cycle, each with a fresh budget (Codex S2-11).
  const stale = new Set();
  const resetting = new Set(); // targets with a reset already in flight
  const names = new Map();   // peer id -> display name, from the server only
  const frames = new Map();  // peer id -> frames rendered, for the test hook
  const tiles = new Map();   // tile key -> {figure, video}
  // §15.19: peer id -> {muted, cameraOff}, for the peers that have
  // reported. A peer absent here is unknown and is drawn as neither.
  const remoteMedia = new Map();
  // The state this tab last put on the broadcast lane, as mediaKey
  // writes it, so a toggle that changes nothing sends nothing.
  let mediaSent = '';
  // §15.20: whether the report may carry the two optional keys. A server
  // from before them answers 400 to anything but the two booleans, and
  // the first such answer turns them off for the life of the page.
  let mediaExtras = true;
  // §15.21: share key -> {decoded, movedAt}, the receiver's watch; the
  // peers last reported stalled; peer -> {at, tries, restUntil}, the
  // sharer's keyframe answers; and the sharer's quiet notice.
  const screenSeen = new Map();
  let screenStalled = [];
  const screenAsks = new Map();
  let shareRecovery = '';
  let screenStallTestUntil = 0;
  // §15.22: each arriving screen's statistics at the last poll and when
  // it last moved (share key -> screenReading); pictures handed back;
  // when each peer's screen was last rebuilt, and everyone's last shared
  // again; and the timeline itself.
  const screenReadings = new Map();
  const screenMoving = new Map();
  let screenReattaches = 0;
  const shareRebuiltAt = new Map();
  let shareResharedAt = 0;
  const shareCounts = { keyframes: 0, rebuilds: 0, reshares: 0, failures: 0 };
  const screenLines = [];
  // §15.26: the same ladder and mending, per peer, taken by each quality
  // report (peer id -> counts). shareCounts above is the whole call's,
  // for the diagnostics.
  const shareCountsBy = new Map();
  const reattachesBy = new Map();
  // §15.23: when the stream went down (0 while it is up), and the watch.
  let streamDownSince = 0;
  const reconnect = reconnectRecord();
  // §15.24: who can hear us yet (connectingStep's record), and the
  // `hearing` list as last reported, joined, so a change is seen.
  const connecting = connectingRecord();
  let hearingKey = '';
  // §15.20: peer id -> what this tab is hearing from that peer, as
  // pollLevels reads it (hearingRecord). selfHearing is the same record
  // for our own microphone, read off the sender.
  const hearing = new Map();
  const selfHearing = hearingRecord();
  // Who has the floor, for Speaker view's stage (speakerStep).
  const stageSpeaker = speakerRecord();
  // Tile keys whose element the browser refused to play. Non-empty is
  // `audioBlocked`: the page banner shows, and the report says so.
  const refusedTiles = new Set();
  let audioBlocked = false;
  // The autoplay policy as the browser states it in advance, where it
  // will (Firefox). A hint that puts the banner up early; the refusal
  // is still the authority, and a play that succeeds takes it down.
  let autoplayDoubted = autoplayPolicyDoubtful();
  let soundBanner = null;    // {box, text, button} once built
  let levelTimer = 0;
  let levelsBusy = false;
  // The noSoundFrom list as last computed, joined, so a change is seen.
  let noSoundKey = '';

  // §5.2's list and §5.3's clocks. `expiresAt`, `renewAt`, `fetchedAt`
  // and `lastFetchAt` are all milliseconds since the epoch: the server
  // sends unix seconds and fetchIce is the one place they are converted,
  // so everything below — and everything the test hook exposes —
  // compares them with Date.now() and with nothing else.
  const ice = {
    servers: [],       // the RTCIceServer list, [] on the floor (§5.5)
    expiresAt: 0,      // the credential's hard deadline on the relay
    renewAt: 0,        // when the server asks us to come back
    margin: 0,         // expiresAt - renewAt: a duration both clocks agree on
    fetchedAt: 0,      // when the list we hold arrived
    failedSince: 0,    // the first failure of the current run, or 0
    lastTryAt: 0,      // the most recent failed attempt, for the catch-up
    fetches: 0,        // *successful* fetches, for the gate
    lastFetchAt: 0,
  };
  // peer id -> §5.3's record for one connection's renewal.
  const renewals = new Map();

  let waiting = [];          // the admission queue, members only (§4.3)
  let lastRoster = null;
  // The newest roster this browser has been sent and has not applied
  // yet. Only §5.2's fetch can leave anything in it for longer than a
  // microtask.
  let pendingRoster = null;
  let pendingRosterAt = 0;   // the tick that roster arrived on
  let tick = 0;
  let local = null;          // the local MediaStream, or null
  // §5.4: the display capture while this tab is sharing, and nothing
  // when it is not. One capture, whatever the mesh's size — every
  // connection carries the same track on a transceiver of its own.
  let share = null;          // {stream, track} while sharing
  // True from the moment getDisplayMedia is asked until it answers. The
  // picker takes as long as a person takes, and without this a second
  // click during it takes a second capture that nothing ever stops.
  let sharePending = false;
  // §6: the mounted panel, once there is one. `chatSent` counts lines
  // the hub accepted, not lines typed, and `chatReceived` counts lines
  // put in the log — the two facts a gate cannot read off the DOM
  // without knowing the panel's own markup.
  let chat = null;
  let chatSent = 0;
  let chatReceived = 0;
  let prefs = loadPrefs();
  let es = null;             // the live EventSource
  let backoff = BACKOFF_MIN;
  let stalls = 0;            // consecutive stream rounds that produced no hello
  // When this browser last reached the room. It starts at load rather
  // than at zero: a page that has never once got a `hello` has been
  // trying since it opened, and that is the stretch STALL_WINDOW means.
  let lastHelloAt = Date.now();
  let reconnectTimer = 0;
  let reconnectWatchTimer = 0;
  let statsTimer = 0;
  let backdropTimer = 0;
  let fullTimer = 0;
  let renewTimer = 0;        // §5.3: the scheduled renewal, at `renewAt`
  let iceRetryTimer = 0;     // §5.3 step 1: the one-minute retry
  let expiryTimer = 0;       // §5.3 step 3: the must-succeed-by verdict
  let icePrimed = false;     // a first fetch has been made (success or not)
  let firstIce = null;       // that fetch, shared by concurrent callers
  let renewing = false;      // a renewal fetch is in flight
  let renewDue = false;      // the current run is a renewal, not a first fetch
  let iceWarningEl = null;
  // §15.26: the report token the latest `hello` carried — the authority
  // for both report endpoints, kept after leaving because it goes on
  // working for ten minutes after — and the quality report's own state:
  // when the current window began (0 until admitted), each connection's
  // reading at the last report (peer id -> {pc, reading}), the event
  // watch, the output device's kind as last enumerated, and what has
  // been sent. A 204 is the server's kill switch, and stops the reports
  // for the rest of this page.
  let reportToken = '';
  let qualityEvery = QUALITY_EVERY;
  let qualityFrom = 0;
  const qualityPrev = new Map();
  const qualityEvents = qualityWatchRecord();
  let qualityOutput = 'unknown';
  let qualityServerOff = false;
  let qualityLocalOff = false;   // the switch, where there is no storage to keep it in
  let qualityFinalSent = false;
  const quality = { sent: 0, accepted: 0, status: 0 };
  // How many rosters this tab has applied. Nothing in the page reads
  // it: it is the one fact a gate cannot infer from the DOM or from
  // `peers`, because a connection can be closed locally without any
  // roster having arrived, and "recovered" has to mean the server said
  // so (Codex S2-16).
  let rosters = 0;

  // ---------------------------------------------------------------
  // Preferences, stored by the holding screen (devices.js)
  // ---------------------------------------------------------------

  function loadPrefs() {
    try {
      return JSON.parse(localStorage.getItem(DEVICE_KEY) || '{}') || {};
    } catch {
      return {};
    }
  }

  function savePrefs() {
    try {
      localStorage.setItem(DEVICE_KEY, JSON.stringify(prefs));
    } catch {
      // Private browsing or a full quota: the toggle still works for
      // this call, it just will not be remembered for the next one.
    }
  }

  // ---------------------------------------------------------------
  // Local media (§3.3's stored choices, §5.1's tracks)
  // ---------------------------------------------------------------

  // audioConstraints builds the microphone half of a getUserMedia
  // request out of the stored preferences. It is a pure function of
  // `prefs` so the gate can lift it out of both files and check the two
  // copies still agree (test/browser/audio.test.mjs). room.js carries
  // it verbatim, because the room asks for a stream of its own at join
  // — the holding screen's is stopped by then — and a choice that held
  // on one page and not the other would be worse than no choice.
  //
  // The three flags are the browser's voice pipeline: echo
  // cancellation, noise suppression and automatic gain. Every browser
  // turns all three on for a microphone unless told otherwise, which is
  // right for a laptop on a kitchen table and wrong for an interface in
  // a room someone has treated — gain riding a held note, noise
  // suppression taking a cello for a fan. `rawAudio` is the person
  // saying which of those two rooms they are in.
  //
  // They are asked for as ideals and never as `exact`. A browser that
  // cannot turn its processing off should hand over a processed
  // microphone, not refuse getUserMedia and cost the person their
  // voice — the same rule the device ladder is built on. It is also why
  // the holding screen checks afterwards what it was actually given
  // (rawHonoured) instead of trusting that it got what it asked for.
  //
  // voiceIsolation is the newer, heavier filter in Safari and Chrome —
  // on a Mac it is Apple's own system Voice Isolation, reached through
  // the browser. It is only ever asked for *off*, and never on. Asked
  // on, it runs on top of the noise suppression above rather than
  // instead of it, and two suppressors chewing one voice is not twice
  // as clean: it is a growl with the keystrokes still coming through,
  // which is what a call on 2026-09-17 came back as. The pipeline above
  // is every browser's own default and is the one this app asks for.
  //
  // Off it still belongs here, because someone may have turned Voice
  // Isolation on for the whole machine and studio audio has to be able
  // to say no to it. An unknown constraint name in this basic,
  // non-exact form is dropped rather than refused, so naming it costs
  // nothing in a browser that has never heard of it.
  function audioConstraints(prefs) {
    const processed = !prefs.rawAudio;
    const constraints = {
      echoCancellation: processed,
      noiseSuppression: processed,
      autoGainControl: processed,
    };
    if (!processed) constraints.voiceIsolation = false;
    if (prefs.mic) constraints.deviceId = { exact: prefs.mic };
    return constraints;
  }

  // tuneAudioSender raises the audio ceiling on one connection, and is
  // the other half of what studio audio promises: turning the filters
  // off buys nothing if the result then goes out through Opus at its
  // default of roughly 32 kbit/s mono, which is a codec a good
  // microphone is heard *through* rather than heard.
  //
  // It is a sender-side change, so it needs no SDP of our own and no
  // renegotiation, and §5.1's perfect negotiation above never learns it
  // happened. Stereo is deliberately not attempted: it lives in the
  // fmtp line, and reaching it would mean building offers by hand
  // instead of the argumentless setLocalDescription §5.1 is written on
  // — a large risk to the one part of this file that must not wobble,
  // bought for a microphone that is almost always mono anyway.
  //
  // Every step is optional in some browser that is otherwise fine, so
  // the whole thing is best effort: a browser that will not take the
  // parameters carries the call at its own bitrate rather than losing
  // the connection over it. The encodings array is read right after
  // addTrack, which is where Chromium has already built it; a browser
  // that fills it in later simply keeps its default here, and that is a
  // quieter microphone and not a broken one.
  function tuneAudioSender(pc) {
    let sender;
    try {
      sender = pc.getSenders().find((s) => s.track && s.track.kind === 'audio');
    } catch {
      return;
    }
    if (!sender || typeof sender.getParameters !== 'function') return;
    let params;
    try {
      params = sender.getParameters();
    } catch {
      return;
    }
    // A sender the browser has not built encodings for yet is not one to
    // invent an encodings array for: that is a different request, and
    // not the one this function is making.
    if (!params.encodings || !params.encodings.length) return;
    // Both directions. Studio audio turned off mid-call has to give the
    // ceiling back, and `undefined` — not zero, which is a request to
    // send nothing — is how the API spells "the encoder's own default".
    if (prefs.rawAudio) params.encodings[0].maxBitrate = RAW_AUDIO_BITRATE;
    else delete params.encodings[0].maxBitrate;
    Promise.resolve().then(() => sender.setParameters(params)).catch(() => {
      // Chromium refuses parameters that did not come from the most
      // recent getParameters, which a renegotiation in flight can cause.
      // The call is unharmed, and the next connection gets its own try.
    });
  }

  // sharePlan is what a shared screen is sent as, for one "Optimise
  // for" mode and the capture's size. Pure, and lifted by name in the
  // node test; the native app's ScreenSendPolicy is its twin, and the two
  // are meant to agree number for number.
  //
  // Why it exists (2026-09-24, "the screenshare isn't keeping up"): a
  // screen capture left to the browser's defaults keeps every pixel and
  // drops frames, at the encoder's default ceiling of about 2.5 Mbit/s
  // for 1080p. On anything but a fast uplink that is a few frames a
  // second of someone scrolling.
  //
  //   detail    full resolution, frames give way — slides, code, text
  //   balanced  frame rate held, full size while the link carries it
  //             and smaller rather than a slideshow when it cannot
  //   motion    frame rate held, at most 1280 on the long side
  //
  // Measured in the native gate (ScreenSendPolicy has the numbers): on a
  // 1.5 Mbit/s uplink a scrolling 1080p page arrived at 2 fps as before,
  // 13 in detail, 19 in balanced and 30 in motion.
  //
  // contentHint is the browser's own name for the same choice, and
  // degradationPreference the sender's; both are set because browsers
  // honour one or the other.
  function sharePlan(mode, width, height) {
    const longest = Math.max(width || 0, height || 0);
    const fit = (side) => (longest > side ? longest / side : 1);
    const high = { priority: 'high', networkPriority: 'high', maxFramerate: 30 };
    if (mode === 'detail') {
      return {
        contentHint: 'detail', degradationPreference: 'maintain-resolution',
        encoding: Object.assign({ maxBitrate: 3500000, scaleResolutionDownBy: fit(1920) }, high),
      };
    }
    if (mode === 'motion') {
      return {
        contentHint: 'motion', degradationPreference: 'maintain-framerate',
        encoding: Object.assign({ maxBitrate: 2500000, scaleResolutionDownBy: fit(1280) }, high),
      };
    }
    return {
      contentHint: 'detail', degradationPreference: 'maintain-framerate',
      encoding: Object.assign({ maxBitrate: 3000000, scaleResolutionDownBy: fit(1920) }, high),
    };
  }

  // cameraCap is the camera's encoding while this tab shares a screen,
  // and its defaults again when it stops: the screen is what everyone is
  // looking at, and it should have the uplink. `undefined` rather than a
  // number is how the API spells "the encoder's own choice". Pure, and
  // lifted by name in the node test.
  function cameraCap(sharing, height) {
    if (!sharing) return { maxBitrate: undefined, scaleResolutionDownBy: 1 };
    return { maxBitrate: 500000, scaleResolutionDownBy: height > 360 ? height / 360 : 1 };
  }

  function shareMode() {
    return SHARE_MODES.some(([m]) => m === prefs.shareMode) ? prefs.shareMode : SHARE_MODES[0][0];
  }

  // tuneSender sets one sender's first encoding (and, where given, its
  // degradation preference). Best effort for the same reasons as
  // tuneAudioSender: a sender parameter needs no SDP and no
  // renegotiation, so §5.1 never learns it happened, and a browser that
  // refuses carries the call at its own defaults.
  function tuneSender(sender, encoding, degradationPreference) {
    if (!sender || typeof sender.getParameters !== 'function') return;
    let params;
    try {
      params = sender.getParameters();
    } catch {
      return;
    }
    if (!params.encodings || !params.encodings.length) return;
    for (const [key, value] of Object.entries(encoding)) {
      if (value === undefined) delete params.encodings[0][key];
      else params.encodings[0][key] = value;
    }
    if (degradationPreference) params.degradationPreference = degradationPreference;
    Promise.resolve().then(() => sender.setParameters(params)).catch(() => {
      // Refused, or raced a renegotiation: the next call to this for the
      // same sender (a mode change, the next connection) tries again.
    });
  }

  // tuneShare puts one connection's screen and camera where the mode
  // wants them: the screen at its plan, the camera capped beside it —
  // or, with nothing shared, the camera back at its defaults.
  function tuneShare(entry) {
    if (!entry) return;
    const sharing = !!(share && entry.shareTx);
    if (sharing) {
      const s = share.track.getSettings ? share.track.getSettings() : {};
      const plan = sharePlan(shareMode(), s.width, s.height);
      tuneSender(entry.shareTx.sender, plan.encoding, plan.degradationPreference);
    }
    const camera = senderFor(entry, 'video');
    const track = camera && camera.sender && camera.sender.track;
    if (!track) return;
    const settings = track.getSettings ? track.getSettings() : {};
    tuneSender(camera.sender, cameraCap(sharing, settings.height || 0));
  }

  // startLocal walks down a ladder: the remembered devices, then the
  // browser's defaults, then audio alone. A camera that is missing or
  // in use should not cost the call its microphone as well, and a
  // person who reaches the bottom rung joins with nothing, which the
  // room is built to allow.
  async function startLocal() {
    if (!navigator.mediaDevices || !navigator.mediaDevices.getUserMedia) {
      applyToggles();
      return;
    }
    const exact = (id) => ({ deviceId: { exact: id } });
    const remembered = !!(prefs.mic || prefs.camera);
    // The processing choice rides every rung. Falling back to the
    // browser's default *device* is not a reason to put the voice
    // pipeline back on someone who asked for it off, so only the
    // remembered device id is dropped on the way down — by
    // forgetDevices, which touches mic and camera and never rawAudio.
    const raw = { rawAudio: prefs.rawAudio };
    const attempts = [
      { audio: audioConstraints(prefs), video: prefs.camera ? exact(prefs.camera) : true },
      { audio: audioConstraints(raw), video: true },
      { audio: audioConstraints(raw), video: false },
    ];
    for (let i = 0; i < attempts.length; i++) {
      try {
        local = await navigator.mediaDevices.getUserMedia(attempts[i]);
        if (i > 0 && remembered) forgetDevices();
        break;
      } catch {
        // Try the next rung. Nothing is said on the way down: the only
        // thing worth telling a person is where they ended up.
      }
    }
    applyToggles();
  }

  // forgetDevices drops remembered ids the browser would not honour, so
  // the next visit does not repeat the same failed attempt. devices.js
  // does the same on the holding screen; this is the room's copy for
  // the case where the device went between the two pages.
  function forgetDevices() {
    delete prefs.mic;
    delete prefs.camera;
    savePrefs();
  }

  function applyToggles() {
    if (local) {
      for (const track of local.getAudioTracks()) track.enabled = !prefs.muted;
      for (const track of local.getVideoTracks()) track.enabled = !prefs.cameraOff;
    }
    // The accessible name is fixed, in aria-label on the server's own
    // markup; a toggle whose name changes under the reader is announced
    // as a different control every time it is used. The state moves
    // three ways and never by colour: aria-pressed, the word in the
    // button, and calls.css's inset outline.
    muteButton.setAttribute('aria-pressed', String(!!prefs.muted));
    cameraButton.setAttribute('aria-pressed', String(!!prefs.cameraOff));
    if (muteState) muteState.textContent = prefs.muted ? 'Muted' : 'On';
    if (cameraState) cameraState.textContent = prefs.cameraOff ? 'Off' : 'On';
    // With no stream there is no track to enable, so the two toggles
    // are controls that would do nothing. Leave is still live.
    const hasAudio = !!(local && local.getAudioTracks().length);
    const hasVideo = !!(local && local.getVideoTracks().length);
    if (!state.stopped) {
      muteButton.disabled = !hasAudio;
      cameraButton.disabled = !hasVideo;
    }
    // §15.19: every path that can change what we send ends here — the
    // two toggles, a device switch, a stream that lost a track — so the
    // report is made here too, and the tile marks follow.
    reportMedia();
    if (tiles.has('self')) markTile('self', localMedia());
  }

  function stopLocal() {
    if (!local) return;
    for (const track of local.getTracks()) track.stop();
    local = null;
  }

  // ---------------------------------------------------------------
  // Changing a device mid-call (§3.3's stored choice, made movable)
  // ---------------------------------------------------------------
  //
  // The holding screen picks the devices; until now that was the only
  // place they could be picked, and a microphone chosen wrongly — or
  // unplugged, or wanted for a headset halfway through — cost the
  // person the call to change. Everything below is that choice, applied
  // to a call already running.
  //
  // The whole thing rests on replaceTrack, which swaps the media a
  // sender is sending without touching the m-line it sends on. That is
  // the part §5.1 never has to hear about: no offer, no answer, no
  // rollback, and no chance of the glare the negotiation above spends
  // 300 ms avoiding. The one case that does renegotiate is named at
  // sendTrack, and it is a direction change on an m-line that already
  // exists rather than a new one.

  // Two clicks on a picker are two switches, and they must not run at
  // once. devices.js can settle that with a generation counter alone
  // because the only thing it is racing for is one <video>; here the
  // loser would be racing for what every sender in the mesh is holding,
  // and interleaved replaceTracks leave that decided by whichever
  // getUserMedia happened to settle last.
  //
  // So they are serialised, and the counter only decides which queued
  // run is still wanted: three clicks queue three runs, the first two
  // find themselves superseded before their turn and return without
  // opening anything, and the third does the work. One switch is in
  // flight at a time and the last click wins, which is what clicking
  // means.
  // One counter per kind, not one between them: a camera and a
  // microphone are two independent choices, and a shared counter made
  // changing the camera silently cancel a microphone change whose
  // getUserMedia had not settled — the select snapping back with
  // nothing said about why.
  const switching = { audio: 0, video: 0 };
  let switchQueue = Promise.resolve();

  // senderFor finds the transceiver carrying one kind for this call —
  // the camera or the microphone, never the screen. entry.shareTx is
  // video too, and replacing *its* track with a camera would put the
  // camera on the m-line the far side has already labelled a screen
  // (§5.4), which is the one mistake here that would look like a bug in
  // someone else's browser.
  function senderFor(entry, kind) {
    let transceivers;
    try {
      transceivers = entry.pc.getTransceivers();
    } catch {
      return null;
    }
    for (const tx of transceivers) {
      if (tx === entry.shareTx || tx.stopped) continue;
      // receiver.track is present on every transceiver and carries the
      // kind even when nothing is being sent yet, which is exactly the
      // recvonly case this has to find.
      const known = (tx.sender && tx.sender.track) || (tx.receiver && tx.receiver.track);
      if (known && known.kind === kind) return tx;
    }
    return null;
  }

  // sendTrack puts one track on one connection.
  //
  // The replaceTrack is the whole job when this browser was already
  // sending that kind. When it was not — it came down startLocal's
  // ladder with no camera, or joined with nothing at all — createPC
  // left a `recvonly` transceiver for the kind, and that m-line is
  // already in the right place in the order. Turning it round is a
  // direction change on an existing m-line, so no m-line is added and
  // none moves: the hazard addShareTo carries (an unassociated
  // transceiver claiming the m-line a remote offer meant for something
  // else) is not in this path at all. It still waits for `stable`,
  // because a direction changed mid-negotiation is a change the offer
  // in flight does not carry, and the deferred ones are picked up by
  // the connection's own signalingstatechange.
  async function sendTrack(entry, kind, track) {
    const tx = senderFor(entry, kind);
    if (!tx || !tx.sender || typeof tx.sender.replaceTrack !== 'function') return;
    try {
      await tx.sender.replaceTrack(track);
    } catch {
      // A connection closing under us, or a browser refusing the track.
      // Every other peer still gets it, and this one is the reset path's
      // problem rather than this function's.
      return;
    }
    // classifyTrack reads entry.sentVideo to tell an arriving camera
    // from an arriving screen, and a browser that starts sending video
    // for the first time here has just changed that answer.
    if (kind === 'video') entry.sentVideo = true;
    if (tx.direction === 'sendrecv' || tx.direction === 'sendonly') return;
    if (entry.pc.signalingState !== 'stable') {
      entry.upgrades.add(kind);
      return;
    }
    try {
      tx.direction = 'sendrecv';
    } catch {
      // Older browsers make direction read-only. The track is on the
      // sender either way; it simply is not sent until the next full
      // renegotiation builds the m-line sending.
    }
  }

  // upgradeWhenQuiet runs the direction changes sendTrack could not make
  // because the connection was mid-negotiation. Called from the same
  // signalingstatechange that adds a deferred share transceiver.
  function upgradeWhenQuiet(entry) {
    if (!entry.upgrades.size || entry.pc.signalingState !== 'stable') return;
    for (const kind of Array.from(entry.upgrades)) {
      entry.upgrades.delete(kind);
      const tx = senderFor(entry, kind);
      if (!tx || !tx.sender || !tx.sender.track) continue;
      if (tx.direction === 'sendrecv' || tx.direction === 'sendonly') continue;
      try {
        tx.direction = 'sendrecv';
      } catch {
        // As above: nothing to do about it, and nothing broken by it.
      }
    }
  }

  // switchDevice is the gesture: one kind, one device id, applied to
  // every connection and then to the local stream.
  //
  // Order matters twice here. The new track is disabled before it is
  // anywhere near a sender, because a track that goes live for even one
  // frame while the person is muted has broken the only promise the
  // mute button makes. And the old track is stopped only once the new
  // one is on every sender: stopping it first would take the camera
  // light off a beat early and send black frames in the gap.
  function switchDevice(kind, deviceId) {
    const myGen = ++switching[kind];
    const run = switchQueue.then(() => applySwitch(kind, deviceId, myGen));
    // The queue must not break on a failure, or one rejected switch
    // would swallow every switch after it. The caller still sees the
    // rejection through `run`.
    switchQueue = run.catch(() => {});
    return run;
  }

  // Returns true when the call is actually on the new device, so a
  // caller that changed a preference to ask for the switch can put it
  // back when the switch did not happen.
  async function applySwitch(kind, deviceId, myGen) {
    // Superseded before this run's turn came round, or the call ended
    // while it waited. Nothing has been opened yet, so there is nothing
    // to put back.
    if (myGen !== switching[kind] || state.stopped) return false;
    const wanted = kind === 'audio'
      ? { audio: audioConstraints(Object.assign({}, prefs, { mic: deviceId })) }
      : { video: deviceId ? { deviceId: { exact: deviceId } } : true };
    let fresh;
    try {
      fresh = await navigator.mediaDevices.getUserMedia(wanted);
    } catch (err) {
      if (myGen !== switching[kind]) return false;
      note(deviceError(kind, err));
      // The choice is not saved: the pickers are put back to the device
      // actually in use, so the select never claims a device the call is
      // not on.
      fillDevices().catch(() => {});
      return false;
    }
    const track = fresh.getTracks()[0];
    if (myGen !== switching[kind] || !track || state.stopped) {
      for (const t of fresh.getTracks()) t.stop();
      return false;
    }
    track.enabled = kind === 'audio' ? !prefs.muted : !prefs.cameraOff;
    for (const entry of pcs.values()) {
      // Sequential and not Promise.all: replaceTrack is cheap, the mesh
      // is four, and a failure on one connection should not abandon the
      // rest through a rejected race.
      await sendTrack(entry, kind, track);
    }
    // No *generation* check here, and that is deliberate. From the loop
    // above onwards this run owns what every sender is holding, so
    // stopping the track to defer to a newer choice would stop the
    // media the call is sending — until that newer choice arrives, which
    // it may never do if its own getUserMedia fails, leaving every peer
    // watching a track that ended. The queued run replaces the senders
    // and `local` together when its turn comes; until then this is the
    // truth and is recorded as such.
    //
    // The call *ending* is the other thing entirely, and does need
    // checking: terminal() leaves the page alive, so without this the
    // line below would build a fresh MediaStream around a camera that
    // was opened for a call that is already over, and nothing would
    // ever stop it. A light left on after the meeting ended is the one
    // way this file can be rude.
    if (state.stopped) {
      track.stop();
      return false;
    }
    if (!local) local = new MediaStream();
    for (const old of kind === 'audio' ? local.getAudioTracks() : local.getVideoTracks()) {
      local.removeTrack(old);
      old.stop();
    }
    local.addTrack(track);
    // A track that ends on its own — the device unplugged mid-call —
    // should leave the pickers telling the truth about what is left.
    track.addEventListener('ended', () => {
      fillDevices().catch(() => {});
    });
    // An id that names nothing is the browser's default, and the
    // absence of a remembered device is how the rest of this file and
    // devices.js both spell that.
    const key = kind === 'audio' ? 'mic' : 'camera';
    if (deviceId) prefs[key] = deviceId;
    else delete prefs[key];
    savePrefs();
    note('');
    applyToggles();
    renderTiles();
    // The audio ceiling follows the choice and not the connection: a
    // studio switch flipped mid-call has to reach the connections that
    // already exist, and flipped back has to let them go again.
    // tuneAudioSender reads the preference itself, so this is the same
    // call in both directions.
    if (kind === 'audio') {
      for (const entry of pcs.values()) tuneAudioSender(entry.pc);
    }
    await fillDevices().catch(() => {});
    return true;
  }

  // deviceError is the sentence for a device that would not open. The
  // names are getUserMedia's own; the wording says what the person can
  // do about it, and never that the call is over, because it is not —
  // the old device is still on every sender.
  function deviceError(kind, err) {
    const thing = kind === 'audio' ? 'microphone' : 'camera';
    if (err && err.name === 'NotAllowedError') {
      return 'Calls needs permission to use that ' + thing + '. The call is still on the previous one.';
    }
    if (err && err.name === 'NotReadableError') {
      return 'That ' + thing + ' is in use by another app. The call is still on the previous one.';
    }
    return 'That ' + thing + ' could not be opened. The call is still on the previous one.';
  }

  // note writes the device panel's own live region. It is not `say`:
  // renderStatus owns #status and rewrites it on every render, so a
  // sentence put there would be gone by the next roster.
  function note(text) {
    if (!deviceNote) return;
    deviceNote.textContent = text;
    deviceNote.hidden = !text;
  }

  // fillDevices is devices.js's fillPickers, for the room. The two are
  // deliberate mirrors — same ids, same rules, same reason for each —
  // and test/browser/devices.test.mjs holds them to it. Labels only
  // exist once permission has been granted, which in the room it always
  // has by the time this runs.
  async function fillDevices() {
    if (!pickCamera || !navigator.mediaDevices || !navigator.mediaDevices.enumerateDevices) return;
    let devices;
    try {
      devices = await navigator.mediaDevices.enumerateDevices();
    } catch {
      devices = [];
    }
    const fillOne = (select, kind, chosen) => {
      select.replaceChildren();
      let count = 0;
      for (const device of devices) {
        if (device.kind !== kind) continue;
        count++;
        const option = document.createElement('option');
        option.value = device.deviceId;
        option.textContent = device.label || labelFor(kind, count);
        if (device.deviceId === chosen) option.selected = true;
        select.append(option);
      }
      return count;
    };
    const cameraCount = fillOne(pickCamera, 'videoinput', liveDeviceId('video') || prefs.camera);
    const micCount = fillOne(pickMic, 'audioinput', liveDeviceId('audio') || prefs.mic);
    const speakerCount = HAS_SINK_ID ? fillOne(pickSpeaker, 'audiooutput', prefs.speaker) : 0;
    // A field with nothing to choose from is clutter, not help. Unlike
    // the holding screen, the camera and microphone rows can be empty
    // here too — a call joined with neither is a call this file is
    // built to allow.
    if (cameraRow) cameraRow.hidden = cameraCount === 0;
    if (micRow) micRow.hidden = micCount === 0;
    if (speakerRow) speakerRow.hidden = !HAS_SINK_ID || speakerCount === 0;
    if (rawRow) rawRow.hidden = micCount === 0;
  }

  function labelFor(kind, count) {
    return (kind === 'videoinput' ? 'Camera ' : 'Microphone ') + count;
  }

  // liveDeviceId is what the call is *actually* on, which is the honest
  // thing for a select to be showing: prefs can name a device that
  // startLocal's ladder never managed to open.
  function liveDeviceId(kind) {
    const track = local && local.getTracks().find((t) => t.kind === kind && t.readyState === 'live');
    if (!track || typeof track.getSettings !== 'function') return '';
    return track.getSettings().deviceId || '';
  }

  // applySinkAll re-routes every remote tile after a speaker change.
  // applySink does one element and is what a new tile gets; this is the
  // same thing for the tiles that already exist.
  function applySinkAll() {
    for (const [key, t] of tiles) {
      if (t.self || key === 'self') continue;
      applySink(t.video);
    }
  }

  // ---------------------------------------------------------------
  // The stream (§4.1, §4.5)
  // ---------------------------------------------------------------

  const DOWNSTREAM = ['hello', 'roster', 'peer', 'gone', 'knock', 'knock-gone',
    'full', 'lost', 'pair', 'gap', 'state', 'offer', 'answer', 'candidate',
    // §4.3's fan-out pair. They carry no `to`, no `seq` and no `gen`, so
    // nothing about them goes through §4.6's inbound rules: the hub
    // rebuilt the envelope and there is nothing to dedupe against.
    'chat', 'share',
    // §15.19: one peer's media state changed. State, not an event —
    // the roster carries it too — so a missed one costs nothing.
    'media'];

  function streamPath(peer) {
    let path = '/m/' + encodeURIComponent(sqid) + '/stream';
    if (!peer) return path;
    const last = {};
    for (const [id, seq] of lastIn) last[id] = seq;
    return path + '?peer=' + encodeURIComponent(peer) +
      '&last=' + encodeURIComponent(JSON.stringify(last));
  }

  function closeStream() {
    if (!es) return;
    // Always close by hand. EventSource reconnects on its own, and its
    // own retry of a fresh (peerless) URL would ask for a second
    // participation and be refused 409 — reconnection is this file's
    // job, not the browser's.
    es.onerror = null;
    es.close();
    es = null;
  }

  // connectStream opens a fresh stream: no `peer`, so the hub issues a
  // new participation and this browser posts `join` on its `hello`.
  function connectStream() {
    if (state.stopped) return;
    closeStream();
    state.peer = null;
    state.joined = false;
    state.admitted = false;
    // `full` belongs to the participation that heard it, not to the tab.
    state.full = false;
    clearTimeout(fullTimer);
    renderStatus();
    attach(streamPath(null), diagnoseFresh);
  }

  // resume reattaches to the participation we already hold. EventSource
  // hides the status of a refused stream, so the refusal is read first
  // with a plain fetch against ?probe=1 — which attaches nothing and,
  // per the wire contract, must NOT carry Accept: text/event-stream.
  async function resume() {
    if (state.stopped) return;
    closeStream();
    const peer = state.peer;
    if (!peer) {
      connectStream();
      return;
    }
    let res;
    try {
      // Bounded like every other probe: a request that never settles
      // would otherwise be the end of this browser's reconnecting.
      res = await probe('/m/' + encodeURIComponent(sqid) + '/stream?probe=1&peer=' + encodeURIComponent(peer),
        Date.now() + SEND_DEADLINE);
    } catch {
      later(resume);
      return;
    }
    if (state.stopped) return;
    if (refused(res)) return;
    if (res.status === 204) {
      // "A resume would attach" — not "a resume is free". If this
      // round produces no hello either, the stall count is what stops
      // the loop.
      if (stall()) return;
      attach(streamPath(peer), resume);
      return;
    }
    if (res.status === 410) {
      terminal(res.data.reason || 'ended');
      return;
    }
    if (res.status === 404) {
      // Either the process restarted (a different boot) or the window
      // lapsed (the same one). Both answers are the same: drop every
      // connection and enter afresh — but only after the local
      // connections are closed, so no media survives a restart.
      closeAllPCs();
      state.boot = res.data.boot || state.boot;
      connectStream();
      return;
    }
    if (res.status === 409) {
      terminal('replaced');
      return;
    }
    // A status the contract does not name (500, or anything a proxy
    // invented): retry, but not for ever.
    if (stall()) return;
    later(resume);
  }

  // diagnoseFresh runs when a fresh stream failed to open. The peerless
  // probe says whether this session already holds a peer here (409) or
  // whether the room is gone (404); a 204 means the refusal was
  // something the probe cannot see — a full room, or the network.
  async function diagnoseFresh() {
    if (state.stopped) return;
    let res;
    try {
      res = await probe('/m/' + encodeURIComponent(sqid) + '/stream?probe=1', Date.now() + SEND_DEADLINE);
    } catch {
      later(connectStream);
      return;
    }
    if (state.stopped) return;
    if (refused(res)) return;
    if (res.status === 409) {
      terminal('replaced');
      return;
    }
    if (res.status === 404) {
      terminal('gone');
      return;
    }
    // 204 here means only "this session holds no peer in this room".
    // The stream that follows can still be refused 503 for a full
    // room, which the probe cannot see, so this round is counted.
    if (stall()) return;
    later(connectStream);
  }

  // refused is the two answers that mean "stop, and say why", wherever
  // they turn up: a session that has ended, and a request the stream
  // endpoint will not accept in the shape this client sends it.
  //
  // There is no arm for 400 (review W-8). Both callers pass a probe
  // response, the stream's only 400 is a `last` it could not parse, and
  // neither probe form sends `last` — so the arm that used to be here
  // could not fire. The attaching stream's 400 is invisible to
  // EventSource anyway: it arrives as an error with no status, and the
  // stall ladder is what ends it.
  function refused(res) {
    if (res.signedOut) {
      terminal('signedout');
      return true;
    }
    if (res.status === 406) {
      terminal('accept');
      return true;
    }
    return false;
  }

  // stall counts consecutive rounds that ended without a `hello`. A
  // network failure is not one of them: an unreachable server is worth
  // waiting for, and the browser says nothing new by giving up on it.
  function stall() {
    stalls += 1;
    if (stalls < MAX_STALLS) return false;
    if (Date.now() - lastHelloAt < STALL_WINDOW) return false;
    terminal('unreachable');
    return true;
  }

  function attach(path, onFail) {
    const source = new EventSource(path);
    const openedAt = Date.now();
    es = source;
    for (const type of DOWNSTREAM) {
      source.addEventListener(type, (ev) => {
        if (source !== es) return;
        let msg;
        try {
          msg = JSON.parse(ev.data);
        } catch {
          return;
        }
        handle(type, msg);
      });
    }
    source.onerror = () => {
      if (source !== es) return;
      closeStream();
      if (state.stopped) return;
      if (!streamDownSince) streamDownSince = Date.now();
      // Only a stream that actually lived clears the backoff. One that
      // died moments after its hello has not proved anything, and
      // resetting on the hello alone is how a tight reconnect loop
      // starts.
      if (Date.now() - openedAt > HEALTHY_STREAM) backoff = BACKOFF_MIN;
      if (state.peer) {
        later(resume);
        return;
      }
      // No participation to come back to, so this goes to the fresh
      // ladder's own diagnosis — which waits before it retries. Waiting
      // here as well would put two backoffs in every round, and double
      // the ladder's own doubling.
      onFail();
    };
  }

  // `deadline` is an absolute instant, and it bounds the whole exchange
  // — the request and the reading of its body — because both are the
  // same fetch and an AbortController ends both. Without it a probe that
  // never settles never returns, and every caller here awaits it: the
  // recovery's deadline was checked only between attempts, so a hanging
  // probe held its target's pump or reset marked in flight for as long
  // as the request stayed open (Codex S2-15).
  async function probe(path, deadline) {
    let stop = 0;
    let controller = null;
    if (deadline && typeof AbortController === 'function') {
      controller = new AbortController();
      stop = setTimeout(() => controller.abort(), Math.max(0, deadline - Date.now()));
    }
    try {
      // No Accept header: the probe forms are exempt from the stream's
      // text/event-stream gate and must not claim to be one.
      const res = await fetch(path, {
        credentials: 'same-origin',
        cache: 'no-store',
        signal: controller ? controller.signal : undefined,
      });
      return await readRefusal(res, 204, path);
    } finally {
      if (stop) clearTimeout(stop);
    }
  }

  // readRefusal turns one response into the shape every caller here
  // branches on. `emptyOK` is the one status that legitimately carries
  // no body — 204 from the stream probe, 200 from the signal endpoint.
  //
  // The signed-out case needs saying: an expired session answers 303 to
  // /signin, fetch follows it, and what comes back is a 200 carrying a
  // sign-in page, which read as a status alone is indistinguishable
  // from success.
  //
  // A redirect on its own is not that, though, which is why `asked` is
  // passed in: a redirect that lands back on the path it was sent to —
  // a proxy normalising a URL, a trailing slash, anything a deployment
  // might do in front of this app — is not a sign-out, and treating it
  // as one would end a working call with a sentence about signing in.
  // Only a redirect that came out somewhere else counts.
  async function readRefusal(res, emptyOK, asked) {
    let data = null;
    if (res.status !== emptyOK) {
      try {
        data = await res.json();
      } catch {
        data = null;
      }
    }
    const signedOut = wentElsewhere(res, asked) || res.status === 401 || res.status === 403 ||
      (res.status === 200 && res.status !== emptyOK && data === null);
    return { status: res.status, data: data || {}, signedOut, retryAfter: res.headers.get('Retry-After') };
  }

  // Origin as well as pathname: a redirect off this origin is somewhere
  // else however familiar the path looks, and a sign-in page served from
  // an identity host would otherwise read as success.
  function wentElsewhere(res, asked) {
    if (!res.redirected) return false;
    try {
      const got = new URL(res.url);
      const want = new URL(asked, location.origin);
      return got.origin !== want.origin || got.pathname !== want.pathname;
    } catch {
      // A URL neither of them can parse is not one this browser asked
      // for: treat it the way the old check did.
      return true;
    }
  }

  function later(fn) {
    if (state.stopped) return;
    clearTimeout(reconnectTimer);
    renderStatus();
    reconnectTimer = setTimeout(fn, backoff);
    backoff = Math.min(backoff * 2, STREAM_BACKOFF_MAX);
  }

  // ---------------------------------------------------------------
  // Events (§4.3)
  // ---------------------------------------------------------------

  function handle(type, msg) {
    // Every downstream event moves this on. It is not a clock and not a
    // sequence number the server would recognise — it is only this
    // browser's own count of what it has been told, and it exists so
    // that a roster can be compared with the connections built since it
    // arrived (see reconcile).
    tick += 1;
    switch (type) {
      case 'hello': return onHello(msg);
      case 'roster': return onRoster(msg);
      case 'peer': return onPeer(msg);
      case 'gone': return onGone(msg);
      case 'knock': return onKnock(msg);
      case 'knock-gone': return onKnockGone(msg);
      case 'full': return onFull();
      case 'state': return onState(msg);
      case 'pair': return onPair(msg);
      case 'gap': return onGap(msg);
      case 'lost': return onLost(msg);
      case 'offer': return onOffer(msg);
      case 'answer': return onAnswer(msg);
      case 'candidate': return onCandidate(msg);
      case 'chat': return onChat(msg);
      case 'share': return onShare(msg);
      case 'media': return onMedia(msg);
      default: return undefined;
    }
  }

  function onHello(msg) {
    // A hello is the proof that this round reached the room; the
    // backoff itself is cleared by attach, and only for a stream that
    // then stayed open.
    stalls = 0;
    lastHelloAt = Date.now();
    streamDownSince = 0;
    const fresh = !state.peer;
    state.peer = msg.peer || null;
    state.boot = msg.boot || state.boot;
    // §15.26: a resumed stream's hello carries the same token, and a new
    // participation's a new one; either way the latest is the one that
    // works. A server from before reports sends none, and nothing is sent.
    if (typeof msg.report === 'string' && /^[0-9a-f]{32}$/.test(msg.report)) reportToken = msg.report;
    root.dataset.peer = state.peer || '';
    if (fresh) join();
    renderStatus();
  }

  async function join(attempt) {
    const round = attempt || 0;
    const peer = state.peer;
    const res = await postSignal({ peer, type: 'join' });
    if (state.stopped || state.peer !== peer) return;
    // signedOut before the status, because it can be true *of* a 200: a
    // session that has expired answers 303 to /signin, fetch follows
    // it, and the sign-in page comes back 200 — which read as a status
    // alone marked the join a success (Codex S2-8).
    if (res.signedOut) {
      terminal('signedout');
      return;
    }
    if (res.status === 200) {
      state.joined = true;
      // A guest gets nothing back from its own join: no roster, no
      // state. The waiting sentence is this browser's own conclusion,
      // not an event it waits for.
      renderStatus();
      return;
    }
    if (res.status === 404) {
      await recoverFromNotFound(res.data.boot);
      // The probe kept this participation, so the 404 raced something
      // rather than naming the end of it. `join` is idempotent: one
      // more go, and then it is the stream's ladder's problem.
      if (round === 0 && !state.stopped && state.peer === peer && !state.joined) {
        await sleep(BACKOFF_MIN);
        if (!state.stopped && state.peer === peer && !state.joined) join(1);
      }
      return;
    }
    // 429 and the transient failures are retried on the same peer, with
    // its own wait so a pending stream reconnect is never cancelled;
    // anything else leaves the sentence alone and the next roster or
    // knock speaks for itself.
    if (res.status === 429 || res.status >= 500 || res.status === 0) {
      await sleep(res.status === 429 ? retryAfter(res.retryAfter) : BACKOFF_MIN);
      if (!state.stopped && state.peer === peer && !state.joined) join(round);
    }
  }

  function onPeer(msg) {
    const id = msg.peer;
    if (!id || id === state.peer) return;
    if (msg.name) names.set(id, msg.name);
    const rp = (msg.roster && msg.roster.peers && msg.roster.peers[0]) || {};
    const g = rp.gen || 1;
    if (rp.name) names.set(id, rp.name);
    learnMedia(id, rp.media);
    ensurePC(id, g);
    renderTiles();
  }

  function onGone(msg) {
    if (!msg.from) return;
    remoteMedia.delete(msg.from);
    closePC(msg.from, true);
    dropWaiting(msg.from);
    renderTiles();
    renderQueue();
  }

  function onKnock(msg) {
    if (!msg.from) return;
    names.set(msg.from, msg.name || '');
    if (!waiting.some((w) => w.peer === msg.from)) {
      waiting = waiting.concat([{ peer: msg.from, name: msg.name || '' }]);
    }
    renderQueue();
  }

  function onKnockGone(msg) {
    if (!msg.from) return;
    dropWaiting(msg.from);
    renderQueue();
  }

  function dropWaiting(id) {
    waiting = waiting.filter((w) => w.peer !== id);
  }

  // §4.3: a member who sees `full` may wait and retry, so this does —
  // once every five seconds, until a roster says we are in or the
  // stream ends. Nothing else in the room polls.
  function onFull() {
    state.full = true;
    renderStatus();
    clearTimeout(fullTimer);
    fullTimer = setTimeout(() => {
      if (state.stopped || state.admitted || !state.peer) return;
      join();
    }, FULL_RETRY);
  }

  function onState(msg) {
    // The only `state` the server sends is waiting:true, on a resume of
    // a participation that has not been admitted. `waiting` uses
    // omitempty, so an absent field is false.
    if (!msg.waiting) return;
    // Not joined: this only ever confirms that the participation this
    // stream reattached to has not been admitted. `joined` is the
    // join's own answer and is not re-derived from an event.
    state.admitted = false;
    renderStatus();
  }

  function onPair(msg) {
    const id = msg.peer;
    if (!id || !msg.gen) return;
    // A generation at or below the local one is a no-op, so duplicates
    // and reordering are harmless (§4.6).
    if (msg.gen <= (gen.get(id) || 0)) return;
    rebuildPC(id, msg.gen);
  }

  function onGap(msg) {
    // The replay could not fill this sender's gap, so the pair is
    // reset: the hub bumps the generation and tells both sides (§4.6).
    if (msg.from) requestReset(msg.from);
  }

  function onLost(msg) {
    const reason = msg.reason || 'ended';
    if (reason === 'buffer') {
      // The one reason that is followed by a resume, not a screen.
      closeStream();
      resume();
      return;
    }
    terminal(reason);
  }

  // ---------------------------------------------------------------
  // Reconciliation (§4.5: the roster is the authority)
  // ---------------------------------------------------------------

  // onRoster is the roster's door, and it keeps `handle` synchronous:
  // §5.2 puts one await in front of the first connection this browser
  // builds, and a rejection escaping an event listener goes where
  // neither a person nor a gate could see it. Same shape as the
  // pageshow handler's.
  function onRoster(msg) {
    // The newest roster wins, and the slot is what makes that true
    // across §5.2's await: a roster that arrives while the first /ice
    // fetch is out overwrites the one waiting to be applied, rather
    // than queueing behind it. Reconciling a superseded roster closes
    // connections the hub has since named — which is exactly how the
    // gate's three ICE scenarios died (Task 5's report): a `peer` event
    // ten milliseconds after the roster built a connection the captured
    // roster did not carry.
    pendingRoster = msg.roster || { peers: [] };
    pendingRosterAt = tick;
    applyRoster().catch((err) => {
      console.error('meet: roster', err);
    });
  }

  // applyRoster is §5.2's ordering: the ICE list is fetched before the
  // first connection is built, and only before the first — every later
  // roster reconciles straight away. A fetch that fails does not hold
  // the room up: it leaves the floor's empty list in place, shows the
  // warning and arms the minute retry, and the roster is applied.
  //
  // Whatever it applies is read *after* the await, never before. Two
  // rosters that arrive during one fetch resume in order: the first
  // takes the newest of them and empties the slot, and the second finds
  // it empty and has nothing left to do.
  async function applyRoster() {
    if (!icePrimed) await iceReady();
    if (state.stopped) return;
    const roster = pendingRoster;
    const at = pendingRosterAt;
    pendingRoster = null;
    if (!roster) return;
    reconcile(roster, at);
  }

  function reconcile(roster, at) {
    rosters += 1;
    lastRoster = roster;
    state.admitted = true;
    state.joined = true;
    state.full = false;
    // The roster is the authority on who is here (§4.5), so it settles
    // every target a 404 marked stale: the ones it lists get their
    // connection back through ensurePC below, and the ones it does not
    // are closed a few lines further down.
    stale.clear();
    const present = new Set();
    for (const rp of roster.peers || []) {
      if (!rp || !rp.peer) continue;
      names.set(rp.peer, rp.name || '');
      if (rp.peer === state.peer) {
        // Our own kind, re-derived by the server on every tick: this,
        // not data-is-member, is what decides whether the member-only
        // controls are drawn.
        state.kind = rp.kind || state.kind;
        continue;
      }
      present.add(rp.peer);
      ensurePC(rp.peer, rp.gen || 1);
    }
    for (const [id, entry] of pcs) {
      if (present.has(id)) continue;
      // A roster can only speak for the room as it was when the hub
      // sent it. A connection built *since* — from a `peer` event that
      // arrived while §5.2's fetch was still out, which is the case
      // that cost the gate three scenarios (Task 5's report) — is not
      // something this roster ever knew about, and closing it leaves a
      // call with a peer it will never hear from again: no further
      // roster is coming, because nothing has changed as far as the hub
      // is concerned.
      if (at && entry.bornAt > at) continue;
      // Otherwise: a connection to an id the roster does not carry is
      // closed, which is how a browser that missed a `gone` still lets
      // go. The counters are *not* dropped with it, though — §4.6 gives
      // `seq` a sender's whole participation, and a roster's silence is
      // not the hub telling us that participation ended. `gone`, `lost`
      // and a departure of our own are; they forget. Dropping them here
      // meant a connection closed and rebuilt started numbering at 1
      // into a peer whose cursor was already at 3, and every message of
      // the new one was discarded as a replay.
      closePC(id, false);
    }
    waiting = (roster.waiting || []).map((w) => {
      names.set(w.peer, w.name || '');
      return { peer: w.peer, name: w.name || '' };
    });
    // §6: a roster is admission, and admission is when the chat panel
    // appears and becomes usable. Mounting is idempotent, so every later
    // roster costs one `setEnabled(true)` and nothing else.
    mountChat();
    chatEnabled(true);
    // §15.19: before the tiles are drawn, so they are drawn right.
    rosterMedia(roster);
    renderTiles();
    renderQueue();
    renderStatus();
  }

  // ---------------------------------------------------------------
  // Peer connections and perfect negotiation (§5.1)
  // ---------------------------------------------------------------

  // ensurePC is the one door into the mesh: a peer with no connection
  // gets one, and a peer whose generation has moved on is rebuilt under
  // the new one. Both `roster` and `peer` come through here, so the two
  // paths cannot drift.
  function ensurePC(id, g) {
    if (state.stopped) return null;
    if (pcs.has(id)) {
      if (g > (gen.get(id) || 0)) rebuildPC(id, g);
      return pcs.get(id);
    }
    gen.set(id, g);
    return createPC(id, g);
  }

  function rebuildPC(id, g) {
    // A new generation: close the connection, discard the outbound
    // queue and the candidate buffer, keep the seq counters (§4.6).
    closePC(id, false);
    if (state.stopped) return;
    gen.set(id, g);
    createPC(id, g);
    renderTiles();
  }

  function createPC(id, g) {
    // §5.2: the list `fetchIce` took from GET /m/{sqid}/ice, which the
    // first roster waits for. An empty one is §5.5's floor — browsers
    // gather host candidates only, which connects on a permissive local
    // network and usually not across the internet — and it is what a
    // connection built during the very first fetch gets, until
    // `adoptServers` hands it the real list.
    let pc;
    try {
      pc = new RTCPeerConnection({ iceServers: ice.servers });
    } catch {
      // No WebRTC at all: an old browser, or one where it is switched
      // off. Nothing here can recover, so the room says so once.
      terminal('nowebrtc');
      return null;
    }
    // Building a connection to a peer means the server has just named it
    // — a roster, a `peer`, or a `pair` — so whatever a 404 marked stale
    // about it is out of date. Without this, a pair the hub reset while
    // this tab was giving up on it would be rebuilt and then never
    // spoken to, because `send` drops for a stale target.
    stale.delete(id);
    const entry = {
      pc,
      // §5.1: the peer with the lower id is polite and rolls back on a
      // collision; the higher is impolite and ignores the offer.
      polite: String(state.peer) < String(id),
      makingOffer: false,
      ignoreOffer: false,
      // §5.1's third negotiation flag, and the one this file was
      // missing (Codex S2-7). It is true only while an answer is being
      // applied, which is a state that looks exactly like glare from
      // the outside — signalingState is still have-local-offer — and is
      // not.
      isSettingRemoteAnswerPending: false,
      // §5.1's polite yield, in three parts (Codex S4-4).
      //
      // `yields` is how many times in a row this side has given way
      // without an offer of its own going out, capped at POLITE_YIELDS
      // and handed back one at a time by an exchange this side did not
      // offer. `negotiation` is the generation: it moves whenever this
      // connection's negotiation moves on, so a yield that captured it
      // and then slept can tell "nothing happened" from "an exchange
      // came and went while I was asleep". `negotiating` is the
      // serializer: one local offer attempt at a time, because two
      // `negotiationneeded` events while one of them sleeps used to
      // produce two offers, the second of them skipping the yield
      // entirely because the first had already spent it.
      yields: 0,
      negotiation: 0,
      negotiating: false,
      // A retry scheduled for an ask the rounds ran out on, so a second
      // one is never stacked on top of it, and how many times that
      // retry has found the connection busy and put itself off.
      negotiateTimer: 0,
      negotiateDefers: 0,
      // A `negotiationneeded` that arrived while an attempt was in
      // flight, kept rather than dropped: an attempt that abandons its
      // offer would otherwise take that change to the grave with it.
      renegotiate: false,
      // §5.1's camera watch (Codex S4-5): the last framesEncoded read
      // off this connection's own camera m-line, how many polls in a
      // row have reported that same number, and how many times the
      // encoder has been rebuilt before giving up and resetting.
      cameraFrames: -1,
      cameraStalls: 0,
      cameraRepairs: 0,
      pending: [],
      descSeq: 0,
      gen: g,
      stream: null,
      failed: false,
      // §5.2: true while this connection is running on the empty list,
      // so `adoptServers` can find the ones built during the first
      // fetch and give them the servers when they arrive.
      floor: !ice.servers.length,
      // Which list this connection was built on. A connection built
      // after a fetch is already on that credential and has nothing to
      // renew, which is what keeps §5.3 step 3's deadline off a peer
      // who joined the call two minutes ago.
      listAt: ice.fetchedAt,
      // Remote descriptions applied, which is how §5.3 step 2's "the
      // restart's offer/answer exchange has completed" is read without
      // guessing from signalingState alone.
      desc: 0,
      // What this browser had been told when the connection was built.
      // reconcile reads it: a roster older than this cannot be talking
      // about this connection.
      bornAt: tick,
      // The four numbers that say where ICE stopped, and the one place
      // they exist: a connection whose negotiation completed and whose
      // transport never left `new` (the residual gate flake) is either
      // gathering nothing, delivering nothing, receiving nothing, or
      // adding nothing, and only these tell those four apart.
      // `delivered` is counted where the hub accepts a candidate, not
      // where one is handed to the queue. Counts, never candidates: an
      // address is not something this file publishes.
      gathered: 0,
      delivered: 0,
      received: 0,
      added: 0,
      // §5.4, sending: the transceiver this connection carries our
      // display track on, while we are sharing.
      shareTx: null,
      // §5.4, receiving: what this peer's camera came in on, and the
      // screen once it arrives. `cameraMid` and `cameraStream` are
      // recorded from the *first* video track — the camera, by
      // definition — and `classifyTrack` reads them to tell the second
      // video track apart from it. `sharing` is the `share {on:true}`
      // message, which usually beats the track here by a renegotiation,
      // and is what lets the tile carry the label before there is
      // anything to show in it.
      cameraMid: '',
      cameraStream: '',
      // The stream everything else from this peer has been arriving in,
      // recorded from the first track of any kind. A sender puts its
      // camera and its microphone in one MediaStream and its screen in
      // another, so this places a video track even before there is a
      // camera to compare it with — which is the audio-only sharer, whose
      // screen is the first video track its peers ever see.
      peerStream: '',
      // Whether this connection carries a camera of ours. Not the same
      // question as `local` having a video track: addTrack can throw,
      // and then this tab has a camera and this connection has a video
      // m-line it built for nobody. classifyTrack's direction rule turns
      // on which of the two is true.
      sentVideo: false,
      // Kinds whose transceiver switchDevice turned round while the
      // connection was mid-negotiation, waiting for it to settle.
      upgrades: new Set(),
      sharing: false,
      share: null,
      // The mid the peer's screen arrives on, so the getStats fallback
      // can tell two inbound video streams apart.
      shareMid: '',
    };
    pcs.set(id, entry);

    // The listeners go on before any media does. `addTrack` fires
    // `negotiationneeded`, and a connection registered in `pcs` with
    // nothing listening for that is a connection that will never offer:
    // the event is one-shot, and by the time a listener arrives it has
    // been and gone. The same order also means a throw from the media
    // below leaves a connection that can still be reset and rebuilt,
    // rather than a live entry nobody is watching.

    // The listener is not async, for the reason the pageshow handler is
    // not: a rejection escaping an event listener goes where neither a
    // person nor a gate could see it. The work is a named function, so
    // it is also the one §5.1 path a node test can drive.
    pc.addEventListener('negotiationneeded', () => {
      negotiate(id, entry).catch((err) => {
        console.error('meet: negotiate', err);
      });
    });

    pc.addEventListener('icecandidate', ({ candidate }) => {
      if (pcs.get(id) !== entry || !candidate) return;
      entry.gathered += 1;
      send(id, 'candidate', { candidate: candidate.toJSON() });
    });

    pc.addEventListener('track', (ev) => {
      if (pcs.get(id) !== entry) return;
      onRemoteTrack(id, entry, ev);
    });

    pc.addEventListener('connectionstatechange', () => {
      if (pcs.get(id) !== entry) return;
      entry.failed = pc.connectionState === 'failed';
      renderTiles();
    });

    // §5.2's deferred half. A connection built during the first /ice
    // fetch is on the floor's empty list, and `adoptServers` will not
    // restart it while a negotiation is in flight — doing that cost a
    // gate run its media. So it waits here for the connection's own
    // next quiet moment instead of waiting 150 minutes for the first
    // renewal.
    pc.addEventListener('signalingstatechange', () => {
      if (pcs.get(id) !== entry) return;
      // §5.4: the same quiet moment is when a deferred share transceiver
      // is added. addShareTo will not add one to a connection that is
      // mid-negotiation, because an unassociated sendonly transceiver is
      // exactly what a remote offer's m-line matching will claim on a
      // rollback — and then the screen is being sent on the m-line the
      // far side means for something else.
      addShareTo(entry);
      upgradeWhenQuiet(entry);
      adoptWhenQuiet(id, entry);
      // And it is when an ask the negotiation rounds ran out on gets
      // its turn (Codex S4-8): a connection that was mid-negotiation is
      // the usual reason they ran out, and this is it settling.
      if (entry.renegotiate && !entry.negotiating && pc.signalingState === 'stable') {
        negotiate(id, entry).catch((err) => {
          console.error('meet: negotiate', err);
        });
      }
    });

    // And now the media. Our own tracks, and a transceiver for every
    // kind we do not have one of — the two used to be all-or-nothing,
    // and that was a hole: a browser that came down `startLocal`'s
    // ladder to audio alone (a camera in use, or gone) has a local
    // stream, so nothing asked to receive video, so it offered no video
    // m-line at all and the person on the other side sat looking at a
    // tile that was never going to get a frame. Per kind, and a track
    // that has ended counts as absent, because it is.
    try {
      if (local) {
        for (const track of local.getTracks()) {
          pc.addTrack(track, local);
          if (track.kind === 'video' && track.readyState !== 'ended') entry.sentVideo = true;
        }
      }
    } catch {
      // A track the browser will not add — ended between the ladder and
      // here, or a device that went away — is not worth the connection.
      // The recvonly transceivers below cover what it would have been.
    }
    tuneAudioSender(pc);
    for (const kind of ['video', 'audio']) {
      if (hasLiveTrack(kind)) continue;
      try {
        pc.addTransceiver(kind, { direction: 'recvonly' });
      } catch {
        // An old browser without addTransceiver simply waits to be
        // offered to, which the other side will do if it has media.
      }
    }
    // §5.4: a connection built while this tab is already sharing gets
    // the screen with everything else, rather than waiting for the next
    // time the button is pressed. Someone joining a call mid-share sees
    // the screen.
    //
    // Last, and that is load-bearing: the m-lines of the first offer
    // come out in the order the transceivers were created, so the camera
    // and the microphone take the places the far side's own createPC
    // built for them and the screen takes a place of its own after them.
    // Added before them, the screen would sit in the m-line a peer built
    // for a camera.
    addShareTo(entry);

    return entry;
  }

  // politeYield waits POLITE_YIELD and then answers whether the
  // negotiation it gave way for is still this side's to make.
  //
  // Three things can have happened while it slept. The connection can
  // have gone, or the call ended: nothing to offer to. A remote offer
  // can have arrived and still be being answered: signalingState says
  // so. Or — the case a state check alone cannot see, and Codex S4-4's
  // first half — a whole exchange can have arrived, been answered and
  // completed, leaving the connection back at `stable` looking exactly
  // as it did when this yield began. The generation is what tells those
  // two apart: it moves on every exchange, so a yield whose generation
  // has changed is a yield whose negotiation somebody else already
  // made. Offering anyway is the extra offer that produced.
  //
  // It answers with the reason rather than a bare no, because the three
  // are not the same afterwards (Codex S4-12). A connection that has
  // gone owes nothing. A negotiation somebody else made is finished
  // with. But an exchange still *in flight* has settled nothing: this
  // side's own reason for offering is as outstanding as it was, and an
  // attempt that walks away from it without saying so is where the ask
  // went missing.
  async function politeYield(id, entry, generation) {
    await sleep(POLITE_YIELD);
    if (pcs.get(id) !== entry || state.stopped) return 'gone';
    if (entry.negotiation !== generation) return 'superseded';
    if (entry.pc.signalingState !== 'stable') return 'busy';
    return '';
  }

  // answeredExchange records one offer/answer exchange this side did
  // not offer: a return to `stable` through somebody else's turn.
  //
  // It moves the generation, which invalidates any yield sleeping
  // through it, and it hands back one spent yield — one, never more
  // than was spent, so a pair renegotiating in turn cannot talk this
  // side into giving way for ever. Without the hand-back, a yield lost
  // to an exchange that happened to satisfy this side's own change left
  // `yields` spent and the *next* independent negotiation unprotected,
  // which is the reset defect the Task 4 re-review carried (item 1).
  function answeredExchange(entry) {
    entry.negotiation += 1;
    if (entry.yields > 0) entry.yields -= 1;
  }

  // negotiate is §5.1's offering half: one offer per negotiation, with
  // the polite side's yield in front of it.
  //
  // The yield is fix round 2's finding, and it is the whole reason this
  // function is not two lines. Perfect negotiation's answer to glare is
  // a rollback on the polite side, and in Chromium rolling back an offer
  // that added an m-line rebuilds every send stream on the connection:
  // the camera's comes back having encoded nothing and never encodes
  // again, on an m-line that goes on reading sendrecv with a live track
  // the whole time. So the side that would roll back gives way *before*
  // it offers instead, and the offer that was already on its way is
  // answered from a stable state with no rollback anywhere.
  //
  // Bounded, which is what `yields` is for: a side that gave way and
  // came back to find another offer waiting would give way again, and
  // two peers renegotiating in turn would keep one of them permanently a
  // beat behind. Past POLITE_YIELDS in a row it offers and takes the
  // ordinary collision path, which is what the pattern is for. The count
  // goes back to zero on this side's own offer, and back by one on an
  // exchange this side answered instead.
  //
  // One attempt at a time, too (Codex S4-4). `negotiationneeded` can
  // fire again while the first attempt is asleep in its yield — a
  // remote exchange completing is exactly the thing that fires it — and
  // the second attempt used to skip the yield, because the first had
  // already spent it, and then both of them offered.
  // An attempt abandoned by its yield is not the end of the story, and
  // this is where the first draft of the serializer was wrong — the
  // browser gate's mutualshare caught it. `negotiationneeded` fires for
  // the polite side's own screen while its attempt is asleep; the
  // attempt then wakes, finds the generation moved by the exchange it
  // slept through, and abandons its offer. If that event was simply
  // dropped because an attempt was in flight, the screen it was about
  // is never offered at all — the transceiver sits unassociated for the
  // rest of the call and the far side sees a caption with nothing in
  // it. So an event that arrives mid-attempt is remembered, and an
  // attempt that abandons its offer runs again for it.
  //
  // Bounded, because "go round again" and "give way" are the same two
  // steps: each round can spend a yield, and the allowance runs out.
  const NEGOTIATE_ROUNDS = 4;

  // How many times a kept ask's retry may find the connection busy and
  // put itself off again. After that it stops asking and waits: the
  // connection's own `signalingstatechange` is what picks the ask up,
  // and a timer that keeps waking every 300 ms adds nothing to it.
  const NEGOTIATE_DEFERS = 10;

  async function negotiate(id, entry) {
    if (pcs.get(id) !== entry) return;
    if (entry.negotiating) {
      entry.renegotiate = true;
      return;
    }
    entry.negotiating = true;
    try {
      for (let round = 0; round < NEGOTIATE_ROUNDS; round++) {
        entry.renegotiate = false;
        const generation = entry.negotiation;
        if (entry.polite && entry.yields < POLITE_YIELDS) {
          entry.yields += 1;
          const why = await politeYield(id, entry, generation);
          if (why === 'gone') return;
          if (why === 'busy') {
            // An exchange is in flight and has settled nothing of ours.
            // The ask goes back on the connection for the return to
            // `stable` to collect (Codex S4-12): walking away from it
            // here is how a preserved request went missing, and this
            // attempt may be the only thing that was holding it.
            entry.renegotiate = true;
            return;
          }
          if (why === 'superseded') {
            // Somebody else made this negotiation. Only an ask that
            // arrived *while* we slept is still outstanding.
            if (!entry.renegotiate || pcs.get(id) !== entry || state.stopped) return;
            continue;
          }
        }
        let offered = false;
        try {
          entry.makingOffer = true;
          await entry.pc.setLocalDescription();
          // This side's own offer: the negotiation is ours, the
          // generation moves with it, and the next one starts with the
          // whole allowance again.
          entry.negotiation += 1;
          entry.yields = 0;
          send(id, 'offer', { description: describe(entry.pc.localDescription) });
          offered = true;
        } catch {
          // A failed local description is not fatal: the pair recovers
          // through a reset if it never connects.
        } finally {
          entry.makingOffer = false;
        }
        // An offer that went out was made from the connection as it
        // stands, so it carries every local change asked for up to this
        // moment. One that did not — an impolite side finding the
        // connection mid-exchange, say — has settled nothing, and the
        // ask goes back for the quiet moment to collect.
        if (!offered) entry.renegotiate = true;
        return;
      }
    } finally {
      entry.negotiating = false;
      // The bound limits how long one attempt may go round; it does not
      // decide that outstanding work stops mattering (Codex S4-8). If
      // something asked for a negotiation that this attempt never got
      // to, the ask stays on the connection and is picked up at its
      // next quiet moment.
      keepNegotiation(id, entry);
    }
  }

  // keepNegotiation is what happens to an ask the rounds ran out on.
  // The request stays true and a retry is scheduled: on the next return
  // to `stable` if the connection is mid-negotiation (which is the
  // usual reason the rounds ran out), and on a timer otherwise, because
  // a connection that is already stable and quiet will not announce
  // anything for the retry to hang off.
  //
  // A retry is scheduled once at a time: `negotiate` clears the flag at
  // the top of every round, so a scheduled one that finds nothing
  // outstanding does nothing at all.
  function keepNegotiation(id, entry) {
    if (!entry.renegotiate) return;
    if (pcs.get(id) !== entry || state.stopped) {
      entry.renegotiate = false;
      return;
    }
    if (entry.negotiateTimer) return;
    entry.negotiateTimer = setTimeout(() => {
      entry.negotiateTimer = 0;
      if (!entry.renegotiate || pcs.get(id) !== entry || state.stopped) return;
      // A retry that lands mid-exchange must not spend the ask on an
      // attempt that cannot offer (Codex S4-12): it defers instead, and
      // the connection's own return to `stable` is what collects it.
      // The timer comes back a bounded number of times for the case
      // where nothing announces that return; after that the ask simply
      // waits, because the stable handler is not going anywhere.
      if (entry.negotiating || entry.pc.signalingState !== 'stable') {
        if (entry.negotiateDefers >= NEGOTIATE_DEFERS) return;
        entry.negotiateDefers += 1;
        keepNegotiation(id, entry);
        return;
      }
      entry.negotiateDefers = 0;
      negotiate(id, entry).catch((err) => {
        console.error('meet: negotiate', err);
      });
    }, POLITE_YIELD);
  }

  // hasLiveTrack answers whether the local stream has a track of this
  // kind that could actually carry media. An ended track is not one:
  // the browser keeps it in the stream, and `addTrack` will take it,
  // but nothing ever comes out of it.
  function hasLiveTrack(kind) {
    if (!local) return false;
    const tracks = kind === 'video' ? local.getVideoTracks() : local.getAudioTracks();
    return tracks.some((track) => track && track.readyState !== 'ended');
  }

  function describe(desc) {
    return desc ? { type: desc.type, sdp: desc.sdp } : null;
  }

  function closePC(id, forget) {
    const entry = pcs.get(id);
    if (entry) {
      try {
        entry.pc.close();
      } catch {
        // Already closed.
      }
      // A retry scheduled for a connection that is going away has
      // nothing left to negotiate; the timer's own guard would refuse
      // it anyway, and clearing it here keeps nothing pending.
      if (entry.negotiateTimer) {
        clearTimeout(entry.negotiateTimer);
        entry.negotiateTimer = 0;
      }
      entry.renegotiate = false;
      pcs.delete(id);
    }
    queue.delete(id);
    // §5.3's record belongs to a connection, not to a peer id: a pair
    // rebuilt under a new generation has renewed nothing yet, and a
    // record left behind would say it had.
    renewals.delete(id);
    // §15.20: what was heard belongs to a connection too. A rebuilt one
    // starts its counters again, and a silence timed on the old one is
    // not a silence on the new.
    hearing.delete(id);
    if (forget) {
      stale.delete(id);
      gen.delete(id);
      seqOut.delete(id);
      lastIn.delete(id);
      names.delete(id);
      frames.delete(id);
      frames.delete(shareKey(id));
    }
  }

  function closeAllPCs() {
    for (const id of Array.from(pcs.keys())) closePC(id, true);
    waiting = [];
    lastRoster = null;
    renderTiles();
    renderQueue();
  }

  // accept applies §4.6's inbound rules to a targeted message: drop
  // anything at or below the seq already seen from this sender, then
  // drop anything below the current pair generation. A generation
  // *above* the local one means a `pair` was missed, so the connection
  // is rebuilt before the message is used.
  function accept(msg) {
    const from = msg.from;
    if (!from) return null;
    const seq = msg.seq || 0;
    const g = msg.gen || 0;
    const mine = gen.get(from) || 0;
    // The generation is read before the cursor, and that order is
    // load-bearing. A message from a generation *older* than ours
    // belongs to a pair that has been reset out from under it and is
    // gone whatever its seq. One from a *newer* generation is the other
    // side of a reset we have not seen yet — and the cursor it would be
    // measured against was built by the connection that reset, so it
    // cannot honestly call that message a replay. Reading the cursor
    // first meant the first message of a rebuilt pair could be
    // discarded for ever, which is the line Task 5's report found under
    // the stale-roster defect.
    if (g && g < mine) return null;
    if (g && g > mine) {
      rebuildPC(from, g);
      if (seq) lastIn.set(from, seq);
      return pcs.get(from) || null;
    }
    if (seq && seq <= (lastIn.get(from) || 0)) return null;
    if (seq) lastIn.set(from, seq);
    return pcs.get(from) || null;
  }

  // offerCollision is the W3C perfect-negotiation decision, written out
  // as its own function because it is the one piece of §5.1 that can be
  // reasoned about — and gated — without a browser (see
  // test/browser/negotiation.test.mjs, which reads it out of this file).
  //
  //   readyForOffer = !makingOffer &&
  //     (signalingState === "stable" || isSettingRemoteAnswerPending)
  //   offerCollision = !readyForOffer
  //
  // The second half of that disjunction is the whole point: while an
  // answer is being applied, signalingState is still have-local-offer,
  // and without this an offer arriving in that window read as glare and
  // was discarded by the impolite side (Codex S2-7).
  function offerCollision(entry, signalingState) {
    const readyForOffer = !entry.makingOffer &&
      (signalingState === 'stable' || entry.isSettingRemoteAnswerPending);
    return !readyForOffer;
  }

  async function onOffer(msg) {
    const entry = accept(msg);
    if (!entry) return;
    const desc = msg.payload && msg.payload.description;
    if (!desc || desc.type !== 'offer') return;
    if (offerCollision(entry, entry.pc.signalingState)) {
      entry.ignoreOffer = !entry.polite;
      if (entry.ignoreOffer) return;
    } else {
      entry.ignoreOffer = false;
    }
    try {
      // The polite peer's implicit rollback lives inside this call.
      entry.isSettingRemoteAnswerPending = false; // this one is an offer
      await entry.pc.setRemoteDescription(desc);
      entry.ignoreOffer = false;
      entry.descSeq = msg.seq || entry.descSeq;
      await drainCandidates(entry);
      await entry.pc.setLocalDescription();
      // One exchange completed, on the answering side (§5.3 step 2) —
      // and an exchange this side did not offer, which is what moves
      // the negotiation generation and hands a spent yield back.
      entry.desc += 1;
      answeredExchange(entry);
      send(msg.from, 'answer', { description: describe(entry.pc.localDescription) });
    } catch {
      // A description that will not apply leaves the pair to recover
      // through a reset rather than throwing into the event handler.
    }
  }

  async function onAnswer(msg) {
    const entry = accept(msg);
    if (!entry) return;
    const desc = msg.payload && msg.payload.description;
    if (!desc || desc.type !== 'answer') return;
    if (entry.pc.signalingState !== 'have-local-offer') return;
    try {
      // The W3C flag, set exactly where the reference sets it: around
      // setRemoteDescription, true because this description is an
      // answer. An offer that arrives while this is in flight is a
      // legitimate offer, not glare, and offerCollision reads this to
      // tell the two apart.
      entry.isSettingRemoteAnswerPending = true;
      try {
        await entry.pc.setRemoteDescription(desc);
      } finally {
        entry.isSettingRemoteAnswerPending = false;
      }
      // The reference sets ignoreOffer on every description it applies,
      // and an answer that lands means the collision it was set for is
      // over: candidate failures after this point are real again.
      entry.ignoreOffer = false;
      entry.descSeq = msg.seq || entry.descSeq;
      // One exchange completed, on the offering side (§5.3 step 2).
      entry.desc += 1;
      await drainCandidates(entry);
    } catch {
      // Same as above: a stale answer is not worth an exception.
    }
  }

  async function onCandidate(msg) {
    const entry = accept(msg);
    if (!entry) return;
    const candidate = msg.payload && msg.payload.candidate;
    if (!candidate) return;
    entry.received += 1;
    // §4.6: a candidate whose seq precedes the current description's
    // belongs to a description that has been replaced.
    if (msg.seq && entry.descSeq && msg.seq < entry.descSeq) return;
    if (!entry.pc.remoteDescription) {
      entry.pending.push(candidate);
      if (entry.pending.length > MAX_BUFFERED_CANDIDATES) entry.pending.shift();
      return;
    }
    await addCandidate(entry, candidate);
  }

  async function drainCandidates(entry) {
    const held = entry.pending;
    entry.pending = [];
    for (const candidate of held) await addCandidate(entry, candidate);
  }

  async function addCandidate(entry, candidate) {
    try {
      await entry.pc.addIceCandidate(candidate);
      entry.added += 1;
    } catch (err) {
      // The W3C reference swallows exactly this: an ignored offer's
      // candidates cannot apply, and that is expected, not an error.
      if (!entry.ignoreOffer) console.warn('meet: candidate', err && err.name);
    }
  }

  // ---------------------------------------------------------------
  // ICE servers and renewal (§5.2, §5.3, §5.5)
  // ---------------------------------------------------------------
  //
  // The shape of it: the first roster waits for `fetchIce`, every
  // connection is built with the list it took, and each connection is
  // renewed on its own at the time the server named — with new servers,
  // an ICE restart, and proof that the restart landed. Nothing about the
  // servers is logged: the list carries a credential, and the three
  // diagnostics below print an error object and never a response.

  const ICE_WARNING = 'Calls could not reach the relay. Calls may not connect until it can.';
  const ICE_EXPIRED = 'The relay credential expired for this connection.';
  const ICE_STUCK = 'Could not renew this connection through the relay.';
  const FAILED_RELAY = 'Could not connect, even through the relay.';
  const FAILED_PLAIN = 'Could not connect.';

  // iceReady is the one await §5.2 puts in front of the first connection
  // this browser builds. One shared promise, so two rosters in the same
  // breath cannot start two fetches, and a failure primes exactly as a
  // success does: the room carries on with the floor's empty list while
  // the minute retry runs behind it.
  function iceReady() {
    if (icePrimed) return Promise.resolve(false);
    if (!firstIce) {
      firstIce = fetchIce().finally(() => {
        firstIce = null;
      });
    }
    return firstIce;
  }

  // fetchIce is §5.2's client half: GET /m/{sqid}/ice for this
  // participation, answering {iceServers, expiresAt, renewAt}. It never
  // throws and never rejects — every caller carries on either way — and
  // answers whether a new list is in hand.
  //
  // The stream's `probe` is borrowed whole: same-origin credentials, no
  // store, no Accept the endpoint did not ask for, and an absolute
  // deadline, so a request that never settles cannot be the end of this
  // browser's renewing.
  async function fetchIce() {
    const peer = state.peer;
    if (state.stopped || !peer) return false;
    const path = '/m/' + encodeURIComponent(sqid) + '/ice?peer=' + encodeURIComponent(peer);
    // One budget for the whole exchange, however many requests it takes
    // — the shape §4.6 already gives one outbound message, and the same
    // reason applies: /ice spends /signal's own per-session, per-room
    // bucket, so a renewal that lands inside a burst of signalling gets
    // a 429 and a Retry-After rather than an answer.
    const deadline = Date.now() + SEND_DEADLINE;
    for (;;) {
      let res;
      try {
        res = await probe(path, deadline);
      } catch {
        icePrimed = true;
        iceFailed();
        return false;
      }
      if (state.stopped || state.peer !== peer) return false;
      if (res.signedOut) {
        terminal('signedout');
        return false;
      }
      if (res.status === 429) {
        // Not a failure: the server said "not now, come back in n". Honour
        // it inside this budget and say nothing — a warning about the
        // relay would be untrue, and the person's own call is what filled
        // that bucket. Only a wait that runs out of budget is a failure.
        if (!(await waitWithin(retryAfter(res.retryAfter), deadline))) {
          icePrimed = true;
          iceFailed();
          return false;
        }
        continue;
      }
      if (res.status === 404) {
        // Not a relay failure: a 404 here says this participation is
        // gone — a resume window that has lapsed included, now that
        // /ice gates on the same liveness /signal does — and /signal's
        // own 404 says no more than that either. So it goes through
        // the same probe-first recovery — this browser's own
        // participation is the authority on what the 404 meant — and the
        // next roster fetches again, because whatever comes back from that
        // ladder is a call that has not got a list yet.
        icePrimed = false;
        firstIce = null;
        await recoverFromNotFound(res.data.boot);
        // The ladder is allowed to decide nothing at all: a probe that
        // cannot answer inside its budget leaves this participation alone
        // (§4.5), and a call left with no list and no retry pending would
        // simply sit there. So unless it ended the call or entered afresh
        // — both of which change what is checked here — the minute retry
        // covers it.
        if (!state.stopped && state.peer === peer) iceFailed();
        return false;
      }
      if (res.status !== 200 || !Array.isArray(res.data.iceServers)) {
        icePrimed = true;
        iceFailed();
        return false;
      }
      icePrimed = true;
      ice.servers = res.data.iceServers;
      ice.expiresAt = millis(res.data.expiresAt);
      ice.renewAt = millis(res.data.renewAt);
      // The margin the server left itself: expiry minus renew time, on
      // its clock, where the two subtract to a duration both machines
      // agree on. Everything below is scheduled from it and from
      // `fetchedAt`, which is this browser's own clock — see renewDelay.
      ice.margin = Math.max(0, ice.expiresAt - ice.renewAt);
      ice.fetchedAt = Date.now();
      ice.lastFetchAt = ice.fetchedAt;
      ice.fetches += 1;
      ice.failedSince = 0;
      ice.lastTryAt = 0;
      clearTimeout(iceRetryTimer);
      iceWarning(false);
      scheduleRenewal();
      adoptServers();
      return true;
    }
  }

  // The wire carries unix seconds; everything in this file works in
  // milliseconds since the epoch, and this is the one place the two
  // meet. A field that is missing, zero or not a number means "no
  // clock", which is exactly what the server sends when there is no
  // relay to renew.
  function millis(v) {
    const n = Number(v);
    return Number.isFinite(n) && n > 0 ? n * 1000 : 0;
  }

  // iceFailed is §5.3 step 1: keep the list we have — or the floor's
  // empty one, on the very first fetch — say so from the first failure,
  // and come back in a minute. `ice.expiresAt` is deliberately left
  // alone: the old credential's deadline is the must-succeed-by for
  // every connection that has not renewed (§5.3 step 3), and a failed
  // fetch is the case that makes it matter.
  function iceFailed() {
    if (state.stopped) return;
    // Every failure, not just the first: the catch-up on a tab coming
    // back has to know when this browser last actually tried, and
    // `failedSince` is the start of the run and answers a different
    // question (whether the sentence is up).
    ice.lastTryAt = Date.now();
    if (!ice.failedSince) ice.failedSince = Date.now();
    iceWarning(true);
    clearTimeout(iceRetryTimer);
    iceRetryTimer = setTimeout(() => {
      if (state.stopped) return;
      const run = renewDue ? renewAll() : fetchIce();
      run.catch((err) => {
        console.error('meet: ice', err);
      });
    }, ICE_RETRY);
  }

  // iceWarning is §5.3 step 1's sentence, in a live region of its own
  // created once beside #status. Its own, because the status paragraph
  // is busy with the call's state and a warning coming and going from
  // there would take whatever a person was reading with it. Never colour
  // alone: the sentence is the whole signal.
  function iceWarning(show) {
    const el = warningEl();
    if (!el) return;
    // On the floor the sentence would be untrue: there is no relay this
    // instance could reach, /ice answers an empty list, and a fetch that
    // fails there costs the call nothing a person could act on (§5.5).
    if (show && !relayConfigured) return;
    if (show) {
      // Unhidden first, then written: a live region announces the change
      // it can see, and text set into a hidden element is not one.
      el.hidden = false;
      el.textContent = ICE_WARNING;
      return;
    }
    el.textContent = '';
    el.hidden = true;
  }

  function warningEl() {
    if (iceWarningEl) return iceWarningEl;
    if (!statusEl) return null;
    const el = document.createElement('p');
    el.id = 'ice-warning';
    el.className = 'calls-ice-warning';
    el.setAttribute('role', 'status');
    el.hidden = true;
    statusEl.after(el);
    iceWarningEl = el;
    return el;
  }

  // adoptServers closes the one window §5.2's ordering leaves open: a
  // `peer` event can arrive while the very first fetch is still out, and
  // that connection was built on the floor's empty list. Nothing about
  // it is broken — it is gathering host candidates — so it is handed the
  // servers and restarted rather than torn down and rebuilt.
  function adoptServers() {
    if (!ice.servers.length) return;
    for (const [id, entry] of pcs) {
      if (!entry.floor) continue;
      try {
        entry.pc.setConfiguration({ iceServers: ice.servers });
      } catch {
        // An older browser without setConfiguration: nothing to adopt
        // into, and the connection keeps what it was built with.
        continue;
      }
      // And the restart, if this connection is quiet enough to take
      // one now. If it is not — which is the common case for a peer
      // built during the fetch, because it is mid-offer — it is
      // deferred, not dropped: `createPC`'s signalingstatechange
      // listener runs the same decision at every quiet moment, so the
      // connection takes the list as soon as its negotiation settles
      // rather than waiting 150 minutes for the first renewal.
      adoptWhenQuiet(id, entry);
    }
  }

  // adoptWhenQuiet is that decision and the act. It is safe to call as
  // often as anything likes: `floor` is what makes it happen at most
  // once per list, and clearing it first means the restart's own
  // signalingstatechange cannot come back round here.
  function adoptWhenQuiet(id, entry) {
    if (!readyToAdopt(entry, ice.servers.length)) return;
    entry.floor = false;
    entry.listAt = ice.fetchedAt;
    try {
      entry.pc.restartIce();
    } catch {
      // No restartIce on this browser: a fresh generation is the only
      // way to put the servers under this pair, and the `pair` that
      // answers rebuilds the connection with them from nothing.
      requestReset(id);
    }
  }

  // readyToAdopt is §5.2's deferral rule, pure so it can be gated
  // without a browser: still on the floor, a list to move to, and a
  // connection quiet enough that a restart will not cut across a
  // negotiation already in flight.
  function readyToAdopt(entry, servers) {
    return !!(entry.floor && servers && !entry.makingOffer &&
      entry.pc.signalingState === 'stable');
  }

  // scheduleRenewal is §5.3 step 4: the next renewal is the `renewAt`
  // the server named, counted from the fetch that succeeded. Nothing is
  // scheduled on the floor — there is no credential to renew — and a
  // `renewAt` already behind us runs at once.
  function scheduleRenewal() {
    clearTimeout(renewTimer);
    if (state.stopped || !schedulable()) return;
    renewTimer = setTimeout(renew, Math.max(0, renewDelay() - (Date.now() - ice.fetchedAt)));
  }

  // renewDelay and mustSucceedBy are §5.3's two instants, measured as
  // durations from the moment this browser took the list rather than as
  // points on the server's clock. A browser whose clock is minutes off
  // the server's would otherwise renew at the wrong time, and one far
  // enough ahead would decide the credential had expired before it ever
  // used it.
  //
  // There are two ways to read the duration and neither is right on its
  // own, so both are taken and the earlier wins.
  //
  // The *ratio* reading uses the margin the server left itself —
  // expiresAt minus renewAt, a subtraction of two instants on one clock,
  // so it survives any skew at all. The contract's shape (renew at five
  // sixths of the life) makes the rest arithmetic: the margin is a sixth
  // of the life, the delay five of them, the life six. But the server
  // sends whole seconds, and truncation eats the margin at short lives:
  // a twelve-second life gives 10 and 12 — margin 2, and 2 x 5 = 10, the
  // truth — while a ten-second life gives 8 and 10, where the same
  // arithmetic says 10 and would renew at the very moment the credential
  // died.
  //
  // The *clock* reading subtracts this browser's fetch stamp from the
  // server's instants. It is exact when the clocks agree and wrong by
  // the skew when they do not — but wrong in a direction that only
  // matters one way: a browser running ahead of the server gets a
  // shorter answer and renews early, which costs nothing, and one
  // running behind gets a longer one, which the ratio reading then caps.
  //
  // So: the earlier of the two, and a floor under the delay so that a
  // server answering with no margin at all cannot turn the schedule into
  // a spin.
  function renewDelay() {
    return Math.max(MIN_RENEW_DELAY,
      Math.min(ice.margin * 5, ice.renewAt - ice.fetchedAt));
  }

  function mustSucceedBy() {
    return ice.fetchedAt + Math.min(ice.margin * 6, ice.expiresAt - ice.fetchedAt);
  }

  // §5.3's last paragraph: a suspended tab stops its timers, so a tab
  // coming back to visible compares the clock with `renewAt` rather than
  // trusting one, and runs the sequence at once if it is overdue.
  function catchUpRenewal() {
    if (state.stopped || !schedulable()) return;
    // A fetch that is already failing has a retry of its own running on
    // its own minute, and a tab coming back to visible is not a reason
    // to jump that queue. The comparison is with the clock rather than
    // with the timer because that timer is exactly what a suspended tab
    // stops: a failure older than the retry interval means the minute
    // has passed with nothing to run it, and this is what runs it.
    if (ice.failedSince && Date.now() - ice.lastTryAt < ICE_RETRY) return;
    if (Date.now() - ice.fetchedAt >= renewDelay()) renew();
  }

  function renew() {
    renewAll().catch((err) => {
      console.error('meet: renew', err);
    });
  }

  // renewAll is §5.3's sequence for the whole mesh: fetch, then hand
  // what came back to every connection still on the old list. Both the
  // deadline it arms the watchdog with — step 3's must-succeed-by, the
  // one honest signal, because the browser cannot see which credential
  // an allocation is using — and the stamp naming the credential that
  // deadline belongs to are read *before* the fetch. A failed fetch
  // leaves neither where the watchdog could confuse them: `fetchedAt`
  // only ever advances on a success, which is exactly why reading it
  // afterwards made the watchdog unreachable (round-1 review, item 1).
  async function renewAll() {
    if (state.stopped || renewing) return;
    renewing = true;
    renewDue = true;
    const expiring = ice.fetchedAt;
    armMustSucceedBy(mustSucceedBy(), expiring);
    try {
      // A failed fetch has already armed the warning and the minute
      // retry, and that retry comes back here.
      if (!(await fetchIce())) return;
      renewDue = false;
      renewOutdated(expiring);
    } finally {
      renewing = false;
    }
  }

  // renewOutdated hands a list that has just arrived to every
  // connection still on an older one. Every path that produces a list
  // comes through here — the scheduled renewal and a tile's Retry
  // alike — because a fetch is a fetch: one credential is minted for
  // the call, and renewing only the connection whose Retry happened to
  // make the request left every other connection on a credential about
  // to die, with the shared timers already reset out from under them
  // (Codex S3-2).
  function renewOutdated(expiring) {
    for (const id of Array.from(pcs.keys())) {
      const entry = pcs.get(id);
      if (!entry || entry.listAt > expiring) continue;
      renewOne(id).catch((err) => {
        console.error('meet: renew', err);
      });
    }
  }

  // armMustSucceedBy sets §5.3 step 3's verdict for the connections that
  // have nothing running: with the fetch still failing a minute at a
  // time, the old credential's deadline passes and their allocation dies
  // with it, and the person is owed the sentence. A connection whose own
  // restart is still in flight is left alone — it is the thing that
  // would clear this, and interrupting it would show the sentence to
  // someone whose call is about to come back.
  function armMustSucceedBy(at, expiring) {
    clearTimeout(expiryTimer);
    if (!at) return;
    expiryTimer = setTimeout(() => expireUnrenewed(expiring), Math.max(0, at - Date.now()));
  }

  // expireUnrenewed is the verdict itself. `expiring` is the stamp of
  // the credential that has just run out, so "newer than that" means
  // "built on a list this deadline was never about" — a peer who joined
  // after the fetch, whose connection has the current credential and
  // nothing to renew. It has to be the *expiring* stamp and not
  // `ice.fetchedAt`: on the path this exists for, the fetch is still
  // failing and `ice.fetchedAt` has not moved, so comparing against it
  // exempted every connection in the call and nothing was ever marked.
  function expireUnrenewed(expiring) {
    if (state.stopped) return;
    for (const [id, entry] of pcs) {
      // The one exemption that means anything: this connection is on a
      // list *newer* than the one that just expired, because it was
      // built on it or was proven onto it. `listAt` is that list's
      // stamp and it moves only on proof, so it answers "which
      // credential is this connection actually using" — which is the
      // question. A `renewed` flag answered "did this connection ever
      // renew, once, at any time", and stayed true through every later
      // failure: one successful renewal exempted a connection from
      // every deadline for the rest of the call, and nobody was ever
      // told the second credential had died (Codex S3-1).
      if (entry.listAt > expiring) continue;
      const record = renewals.get(id);
      // A restart still in flight is the thing that would clear this,
      // and interrupting it would show the sentence to someone whose
      // call is about to come back.
      if (record && record.running) continue;
      markRelayExpired(id, expiring);
    }
  }

  // The two verdicts a renewal can end on, and they are not
  // interchangeable. `expired` is the must-succeed-by: the credential
  // this connection is using ran out before a new one landed, which is
  // §5.3 step 3's honest signal. `stuck` is the other ending — three
  // ICE restarts with a good new credential in hand, none of them
  // proven — where the credential is fine and the path is not. Saying
  // "expired" there would be a sentence about the wrong thing.
  function markRelayExpired(id, expiring) {
    markTrouble(id, 'expired', expiring);
  }

  // markTrouble is where a verdict becomes a sentence, and `upTo` is
  // the list the verdict is about: the credential that expired, or the
  // one a restart could not install. A connection proven onto something
  // newer has nothing to answer for and is left alone; anything else is
  // told.
  //
  // It used to read `record.renewed` instead — "did this connection
  // ever renew, once, at any time" — which was true for the rest of the
  // call after a single success and swallowed every later verdict
  // silently, watchdog included (Codex S3-8). The boolean is gone from
  // the decision entirely; `listAt` is the only thing that answers
  // which credential a connection is actually on.
  function markTrouble(id, kind, upTo) {
    const entry = pcs.get(id);
    if (!entry || (upTo && entry.listAt > upTo)) return;
    renewalRecord(id).trouble = kind;
    renderTiles();
  }

  function renewalRecord(id) {
    let record = renewals.get(id);
    if (!record) {
      record = {
        attempts: 0, renewed: false, ufrag: '', at: 0, running: false, trouble: '',
        // The last run's own budget and how it ended, for a reader who
        // needs to know a verdict followed three restarts and not one —
        // which `attempts`, counting a whole life, cannot answer.
        lastRun: null,
      };
      renewals.set(id, record);
    }
    return record;
  }

  // renewOne is §5.3 step 2 for one connection: the new servers under
  // the existing transport, an ICE restart, perfect negotiation carrying
  // the offer, and then proof. Three attempts, thirty seconds each, and
  // the must-succeed-by is read *between* attempts rather than during
  // one — cutting a restart that is about to land would show a person
  // the expired sentence for a call that was coming back.
  // renewOne is reached only with a fresh credential in hand — every
  // caller has just fetched one — so the deadline plays no part in it.
  // Its whole budget is three restarts, and its verdict on failure is
  // always `stuck`: the credential is fine and the path is not. Cutting
  // the budget short at the old deadline and calling the result
  // "expired" was a sentence about the wrong thing, told after one
  // attempt of the three (Codex S3-4). `expired` belongs to the
  // watchdog, which is the only place that knows the other case: no
  // fresh credential arrived at all.
  async function renewOne(id) {
    const entry = pcs.get(id);
    if (!entry || state.stopped) return false;
    const record = renewalRecord(id);
    if (record.running) return false;
    record.running = true;
    record.renewed = false;
    // The stamp of the last list this run actually installed, for the
    // verdict at the bottom: it is the list the restarts failed on, and
    // not necessarily the newest one the call holds.
    let lastInstalled = ice.fetchedAt;
    // What *this* run spends, as against `record.attempts`, which is
    // the connection's whole life. A verdict has to be readable
    // alongside the budget it followed, and a lifetime counter cannot
    // say that: a later run raises it while the first verdict is still
    // on the screen (Codex S3-14).
    let spent = 0;
    try {
      for (let attempt = 1; attempt <= RENEW_ATTEMPTS; attempt++) {
        if (state.stopped || pcs.get(id) !== entry) return false;
        // Restarts spent on this connection, and never reset: a
        // connection that is handed one list after another and cannot
        // land on any of them has spent all of them, and a count that
        // started again with each run read as 1 the instant a
        // follow-up began — which is a number that says nothing and
        // that a gate cannot wait on.
        record.attempts += 1;
        spent += 1;
        // The generation this connection is on now, and the count of
        // exchanges it has completed: the two things the proof is
        // measured against.
        const oldUfrag = await selectedUfrag(entry.pc);
        const from = entry.desc;
        // The list this attempt installs, and the stamp that names it.
        // Read here and used on proof, because `ice.fetchedAt` is the
        // *newest* list the call has fetched and another tile's Retry
        // can replace it while this attempt is still running: stamping
        // the global one claimed the connection was on a credential it
        // had never been given, and handed it that credential's
        // schedule (Codex S3-9).
        const installed = ice.servers;
        const installedAt = ice.fetchedAt;
        try {
          entry.pc.setConfiguration({ iceServers: installed });
          entry.floor = !installed.length;
        } catch {
          // The connection is still on the list it had, and a restart
          // from here would re-gather on *those* servers — and could
          // prove, on a new fragment, and be stamped onto a list it
          // never took (Codex S3-13). Nothing is stamped, nothing is
          // restarted, and a fresh generation is asked for instead: a
          // rebuilt connection takes `ice.servers` at construction,
          // which is the only way left to put these servers under this
          // pair, and it keeps §4.6's counters.
          requestReset(id);
          await sleep(RENEW_WINDOW);
          if (state.stopped || pcs.get(id) !== entry) return false;
          verdict(id, record, spent, 'stuck', lastInstalled);
          return false;
        }
        // Installed, and only now is this the list the run is working
        // on. The stamp moves after the call returns, never before it.
        lastInstalled = installedAt;
        try {
          entry.pc.restartIce();
        } catch {
          // No restartIce at all: a fresh generation is the only way to
          // put a new credential under this pair, and the `pair` that
          // answers rebuilds the connection from nothing — a rebuild
          // this record does not survive, which is what "the connection
          // is gone from under us" means below. If nothing has rebuilt
          // it by the end of the window, nothing is going to, and the
          // person is owed a sentence rather than a tile that looks
          // fine and carries no media.
          requestReset(id);
          await sleep(RENEW_WINDOW);
          if (state.stopped || pcs.get(id) !== entry) return false;
          verdict(id, record, spent, 'stuck', installedAt);
          return false;
        }
        const proven = await proveRenewed(id, entry, oldUfrag, from, Date.now() + RENEW_WINDOW);
        if (state.stopped || pcs.get(id) !== entry) return false;
        if (proven !== null) {
          record.renewed = true;
          record.ufrag = proven;
          record.at = Date.now();
          entry.listAt = installedAt;
          record.trouble = '';
          record.lastRun = { attempts: spent, verdict: 'renewed' };
          renderTiles();
          return true;
        }
      }
      verdict(id, record, spent, 'stuck', lastInstalled);
      return false;
    } finally {
      record.running = false;
      // And if a newer list arrived while this attempt was running,
      // this connection owes a renewal onto it: `renewOutdated` skipped
      // it because a restart was in flight, and nothing else is coming
      // for it until the next scheduled renewal (Codex S3-9).
      followUp(id, lastInstalled);
    }
  }

  // verdict records how a run ended and what it spent getting there,
  // and then says it on the tile. `spent` is this run's own budget;
  // `record.attempts` keeps counting across runs for whoever wants the
  // whole story.
  function verdict(id, record, spent, kind, upTo) {
    record.lastRun = { attempts: spent, verdict: kind };
    markTrouble(id, kind, upTo);
  }

  // followUp is that debt, paid once the attempt that incurred it has
  // let go of the record. `attempted` is the newest list that run had
  // to work with: only a list newer than *that* is a debt, which is
  // what keeps a connection that simply cannot be renewed from
  // restarting itself for ever. A timeout of zero rather than a direct
  // call, because `renewOne` refuses to start while `running` is set
  // and this runs from the `finally` that clears it.
  function followUp(id, attempted) {
    if (state.stopped || ice.fetchedAt <= attempted) return;
    const entry = pcs.get(id);
    if (!entry || entry.listAt >= ice.fetchedAt) return;
    setTimeout(() => {
      const now = pcs.get(id);
      if (state.stopped || !now || now.listAt >= ice.fetchedAt) return;
      renewOne(id).catch((err) => {
        console.error('meet: renew', err);
      });
    }, 0);
  }

  // retryRenewal is the control §5.3 step 3 puts on a tile in trouble:
  // a fresh fetch, then step 2 again — for this connection and for
  // every other one the fetch just re-credentialed.
  //
  // A fetch that fails is the case worth writing out. `restartIce` has
  // already cleared the sentence off the tile, so returning here left a
  // person looking at a tile that said nothing was wrong while nothing
  // had been done about it. The sentence goes back up — it is still
  // true — and the connection still gets the plain restart the ordinary
  // Retry would have given it, which is the one thing left that might
  // help.
  async function retryRenewal(id, wasTrouble) {
    const expiring = ice.fetchedAt;
    if (await fetchIce()) {
      // Not just this one. The fetch this Retry made replaced the
      // credential every connection was using, and reset the shared
      // schedule with it, so every connection still on the old list is
      // renewed here (Codex S3-2).
      renewOutdated(expiring);
      return;
    }
    if (wasTrouble) {
      renewalRecord(id).trouble = wasTrouble;
      renderTiles();
    }
    const entry = pcs.get(id);
    if (entry) bareRestart(id, entry);
  }

  // proveRenewed polls getStats until the decision below says the
  // restart landed, or until the window runs out. Half a second between
  // polls: an ICE restart is a round trip and a handful of candidate
  // exchanges, and asking faster only costs the call CPU.
  async function proveRenewed(id, entry, oldUfrag, from, deadline) {
    // The generation this connection was on before the restart, when it
    // could be read. When it could not, the first fragment readable
    // afterwards stands in for it, and the proof is then the ordinary
    // one: a *different* fragment after that. It is a weaker starting
    // point and it can honestly fail to prove a restart that did land —
    // but failing to prove costs a sentence and a Retry, where wrongly
    // proving is a call running on a credential nobody ever checked.
    let baseline = oldUfrag || '';
    for (;;) {
      // A connection replaced under us — a `pair`, a roster, an
      // unreachable target — is not the connection this proof is about,
      // and polling its stats for another thirty seconds proves nothing
      // about either of them.
      if (state.stopped || pcs.get(id) !== entry) return null;
      const reports = await statsList(entry.pc);
      const proven = renewedUfrag(reports, baseline,
        entry.pc.signalingState, entry.desc > from);
      if (proven !== null) return proven;
      if (!baseline) baseline = selectedPairUfrag(reports) || '';
      const left = deadline - Date.now();
      if (left <= 0) return null;
      await sleep(Math.min(RENEW_POLL, left));
    }
  }

  // renewedUfrag is §5.3 step 2's decision, written as a pure function
  // of one getStats report so it can be reasoned about — and gated —
  // without a browser (test/browser/negotiation.test.mjs lifts it out of
  // this file by name).
  //
  // A connection is renewed when the restart's offer/answer exchange has
  // completed, `signalingState` is stable with that answer applied, and
  // the selected succeeded pair's local candidate carries a *different*
  // ICE username fragment from the one the connection was on. An
  // `iceConnectionState` change proves nothing on its own: a `completed`
  // transport moves to `connected` merely by starting a restart.
  //
  // It answers the new fragment, '' when the restart is proven but the
  // browser does not name fragments, and null when it is not proven —
  // so callers test `!== null`, never truthiness.
  function renewedUfrag(reports, oldUfrag, signalingState, negotiated) {
    if (!negotiated || signalingState !== 'stable') return null;
    // No baseline, no proof. Without knowing which generation this
    // connection was on, a selected pair that has not moved at all
    // looks exactly like one that has — and the old reading took that
    // as proof, cleared the warning, and stamped the connection as
    // renewed onto a credential it had never gathered on (Codex S3-3).
    // A getStats that rejected before the restart arrived here the same
    // way. The caller establishes a baseline from the first reading it
    // can take *after* the restart and comes back; if none can be read,
    // the restart stays unproven, which is the honest answer.
    if (!oldUfrag) return null;
    const ufrag = selectedPairUfrag(reports);
    // And a pair the browser will not name is not evidence either: ''
    // says "there is a pair", not "there is a new one".
    if (!ufrag) return null;
    return ufrag !== oldUfrag ? ufrag : null;
  }

  // selectedPairUfrag reads one getStats report and answers the ICE
  // username fragment on the local candidate of the selected, succeeded
  // candidate pair: the fragment when the browser names it, '' when the
  // pair is there and the fragment is not, and null when there is no
  // such pair at all. Pure, like the decision above.
  //
  // Where a browser names the selected pair itself — Chromium's
  // transport.selectedCandidatePairId — that answer wins outright, and a
  // pair it does not name is not consulted however succeeded and
  // nominated it looks. Chromium keeps the *previous* generation's pair
  // in the report for a while after a restart, still succeeded and still
  // nominated, and scanning for one of those was how a restart could
  // read as proven by the connection it had just replaced (round-1
  // review, item 2). `nominated`/`selected` are the fallback for a
  // report with no transport in it, which is what Firefox sends.
  function selectedPairUfrag(reports) {
    const locals = new Map();
    const pairs = [];
    const selected = new Set();
    let transports = 0;
    for (const r of reports || []) {
      if (!r || !r.type) continue;
      if (r.type === 'local-candidate') locals.set(r.id, r);
      else if (r.type === 'candidate-pair') pairs.push(r);
      else if (r.type === 'transport') {
        transports += 1;
        if (r.selectedCandidatePairId) selected.add(r.selectedCandidatePairId);
      }
    }
    // A transport that has not named a pair yet has not selected one:
    // `selected` is empty, nothing matches, and the answer is null.
    const chosen = transports
      ? pairs.filter((p) => selected.has(p.id))
      : pairs.filter((p) => p.nominated || p.selected);
    let found = null;
    for (const p of chosen) {
      if (p.state !== 'succeeded') continue;
      const local = locals.get(p.localCandidateId);
      const ufrag = (local && local.usernameFragment) || '';
      // A pair that names the fragment is worth more than one that does
      // not, so keep looking rather than settling for the first.
      if (ufrag) return ufrag;
      found = '';
    }
    return found;
  }

  // selectedUfrag is the generation a connection is on right now. null
  // means the browser will not say — no selected pair yet, or no
  // fragment reported — which is the case renewedUfrag falls back for.
  async function selectedUfrag(pc) {
    return selectedPairUfrag(await statsList(pc)) || null;
  }

  // statsList flattens one RTCStatsReport into an array, and answers an
  // empty one for a connection that is closing — getStats can reject,
  // and on some browsers throw outright, and neither is worth an
  // exception in the middle of a renewal.
  function statsList(pc) {
    try {
      return pc.getStats().then((stats) => {
        const list = [];
        stats.forEach((report) => list.push(report));
        return list;
      }, () => []);
    } catch {
      return Promise.resolve([]);
    }
  }

  function stopIceTimers() {
    clearTimeout(renewTimer);
    clearTimeout(iceRetryTimer);
    clearTimeout(expiryTimer);
  }

  // ---------------------------------------------------------------
  // Outbound queue (§4.6)
  // ---------------------------------------------------------------

  function send(to, type, payload) {
    if (!state.peer) return;
    // A target the hub has already said it does not have. Queueing for
    // it would buy one more 404 and one more recovery round each time,
    // and ICE alone produces a dozen candidates a renegotiation; the
    // roster is what settles this, and it clears the mark.
    if (stale.has(to)) return;
    const seq = (seqOut.get(to) || 0) + 1;
    seqOut.set(to, seq);
    const q = queue.get(to) || [];
    q.push({ seq, body: { peer: state.peer, type, to, seq, gen: gen.get(to) || 1, payload } });
    queue.set(to, q);
    pump(to);
  }

  // pump owns one POST at a time per target, in order, and does not
  // start the next message until this one is accepted. Every status the
  // wire contract names has its own arm here.
  //
  // §4.6's thirty seconds is an absolute deadline per message, stamped
  // when the message reaches the head of the queue and covering
  // everything that follows: the requests, the backoff between them,
  // and the 429s. Each of those used to be able to slip it (Codex
  // S2-6) — a 429 skipped the check entirely, a sleep could overshoot
  // it, and a fetch that never settled meant the check was never
  // reached at all — so a pair could sit "unreachable" for ever with
  // nothing rebuilding it. The fetch is aborted at the deadline for
  // that last one.
  async function pump(to) {
    if (inflight.has(to)) return;
    inflight.add(to);
    let wait = BACKOFF_MIN;
    try {
      for (;;) {
        const q = queue.get(to);
        if (!q || !q.length || state.stopped) return;
        const head = q[0];
        if (!head.deadline) head.deadline = Date.now() + SEND_DEADLINE;
        if (Date.now() >= head.deadline) {
          unreachable(to);
          return;
        }
        const res = await postSignal(head.body, { deadline: head.deadline });
        if (queue.get(to) !== q) return; // the queue was dropped underneath us
        // signedOut is read before the status, because it can be true
        // *of* a 200: an expired session answers 303 to /signin, fetch
        // follows it, and the sign-in page comes back 200 (Codex S2-8).
        if (res.signedOut) {
          terminal('signedout');
          return;
        }
        if (res.status === 200) {
          // Accepted by the hub, which is the only count worth having:
          // one taken at `send` counted candidates that a stale target
          // dropped on the spot and ones still sitting in a queue
          // nobody was pumping (Codex S3-12).
          if (head.body.type === 'candidate') {
            const entry = pcs.get(to);
            if (entry) entry.delivered += 1;
          }
          q.shift();
          wait = BACKOFF_MIN;
          continue;
        }
        if (res.status === 429) {
          // Retry-After is whole seconds, and the same message is
          // retried with the same seq — but never past this message's
          // own deadline.
          if (!(await waitWithin(retryAfter(res.retryAfter), head.deadline))) {
            unreachable(to);
            return;
          }
          continue;
        }
        if (res.status === 409) {
          if (res.data.error === 'stale') {
            // The pair moved on. Drop everything queued for this
            // target; a `pair` or the next roster rebuilds it, and if
            // the roster already knows a higher generation, use it now.
            queue.set(to, []);
            const known = rosterGen(to);
            if (known > (gen.get(to) || 0)) rebuildPC(to, known);
            else requestReset(to);
            return;
          }
          return; // `conflict` belongs to admit, which is not queued here
        }
        if (res.status === 404) {
          // The message's own deadline, not a fresh one: the diagnosis
          // and any reset it leads to are part of getting this message
          // delivered, and §4.6 gives that thirty seconds in total
          // (Codex S2-15).
          await recoverFromNotFound(res.data.boot, to, { deadline: head.deadline });
          return;
        }
        if (res.status === 400 || res.status === 413) {
          // Malformed, or over 64 KB: never retried. Drop that one
          // message and carry on with the rest of the queue — the next
          // one gets a deadline of its own, because this one was
          // answered.
          q.shift();
          wait = BACKOFF_MIN;
          continue;
        }
        if (!(await waitWithin(wait, head.deadline))) {
          unreachable(to);
          return;
        }
        wait = Math.min(wait * 2, BACKOFF_MAX);
      }
    } finally {
      inflight.delete(to);
      // A send() that arrived while this POST was in flight found the
      // pump busy and returned; and if the queue was replaced under
      // this loop, the loop returned rather than touching the new one.
      // Either way what is here now has no pump, so it gets this one.
      const rest = queue.get(to);
      if (!state.stopped && rest && rest.length) pump(to);
    }
  }

  // unreachable is §4.6's verdict on one target: the message at the head
  // of its queue never got through inside its deadline. Close the
  // connection, drop what was queued for it, and ask the hub for a fresh
  // generation — `pair` or the next roster builds it again.
  function unreachable(to) {
    queue.set(to, []);
    closePC(to, false);
    renderTiles();
    requestReset(to);
  }

  // ---------------------------------------------------------------
  // The broadcast lane (§4.3's chat and share)
  // ---------------------------------------------------------------
  //
  // `send` above is §4.6: per target, with a seq, a generation and a
  // pair to reset when it stops working. Chat and screen share are
  // neither targeted nor paired — the hub fans them out to every other
  // admitted peer and rebuilds the envelope itself — so they ride a
  // queue of their own under the sentinel key '*', with the same pump
  // discipline and none of §4.6's bookkeeping: no `to`, no `seq`, no
  // `gen` on the wire, and `stale`/`gen` mean nothing here.
  //
  // The one thing this lane has that the other does not is an answer:
  // the chat panel echoes a line into the log only when the hub took
  // it, so every message resolves exactly once, and only a 200 resolves
  // true.

  // broadcastBody is the whole wire shape of an untargeted message. It
  // is its own function because what is *not* in it is the contract:
  // any `to`, `seq` or `gen` here is a 400 from /signal.
  function broadcastBody(peer, type, payload) {
    return { peer, type, payload };
  }

  // broadcastVerdict reads one POST answer, in the wire contract's own
  // terms. Pure, so the node test can lift it by name.
  function broadcastVerdict(res) {
    // signedOut before the status, for the reason pump gives: an
    // expired session answers 303 to /signin and fetch follows it, so
    // the sign-in page comes back 200.
    if (res.signedOut) return 'signedout';
    if (res.status === 200) return 'sent';
    if (res.status === 429) return 'wait';
    if (res.status === 404) return 'recover';
    // 400 is a bug in this file, 413 is a message the server will never
    // take however often it is offered, and 409 belongs to the targeted
    // lane and cannot mean anything here. None of the three is retried.
    if (res.status === 400 || res.status === 413 || res.status === 409) return 'drop';
    // A 5xx, a network failure, or a status the contract does not name:
    // worth trying again inside the deadline.
    return 'retry';
  }

  // accepted is the answer the sender gets, and the only true in it is
  // a 200. chat.js echoes a line into the log on exactly `true` and on
  // nothing else, so anything looser here would put a message on the
  // screen that nobody received.
  function accepted(verdict) {
    return verdict === 'sent';
  }

  // recoveryDeadline is the budget a 404's diagnosis actually gets. The
  // message's own deadline, unless the POST that produced the 404 spent
  // it — a recovery with nothing left decides nothing, leaves the
  // participation unexamined, and the tab goes on looking live. Pure, so
  // the node test can lift it by name.
  function recoveryDeadline(deadline, now) {
    return Math.max(deadline, now + MIN_RECOVERY);
  }

  // broadcast queues one untargeted message and resolves when the hub
  // has answered for it: true if it was accepted, false for every other
  // ending, including a deadline that ran out with nothing decided.
  // `onStatus`, if given, hears the status of the answer that settled it
  // — the one thing the boolean cannot say, and what §15.20's report
  // needs to tell an old server's 400 from a network that failed.
  function broadcast(type, payload, onStatus) {
    if (!state.peer || state.stopped) return Promise.resolve(false);
    return new Promise((resolve) => {
      const q = queue.get(BROADCAST) || [];
      q.push({ body: broadcastBody(state.peer, type, payload), resolve, onStatus });
      queue.set(BROADCAST, q);
      runBroadcast();
    });
  }

  // runBroadcast is the fire-and-forget face of pumpBroadcast: nothing
  // awaits the pump, and a rejection escaping an async function nobody
  // awaits goes where neither a person nor a gate could see it. Same
  // shape as requestReset's, and as the share button's.
  function runBroadcast() {
    pumpBroadcast().catch((err) => {
      console.error('meet: chat', err);
    });
  }

  // pumpBroadcast is pump's discipline for the lane with no target: one
  // POST in flight, in order, each message with its own absolute thirty
  // seconds covering the requests, the backoff and the 429s.
  async function pumpBroadcast() {
    if (inflight.has(BROADCAST)) return;
    inflight.add(BROADCAST);
    let wait = BACKOFF_MIN;
    try {
      for (;;) {
        const q = queue.get(BROADCAST);
        if (!q || !q.length) return;
        if (state.stopped) {
          // Nothing more will be sent, and a sender waiting on a
          // promise that never settles is a chat box that never comes
          // back. Answer every one of them.
          drainBroadcast(q);
          return;
        }
        const head = q[0];
        if (!head.deadline) head.deadline = Date.now() + SEND_DEADLINE;
        if (Date.now() >= head.deadline) {
          // Out of time with nothing decided: the sender is told so, and
          // the next message in the lane starts on a budget of its own.
          settleBroadcast(q, false);
          wait = BACKOFF_MIN;
          continue;
        }
        const res = await postSignal(head.body, { deadline: head.deadline });
        if (queue.get(BROADCAST) !== q) return; // the queue was dropped underneath us
        const verdict = broadcastVerdict(res);
        if (verdict === 'signedout') {
          drainBroadcast(q);
          terminal('signedout');
          return;
        }
        if (verdict === 'sent' || verdict === 'drop') {
          if (typeof head.onStatus === 'function') head.onStatus(res.status);
          settleBroadcast(q, accepted(verdict));
          wait = BACKOFF_MIN;
          continue;
        }
        if (verdict === 'recover') {
          // The participation is gone, or was never admitted. Nothing
          // queued here can be delivered by anyone, so every sender is
          // answered before the probe-first diagnosis decides what this
          // tab does next — with no target to pass it, because a
          // fan-out message never had one.
          queue.set(BROADCAST, []);
          drainBroadcast(q);
          await recoverFromNotFound(res.data.boot, null, {
            deadline: recoveryDeadline(head.deadline, Date.now()),
          });
          return;
        }
        const ms = verdict === 'wait' ? retryAfter(res.retryAfter) : wait;
        if (!(await waitWithin(ms, head.deadline))) {
          settleBroadcast(q, false);
          wait = BACKOFF_MIN;
          continue;
        }
        if (verdict !== 'wait') wait = Math.min(wait * 2, BACKOFF_MAX);
      }
    } finally {
      inflight.delete(BROADCAST);
      const rest = queue.get(BROADCAST);
      if (rest && rest.length) {
        // Something was queued while this pump was busy — during the
        // 404's diagnosis, most of the time, which is the one arm that
        // returns while the tab may still be alive. If that diagnosis
        // ended the session there is nobody left to send it, and a
        // sender left holding a promise that never settles is a composer
        // that never comes back; otherwise it gets this pump.
        if (state.stopped) drainBroadcast(rest);
        else runBroadcast();
      }
    }
  }

  // settleBroadcast answers the message at the head of the lane and
  // drops it.
  function settleBroadcast(q, ok) {
    const head = q.shift();
    if (head && head.resolve) head.resolve(ok);
  }

  // drainBroadcast answers everything still queued with false: the lane
  // is finished, and nothing in it was delivered.
  function drainBroadcast(q) {
    while (q.length) settleBroadcast(q, false);
  }

  function rosterGen(id) {
    if (!lastRoster) return 0;
    for (const rp of lastRoster.peers || []) if (rp.peer === id) return rp.gen || 0;
    return 0;
  }

  function retryAfter(header) {
    const n = parseInt(header || '', 10);
    return Number.isFinite(n) && n > 0 ? Math.min(n, 30) * 1000 : 1000;
  }

  function sleep(ms) {
    return new Promise((resolve) => setTimeout(resolve, ms));
  }

  // waitWithin sleeps for ms, or until the deadline, whichever comes
  // first, and answers whether there is any budget left afterwards. A
  // backoff is not allowed to be the reason a deadline is missed.
  async function waitWithin(ms, deadline) {
    const left = deadline - Date.now();
    if (left <= 0) return false;
    await sleep(Math.min(ms, left));
    return Date.now() < deadline;
  }

  // postSignal is the one place this file talks upstream. csrf.Protect
  // is origin-based, so a same-origin fetch needs no token.
  //
  // `deadline` is an absolute instant, not a duration: a request that
  // has not settled by then is aborted, so a hanging fetch cannot hold
  // a queue open past the moment its caller had promised to give up
  // (Codex S2-6). An aborted fetch throws, and lands on the same
  // status 0 as any other network failure — which the caller then reads
  // as "out of budget" on its next pass.
  async function postSignal(body, opts) {
    const o = opts || {};
    const path = '/m/' + encodeURIComponent(sqid) + '/signal';
    let stop = 0;
    let controller = null;
    if (o.deadline && typeof AbortController === 'function') {
      controller = new AbortController();
      stop = setTimeout(() => controller.abort(), Math.max(0, o.deadline - Date.now()));
    }
    try {
      const res = await fetch(path, {
        method: 'POST',
        credentials: 'same-origin',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify(body),
        keepalive: !!o.keepalive,
        signal: controller ? controller.signal : undefined,
      });
      return await readRefusal(res, 200, path);
    } catch {
      return { status: 0, data: {}, signedOut: false, retryAfter: null };
    } finally {
      if (stop) clearTimeout(stop);
    }
  }

  // requestReset is the fire-and-forget face of resetPair: every caller
  // asks for a reset and carries on, and a rejection escaping an async
  // function nobody awaits would go where neither a person nor a gate
  // could see it. Same shape as the pageshow handler's.
  function requestReset(to, budget) {
    resetPair(to, budget).catch((err) => {
      console.error('meet: reset', err);
    });
  }

  // resetPair asks the hub for a fresh generation with this target.
  // The answer used to be discarded (Codex S2-5), so a 429 or a 5xx
  // lost the reset silently — and the reset that follows an outbound
  // deadline is the only thing that rebuilds a connection this browser
  // has just closed, which left the pair down with nothing coming to
  // fix it. Bounded by the same thirty seconds one queued message gets,
  // and by the same rules: Retry-After on a 429, doubling backoff on
  // the transient failures, terminal on a session that has been signed
  // out, and the 404 ladder.
  async function resetPair(to, budget) {
    const peer = state.peer;
    if (!peer) return;
    // One reset per target at a time. Two in flight can only ask the hub
    // for two generations, and the second is stale before it is sent.
    if (resetting.has(to)) return;
    resetting.add(to);
    try {
      await resetLoop(to, peer, budget || Date.now() + SEND_DEADLINE);
    } finally {
      resetting.delete(to);
    }
  }

  async function resetLoop(to, peer, deadline) {
    let wait = BACKOFF_MIN;
    for (;;) {
      if (state.stopped || state.peer !== peer) return;
      if (Date.now() >= deadline) {
        // The budget this reset inherited is spent. One more POST would
        // be a request made outside the deadline that was supposed to
        // cover it, and the target has to be released either way
        // (Codex S2-17): the roster is what settles it now.
        staleTarget(to, true, deadline);
        return;
      }
      const res = await postSignal({ peer, type: 'reset', to }, { deadline });
      if (res.signedOut) {
        terminal('signedout');
        return;
      }
      if (res.status === 200) return;
      if (res.status === 404) {
        // Whatever this 404 turns out to be, it is not worth another
        // reset: `fromReset` is what stops the cycle, and the budget is
        // the same one, not a fresh thirty seconds (Codex S2-11).
        await recoverFromNotFound(res.data.boot, to, { deadline, fromReset: true });
        return;
      }
      if (res.status !== 429 && res.status !== 0 && res.status < 500) {
        // 400, 409 and anything else the contract names: a reset that
        // is refused on its merits is not retried. The roster is the
        // other way this pair converges (§4.6).
        return;
      }
      const ms = res.status === 429 ? retryAfter(res.retryAfter) : wait;
      wait = Math.min(wait * 2, BACKOFF_MAX);
      // As in the diagnosis: round the loop, and let the check at the
      // top be the one place a spent budget is answered.
      await waitWithin(ms, deadline);
    }
  }

  // recoverFromNotFound is a 404 from either endpoint. It used to read
  // as "this participation no longer exists" and close everything, but
  // a 404 from `/signal` says no such thing (Codex S2-3): the *target*
  // may simply have left, which is the ordinary case while this
  // browser's own stream is down and the `gone` event cannot reach it.
  // Acting on that as if it were our own ending closed a live call and
  // then met a 409 from our own still-live participation, and showed a
  // takeover screen for a tab that does not exist.
  //
  // So the sender's own participation is probed, and that is the
  // authority: 204 keeps the call and lets the next roster reconcile
  // the target; 410 is terminal with the reason the tombstone carries;
  // 404 — and only 404 — is the fresh-entry ladder, which is what this
  // function always was.
  //
  // A 429 or a 5xx from the probe proves nothing either way, and used
  // to fall through to the fresh-entry ladder and re-create exactly the
  // failure above (Codex S2-12). It is retried instead, on the stream's
  // own backoff, inside one budget shared with whatever asked for the
  // diagnosis — a recovery that cannot get an answer inside thirty
  // seconds leaves the participation alone and lets the stream ladder,
  // which is running anyway, be the thing that decides.
  async function recoverFromNotFound(boot, to, opts) {
    const o = opts || {};
    const deadline = o.deadline || Date.now() + SEND_DEADLINE;
    if (state.stopped) return;
    if (boot) state.boot = boot;
    const peer = state.peer;
    if (!peer) {
      enterAfresh();
      return;
    }
    const path = '/m/' + encodeURIComponent(sqid) + '/stream?probe=1&peer=' + encodeURIComponent(peer);
    let wait = BACKOFF_MIN;
    for (;;) {
      if (Date.now() >= deadline) {
        // Out of budget with nothing decided. The participation is left
        // alone — nothing here proved anything about it — but the target
        // this recovery was for is treated as stale, so the queue is
        // dropped and the in-flight mark released rather than held by a
        // diagnosis that is never going to answer (Codex S2-15). The
        // next roster settles it.
        staleTarget(to, true, deadline);
        return;
      }
      let res;
      try {
        res = await probe(path, deadline);
      } catch {
        // The probe could not be made at all: the same "nothing is
        // proved" as a 5xx, and treated the same way.
        res = { status: 0, data: {}, signedOut: false, retryAfter: null };
      }
      if (state.stopped || state.peer !== peer) return;
      if (refused(res)) return;
      if (res.status === 410) {
        terminal(res.data.reason || 'ended');
        return;
      }
      if (res.status === 204) {
        staleTarget(to, !!o.fromReset, deadline);
        return;
      }
      if (res.status === 404) {
        enterAfresh();
        return;
      }
      // 429, 5xx, a network failure, or a status the contract does not
      // name: try the diagnosis again rather than acting on it.
      const ms = res.status === 429 ? retryAfter(res.retryAfter) : wait;
      wait = Math.min(wait * 2, STREAM_BACKOFF_MAX);
      // Deliberately not a `return` when the budget runs out here: the
      // loop goes round and the check at the top is the one exit for an
      // exhausted diagnosis, so it cannot be reached without releasing
      // the target (Codex S2-17). Returning straight from this line left
      // the queue intact, the pump's `finally` restarted it, its expired
      // head called `unreachable`, and that opened a reset with a fresh
      // thirty seconds — the bounded recovery this whole path exists to
      // be. `waitWithin` does not sleep when there is nothing left, so
      // this is not a spin.
      await waitWithin(ms, deadline);
    }
  }

  // staleTarget is what a 404 means once the probe has said this
  // browser's own participation is fine: the peer we were writing to has
  // gone, and our roster has not caught up. Nothing queued for it can be
  // delivered, and nothing new may be queued until a roster settles it.
  //
  // The single reset is worth asking for once, while the roster still
  // lists the target, because a `pair` is how a live peer that merely
  // lost its own participation comes back. Asking again after that reset
  // has itself been answered 404 is the cycle S2-11 found — twelve
  // rounds and counting — so `fromReset` skips straight to closing the
  // connection and waiting for the roster, which recreates it through
  // `reconcile` if the peer is still there.
  function staleTarget(to, fromReset, deadline) {
    if (!to) return;
    queue.set(to, []);
    const first = !stale.has(to);
    stale.add(to);
    if (first && !fromReset && rosterGen(to)) {
      // The same budget again: one message, one thirty seconds, however
      // many requests it takes to settle (Codex S2-15).
      requestReset(to, deadline);
      return;
    }
    closePC(to, false);
    renderTiles();
  }

  // enterAfresh is the fresh-entry ladder: drop every connection, forget
  // the peer, and open a new stream. `boot` has already been recorded by
  // the caller, so the fresh stream starts from the right one.
  function enterAfresh() {
    if (state.stopped) return;
    closeStream();
    closeAllPCs();
    state.peer = null;
    connectStream();
  }

  // ---------------------------------------------------------------
  // Chat (§6) and screen share (§5.4)
  // ---------------------------------------------------------------
  //
  // The panel is chat.js's: it owns the log, the composer, the two
  // sentences it can say and every word on a line. This file owns four
  // things about it — the wire underneath it, the name on the local
  // echo, when it appears, and when it is usable — and nothing else.
  // Nothing below reads inside `#chat`.
  //
  // Screen share is §5.4 in full: one display capture, carried to every
  // connection on a `sendonly` transceiver of its own so the camera
  // m-line is untouched, announced with a `share` message so the far
  // side can label the tile before the track lands, and stopped by
  // stopping the transceiver — which ends the receiver's track rather
  // than leaving a frozen last frame on the screen.

  const SHARE_REFUSED = 'Screen sharing was not allowed.';

  // mountChat hands chat.js the panel and the one thing it cannot know:
  // how to put a line on the wire. It is called on admission and on the
  // first arriving message, whichever comes first — a `chat` can be
  // fanned out to us while §5.2's fetch still has our own roster
  // waiting behind it, and a message that reached this tab is a message
  // a person should see.
  //
  // Un-hiding is this file's job and not the panel's: `mount` never
  // touches `hidden`, because when a panel is usable is the host's
  // fact. And it is only un-hidden if chat.js is actually here — a
  // visible composer with no script behind it would submit its form and
  // navigate away from the call.
  function mountChat() {
    if (chat) return chat;
    if (!chatEl || !window.Chat || typeof window.Chat.mount !== 'function') return null;
    // chat.js answers a root it cannot use with a working no-op rather
    // than a throw, which is right for it and wrong to trust here: an
    // un-hidden panel backed by a no-op is a composer that swallows
    // everything typed into it in silence. These are the three elements
    // its own mount requires, so this is the same question asked before
    // the answer stops being distinguishable.
    if (!chatEl.querySelector('[data-chat-log]') ||
        !chatEl.querySelector('[data-chat-form]') ||
        !chatEl.querySelector('[data-chat-text]')) {
      return null;
    }
    const panel = window.Chat.mount(chatEl, { name: selfName, send: sendChat });
    if (!panel) return null;
    chat = panel;
    chatEl.hidden = false;
    chat.setEnabled(!!state.admitted && !state.stopped);
    return chat;
  }

  // chatEnabled is the panel's gate, and it moves with admission: the
  // roster turns it on, terminal and leave turn it off. It is not the
  // same thing as `hidden` — a panel that has been usable stays
  // readable after the call ends.
  function chatEnabled(on) {
    if (!chat) return;
    chat.setEnabled(!!on);
  }

  // sendChat is the panel's `send`: chat.js hands it text it has
  // already trimmed and measured, and reads back a strict boolean. True
  // is the only answer that echoes the line into the log, so anything
  // this file is unsure about has to be false.
  async function sendChat(text) {
    const ok = await broadcast('chat', { text });
    if (ok === true) chatSent += 1;
    return ok === true;
  }

  // onChat renders one arrived message (§6). The name comes from the
  // envelope and from nowhere else: the hub put the sender's own name
  // on it, and a peer that is not in this tab's roster — one admitted
  // while our own roster was in flight — is still someone the hub says
  // is in the room. The text is re-validated as a string here, because
  // what reaches `append` reaches the DOM.
  function onChat(msg) {
    // Validated before anything is built: a malformed message is not a
    // reason to put a panel on the screen.
    const text = msg.payload && msg.payload.text;
    if (typeof text !== 'string' || !text) return;
    const panel = mountChat();
    if (!panel) return;
    chatReceived += 1;
    panel.append({
      from: msg.from || '',
      name: msg.name || '',
      text,
      at: Date.now(),
      self: false,
    });
  }

  // onShare is the label arriving ahead of the media, or the removal
  // arriving ahead of the track's own `ended` — §5.4 says whichever
  // comes first wins, and both endings meet in dropShare.
  function onShare(msg) {
    const from = msg.from;
    const entry = from ? pcs.get(from) : null;
    if (!entry) return;
    const on = !!(msg.payload && msg.payload.on === true);
    if (!on) {
      dropShare(entry);
      return;
    }
    entry.sharing = true;
    renderTiles();
  }

  // shareKey is the tile key a peer's screen gets: the peer's own key
  // with a suffix that no peer id can carry, so one peer holds two
  // tiles and every map keyed by tile key — `tiles`, `frames` — keeps
  // them apart without a second structure.
  function shareKey(id) {
    return id + SHARE_SUFFIX;
  }

  // classifyTrack tells a peer's screen from its camera, which is the
  // one judgement §5.4's receiving half turns on. Pure, and lifted by
  // name in the node test.
  //
  //   known  what this connection has recorded: cameraMid, cameraStream,
  //          peerStream, sharing
  //   info   the arriving track: {kind, streamId, mid, direction},
  //          direction being the transceiver's currentDirection
  //   self   this tab: {hasVideo}, a live local video track
  //
  // "The first video track is the camera" is the rule this started as,
  // and it is wrong for one sender that really exists: the audio-only
  // rung of startLocal. A peer whose camera was in use or absent has no
  // camera m-line at all, so its *screen* is the first video track its
  // peers ever see, and the rule would caption it as a face.
  //
  // So four signals, strongest first.
  //
  // 1. The transceiver's direction. This connection builds a video
  //    m-line of its own — sendrecv when it is sending a camera,
  //    recvonly when it has none to send — so a video track arriving
  //    `recvonly` on a connection that *is* sending a camera is a track
  //    on an m-line the far side added, and the only m-line it adds is
  //    the screen.
  // 2. The camera's own mid, once one is known. Assigned once, and it
  //    survives every renegotiation and ICE restart.
  // 3. The camera's stream id, for a browser that reports no mid.
  // 4. The stream everything else from this peer has arrived in. A
  //    sender puts its camera and its microphone in one MediaStream and
  //    its screen in another, so a video track in a *different* stream
  //    from the peer's audio is the screen even when no camera has ever
  //    arrived — which is the audio-only sharer above.
  //
  // And, when none of the four can speak — a peer that has sent nothing
  // else at all — `sharing`, the `share {on:true}` message, breaks the
  // tie. It is last on purpose: it says this peer is showing a screen
  // somewhere, not that *this* track is it.
  //
  // One hole is left, and it is left knowingly. A peer that joined with
  // no camera *and* no microphone — startLocal's bottom rung, where
  // getUserMedia gave nothing at all — has sent this connection nothing
  // before its screen, so there is no camera mid, no camera stream and
  // no peer stream, and if this tab has no camera either the direction
  // says nothing. Everything then rests on the `share` message, which is
  // sent before the track and is what the tiebreaker reads. If that
  // message were ever lost, that peer's screen would be captioned as its
  // face. Nothing in §4.3 loses it — a fan-out message is delivered to
  // an admitted peer or the sender is told it failed — so the hole is a
  // consequence of the wire, not of this judgement.
  function classifyTrack(known, info, self) {
    if (info.kind !== 'video') return 'audio';
    if (info.direction === 'recvonly' && self.hasVideo) return 'share';
    if (known.cameraMid && info.mid) return info.mid === known.cameraMid ? 'camera' : 'share';
    if (known.cameraStream && info.streamId) {
      return info.streamId === known.cameraStream ? 'camera' : 'share';
    }
    if (known.peerStream && info.streamId) {
      return info.streamId === known.peerStream ? 'camera' : 'share';
    }
    if (!known.cameraMid && !known.cameraStream) return known.sharing ? 'share' : 'camera';
    // A camera is known but there is nothing on this track to compare
    // with it: a second video track is the screen.
    return 'share';
  }

  // onRemoteTrack is the `track` handler's whole body. A camera track
  // goes on the peer's own tile, exactly as it always did; a screen
  // goes on a tile of its own and leaves the camera alone.
  function onRemoteTrack(id, entry, ev) {
    const track = ev.track;
    const stream = (ev.streams && ev.streams.length && ev.streams[0]) || null;
    const mid = (ev.transceiver && ev.transceiver.mid) || '';
    const tx = ev.transceiver;
    const what = classifyTrack(entry, {
      kind: track.kind,
      streamId: (stream && stream.id) || '',
      mid,
      // currentDirection is the negotiated one and the one to believe —
      // but it is null until an *answer* has been applied, so on the
      // side that answers an offer it says nothing at all, which is
      // exactly the side a screen arrives at. `direction` is what the
      // browser set when it built the transceiver, and a transceiver
      // built by setRemoteDescription for an m-line the far side added
      // is recvonly. Falling back to it is what makes the rule work in
      // both roles.
      direction: (tx && (tx.currentDirection || tx.direction)) || '',
    }, { hasVideo: !!entry.sentVideo });
    if (what === 'share') {
      entry.sharing = true;
      entry.shareMid = mid || entry.shareMid;
      // The stream a tile shows is this file's own, kept for the life
      // of the entry, and what goes in it is decided here (Codex S4-9).
      // A remote stream is a thing the far side composes: it can carry
      // the old track and the new one at once, in whatever order, and
      // binding a tile to "its first video track" then shows whichever
      // happens to be first. So the role owns a stream, the role's
      // authoritative track goes in it, and nothing else of that kind
      // stays behind.
      const held = (entry.share && entry.share.stream) || new MediaStream();
      entry.share = { stream: held, track };
      entry.shareTrack = track;
      adoptTrack(held, track);
      // §5.4's first ending: the sender stopped the transceiver, so
      // this track ends rather than freezing. The listener is dropped
      // with the connection, and dropShare is idempotent, so the `share
      // {on:false}` that usually arrives alongside it costs nothing.
      //
      // Only for the screen that is still showing, though (Codex
      // S4-15). A screen can be *replaced* on its own mid — the far
      // side rebuilding it, or a rollback doing it for them — and the
      // predecessor ends afterwards, as a superseded track does. Its
      // listener is still on the connection, and without this it took
      // the live replacement's tile away with it.
      track.addEventListener('ended', () => {
        if (pcs.get(id) !== entry) return;
        if (!entry.share || entry.share.track !== track) return;
        dropShare(entry);
      });
      renderTiles();
      return;
    }
    if (what === 'camera') {
      // Recorded from the first video track and never revised: this is
      // what every later video track is judged against.
      if (mid) entry.cameraMid = mid;
      if (stream) entry.cameraStream = stream.id;
      // The authoritative camera track, which is what the tile binds
      // to. A replacement arriving on the same mid supersedes its
      // predecessor whether or not the predecessor has ended.
      entry.cameraTrack = track;
    }
    // Recorded from the first track of any kind, camera or microphone:
    // it is what places a video track for a peer that has no camera.
    if (stream && !entry.peerStream) entry.peerStream = stream.id;
    // This tile's own stream, again: the remote one is only ever read
    // for its id. Audio and video are kept apart by `adoptTrack`, so a
    // camera replacing a camera leaves the microphone alone.
    entry.stream = entry.stream || new MediaStream();
    adoptTrack(entry.stream, track);
    renderTiles();
  }

  // adoptTrack makes one arriving track *the* track of its kind in the
  // stream a tile shows: every other track of that kind comes out,
  // whatever its readyState, and this one goes in. Pure enough to lift
  // by name, and gated in the node test.
  //
  // This is the receiving half of the rollback damage, and its first
  // draft got the rule wrong (Codex S4-9). Chromium rebuilds every
  // stream on a connection when it rolls back an offer that added an
  // m-line — receive streams included — so the far side's camera
  // arrives again as a *new* track, sometimes with no stream of its own
  // and sometimes inside the very stream that still holds the old one.
  // The old one is not necessarily `ended`: a receiver can be
  // superseded while its track is still live and simply never carries
  // another frame. Pruning only ended tracks therefore left the stream
  // holding [old, new], and a media element renders the first track of
  // its kind — a face that never moves again on a connection that is
  // otherwise perfect: connected, stable, sendrecv, and decoding
  // hundreds of frames nobody can see.
  //
  // Which track is authoritative is `onRemoteTrack`'s judgement, not
  // this function's: classifyTrack has already said whether this is the
  // camera or the screen, and each role owns a stream of its own. So
  // there is no ordering question left here, and none of "is the old
  // one finished with" either. Audio is a kind of its own and is
  // untouched by a video track arriving.
  function adoptTrack(stream, track) {
    if (!stream || !track) return stream;
    for (const old of stream.getTracks()) {
      if (old !== track && old.kind === track.kind) stream.removeTrack(old);
    }
    if (!stream.getTracks().includes(track)) stream.addTrack(track);
    return stream;
  }

  // shownTrack is the video track a tile is actually rendering: the
  // first one in the stream. The tile follows it, not just the stream
  // object, because the two can change independently.
  function shownTrack(stream) {
    if (!stream || !stream.getVideoTracks) return null;
    return stream.getVideoTracks()[0] || null;
  }

  // dropShare removes one peer's screen, from either ending. The frame
  // count is deliberately left behind: it says the screen was really
  // arriving before it went away, which is exactly what a gate watching
  // a stop needs to be able to see afterwards.
  function dropShare(entry) {
    if (!entry.sharing && !entry.share) return;
    entry.sharing = false;
    entry.share = null;
    entry.shareMid = '';
    renderTiles();
  }

  // hasShare: this peer holds a share tile. The message alone is enough
  // — it beats the media by a renegotiation — so the tile can carry the
  // label before there is anything to show in it.
  function hasShare(entry) {
    return !!(entry.sharing || entry.share);
  }

  function shareCaption(name) {
    return name + '’s screen';
  }

  // startSharing is the button's on half. The capture is asked for
  // first: a person who changes their mind at the browser's own picker
  // has shared nothing, and nothing should have been announced.
  async function startSharing() {
    if (share || sharePending || state.stopped || !HAS_DISPLAY_MEDIA) return;
    // The picker is open for as long as a person takes to answer it, and
    // the button is live the whole time. Without this a second click
    // starts a second capture: the peers would be watching the first,
    // `share` would point at the second, and Off would stop only the one
    // nobody could see — leaving a screen being sent that this tab no
    // longer believes in.
    sharePending = true;
    let stream;
    try {
      stream = await navigator.mediaDevices.getDisplayMedia({ video: true, audio: false });
    } catch {
      // Refused at the picker, or not permitted by policy. One
      // sentence, and no diagnosis of which.
      say(SHARE_REFUSED);
      return;
    } finally {
      sharePending = false;
    }
    const track = stream.getVideoTracks()[0];
    // Read again on this side of the await: a capture that arrives after
    // the call ended, or after some other path started one, is a capture
    // nothing will ever stop unless it is stopped here.
    if (!track || share || state.stopped) {
      stopStream(stream);
      return;
    }
    share = { stream, track };
    try {
      track.contentHint = sharePlan(shareMode()).contentHint;
    } catch {
      // A browser without contentHint: the sender's degradation
      // preference below says the same thing.
    }
    // The browser's own "Stop sharing" bar ends the track without
    // telling this file anything else. §5.4 gives it the same ending as
    // the button.
    track.addEventListener('ended', () => stopSharing());
    for (const entry of pcs.values()) addShareTo(entry);
    renderShare();
    // The label, not the media: peers use it to draw the tile before
    // the renegotiation lands, and the track carries no name of its own.
    broadcast('share', { on: true });
  }

  // addShareTo gives one connection the display track on a transceiver
  // of its own. `sendonly` and a stream of its own is what keeps it
  // clear of the camera at the far end, and adding it fires
  // `negotiationneeded`, so §5.1's perfect negotiation carries the
  // offer with no help from here.
  function addShareTo(entry) {
    if (!share || !entry || entry.shareTx) return;
    // Only on a stable connection. A transceiver added mid-negotiation
    // is unassociated when the far side's offer arrives, and m-line
    // matching will hand it that offer's m-line — so two peers sharing
    // at the same moment end up with each one's screen in the place the
    // other built for its own. The connection's own signalingstatechange
    // brings this back the moment it settles, which is where every
    // deferred one is added.
    if (entry.pc.signalingState !== 'stable') return;
    try {
      entry.shareTx = entry.pc.addTransceiver(share.track, {
        direction: 'sendonly',
        streams: [share.stream],
      });
      tuneShare(entry);
    } catch {
      // A browser without addTransceiver, or a connection already
      // closing: that peer simply never sees this screen, and the call
      // carries on.
    }
  }

  // stopSharing is the off half, and every way out uses it: the button,
  // the browser's own stop bar, and the end of the call.
  function stopSharing() {
    if (!share) return;
    const held = share;
    share = null;
    for (const entry of pcs.values()) removeShareFrom(entry);
    renderShare();
    broadcast('share', { on: false });
    // Last, so the transceivers are stopped and the message is queued
    // before the capture goes: stopping the track first would fire its
    // own `ended` into a path that has already run.
    stopStream(held.stream);
  }

  // stopStream ends a capture, whether it was ever used or not.
  function stopStream(stream) {
    if (!stream) return;
    for (const t of stream.getTracks()) {
      try {
        t.stop();
      } catch {
        // Already stopped.
      }
    }
  }

  // removeShareFrom ends one connection's share m-line. `stop()` is
  // §5.4's own instruction and the only one that makes the receiver's
  // track *end*; the fallback is for a browser whose transceivers
  // cannot be stopped, where nulling the sender and removing it at
  // least stops the media and renegotiates.
  //
  // Only ever this connection's own share transceiver, which fix round 2
  // pins with a test: a camera that stopped encoding was that round's
  // whole hunt, and `removeTrack` on the wrong sender is one of the two
  // ways this file could have done that to itself.
  function removeShareFrom(entry) {
    const tx = entry.shareTx;
    if (!tx) return;
    entry.shareTx = null;
    tuneShare(entry);
    try {
      if (typeof tx.stop === 'function') {
        tx.stop();
        return;
      }
    } catch {
      // Fall through to the older way.
    }
    try {
      const sender = tx.sender;
      if (!sender) return;
      if (typeof sender.replaceTrack === 'function') {
        const replaced = sender.replaceTrack(null);
        if (replaced && typeof replaced.catch === 'function') replaced.catch(() => {});
      }
      entry.pc.removeTrack(sender);
    } catch {
      // A connection that is closing: there is nothing left to remove.
    }
  }

  // renderShare moves the button's state three ways and never by
  // colour, exactly as the other two toggles do: aria-pressed, the word
  // in the button, and calls.css's inset outline.
  function renderShare() {
    if (!shareButton) return;
    shareButton.setAttribute('aria-pressed', String(!!share));
    if (shareState) shareState.textContent = share ? 'On' : 'Off';
    if (shareNotice) shareNotice.hidden = !share;
    if (shareRecoveryEl) {
      const text = share ? shareRecovery : '';
      shareRecoveryEl.textContent = text;
      shareRecoveryEl.hidden = !text;
    }
  }

  // sharingPeers: the peers holding a share tile, for the gate.
  function sharingPeers() {
    const out = [];
    for (const [id, entry] of pcs) if (hasShare(entry)) out.push(id);
    return out;
  }

  // ---------------------------------------------------------------
  // Media state (§15.19): who is muted, whose camera is off
  // ---------------------------------------------------------------
  //
  // State, not an event. The hub keeps each peer's last report and puts
  // it in every roster, so what a tile shows is always the roster's word
  // or a `media` since; nothing here is replayed or reconstructed. A
  // peer that never reports — a client from before this — is unknown,
  // and unknown is drawn as neither muted nor camera-off.

  // mediaFrom accepts the two booleans and nothing looser, for a roster
  // entry or a `media` payload alike: either is missing or not a
  // boolean, and the whole report is unknown. §15.20's two optional keys
  // are read more forgivingly, because they are news about hearing and
  // not about who is muted: an `audioBlocked` that is not exactly true,
  // or a `noSoundFrom` entry that is not a peer id, is dropped on its
  // own and the rest of the report stands. Pure, and lifted by name in
  // the node test.
  function mediaFrom(value) {
    if (!value || typeof value !== 'object') return null;
    if (typeof value.muted !== 'boolean' || typeof value.cameraOff !== 'boolean') return null;
    const out = { muted: value.muted, cameraOff: value.cameraOff };
    if (value.audioBlocked === true) out.audioBlocked = true;
    if (Array.isArray(value.noSoundFrom)) {
      const ids = [];
      for (const id of value.noSoundFrom) {
        if (ids.length >= 15) break;
        if (typeof id === 'string' && /^[0-9a-f]{32}$/.test(id) && !ids.includes(id)) ids.push(id);
      }
      if (ids.length) out.noSoundFrom = ids;
    }
    if (Array.isArray(value.screenStalled)) {
      const ids = [];
      for (const id of value.screenStalled) {
        if (ids.length >= 15) break;
        if (typeof id === 'string' && /^[0-9a-f]{32}$/.test(id) && !ids.includes(id)) ids.push(id);
      }
      if (ids.length) out.screenStalled = ids;
    }
    // §15.24: kept even when empty — [] is "I hear nobody yet", where an
    // absent list is a client that does not say.
    if (Array.isArray(value.hearing)) {
      const ids = [];
      for (const id of value.hearing) {
        if (ids.length >= 15) break;
        if (typeof id === 'string' && /^[0-9a-f]{32}$/.test(id) && !ids.includes(id)) ids.push(id);
      }
      out.hearing = ids;
    }
    return out;
  }

  function sameMedia(a, b) {
    return !!a && !!b && mediaKey(a) === mediaKey(b);
  }

  // mediaKey is one string per distinct report, the optional keys
  // included, so a change in what this tab can hear is a change that is
  // sent. The list is sorted here: the same peers in another order are
  // the same report.
  function mediaKey(m) {
    let key = (m.muted ? 'm' : '-') + (m.cameraOff ? 'c' : '-');
    if (m.audioBlocked) key += 'b';
    if (m.noSoundFrom && m.noSoundFrom.length) key += ':' + m.noSoundFrom.slice().sort().join(',');
    if (m.screenStalled && m.screenStalled.length) key += '/' + m.screenStalled.slice().sort().join(',');
    if (Array.isArray(m.hearing)) key += '|' + m.hearing.slice().sort().join(',');
    return key;
  }

  // localMedia is what this tab is actually sending. No microphone at
  // all is muted as far as anyone listening can tell, and no camera is
  // off; the preference alone would claim a microphone that is not there.
  function localMedia() {
    const hasAudio = !!(local && local.getAudioTracks().length);
    const hasVideo = !!(local && local.getVideoTracks().length);
    return { muted: !!prefs.muted || !hasAudio, cameraOff: !!prefs.cameraOff || !hasVideo };
  }

  // mediaPayload is the report itself: §15.19's two booleans, and
  // §15.20's two keys only when they carry bad news. §15.24's `hearing`
  // is the exception, and travels whenever it is given, [] included: it
  // is good news, and its presence tells the others this tab says who it
  // hears. `plain` is a server that has refused the extras once. Pure,
  // and lifted by name in the node test.
  function mediaPayload(mine, blocked, silentFrom, plain, stalled, heard) {
    const out = { muted: !!mine.muted, cameraOff: !!mine.cameraOff };
    if (plain) return out;
    if (blocked) out.audioBlocked = true;
    if (silentFrom && silentFrom.length) out.noSoundFrom = silentFrom.slice(0, 15);
    // §15.21: whose screens have stalled here, bad news only, like the rest.
    if (stalled && stalled.length) out.screenStalled = stalled.slice(0, 15);
    if (Array.isArray(heard)) out.hearing = heard.slice(0, 15);
    return out;
  }

  // reportMedia puts our state on the broadcast lane, once per change,
  // and only once admitted: before that the hub refuses it, and the
  // roster that admits us is where it is sent from. A refusal forgets
  // what was sent, so the next toggle or roster tries again — which
  // against a server from before §15.19 is a quiet 400 each time.
  //
  // A 400 for a report that carried §15.20's keys is a server from
  // between the two, and the answer is to stop sending them and say the
  // two booleans at once, for the rest of this page's life: being heard
  // as muted or not matters more than being heard as unable to hear.
  function reportMedia() {
    if (!state.admitted || state.stopped || !state.peer) return;
    const now = mediaPayload(localMedia(), audioBlocked, noSoundList(), !mediaExtras, screenStalled, hearingList());
    const key = mediaKey(now);
    if (key === mediaSent) return;
    mediaSent = key;
    const extras = key !== mediaKey(mediaPayload(now, false, null, true));
    let fallBack = false;
    broadcast('media', now, (status) => {
      if (status === 400 && extras && mediaExtras) {
        mediaExtras = false;
        fallBack = true;
      }
    }).then((ok) => {
      if (!ok && mediaSent === key) mediaSent = '';
      if (fallBack) reportMedia();
    });
  }

  // rosterMedia takes a roster's word on everybody's media. On ours as
  // well: missing is a participation the hub has never heard from — a
  // fresh join, or a restart — and different is a report lost while the
  // stream was down, and either way it is told again.
  function rosterMedia(roster) {
    for (const rp of roster.peers || []) {
      if (!rp || !rp.peer) continue;
      if (rp.peer !== state.peer) {
        learnMedia(rp.peer, rp.media);
        continue;
      }
      const now = mediaPayload(localMedia(), audioBlocked, noSoundList(), !mediaExtras, screenStalled, hearingList());
      mediaSent = sameMedia(mediaFrom(rp.media), now) ? mediaKey(now) : '';
    }
    reportMedia();
  }

  // learnMedia records a roster's or a peer event's word on one peer.
  // Absent is unknown, and forgets anything older: the roster is the
  // authority, and a participation that has not reported has not.
  function learnMedia(id, value) {
    const m = mediaFrom(value);
    if (m) remoteMedia.set(id, m);
    else remoteMedia.delete(id);
  }

  // onMedia is one peer's change. Only a peer we hold a connection to
  // is drawn; the roster will carry the rest.
  function onMedia(msg) {
    const id = msg.from;
    const next = mediaFrom(msg.payload);
    if (!id || id === state.peer || !next) return;
    const before = remoteMedia.get(id) || null;
    remoteMedia.set(id, next);
    announceMedia(mediaChange(msg.name || names.get(id) || 'Someone', before, next));
    markTile(id, next);
    answerScreenStalls();
  }

  // ---------------------------------------------------------------
  // The screen watchdogs (§15.21, 2026-09-28)
  // ---------------------------------------------------------------
  //
  // Paul, on the Mac app: "after a while, my screen froze on her end and
  // she was no longer able to see my screen. I had to stop and re-share
  // again." The receiver can see that happening and the sharer cannot, so
  // the receiver says so and the sharer answers with a keyframe — the
  // part of a stop and a share again that a frozen picture is missing.

  // judgeScreen is the receiver's verdict on one screen, from its decoded
  // count this poll: stalled, or not. `seen` is its record, updated here.
  // Pure over its arguments, and lifted by name in the node test.
  //
  // Any change in the count is movement, a smaller one included: a
  // screen the sharer has rebuilt arrives on a new receiver whose count
  // starts again, and up to 2026-09-30 only a larger count moved, so a
  // rebuilt screen that was playing again stayed "stalled" here — and the
  // sharer's notice with it — until the new count passed the old.
  function judgeScreen(seen, decoded, now, frozen) {
    if (!seen.movedAt || (decoded !== seen.decoded && !frozen)) {
      seen.decoded = decoded;
      seen.movedAt = now;
      seen.reattached = false;
      return false;
    }
    const quiet = now - seen.movedAt;
    return quiet >= SCREEN_STALL_AFTER && quiet < SCREEN_STALL_GIVE_UP;
  }

  // reattachDue says, once per stall, when a stalled screen's picture
  // should be handed to its element again (§15.22): SCREEN_REATTACH_AFTER
  // into the stall. A picture stopped on this side — an element or a
  // track Chromium has left muted — is this side's to mend. Pure over
  // `seen`, and lifted by name in the node test.
  function reattachDue(seen, now) {
    const quiet = now - seen.movedAt;
    if (seen.reattached || quiet < SCREEN_STALL_AFTER + SCREEN_REATTACH_AFTER || quiet >= SCREEN_STALL_GIVE_UP) {
      return false;
    }
    seen.reattached = true;
    return true;
  }

  // screenLog is one line of the screen's timeline: the console, and the
  // last SCREEN_LOG_LINES kept for "Copy call diagnostics".
  function screenLog(line) {
    const d = new Date();
    const pad = (n, w) => String(n).padStart(w || 2, '0');
    const stamp = pad(d.getHours()) + ':' + pad(d.getMinutes()) + ':' + pad(d.getSeconds()) + '.' + pad(d.getMilliseconds(), 3);
    screenLines.push(stamp + ' ' + line);
    if (screenLines.length > SCREEN_LOG_LINES) screenLines.splice(0, screenLines.length - SCREEN_LOG_LINES);
    console.info('calls: ' + line);
  }

  // screenReading is what one inbound screen report says, and
  // readingSummary and readingMoved put it in words. Pure, and lifted by
  // name in the node test: packets arriving and frames assembled but none
  // decoded is a decoder; nothing arriving is the sender or the path.
  function screenReading(r, trackMuted) {
    return {
      mid: r.mid || '',
      packets: r.packetsReceived || 0,
      lost: r.packetsLost || 0,
      received: r.framesReceived || 0,
      decoded: r.framesDecoded || 0,
      dropped: r.framesDropped || 0,
      keyframes: r.keyFramesDecoded || 0,
      pli: r.pliCount || 0,
      fir: r.firCount || 0,
      nack: r.nackCount || 0,
      freezes: r.freezeCount || 0,
      width: r.frameWidth || 0,
      height: r.frameHeight || 0,
      decoder: r.decoderImplementation || '',
      muted: !!trackMuted,
    };
  }

  function readingSummary(r) {
    return 'mid ' + (r.mid || '-') + ', ' + r.width + 'x' + r.height + ', decoder ' + (r.decoder || 'unknown') +
      (r.muted ? ', track muted' : '') + '; packets ' + r.packets + ' (lost ' + r.lost + '), frames received ' +
      r.received + ', decoded ' + r.decoded + ', dropped ' + r.dropped + ', keyframes ' + r.keyframes +
      ', PLI ' + r.pli + ', FIR ' + r.fir + ', NACK ' + r.nack + ', freezes ' + r.freezes;
  }

  function readingMoved(r, b) {
    if (!b || b.mid !== r.mid) return readingSummary(r) + ' — no earlier reading';
    const d = (a, z) => (a >= z ? '+' + (a - z) : 'new ' + a);
    let verdict = 'decoding';
    if (r.packets === b.packets) verdict = 'no packets arriving (the sender or the path)';
    else if (r.received === b.received) verdict = 'packets arriving, no frames assembled (loss, or waiting on a keyframe)';
    else if (r.decoded === b.decoded) verdict = 'frames arriving, none decoded (the decoder)';
    return 'packets ' + d(r.packets, b.packets) + ', frames received ' + d(r.received, b.received) + ', decoded ' +
      d(r.decoded, b.decoded) + ', dropped ' + d(r.dropped, b.dropped) + ', keyframes ' + d(r.keyframes, b.keyframes) +
      ', PLI ' + d(r.pli, b.pli) + ', NACK ' + d(r.nack, b.nack) + (r.muted ? ', track muted' : '') + ' — ' + verdict;
  }

  // watchScreens takes one poll's decoded counts, by share key, and
  // reports the list when it changes.
  //
  // `readings` is the same poll's screenReading per share key: kept for
  // the diagnostics, and set against the reading from when the screen last
  // moved, so a stall is logged with what is and is not still arriving.
  function watchScreens(decodedByKey, readings) {
    const now = Date.now();
    const frozen = now < screenStallTestUntil;
    const stalled = [];
    for (const key of Array.from(screenSeen.keys())) {
      if (!decodedByKey.has(key)) screenSeen.delete(key);
    }
    for (const key of Array.from(screenReadings.keys())) {
      if (!decodedByKey.has(key)) {
        screenReadings.delete(key);
        screenMoving.delete(key);
      }
    }
    for (const [key, decoded] of decodedByKey) {
      const id = key.slice(0, -SHARE_SUFFIX.length);
      const entry = pcs.get(id);
      if (!entry || !hasShare(entry)) {
        screenSeen.delete(key);
        continue;
      }
      let seen = screenSeen.get(key);
      if (!seen) {
        seen = { decoded: 0, movedAt: 0, reattached: false };
        screenSeen.set(key, seen);
      }
      const reading = readings && readings.get(key);
      if (reading) screenReadings.set(key, reading);
      if (judgeScreen(seen, decoded, now, frozen)) {
        stalled.push(id);
        if (reattachDue(seen, now)) {
          screenLog('screen from ' + id.slice(0, 6) + ' still stalled: handing its picture to the tile again; ' +
            (reading ? readingMoved(reading, screenMoving.get(key)) : 'no reading'));
          const t = tiles.get(key);
          if (t && t.video) {
            screenReattaches += 1;
            reattachesBy.set(id, (reattachesBy.get(id) || 0) + 1);
            replayTile(key, t, entry, true);
          }
        }
      } else if (reading) {
        screenMoving.set(key, reading);
      }
    }
    stalled.sort();
    if (stalled.join() === screenStalled.join()) return;
    for (const id of stalled) {
      if (screenStalled.includes(id)) continue;
      const key = shareKey(id);
      const reading = screenReadings.get(key);
      screenLog('screen from ' + id.slice(0, 6) + ' stalled here: reporting it; since it last moved ' +
        (reading ? readingMoved(reading, screenMoving.get(key)) : 'no reading'));
    }
    for (const id of screenStalled) {
      if (stalled.includes(id)) continue;
      const reading = screenReadings.get(shareKey(id));
      screenLog('screen from ' + id.slice(0, 6) + ' moving here again' + (reading ? ': ' + readingSummary(reading) : ''));
    }
    screenStalled = stalled;
    reportMedia();
  }

  // answerScreenStalls is the sharer's half: every peer whose report
  // names us gets a keyframe from our screen's encoder, and — when
  // keyframes do not answer (§15.22) — that connection's screen rebuilt,
  // then everyone's shared again from the same capture, and then words
  // saying it could not be restored. The quiet notice says which.
  function answerScreenStalls() {
    const me = state.peer;
    const now = Date.now();
    let reshare = false;
    for (const [id, m] of remoteMedia) {
      const asking = !!(share && me && m && m.screenStalled && m.screenStalled.includes(me));
      if (!asking) {
        const gone = screenAsks.get(id);
        if (gone && gone.stage && share) screenLog(id.slice(0, 6) + '\u2019s view restored after ' + stageWords(gone.stage));
        screenAsks.delete(id);
        continue;
      }
      const entry = pcs.get(id);
      let ask = screenAsks.get(id);
      if (!ask) {
        ask = { at: 0, tries: 0, restUntil: 0, stage: '', stageAt: 0 };
        screenAsks.set(id, ask);
        if (entry) entry.shareSentSince = 0;
      }
      if (entry && now >= ask.restUntil && now - ask.at >= SCREEN_KEYFRAME_EVERY) {
        ask.at = now;
        ask.tries += 1;
        if (ask.tries >= SCREEN_KEYFRAME_TRIES) {
          ask.tries = 0;
          ask.restUntil = now + SCREEN_KEYFRAME_REST;
        }
        shareCounts.keyframes += 1;
        countShareStep(id, 'keyframes');
        screenLog('keyframe for ' + id.slice(0, 6) + ', whose view of the screen stalled');
        shareKeyframe(entry).catch(() => {});
      }
      // Frames left for this person since the last step, or no screen
      // negotiated with them at all (a rebuild that never came back).
      const negotiated = !!(entry && entry.shareTx && entry.shareSend);
      const owed = !negotiated || (entry.shareSentSince || 0) >= SCREEN_ESCALATE_SENT;
      const rec = { stage: ask.stage, at: ask.stageAt, lastRebuild: shareRebuiltAt.get(id) || 0 };
      const before = rec.stage;
      const reshareFree = reshare || !shareResharedAt || now - shareResharedAt >= SCREEN_RESHARE_EVERY;
      const action = escalateShare(rec, now, owed, reshareFree);
      ask.stage = rec.stage;
      ask.stageAt = rec.at;
      if (rec.stage !== before && entry) entry.shareSentSince = 0;
      if (action === 'rebuild') {
        shareRebuiltAt.set(id, now);
        shareCounts.rebuilds += 1;
        countShareStep(id, 'rebuilds');
        screenLog(id.slice(0, 6) + ' still reports a stall after keyframes: rebuilding its screen (new transceiver, same size and mode)');
        if (entry) rebuildShareFor(entry);
      } else if (action === 'reshare') {
        reshare = true;
        countShareStep(id, 'reshares');
        screenLog(id.slice(0, 6) + ' still reports a stall' + (before === 'rebuilt' ? ' after the rebuild' : ', rebuilt under a minute ago') + ': sharing again');
      } else if (action === 'failed') {
        shareCounts.failures += 1;
        countShareStep(id, 'failures');
        screenLog(id.slice(0, 6) + ' still reports a stall and there is nothing left to try: giving up');
      }
    }
    if (reshare) {
      shareResharedAt = now;
      shareCounts.reshares += 1;
      // One share again answers every report in flight. For §15.26 it is
      // counted against each of the people it answers: it was done for
      // them, though it reached everyone.
      for (const [askId, ask] of screenAsks) {
        if (ask.stage === 'keyframes' || ask.stage === 'rebuilt') {
          countShareStep(askId, 'reshares');
          ask.stage = 'reshared';
          ask.stageAt = now;
        }
      }
      for (const entry of pcs.values()) entry.shareSentSince = 0;
      reshareAll();
    }
    const recovering = [];
    const restarting = [];
    const failed = [];
    for (const [id, ask] of screenAsks) {
      const who = names.get(id) || 'Someone';
      if (ask.stage === 'failed') failed.push(who);
      else if (ask.stage === 'rebuilt' || ask.stage === 'reshared') restarting.push(who);
      else recovering.push(who);
    }
    const text = noticeWords(recovering.sort(), restarting.sort(), failed.sort());
    if (text !== shareRecovery) {
      shareRecovery = text;
      renderShare();
    }
  }

  // callDiagnostics is "Copy call diagnostics" for the browser: the
  // connections, and the screen — how ours is leaving and what the ladder
  // has done, every screen arriving here as its statistics have it, and
  // the timeline. Names, states and counts only: no media, no addresses,
  // no credentials.
  //
  // §15.26: "Report a problem" sends the same text with `anonymous`, in
  // which every person is "peer " and the first six characters of their
  // peer id rather than their name — the server turns those into the
  // call's random tags before anything is logged. "Copy call
  // diagnostics" keeps the names: that text goes only where its owner
  // pastes it.
  function callDiagnostics(opts) {
    const anonymous = !!(opts && opts.anonymous);
    const who = (id) => (anonymous ? 'peer ' + id.slice(0, 6) : names.get(id) || 'Someone');
    const lines = ['Calls web diagnostics, ' + new Date().toISOString()];
    lines.push('Browser: ' + (navigator.userAgent || 'unknown'));
    lines.push('');
    lines.push('## Call');
    lines.push('admitted ' + state.admitted + ', people here ' + (pcs.size + 1) + ', stopped ' + state.stopped);
    for (const [id, entry] of pcs) {
      lines.push((anonymous ? who(id) : who(id) + ' (' + id.slice(0, 6) + ')') + ': connection ' + entry.pc.connectionState +
        ', signalling ' + entry.pc.signalingState + ', ICE ' + entry.pc.iceConnectionState);
    }
    lines.push('');
    lines.push('## Screen');
    if (share) {
      lines.push('Sharing (' + shareMode() + ')');
      for (const [id, entry] of pcs) {
        const r = entry.shareSend;
        if (!r) {
          lines.push('to ' + who(id) + ': ' + (entry.shareTx ? 'negotiating' : 'no screen transceiver'));
          continue;
        }
        lines.push('to ' + who(id) + ': ' + r.width + 'x' + r.height + ' at ' + Math.round(r.fps) + ' fps, encoder ' +
          (r.encoder || 'unknown') + ', encoded ' + r.framesEncoded + ', sent ' + r.framesSent + ', keyframes ' +
          r.keyFramesEncoded + ', limitation ' + (r.limitation || 'none'));
      }
      for (const [id, ask] of screenAsks) {
        if (ask.stage) lines.push('recovering ' + who(id) + '\u2019s view: ' + ask.stage);
      }
    } else {
      lines.push('Not sharing');
    }
    lines.push('recoveries: ' + shareCounts.keyframes + ' keyframes, ' + shareCounts.rebuilds + ' rebuilds, ' +
      shareCounts.reshares + ' shares again, ' + shareCounts.failures + ' given up');
    for (const [key, reading] of screenReadings) {
      const id = key.slice(0, -SHARE_SUFFIX.length);
      lines.push('from ' + who(id) + ': ' + readingSummary(reading));
    }
    if (screenStalled.length) lines.push('stalled here: ' + screenStalled.map(who).join(', '));
    if (screenReattaches) lines.push('pictures handed to their tiles again here: ' + screenReattaches);
    lines.push('');
    lines.push('## Screen log (last ' + SCREEN_LOG_LINES + ' lines)');
    if (screenLines.length) lines.push(...screenLines);
    else lines.push('(nothing logged)');
    return lines.join('\n');
  }

  // ---------------------------------------------------------------
  // Quality reports and "Report a problem" (§15.26, 2026-10-03)
  // ---------------------------------------------------------------
  //
  // Paul's ruling: every thirty seconds while admitted, and once more at
  // leave, this tab tells the server how its connections went over the
  // window — numbers and enums only, per remote peer, read off the stats
  // walk pollFrames already makes once a second rather than a walk of its
  // own. No name, no email, no title, no meeting, no device label, no
  // address and nothing anyone typed: the report names a remote peer only
  // by the peer id the server already knows, which it logs as the call's
  // random tag in its place. The person can switch the reports off in the
  // Devices panel; the server can switch them off for everyone (a 204).
  //
  // "Report a problem" is report.js's sheet; this file hands it the
  // token, the diagnostics with the people named by short peer id, and
  // what kind of client this is.

  // qualityCeiling is a number's bound in protocol/quality.go, by its JSON
  // name, as the server's numberCeiling has it.
  function qualityCeiling(name) {
    switch (name) {
      case 'seconds': case 'reconnectingSeconds': case 'cantHearSeconds': case 'freezeSeconds':
        return QUALITY_MAX_SECONDS;
      case 'rtt': case 'jitter': case 'jitterBufferMs':
        return QUALITY_MAX_MILLIS;
      case 'kbps':
        return QUALITY_MAX_KBPS;
      case 'width': case 'height':
        return QUALITY_MAX_PIXELS;
      case 'fps':
        return QUALITY_MAX_FPS;
      default:
        return QUALITY_MAX_COUNT;
    }
  }

  // qualitySet writes one number into a report part: finite and not
  // negative or it is left out (absent is "could not measure"), clamped
  // to its ceiling, and to a tenth, which is all the server keeps.
  function qualitySet(obj, name, v) {
    if (typeof v !== 'number' || !Number.isFinite(v) || v < 0) return;
    obj[name] = Math.round(Math.min(v, qualityCeiling(name)) * 10) / 10;
  }

  // qualityReading is one connection's getStats walk, kept as the next
  // window's starting point: each RTP stream by its report id (a new SSRC
  // is a new stream, whose counters start again from nothing) with its
  // running counters and what it reads now, and the selected candidate
  // pair's kinds, transport and round trip. `classify(r)` names an RTP
  // report's stream — 'audio', 'video' or 'screen', or '' to leave it out
  // — and a remote-inbound-rtp report (the far side's account of what we
  // send) takes the name of the outbound stream it is about. Fields are
  // copied by name from the lists below and nothing else is: a
  // candidate's address and port never leave this function. Pure, and
  // lifted by name in test/browser/room-quality.test.mjs.
  function qualityReading(reports, classify) {
    const COUNTERS = {
      out: ['bytesSent', 'packetsSent'],
      remote: ['packetsLost'],
      in: ['bytesReceived', 'packetsReceived', 'packetsLost', 'totalSamplesReceived', 'concealedSamples',
        'insertedSamplesForDeceleration', 'removedSamplesForAcceleration', 'jitterBufferDelay',
        'jitterBufferEmittedCount', 'freezeCount', 'totalFreezesDuration', 'framesDecoded', 'framesDropped'],
    };
    const GAUGES = {
      out: ['frameWidth', 'frameHeight', 'framesPerSecond', 'qualityLimitationReason'],
      remote: ['roundTripTime', 'jitter'],
      in: ['jitter', 'frameWidth', 'frameHeight', 'framesPerSecond'],
    };
    const all = [];
    const byId = new Map();
    if (reports && typeof reports.forEach === 'function') {
      reports.forEach((r) => {
        if (!r || typeof r !== 'object') return;
        all.push(r);
        if (r.id) byId.set(r.id, r);
      });
    }
    const streams = new Map();
    const keep = (key, dir, kind, r) => {
      const counters = {};
      const gauges = {};
      for (const n of COUNTERS[dir]) if (typeof r[n] === 'number') counters[n] = r[n];
      for (const n of GAUGES[dir]) if (typeof r[n] === 'number' || typeof r[n] === 'string') gauges[n] = r[n];
      streams.set(key, { dir, kind, counters, gauges });
    };
    for (const r of all) {
      const key = r.type + ':' + (r.id || r.ssrc || '');
      if (r.type === 'outbound-rtp' || r.type === 'inbound-rtp') {
        const kind = classify(r);
        if (kind) keep(key, r.type === 'outbound-rtp' ? 'out' : 'in', kind, r);
      } else if (r.type === 'remote-inbound-rtp') {
        const sent = r.localId ? byId.get(r.localId) : null;
        const kind = sent && sent.type === 'outbound-rtp' ? classify(sent) : '';
        if (kind) keep(key, 'remote', kind, r);
      }
    }
    let pair = null;
    for (const r of all) {
      if (r.type === 'transport' && r.selectedCandidatePairId && byId.has(r.selectedCandidatePairId)) {
        pair = byId.get(r.selectedCandidatePairId);
        break;
      }
    }
    // Firefox has no transport report; it marks the pair itself.
    if (!pair) pair = all.find((r) => r.type === 'candidate-pair' && r.selected === true) || null;
    if (!pair) pair = all.find((r) => r.type === 'candidate-pair' && r.nominated && r.state === 'succeeded') || null;
    let path = null;
    if (pair) {
      const kinds = ['host', 'srflx', 'prflx', 'relay'];
      const local = byId.get(pair.localCandidateId) || {};
      const remote = byId.get(pair.remoteCandidateId) || {};
      // A relay candidate's own protocol is the relay's leg to the peer;
      // how this browser reaches the relay is relayProtocol, and that is
      // the one that says "TURN over TLS".
      const transport = local.candidateType === 'relay' && ['udp', 'tcp', 'tls'].includes(local.relayProtocol)
        ? local.relayProtocol
        : ['udp', 'tcp'].includes(local.protocol) ? local.protocol : 'unknown';
      path = {
        local: kinds.includes(local.candidateType) ? local.candidateType : 'unknown',
        remote: kinds.includes(remote.candidateType) ? remote.candidateType : 'unknown',
        protocol: transport,
        rtt: typeof pair.currentRoundTripTime === 'number' ? pair.currentRoundTripTime * 1000 : undefined,
      };
    }
    return { streams, path };
  }

  // qualityPeer is one remote peer's statistics for a window: what moved
  // between two readings `seconds` apart, per stream kind and direction.
  // Counts are deltas — a stream `prev` does not have counts from zero,
  // which is where its counters started — and rates are over the window;
  // sizes, frame rates, jitter, round trips and the limitation are what
  // the latest reading says. Two streams of one kind (a screen rebuilt on
  // a new transceiver during the window) add up. Returns {path, rtt, out,
  // in} with whatever parts there is something for. Pure, and lifted by
  // name in the node test.
  function qualityPeer(prev, now, seconds) {
    const sums = new Map();
    for (const [key, s] of now.streams) {
      const p = prev && prev.streams ? prev.streams.get(key) : null;
      const slot = s.dir + ':' + s.kind;
      let b = sums.get(slot);
      if (!b) {
        b = { d: {}, g: {} };
        sums.set(slot, b);
      }
      for (const n of Object.keys(s.counters)) {
        const base = p && typeof p.counters[n] === 'number' ? p.counters[n] : 0;
        b.d[n] = (b.d[n] || 0) + Math.max(0, s.counters[n] - base);
      }
      for (const n of Object.keys(s.gauges)) {
        const v = s.gauges[n];
        if (typeof v === 'string') {
          if (!b.g[n] || b.g[n] === 'none') b.g[n] = v;
        } else {
          b.g[n] = typeof b.g[n] === 'number' ? Math.max(b.g[n], v) : v;
        }
      }
    }
    const kbps = (bytes) => (typeof bytes === 'number' && seconds > 0 ? (bytes * 8) / 1000 / seconds : undefined);
    const ms = (s) => (typeof s === 'number' ? s * 1000 : undefined);
    const limits = ['none', 'cpu', 'bandwidth', 'other'];
    const out = {};
    const inbound = {};
    for (const kind of ['audio', 'video', 'screen']) {
      const o = sums.get('out:' + kind);
      const ri = sums.get('remote:' + kind);
      if (o || ri) {
        const s = {};
        if (o) {
          qualitySet(s, 'kbps', kbps(o.d.bytesSent));
          qualitySet(s, 'packets', o.d.packetsSent);
          if (kind !== 'audio') {
            qualitySet(s, 'width', o.g.frameWidth);
            qualitySet(s, 'height', o.g.frameHeight);
            qualitySet(s, 'fps', o.g.framesPerSecond);
            if (limits.includes(o.g.qualityLimitationReason)) s.limit = o.g.qualityLimitationReason;
          }
        }
        if (ri) {
          qualitySet(s, 'lost', ri.d.packetsLost);
          qualitySet(s, 'rtt', ms(ri.g.roundTripTime));
          qualitySet(s, 'jitter', ms(ri.g.jitter));
        }
        if (Object.keys(s).length) out[kind] = s;
      }
      const i = sums.get('in:' + kind);
      if (i) {
        const s = {};
        qualitySet(s, 'kbps', kbps(i.d.bytesReceived));
        qualitySet(s, 'packets', i.d.packetsReceived);
        qualitySet(s, 'lost', i.d.packetsLost);
        qualitySet(s, 'jitter', ms(i.g.jitter));
        if (kind === 'audio') {
          qualitySet(s, 'samples', i.d.totalSamplesReceived);
          qualitySet(s, 'concealed', i.d.concealedSamples);
          qualitySet(s, 'inserted', i.d.insertedSamplesForDeceleration);
          qualitySet(s, 'removed', i.d.removedSamplesForAcceleration);
          if (i.d.jitterBufferEmittedCount > 0) {
            qualitySet(s, 'jitterBufferMs', (i.d.jitterBufferDelay / i.d.jitterBufferEmittedCount) * 1000);
          }
        } else {
          qualitySet(s, 'freezes', i.d.freezeCount);
          qualitySet(s, 'freezeSeconds', i.d.totalFreezesDuration);
          qualitySet(s, 'decoded', i.d.framesDecoded);
          qualitySet(s, 'dropped', i.d.framesDropped);
          qualitySet(s, 'width', i.g.frameWidth);
          qualitySet(s, 'height', i.g.frameHeight);
          qualitySet(s, 'fps', i.g.framesPerSecond);
        }
        if (Object.keys(s).length) inbound[kind] = s;
      }
    }
    const peer = {};
    if (now.path) {
      peer.path = { local: now.path.local, remote: now.path.remote, protocol: now.path.protocol };
      const r = {};
      qualitySet(r, 'rtt', now.path.rtt);
      if ('rtt' in r) peer.rtt = r.rtt;
    }
    if (Object.keys(out).length) peer.out = out;
    if (Object.keys(inbound).length) peer.in = inbound;
    return peer;
  }

  // The notices a quality report counts (§15.23's "Reconnecting…", for
  // the whole call and per person; §15.24's "can't hear you yet"), and
  // the reports about sound and screens (§15.20, §15.21), watched five
  // times a second by watchReconnect and taken by each report.
  function qualityWatchRecord() {
    return { at: null, call: { shown: false, count: 0, ms: 0, blocked: false }, peers: new Map() };
  }

  // qualityWatch is one look. `look` is {call, audioBlocked, peers}, peers
  // being peer id -> {reconnecting, cantHear, noSound, noSoundFromUs,
  // audioBlocked, screenStalled}, every one a boolean for what is true at
  // this moment. A notice counts once each time it appears, and the time
  // between two looks counts towards whatever was showing at the first of
  // them, up to QUALITY_LOOK_MAX. Pure, and lifted by name in the node
  // test.
  function qualityWatch(rec, now, look) {
    const dt = rec.at === null ? 0 : Math.min(Math.max(0, now - rec.at), QUALITY_LOOK_MAX);
    rec.at = now;
    const shown = (s, on) => {
      if (s.shown) s.ms += dt;
      if (on && !s.shown) s.count += 1;
      s.shown = !!on;
    };
    shown(rec.call, look.call);
    if (look.audioBlocked) rec.call.blocked = true;
    for (const p of rec.peers.values()) p.present = false;
    for (const [id, l] of look.peers) {
      let p = rec.peers.get(id);
      if (!p) {
        p = { present: true, reconnecting: { shown: false, count: 0, ms: 0 }, cantHear: { shown: false, count: 0, ms: 0 },
          noSound: false, noSoundFromUs: false, audioBlocked: false, screenStalled: false };
        rec.peers.set(id, p);
      }
      p.present = true;
      shown(p.reconnecting, l.reconnecting);
      shown(p.cantHear, l.cantHear);
      for (const k of ['noSound', 'noSoundFromUs', 'audioBlocked', 'screenStalled']) if (l[k]) p[k] = true;
    }
    for (const p of rec.peers.values()) {
      if (p.present) continue;
      shown(p.reconnecting, false);
      shown(p.cantHear, false);
    }
  }

  // qualityTake is the window's events, in the report's shape — only what
  // happened, so a quiet window says nothing — and the record started on
  // the next window. A notice still showing goes on counting there, and
  // someone who has left is forgotten. Returns {call, peers: Map}. Pure,
  // and lifted by name in the node test.
  function qualityTake(rec) {
    const secs = (ms) => ms / 1000;
    const call = {};
    if (rec.call.count) qualitySet(call, 'reconnecting', rec.call.count);
    if (rec.call.ms) qualitySet(call, 'reconnectingSeconds', secs(rec.call.ms));
    if (rec.call.blocked) call.audioBlocked = true;
    rec.call.count = 0;
    rec.call.ms = 0;
    rec.call.blocked = false;
    const peers = new Map();
    for (const [id, p] of Array.from(rec.peers)) {
      const e = {};
      if (p.reconnecting.count) qualitySet(e, 'reconnecting', p.reconnecting.count);
      if (p.reconnecting.ms) qualitySet(e, 'reconnectingSeconds', secs(p.reconnecting.ms));
      if (p.cantHear.ms) qualitySet(e, 'cantHearSeconds', secs(p.cantHear.ms));
      for (const k of ['noSound', 'noSoundFromUs', 'audioBlocked', 'screenStalled']) if (p[k]) e[k] = true;
      if (Object.keys(e).length) peers.set(id, e);
      if (!p.present) {
        rec.peers.delete(id);
        continue;
      }
      p.reconnecting.count = 0;
      p.reconnecting.ms = 0;
      p.cantHear.count = 0;
      p.cantHear.ms = 0;
      p.noSound = p.noSoundFromUs = p.audioBlocked = p.screenStalled = false;
    }
    return { call, peers };
  }

  // qualityReport is the body POSTed to /m/{sqid}/quality
  // (protocol.QualityReport). `o.peers` is [{id, prev, now, ladder,
  // reattaches, events}]: the two readings, the §15.22 ladder's steps
  // toward that person this window ({keyframes, rebuilds, reshares,
  // failures}), the times their screen was handed to its tile again, and
  // qualityTake's events for them. At most QUALITY_MAX_PEERS, each by a
  // well-formed peer id, and none with nothing to say. Steps and events
  // that did not happen are left out rather than sent as zeros: the line
  // the server writes has a size limit, and absent means none. Pure, and
  // lifted by name in the node test.
  function qualityReport(o) {
    const report = { v: 1 };
    if (o.final) report.final = true;
    qualitySet(report, 'seconds', Math.max(0.1, o.seconds));
    report.client = o.client;
    if (o.devices) report.devices = o.devices;
    if (o.events && Object.keys(o.events).length) report.events = o.events;
    const peers = [];
    for (const p of o.peers || []) {
      if (peers.length >= QUALITY_MAX_PEERS) break;
      if (typeof p.id !== 'string' || !/^[0-9a-f]{32}$/.test(p.id)) continue;
      const q = qualityPeer(p.prev, p.now, o.seconds);
      const ladder = {};
      for (const k of ['keyframes', 'rebuilds', 'reshares', 'failures']) {
        if (p.ladder && p.ladder[k] > 0) qualitySet(ladder, k, p.ladder[k]);
      }
      if (Object.keys(ladder).length) {
        q.out = q.out || {};
        q.out.screen = Object.assign(q.out.screen || {}, ladder);
      }
      if (p.reattaches > 0) {
        q.in = q.in || {};
        q.in.screen = q.in.screen || {};
        qualitySet(q.in.screen, 'reattaches', p.reattaches);
      }
      if (p.events && Object.keys(p.events).length) q.events = p.events;
      if (!Object.keys(q).length) continue;
      peers.push(Object.assign({ peer: p.id }, q));
    }
    if (peers.length) report.peers = peers;
    return report;
  }

  // deviceKind is a microphone's or speaker's kind, by its label, which
  // never leaves this function: only the enum is reported. A heuristic,
  // and an honest one — what it cannot place is 'unknown'. Pure, and
  // lifted by name in the node test.
  function deviceKind(label) {
    const l = String(label || '');
    if (!l) return 'unknown';
    if (/airpods|bluetooth|beats|buds|hands-?free|bose|jabra|wh-1000|wf-1000|\bbt\b/i.test(l)) return 'bluetooth';
    if (/airplay/i.test(l)) return 'airplay';
    if (/continuity|iphone microphone/i.test(l)) return 'continuity';
    if (/blackhole|loopback|soundflower|virtual|vb-audio|cable (?:in|out)put|zoomaudiodevice|teams audio/i.test(l)) return 'virtual';
    if (/usb/i.test(l)) return 'usb';
    if (/built-?in|macbook|imac|internal|microphone array|realtek/i.test(l)) return 'built-in';
    if (/external (?:microphone|headphones)|headphones|line in|wired/i.test(l)) return 'wired';
    return 'unknown';
  }

  // qualityOn: the person's own switch, on unless they turned it off.
  function qualityOn() {
    if (qualityLocalOff) return false;
    try {
      return localStorage.getItem(QUALITY_KEY) !== 'off';
    } catch {
      return true;
    }
  }

  // countShareStep is one §15.22 step toward one person, for the report.
  function countShareStep(id, step) {
    let c = shareCountsBy.get(id);
    if (!c) {
      c = { keyframes: 0, rebuilds: 0, reshares: 0, failures: 0 };
      shareCountsBy.set(id, c);
    }
    c[step] += 1;
  }

  // qualityKind classifies an RTP report on one connection: audio, the
  // camera or the screen. Outbound by the screen transceiver's mid,
  // inbound by frameKey, the same split the frame counts use.
  function qualityKind(id, entry, r) {
    const kind = r.kind || r.mediaType;
    if (kind === 'audio') return 'audio';
    if (kind !== 'video') return '';
    if (r.type === 'outbound-rtp') {
      return entry.shareTx && entry.shareTx.mid && r.mid === entry.shareTx.mid ? 'screen' : 'video';
    }
    const key = frameKey(id, entry, r.mid || '');
    if (!key) return '';
    return key === id ? 'video' : 'screen';
  }

  // refreshOutputKind finds the speaker this tab plays through — the one
  // chosen, or the system's default — for the next report. Asynchronous
  // (enumerateDevices), so a report carries what the last one found.
  function refreshOutputKind() {
    if (!navigator.mediaDevices || !navigator.mediaDevices.enumerateDevices) return;
    navigator.mediaDevices.enumerateDevices().then((devices) => {
      const outs = devices.filter((d) => d.kind === 'audiooutput');
      const chosen = (HAS_SINK_ID && prefs.speaker && outs.find((d) => d.deviceId === prefs.speaker)) ||
        outs.find((d) => d.deviceId === 'default') || outs[0] || null;
      qualityOutput = chosen ? deviceKind(chosen.label) : 'unknown';
    }, () => {});
  }

  function reportClient() {
    const api = window.CallsReport;
    return api && typeof api.client === 'function' ? api.client() : { app: 'web' };
  }

  // sendQuality closes the window and, when it may, sends its report. The
  // window is closed whether or not anything is sent, so the next one
  // starts from now whatever the switches said. `final` is the report at
  // leave or at the end, sent once with keepalive so it survives the page
  // going. Never retried, and never said to the person: a report that
  // did not arrive is one fewer line in a log.
  function sendQuality(final) {
    if (!qualityFrom || (final && qualityFinalSent)) return;
    if (final) qualityFinalSent = true;
    const now = Date.now();
    const seconds = (now - qualityFrom) / 1000;
    qualityFrom = now;
    const events = qualityTake(qualityEvents);
    const peers = [];
    for (const [id, entry] of pcs) {
      if (!entry.statsReport) continue;
      const reading = qualityReading(entry.statsReport, (r) => qualityKind(id, entry, r));
      const was = qualityPrev.get(id);
      qualityPrev.set(id, { pc: entry.pc, reading });
      peers.push({
        id,
        prev: was && was.pc === entry.pc ? was.reading : null,
        now: reading,
        ladder: shareCountsBy.get(id) || null,
        reattaches: reattachesBy.get(id) || 0,
        events: events.peers.get(id) || null,
      });
    }
    for (const id of Array.from(qualityPrev.keys())) if (!pcs.has(id)) qualityPrev.delete(id);
    shareCountsBy.clear();
    reattachesBy.clear();
    refreshOutputKind();
    if (!reportToken || qualityServerOff || !qualityOn()) return;
    const track = local && local.getAudioTracks()[0];
    const report = qualityReport({
      final,
      seconds,
      client: reportClient(),
      devices: {
        input: !track || track.readyState === 'ended' ? 'none' : deviceKind(track.label),
        output: qualityOutput,
      },
      events: events.call,
      peers,
    });
    let body = JSON.stringify(report);
    while (body.length > QUALITY_MAX_BODY && report.peers && report.peers.length) {
      report.peers.pop();
      body = JSON.stringify(report);
    }
    quality.sent += 1;
    fetch('/m/' + encodeURIComponent(sqid) + '/quality', {
      method: 'POST',
      credentials: 'same-origin',
      headers: { 'Content-Type': 'application/json', 'X-Calls-Report': reportToken },
      body,
      keepalive: !!final,
    }).then((res) => {
      quality.status = res.status;
      if (res.status === 202) quality.accepted += 1;
      if (res.status === 204) qualityServerOff = true;
    }, () => {
      quality.status = 0;
    });
  }

  // qualityTick runs after each stats walk: the window opens when this
  // tab is first admitted, and a report closes it every qualityEvery.
  function qualityTick() {
    if (state.stopped || !state.admitted) return;
    const now = Date.now();
    if (!qualityFrom) {
      qualityFrom = now;
      refreshOutputKind();
      return;
    }
    if (now - qualityFrom >= qualityEvery) sendQuality(false);
  }

  // qualityLook feeds the event watch what this tab is showing now.
  function qualityLook(now) {
    const peers = new Map();
    for (const id of pcs.keys()) {
      const m = remoteMedia.get(id) || null;
      const r = connecting.peers.get(id);
      const h = hearing.get(id);
      peers.set(id, {
        reconnecting: !reconnect.call && reconnect.peers.has(id),
        cantHear: !!(r && r.shown),
        noSound: !!(h && h.silent),
        noSoundFromUs: !!(m && state.peer && Array.isArray(m.noSoundFrom) && m.noSoundFrom.includes(state.peer)),
        audioBlocked: !!(m && m.audioBlocked),
        screenStalled: screenStalled.includes(id),
      });
    }
    qualityWatch(qualityEvents, now, { call: reconnect.call, audioBlocked, peers });
  }

  // problemOptions is what the sheet needs from this page: the token as
  // it stands when Send is pressed, and the diagnostics as they stand
  // then, with the people named by short peer id.
  function problemOptions(returnFocus) {
    return {
      sqid,
      token: () => reportToken,
      diagnostics: () => callDiagnostics({ anonymous: true }),
      client: reportClient,
      returnFocus,
    };
  }

  // openProblem opens the sheet, or says why it cannot: a page without
  // report.js, or a server that never handed this tab a token.
  function openProblem(returnFocus) {
    const api = window.CallsReport;
    if (!api || !reportToken) {
      if (deviceNote) note('This call cannot be reported from here.');
      return;
    }
    api.open(problemOptions(returnFocus));
  }

  // ---------------------------------------------------------------
  // "Reconnecting…" (§15.23, 2026-09-30)
  // ---------------------------------------------------------------
  //
  // Paul: "I saw 'Reconnecting' appear occasionally over the video, but
  // only for a second … I didn't notice any interruption in the call."
  // The Mac app said so the moment its stream ended, and a stream ends on
  // purpose every few minutes and is resumed half a second later. Here,
  // as there, the words wait for a problem that lasts.

  function reconnectRecord() {
    return { streamSince: 0, connection: new Map(), audio: new Map(), call: false, callClear: 0,
      peers: new Set(), peerClear: new Map() };
  }

  // reconnectStep is one look: `streamDown`, and `people` (peer id ->
  // {connectionBad, audioMissing}) for everyone else. It moves `rec` on:
  // rec.call is the whole call's words, rec.peers the tiles that say
  // "Reconnecting to …". The native app's ReconnectWatch is its twin.
  // Pure, and lifted by name in the node test.
  function reconnectStep(rec, now, streamDown, people) {
    rec.streamSince = streamDown ? rec.streamSince || now : 0;
    for (const id of Array.from(rec.connection.keys())) if (!people.has(id)) rec.connection.delete(id);
    for (const id of Array.from(rec.audio.keys())) if (!people.has(id)) rec.audio.delete(id);
    const troubled = new Set();
    for (const [id, p] of people) {
      if (p.connectionBad) {
        if (!rec.connection.has(id)) rec.connection.set(id, now);
      } else {
        rec.connection.delete(id);
      }
      if (p.audioMissing) {
        if (!rec.audio.has(id)) rec.audio.set(id, now);
      } else {
        rec.audio.delete(id);
      }
      const connection = rec.connection.has(id) && now - rec.connection.get(id) >= RECONNECT_CONNECTION_AFTER;
      const audio = rec.audio.has(id) && now - rec.audio.get(id) >= RECONNECT_AUDIO_AFTER;
      if (connection || audio) troubled.add(id);
    }
    const stream = !!rec.streamSince && now - rec.streamSince >= RECONNECT_STREAM_AFTER;
    const everyone = troubled.size >= 2 && troubled.size === people.size;
    const wantCall = stream || everyone;
    if (wantCall) {
      rec.call = true;
      rec.callClear = 0;
    } else if (rec.call) {
      if (!rec.callClear) rec.callClear = now;
      if (now - rec.callClear >= RECONNECT_HOLD) {
        rec.call = false;
        rec.callClear = 0;
      }
    }
    const shown = new Set(Array.from(rec.peers).filter((id) => people.has(id)));
    if (!wantCall) {
      for (const id of troubled) {
        shown.add(id);
        rec.peerClear.delete(id);
      }
    }
    for (const id of Array.from(shown)) {
      if (!wantCall && troubled.has(id)) continue;
      if (wantCall) {
        shown.delete(id);
        rec.peerClear.delete(id);
        continue;
      }
      if (!rec.peerClear.has(id)) rec.peerClear.set(id, now);
      if (now - rec.peerClear.get(id) >= RECONNECT_HOLD) {
        shown.delete(id);
        rec.peerClear.delete(id);
      }
    }
    for (const id of Array.from(rec.peerClear.keys())) if (!shown.has(id)) rec.peerClear.delete(id);
    rec.peers = shown;
  }

  // ---------------------------------------------------------------
  // "… is connecting and can't hear you yet" (§15.24, 2026-10-01)
  // ---------------------------------------------------------------
  //
  // Paul asked for Zoom's "… is connecting to audio and cannot hear you
  // yet": the gap after someone joins, before their side is receiving and
  // playing our audio, said rather than talked into. Their own report's
  // `hearing` is the authority; a client that does not send one is judged
  // on what this tab can see of its own audio reaching them.

  function connectingRecord() {
    return { peers: new Map() };
  }

  // hearsYou is a peer's report on us: true when its `hearing` lists us,
  // false when it has a list and we are not on it, and null when it has
  // no list — no report yet, or a client from before §15.24. Pure, and
  // lifted by name in the node test.
  function hearsYou(media, me) {
    if (!media || !Array.isArray(media.hearing)) return null;
    return !!me && media.hearing.includes(me);
  }

  // connectingStep is one look at everyone else: `people` is peer id ->
  // {epoch, hearsMe, reported, connected, acked}, where epoch is the pair
  // generation (a new one is a new connection, and they cannot hear us on
  // it yet), hearsMe is hearsYou's answer, reported whether they have
  // made any media report, connected whether the connection to them is
  // up, and acked whether their receiver reports say our audio reaches
  // them. rec.peers holds {epoch, since, done, shown} per person. Returns
  // the people whose words have just gone because they can hear us, for
  // "<name> can hear you now". The native app's ConnectingWatch is its
  // twin. Pure, and lifted by name in the node test.
  //
  // Clears when they say they hear us; or, for a client that does not
  // say (hearsMe null), once the connection is up and either our audio is
  // acknowledged or they have reported without a list. Said only past
  // CONNECTING_GRACE, and given up at CONNECTING_CAP whatever happens.
  function connectingStep(rec, now, people) {
    const cleared = [];
    for (const id of Array.from(rec.peers.keys())) if (!people.has(id)) rec.peers.delete(id);
    for (const [id, p] of people) {
      let r = rec.peers.get(id);
      if (!r || r.epoch !== p.epoch) {
        r = { epoch: p.epoch, since: now, done: false, shown: false };
        rec.peers.set(id, r);
      }
      if (r.done) continue;
      const fallback = p.hearsMe === null && p.connected && (p.acked || p.reported);
      if (p.hearsMe === true || fallback) {
        if (r.shown) cleared.push(id);
        r.done = true;
        r.shown = false;
      } else if (now - r.since >= CONNECTING_CAP) {
        r.done = true;
        r.shown = false;
      } else {
        r.shown = now - r.since >= CONNECTING_GRACE;
      }
    }
    return cleared;
  }

  // connectingNow: whether a person is still in their first moments, as
  // far as we can tell not hearing us — the words may not show yet.
  function connectingNow(id) {
    const r = connecting.peers.get(id);
    return !!r && !r.done;
  }

  // The words. The ellipsis is drawn apart from them (calls-ellipsis), so
  // a screen reader hears the sentence and never the dots.
  function connectingWords(name) {
    return name + ' is connecting and can\u2019t hear you yet';
  }
  function canHearWords(name) {
    return name + ' can hear you now';
  }

  // peerNotice is what a person's tile says about them and us, in order:
  // in their first moments (`joining`), a more specific report about us
  // (their browser blocking sound, or no sound from us) and otherwise
  // "connecting" once the grace has passed (`shown`) — "Reconnecting"
  // would be wrong of a connection that has never been up; after that,
  // §15.23's "Reconnecting to …" first and then the report. Returns
  // {kind, text}: kind '' for nothing, 'connecting' for the words with
  // the ellipsis. Pure, and lifted by name in the node test.
  function peerNotice(name, media, me, muted, joining, shown, reconnecting) {
    const report = remoteNotice(name, media, me, muted);
    if (joining) {
      if (report) return { kind: 'report', text: report };
      if (shown) return { kind: 'connecting', text: connectingWords(name) };
      return { kind: '', text: '' };
    }
    if (reconnecting) return { kind: 'reconnecting', text: 'Reconnecting to ' + name + '\u2026' };
    if (report) return { kind: 'report', text: report };
    return { kind: '', text: '' };
  }

  // judgeHeard is this tab's half of §15.24 for one connection: whether
  // the audio path from that person is established. Once it is, it stays
  // so until the connection fails or closes. Established is: the
  // connection up, and either their audio arriving — packets received and
  // decoded samples coming out — on a live receiver, or, for someone who
  // says they are muted, nothing more than that (a muted sender may send
  // only silence, or no audio at all, and must not look unheard: the
  // moment they unmute, it plays). `f` is {connected, bad, hasReceiver,
  // receiverLive, packets, samples, senderMuted}. Pure, and lifted by
  // name in the node test.
  function judgeHeard(was, f) {
    if (f.bad) return false;
    if (was) return true;
    if (!f.connected) return false;
    if (f.senderMuted && (!f.hasReceiver || f.receiverLive)) return true;
    return !!(f.receiverLive && f.packets > 0 && f.samples > 0);
  }

  // hearingList is the `hearing` this tab would report now: everyone
  // whose audio path is established and whose tile is playing — not
  // refused by an autoplay policy — sorted, at most fifteen.
  function hearingList() {
    const out = [];
    for (const [id, entry] of pcs) {
      if (!entry.heard) continue;
      const t = tiles.get(id);
      if (!t || refusedTiles.has(id)) continue;
      if (t.video && t.video.paused && entry.audioLive) continue;
      out.push(id);
    }
    return out.sort().slice(0, 15);
  }

  // hearingMoved is whether `hearing` has changed in a way worth a report
  // (both lists joined with commas): someone heard who was not, or someone
  // still here no longer heard. Someone who has left is not news — every
  // departure would otherwise cost a report from everyone left — and their
  // id rides along, ignored, until the next report for another reason.
  // Pure, and lifted by name in the node test.
  function hearingMoved(before, now, present) {
    const was = new Set(before ? before.split(',') : []);
    const is = new Set(now ? now.split(',') : []);
    for (const id of is) if (!was.has(id)) return true;
    for (const id of was) if (!is.has(id) && present.has(id)) return true;
    return false;
  }

  // watchConnecting feeds connectingStep what this tab knows, and says
  // "<name> can hear you now" for anyone whose words have just gone.
  function watchConnecting(now) {
    const people = new Map();
    for (const [id, entry] of pcs) {
      const media = remoteMedia.get(id) || null;
      const ice = entry.pc.iceConnectionState;
      people.set(id, {
        epoch: gen.get(id) || 0,
        hearsMe: hearsYou(media, state.peer),
        reported: !!media,
        connected: entry.pc.connectionState === 'connected' || ice === 'connected' || ice === 'completed',
        acked: !!entry.acked,
      });
    }
    const was = Array.from(connecting.peers).filter(([, r]) => !r.done).map(([id]) => id).sort().join();
    const wasShown = Array.from(connecting.peers).filter(([, r]) => r.shown).map(([id]) => id).sort().join();
    const cleared = connectingStep(connecting, now, people);
    for (const id of cleared) {
      console.info('calls: ' + id.slice(0, 6) + ' can hear us');
      announceMedia(canHearWords(names.get(id) || 'Someone'));
    }
    const is = Array.from(connecting.peers).filter(([, r]) => !r.done).map(([id]) => id).sort().join();
    const isShown = Array.from(connecting.peers).filter(([, r]) => r.shown).map(([id]) => id).sort().join();
    return is !== was || isShown !== wasShown;
  }

  // watchReconnect feeds the watch what this tab can see, five times a
  // second, and redraws what changed.
  function watchReconnect() {
    if (state.stopped) return;
    const now = Date.now();
    const joiningMoved = watchConnecting(now);
    const people = new Map();
    for (const [id, entry] of pcs) {
      // Someone in their first moments has not lost anything yet: §15.24
      // speaks for them until it gives up.
      if (connectingNow(id)) {
        people.set(id, { connectionBad: false, audioMissing: false });
        continue;
      }
      const ice = entry.pc.iceConnectionState;
      const rec = hearing.get(id);
      const media = remoteMedia.get(id);
      people.set(id, {
        connectionBad: ice === 'disconnected' || ice === 'failed',
        // Two level polls without a packet: stopped, as far as a poll can tell.
        audioMissing: !!(rec && rec.packetAt && media && !media.muted && now - rec.packetAt > 500),
      });
    }
    const wasCall = reconnect.call;
    const wasPeers = Array.from(reconnect.peers).sort().join();
    reconnectStep(reconnect, now, !!streamDownSince && !!state.peer, people);
    qualityLook(now);
    if (reconnect.call !== wasCall) {
      console.info('calls: reconnecting ' + (reconnect.call ? 'shown (a problem that lasted)' : 'cleared'));
      renderStatus();
    }
    if (Array.from(reconnect.peers).sort().join() !== wasPeers || joiningMoved) {
      for (const id of pcs.keys()) drawHearing(id);
    }
  }

  // noteShareSent counts the frames that left on this connection's
  // screen since its escalation last moved on, across a new transceiver's
  // counters starting again from nothing.
  function noteShareSent(entry) {
    if (!entry.shareSend) return;
    const sent = entry.shareSend.framesSent || 0;
    const last = entry.shareSentLast || 0;
    entry.shareSentSince = (entry.shareSentSince || 0) + (sent >= last ? sent - last : sent);
    entry.shareSentLast = sent;
  }

  // escalateShare is §15.22's ladder for one reporting peer: '' (nothing
  // now), 'rebuild', 'reshare' or 'failed', moving `rec` ({stage, at,
  // lastRebuild}) on. `owed` is whether frames have left for that person
  // since the last step; `reshareFree` whether a share again may happen
  // now. The native app's ScreenWatchdog is its twin. Pure, and lifted by
  // name in the node test.
  function escalateShare(rec, now, owed, reshareFree) {
    const move = (stage) => {
      rec.stage = stage;
      rec.at = now;
    };
    if (!rec.stage) {
      move('keyframes');
      return '';
    }
    if (rec.stage === 'keyframes') {
      if (now - rec.at < SCREEN_REBUILD_AFTER || !owed) return '';
      if (!rec.lastRebuild || now - rec.lastRebuild >= SCREEN_REBUILD_EVERY) {
        move('rebuilt');
        rec.lastRebuild = now;
        return 'rebuild';
      }
    } else if (rec.stage === 'rebuilt') {
      if (now - rec.at < SCREEN_RESHARE_AFTER || !owed) return '';
    } else if (rec.stage === 'reshared') {
      if (now - rec.at < SCREEN_GIVE_UP_AFTER || !owed) return '';
      move('failed');
      return 'failed';
    } else {
      return '';
    }
    if (reshareFree) {
      move('reshared');
      return 'reshare';
    }
    move('failed');
    return 'failed';
  }

  function stageWords(stage) {
    return { keyframes: 'keyframes', rebuilt: 'the rebuild', reshared: 'sharing again', failed: 'giving up' }[stage] || stage;
  }

  // rebuildShareFor is a stop and share again for one person (§15.22):
  // this connection's screen transceiver stopped, and a new one added by
  // the connection's own signalingstatechange once that has been
  // negotiated — a new encoder here, a new receiver and decoder there, at
  // the same size and mode.
  function rebuildShareFor(entry) {
    if (!share || !entry.shareTx) return;
    removeShareFrom(entry);
    sayShareAgain();
  }

  // reshareAll is Stop and Share for everyone without the picker: every
  // connection's screen transceiver stopped, and a clone of the captured
  // track — the same capture, a new track — added to each as it settles.
  function reshareAll() {
    if (!share) return;
    const held = share;
    let track;
    try {
      track = held.track.clone();
    } catch {
      return;
    }
    try {
      track.contentHint = held.track.contentHint;
    } catch {
      // A browser without contentHint.
    }
    // The browser's own Stop sharing bar ends every clone.
    track.addEventListener('ended', () => {
      if (share && share.track === track) stopSharing();
    });
    for (const entry of pcs.values()) removeShareFrom(entry);
    share = { stream: new MediaStream([track]), track };
    // The old one after: stopping it alone does not fire its own
    // `ended`, and the clone keeps the capture running.
    try {
      held.track.stop();
    } catch {
      // Already stopped.
    }
    sayShareAgain();
  }

  // sayShareAgain repeats `share {on:true}` once a rebuilt screen has had
  // time to arrive: its new track comes without a label of its own.
  function sayShareAgain() {
    setTimeout(() => {
      if (share) broadcast('share', { on: true });
    }, 2000);
  }

  // recoveringWords is the sharer's notice. Pure, and lifted by name in
  // the node test.
  function recoveringWords(people) {
    if (!people.length) return '';
    if (people.length === 1) return people[0] + '\u2019s view of your screen stalled \u2014 recovering';
    if (people.length === 2) {
      return people[0] + '\u2019s and ' + people[1] + '\u2019s views of your screen stalled \u2014 recovering';
    }
    return people.length + ' people\u2019s views of your screen stalled \u2014 recovering';
  }

  // noticeWords is the notice as §15.22's ladder moves on: recovering,
  // then "Restarting your share for Samuel…", then either nothing or
  // "Couldn’t restore Samuel’s view — try Stop and Share again". Worst
  // news first. The native app's ScreenWords.notice, word for word. Pure,
  // and lifted by name in the node test (with recoveringWords).
  function noticeWords(recovering, restarting, failed) {
    const parts = [];
    if (failed.length) {
      let whose = failed.length + ' people\u2019s views';
      if (failed.length === 1) whose = failed[0] + '\u2019s view';
      else if (failed.length === 2) whose = failed[0] + '\u2019s and ' + failed[1] + '\u2019s views';
      parts.push('Couldn\u2019t restore ' + whose + ' \u2014 try Stop and Share again');
    }
    if (restarting.length) {
      let who = restarting.length + ' people';
      if (restarting.length === 1) who = restarting[0];
      else if (restarting.length === 2) who = restarting[0] + ' and ' + restarting[1];
      parts.push('Restarting your share for ' + who + '\u2026');
    }
    const stalled = recoveringWords(recovering);
    if (stalled) parts.push(stalled);
    return parts.join('. ');
  }

  // shareKeyframe switches this connection's screen encoding off and on
  // again, which WebRTC answers by starting it on a keyframe: there is
  // no API that asks for one directly.
  async function shareKeyframe(entry) {
    const sender = entry.shareTx && entry.shareTx.sender;
    if (!sender || !sender.getParameters) return;
    const off = sender.getParameters();
    if (!off.encodings || !off.encodings.length) return;
    off.encodings[0].active = false;
    await sender.setParameters(off);
    await sleep(150);
    const on = sender.getParameters();
    if (!on.encodings || !on.encodings.length) return;
    on.encodings[0].active = true;
    await sender.setParameters(on);
  }

  // mediaChange is the sentence a change earns, or '' for none. A first
  // report is not news — it is somebody arriving the way they arrived —
  // so only a known state that moved is said out loud. Pure, and lifted
  // by name in the node test.
  function mediaChange(name, before, after) {
    if (!before || !after) return '';
    const parts = [];
    if (before.muted !== after.muted) {
      parts.push(name + (after.muted ? ' muted their microphone.' : ' unmuted their microphone.'));
    }
    if (before.cameraOff !== after.cameraOff) {
      parts.push(name + (after.cameraOff ? ' turned their camera off.' : ' turned their camera on.'));
    }
    return parts.join(' ');
  }

  // spaceKeyAction is what a keydown means for Space-to-mute: 'toggle',
  // 'swallow' (the same key repeating while held), or '' when it is not
  // ours — another key, a modified Space (those are shortcuts of their
  // own), text being composed by an input method, or focus on something
  // for which Space is typing or activation. Pure, and lifted by name in
  // the node test with spaceBelongsTo.
  function spaceKeyAction(ev, target) {
    if (!ev || (ev.key !== ' ' && ev.code !== 'Space')) return '';
    if (ev.ctrlKey || ev.metaKey || ev.altKey || ev.shiftKey || ev.isComposing) return '';
    if (spaceBelongsTo(target)) return '';
    return ev.repeat ? 'swallow' : 'toggle';
  }

  // spaceBelongsTo says whether Space already means something to the
  // focused element: text to type into, a control it activates (buttons,
  // checkboxes, summaries, links, anything given such a role), a select
  // it opens, or a media element's own controls. Unknown is not
  // claimed: a tile, the page body, a heading.
  function spaceBelongsTo(el) {
    if (!el || !el.tagName) return false;
    if (el.isContentEditable) return true;
    const tag = String(el.tagName).toUpperCase();
    if (['INPUT', 'TEXTAREA', 'SELECT', 'BUTTON', 'SUMMARY', 'OPTION', 'IFRAME'].includes(tag)) return true;
    const has = (name) => !!(el.hasAttribute && el.hasAttribute(name));
    if (tag === 'A' && has('href')) return true;
    if ((tag === 'VIDEO' || tag === 'AUDIO') && has('controls')) return true;
    const role = String((el.getAttribute && el.getAttribute('role')) || '').trim().toLowerCase();
    return [
      'button', 'link', 'checkbox', 'switch', 'radio', 'tab', 'menuitem', 'menuitemcheckbox',
      'menuitemradio', 'option', 'slider', 'spinbutton', 'combobox', 'textbox', 'searchbox',
      'listbox', 'treeitem', 'gridcell', 'scrollbar',
    ].includes(role);
  }

  function announceMedia(text) {
    if (!text || !mediaLive) return;
    mediaLive.textContent = text;
  }

  // screenWake keeps the screen on through the call (0.4.10): a call is
  // often watched rather than typed into, and a screen dimming and
  // locking under it reads as the call having ended. The Screen Wake Lock
  // is held from the start of the call until it is left or ends. The
  // browser lets it go whenever the tab is hidden, so it is asked for
  // again when the tab is visible again, while still wanted; released on
  // leaving. Where there is no navigator.wakeLock, or the request is
  // refused (a battery saver, a policy), nothing is said: the call works
  // as before. Self-contained, so room-wake.test.mjs can lift it.
  function screenWake(nav, doc) {
    let sentinel = null;
    let wanted = false;
    let asking = null;
    const ask = () => {
      if (asking) return asking;
      if (!wanted || sentinel || !nav || !nav.wakeLock || doc.visibilityState !== 'visible') return Promise.resolve();
      asking = Promise.resolve()
        .then(() => nav.wakeLock.request('screen'))
        .then((lock) => {
          asking = null;
          if (!wanted) return lock.release().catch(() => {});
          sentinel = lock;
          if (lock.addEventListener) {
            lock.addEventListener('release', () => { if (sentinel === lock) sentinel = null; });
          }
        }, () => { asking = null; });
      return asking;
    };
    doc.addEventListener('visibilitychange', () => {
      if (doc.visibilityState === 'visible') ask();
    });
    return {
      hold() { wanted = true; return ask(); },
      release() {
        wanted = false;
        const lock = sentinel;
        sentinel = null;
        return lock ? Promise.resolve(lock.release()).catch(() => {}) : Promise.resolve();
      },
      get held() { return !!sentinel; },
    };
  }
  const wake = screenWake(navigator, document);

  // paintBackdrops draws the shared screen on the stage, if there is one,
  // into its 64 × 36 backdrop canvas: what calls.css enlarges, blurs and
  // dims around the fitted screen instead of black bars (2026-10-05, as
  // FaceTime; the native apps' ScreenBackdrop). Twice a second, and only
  // for the screen on the stage in a visible tab: one small drawImage,
  // whose cost is kept on the canvas (data-cost-ms, the slowest so far)
  // for the browser gate to report.
  const BACKDROP_W = 64;
  const BACKDROP_H = 36;
  const BACKDROP_EVERY = 500;
  function paintBackdrops() {
    if (document.visibilityState !== 'visible') return;
    const fig = document.querySelector('#tiles > [data-stage].calls-tile-share');
    if (!fig) return;
    const video = fig.querySelector('video');
    const canvas = fig.querySelector('.calls-tile-backdrop');
    if (!video || !canvas || video.readyState < 2 || !video.videoWidth) return;
    const ctx = canvas.getContext('2d', { alpha: false });
    if (!ctx) return;
    const t0 = performance.now();
    try {
      ctx.drawImage(video, 0, 0, BACKDROP_W, BACKDROP_H);
    } catch (err) {
      return;
    }
    const cost = performance.now() - t0;
    const worst = parseFloat(canvas.dataset.costMs || '0');
    if (cost > worst) canvas.dataset.costMs = cost.toFixed(3);
    canvas.dataset.painted = String((parseInt(canvas.dataset.painted || '0', 10) || 0) + 1);
  }

  // tileMarks builds one tile's pair of marks from the server's
  // templates: the muted badge beside the name, and the camera-off cover
  // over the video. The cover sits over the element rather than hiding
  // it — the element is also what plays the peer's audio.
  function tileMarks() {
    const muted = document.createElement('span');
    muted.className = 'calls-tile-muted';
    muted.hidden = true;
    if (mutedMark) muted.append(mutedMark.content.cloneNode(true));
    else muted.textContent = 'Muted';
    const off = document.createElement('div');
    off.className = 'calls-tile-off';
    off.hidden = true;
    if (cameraOffMark) off.append(cameraOffMark.content.cloneNode(true));
    else off.textContent = 'Camera off';
    return { muted, off };
  }

  // markTile shows or hides one tile's marks. `media` null is unknown.
  function markTile(key, media) {
    const t = tiles.get(key);
    if (!t || !t.muted) return;
    t.muted.hidden = !(media && media.muted);
    t.off.hidden = !(media && media.cameraOff);
    t.figure.classList.toggle('calls-tile-camera-off', !!(media && media.cameraOff));
    drawHearing(key);
  }

  // ---------------------------------------------------------------
  // Hearing (§15.20): what this tab can hear, and what it is sending
  // ---------------------------------------------------------------
  //
  // Written after a call on 2026-09-25 in which one side could not hear
  // the other and neither could tell why. §15.19 says who is muted; this
  // says whether sound is actually arriving. Every tile carries a meter
  // for the audio behind it, read from getStats and never from Web Audio
  // (an AudioContext made without a gesture starts suspended and reads
  // nothing), and three things are said in words:
  //
  //   - a stream that is arriving but has been flat for five seconds
  //     from someone who says they are not muted: "No sound from …",
  //     and the same list goes back to the hub as `noSoundFrom`, so the
  //     person who cannot be heard is told so on their own screen;
  //   - a browser that refused to play: "Sound blocked", a page banner,
  //     and `audioBlocked` in the report, for the same reason;
  //   - our own microphone flat for five seconds while unmuted.
  //
  // Everything here is about sound that has already reached a browser.
  // Nothing about it leaves this tab except the two keys above.

  // hearingRecord is one stream's running state between polls.
  function hearingRecord() {
    return {
      level: 0,          // the latest level, 0..1
      peak: 0,           // the loudest level seen, for the gate
      energy: -1,        // totalAudioEnergy at the last poll
      duration: -1,      // totalSamplesDuration at the last poll
      packets: -1,       // packetsReceived at the last poll
      packetAt: 0,       // when packetsReceived last grew
      sampled: false,    // a report has been read at all
      quietSince: 0,     // when the current flat stretch began, or 0
      silent: false,     // flat for NO_SOUND_AFTER while it counted
      speaking: false,
      speakHold: 0,
      glowLit: false,    // the speaking glow is lit (judgeGlow)
      glow: 0,           // where its brightness is heading, 0..1
      loudFrom: 0,       // the first and latest loud readings since
      loudLast: 0,       //   speaking began, or 0
      notice: '',        // the remote notice last drawn, for the live region
    };
  }

  // audioSample reads one audio stats report against the record's last
  // one: the level to draw, whether it was sound, and the counters for
  // next time. `audioLevel` is the browser's own reading; where it is
  // missing, the root mean square since the last poll stands in for it,
  // from totalAudioEnergy over totalSamplesDuration. Sound is either one
  // at or over FLAT_LEVEL — the energy half is what catches a beep that
  // fell between two polls. A report carrying neither is `measurable:
  // false`: a browser that does not say how loud a stream is has not
  // said it is silent, and the five-second rule must not read it so.
  // Pure, and lifted by name in the node test.
  function audioSample(prev, r) {
    const energy = typeof r.totalAudioEnergy === 'number' ? r.totalAudioEnergy : -1;
    const duration = typeof r.totalSamplesDuration === 'number' ? r.totalSamplesDuration : -1;
    const packets = typeof r.packetsReceived === 'number' ? r.packetsReceived : -1;
    let rms = -1;
    if (prev && prev.energy >= 0 && energy >= prev.energy && duration > prev.duration && prev.duration >= 0) {
      rms = Math.sqrt((energy - prev.energy) / (duration - prev.duration));
    }
    let level = typeof r.audioLevel === 'number' ? r.audioLevel : rms;
    if (!(level >= 0)) level = 0;
    level = Math.min(1, level);
    return {
      level,
      measurable: typeof r.audioLevel === 'number' || energy >= 0,
      heard: level >= FLAT_LEVEL || rms >= FLAT_LEVEL,
      energy,
      duration,
      packets,
      grew: !!prev && packets >= 0 && prev.packets >= 0 && packets > prev.packets,
    };
  }

  // judgeSilence is the five-second rule. It counts only while the
  // stream is `eligible` (the sender says it is unmuted, and this tab is
  // in a position to hear it) and `arriving` (packets are coming in); a
  // stream that is not arriving is a connection's problem, not a
  // microphone's, and says nothing here. Any sound ends a flat stretch
  // at once, which is the hysteresis: on only after five quiet seconds,
  // off at the first sound. Pure over the record, and lifted by name in
  // the node test.
  function judgeSilence(rec, now, eligible, arriving, heard) {
    if (!eligible || !arriving || heard) {
      rec.quietSince = 0;
      rec.silent = false;
      return false;
    }
    if (!rec.quietSince) rec.quietSince = now;
    rec.silent = now - rec.quietSince >= NO_SOUND_AFTER;
    return rec.silent;
  }

  // selfMicWatched is whether "Your microphone isn't picking anything
  // up" may count at all: our level is measurable, we are not muted (the
  // Muted state says it already), and a connection is up and sending the
  // microphone to someone. Alone in a call nothing is sent, and silence
  // there is nobody's problem (the Mac app said it to Paul alone,
  // 2026-10-03; the rule is the same on every client). Pure, and lifted
  // by name in the node test.
  function selfMicWatched(measurable, muted, sending) {
    return !!(measurable && !muted && sending);
  }

  // judgeSpeaking is the tile's highlight: on above SPEAK_ON, off after
  // SPEAK_HOLD polls under SPEAK_OFF, and held in between. Pure over the
  // record, and lifted by name in the node test.
  function judgeSpeaking(rec, level) {
    if (level >= SPEAK_ON) {
      rec.speaking = true;
      rec.speakHold = SPEAK_HOLD;
    } else if (rec.speaking && level < SPEAK_OFF) {
      rec.speakHold -= 1;
      if (rec.speakHold <= 0) rec.speaking = false;
    }
    return rec.speaking;
  }

  // glowIntensity is a level for the warm rim, 0..1: decibels,
  // because that is how loudness is heard, from nothing at GLOW_QUIET_DB
  // to all of it at GLOW_LOUD_DB. Pure, and lifted by name in the node
  // test.
  function glowIntensity(level) {
    if (!(level > 0)) return 0;
    const db = 20 * Math.log10(Math.min(1, level));
    return Math.max(0, Math.min(1, (db - GLOW_QUIET_DB) / (GLOW_LOUD_DB - GLOW_QUIET_DB)));
  }

  // judgeGlow is the glow's gate and target, taken after judgeSpeaking
  // on the same reading: lit while speaking once loud readings have kept
  // up for GLOW_ONSET ms, and then at the reading's level. Returns the
  // target level. Pure over the record, and
  // lifted by name in the node test.
  function judgeGlow(rec, level, now) {
    if (!rec.speaking) {
      rec.loudFrom = 0;
      rec.loudLast = 0;
      rec.glowLit = false;
    } else if (level >= SPEAK_ON) {
      if (!rec.loudFrom) rec.loudFrom = now;
      rec.loudLast = now;
    }
    if (rec.speaking && !rec.glowLit && rec.loudFrom && rec.loudLast - rec.loudFrom >= GLOW_ONSET) {
      rec.glowLit = true;
    }
    rec.glow = rec.glowLit ? glowIntensity(level) : 0;
    return rec.glow;
  }

  // glowStyle is what a name label is given for the warm rim: --lvl, as
  // a string with two places so an unchanged level writes nothing, and
  // the transition's duration for getting there — the attack going up,
  // the release coming down; --on, 1 while lit; and how long --on waits
  // before going out, which is the release, so the rim and its inner
  // light fade with the level rather than vanishing at once. Under reduced
  // motion a lit rim is one steady level and nothing waits. Pure, and
  // lifted by name in the node test.
  function glowStyle(lit, target, before, reduced) {
    const value = reduced ? (lit ? GLOW_STEADY : 0) : lit ? target : 0;
    const time = reduced ? 0 : value > before ? GLOW_ATTACK : GLOW_RELEASE;
    const onTime = reduced || lit ? 0 : GLOW_RELEASE;
    return { lvl: value.toFixed(2), time: time + 'ms', on: lit ? '1' : '0', onTime: onTime + 'ms' };
  }

  // hearingShown is what a tile says about its audio, in order: the
  // Muted badge, when the person says so (a glow beside it would only
  // argue); "Sound blocked", when this browser will not play; "No sound",
  // when the five-second rule says so; and otherwise the live sound, the
  // glow behind the name ('meter', the state's name from before). The same
  // order for our own tile, which is never blocked. Pure, and lifted by
  // name in the node test.
  function hearingShown(media, blocked, silent) {
    if (media && media.muted) return 'muted';
    if (blocked) return 'blocked';
    if (silent) return 'silent';
    return 'meter';
  }

  // remoteNotice is what a peer's own report says about hearing us: that
  // their browser is refusing sound, or that they are getting none from
  // us while we are not muted. Pure, and lifted by name in the node test.
  function remoteNotice(name, media, me, muted) {
    if (!media) return '';
    if (media.audioBlocked) {
      return name + '’s browser is blocking sound — they need to click to hear you.';
    }
    if (!muted && me && Array.isArray(media.noSoundFrom) && media.noSoundFrom.includes(me)) {
      return name + ' isn’t getting any sound from you.';
    }
    return '';
  }

  // noSoundList is the `noSoundFrom` this tab would report now: every
  // peer the five-second rule has judged silent, sorted, and never more
  // than the hub will take.
  function noSoundList() {
    const out = [];
    for (const [id, rec] of hearing) if (rec.silent) out.push(id);
    return out.sort().slice(0, MAX_NO_SOUND);
  }

  // The words and the explanation behind the ⓘ, for each thing a tile
  // can say. The explanations are what someone who has never used this
  // app needs in order to do something about it.
  const HEAR_SELF_SILENT = 'Your microphone isn’t picking anything up';
  const HEAR_SELF_WHY = 'Calls is sending your microphone, but it has been silent for a few seconds, ' +
    'so the others hear nothing. Check the microphone chosen under Devices, or on the holding screen, ' +
    'and the input your computer’s sound settings are using. A microphone with its own mute ' +
    'switch, or an audio interface sending a different input, looks exactly like this.';
  const HEAR_BLOCKED = 'Sound blocked — click to hear';
  const HEAR_BLOCKED_WHY = 'This browser will not play sound until you interact with the page. ' +
    'Click anywhere, or press any key, and the call’s sound comes on.';
  const HEAR_SILENT_WHY = 'Their audio is reaching this browser, but it has been silent for a few ' +
    'seconds while they are not muted. Their microphone may not be picking anything up: the wrong ' +
    'input chosen, a microphone muted on the device itself, or an audio interface sending a ' +
    'different input. Calls lets them know.';

  // reducedMotion: the person has asked for less movement, so the warm
  // rim holds one level rather than following the voice.
  function reducedMotion() {
    return typeof matchMedia === 'function' && matchMedia('(prefers-reduced-motion: reduce)').matches;
  }

  // hearingMarks builds one tile's hearing parts: the sentence with its
  // ⓘ, and the line for a peer's notice. The live sound is the warm rim
  // on the name label itself (drawHearing), which is a box-shadow and so
  // nothing a screen reader hears — a level moving five times a second is
  // noise to one — and everything it means that matters is said in the
  // sentence instead.
  function hearingMarks() {
    const box = document.createElement('div');
    box.className = 'calls-tile-hear';
    box.hidden = true;
    const text = document.createElement('span');
    const info = document.createElement('details');
    info.className = 'calls-info';
    const summary = document.createElement('summary');
    summary.setAttribute('aria-label', 'What this means');
    summary.textContent = 'ⓘ';
    const why = document.createElement('p');
    info.append(summary, why);
    box.append(text, info);
    const notice = document.createElement('span');
    notice.className = 'calls-tile-notice';
    notice.hidden = true;
    return { box, text, why, notice, noticeText: '', noticeKind: '', kind: '', glow: '0.00', on: '0' };
  }

  // drawHearing brings one tile's hearing parts up to date. Called from
  // markTile and from every level poll, so it writes nothing that has
  // not changed: a details element someone has opened stays open, and
  // the live region hears a notice once.
  function drawHearing(key) {
    const t = tiles.get(key);
    if (!t || !t.hear) return;
    const h = t.hear;
    const self = key === 'self';
    const rec = self ? selfHearing : hearing.get(key) || null;
    const media = self ? localMedia() : remoteMedia.get(key) || null;
    const blocked = !self && refusedTiles.has(key);
    const shown = hearingShown(media, blocked, !!(rec && rec.silent));
    t.hearShown = shown;
    const lit = shown === 'meter' && !!(rec && rec.glowLit);
    const glow = glowStyle(lit, rec ? rec.glow : 0, Number(h.glow), reducedMotion());
    if (h.glow !== glow.lvl) {
      h.glow = glow.lvl;
      t.label.style.setProperty('--lvl-t', glow.time);
      t.label.style.setProperty('--lvl', glow.lvl);
    }
    if (h.on !== glow.on) {
      h.on = glow.on;
      t.label.style.setProperty('--on-t', glow.onTime);
      t.label.style.setProperty('--on', glow.on);
    }
    const litText = lit ? 'on' : 'off';
    if (t.label.dataset.glow !== litText) t.label.dataset.glow = litText;
    const name = self ? '' : names.get(key) || 'Someone';
    let kind = '';
    let text = '';
    let why = '';
    if (shown === 'blocked') {
      kind = 'blocked';
      text = HEAR_BLOCKED;
      why = HEAR_BLOCKED_WHY;
    } else if (shown === 'silent') {
      kind = self ? 'self' : 'silent:' + name;
      text = self ? HEAR_SELF_SILENT : 'No sound from ' + name;
      why = self ? HEAR_SELF_WHY : HEAR_SILENT_WHY;
    }
    if (h.kind !== kind) {
      h.kind = kind;
      h.text.textContent = text;
      h.why.textContent = why;
      h.box.hidden = !kind;
    }
    if (self) return;
    const joining = connecting.peers.get(key);
    const said = peerNotice(name, media, state.peer, localMedia().muted, !!joining && !joining.done,
      !!joining && joining.shown, reconnect.peers.has(key));
    const notice = said.text;
    if (h.noticeText !== notice || h.noticeKind !== said.kind) {
      h.noticeText = notice;
      h.noticeKind = said.kind;
      h.notice.textContent = notice;
      if (said.kind === 'connecting') h.notice.append(ellipsisEl());
      if (said.kind) h.notice.dataset.kind = said.kind;
      else delete h.notice.dataset.kind;
      h.notice.hidden = !notice;
    }
    if (rec && rec.notice !== notice) {
      rec.notice = notice;
      announceMedia(notice);
    }
  }

  // ellipsisEl is three dots that pulse in turn (calls.css; one steady
  // ellipsis under reduced motion), hidden from screen readers: the
  // sentence is said once, the dots never.
  function ellipsisEl() {
    const dots = document.createElement('span');
    dots.className = 'calls-ellipsis';
    dots.setAttribute('aria-hidden', 'true');
    for (let i = 0; i < 3; i++) {
      const dot = document.createElement('span');
      dot.textContent = '.';
      dots.append(dot);
    }
    return dots;
  }

  // audioPart finds a connection's microphone sender or receiver — the
  // camera m-line's audio, which is the only audio a connection carries
  // (§5.4's screen has none).
  function audioPart(pc, which) {
    try {
      return pc[which]().find((x) => x.track && x.track.kind === 'audio') || null;
    } catch {
      return null;
    }
  }

  // audioReport is the one report of `type` in a sender's or receiver's
  // own stats, which are a few objects rather than the connection's
  // whole walk.
  async function audioReport(part, type) {
    const stats = await part.getStats();
    let found = null;
    stats.forEach((r) => {
      if (!found && r.type === type && (r.kind === 'audio' || r.mediaType === 'audio')) found = r;
    });
    return found;
  }

  // audioAcked reads our microphone's sender: packets have left, and the
  // far side's receiver reports (remote-inbound-rtp, which exists only
  // once one has arrived) say they are reaching it.
  async function audioAcked(sender) {
    const stats = await sender.getStats();
    let sent = 0;
    let acked = false;
    stats.forEach((r) => {
      if (r.kind !== 'audio' && r.mediaType !== 'audio') return;
      if (r.type === 'outbound-rtp') sent = Math.max(sent, r.packetsSent || 0);
      if (r.type === 'remote-inbound-rtp' && ((r.packetsReceived || 0) > 0 ||
        (r.roundTripTimeMeasurements || 0) > 0 || typeof r.roundTripTime === 'number')) acked = true;
    });
    return sent > 0 && acked;
  }

  // speakerRecord is who has the floor, for Speaker view's stage.
  function speakerRecord() {
    return { current: '', since: -Infinity, candidate: '', candidateSince: 0 };
  }

  // speakerStep takes one poll's voices — [{peer, speaking, level}], the
  // speaking gate and level the glow already use, for everyone but us —
  // and who is still here, and moves the floor only once someone has
  // been the loudest speaker for SPEAKER_DOMINANCE and whoever had it has
  // had SPEAKER_HOLD. A pause, or the speaker speaking, is nobody taking
  // over. Someone who left loses it at once. Returns whether it moved.
  // Pure, and lifted by name in test/browser/room-layout.test.mjs.
  function speakerStep(rec, voices, present, now) {
    const before = rec.current;
    if (rec.current && !present.has(rec.current)) {
      rec.current = '';
      rec.since = -Infinity;
    }
    let loudest = '';
    let level = -1;
    for (const v of voices) {
      if (v.speaking && present.has(v.peer) && v.level > level) {
        loudest = v.peer;
        level = v.level;
      }
    }
    if (!loudest || loudest === rec.current) {
      rec.candidate = '';
    } else if (loudest !== rec.candidate) {
      rec.candidate = loudest;
      rec.candidateSince = now;
    }
    if (rec.candidate && now - rec.candidateSince >= SPEAKER_DOMINANCE && now - rec.since >= SPEAKER_HOLD) {
      rec.current = rec.candidate;
      rec.since = now;
      rec.candidate = '';
    }
    return rec.current !== before;
  }

  // sampleInto takes one report into one record, and returns the sample.
  function sampleInto(rec, report, now) {
    const s = audioSample(rec.sampled ? rec : null, report);
    rec.sampled = true;
    rec.level = s.level;
    rec.peak = Math.max(rec.peak, s.level);
    rec.energy = s.energy;
    rec.duration = s.duration;
    rec.packets = s.packets;
    if (s.grew) rec.packetAt = now;
    judgeSpeaking(rec, s.level);
    judgeGlow(rec, s.level, now);
    return s;
  }

  // pollLevels is the hearing watch: one receiver's stats per connection,
  // and one sender's for our own microphone, five times a second. Never
  // two at once — a getStats that takes longer than the interval would
  // otherwise stack.
  async function pollLevels() {
    if (levelsBusy || state.stopped) return;
    levelsBusy = true;
    try {
      const now = Date.now();
      let selfReport = null;
      for (const [id, entry] of pcs) {
        let rec = hearing.get(id);
        if (!rec) {
          rec = hearingRecord();
          hearing.set(id, rec);
        }
        const receiver = audioPart(entry.pc, 'getReceivers');
        let report = null;
        try {
          report = receiver ? await audioReport(receiver, 'inbound-rtp') : null;
        } catch {
          // A closing connection: nothing heard.
        }
        // §15.24: whether the path from them is established, for `hearing`.
        const pcState = entry.pc.connectionState;
        const iceState = entry.pc.iceConnectionState;
        const remote = remoteMedia.get(id) || null;
        entry.audioLive = !!(receiver && receiver.track && receiver.track.readyState === 'live');
        entry.heard = judgeHeard(!!entry.heard, {
          connected: pcState === 'connected' || iceState === 'connected' || iceState === 'completed',
          bad: pcState === 'failed' || pcState === 'closed',
          hasReceiver: !!receiver,
          receiverLive: entry.audioLive,
          packets: report && typeof report.packetsReceived === 'number' ? report.packetsReceived : 0,
          samples: report && typeof report.totalSamplesReceived === 'number' ? report.totalSamplesReceived : 0,
          senderMuted: !!(remote && remote.muted),
        });
        // And for someone who does not say who they hear: whether their
        // receiver reports show our audio reaching them. Asked only while
        // it could still matter.
        if (!entry.acked && connectingNow(id) && hearsYou(remote, state.peer) === null) {
          const sender = audioPart(entry.pc, 'getSenders');
          try {
            entry.acked = sender ? await audioAcked(sender) : false;
          } catch {
            entry.acked = false;
          }
        }
        if (!report) {
          rec.level = 0;
          rec.speaking = false;
          judgeGlow(rec, 0, now);
          judgeSilence(rec, now, false, false, false);
        } else {
          const s = sampleInto(rec, report, now);
          const t = tiles.get(id);
          const media = remoteMedia.get(id) || null;
          // Eligible: the peer has said it is unmuted, and this tab is
          // playing it. A paused element pulls no audio through the
          // decoder, so every level reads flat, and that is this
          // browser's silence and not the sender's.
          const eligible = !!(s.measurable && media && !media.muted && t && t.video && !t.video.paused &&
            !refusedTiles.has(id) && entry.pc.connectionState === 'connected');
          judgeSilence(rec, now, eligible, now - rec.packetAt < ARRIVING_WINDOW, s.heard);
        }
        // Our own microphone is read off a connection that is up: one
        // that is sending it to someone. Alone, or with nobody connected
        // yet, there is nothing to judge (selfMicWatched).
        if (!selfReport && entry.pc.connectionState === 'connected') {
          const sender = audioPart(entry.pc, 'getSenders');
          try {
            selfReport = sender ? await audioReport(sender, 'media-source') : null;
          } catch {
            selfReport = null;
          }
        }
      }
      const track = local && local.getAudioTracks()[0];
      if (selfReport && track && track.readyState === 'live') {
        const s = sampleInto(selfHearing, selfReport, now);
        judgeSilence(selfHearing, now, selfMicWatched(s.measurable, localMedia().muted, true), true, s.heard);
      } else {
        selfHearing.level = 0;
        selfHearing.speaking = false;
        judgeGlow(selfHearing, 0, now);
        judgeSilence(selfHearing, now, false, false, false);
      }
      // Who has the floor, for call-layout.js's Speaker view: on #tiles,
      // where its observer sees it change a few times a minute at most.
      const voices = [];
      for (const id of pcs.keys()) {
        const rec = hearing.get(id);
        if (rec) voices.push({ peer: id, speaking: !!rec.speaking, level: rec.level || 0 });
      }
      if (speakerStep(stageSpeaker, voices, new Set(pcs.keys()), now)) {
        if (stageSpeaker.current) tilesEl.dataset.speaker = stageSpeaker.current;
        else delete tilesEl.dataset.speaker;
      }
      const key = noSoundList().join(',');
      const heardKey = hearingList().join(',');
      const heardMoved = hearingMoved(hearingKey, heardKey, new Set(pcs.keys()));
      hearingKey = heardKey;
      if (key !== noSoundKey || heardMoved) {
        noSoundKey = key;
        reportMedia();
      }
      for (const k of tiles.keys()) drawHearing(k);
    } finally {
      levelsBusy = false;
    }
  }

  // ---------------------------------------------------------------
  // Sound the browser refused to play (§15.20)
  // ---------------------------------------------------------------
  //
  // Chromium plays a MediaStream without a gesture whatever its autoplay
  // policy says, but Safari, Firefox and a site set to "Block" in Edge
  // may not. Each refused tile already offers its own Play; this is the
  // page-level half, because a first-time visitor looking at a paused
  // face does not know that the silence and the picture are the same
  // problem. Any click or key anywhere is the gesture, and it resumes
  // every tile at once — shouldPlay's rule still holds, because this is
  // the person's gesture and not a retry behind their back.

  // autoplayPolicyDoubtful asks the browser in advance, where it will
  // say (Firefox's getAutoplayPolicy). Only a hint: the refusal itself
  // is what decides.
  function autoplayPolicyDoubtful() {
    try {
      const policy = typeof navigator !== 'undefined' && typeof navigator.getAutoplayPolicy === 'function'
        ? navigator.getAutoplayPolicy('mediaelement')
        : '';
      return policy === 'disallowed' || policy === 'allowed-muted';
    } catch {
      return false;
    }
  }

  // soundRefused records one tile's refusal, or its end, and puts the
  // consequences everywhere they go: the banner, the report, the tile.
  function soundRefused(key, refused) {
    const had = refusedTiles.has(key);
    if (refused) refusedTiles.add(key);
    else refusedTiles.delete(key);
    if (had === refused) return;
    const blocked = refusedTiles.size > 0;
    if (blocked !== audioBlocked) {
      audioBlocked = blocked;
      reportMedia();
    }
    drawBanner();
    drawHearing(key);
  }

  function bannerShown() {
    if (audioBlocked) return true;
    if (!autoplayDoubted) return false;
    for (const t of tiles.values()) if (!t.self && t.stream) return true;
    return false;
  }

  // soundBannerEl builds the banner now, empty and hidden, for the reason
  // warningEl gives: a live region inserted along with its text is one
  // nobody was watching.
  function soundBannerEl() {
    if (soundBanner) return soundBanner;
    const box = document.createElement('div');
    box.id = 'sound-banner';
    box.className = 'calls-sound-banner';
    box.hidden = true;
    const text = document.createElement('p');
    text.setAttribute('role', 'status');
    const button = document.createElement('button');
    button.type = 'button';
    button.setAttribute('rst-btn', 'primary');
    button.textContent = 'Turn on sound';
    // The click reaches the page-wide listener below as well; the button
    // is here for a keyboard, which needs something to land on.
    box.append(text, button);
    // In the window's notices, under the sharing notice: it stays on
    // screen whatever the controls do.
    const notices = $('notices');
    if (notices) notices.insertBefore(box, $('status') || null);
    else root.prepend(box);
    soundBanner = { box, text, button };
    return soundBanner;
  }

  function drawBanner() {
    const b = soundBannerEl();
    const show = bannerShown() && !state.stopped;
    if (show === !b.box.hidden) return;
    if (show) {
      b.box.hidden = false;
      b.text.textContent = 'Click anywhere to turn on sound';
      return;
    }
    b.text.textContent = '';
    b.box.hidden = true;
  }

  // resumeSound is the gesture's work: every remote tile that is not
  // playing is asked again, and the answers decide whether the banner
  // stays.
  function resumeSound() {
    autoplayDoubted = false;
    for (const [key, t] of tiles) {
      if (t.self || !t.stream || !t.video) continue;
      if (!t.video.paused && !refusedTiles.has(key)) continue;
      if (t.play) t.play.hidden = true;
      startPlaying(key, t);
    }
    drawBanner();
  }

  // A click or a key anywhere, while the banner is up. Capture, so a
  // control that stops propagation still counts as the gesture it was.
  // Space would also toggle the microphone below, and turning on sound
  // is what that first key was for — so that one press is kept from it.
  function onGesture(ev) {
    if (!bannerShown()) return;
    if (ev.type === 'keydown' && spaceKeyAction(ev, ev.target) === 'toggle') {
      ev.preventDefault();
      ev.stopImmediatePropagation();
    }
    resumeSound();
  }
  document.addEventListener('click', onGesture, true);
  document.addEventListener('keydown', onGesture, true);

  // ---------------------------------------------------------------
  // Terminal states (§4.5, §4.2)
  // ---------------------------------------------------------------
  //
  // Every reason ends the call the same way — close the stream, close
  // every connection, stop the camera — and differs only in the
  // sentence and the way out. `replaced` is the one the server names
  // most often; the rest of the keys below are this file's own words
  // for a refusal it had to interpret.

  const TERMINAL = {
    replaced: 'This meeting is open in another tab.',
    standing: 'You no longer have access to this meeting.',
    expired: 'Your invitation to this meeting has expired.',
    removed: 'Someone removed you from this meeting.',
    ended: 'This meeting has ended.',
    gone: 'You cannot join this meeting.',
    signedout: 'You have been signed out.',
    accept: 'This browser could not open the call\u2019s connection.',
    unreachable: 'Calls cannot reach the call. The room may be full, or you may have been signed out.',
    nowebrtc: 'This browser cannot make calls.',
  };

  function terminal(reason) {
    if (state.stopped) return;
    // §15.26: the last window's report, and the diagnostics for "Report a
    // problem", while the connections are still there to read.
    sendQuality(true);
    const lastDiagnostics = callDiagnostics({ anonymous: true });
    state.stopped = true;
    state.terminal = reason;
    // Admission ended with the participation. `peer` is kept: it names
    // what this tab held, which is worth having in a diagnosis, and
    // nothing reconnects with it once stopped is set.
    state.admitted = false;
    clearTimeout(reconnectTimer);
    clearTimeout(fullTimer);
    clearInterval(statsTimer);
    clearInterval(backdropTimer);
    wake.release();
    clearInterval(reconnectWatchTimer);
    clearInterval(levelTimer);
    stopIceTimers();
    closeStream();
    closeAllPCs();
    stopLocal();
    // §5.4: whatever is left of a share goes with the call. The
    // transceivers are already closed with their connections, so this is
    // the capture itself and the button's own state.
    stopSharing();
    remoteMedia.clear();
    renderTiles();
    drawBanner();
    iceWarning(false);
    controlsEnabled(false);
    // §6: nothing can be sent from here, so the composer says so. The
    // log stays readable — what was said is still worth reading.
    chatEnabled(false);
    say(TERMINAL[reason] || TERMINAL.ended);
    wayOut(reason);
    offerProblemAfter(reason, lastDiagnostics);
  }

  // offerProblemAfter puts "Report a problem" beside the way out of a
  // call that is over (§15.26): the token goes on working for ten
  // minutes, and the sheet carries the diagnostics as they were left.
  // Not for a sign-in that lapsed — the report needs the session — nor
  // for a browser that could never make a call.
  function offerProblemAfter(reason, diagnostics) {
    if (!reportToken || !window.CallsReport || reason === 'signedout' || reason === 'nowebrtc') return;
    const b = document.createElement('button');
    b.type = 'button';
    b.id = 'report-problem-after';
    b.className = 'calls-report-after';
    b.textContent = 'Report a problem';
    b.addEventListener('click', () => {
      window.CallsReport.open(Object.assign(problemOptions(b), { diagnostics: () => diagnostics }));
    });
    statusEl.append(' ', b);
  }

  // wayOut is the rule that no terminal screen is a dead end. Being
  // signed out is answered by signing in, and by nothing else: the
  // holding screen would only bounce this person to the same sign-in
  // page. Every other reason ends with the holding screen, which is
  // where a person can look at their camera and try again, and two of
  // them offer something better first — `replaced` the takeover, which
  // is what this tab is actually for, and `unreachable` another go at
  // the room. The specific link comes first, so it reads as the answer
  // and the holding screen as the fallback.
  function wayOut(reason) {
    if (reason === 'signedout') {
      // Back to this meeting's holding screen once signed in (spec §9.4).
      link('/signin?return_to=' + encodeURIComponent('/m/' + sqid + '/join'), 'Sign in again');
      return;
    }
    if (reason === 'replaced') link('/m/' + encodeURIComponent(sqid) + '/takeover', 'Use this tab instead');
    if (reason === 'unreachable') link('/m/' + encodeURIComponent(sqid), 'Try again');
    link('/m/' + encodeURIComponent(sqid) + '/join', 'Back to the holding screen');
  }

  function link(href, text) {
    const a = document.createElement('a');
    a.href = href;
    a.textContent = text;
    statusEl.append(' ', a);
  }

  function controlsEnabled(on) {
    muteButton.disabled = !on;
    cameraButton.disabled = !on;
    leaveButton.disabled = !on;
    // A browser with no getDisplayMedia is a browser where Share screen
    // is a control that could only ever do nothing, so it is never
    // enabled — the same rule the two device toggles follow when there
    // is no track for them to move.
    if (shareButton) shareButton.disabled = !on || !HAS_DISPLAY_MEDIA;
    // The device panel goes the same way. A terminal screen's pickers
    // are inert anyway — applySwitch refuses once state.stopped — but a
    // live-looking select that silently does nothing is the worse half
    // of that, so they are disabled and say so.
    if (devicesToggle) devicesToggle.disabled = !on;
    for (const el of [pickCamera, pickMic, pickSpeaker, rawInput, pickShareMode]) {
      if (el) el.disabled = !on;
    }
  }

  // ---------------------------------------------------------------
  // Rendering (§3.4's room, §4.3's queue)
  // ---------------------------------------------------------------

  function say(text, quiet) {
    statusEl.replaceChildren();
    statusEl.textContent = text;
    // A quiet line is how the call is going rather than something wrong
    // with it, and fades with the controls (calls.css); everything else
    // said here stays on screen until it is over.
    statusEl.toggleAttribute('data-quiet', !!quiet);
  }

  // statusLine is what the status notice says for how the call is going,
  // and whether it is quiet (fades with the controls): the one place the
  // call's state is put into words since the title pill went (2026-10-02).
  // Pure, so test/browser/room-window.test.mjs lifts it by name and holds
  // every state the pill used to carry — connecting, waiting to be let
  // in, full, reconnecting — to a notice. The call being over is said by
  // stop(), with its way out, and renderStatus says nothing after it.
  function statusLine(s, reconnectCall, others, member) {
    if (s.full) return ['The room is full.', false];
    // A member is admitted by its own join, so between hello and the
    // roster it is connecting, not waiting. Only a guest that has
    // knocked is actually waiting for anyone.
    if (!s.admitted) {
      return [s.peer && s.joined && !member ? 'Waiting for someone to let you in.' : 'Connecting to the call.', false];
    }
    if (reconnectCall) return ['Reconnecting…', false];
    if (!others) return ['You are the only one here.', true];
    return ['', false];
  }

  function renderStatus() {
    if (state.stopped) return;
    const [text, quiet] = statusLine(state, reconnect.call, pcs.size, isMember());
    say(text, quiet);
  }

  function isMember() {
    return state.kind === 'member';
  }

  function renderTiles() {
    const wanted = [];
    if (local) wanted.push('self');
    for (const [id, entry] of pcs) {
      wanted.push(id);
      // §5.4: a peer sharing a screen holds two tiles, and the second
      // one exists from the `share` message rather than from the track
      // — the message beats the media by a renegotiation, and a tile
      // that is about to fill is better than a grid that jumps.
      if (hasShare(entry)) wanted.push(shareKey(id));
    }
    for (const key of Array.from(tiles.keys())) {
      if (!wanted.includes(key)) {
        tiles.get(key).figure.remove();
        tiles.delete(key);
        // A tile that has gone cannot be blocked any more.
        soundRefused(key, false);
      }
    }
    if (local) {
      tile('self', selfName, local, true, '');
      markTile('self', localMedia());
    }
    for (const [id, entry] of pcs) {
      const name = names.get(id) || 'Someone';
      // The track as well as the stream: which video track a tile is
      // meant to be showing is `onRemoteTrack`'s judgement, and passing
      // it here is what keeps the element off a superseded one (Codex
      // S4-9). Undefined for a tile whose role has never named one, in
      // which case tile() falls back to the stream's own first video
      // track, which is unambiguous by then.
      tile(id, name, entry.stream, false, tileNote(id, entry), entry.cameraTrack);
      markTile(id, remoteMedia.get(id) || null);
      // The screen's own tile carries no note: §5.3's and §5.5's
      // sentences are about a connection, and this is the same
      // connection as the camera tile above, which is already saying it.
      if (hasShare(entry)) {
        tile(shareKey(id), shareCaption(name), entry.share && entry.share.stream, false, '',
          entry.share && entry.share.track);
      }
    }
    renderStatus();
  }

  // tileNote is the sentence a tile carries when its connection is not
  // working, and the empty string when it is. §5.3 step 3's relay
  // sentence comes first: it says *why*, where §5.5's says only that.
  // §5.5's own wording depends on whether there was a relay to fail —
  // "even through the relay" is a claim about this instance, and
  // data-relay is where the server states it.
  function tileNote(id, entry) {
    const record = renewals.get(id);
    if (record && record.trouble === 'expired') return ICE_EXPIRED;
    if (record && record.trouble === 'stuck') return ICE_STUCK;
    if (!entry.failed) return '';
    // Both halves have to be true for the longer sentence: this
    // instance has a relay, and *this connection* was given it. A
    // connection still running on the empty list never went near one,
    // and saying it failed through the relay would be a claim about
    // something it never tried.
    return relayConfigured && !entry.floor ? FAILED_RELAY : FAILED_PLAIN;
  }

  // tile builds or updates one <figure> per participant. Nothing here
  // uses innerHTML, and every name is written with textContent: names
  // come from the server's roster, peer and knock events and are other
  // people's text.
  function tile(key, name, stream, isSelf, noteText, want) {
    let t = tiles.get(key);
    if (!t) {
      const figure = document.createElement('figure');
      figure.className = 'calls-tile';
      figure.dataset.tile = key;
      const video = document.createElement('video');
      video.autoplay = true;
      video.playsInline = true;
      video.setAttribute('playsinline', '');
      if (isSelf) {
        video.muted = true;
        figure.classList.add('calls-tile-self');
      }
      // §5.4: a screen is not a face. The class is the one thing tile()
      // knows about sharing, and it exists so calls.css can fit the whole
      // screen into the tile instead of cropping it to fill.
      if (key.slice(-SHARE_SUFFIX.length) === SHARE_SUFFIX) {
        figure.classList.add('calls-tile-share');
        // What surrounds the fitted screen on the stage (paintBackdrops).
        const backdrop = document.createElement('canvas');
        backdrop.className = 'calls-tile-backdrop';
        backdrop.width = BACKDROP_W;
        backdrop.height = BACKDROP_H;
        backdrop.setAttribute('aria-hidden', 'true');
        figure.append(backdrop);
      }
      const label = document.createElement('figcaption');
      label.className = 'calls-tile-name';
      const nameEl = document.createElement('span');
      const note = document.createElement('span');
      note.className = 'calls-tile-note';
      note.hidden = true;
      const retry = document.createElement('button');
      retry.type = 'button';
      retry.textContent = 'Retry';
      retry.hidden = true;
      retry.addEventListener('click', () => restartIce(key));
      const play = document.createElement('button');
      play.type = 'button';
      play.textContent = 'Play';
      play.hidden = true;
      play.addEventListener('click', () => {
        play.hidden = true;
        startPlaying(key, t);
      });
      label.append(nameEl, note, retry, play);
      figure.append(video, label);
      // §15.19's two marks, hidden until markTile says otherwise. A
      // screen has neither: it has no microphone, and it is never "off".
      const marks = key.slice(-SHARE_SUFFIX.length) === SHARE_SUFFIX ? null : tileMarks();
      // §15.20's hearing parts go with them, on the same tiles and for
      // the same reason: a screen carries no audio to meter.
      const hear = marks ? hearingMarks() : null;
      if (marks) {
        nameEl.after(marks.muted);
        figure.append(marks.off);
        // After Play, so the caption's buttons keep their order.
        label.append(hear.box, hear.notice);
      }
      tilesEl.append(figure);
      // `self` is kept on the record because rearmFrames reads it: the
      // local preview is never counted, and only tile() knows which
      // tile is ours.
      t = {
        figure, video, label, nameEl, note, retry, play,
        muted: marks && marks.muted, off: marks && marks.off,
        hear, hearShown: '',
        remove: null, stream: null, track: null, self: isSelf,
        // What judgeRender remembers between polls: the element's own
        // clock, the decoder's count, and how long the two have
        // disagreed.
        renderTime: -1, renderDecoded: -1, renderStalls: 0, renderReplays: 0,
      };
      tiles.set(key, t);
      if (!isSelf) applySink(video);
    }
    t.nameEl.textContent = isSelf ? name + ' (you)' : name;
    // call-layout.js keeps this viewer's order by name, which survives a
    // rejoin where a peer id does not.
    if (t.figure.dataset.name !== name) t.figure.dataset.name = name;
    // The removal control comes and goes with our own kind, which the
    // roster re-states on every tick — a member demoted mid-call loses
    // it without the tile being rebuilt.
    // It is not in the name's label: since 2026-09-29 it is an item in
    // the tile's ⋯ menu (call-layout.js), which reads it from here.
    if (!isSelf && isMember() && !t.remove && PEER_ID.test(key)) {
      t.remove = removeHref(key);
      t.figure.dataset.removeHref = t.remove;
    } else if (t.remove && !isMember()) {
      delete t.figure.dataset.removeHref;
      t.remove = null;
    }
    // The track as well as the stream: a camera the far side rebuilt
    // can arrive inside the same MediaStream object, and a tile that
    // watched only the object would keep an element pointed at a track
    // that has ended. Nulling srcObject first is what makes the element
    // let go of it — assigning the same object again is a no-op.
    // `want` is the track this tile is meant to be showing, named by
    // whoever put it in the stream; the stream's own first video track
    // is the fallback for a tile nobody has named one for. Either way
    // the element follows a track identity and not an array position.
    const shown = want || shownTrack(stream);
    if (t.stream !== stream || t.track !== shown) {
      // srcObject only: media-src in the page's CSP would block a blob:
      // URL, and createObjectURL is the wrong tool here anyway.
      if (t.stream === stream) t.video.srcObject = null;
      t.video.srcObject = stream || null;
      t.stream = stream || null;
      t.track = shown;
      if (shouldPlay(t, isSelf)) startPlaying(key, t);
    }
    // The frame counter follows the stream, not the element: a tile
    // whose track arrives after it was drawn must still be counted, and
    // a rebuilt pair hands the same element a new one. Asked on every
    // render rather than only when the stream changes, because a chain
    // can also end on its own — an element detached while the grid was
    // rebuilt — and this is what puts it back.
    if (stream && !isSelf) watchFrames(key, t.video);
    // One note element and one Retry beside it, whichever sentence the
    // tile is carrying: `restartIce` is the handler for both, and it
    // decides whether a retry means a bare ICE restart or a renewal.
    const show = !!noteText;
    t.note.hidden = !show;
    t.retry.hidden = !show;
    t.note.textContent = noteText || '';
  }

  // startPlaying asks the element to play and, if the browser refuses
  // (an autoplay policy that wants a gesture first), offers the gesture
  // rather than leaving a still frame nobody can explain. A refusal by
  // policy — NotAllowedError, and nothing else — is also §15.20's
  // `audioBlocked`: the page banner, and the report that tells the
  // people this tab cannot hear.
  function startPlaying(key, t) {
    const attempt = t.video.play();
    if (!attempt || typeof attempt.catch !== 'function') return;
    attempt.then(() => {
      if (t.play) t.play.hidden = true;
      if (!t.self) autoplayDoubted = false;
      soundRefused(key, false);
    }).catch((err) => {
      if (t.play) t.play.hidden = false;
      if (err && err.name === 'NotAllowedError' && tiles.get(key) === t) soundRefused(key, true);
    });
  }

  function removeHref(id) {
    // §3.5: a destructive action gets its own confirm page URL, which
    // the tile menu opens in a new tab, because this one is holding a
    // call.
    return '/m/' + encodeURIComponent(sqid) + '/remove/' + id;
  }

  // restartIce is the Retry on a tile, and it answers both sentences.
  // A connection whose relay credential ran out needs a fetch before a
  // restart, and so does one whose list is past its `renewAt` — a bare
  // restart there would re-gather on a credential the relay has already
  // stopped honouring (§5.3 step 3). Everything else is §5.1's plain
  // restart, which is what this control always was.
  function restartIce(id) {
    const entry = pcs.get(id);
    if (!entry) return;
    entry.failed = false;
    const record = renewals.get(id);
    const trouble = (record && record.trouble) || '';
    if (record) record.trouble = '';
    renderTiles();
    if (trouble || iceStale()) {
      retryRenewal(id, trouble).catch((err) => {
        console.error('meet: renew', err);
      });
      return;
    }
    bareRestart(id, entry);
  }

  // bareRestart is §5.1's retry, unchanged: the restart, and a fresh
  // generation from the hub for a browser that has no restartIce.
  function bareRestart(id, entry) {
    try {
      entry.pc.restartIce();
    } catch {
      requestReset(id);
    }
  }

  // iceStale: we hold a list, and the server's own renew time for it has
  // passed. A retry then is a renewal, not a restart.
  function iceStale() {
    return !!(schedulable() && Date.now() - ice.fetchedAt >= renewDelay());
  }

  // schedulable: there is a credential, there are servers to renew it
  // for, and the margin the server left is one a schedule can be built
  // on. Pure enough to gate without a browser.
  function schedulable() {
    return !!(ice.expiresAt && ice.servers.length && ice.margin >= MIN_MARGIN);
  }

  // applySink routes a remote tile's audio to the speaker the holding
  // screen remembered. Feature-detected on the prototype, because a
  // browser without setSinkId would otherwise leave that picker as a
  // control that does nothing.
  function applySink(video) {
    if (!prefs.speaker || !HAS_SINK_ID) return;
    video.setSinkId(prefs.speaker).catch(() => {
      // The remembered output is gone, or is not permitted: the
      // browser's default output carries the call instead.
    });
  }

  // renderQueue draws the admission queue. Only members are ever sent
  // knock, knock-gone or roster.waiting, so what is in `waiting` is
  // already the server's decision about who may see this.
  function renderQueue() {
    knocksEl.replaceChildren();
    for (const w of waiting) {
      const li = document.createElement('li');
      const who = document.createElement('span');
      who.textContent = w.name || 'Someone';
      const button = document.createElement('button');
      button.type = 'button';
      button.textContent = 'Admit';
      button.addEventListener('click', () => admit(w.peer, button));
      li.append(who, button);
      knocksEl.append(li);
    }
    queueEl.hidden = waiting.length === 0;
  }

  async function admit(peer, button) {
    button.disabled = true;
    // admit names its target in the payload, not in `to` (§4.3).
    const res = await postSignal({ peer: state.peer, type: 'admit', payload: { peer } });
    if (res.signedOut) {
      terminal('signedout');
      return;
    }
    if (res.status === 409) {
      // The guest is no longer waiting: gone, or admitted by someone
      // else. The knock-gone that follows removes the row anyway.
      dropWaiting(peer);
      renderQueue();
      return;
    }
    if (res.status === 404) {
      await recoverFromNotFound(res.data.boot);
      return;
    }
    if (res.status !== 200) button.disabled = false;
  }

  // ---------------------------------------------------------------
  // Controls (§3.4)
  // ---------------------------------------------------------------

  // The one way the microphone is toggled, by the button and by Space
  // alike, so the tile marks and the `media` report to peers follow
  // either (applyToggles). A toggle from the keyboard is also said out
  // loud: the button's aria-pressed is announced only to someone whose
  // focus is on the button, and Space works precisely when it is not.
  function toggleMute(fromKeyboard) {
    prefs.muted = !prefs.muted;
    savePrefs();
    applyToggles();
    if (fromKeyboard) announceMedia(prefs.muted ? 'Microphone muted.' : 'Microphone on.');
  }

  muteButton.addEventListener('click', () => toggleMute(false));

  // Space toggles mute, as it does in most calling apps — but only when
  // Space means nothing else. spaceKeyAction decides: 'toggle', 'swallow'
  // for a held key's repeats (handled, so they neither flicker the
  // microphone nor scroll the page), or '' for a key that is not ours.
  // Only a handled key is prevented. Push-to-talk (holding Space while
  // muted to speak) would start here and is deliberately not built.
  document.addEventListener('keydown', (ev) => {
    const action = spaceKeyAction(ev, ev.target);
    if (!action || muteButton.disabled || state.stopped) return;
    ev.preventDefault();
    if (action === 'toggle') toggleMute(true);
  });

  cameraButton.addEventListener('click', () => {
    prefs.cameraOff = !prefs.cameraOff;
    savePrefs();
    applyToggles();
  });

  // The device panel. The button is hidden by the server and revealed
  // only where there is something behind it: a browser with no
  // enumerateDevices has no list to draw and no switch to offer, and a
  // control that does nothing is worse than no control.
  if (devicesToggle && devicesPanel && navigator.mediaDevices &&
      navigator.mediaDevices.enumerateDevices) {
    devicesToggle.hidden = false;
    devicesToggle.addEventListener('click', () => {
      const open = devicesPanel.hidden;
      devicesPanel.hidden = !open;
      devicesToggle.setAttribute('aria-expanded', String(open));
      // Filled on opening rather than at load: the list is only worth
      // having when it is about to be looked at, and a device plugged
      // in during the call is then always in the one that is shown.
      if (open) {
        fillDevices().catch((err) => {
          console.error('meet: devices', err);
        });
        if (pickCamera && cameraRow && !cameraRow.hidden) pickCamera.focus();
      }
    });
    if (rawInput) {
      if (deviceNote || $('raw-help')) rawInput.setAttribute('aria-describedby', 'raw-help');
      rawInput.checked = !!prefs.rawAudio;
    }
    navigator.mediaDevices.addEventListener?.('devicechange', () => {
      if (!devicesPanel.hidden) fillDevices().catch(() => {});
    });
    // Filled once now, as well as on every open. Opening reveals the
    // panel synchronously and fills it a microtask later, so without
    // this the first open is a flash of three empty selects — and the
    // focus below would be deciding on rows whose hidden state nothing
    // had set yet.
    fillDevices().catch(() => {});
  }

  // The three pickers and the studio switch. Each one is a getUserMedia
  // and a replaceTrack per connection (switchDevice), except the
  // speaker, which never touches the call at all: it is where this
  // browser plays what it has already received.
  if (pickCamera) {
    pickCamera.addEventListener('change', () => {
      switchDevice('video', pickCamera.value).catch((err) => {
        console.error('meet: camera', err);
      });
    });
  }
  if (pickMic) {
    pickMic.addEventListener('change', () => {
      switchDevice('audio', pickMic.value).catch((err) => {
        console.error('meet: microphone', err);
      });
    });
  }
  if (pickSpeaker) {
    pickSpeaker.addEventListener('change', () => {
      prefs.speaker = pickSpeaker.value;
      savePrefs();
      applySinkAll();
    });
  }
  if (rawInput) {
    // Studio audio is chosen when the track is opened and cannot be
    // changed on a track already running, so this re-opens the
    // microphone that is already in use — the same switch as picking it
    // again from the list, with a different set of constraints behind
    // it.
    rawInput.addEventListener('change', () => {
      const was = !!prefs.rawAudio;
      prefs.rawAudio = rawInput.checked;
      // The remembered microphone and not the live one. Passing the id
      // of whatever happens to be open would write it into prefs.mic
      // and pin someone who had been following the system default to
      // one device, for ever, because they touched an audio setting.
      switchDevice('audio', prefs.mic || '').then((ok) => {
        if (ok) {
          savePrefs();
          return;
        }
        // The microphone would not re-open, so the call is still on the
        // processed track and saying otherwise — in the checkbox or in
        // localStorage — would be a lie the next call would inherit.
        prefs.rawAudio = was;
        rawInput.checked = was;
      }).catch((err) => {
        prefs.rawAudio = was;
        rawInput.checked = was;
        console.error('meet: studio audio', err);
      });
    });
  }

  // "Optimise shared screen for". Applied at once to a share in
  // progress — contentHint on the track, parameters on each sender —
  // and remembered for the next.
  if (pickShareMode && shareModeRow && HAS_DISPLAY_MEDIA) {
    for (const [value, label] of SHARE_MODES) {
      const option = document.createElement('option');
      option.value = value;
      option.textContent = label;
      pickShareMode.append(option);
    }
    pickShareMode.value = shareMode();
    shareModeRow.hidden = false;
    pickShareMode.addEventListener('change', () => {
      prefs.shareMode = pickShareMode.value;
      savePrefs();
      if (!share) return;
      try {
        share.track.contentHint = sharePlan(shareMode()).contentHint;
      } catch {
        // No contentHint here: the sender parameters carry it.
      }
      for (const entry of pcs.values()) tuneShare(entry);
    });
  }

  // §5.4's gesture. The handler is not async: a rejection escaping one
  // goes where neither a person nor a gate could see it, so the work is
  // a named function with a catch of its own — the same shape as the
  // pageshow handler's.
  if (shareButton) {
    // The notice's own way out: the same stop as the Share button's.
    if (shareStop) shareStop.addEventListener('click', () => stopSharing());
    shareButton.addEventListener('click', () => {
      if (share) {
        stopSharing();
        return;
      }
      startSharing().catch((err) => {
        console.error('meet: share', err);
      });
    });
  }

  // "Copy call diagnostics" (§15.22), and a sentence in the device
  // panel's own live region either way.
  if (copyDiagnostics) {
    copyDiagnostics.addEventListener('click', () => {
      const text = callDiagnostics();
      const done = () => note('Call diagnostics copied.');
      const failed = () => note('The diagnostics could not be copied.');
      try {
        navigator.clipboard.writeText(text).then(done, failed);
      } catch {
        failed();
      }
    });
  }

  // §15.26: "Report a problem" from the Devices panel and from More. The
  // panel that opened it closes first, so Escape in the sheet closes the
  // sheet and nothing behind it, and the keyboard comes back to the bar
  // button the panel hung from.
  if (reportProblem) {
    reportProblem.addEventListener('click', () => {
      if (devicesPanel && !devicesPanel.hidden && devicesToggle) {
        devicesPanel.hidden = true;
        devicesToggle.setAttribute('aria-expanded', 'false');
      }
      openProblem(devicesToggle || reportProblem);
    });
  }
  if (reportProblemMenu) {
    reportProblemMenu.addEventListener('click', () => {
      if (morePanel && !morePanel.hidden) {
        morePanel.hidden = true;
        if (moreToggle) moreToggle.setAttribute('aria-expanded', 'false');
      }
      openProblem(moreToggle || reportProblemMenu);
    });
  }
  // "Send anonymous quality reports": on unless turned off, remembered in
  // this browser, and read at every report, so turning it off stops the
  // next one. "Report a problem" is a person's own choice each time and
  // does not ask it.
  if (qualityInput) {
    if ($('quality-help')) qualityInput.setAttribute('aria-describedby', 'quality-help');
    qualityInput.checked = qualityOn();
    qualityInput.addEventListener('change', () => {
      try {
        if (qualityInput.checked) localStorage.removeItem(QUALITY_KEY);
        else localStorage.setItem(QUALITY_KEY, 'off');
      } catch {
        // No storage: the switch holds for this page only.
      }
      qualityLocalOff = !qualityInput.checked;
    });
  }

  leaveButton.addEventListener('click', () => {
    leave();
    go('/m/' + encodeURIComponent(sqid) + '/join');
  });

  // go navigates only within this app: a path, never a URL that could
  // carry a scheme or a host.
  function go(path) {
    if (typeof path === 'string' && path.startsWith('/') && !path.startsWith('//')) {
      location.assign(path);
    }
  }

  // leave is not idempotent, so it is sent exactly once, and its
  // response is never read.
  function leave() {
    if (state.leaveSent) return;
    state.leaveSent = true;
    // §15.26, before the connections go: the last window's report, and
    // what the holding screen needs to offer "Report a problem" for the
    // next ten minutes — the token and the diagnostics as they are now,
    // because the page that has them is about to be gone.
    sendQuality(true);
    if (reportToken && window.CallsReport) {
      window.CallsReport.remember({ sqid, token: reportToken, diagnostics: callDiagnostics({ anonymous: true }), client: reportClient() });
    }
    state.stopped = true;
    clearTimeout(reconnectTimer);
    clearTimeout(fullTimer);
    clearInterval(statsTimer);
    clearInterval(backdropTimer);
    wake.release();
    clearInterval(reconnectWatchTimer);
    clearInterval(levelTimer);
    stopIceTimers();
    if (state.peer) postSignal({ peer: state.peer, type: 'leave' }, { keepalive: true });
    closeStream();
    closeAllPCs();
    stopLocal();
    stopSharing();
    chatEnabled(false);
  }

  // A page going into the back/forward cache is not a person leaving:
  // it comes back with its DOM intact and expects the call to still be
  // there. Only a real unload leaves. What the cache does not restore
  // is the stream or the tracks, so pageshow rebuilds both.
  window.addEventListener('pagehide', (e) => {
    if (e.persisted) {
      closeStream();
      return;
    }
    leave();
  });

  // The listener itself is not async: an async handler's rejection goes
  // nowhere an event target can report it, and getUserMedia is one await
  // away. The work is a named function with a catch of its own, so a
  // camera that will not restart after a bfcache return is a logged
  // error and a call that carries on, not a silent unhandled rejection.
  window.addEventListener('pageshow', (e) => {
    restoreFromCache(e).catch((err) => {
      console.error('meet: pageshow', err);
    });
  });

  // §5.3's last paragraph: a suspended tab stops its timers, so a tab
  // coming back compares the clock with `renewAt` rather than trusting
  // one. The listener is not async for the same reason the pageshow one
  // is not.
  document.addEventListener('visibilitychange', () => {
    if (document.visibilityState !== 'visible') return;
    catchUpRenewal();
    comeBack();
  });

  // lostKinds names the kinds of our own media that are gone for good:
  // a kind we had, whose every track has ended. Pure, and lifted by name
  // in the node test.
  function lostKinds(audio, video) {
    const out = [];
    const gone = (tracks) => tracks.length > 0 && tracks.every((t) => t.readyState === 'ended');
    if (gone(audio || [])) out.push('audio');
    if (gone(video || [])) out.push('video');
    return out;
  }

  // comeBack is the tab in front again (2026-10-03, an iPhone that "kept
  // cutting in and out"). Safari on iOS pauses a page's media in the
  // background and can end its camera and microphone outright; nothing
  // brought them back. A device that ended is opened again through the
  // switch every device change takes, onto every connection, and a tile
  // the system paused is asked to play once more — the same ask a render
  // makes, so a Play control showing still waits for the person.
  function comeBack() {
    if (state.stopped || state.leaveSent || !local) return;
    for (const kind of lostKinds(local.getAudioTracks(), local.getVideoTracks())) {
      const id = prefs[kind === 'audio' ? 'mic' : 'camera'] || '';
      switchDevice(kind, id).catch((err) => {
        console.error('meet: reopen ' + kind, err);
      });
    }
    for (const [key, t] of tiles) {
      if (key !== 'self' && t.video && t.video.paused && shouldPlay(t, false)) startPlaying(key, t);
    }
  }

  async function restoreFromCache(e) {
    if (!e.persisted || state.stopped || state.leaveSent) return;
    if (!local) await startLocal();
    renderTiles();
    if (state.peer) resume();
    else connectStream();
  }

  // ---------------------------------------------------------------
  // The test hook (Task 9's Playwright gate)
  // ---------------------------------------------------------------

  const HAS_RVFC = typeof HTMLVideoElement !== 'undefined' &&
    typeof HTMLVideoElement.prototype.requestVideoFrameCallback === 'function';

  // watchFrames counts rendered frames per peer. One chain per element
  // *and* per stream, which the first draft got wrong and the browser
  // gate's `laterolls` caught: setting `srcObject` resets the media
  // element and discards any pending `requestVideoFrameCallback`, so a
  // tile handed a new stream — a rebuilt pair, or a camera the far side
  // rebuilt after a rollback — lost its chain, and a `WeakSet` of
  // elements then refused to arm a new one. The tile went on playing
  // perfectly and its count stood still for the rest of the call, which
  // is a lie the gate reads as dead media.
  //
  // A WeakMap of what each element is currently being counted on says
  // both things: re-arm when the stream (or the tile) changed, and
  // leave a live chain alone. The old chain retires itself the moment
  // it is no longer the current one, so two counters never race the
  // same tile up. A chain that finds its element detached forgets
  // itself, so the next render arms a fresh one rather than counting
  // nothing for ever.
  // The identity is the tile, the stream *and* the track inside it: a
  // camera the far side rebuilt comes back on a new receiver track, and
  // in Chromium it comes back inside the same MediaStream, so a stream
  // alone cannot tell the two apart.
  const watched = new WeakMap(); // video -> {id, stream, track, at, time}

  // How long a chain may count nothing before it is treated as dropped
  // rather than idle — but only if the element's own clock moved on
  // meanwhile. A frozen tile is idle and must be left alone; a tile
  // that is playing and not counting has lost its callback.
  const FRAME_QUIET = 2000;

  function watchFrames(id, video) {
    if (!HAS_RVFC) return;
    const stream = video.srcObject;
    const track = (stream && stream.getVideoTracks && stream.getVideoTracks()[0]) || null;
    const current = watched.get(video);
    if (current && current.id === id && current.stream === stream &&
        current.track === track && !chainDropped(current, video)) {
      return;
    }
    const mine = { id, stream, track, at: Date.now(), time: video.currentTime };
    watched.set(video, mine);
    const step = () => {
      if (watched.get(video) !== mine) return;
      if (!video.isConnected) {
        // The grid was rebuilt under this tile. Forget the chain rather
        // than keeping a dead one on the books, so the next render arms
        // a fresh one.
        watched.delete(video);
        return;
      }
      mine.at = Date.now();
      frames.set(id, (frames.get(id) || 0) + 1);
      video.requestVideoFrameCallback(step);
    };
    video.requestVideoFrameCallback(step);
  }

  // chainDropped answers whether this chain has stopped counting while
  // its element played on, and remembers the clock it saw for next
  // time. Asked on every render and once a second from pollFrames, so
  // no cause of a lost callback — a replaced stream, a replaced track,
  // a tile detached and put back — can leave a tile playing perfectly
  // with a count that never moves again.
  function chainDropped(current, video) {
    const moved = video.currentTime !== current.time;
    current.time = video.currentTime;
    return moved && Date.now() - current.at > FRAME_QUIET;
  }

  // rearmFrames asks the question of every tile that has media, which
  // is what makes the answer above a repair rather than a diagnosis.
  function rearmFrames() {
    if (!HAS_RVFC) return;
    for (const [key, t] of tiles) {
      if (t && t.video && t.stream && !t.self) watchFrames(key, t.video);
    }
  }

  // frameKey places one inbound video report on one tile. A peer that is
  // sharing sends two video streams, and the loop below used to write
  // both under the peer's own key — so the camera's count was whatever
  // the last report happened to be, and the screen had none at all.
  // Pure, and lifted by name in the node test.
  //
  // The empty string means "cannot say": a report with no mid, on a
  // connection that has two video tiles, is left out rather than
  // credited to the wrong one. A connection with one tile is not
  // ambiguous, so a missing mid there still counts.
  //
  // What that costs, on a browser that reports no `mid` on inbound-rtp
  // and no requestVideoFrameCallback either: while a peer is sharing,
  // *both* of its tiles stop counting — the camera's number stands
  // still rather than being replaced by the screen's. It is the right
  // way round (a stale count is better than a wrong one, and only the
  // gate reads these), and no browser this app supports is in that
  // position: rVFC has been in Chromium since 83 and in Safari since
  // 15.4, and every browser without it that carries getStats reports
  // `mid`.
  function frameKey(id, entry, mid) {
    if (mid && entry.shareMid && mid === entry.shareMid) return shareKey(id);
    if (mid && entry.cameraMid && mid === entry.cameraMid) return id;
    if (!entry.share && !entry.sharing) return id;
    return '';
  }

  // localCameraTx is this connection's own camera transceiver: the one
  // whose sender is carrying the local stream's live video track. The
  // screen has a transceiver and a track of its own and is excluded by
  // identity, not by mid, so a tab that is sharing is still watched on
  // the right m-line.
  function localCameraTx(entry) {
    if (!entry.pc.getTransceivers || !local || !local.getVideoTracks) return null;
    const wanted = local.getVideoTracks()[0];
    if (!wanted || wanted.readyState === 'ended') return null;
    for (const tx of entry.pc.getTransceivers()) {
      if (tx && tx.sender && tx.sender.track === wanted) return tx;
    }
    return null;
  }

  // cameraReport picks the outbound video report that belongs to the
  // camera. By mid when both sides of the comparison have one; with no
  // mid to compare, only a single unambiguous report counts — the same
  // refusal to guess between two video streams that frameKey makes.
  // Pure, and lifted by name in the node test.
  function cameraReport(reports, mid) {
    if (mid) {
      for (const r of reports) if (r.mid === mid) return r;
      return reports.length === 1 && !reports[0].mid ? reports[0] : null;
    }
    return reports.length === 1 ? reports[0] : null;
  }

  // shareSendReport is this tab's own screen on the way out, from one
  // connection's outbound reports: what size and rate it is actually
  // leaving at, what (if anything) is holding it back, and which encoder
  // is doing the work — the questions "the screenshare isn't keeping up"
  // asks. Pure, and lifted by name in the node test.
  function shareSendReport(reports, mid) {
    if (!mid) return null;
    const r = reports.find((x) => x.mid === mid);
    if (!r) return null;
    return {
      width: r.frameWidth || 0,
      height: r.frameHeight || 0,
      fps: r.framesPerSecond || 0,
      limitation: r.qualityLimitationReason || '',
      targetBitrate: r.targetBitrate || 0,
      encoder: r.encoderImplementation || '',
      framesEncoded: r.framesEncoded || 0,
      framesSent: r.framesSent || 0,
      keyFramesEncoded: r.keyFramesEncoded || 0,
    };
  }

  // judgeCamera watches one connection's own camera encoder and says
  // what to do about it: '' to leave it alone, 'repair' to rebuild the
  // encoder, 'reset' to rebuild the whole connection.
  //
  // This is Codex S4-5, and the Task 4 re-review's item 2. POLITE_YIELD
  // prevents the rollback that costs a camera its encoder, but it is a
  // duration and not a guarantee: a signalling round trip longer than
  // 300 ms, a 429 retry, or a slow offer can still land the remote offer
  // late, and then the polite side rolls back and Chromium rebuilds
  // every send stream on the connection. What is left looks entirely
  // healthy — `connected`, the m-line `sendrecv`, the track `live` —
  // and encodes nothing, ever. No connection-state handler fires,
  // because nothing failed.
  //
  // The one thing that does say so is framesEncoded standing still, so
  // that is what this reads, off the getStats walk that already runs.
  // Two polls in a row with no new frames on a sending m-line with a
  // live track is the signature; the repair is the cheapest thing that
  // makes the browser build a new encoder for the same sender, and if
  // two more polls are still frozen the pair is reset instead.
  //
  // The counters live on the entry, so a connection that is not sending
  // video — no camera, an ended track, a recvonly m-line — resets them
  // rather than accumulating a stall it could never repair.
  function judgeCamera(entry, tx, report) {
    const track = tx && tx.sender && tx.sender.track;
    const direction = (tx && (tx.currentDirection || tx.direction)) || '';
    const sends = direction === 'sendrecv' || direction === 'sendonly';
    // A muted track is the system holding the camera (2026-10-03): iOS
    // mutes it, live, while Safari is in the background, the screen is
    // locked, or a call or Siri takes the camera, and it encodes nothing
    // until it is given back. That is not a stalled encoder, and a reset
    // for it rebuilt the whole connection — sound included — every time
    // an iPhone's camera paused. Disabled (camera off) is the person's
    // own doing, and no more a stall.
    if (!tx || !sends || !track || track.readyState === 'ended' || track.muted ||
        track.enabled === false ||
        !report || typeof report.framesEncoded !== 'number') {
      entry.cameraFrames = -1;
      entry.cameraStalls = 0;
      return '';
    }
    if (report.framesEncoded !== entry.cameraFrames) {
      // A different number is not the same thing as progress (Codex
      // S4-10). A stats or encoder restart takes the counter *back*,
      // often to zero, and reading that as "encoding recovered" handed
      // the repair allowance back without a single new frame — so a
      // camera that kept restarting could be repaired for ever and
      // never reset. The baseline moves either way, because the old
      // number means nothing now; the budget is only forgiven by frames
      // that actually arrived.
      const grew = report.framesEncoded > entry.cameraFrames;
      entry.cameraFrames = report.framesEncoded;
      entry.cameraStalls = 0;
      if (grew) entry.cameraRepairs = 0;
      return '';
    }
    entry.cameraStalls += 1;
    if (entry.cameraStalls < CAMERA_STALL_POLLS) return '';
    entry.cameraStalls = 0;
    entry.cameraRepairs += 1;
    if (entry.cameraRepairs <= CAMERA_REPAIRS) return 'repair';
    if (entry.cameraRepairs === CAMERA_REPAIRS + 1) return 'reset';
    // A reset has already been asked for and the frames are still
    // frozen. The reset rebuilds the connection and these counters with
    // it, so being here at all means it did not take — and asking for
    // another one every two seconds would be a loop, not a recovery.
    return '';
  }

  // repairCamera takes the track off its sender and puts it straight
  // back. Neither call renegotiates — the kind is unchanged — and the
  // second one is what makes the browser build an encoder for a sender
  // whose own was torn down and never rebuilt.
  async function repairCamera(tx) {
    const sender = tx && tx.sender;
    const track = sender && sender.track;
    if (!sender || !track || typeof sender.replaceTrack !== 'function') return;
    // Which camera the call is on, captured before the awaits below.
    // Asking the sender afterwards would be the more obvious check and
    // is the weaker one: it reads a browser's own bookkeeping to infer
    // whether something else has been here, where this asks the
    // question directly.
    const generation = switching.video;
    try {
      await sender.replaceTrack(null);
      // A device switch that started in this gap owns this sender now,
      // and the track captured above is the one it is retiring — it
      // stops it. Putting it back would undo the switch and freeze this
      // peer on a track that has ended, which is a worse fault than the
      // stall being repaired. The switch sets its own track on every
      // sender, so leaving is safe; and if that switch then fails, the
      // stall detector is still watching and asks again on the next
      // poll.
      if (switching.video !== generation || track.readyState === 'ended') return;
      await sender.replaceTrack(track);
    } catch {
      // A connection that is closing. The reset is behind this anyway.
    }
  }

  // judgeRender watches the one link nothing else in this file can see:
  // an element that holds exactly the right track — live, unmuted, the
  // one the connection is receiving the camera on — on a connection
  // that is decoding frames for it, and paints none of them.
  //
  // That is not a hypothetical. It is what the browser gate's
  // `laterolls` reproduces after a forced late collision, and the
  // identity reading `meet.media()` was added for settles what it is
  // not: the tile is bound to the receiver's own track and the element
  // holds that track alone (`agrees: true`), so nothing upstream of the
  // element is confused about which media this is. Frames are decoded
  // and the picture does not move.
  //
  // Three signals, and all three have to say so together: the track is
  // playable, the decoder is delivering (`framesDecoded` rising), and
  // the element's own clock is not. A tile receiving nothing is idle,
  // not stalled — that is what `arriving` is for — and a tile whose
  // track has ended or gone muted is a sender's doing, not this one's.
  //
  // Pure over the tile record, and lifted by name in the node test.
  function judgeRender(t, decoded) {
    const track = t && t.track;
    // `paused` is in here for a reason the browser gate had to teach:
    // an element the autoplay policy refused is paused, its clock is
    // stopped, and frames are arriving — which is this watch's exact
    // signature and none of its business. §5's answer to that is the
    // Play control in the tile's own caption, and a watch that quietly
    // called play() again would take the decision away from the person
    // and hide the button that says so.
    const playable = !!(t && t.video && t.stream && track && !t.video.paused &&
      track.readyState !== 'ended' && !track.muted);
    if (!playable || typeof decoded !== 'number') {
      t.renderTime = -1;
      t.renderDecoded = -1;
      t.renderStalls = 0;
      return '';
    }
    const time = t.video.currentTime || 0;
    const moving = time - t.renderTime >= RENDER_MOVED;
    const restarted = time < t.renderTime;
    const arriving = decoded > t.renderDecoded;
    const first = t.renderDecoded < 0;
    t.renderTime = time;
    t.renderDecoded = decoded;
    if (first) return '';
    if (restarted) {
      // The clock went backwards: this element has just been handed its
      // media again, by this watch or by a tile rebinding. Nothing to
      // judge until it has run for a poll.
      t.renderStalls = 0;
      return '';
    }
    if (moving) {
      // Painting. Whatever was wrong is not wrong now, and a replay
      // that worked is forgotten rather than counted against the next
      // stall.
      t.renderStalls = 0;
      t.renderReplays = 0;
      return '';
    }
    if (!arriving) {
      // Nothing to paint. A frozen picture on a stream that has stopped
      // arriving is the sender's business, and the camera watch's.
      t.renderStalls = 0;
      return '';
    }
    t.renderStalls += 1;
    if (t.renderStalls < RENDER_STALL_POLLS) return '';
    t.renderStalls = 0;
    t.renderReplays += 1;
    if (t.renderReplays <= RENDER_REPLAYS) return 'replay';
    if (t.renderReplays === RENDER_REPLAYS + 1) return 'reset';
    // Asked for a reset already and the picture is still frozen. The
    // reset rebuilds the connection and its tiles, so being here means
    // it did not take, and asking again every three seconds would be a
    // loop rather than a recovery.
    return '';
  }

  // shouldPlay answers whether this file may start a tile playing, and
  // the interesting half is when it may not: while the Play control is
  // showing, the gesture is the person's to give. §5 offers that
  // control when the browser's autoplay policy refuses, and a tile
  // bound more than once — audio arriving before the camera does
  // exactly that — would otherwise call play() again behind the control
  // and hide a question nobody had answered. The browser gate's
  // `playfallback` is what says so out loud. Pure, and lifted by name
  // in the node test.
  function shouldPlay(t, isSelf) {
    return !isSelf && !!t.stream && (!t.play || t.play.hidden);
  }

  // freshStream gives a role a *new* MediaStream over the tracks it
  // holds, and puts it back where the role keeps it — which is the half
  // the first draft of the replay missed (Codex S4-13). A fresh object
  // handed to the element alone left the role still writing to the old
  // one, so the next microphone to arrive or be replaced went into a
  // stream nothing was showing: authoritative [video, new mic], element
  // [video, old mic], and nobody to hear.
  //
  // Making the fresh object the role's own keeps the one rule this file
  // has about tiles: the element holds the role's stream, and every
  // track the role adopts afterwards reaches it.
  function freshStream(entry, share) {
    const held = share ? entry.share && entry.share.stream : entry.stream;
    if (!held || !held.getTracks) return null;
    const next = new MediaStream(held.getTracks());
    if (share) entry.share.stream = next;
    else entry.stream = next;
    return next;
  }

  // replayTile hands an element its media again: a fresh stream over
  // the same tracks, and play() asked for once more. Cheaper than a
  // renegotiation and enough for a decoder pipeline that has stopped
  // painting what it is still producing.
  //
  // Fresh rather than the object the element was already holding:
  // assigning the same one back is where an earlier draft stopped, and
  // it bought a frame or two before the picture stalled again. A
  // different object is a different source as far as the element is
  // concerned, and it rebuilds the pipeline rather than nudging it.
  function replayTile(key, t, entry, share) {
    const next = freshStream(entry, share);
    if (!next) return;
    try {
      t.video.srcObject = null;
      t.video.srcObject = next;
    } catch {
      // An element that has gone: the next render builds another.
      return;
    }
    t.stream = next;
    t.track = shownTrack(next);
    if (shouldPlay(t, false)) startPlaying(key, t);
  }

  // pollFrames is one getStats walk per connection, once a second, and
  // it does two jobs. The inbound half is the frame counter's fallback
  // for a browser without requestVideoFrameCallback. The outbound half
  // is the camera watch, and it runs in every browser — rVFC counts
  // what arrives, and a camera that stopped encoding is a fault in what
  // leaves.
  async function pollFrames() {
    // Once a second, whatever else this walk is for: a tile whose frame
    // callback was dropped is put back on the books (Codex S4-6's gate
    // found one, and the counter is what every frames assertion reads).
    rearmFrames();
    // §15.21: every screen's decoded count, for the receiver's watch, and
    // (§15.22) the rest of what its statistics say.
    const screens = new Map();
    const screenReports = new Map();
    for (const [id, entry] of pcs) {
      try {
        const stats = await entry.pc.getStats();
        // §15.26: the quality report reads this walk rather than making
        // one of its own.
        entry.statsReport = stats;
        const outbound = [];
        // What the decoder is delivering, per tile: the fallback frame
        // count where there is no requestVideoFrameCallback, and — in
        // every browser — the half of judgeRender's question that the
        // element cannot answer.
        const decoded = new Map();
        stats.forEach((report) => {
          if (report.type === 'outbound-rtp' && report.kind === 'video') {
            outbound.push(report);
            return;
          }
          if (report.type !== 'inbound-rtp' || report.kind !== 'video' ||
              typeof report.framesDecoded !== 'number') {
            return;
          }
          const key = frameKey(id, entry, report.mid || '');
          if (!key) return;
          decoded.set(key, report.framesDecoded);
          if (key !== id) {
            screens.set(key, report.framesDecoded);
            const t = tiles.get(key);
            screenReports.set(key, screenReading(report, !!(t && t.track && t.track.muted)));
          }
          if (!HAS_RVFC) frames.set(key, report.framesDecoded);
        });
        for (const [key, count] of decoded) {
          const t = tiles.get(key);
          if (!t || t.self) continue;
          const verdict = judgeRender(t, count);
          if (verdict === 'replay') replayTile(key, t, entry, key !== id);
          else if (verdict === 'reset') requestReset(id);
        }
        entry.shareSend = shareSendReport(outbound, (entry.shareTx && entry.shareTx.mid) || '');
        noteShareSent(entry);
        const tx = localCameraTx(entry);
        const verdict = judgeCamera(entry, tx, cameraReport(outbound, (tx && tx.mid) || ''));
        if (verdict === 'repair') await repairCamera(tx);
        else if (verdict === 'reset') requestReset(id);
      } catch {
        // getStats on a closing connection: nothing to report.
      }
    }
    watchScreens(screens, screenReports);
    answerScreenStalls();
    qualityTick();
  }

  function hearingState() {
    const out = {};
    for (const [key, t] of tiles) {
      if (!t.hear) continue;
      const rec = key === 'self' ? selfHearing : hearing.get(key) || null;
      out[key] = {
        shown: t.hearShown,
        level: rec ? rec.level : 0,
        peak: rec ? rec.peak : 0,
        silent: !!(rec && rec.silent),
        // The warm rim on the name as drawn: lit, and its --lvl.
        speaking: t.label.dataset.glow === 'on',
        glow: Number(t.hear.glow) || 0,
        text: t.hear.box.hidden ? '' : t.hear.text.textContent,
        // The words alone, without the connecting notice's dots.
        notice: t.hear.notice.hidden ? '' : t.hear.noticeText,
        noticeKind: t.hear.notice.hidden ? '' : t.hear.noticeKind,
      };
    }
    return out;
  }

  function candidateState() {
    const out = {};
    for (const [id, entry] of pcs) {
      out[id] = {
        gathered: entry.gathered,
        delivered: entry.delivered,
        received: entry.received,
        added: entry.added,
        pending: entry.pending.length,
      };
    }
    return out;
  }

  // renewalState is a plain object rather than a Map: the gate reads it
  // by peer id, and this is the one shape that survives being handed
  // straight out of page.evaluate().
  function renewalState() {
    const out = {};
    for (const [id, r] of renewals) {
      out[id] = {
        attempts: r.attempts,
        renewed: !!r.renewed,
        ufrag: r.ufrag || '',
        // `expired` is the must-succeed-by's own verdict and nothing
        // else; `trouble` also carries a renewal that could not land on
        // a credential that was perfectly good.
        expired: r.trouble === 'expired',
        trouble: r.trouble || '',
        // What the run that reached that verdict spent getting there,
        // which `attempts` — a whole life's worth — cannot say.
        lastRun: r.lastRun,
      };
    }
    return out;
  }

  window.meet = {
    // local() is what this tab is actually sending: one entry per track
    // on the local stream, with its kind and readyState. It is the fact
    // a device switch has to be judged on and that the DOM cannot
    // answer — a self tile looks exactly the same whichever microphone
    // is behind it.
    //
    // No device id and no label. devices.js's promise is that neither
    // ever leaves this browser, and a test hook is not an exception
    // worth carving into it. Whether a device was *chosen* is a
    // boolean, which is all a gate needs to tell a switch from a
    // default.
    local() {
      if (!local) return [];
      return local.getTracks().map((t) => ({
        kind: t.kind,
        state: t.readyState,
        enabled: !!t.enabled,
        chosen: !!(typeof t.getSettings === 'function' && t.getSettings().deviceId),
      }));
    },
    // media() is the identity reading the fix wave's second round asked
    // for: which track each tile is bound to, which tracks its element
    // is actually holding, and what the connection's own receivers say
    // it should be. Three answers that ought to be one object, and a
    // browser scenario cannot compare objects across an evaluate()
    // boundary — so they are compared here, with ===, and reported as
    // ids and a verdict. Ids only: a track id is local to this tab and
    // names nothing about anybody.
    media() {
      const out = {};
      for (const [id, entry] of pcs) {
        const t = tiles.get(id) || null;
        const el = (t && t.video && t.video.srcObject) || null;
        const want = entry.cameraTrack || null;
        const receivers = [];
        try {
          for (const tx of entry.pc.getTransceivers()) {
            const track = tx && tx.receiver && tx.receiver.track;
            if (!track || track.kind !== 'video') continue;
            receivers.push({
              mid: tx.mid || '',
              direction: tx.currentDirection || tx.direction || '',
              track: track.id,
              state: track.readyState,
              muted: !!track.muted,
              isCamera: track === want,
            });
          }
        } catch {
          // A closing connection has nothing to say.
        }
        out[id] = {
          cameraMid: entry.cameraMid || '',
          wanted: (want && want.id) || '',
          bound: (t && t.track && t.track.id) || '',
          element: el && el.getVideoTracks
            ? el.getVideoTracks().map((tr) => tr.id + ':' + tr.readyState + (tr.muted ? ':muted' : ''))
            : [],
          currentTime: (t && t.video && t.video.currentTime) || 0,
          receivers,
          // The whole question in one word: is the track this tile is
          // bound to the one the connection is receiving the camera on,
          // and is it the one the element is actually holding?
          agrees: !!(want && t && t.track === want && el && el.getVideoTracks &&
            el.getVideoTracks()[0] === want),
        };
      }
      return out;
    },
    // §15.21, for the gate: this tab's receiver watch treats every
    // screen as frozen for `ms`, so its stall report and the sharer's
    // keyframe can be driven end to end.
    // §15.22: "Copy call diagnostics" as it would be copied; §15.26's
    // {anonymous: true} is what "Report a problem" would send.
    diagnostics(opts) {
      return callDiagnostics(opts);
    },
    // §15.26, for the gate: the quality report's cadence, shortened from
    // thirty seconds so a scenario sees reports in seconds. Never below
    // QUALITY_EVERY_MIN, and nothing else about the report changes.
    qualityEveryForTest(ms) {
      qualityEvery = Math.max(QUALITY_EVERY_MIN, Math.min(Number(ms) || QUALITY_EVERY, QUALITY_EVERY));
    },
    stallScreenForTest(ms) {
      screenStallTestUntil = Date.now() + Math.max(0, Math.min(Number(ms) || 0, 60000));
    },
    state() {
      // signaling and connection are the two per-peer facts a gate
      // cannot see from the DOM: whether negotiation settled, and
      // whether the transport came up. Both are read straight off the
      // connection, never cached, so they are never stale.
      const signaling = new Map();
      const connection = new Map();
      for (const [id, entry] of pcs) {
        signaling.set(id, entry.pc.signalingState);
        connection.set(id, entry.pc.connectionState);
      }
      return {
        peer: state.peer,
        // The boot id of the process this stream last said hello from.
        // A restart changes it, and that is the only thing that tells a
        // browser a 404 on resume is a restart rather than a lapsed
        // window (§4.5) — so the gate has to be able to read it.
        boot: state.boot,
        admitted: state.admitted,
        terminal: state.terminal,
        // Rosters applied, so a gate can tell "this tab closed a
        // connection" from "the server told this tab who is here".
        rosters,
        // §15.21: whose screens this tab has reported stalled, and the
        // sharer's notice while someone's view of ours is being put right.
        screenStalled: screenStalled.slice(),
        shareRecovery,
        // §15.22: what the ladder and the receiver's own mending have done.
        shareRecoveries: Object.assign({ reattaches: screenReattaches }, shareCounts),
        // §15.23: whether "Reconnecting…" is said, for the call and by tile.
        reconnect: { call: reconnect.call, peers: Array.from(reconnect.peers), streamDown: !!streamDownSince },
        // Targets a 404 has marked stale: nothing is sent to them and
        // no reset is asked for until a roster settles it.
        stale: Array.from(stale),
        peers: Array.from(pcs.keys()),
        // Keyed by tile, so a peer sharing a screen has two entries: its
        // own id and `shareKey(id)`. A share tile's count is left behind
        // when the tile goes, which is how a gate can tell "the screen
        // was arriving and then stopped" from "the screen never came".
        frames: new Map(frames),
        signaling,
        connection,
        // Where ICE got to, per connection: gathered, delivered
        // (accepted by the hub), received, added, and what is still
        // buffered waiting for a remote description. Four counts and a
        // length — never an address.
        candidates: candidateState(),
        // §5.2 and §5.3, for the gate. The three clocks are
        // milliseconds since the epoch, converted once in fetchIce, so
        // they compare with Date.now(); `fetches` counts the fetches
        // that produced a list, not the attempts; `servers` is the
        // length of that list, never the list — nothing about a
        // credential leaves this file.
        ice: {
          fetches: ice.fetches,
          lastFetchAt: ice.lastFetchAt,
          expiresAt: ice.expiresAt,
          renewAt: ice.renewAt,
          // The sentence that is actually showing: on the floor there
          // is no relay to fail and none is shown (§5.5).
          warning: !!(ice.failedSince && relayConfigured),
          servers: ice.servers.length,
          // False when the list carries a margin too small to schedule
          // on: nothing is timed, and that is deliberate (W3-12).
          schedulable: schedulable(),
        },
        // Per connection: how many restarts §5.3 step 2 has spent
        // since this connection was built — across runs, never reset —
        // and whether one of them was proven. `ufrag` is the ICE username
        // fragment the proof found — a generation name, not a
        // credential.
        renewals: renewalState(),
        // §6: lines the hub accepted from this tab, and lines this tab
        // put in the log. Neither is readable from the panel's markup
        // without knowing it, and the panel is not this file's to know.
        chat: { sent: chatSent, received: chatReceived },
        // §5.4: whether this tab is sharing, and which peers are showing
        // a screen here — the label counts, not just the media, because
        // the message is what draws the tile.
        sharing: !!share,
        shares: sharingPeers(),
        // And how this tab's own screen is leaving, per connection, as of
        // the last stats walk (shareSendReport); the mode it was asked for.
        shareMode: shareMode(),
        shareSend: Object.fromEntries(
          Array.from(pcs, ([id, entry]) => [id, entry.shareSend || null])),
        // §15.19: what this tab reports, and what it has been told, by
        // peer id. Peers that never reported are absent.
        media: localMedia(),
        remoteMedia: Object.fromEntries(remoteMedia),
        // §15.20, by tile key ('self' for ours): what the tile is saying
        // about its audio ('muted', 'blocked', 'silent' or 'meter', which
        // is live sound), the level as last read and the loudest seen,
        // the speaking glow (lit, and its brightness), and the notice a peer's own report put
        // there. Levels are numbers between 0 and 1 and say nothing
        // about what was said.
        hearing: hearingState(),
        audioBlocked,
        soundBanner: !!(soundBanner && !soundBanner.box.hidden),
        noSoundFrom: noSoundList(),
        // §15.24: who this tab reports it hears, and, per peer, whether
        // they are still in their first moments (`joining`) and whether
        // "… can't hear you yet" is showing for them.
        hearingList: hearingList(),
        connecting: Object.fromEntries(Array.from(connecting.peers,
          ([id, r]) => [id, { joining: !r.done, shown: r.shown }])),
        // Speaker view: who has the floor (speakerStep), by peer id.
        speaker: stageSpeaker.current,
        mediaExtras,
        // §15.26: whether this tab holds a report token (never the token),
        // the reports sent and accepted, the last answer, and the two
        // switches — the server's (a 204) and the person's.
        quality: {
          token: !!reportToken,
          sent: quality.sent,
          accepted: quality.accepted,
          status: quality.status,
          serverOff: qualityServerOff,
          on: qualityOn(),
          every: qualityEvery,
        },
      };
    },
  };

  // ---------------------------------------------------------------
  // Start
  // ---------------------------------------------------------------

  async function start() {
    controlsEnabled(true);
    renderShare();
    // The relay warning's live region is built now, empty and hidden,
    // rather than at the moment it has something to say: a live region
    // inserted along with its own text is a region the reader was not
    // watching, and the change goes unannounced.
    warningEl();
    soundBannerEl();
    renderStatus();
    renderQueue();
    await startLocal();
    renderTiles();
    // Once a second, in every browser. rVFC counts arriving frames
    // better than getStats can, but nothing but getStats can see a
    // camera that stopped encoding (Codex S4-5), so the walk runs
    // either way and does whichever halves apply.
    statsTimer = setInterval(pollFrames, 1000);
    backdropTimer = setInterval(paintBackdrops, BACKDROP_EVERY);
    wake.hold();
    // §15.23: no stats, only what the tab already knows.
    reconnectWatchTimer = setInterval(watchReconnect, RECONNECT_EVERY);
    // §15.20's meters, five times a second and cheaper per turn: one
    // receiver's and one sender's own stats, not the connection's walk.
    levelTimer = setInterval(() => {
      pollLevels().catch((err) => {
        console.error('meet: levels', err);
      });
    }, LEVEL_EVERY);
    connectStream();
  }

  // Nothing above may throw into nowhere: an unhandled rejection here
  // would leave the room revealed, empty and silent.
  start().catch((err) => {
    console.error('meet: start', err);
    terminal('unreachable');
  });
})();