diff --git a/README.md b/README.md
index 2628a43..d61c0fe 100644
--- a/README.md
+++ b/README.md
@@ -131,6 +131,7 @@ gh attestation verify dist/koalasync-chrome.zip \
 - **[CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)**: Our community standards and expectations.
 - **[HOW_IT_WORKS.md](docs/HOW_IT_WORKS.md)**: Step-by-step walkthrough of the complete user flow.
 - **[ARCHITECTURE.md](docs/ARCHITECTURE.md)**: Deep-dive into the two-phase sync and heartbeat logic.
+- **[PROTOCOL.md](docs/PROTOCOL.md)**: WebSocket protocol specification and event reference.
 - **[ROADMAP.md](docs/ROADMAP.md)**: Planned features, backlog, and rejected ideas.
 - **[SECURITY.md](SECURITY.md)**: Disclosure policy and security practices.
 - **[Caddyfile.example](examples/Caddyfile.example)**: Production Caddy configuration for website and relay.
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 6b84b4f..0e703d7 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -8,6 +8,8 @@ All notable changes to the KoalaSync browser extension and relay server.
 
 ### Added
 - **Extension: Privacy title controls** - Advanced users can now disable sending browser tab titles separately from media titles. Media titles can still be sent in full, reduced to detected episode identifiers such as `S01E04`, or hidden entirely. Defaults remain full titles for backwards compatibility.
+- **Relay: Cleaner restart handling** — Connected clients are now disconnected explicitly during relay shutdown so reconnects recover more predictably.
+- **Relay: Stronger abuse protection** — Rapid room-leave spam is now rate-limited.
 
 ---
 
diff --git a/docs/PROTOCOL.md b/docs/PROTOCOL.md
new file mode 100644
index 0000000..ae01122
--- /dev/null
+++ b/docs/PROTOCOL.md
@@ -0,0 +1,369 @@
+# WebSocket Protocol Reference
+
+This document describes the relay behavior implemented by `server/index.js` and
+the event names defined in `shared/constants.js`.
+
+## Transport
+
+- The relay uses Socket.IO v4 events over WebSocket.
+- Long-polling is disabled (`transports: ['websocket']`, `allowUpgrades: false`).
+- Messages are Socket.IO event packets whose payload is an event name plus an
+  object payload.
+- The relay caps incoming Socket.IO message size at 4 KB.
+
+## Connection Handshake
+
+The Socket.IO handshake must include:
+
+- `token`: must match `OFFICIAL_SERVER_TOKEN`.
+- `version`: optional app version. If present, it must be a valid semver-like
+  string and not older than `MIN_VERSION` (default `1.0.0`).
+
+If the token is invalid, the relay emits `error` and disconnects the socket.
+If `version` is invalid or too old, the relay emits `error` and disconnects the
+socket.
+
+After the socket is connected, `join_room` must include `protocolVersion`.
+It must equal `PROTOCOL_VERSION` exactly. A mismatch emits `error` and rejects
+the join attempt; it does not currently disconnect the socket.
+
+## Room Join
+
+### `join_room` (client -> server)
+
+Payload:
+
+```json
+{
+  "roomId": "string, sanitized to [A-Za-z0-9-], max 64",
+  "peerId": "string, max 16",
+  "username": "string, max 30",
+  "password": "string, max 128, optional",
+  "tabTitle": "string, max 100, optional",
+  "mediaTitle": "string, max 100, optional",
+  "protocolVersion": "string, max 16"
+}
+```
+
+Behavior:
+
+- Creates the room if it does not exist and capacity allows it.
+- The first peer becomes `hostPeerId`.
+- Rooms may have an optional password hash.
+- Joining with a duplicate `peerId` disconnects the previous socket for that peer.
+- Joining the same room with the same socket and peer is ignored as a no-op.
+- Switching rooms removes the socket from the old room first.
+
+On success, the joining socket receives `room_data`.
+Other room members receive `peer_status` with `status: "joined"`.
+
+### `room_data` (server -> client)
+
+Payload:
+
+```json
+{
+  "roomId": "string",
+  "peers": ["peer state objects"],
+  "activeLobby": "object or null",
+  "hostPeerId": "string or null",
+  "controlMode": "everyone | host-only",
+  "controllers": ["peerId"],
+  "capabilities": ["host-control", "co-host"]
+}
+```
+
+`room_data` is sent to the joining socket. It is not the general broadcast used
+for every later room update.
+
+## Room Leave
+
+### `leave_room` (client -> server)
+
+Payload: none.
+
+Behavior:
+
+- Rate-limited to 10 events per socket per minute.
+- If the socket is mapped to a room, the relay removes it from that room.
+- Remaining room members receive `peer_status` with `status: "left"` when the
+  peer is no longer represented by another socket.
+- Empty rooms are deleted.
+- If the host leaves and peers remain, the relay assigns the next peer as host,
+  falls back to `controlMode: "everyone"`, resets controllers to the new host,
+  and broadcasts `control_mode`.
+
+Exceeding the `leave_room` limit is logged and the socket is disconnected.
+
+## Relayed Room Events
+
+The relay accepts and sanitizes these events, then emits the same event to other
+peers in the room:
+
+- `play`
+- `pause`
+- `seek`
+- `peer_status`
+- `force_sync_prepare`
+- `force_sync_ack`
+- `force_sync_execute`
+- `episode_lobby`
+- `episode_ready`
+- `episode_lobby_cancel`
+
+Relayed payload fields are sanitized and may include:
+
+```json
+{
+  "senderId": "peerId of sender",
+  "seq": "number",
+  "currentTime": "number 0..86400 or null",
+  "targetTime": "number 0..86400",
+  "playbackState": "playing | paused",
+  "username": "string, max 30",
+  "tabTitle": "string, max 100 or null",
+  "mediaTitle": "string, max 100 or null",
+  "volume": "number 0..1",
+  "muted": "boolean",
+  "desynced": "boolean",
+  "peerId": "sender peerId",
+  "status": "string, max 16",
+  "expectedTitle": "string, max 100",
+  "title": "string, max 100",
+  "actionTimestamp": "number"
+}
+```
+
+Undefined fields are removed before relay. Raw client payloads are not forwarded.
+
+## Media Control
+
+### `play`, `pause`, `seek`
+
+These are room-moving actions. In `host-only` mode, the relay drops them unless
+the sender is a controller.
+
+Common payload fields:
+
+- `currentTime` for `play`/`pause`.
+- `targetTime` for `seek`.
+- `seq` and `actionTimestamp` when the extension needs stale-command or ACK
+  handling.
+
+The content script applies additional client-side filtering for noisy native
+player events before it sends these events.
+
+## Peer Status
+
+### `peer_status`
+
+Used for heartbeats and peer state updates. The extension sends it every
+`HEARTBEAT_INTERVAL` while syncing is active.
+
+Typical fields:
+
+- `peerId`
+- `username`
+- `tabTitle`
+- `mediaTitle`
+- `playbackState`
+- `currentTime`
+- `volume`
+- `muted`
+- `desynced`
+- `status`
+
+The relay stores sanitized peer state and relays the sanitized update to other
+peers.
+
+## Force Sync
+
+Force sync coordination is implemented primarily in the extension. The relay
+sanitizes and relays the events.
+
+### `force_sync_prepare`
+
+Payload includes `targetTime`. The initiator waits for ACKs or for
+`FORCE_SYNC_TIMEOUT` before sending `force_sync_execute`.
+
+In `host-only` mode, only controllers may initiate it.
+
+### `force_sync_ack`
+
+The extension sends ACKs with peer identity and sequence data. The relay relays
+them with the same sanitized relay envelope as other room events, including
+`senderId`.
+
+### `force_sync_execute`
+
+Payload includes `targetTime`. In `host-only` mode, only controllers may send it.
+The relay also allows a matching initiator's execute event after that initiator
+started the prepare step, even if their controller state changed before execute.
+
+## Episode Lobby
+
+Episode lobby coordination is implemented primarily in the extension. The relay
+tracks enough state to include `activeLobby` in `room_data` for later joiners.
+
+### `episode_lobby`
+
+Payload uses `expectedTitle`. The relay creates `activeLobby` when this field is
+present and no lobby is already active.
+
+In `host-only` mode, only controllers may initiate it.
+
+### `episode_ready`
+
+Payload may include `title`. The relay adds the sender to the active lobby's
+ready list when a lobby exists.
+
+### `episode_lobby_cancel`
+
+Clears the active lobby and is relayed to peers. In `host-only` mode, only
+controllers may initiate it.
+
+## Host Control Mode
+
+### `set_control_mode` (client -> server)
+
+Payload:
+
+```json
+{
+  "controlMode": "everyone | host-only"
+}
+```
+
+Only the room host may change the mode. Non-host attempts are ignored and the
+sender receives the current `control_mode` snapshot.
+
+Mode changes are debounced per room with `CONTROL_MODE_MIN_INTERVAL_MS` (500 ms).
+
+### `set_peer_role` (client -> server)
+
+Payload:
+
+```json
+{
+  "peerId": "string, max 16",
+  "controller": "boolean"
+}
+```
+
+Only the room host may promote or demote controllers. The host cannot demote
+themself. Role changes use the same 500 ms per-room debounce as mode changes.
+
+### `control_mode` (server -> client)
+
+Payload:
+
+```json
+{
+  "controlMode": "everyone | host-only",
+  "hostPeerId": "string or null",
+  "controllers": ["peerId"]
+}
+```
+
+Sent when mode or controller state changes, when host migration changes room
+authority, and when unauthorized role/mode attempts need to resync the sender.
+
+## Room List
+
+### `get_rooms` (client -> server)
+
+Payload: none.
+
+No admin token is required for this Socket.IO event.
+
+Limits:
+
+- Counts against the per-socket event limit.
+- Also has a 10 second per-socket cooldown.
+
+### `room_list` (server -> client)
+
+Payload:
+
+```json
+{
+  "rooms": [
+    {
+      "id": "room id",
+      "peerCount": 2,
+      "hasPassword": false
+    }
+  ]
+}
+```
+
+## Ping, Pong, and ACK
+
+### `ping`
+
+Payload:
+
+```json
+{
+  "t": 1234567890,
+  "target": "peerId, optional"
+}
+```
+
+If `target` is omitted, the relay responds to the sender with `pong`.
+If `target` is another peer in the same room, the relay sends `ping` to that peer
+with `{ "t": ..., "sender": "senderPeerId" }`.
+
+### `pong`
+
+Payload:
+
+```json
+{
+  "t": 1234567890,
+  "target": "peerId, optional"
+}
+```
+
+If `target` is a peer in the same room, the relay sends `pong` to that peer with
+`{ "t": ... }`.
+
+### `event_ack`
+
+Client payload:
+
+```json
+{
+  "targetId": "peerId",
+  "actionTimestamp": 1234567890
+}
+```
+
+If sender and target are still in the same room, the relay emits:
+
+```json
+{
+  "senderId": "sender peerId",
+  "actionTimestamp": 1234567890
+}
+```
+
+## Rate Limits
+
+- Connections: 10 per IP per minute; excess connections are disconnected.
+- Relayed/events: 50 per socket per 10 seconds; excess disconnects the socket.
+- `get_rooms`: 10 second cooldown per socket plus the event limit.
+- `leave_room`: 10 per socket per minute; excess disconnects the socket.
+- Invalid room passwords: tracked per IP and room. Five recent failures block
+  more password attempts for that room until the failure window ages out.
+- HTTP health and admin-metrics endpoints have their own rate limits outside this
+  Socket.IO protocol.
+
+## Capabilities
+
+`room_data.capabilities` advertises server-backed features:
+
+- `host-control`
+- `co-host`
+
+Clients should treat a missing or unknown capabilities list as unsupported.
diff --git a/docs/host-control-mode-COHOST-PLAN.md b/docs/host-control-mode-COHOST-PLAN.md
deleted file mode 100644
index 854b9dc..0000000
--- a/docs/host-control-mode-COHOST-PLAN.md
+++ /dev/null
@@ -1,118 +0,0 @@
-# Co-Host (Multi-Controller) — Implementation Plan
-
-Branch base: `feature/host-control-mode` (builds directly on it).
-Goal: let the room owner grant **playback control to several peers** (co-hosts), not
-just one — e.g. 4 of N people in a room may drive play/pause/seek, the rest are guests.
-
-This is the second server-gated feature the `capabilities` hook was designed for
-(`CAPABILITIES.CO_HOST = 'co-host'`, already stubbed in `shared/constants.js`).
-
----
-
-## 1. Roles
-
-| Role | Can drive (play/pause/seek/force-sync/episode-lobby) | Can promote/demote + toggle mode |
-|------|------|------|
-| **Owner** (room creator, = today's "host") | yes (always a controller) | **yes** |
-| **Controller** (co-host) | yes (in `host-only` mode) | no |
-| **Guest** | only in `everyone` mode | no |
-
-The single-host feature is just the special case `controllers = { owner }`.
-
-## 2. Data model
-
-### Server (`room` object)
-- `ownerPeerId` — the creator / manager. Keep `hostPeerId` as an **alias** (= ownerPeerId)
-  so older clients keep working.
-- `controllers: Set<peerId>` — peers allowed to drive. **Always contains ownerPeerId.**
-- `controlMode: 'everyone' | 'host-only'` — unchanged wire values (`'host-only'` now means
-  "restricted to controllers", not "single host").
-- `MAX_CONTROLLERS` cap (e.g. 10) to bound the set + payload.
-
-### Shared constants
-- `CAPABILITIES.CO_HOST = 'co-host'` (un-stub it) → add to `SERVER_CAPABILITIES`.
-- New events:
-  - `SET_PEER_ROLE` (client→server): `{ peerId, controller: boolean }` — owner promotes/demotes.
-  - Extend `CONTROL_MODE` (server→client) payload: `{ controlMode, ownerPeerId, hostPeerId, controllers: [peerId...] }`.
-- `ROOM_DATA` gains `ownerPeerId` + `controllers`.
-
-## 3. Gate generalization (the core change)
-
-Today the gate compares against a single `hostPeerId`. Generalize to set membership:
-
-- **Server relay gate** (`server/index.js`): `controlMode === 'host-only' && !room.controllers.has(mapping.peerId)` → drop. (Was `mapping.peerId !== room.hostPeerId`.)
-- **Background gates** (sender + receiver): replace `amHost()` / `senderId !== hostPeerId`
-  with controller-set membership: `controllers.includes(myPeerId)` / `senderId ∈ controllers`.
-- **Helpers:** split `amHost()` into `amOwner()` (manage rights) and `amController()`
-  (drive rights). The desync/snap-back path keys on `!amController()` instead of `!amHost()`.
-
-`SET_PEER_ROLE` handler (server): validate sender is owner, target is a current peer in the
-room, enforce `MAX_CONTROLLERS`, always keep owner in the set, then broadcast `CONTROL_MODE`
-with the new `controllers`.
-
-## 4. Client + UI
-
-- **Owner** sees the peer list with a per-peer **"Controller" toggle** (promote/demote) plus
-  the existing mode toggle.
-- **Controllers** see a "Controller" badge and are NOT locked out of the remote-control buttons.
-- **Guests** see "Guest" + the host-only notice (unchanged).
-- The promote UI + co-host badges render only when the relay advertises the `co-host`
-  capability (feature detection, same pattern as `hostControlSupported`).
-- i18n: new keys (`ROLE_CONTROLLER`, `BTN_PROMOTE`, `BTN_DEMOTE`, …) across all locales.
-
-## 5. Backwards compatibility
-
-- **New client + old server** (host-control only, no `co-host` capability): no co-host UI;
-  behaves as today's single-host. ✓
-- **Old client + new server**: ignores `controllers` / `SET_PEER_ROLE`. An old client that
-  the owner promotes still **gates itself** (its sender-gate only knows `!amHost`), so it
-  can't drive — it degrades to a guest. Co-host requires a client that understands
-  `controllers`. Document this; not a crash. ✓
-- No `PROTOCOL_VERSION` bump needed — purely additive, same as host-control.
-
-## 6. Edge cases
-- **Controller leaves** → `removePeerFromRoom` also does `room.controllers.delete(peerId)`.
-- **Owner leaves** → fallback: promote the earliest remaining **controller** to owner (prefer
-  a controller over a random peer); if none, earliest peer; keep the rest of the set. Reuse
-  the `peerJoinLocks` guard so a reconnect/second-tab doesn't demote (same fix as host).
-- **Promote a peer not in the room** → server rejects (target must be a live peer).
-- **Promote beyond `MAX_CONTROLLERS`** → server rejects, re-syncs the owner's UI.
-- **`everyone` mode** → the `controllers` set is still maintained (so flipping to `host-only`
-  keeps the chosen co-hosts), it just isn't enforced while in `everyone`.
-- **peerId spoofing** → unchanged accepted limitation (see `docs/KNOWN_LIMITATIONS.md`);
-  co-host doesn't widen it materially (still bounded to a temporary room).
-
-## 7. Scale: the "4 of 510 people" part — read this
-
-The role change above is moderate. **Putting 510 people in one room is a separate, larger
-problem** and should be its own track:
-
-- `MAX_PEERS_PER_ROOM` is **25** today. 510 needs a large raise + load testing.
-- **The real bottleneck at scale is heartbeat fan-out, not control events.** Every peer
-  heartbeats and the relay broadcasts each to all peers → O(N²) per interval. At 510 that's
-  ~510×509 / 15s ≈ **17k msg/s just for heartbeats** — the scaling wall.
-- **Co-host actually *helps* the control-event side:** in `host-only` mode only the few
-  controllers emit play/pause/seek, so event *sources* drop from N to K (e.g. 4). Restricting
-  who can drive is synergistic with big rooms.
-- Large rooms therefore need (independent of co-host):
-  - **Heartbeat fan-out reduction** — e.g. only relay controller/owner heartbeats to everyone,
-    relay guest heartbeats only to the owner/controllers (for the UI), or server-side
-    aggregation into periodic snapshots instead of per-peer relay.
-  - **`ROOM_DATA` payload trimming** — a 510-entry peer list is large; send counts + controller
-    details, lazy-load the full roster.
-  - Possibly the **socket.io Redis adapter** for horizontal scaling, and broadcast tuning.
-
-## 8. Effort estimate
-- **Co-host roles** (server gate generalization + `SET_PEER_ROLE` + owner-leave fallback +
-  client gates + promote UI + i18n), at the current ≤25-peer scale: **~3–4 dev days** (same
-  shape as host-control itself — mostly generalizing host→controller-set).
-- **Large-room scaling (510)**: a **separate ~1–2 week** track (heartbeat redesign + payload
-  trimming + cap raise + load testing), independent of co-host. Recommend shipping co-host at
-  the current cap first, then scaling rooms as its own project.
-
-## 9. Suggested sequencing
-1. `CAPABILITIES.CO_HOST` + `controllers`/`ownerPeerId` in room state + `ROOM_DATA` (additive).
-2. Server `SET_PEER_ROLE` + gate generalization + owner-leave fallback + WS tests.
-3. Background: controller-set membership in both gates + `amOwner`/`amController`.
-4. Popup: promote/demote toggles (owner) + Controller badge + i18n.
-5. (Separate track) large-room scaling.
diff --git a/docs/host-control-mode-EDGECASES.md b/docs/host-control-mode-EDGECASES.md
deleted file mode 100644
index a6dfe8f..0000000
--- a/docs/host-control-mode-EDGECASES.md
+++ /dev/null
@@ -1,283 +0,0 @@
-# Host Control Mode — Branch Overview, Goals & Edge Cases
-
-> **This is the canonical entry-point doc for branch `feature/host-control-mode`.**
-> If you're an agent or contributor picking this up: read this file first, then the
-> implementation plan in [`host-control-mode-plan.md`](./host-control-mode-plan.md).
-> Temporary working doc — delete or fold into permanent docs before merging to `main`.
->
-> Status legend: 🔴 open / unresolved · 🟡 idea, needs testing · 🟢 decided
-
----
-
-## 0. Implementation status
-
-All five layers are implemented & pushed (server + background + content + popup + i18n).
-Automated checks green: ESLint, WS integration tests (incl. host-only gate, toggle
-reject, host-leave fallback), content video-finder, locale consistency (15 langs),
-full release verification.
-
-**Still needs real-device testing** — the EC test matrix in §7 (YouTube/Netflix/
-Twitch/Disney+/Jellyfin): involuntary-pause classification (EC-1/EC-5/EC-8), snap-back
-reliability and fight-loops (EC-4), and the desync/resync flow across players. The
-intent classifier (EC-9) and snap-back cooldown are first-pass heuristics tuned by
-reading the code, not yet by watching them behave on each site.
-
-Deferred by decision (see §8): host grace period on disconnect (EC-10).
-
-### Capability detection (forward-compat hook)
-The relay advertises `capabilities: ['host-control']` in `ROOM_DATA`
-(`SERVER_CAPABILITIES` in server, `CAPABILITIES` in shared/constants). The client
-enables host-control UI/behavior only when the flag is present, so the feature
-degrades cleanly on an older relay (absent → off) and old clients ignore the
-field. This is the extensible hook for the planned **co-host** feature (owner
-promotes guests to additional controllers): it will add a `'co-host'` capability
-+ events without a protocol bump or breaking older relays/clients. Add new flags
-to `CAPABILITIES` / `SERVER_CAPABILITIES` as features land.
-
-### Pre-test self-audit (fixed)
-- **Popup remote buttons froze for guests** — in host-only a guest's Play/Pause/SYNC
-  click was gated server-side but the button stuck on "Playing"/disabled with no
-  feedback. Now the remote controls are locked (disabled + tooltip) for guests, with
-  backstop guards in the handlers. (popup.js)
-- **Desync dialog could break under strict CSP** — it used `innerHTML` with inline
-  `style=""` attributes, which Netflix/YouTube/Disney+ strip via `style-src`. Rebuilt
-  with the DOM API (CSSOM `.style` is CSP-safe) inside a **Shadow DOM** so page CSS
-  can't restyle/hide it. (content.js)
-- **Live-DVR not detected (EC-15)** — `duration === Infinity` misses Twitch/YouTube
-  live-DVR (finite, sliding duration). Added a `seekable.start(0) > 1` sliding-window
-  heuristic in `hcmIsLive()`. (content.js)
-
-### Pre-test self-audit
-- ~~**EC-4/EC-1 snap-back thrash:**~~ FIXED — implemented the **buffer-aware deferred
-  snap-back** (`hcmDeferredSnapBack`): on an involuntary event, if the player isn't
-  ready (`readyState<3` or seeking) we wait (poll, 8s cap) until it can play, then snap
-  ONCE to the host's re-queried position instead of repeatedly fighting the buffer.
-  Done defensively/player-agnostically — we can't enumerate every site, so this is safe
-  whether a player fires `pause()` or only `waiting`. Aborts if the user goes solo or is
-  no longer a gated guest; single pending poll (no stacking).
-- ~~**Control-mode race at join:**~~ FIXED — `hcmHandleBlocked` now treats `HOST_BLOCKED`
-  as authoritative (adopts host-only/guest role) instead of re-checking local mode,
-  since background only sends it to gated guests.
-- ~~**Dialog/badge text is English-only**~~ FIXED — background resolves the strings
-  via GET_HCM_STRINGS (it has the i18n loader); content fetches them on init with
-  English fallback. 6 new keys (HCM_DIALOG_*/HCM_BADGE_*) across all 15 locales.
-
----
-
-## 1. What this branch is for
-
-Origin: a GitHub feature request. When watching with larger groups, anyone can pause
-or seek and disrupt everyone else. The requester wants the room creator to optionally
-restrict control to a single **host**, the way Teleparty works — guests who try to
-pause get asked whether they want to pause *only their own* player (and desync), and
-otherwise get snapped back to the room's position.
-
-**Goal:** Add an optional per-room **Host Control Mode**. A room can be switched
-between:
-- **`everyone`** (default, current behavior): anyone can play/pause/seek for the room.
-- **`host-only`**: only the host drives the room. A guest's deliberate play/pause/seek
-  is not broadcast; instead they're snapped back to the room position — unless they
-  explicitly choose to desync (go solo) with a "Resync" escape hatch.
-
-## 2. Trust model (read this before over-engineering)
-
-This is **client-side trust, by design**. It's a watch party, not a security boundary.
-The point is preventing *accidental* and *casual* disruption, not stopping someone
-determined to patch their own extension. We do **not** add auth, tokens, or
-cryptographic host identity. `peerId` is unauthenticated and that's fine here.
-
-(We still gate server-side as the robust chokepoint — see plan — but that's about
-killing spam reliably, not about defeating a hostile client.)
-
-## 3. Scope / non-goals
-
-In scope:
-- Host designation (first joiner = host), mode toggle, host-only gating of all
-  room-moving events, guest snap-back, deliberate-desync flow + resync, host UI.
-
-Explicit non-goals (for this branch):
-- Authenticated / spoof-proof host identity.
-- Persistent host across server restarts (room state is in-memory).
-- Syncing around personalized ad breaks.
-- Host transfer UI (auto-fallback to `everyone` when host leaves; manual transfer
-  is a possible later add).
-
-## 4. Architecture summary
-
-Three-layer gate for room-moving events from a non-host in host-only mode
-(`PLAY`, `PAUSE`, `SEEK`, `FORCE_SYNC_PREPARE`, `FORCE_SYNC_EXECUTE`, `EPISODE_LOBBY`):
-1. **Server** — doesn't relay them (robust chokepoint, kills spam regardless of client).
-2. **Sender (guest)** — doesn't emit; shows confirm dialog / disables host-only buttons.
-3. **Receiver** — drops any that slip through (covers old/buggy/modified clients).
-
-Snap-back reuses the existing `_setSuppress` mechanism (content.js:442) so applying
-the room state programmatically doesn't echo back as a new event. Target position is
-extrapolated from the host's last known state (±1s). Full detail + code hooks in the
-plan doc.
-
----
-
-## 5. The central challenge
-
-Everything hard about this feature reduces to **one question** (see EC-9):
-
-> How do we reliably tell a **deliberate** guest pause/seek from an **involuntary**
-> player/browser event (buffering, ads, tab throttling, source swaps, DRM hiccups)?
-
-If we get this wrong, guests get spammed with desync dialogs and snap-back loops for
-things they never did. The host/role plumbing is the easy part; this classifier is the
-real work. **Design the intent-classifier before writing the gate.**
-
----
-
-## 6. Edge cases
-
-### EC-1 🔴 Buffering / loading fires a `pause` event
-content.js listens to `play`/`pause`/`seeked`/`loadeddata` only (content.js:1000-1003),
-not `waiting`/`stalled`. Pure HTML5 buffering fires `waiting` → harmless. But custom
-players (Netflix/YouTube/Twitch/JW) often call `video.pause()` during buffering/ads →
-real `pause` → guest gate would mis-classify as deliberate. Sub-cases: (a) initial load
-sits paused, no event, fine; (b) mid-stream stall, player-dependent; (c) seek-induced
-re-buffering may outlast the suppress window and leak. Mitigation: `isBuffering` flag
-from `waiting`/`playing`, or grace window; in host-only the guest's own state is
-irrelevant so just ignore involuntary pauses and let catch-up logic (content.js:489)
-re-sync them.
-
-### EC-2 🟢 Force-Sync / Episode-Lobby abuse by guests
-Guest could seek + spam Force-Sync to drag everyone, or spam Episode-Lobby to pause
-everyone. Decision: host-only blocks guest *initiation* of `FORCE_SYNC_*` and
-`EPISODE_LOBBY`; guests may only respond (`FORCE_SYNC_ACK`, `EPISODE_READY`). Guests'
-legitimate path is the personal "Resync" button.
-
-### EC-3 🟢 Host leaves the room
-Fall back to `controlMode = 'everyone'`, broadcast `CONTROL_MODE`. Never a stuck locked
-room. (Auto-promote next peer deferred.)
-
-### EC-4 🔴 Snap-back fight loop (pause/play/skip back/pause/play)
-Mashing controls or a janky player → each snap-back may emit events → ping-pong.
-Mitigation: cooldown (~600ms) after snap-back; ensure snap-back runs fully under
-suppress. Also: if target is unreachable (seek past buffered range), retry K times then
-give up — no infinite loop.
-
-### EC-5 🔴 Ad breaks (YouTube/Twitch/…)
-Mid-roll ads pause/swap the media element, differ per peer → desync is unavoidable and
-must NOT spam the dialog. Probably covered by EC-1 buffering grace; flag for explicit
-testing.
-
-### EC-6 🟡 Snap-back target accuracy
-No continuous room clock; extrapolate from host's `currentTime` + `lastHeartbeat`
-(±1s, worse if stale). The follow-up host correction must also be suppressed so it
-doesn't read as guest input.
-
-### EC-7 🟢 Old / buggy / modified guest client
-Covered by receiver-side + server-side gates.
-
-### EC-8 🔴 Tab throttling / background tab
-Backgrounding throttles timers and may pause media. There's existing
-`visibilityGraceUntil` handling for seeks (content.js:892). Confirm a
-background-induced pause isn't treated as deliberate in host-only; reuse the grace flag.
-
-### EC-9 🔴 What counts as "deliberate" — the central unresolved question
-Collapses EC-1/EC-5/EC-8. Candidate signals: `readyState`/`networkState`/`video.seeking`
-at event time; recent `waiting`; recent user gesture (`navigator.userActivation`,
-keydown/click); visibility/focus. Build one shared **intent-classifier** helper in
-content.js that all host-only gating flows through.
-
-### EC-10 🔴 Host brief disconnect / reconnect (network blip)
-Host's wifi drops for 3s and reconnects. With "host leaves → fallback to everyone",
-a blip would silently unlock the room and demote the host (peerId persists in
-chrome.storage so they rejoin with the same id, but the server already cleared
-`hostPeerId`). Mitigation idea: short **host grace period** (e.g. keep `hostPeerId`
-reserved for ~30s after disconnect; if the same peerId rejoins, restore host + mode).
-Needs the server reaper (server:644) and `removePeerFromRoom` (server:168) to cooperate.
-
-### EC-11 🔴 New guest joins mid-session in host-only mode
-On join they must (a) immediately sync to the host's current position without the host
-doing anything, and (b) see they're a guest in the UI. ROOM_DATA already carries peers;
-add `hostPeerId`/`controlMode` so a fresh client knows its role instantly. Verify the
-existing "newcomer syncs without waiting" path (content.js:542) still fires.
-
-### EC-12 🔴 Desync semantics — what does "solo" actually mean?
-When a guest chooses "pause only me", do they (a) fully ignore all subsequent host
-events until they Resync, or (b) keep receiving but not auto-applying? Define clearly.
-Proposed: full solo — ignore host play/pause/seek while desynced; Resync re-attaches and
-snaps to current host position. Also: what state does Resync land them in if the host is
-currently paused vs playing?
-
-### EC-13 🔴 Race: host flips to host-only exactly as a guest pauses
-Event ordering between `SET_CONTROL_MODE`/`CONTROL_MODE` and an in-flight guest `PAUSE`.
-The `seq` ordering helps, but define the tie-break. Likely: server is authoritative —
-once it has `host-only`, it drops the guest event regardless of client-side timing.
-
-### EC-14 🟡 Volume / mute / audio-options must NOT be gated
-Those are per-peer, not room control. The gate must target only play/pause/seek +
-forcesync/episode — not `PEER_STATUS` volume/mute fields. Easy to over-block; add a test.
-
-### EC-15 🔴 Live streams (Twitch live, live DVR)
-"Room timestamp" is fuzzy on live edge; seeking semantics differ. Decide whether
-host-only even makes sense for live, or degrade gracefully. Low priority but log it.
-
-### EC-16 🟡 Host's own involuntary events still drive the room
-If the host buffers and the player auto-pauses, that pause is "allowed" and pauses
-everyone. That's existing behavior, but in host-only it means the host's buffering
-stalls the whole room. Acceptable? Probably yes (host is authoritative), but note it.
-
-### EC-17 🟡 Server restart drops room state
-`hostPeerId`/`controlMode` are in-memory. After a server restart, whoever rejoins first
-becomes the new host and mode resets to `everyone`. Acceptable for now (non-goal), but
-document so it's not a surprise.
-
-### EC-18 🟡 Dialog dismissed without choosing
-Guest clicks away / presses Esc on the desync prompt. Default = treat as "No" → snap
-back. Make sure an un-answered dialog can't leave them in limbo (paused + not desynced +
-no dialog).
-
-### EC-19 🟡 Multiple video elements / element swap (SPA, ad → content)
-Players that swap the `<video>` element mid-session: re-attach handlers (content.js
-already re-binds on `loadeddata`) and make sure host-only gating follows the new element.
-
-### EC-20 🟡 Peer list shape (object vs legacy string)
-Throughout background.js peers may be objects or bare peerId strings
-(`typeof p === 'object' ? p.peerId : p`). All new `hostPeerId` comparisons must handle
-both forms, or we get a host that's never recognized.
-
-### EC-21 🟡 Mode toggle spam / rate limiting
-Host hammering the toggle → many `SET_CONTROL_MODE`. Covered by existing
-`checkEventRate` (server), but debounce in the UI and ignore no-op transitions.
-
----
-
-## 7. Test matrix (fill in during dev)
-
-| Player            | Buffer→`pause`? | Ad behavior | Snap-back works? | Element swap? | Notes |
-|-------------------|-----------------|-------------|------------------|---------------|-------|
-| Generic HTML5     |                 |             |                  |               |       |
-| YouTube           |                 |             |                  |               |       |
-| Netflix           |                 |             |                  |               |       |
-| Twitch (VOD)      |                 |             |                  |               |       |
-| Twitch (live)     |                 |             |                  |               |       |
-| Disney+ / DRM     |                 |             |                  |               |       |
-| Jellyfin / Emby   |                 |             |                  |               |       |
-
-## 8. Decisions (audited)
-- [x] **Intent-classifier (EC-9):** A `pause`/`seek` is **involuntary** if ANY of:
-  `readyState < 3`, `video.seeking`, a `waiting` fired < ~1500ms ago (`isBuffering`
-  flag), inside `visibilityGraceUntil`, OR no own-tracked user gesture
-  (`Date.now() - lastUserGestureAt < 1000`, via capturing keydown/pointerdown — do
-  NOT use sticky `navigator.userActivation.hasBeenActive`). Bias: only *clearly*
-  involuntary is ignored; everything else = deliberate. **Note:** in host-only the
-  guest never broadcasts anyway, so this only decides dialog-vs-silent — a UX call,
-  not a room-integrity call. Start simple, tune later.
-- [x] **Host grace on disconnect (EC-10): NOT in v1.** Immediate fallback to
-  `everyone` (EC-3). A grace window risks a multi-second hard-lock if the host never
-  returns. Revisit as polish once the core flow works.
-- [x] **Desync semantics (EC-12): full solo.** Ignore host play/pause/seek while
-  desynced; Resync snaps to host position + adopts host play/pause state. Desync
-  auto-clears on new media/episode. Requires a persistent, obvious "You are desynced"
-  UI.
-- [x] **Snap-back cooldown (EC-4): until-settled, not fixed.** Suppress re-trigger
-  until `readyState>=3 && playing && |Δt|<tol`, hard-cap ~1500ms. Retry target up to
-  3×, then give up (no infinite loop).
-- [x] **Live streams (EC-15): degrade.** Disable the gate when
-  `video.duration === Infinity`. Caveat: live-DVR may report finite duration and slip
-  through — acceptable for v1.
diff --git a/docs/host-control-mode-TESTING.md b/docs/host-control-mode-TESTING.md
deleted file mode 100644
index 7ad63e0..0000000
--- a/docs/host-control-mode-TESTING.md
+++ /dev/null
@@ -1,83 +0,0 @@
-# Host Control Mode — Beta Testing Guide
-
-> Temporary doc for branch `feature/host-control-mode`. Remove before merge.
-> The feature needs the **server** half too — the official relay
-> (`wss://syncserver.koalastuff.net`) doesn't run it yet, so test against a beta
-> server first.
-
-## 1. Run the beta relay (Docker)
-
-The branch publishes the server image to GHCR under non-production tags
-(`:beta` = newest branch build, `:sha-<commit>` = immutable pin). `:latest` is
-never touched.
-
-```bash
-# Log in (the package is private → PAT with read:packages)
-echo "$GHCR_PAT" | docker login ghcr.io -u <your-gh-user> --password-stdin
-
-# Pull + (re)create — NOTE: `docker restart` does NOT pick up a new image,
-# you must remove and re-run (or use compose / Watchtower).
-docker pull ghcr.io/shik3i/koalasync:beta
-docker rm -f koala-beta 2>/dev/null || true
-docker run -d --name koala-beta -p 3000:3000 \
-  -e SERVER_SALT='choose-your-own-salt' \
-  ghcr.io/shik3i/koalasync:beta
-```
-
-To always run the newest beta automatically, point **Watchtower** at the
-container — it does the pull → recreate whenever `:beta` moves.
-
-The `OFFICIAL_SERVER_TOKEN` is baked into `shared/constants.js`, so no token env
-is needed. Set `SERVER_SALT` (used for room-password hashing).
-
-## 2. Connect the extension to it
-
-⚠️ The client **force-upgrades `ws://` to `wss://` for any non-localhost host**
-(see background.js "Upgraded to wss:// for remote host"). So a bare
-`ws://your-server:3000` will fail without TLS. Two options:
-
-- **Quick (no TLS):** SSH-tunnel the port so it counts as local:
-  ```bash
-  ssh -L 3000:localhost:3000 your-beta-server
-  ```
-  then in the popup → **Manual Connect / Advanced → Custom →** `ws://localhost:3000`.
-- **Proper:** put the container behind a TLS reverse proxy (Caddy does automatic
-  HTTPS) → `wss://beta.yourdomain`.
-
-Then create/join a room.
-
-## 3. ⚠️ Use two *new* clients
-
-Test with **two browser profiles both running this branch build** (load unpacked
-from `extension/`, or install the built zip). A stock release client as a guest
-will be correctly gated by the server but has none of the content-side code, so
-it silently desyncs with no dialog/snap-back — that's expected degradation, not a
-bug, but it looks like one during testing.
-
-## 4. Verification checklist
-
-| # | Step | Expect |
-|---|------|--------|
-| 1 | Create a room (host) | Host Control card shows **Host** + the toggle |
-| 2 | Second profile joins | Guest sees no card while mode is "everyone" |
-| 3 | Host enables "Only I can control" | Guest's Play/Pause/SYNC buttons lock; card shows **Guest** |
-| 4 | Guest presses pause/space on the video | Brief flicker, snaps back to host position |
-| 5 | Guest pauses again | Dialog: "Stay in sync" / "Watch on my own" |
-| 6 | Guest → "Watch on my own" | Persistent "Solo" badge; host's peer list shows **Solo** |
-| 7 | Guest → "Resync" | Snaps back to host; Solo badge clears on both sides |
-| 8 | Guest tries Force-Sync / seek spam | Nothing propagates to the room |
-| 9 | Host disables host-only | Card hides for guest; controls unlock |
-| 10 | Host leaves the room | Room falls back to "everyone"; a remaining peer becomes host |
-| 11 | Reload the guest's page while desynced | Still shows Solo (state survives reload) |
-| 12 | Switch the popup language | Dialog/badge text is localized |
-
-## 5. Capability detection
-
-The relay advertises `capabilities: ['host-control']` in `ROOM_DATA`. The client
-only enables the feature when that flag is present, so:
-- against this beta server → feature on;
-- against the old official server → feature cleanly hidden (no errors).
-
-This is the extensible hook for the planned **co-host** feature (owner promotes
-guests to additional controllers) — it'll add a `'co-host'` capability + events
-without breaking older relays/clients.
diff --git a/docs/host-control-mode-plan.md b/docs/host-control-mode-plan.md
deleted file mode 100644
index 1e59836..0000000
--- a/docs/host-control-mode-plan.md
+++ /dev/null
@@ -1,122 +0,0 @@
-# Host Control Mode — Implementierungsplan
-
-Branch: `feature/host-control-mode`
-Issue: GitHub feature request (wasserrutschentester) — nur Host darf den Raum steuern; Gäste werden zurückgesnappt oder gehen bewusst in Desync.
-
-## Ziel
-
-Ein Raum kann zwischen zwei Modi umgeschaltet werden:
-- **`everyone`** (Default, heutiges Verhalten): jeder kann play/pause/seek für alle auslösen.
-- **`host-only`**: nur der Host steuert den Raum. Pause/Seek eines Gasts wird **nicht** gebroadcastet; stattdessen snappt die eigene Extension den Gast zurück auf den Raum-Zustand — es sei denn, der Gast entscheidet sich bewusst für Desync.
-
-Trust-Modell: client-seitig durchgesetzt. Kein Token, keine Auth. Es geht um versehentliches Stören, nicht um Angriffsschutz.
-
----
-
-## Datenmodell
-
-### Server (`server/index.js`, Room-Objekt ~Z.331)
-Room bekommt zwei neue Felder:
-```js
-room = {
-  ...,
-  hostPeerId: peerId,        // gesetzt beim Anlegen = erster Joiner
-  controlMode: 'everyone',   // 'everyone' | 'host-only'
-}
-```
-- In `ROOM_DATA` (~Z.418) mitschicken: `hostPeerId`, `controlMode`.
-- Neues Event `SET_CONTROL_MODE` (siehe unten): nur akzeptieren, wenn `senderPeerId === room.hostPeerId`. Server setzt `room.controlMode`, broadcastet die Änderung an alle.
-- **Host-Migration:** in `removePeerFromRoom` (~Z.168) — wenn der gehende Peer `hostPeerId` war: entweder neuen Host bestimmen (nächster Peer) **oder** `controlMode` auf `everyone` zurückfallen lassen. → Entscheidung: **Fallback auf `everyone`** (simpel, nie verwaister gesperrter Raum). Optional später: Host-Transfer-Button.
-
-### Shared Constants (`shared/constants.js`)
-Neue Events im `EVENTS`-Objekt:
-```js
-SET_CONTROL_MODE: "set_control_mode",   // Client->Server: Host ändert Modus
-CONTROL_MODE: "control_mode",            // Server->Client: Modus geändert { controlMode, hostPeerId }
-```
-⚠️ Danach `node scripts/build-extension.cjs` laufen lassen (Single Source of Truth propagieren). Ggf. `PROTOCOL_VERSION` bumpen — **nein, nur wenn alte Clients brechen würden**. Da alles additiv ist und alte Clients die neuen Felder/Events einfach ignorieren, ist KEIN Protokoll-Bump nötig. (Alter Client in host-only-Raum kennt den Modus nicht und sendet weiter → Host-Extensions ignorieren fremde Events nicht... → siehe Edge Case 7. Evtl. doch Bump erwägen.)
-
-### Extension State (`background.js`)
-```js
-let controlMode = 'everyone';
-let hostPeerId = null;
-// abgeleitet: const amHost = () => hostPeerId === peerId;
-```
-Aus `ROOM_DATA` / `CONTROL_MODE` befüllen, in `chrome.storage.session` persistieren (wie `currentRoom`).
-
----
-
-## Implementierung nach Schichten
-
-### 1. Server (`server/index.js`)
-- [ ] Room-Objekt um `hostPeerId` + `controlMode` erweitern (~Z.331).
-- [ ] `ROOM_DATA`-Payload erweitern (~Z.418).
-- [ ] Handler `SET_CONTROL_MODE`: validieren (Host-Check + Wert in {everyone, host-only}), setzen, `CONTROL_MODE` an Raum broadcasten.
-- [ ] Host-Migration in `removePeerFromRoom`: Fallback auf `everyone` + neues `CONTROL_MODE` broadcasten, wenn Host geht.
-- [ ] `SET_CONTROL_MODE` in die `relayEvents`-Liste? **Nein** — eigener Handler, da Sonderlogik + Host-Check. (relayEvents broadcastet blind.)
-
-### 2. Shared / Build
-- [ ] `EVENTS.SET_CONTROL_MODE`, `EVENTS.CONTROL_MODE` ergänzen.
-- [ ] `node scripts/build-extension.cjs`.
-
-### 3. background.js (Gast-Logik = Kern)
-- [ ] `controlMode` / `hostPeerId` aus `ROOM_DATA` (~Z.875) und neuem `CONTROL_MODE`-Case übernehmen + persistieren + an Popup/Content pushen.
-- [ ] **Emit-Gate** im SEND-Pfad (~Z.1786): bei `host-only && !amHost()` und action ∈ {play, pause, seek}:
-      - NICHT `emit`en.
-      - Stattdessen Content-Script anweisen: "snap back" ODER Desync-Confirm anzeigen.
-- [ ] **Snap-Back-Zielzeit berechnen:** aus Host-Peer-State (`playbackState`, `currentTime`, `lastHeartbeat`) extrapolieren:
-      `targetTime = host.currentTime + (host.playbackState==='playing' ? (now - host.lastHeartbeat)/1000 : 0)`.
-      Genauigkeit ~±1s, für Watchparty ok. (Force-Sync-Maschinerie als Referenz für Ziel-Zeit-Koordination.)
-- [ ] Nachricht an content.js: `{ type: 'HOST_BLOCK', action, targetTime, hostPlaybackState }`.
-
-### 4. content.js (Player-Reaktion + Dialog)
-- [ ] Handler für `HOST_BLOCK`: Confirm-Dialog im Player-Overlay rendern:
-      "Pause only your own player and desync from the group? [Yes] [No]".
-      - **No** (Default): Player via bestehende `_setSuppress`-Mechanik ([content.js:442](../extension/content.js:442)) wieder in Raum-Zustand zwingen (play + seek auf targetTime). Suppress verhindert Re-Broadcast.
-      - **Yes:** lokal pausiert lassen, `isDesynced = true` setzen, dezenten "Desynced — Resync"-Button zeigen.
-- [ ] "Resync"-Button → snappt zurück auf aktuelle Raum-Zeit, `isDesynced = false`.
-- [ ] **Loop-Schutz:** nach einer Snap-Back-Aktion kurzes Cooldown-Fenster (z.B. 600ms), in dem weitere lokale pause/seek-Events nicht erneut den Dialog triggern (verhindert pause→play→pause-Pingpong).
-
-### 5. popup (Host-UI)
-- [ ] Host-Toggle "Only I can control" (nur sichtbar wenn `amHost()`), sendet `SET_CONTROL_MODE`.
-- [ ] Rollen-Badge: "Host" / "Guest" + aktueller Modus.
-- [ ] Gast-Hinweis wenn host-only aktiv: "The host controls playback".
-- [ ] i18n-Keys in `extension/_locales` / `locales` für ~15 Sprachen.
-
----
-
-## Edge Cases (Test-Checkliste)
-
-1. **Pause nicht verhinderbar, nur revidierbar** → kurzer Flicker (~½s) beim Gast ist erwartet/akzeptabel.
-2. **Snap-Back-Zielzeit** aus Heartbeat extrapoliert, ±1s. Bei stark veraltetem Host-State (kein Heartbeat) → letzten bekannten Wert nehmen.
-3. **Kampf-Loop pause/play/skip back/pause/play** → Cooldown-Fenster nach Snap-Back. Testen mit aggressivem Mashing.
-4. **Desync-Escape:** Gast kann bewusst pausieren (Klo/Telefon) → "Yes" → solo, dann Resync.
-5. **Host verlässt Raum** → Fallback auf `everyone`, alle bekommen `CONTROL_MODE`-Update. Testen: Host schließt Tab / Disconnect / Netzabbruch.
-6. **host-only + Episode-Auto-Sync / Force-Sync** (server/index.js:503-516): **Gast darf NICHT initiieren.** Force-Sync trägt eine `targetTime` und zwingt ALLE darauf (background.js:1261) — ein Gast könnte seeken → Force-Sync spammen und damit host-only komplett aushebeln. Episode-Lobby pausiert ebenfalls alle. → Im host-only-Modus dürfen `FORCE_SYNC_PREPARE`/`FORCE_SYNC_EXECUTE` und `EPISODE_LOBBY` nur vom Host **initiiert** werden. Gäste dürfen weiterhin nur **reagieren**: `FORCE_SYNC_ACK`, `EPISODE_READY`. Gäste brauchen Force-Sync nicht — ihr legitimer Fall ist der "Resync"-Button (snappt nur sie selbst, nicht alle).
-7. **Alter Client (ohne Feature) in host-only-Raum** → kennt Modus nicht, sendet weiter pause/seek → andere Extensions wenden es an. Mitigation: Empfänger-seitiges Gate (host-only-Clients ignorieren play/pause/seek von Nicht-Host) ODER `MIN_VERSION`/Protokoll-Bump. → **Empfehlung: zusätzlich Empfänger-seitig filtern** (robuster als nur Sender-Gate).
-8. **Seek getrennt von Pause** → host-only blockt auch Gast-Seeks, nicht nur Pausen.
-9. **Mehrere Tabs / Multi-Peer mit gleicher peerId** (Dedup, server:381) → Host-Identität bleibt an peerId hängen, ok.
-10. **DAU-Verwirrung** "warum kann ich nicht mehr pausieren?" → klare UI-Botschaft + der Desync-Dialog erklärt sich selbst.
-
-## Architektur-Entscheidung zu Edge Case 7 (wichtig)
-Wir setzen das Gate **doppelt** und über **alle raum-verschiebenden Events**, nicht nur play/pause/seek:
-Geblockte Initiierungen für Nicht-Host im host-only-Modus:
-`PLAY`, `PAUSE`, `SEEK`, `FORCE_SYNC_PREPARE`, `FORCE_SYNC_EXECUTE`, `EPISODE_LOBBY`.
-Weiterhin erlaubt für Gäste (reine Reaktion, verschiebt niemanden): `FORCE_SYNC_ACK`, `EPISODE_READY`, `PEER_STATUS`, `PING`/`PONG`.
-
-- **Sender-seitig** (Gast sendet erst gar nicht) → saubere UX, Confirm-Dialog bei play/pause/seek; Force-Sync-/Episode-Lobby-Buttons im Gast-UI deaktiviert/ausgeblendet.
-- **Empfänger-seitig** (in `handleServerEvent`, background.js:969 + Force-Sync-/Episode-Cases): wenn `host-only` und `data.senderId !== hostPeerId` → Event verwerfen (nicht an Content routen, keine State-Mutation).
-So sind auch alte/buggy/manipulierte Clients abgedeckt, ohne harten Protokoll-Bump.
-
-Optional zusätzlich **server-seitig** in den `relayEvents` (server/index.js:445): im host-only-Modus Initiierungs-Events von Nicht-Host gar nicht erst relayen. Spart Traffic + deckt alles zentral ab. Empfehlenswert, da der Server `hostPeerId`/`controlMode` ohnehin kennt.
-
----
-
-## Reihenfolge der Umsetzung (kleine, testbare Schritte)
-1. Constants + Build (Events da, nichts kaputt).
-2. Server: hostPeerId/controlMode + ROOM_DATA + SET_CONTROL_MODE + Migration.
-3. background.js: State übernehmen + Empfänger-seitiges Gate (Edge 7) — testbar ohne UI.
-4. background.js: Sender-seitiges Gate + Snap-Back-Zielzeit.
-5. content.js: Snap-Back-Apply + Confirm-Dialog + Loop-Cooldown.
-6. popup: Host-Toggle + Badge + i18n.
-7. Durchtesten der Edge-Case-Liste auf YT / Netflix / generischem HTML5-Player.
diff --git a/docs/host-control-mode.md b/docs/host-control-mode.md
new file mode 100644
index 0000000..2396c82
--- /dev/null
+++ b/docs/host-control-mode.md
@@ -0,0 +1,151 @@
+# Host Control Mode
+
+This document describes the Host Control Mode implementation in the relay and
+extension. It only covers behavior implemented in the current codebase.
+
+## Modes
+
+### `everyone`
+
+- Default room mode.
+- Any peer may send room-moving playback events.
+
+### `host-only`
+
+- Only controllers may send room-moving playback events.
+- The host is always a controller.
+- The host can promote additional peers to controllers.
+- Guests can keep watching locally in solo/desynced mode, but their local actions
+  still do not drive the shared room.
+
+Room-moving events are:
+
+- `play`
+- `pause`
+- `seek`
+- `force_sync_prepare`
+- `force_sync_execute`
+- `episode_lobby`
+- `episode_lobby_cancel`
+
+Heartbeats, force-sync ACKs, episode-ready events, ping/pong, and command ACKs
+remain allowed for guests.
+
+## Server State
+
+Rooms store Host Control state in memory:
+
+```js
+{
+  hostPeerId,
+  controlMode,
+  controllers,
+  lastControlModeChangeAt,
+  lastRoleChangeAt,
+  forceSyncInitiator
+}
+```
+
+`controllers` is a `Set` on the server and is serialized as an array in
+`room_data` and `control_mode`.
+
+State is not persisted across relay restarts.
+
+## Authority Rules
+
+### Changing mode
+
+Only `hostPeerId` may send `set_control_mode`.
+
+Valid values:
+
+- `everyone`
+- `host-only`
+
+Invalid values are ignored. Non-host attempts are ignored and the sender receives
+the current `control_mode` snapshot so optimistic UI can revert.
+
+Mode changes are debounced per room for 500 ms.
+
+### Promoting and demoting controllers
+
+Only `hostPeerId` may send `set_peer_role`.
+
+The host cannot demote themself. No-op role changes are ignored. Role changes are
+debounced per room for 500 ms.
+
+### Host leaving
+
+When the host leaves and peers remain:
+
+- the next peer becomes `hostPeerId`;
+- `controlMode` falls back to `everyone`;
+- `controllers` is reset to the new host;
+- the relay broadcasts `control_mode`.
+
+When a non-host controller leaves, the relay removes that peer from
+`controllers` and broadcasts `control_mode`.
+
+## Enforcement
+
+The implementation has two enforcement points:
+
+- The extension background script blocks local guest attempts in `host-only` and
+  sends `HOST_BLOCKED` to the content script for local UX.
+- The relay drops room-moving events from non-controllers in `host-only`, so old
+  or modified clients cannot drive the room.
+
+The relay is the authority for room-wide effects.
+
+## Guest UX
+
+When a guest action is blocked locally, the content script classifies it:
+
+- deliberate user action: show the host-control dialog;
+- likely involuntary player action (buffering, tab refocus, no recent gesture):
+  silently snap back when safe;
+- live/DVR stream: degrade without forcing snap-back.
+
+The dialog offers:
+
+- stay in sync: resync to the host;
+- watch on my own: enter solo/desynced mode.
+
+In solo/desynced mode:
+
+- the guest can control their local video;
+- host room commands are ignored locally, except force-sync preparation is ACKed
+  so the host's flow can continue;
+- the guest can resync to the host.
+
+The extension reports `desynced` in peer status so the host UI can show that a
+guest is watching solo.
+
+## Force Sync Edge Case
+
+The relay tracks `forceSyncInitiator` after a controller sends
+`force_sync_prepare`.
+
+This allows that same initiator's `force_sync_execute` through even if their
+controller role changes before execute arrives. Without this, a demotion in the
+middle of a force-sync flow could leave peers waiting after prepare.
+
+The relay clears `forceSyncInitiator` after execute or when the initiator leaves.
+
+## Capabilities
+
+The relay advertises Host Control support in `room_data.capabilities`:
+
+- `host-control`
+- `co-host`
+
+The extension hides or disables matching UI when capabilities are missing.
+
+## Related Events
+
+See [PROTOCOL.md](PROTOCOL.md) for payloads and relay behavior for:
+
+- `set_control_mode`
+- `control_mode`
+- `set_peer_role`
+- host-only gated relay events
diff --git a/eslint.config.mjs b/eslint.config.mjs
index 17f0d1c..8b8cc0f 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -1,6 +1,6 @@
 export default [
   {
-    ignores: ["dist/**", "node_modules/**", "scratch/**"]
+    ignores: ["coverage/**", "dist/**", "node_modules/**", "scratch/**"]
   },
   {
     languageOptions: {
diff --git a/package-lock.json b/package-lock.json
index fbc12ce..10cce7b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,25 +1,110 @@
 {
   "name": "koalasync",
-  "version": "2.2.4",
+  "version": "2.5.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "koalasync",
-      "version": "2.2.4",
+      "version": "2.5.1",
       "devDependencies": {
+        "@vitest/coverage-v8": "^4.1.9",
         "archiver": "^7.0.1",
         "esbuild": "^0.28.1",
         "eslint": "^10.4.0",
         "fs-extra": "^11.2.0",
         "sharp": "^0.34.5",
-        "svgo": "^4.0.1"
+        "svgo": "^4.0.1",
+        "vitest": "^4.1.9"
+      }
+    },
+    "node_modules/@babel/helper-string-parser": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
+      "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-validator-identifier": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
+      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/parser": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.7.tgz",
+      "integrity": "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^7.29.7"
+      },
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@babel/types": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.7.tgz",
+      "integrity": "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-string-parser": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@bcoe/v8-coverage": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-1.0.2.tgz",
+      "integrity": "sha512-6zABk/ECA/QYSCQ1NGiVwwbQerUCZ+TQbp64Q3AgmfNvurHH0j8TtXa1qbShXA6qqkpAj4V5W8pP6mLe1mcMqA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@emnapi/core": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.1.tgz",
+      "integrity": "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/wasi-threads": "1.2.2",
+        "tslib": "^2.4.0"
       }
     },
     "node_modules/@emnapi/runtime": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
-      "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.1.tgz",
+      "integrity": "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@emnapi/wasi-threads": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz",
+      "integrity": "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -1189,6 +1274,63 @@
         "node": ">=12"
       }
     },
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
+      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.5.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
+      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.31",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
+      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.1.0",
+        "@jridgewell/sourcemap-codec": "^1.4.14"
+      }
+    },
+    "node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.6.tgz",
+      "integrity": "sha512-ZLv/JdUfkvOy9eCnnBaGfiO+XimbjebAeO+MRQqD/B+FR1tnRN0tpKSJHRbE8sFfS6aqsXZ67TQjfwfsxULVbg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@tybys/wasm-util": "^0.10.3"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1"
+      }
+    },
+    "node_modules/@oxc-project/types": {
+      "version": "0.138.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.138.0.tgz",
+      "integrity": "sha512-1a7ZKmrRTCoN1XMZ4L0PyyqrMnrNlLyPuOkdSX2MZg7IiIGRUyurNhAm73ptDOraoBcIordsIGKNPKUzy3ZmfA==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/Boshen"
+      }
+    },
     "node_modules/@pkgjs/parseargs": {
       "version": "0.11.0",
       "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
@@ -1200,6 +1342,306 @@
         "node": ">=14"
       }
     },
+    "node_modules/@rolldown/binding-android-arm64": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.4.tgz",
+      "integrity": "sha512-EZLpf/8y7GXkkra90ML47kzik/GMP3EMcE9bPyHmRfxLC6z9+aW5A8poCsoxjrT5GfEcNAAvWwUHjvP1pUQkfw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-darwin-arm64": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.4.tgz",
+      "integrity": "sha512-aUi+HBvmYb7j8krl1+qJgkG8C17fO79gk3c+jPw4S8glRFc1DTija9S3EyaTSQUm5GJXYKDAsugBEhFHH2vYiQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-darwin-x64": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.4.tgz",
+      "integrity": "sha512-F7hHC3gwY11+vByKPRWqwGbeXWVgKmL+pTGCinaEhdihzBV2aQ0fvZOch9cXYUOKuKKq429HeYXOqQLc7wFCEg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-freebsd-x64": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.4.tgz",
+      "integrity": "sha512-sI5yw+7s92SK6odiEhD5lKCBlWcpjHS5qyqpVQbZAJ0fIzEUXrmbl3DH2ybR3PZogulNJF+COLtmA8hUfvkCCQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.4.tgz",
+      "integrity": "sha512-mCi0OKgEieFircrtVYmQAFGszRtMnZ6fpZAXrxanXAu7lqZcsK1E1RAaZNG0uKAnxox3B1f4EyQNnoyMfN1vAA==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm64-gnu": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.4.tgz",
+      "integrity": "sha512-B9Ial3Kv5sh0SHnB1g/QWcUQCEvCF6QKGAl4zXypYj65mVI+B4AhFBwPtSN7pDrJeIx8Z7zdy4ntx+wQABom7w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm64-musl": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.4.tgz",
+      "integrity": "sha512-lZVym0PuHE1KZ22gmFTC15lAkrg9iTszR617oYRB/iPY1A56ywoJzVKOJBKaot5RiikCObmur6pogpse3gRcng==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-ppc64-gnu": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.4.tgz",
+      "integrity": "sha512-t2DNiLJWNTbnEHyUzTumldML6ET4/g16467LZoDDJ3tSxGvguL5/NyC2lCsNKuyRycg9XeDQF5SSv+TNOhQEXg==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-s390x-gnu": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.4.tgz",
+      "integrity": "sha512-0WIRnL1Uw4BvTZRLQt+PVgo6ZKTJadlC2btP+/EOXv2f/DWbY0rEgl+y834mIVwP1FkTlWVTrGGJXf12lru7EQ==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-x64-gnu": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.4.tgz",
+      "integrity": "sha512-JWtGshGfX+oENAKonoNkqEJX+7hC8yfhi9GUyPX1VX4mdh1y5r+ZiJLR5XzAB0aoP6s/PcILsGjKq8O0mm24bw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-x64-musl": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.4.tgz",
+      "integrity": "sha512-rT6yQcxUuXs4CnbofqwHRRV0iem349rLMYpTjkgQGLjrY4ado/eDzwPZPTCgTOlF6Nkp8NEv70yLMTn6qkWxsQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-openharmony-arm64": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.4.tgz",
+      "integrity": "sha512-KXMGoboq5cyaCQjDA4GLuRiOwBQ0EyFnJoVViLeZ45/3rFItRODEr+NdsBcVpll40hhNArlm/speWGRvj08LzA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-wasm32-wasi": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.4.tgz",
+      "integrity": "sha512-5K83rb36oJiY7BCyE9zLZtGcPV4g5wvq+xwdO0XPIwDVZI8cyB/AUjkNXGb92/rnmezEkjMOpgY61rtwjQtFwg==",
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "1.11.1",
+        "@emnapi/runtime": "1.11.1",
+        "@napi-rs/wasm-runtime": "^1.1.6"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-win32-arm64-msvc": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.4.tgz",
+      "integrity": "sha512-PnWBtw3TV5KOg69HQQDR0mnQuyCmSGR2pAB4DC1rPF808fgKeTUMj2EOEyKATpgiuxuR5APQmiDO7PDgEjTFSA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-win32-x64-msvc": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.4.tgz",
+      "integrity": "sha512-M1lpniBePobTfsa7Ks9a199e1akxsXn+GYBUKsEzv3YFzOm1HJAMNwKI3qr0Zq+mxwx9gOZoTdP1yXRYsZUocQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/pluginutils": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
+      "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@standard-schema/spec": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
+      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@tybys/wasm-util": {
+      "version": "0.10.3",
+      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
+      "integrity": "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@types/chai": {
+      "version": "5.2.3",
+      "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz",
+      "integrity": "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/deep-eql": "*",
+        "assertion-error": "^2.0.1"
+      }
+    },
+    "node_modules/@types/deep-eql": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz",
+      "integrity": "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/esrecurse": {
       "version": "4.3.1",
       "resolved": "https://registry.npmjs.org/@types/esrecurse/-/esrecurse-4.3.1.tgz",
@@ -1221,6 +1663,151 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@vitest/coverage-v8": {
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-4.1.9.tgz",
+      "integrity": "sha512-G9/lgqibheLVBDRuya45EbsEXTYcWoSG+TLg7i2axuzx0Eq62eXn+aWXyaVdV5vKvFSWd6ywcX8hA7la9Pvu8g==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "@bcoe/v8-coverage": "^1.0.2",
+        "@vitest/utils": "4.1.9",
+        "ast-v8-to-istanbul": "^1.0.0",
+        "istanbul-lib-coverage": "^3.2.2",
+        "istanbul-lib-report": "^3.0.1",
+        "istanbul-reports": "^3.2.0",
+        "magicast": "^0.5.2",
+        "obug": "^2.1.1",
+        "std-env": "^4.0.0-rc.1",
+        "tinyrainbow": "^3.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "@vitest/browser": "4.1.9",
+        "vitest": "4.1.9"
+      },
+      "peerDependenciesMeta": {
+        "@vitest/browser": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vitest/expect": {
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.9.tgz",
+      "integrity": "sha512-vl/rYsUKcBr3SnQn166+XR5ZQcgMx3DQhFWdfli/cWpLnLUmbxZvyrJZotLFUryib+LtArYMSTJ5RbQ57ZqrlA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@standard-schema/spec": "^1.1.0",
+        "@types/chai": "^5.2.2",
+        "@vitest/spy": "4.1.9",
+        "@vitest/utils": "4.1.9",
+        "chai": "^6.2.2",
+        "tinyrainbow": "^3.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/mocker": {
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.9.tgz",
+      "integrity": "sha512-EVkXzBjrPGM+cK8/ANWgBrkUCfJfb38/EfTSO8h7pWvKkyPkpWxvR7BkD2MyItMF62C97zAEoqdpUixwR/e+Rw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/spy": "4.1.9",
+        "estree-walker": "^3.0.3",
+        "magic-string": "^0.30.21"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "msw": "^2.4.9",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "msw": {
+          "optional": true
+        },
+        "vite": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vitest/pretty-format": {
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.9.tgz",
+      "integrity": "sha512-s0iufns3iIFitdgm+YR7g1whCAaGtXz459VS9/PqyKDEEFgYIhsHOQmXgIgDuYCt7DeQmiZT0Qe2OA2p4ZPu5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tinyrainbow": "^3.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/runner": {
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.9.tgz",
+      "integrity": "sha512-KXLMDtc7oe70+3mJfGrPUWPesswH+3sTxAMAMl8DG7I8IUQT4XW718dY5ID3vPUcmlu27CcKfY4P3h3I29SLJg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/utils": "4.1.9",
+        "pathe": "^2.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/snapshot": {
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.9.tgz",
+      "integrity": "sha512-Jc7RKGNBo8Z28WYIm0Niej4xdSPByRf6mU58VpHQkd6Zh05rlnA+twjbK5HyeIGHxrzsc3mJgS43uM0CZKzaIA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/pretty-format": "4.1.9",
+        "@vitest/utils": "4.1.9",
+        "magic-string": "^0.30.21",
+        "pathe": "^2.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/spy": {
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.9.tgz",
+      "integrity": "sha512-fHpsS6mIi+PiEW+vcRVOMkX1oSaPKne3VOclSFICPcGOmfKgXPU5iAah+wcNcj2xPrCCmfq99IDGf+EojhhvhA==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/utils": {
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.9.tgz",
+      "integrity": "sha512-A51o8ymO5PpqlWNnBP9ZHPXDIpuMtTLlGSjN7la4US+LJzoUMyhwjA5QXlm39JexgwHKW4Xjs8Z2d3dLCXOeuA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/pretty-format": "4.1.9",
+        "convert-source-map": "^2.0.0",
+        "tinyrainbow": "^3.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
     "node_modules/abort-controller": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/abort-controller/-/abort-controller-3.0.0.tgz",
@@ -1240,6 +1827,7 @@
       "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -1338,6 +1926,28 @@
         "node": ">= 14"
       }
     },
+    "node_modules/assertion-error": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
+      "integrity": "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/ast-v8-to-istanbul": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/ast-v8-to-istanbul/-/ast-v8-to-istanbul-1.0.4.tgz",
+      "integrity": "sha512-0bC0/4bTSrnwdhU3IsZDwEdojvuPrSg59OYZfKsLRtJZ0u8VBx9DebfqqG8bRdCC0I7vjgxmPi41P0lpkhJHtA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/trace-mapping": "^0.3.31",
+        "estree-walker": "^3.0.3",
+        "js-tokens": "^10.0.0"
+      }
+    },
     "node_modules/async": {
       "version": "3.2.6",
       "resolved": "https://registry.npmjs.org/async/-/async-3.2.6.tgz",
@@ -1373,6 +1983,7 @@
       "integrity": "sha512-riJjyv1/mHLIPX4RwiK+oW9/4c3TEUeORHKefKAKnZ5kyslbN+HXowtbaVEqt4IMUB7OXlfixcs6gsFeo/jhiQ==",
       "dev": true,
       "license": "Apache-2.0",
+      "peer": true,
       "peerDependencies": {
         "bare-abort-controller": "*"
       },
@@ -1537,6 +2148,16 @@
         "node": ">=8.0.0"
       }
     },
+    "node_modules/chai": {
+      "version": "6.2.2",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
+      "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/color-convert": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
@@ -1584,6 +2205,13 @@
         "node": ">= 14"
       }
     },
+    "node_modules/convert-source-map": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
+      "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/core-util-is": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
@@ -1834,6 +2462,13 @@
         "url": "https://github.com/fb55/entities?sponsor=1"
       }
     },
+    "node_modules/es-module-lexer": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.2.0.tgz",
+      "integrity": "sha512-3lGxdTXCLfe1MYfTz1y2ksAAUM4NAOP6rPEjxGJVKO7TZ5+tvHCaQWGpC4Y3IXvW3ece0Cz1cIP4FWBxOnGCTQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/esbuild": {
       "version": "0.28.1",
       "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz",
@@ -1841,6 +2476,7 @@
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
+      "peer": true,
       "bin": {
         "esbuild": "bin/esbuild"
       },
@@ -1895,6 +2531,7 @@
       "integrity": "sha512-loXy6bWOoP3EP6JA7jo6p5jMpBJmHmsNZM5SFRHLdh1MGOPurMnNBj4ZlAbaqUAaQWbCr7jHV4P7gzAyryZWkQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.2",
@@ -2070,6 +2707,16 @@
         "node": ">=4.0"
       }
     },
+    "node_modules/estree-walker": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
+      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.0"
+      }
+    },
     "node_modules/esutils": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
@@ -2110,6 +2757,16 @@
         "bare-events": "^2.7.0"
       }
     },
+    "node_modules/expect-type": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.4.0.tgz",
+      "integrity": "sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -2138,6 +2795,24 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/fdir": {
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
+      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "peerDependencies": {
+        "picomatch": "^3 || ^4"
+      },
+      "peerDependenciesMeta": {
+        "picomatch": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/file-entry-cache": {
       "version": "8.0.0",
       "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-8.0.0.tgz",
@@ -2221,6 +2896,21 @@
         "node": ">=14.14"
       }
     },
+    "node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
     "node_modules/glob": {
       "version": "10.5.0",
       "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
@@ -2263,6 +2953,23 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/html-escaper": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
+      "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/ieee754": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
@@ -2371,6 +3078,45 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/istanbul-lib-coverage": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.2.tgz",
+      "integrity": "sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/istanbul-lib-report": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-report/-/istanbul-lib-report-3.0.1.tgz",
+      "integrity": "sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "istanbul-lib-coverage": "^3.0.0",
+        "make-dir": "^4.0.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/istanbul-reports": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.2.0.tgz",
+      "integrity": "sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "html-escaper": "^2.0.0",
+        "istanbul-lib-report": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/jackspeak": {
       "version": "3.4.3",
       "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-3.4.3.tgz",
@@ -2387,6 +3133,13 @@
         "@pkgjs/parseargs": "^0.11.0"
       }
     },
+    "node_modules/js-tokens": {
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-10.0.0.tgz",
+      "integrity": "sha512-lM/UBzQmfJRo9ABXbPWemivdCW8V2G8FHaHdypQaIy523snUjog0W71ayWXTjiR+ixeMyVHN2XcpnTd/liPg/Q==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/json-buffer": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
@@ -2491,6 +3244,267 @@
         "node": ">= 0.8.0"
       }
     },
+    "node_modules/lightningcss": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.32.0.tgz",
+      "integrity": "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==",
+      "dev": true,
+      "license": "MPL-2.0",
+      "dependencies": {
+        "detect-libc": "^2.0.3"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      },
+      "optionalDependencies": {
+        "lightningcss-android-arm64": "1.32.0",
+        "lightningcss-darwin-arm64": "1.32.0",
+        "lightningcss-darwin-x64": "1.32.0",
+        "lightningcss-freebsd-x64": "1.32.0",
+        "lightningcss-linux-arm-gnueabihf": "1.32.0",
+        "lightningcss-linux-arm64-gnu": "1.32.0",
+        "lightningcss-linux-arm64-musl": "1.32.0",
+        "lightningcss-linux-x64-gnu": "1.32.0",
+        "lightningcss-linux-x64-musl": "1.32.0",
+        "lightningcss-win32-arm64-msvc": "1.32.0",
+        "lightningcss-win32-x64-msvc": "1.32.0"
+      }
+    },
+    "node_modules/lightningcss-android-arm64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz",
+      "integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-arm64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz",
+      "integrity": "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-x64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.32.0.tgz",
+      "integrity": "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-freebsd-x64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.32.0.tgz",
+      "integrity": "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm-gnueabihf": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.32.0.tgz",
+      "integrity": "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-gnu": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.32.0.tgz",
+      "integrity": "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-musl": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.32.0.tgz",
+      "integrity": "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-gnu": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.32.0.tgz",
+      "integrity": "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-musl": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.32.0.tgz",
+      "integrity": "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-arm64-msvc": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.32.0.tgz",
+      "integrity": "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-x64-msvc": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz",
+      "integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
     "node_modules/locate-path": {
       "version": "6.0.0",
       "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
@@ -2521,6 +3535,44 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/magic-string": {
+      "version": "0.30.21",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
+      "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.5"
+      }
+    },
+    "node_modules/magicast": {
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/magicast/-/magicast-0.5.3.tgz",
+      "integrity": "sha512-pVKE4UdSQ7DvHzivsCIFx2BJn1mHG6KsyrFcaxFx6tONdneEuThrDx0Cj3AMg58KyN4pzYT+LHOotxDQDjNvkw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^7.29.3",
+        "@babel/types": "^7.29.0",
+        "source-map-js": "^1.2.1"
+      }
+    },
+    "node_modules/make-dir": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-4.0.0.tgz",
+      "integrity": "sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "semver": "^7.5.3"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/mdn-data": {
       "version": "2.27.1",
       "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.27.1.tgz",
@@ -2561,6 +3613,25 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/nanoid": {
+      "version": "3.3.15",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.15.tgz",
+      "integrity": "sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
     "node_modules/natural-compare": {
       "version": "1.4.0",
       "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
@@ -2591,6 +3662,20 @@
         "url": "https://github.com/fb55/nth-check?sponsor=1"
       }
     },
+    "node_modules/obug": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.3.tgz",
+      "integrity": "sha512-9miFgM2OFba7hB+pRgvtV84pYTBaoTHohvmIgiRt6dRIzbwEOIaNaP+dIlGs2fNFoB0SeISs0Jz5WFVRid6Xyg==",
+      "dev": true,
+      "funding": [
+        "https://github.com/sponsors/sxzz",
+        "https://opencollective.com/debug"
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
     "node_modules/optionator": {
       "version": "0.9.4",
       "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
@@ -2685,6 +3770,13 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "node_modules/pathe": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
+      "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/picocolors": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
@@ -2692,6 +3784,49 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/picomatch": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true,
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/postcss": {
+      "version": "8.5.16",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.16.tgz",
+      "integrity": "sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "nanoid": "^3.3.12",
+        "picocolors": "^1.1.1",
+        "source-map-js": "^1.2.1"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      }
+    },
     "node_modules/prelude-ls": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
@@ -2769,6 +3904,40 @@
         "node": ">=10"
       }
     },
+    "node_modules/rolldown": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.4.tgz",
+      "integrity": "sha512-IjZYiLxZwpnhwhdBH2ugdTGVSdhCQUmLxLoqyjiL0JxYjyRst+5a0P3xfrTxJ5F638j4Mvvw5FAX5XE6eHpXbA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@oxc-project/types": "=0.138.0",
+        "@rolldown/pluginutils": "^1.0.0"
+      },
+      "bin": {
+        "rolldown": "bin/cli.mjs"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "optionalDependencies": {
+        "@rolldown/binding-android-arm64": "1.1.4",
+        "@rolldown/binding-darwin-arm64": "1.1.4",
+        "@rolldown/binding-darwin-x64": "1.1.4",
+        "@rolldown/binding-freebsd-x64": "1.1.4",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.1.4",
+        "@rolldown/binding-linux-arm64-gnu": "1.1.4",
+        "@rolldown/binding-linux-arm64-musl": "1.1.4",
+        "@rolldown/binding-linux-ppc64-gnu": "1.1.4",
+        "@rolldown/binding-linux-s390x-gnu": "1.1.4",
+        "@rolldown/binding-linux-x64-gnu": "1.1.4",
+        "@rolldown/binding-linux-x64-musl": "1.1.4",
+        "@rolldown/binding-openharmony-arm64": "1.1.4",
+        "@rolldown/binding-wasm32-wasi": "1.1.4",
+        "@rolldown/binding-win32-arm64-msvc": "1.1.4",
+        "@rolldown/binding-win32-x64-msvc": "1.1.4"
+      }
+    },
     "node_modules/safe-buffer": {
       "version": "5.2.1",
       "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
@@ -2881,6 +4050,13 @@
         "node": ">=8"
       }
     },
+    "node_modules/siginfo": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
+      "integrity": "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==",
+      "dev": true,
+      "license": "ISC"
+    },
     "node_modules/signal-exit": {
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
@@ -2904,6 +4080,20 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/stackback": {
+      "version": "0.0.2",
+      "resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz",
+      "integrity": "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/std-env": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.1.0.tgz",
+      "integrity": "sha512-Rq7ybcX2RuC55r9oaPVEW7/xu3tj8u4GeBYHBWCychFtzMIr86A7e3PPEBPT37sHStKX3+TiX/Fr/ACmJLVlLQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/streamx": {
       "version": "2.25.0",
       "resolved": "https://registry.npmjs.org/streamx/-/streamx-2.25.0.tgz",
@@ -3030,6 +4220,19 @@
         "node": ">=8"
       }
     },
+    "node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/svgo": {
       "version": "4.0.1",
       "resolved": "https://registry.npmjs.org/svgo/-/svgo-4.0.1.tgz",
@@ -3089,6 +4292,50 @@
         "b4a": "^1.6.4"
       }
     },
+    "node_modules/tinybench": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
+      "integrity": "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tinyexec": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.2.4.tgz",
+      "integrity": "sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tinyglobby": {
+      "version": "0.2.17",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
+      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fdir": "^6.5.0",
+        "picomatch": "^4.0.4"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/SuperchupuDev"
+      }
+    },
+    "node_modules/tinyrainbow": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.1.0.tgz",
+      "integrity": "sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
     "node_modules/tslib": {
       "version": "2.8.1",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
@@ -3137,6 +4384,176 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/vite": {
+      "version": "8.1.2",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.1.2.tgz",
+      "integrity": "sha512-6YYPbRXTxx6bRXmOn7XdnQAy5DQNHhDgtjhDHI13oe4pY93kkcdGJWxpGwOm++/Wh0QpQhDrpIoVMrmrsI5AGQ==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "lightningcss": "^1.32.0",
+        "picomatch": "^4.0.4",
+        "postcss": "^8.5.16",
+        "rolldown": "~1.1.3",
+        "tinyglobby": "^0.2.17"
+      },
+      "bin": {
+        "vite": "bin/vite.js"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "funding": {
+        "url": "https://github.com/vitejs/vite?sponsor=1"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      },
+      "peerDependencies": {
+        "@types/node": "^20.19.0 || >=22.12.0",
+        "@vitejs/devtools": "^0.3.0",
+        "esbuild": "^0.27.0 || ^0.28.0",
+        "jiti": ">=1.21.0",
+        "less": "^4.0.0",
+        "sass": "^1.70.0",
+        "sass-embedded": "^1.70.0",
+        "stylus": ">=0.54.8",
+        "sugarss": "^5.0.0",
+        "terser": "^5.16.0",
+        "tsx": "^4.8.1",
+        "yaml": "^2.4.2"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        },
+        "@vitejs/devtools": {
+          "optional": true
+        },
+        "esbuild": {
+          "optional": true
+        },
+        "jiti": {
+          "optional": true
+        },
+        "less": {
+          "optional": true
+        },
+        "sass": {
+          "optional": true
+        },
+        "sass-embedded": {
+          "optional": true
+        },
+        "stylus": {
+          "optional": true
+        },
+        "sugarss": {
+          "optional": true
+        },
+        "terser": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "yaml": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vitest": {
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.9.tgz",
+      "integrity": "sha512-nE3/LEyc0z87uHYLZebqCUOaJr2hdtuPp7BQ4BosVFnfltxgAvMG08NyrSGlPpOUWvR27c5flSmYFTNr78L9GQ==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "@vitest/expect": "4.1.9",
+        "@vitest/mocker": "4.1.9",
+        "@vitest/pretty-format": "4.1.9",
+        "@vitest/runner": "4.1.9",
+        "@vitest/snapshot": "4.1.9",
+        "@vitest/spy": "4.1.9",
+        "@vitest/utils": "4.1.9",
+        "es-module-lexer": "^2.0.0",
+        "expect-type": "^1.3.0",
+        "magic-string": "^0.30.21",
+        "obug": "^2.1.1",
+        "pathe": "^2.0.3",
+        "picomatch": "^4.0.3",
+        "std-env": "^4.0.0-rc.1",
+        "tinybench": "^2.9.0",
+        "tinyexec": "^1.0.2",
+        "tinyglobby": "^0.2.15",
+        "tinyrainbow": "^3.1.0",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0",
+        "why-is-node-running": "^2.3.0"
+      },
+      "bin": {
+        "vitest": "vitest.mjs"
+      },
+      "engines": {
+        "node": "^20.0.0 || ^22.0.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "@edge-runtime/vm": "*",
+        "@opentelemetry/api": "^1.9.0",
+        "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
+        "@vitest/browser-playwright": "4.1.9",
+        "@vitest/browser-preview": "4.1.9",
+        "@vitest/browser-webdriverio": "4.1.9",
+        "@vitest/coverage-istanbul": "4.1.9",
+        "@vitest/coverage-v8": "4.1.9",
+        "@vitest/ui": "4.1.9",
+        "happy-dom": "*",
+        "jsdom": "*",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@edge-runtime/vm": {
+          "optional": true
+        },
+        "@opentelemetry/api": {
+          "optional": true
+        },
+        "@types/node": {
+          "optional": true
+        },
+        "@vitest/browser-playwright": {
+          "optional": true
+        },
+        "@vitest/browser-preview": {
+          "optional": true
+        },
+        "@vitest/browser-webdriverio": {
+          "optional": true
+        },
+        "@vitest/coverage-istanbul": {
+          "optional": true
+        },
+        "@vitest/coverage-v8": {
+          "optional": true
+        },
+        "@vitest/ui": {
+          "optional": true
+        },
+        "happy-dom": {
+          "optional": true
+        },
+        "jsdom": {
+          "optional": true
+        },
+        "vite": {
+          "optional": false
+        }
+      }
+    },
     "node_modules/which": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
@@ -3153,6 +4570,23 @@
         "node": ">= 8"
       }
     },
+    "node_modules/why-is-node-running": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-2.3.0.tgz",
+      "integrity": "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "siginfo": "^2.0.0",
+        "stackback": "0.0.2"
+      },
+      "bin": {
+        "why-is-node-running": "cli.js"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/word-wrap": {
       "version": "1.2.5",
       "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",
diff --git a/package.json b/package.json
index 7fbd047..e8b10a7 100644
--- a/package.json
+++ b/package.json
@@ -8,15 +8,18 @@
     "build:extension": "node scripts/build-extension.cjs",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
-    "test": "node scripts/verify-release.mjs",
+    "test": "npm run verify",
+    "test:unit": "vitest run",
     "verify": "node scripts/verify-release.mjs"
   },
   "devDependencies": {
+    "@vitest/coverage-v8": "^4.1.9",
     "archiver": "^7.0.1",
     "esbuild": "^0.28.1",
     "eslint": "^10.4.0",
     "fs-extra": "^11.2.0",
     "sharp": "^0.34.5",
-    "svgo": "^4.0.1"
+    "svgo": "^4.0.1",
+    "vitest": "^4.1.9"
   }
 }
diff --git a/scripts/test-rate-limiter.mjs b/scripts/test-rate-limiter.mjs
index 8cd4dd7..4ee5cb6 100644
--- a/scripts/test-rate-limiter.mjs
+++ b/scripts/test-rate-limiter.mjs
@@ -4,6 +4,7 @@ import {
     checkEventRate,
     checkHealthRate,
     checkAdminMetricsAuthRate,
+    checkLeaveRoomRate,
     checkAuthRate,
     recordAuthFailure,
     clearRateLimitMaps,
@@ -13,11 +14,13 @@ import {
     healthCounts,
     adminMetricsAuthCounts,
     roomListCooldowns,
+    leaveRoomCounts,
     rateLimitDenied,
     startRateLimitCleanup,
     stopRateLimitCleanup,
     CONNECTION_RATE_LIMIT,
-    EVENT_RATE_LIMIT
+    EVENT_RATE_LIMIT,
+    LEAVE_ROOM_RATE_LIMIT
 } from '../server/rate-limiter.js';
 
 // Helper: mock io for cleanup
@@ -26,7 +29,7 @@ const mockIo = { sockets: { sockets: new Map() } };
 // Reset state before each test group
 function reset() {
     clearRateLimitMaps();
-    Object.assign(rateLimitDenied, { connections: 0, events: 0, health: 0, adminMetricsAuth: 0, roomList: 0 });
+    Object.assign(rateLimitDenied, { connections: 0, events: 0, health: 0, adminMetricsAuth: 0, roomList: 0, leaveRoom: 0 });
     stopRateLimitCleanup();
 }
 
@@ -52,6 +55,16 @@ assert.equal(rateLimitDenied.events, 1);
 reset();
 assert.equal(checkEventRate('sock2'), true, 'separate socket independent');
 
+// --- checkLeaveRoomRate ---
+reset();
+assert.equal(checkLeaveRoomRate('sock-leave-1'), true, 'first leave-room event allowed');
+for (let i = 0; i < LEAVE_ROOM_RATE_LIMIT - 1; i++) checkLeaveRoomRate('sock-leave-1');
+assert.equal(checkLeaveRoomRate('sock-leave-1'), false, `leave-room beyond ${LEAVE_ROOM_RATE_LIMIT}/window blocked`);
+assert.equal(rateLimitDenied.leaveRoom, 1);
+
+reset();
+assert.equal(checkLeaveRoomRate('sock-leave-2'), true, 'separate leave-room socket independent');
+
 // --- checkHealthRate ---
 reset();
 assert.equal(checkHealthRate('1.2.3.4'), true, 'first health check allowed');
@@ -91,12 +104,14 @@ eventCounts.set('sock1', { count: 1, resetTime: Date.now() + 10000 });
 healthCounts.set('ip2', { count: 1, resetTime: Date.now() + 60000 });
 adminMetricsAuthCounts.set('ip3', { count: 1, resetTime: Date.now() + 60000 });
 roomListCooldowns.set('sock2', Date.now());
+leaveRoomCounts.set('sock3', { count: 1, resetTime: Date.now() + 60000 });
 clearRateLimitMaps();
 assert.equal(connectionCounts.size, 0, 'connectionCounts cleared');
 assert.equal(eventCounts.size, 0, 'eventCounts cleared');
 assert.equal(healthCounts.size, 0, 'healthCounts cleared');
 assert.equal(adminMetricsAuthCounts.size, 0, 'adminMetricsAuthCounts cleared');
 assert.equal(roomListCooldowns.size, 0, 'roomListCooldowns cleared');
+assert.equal(leaveRoomCounts.size, 0, 'leaveRoomCounts cleared');
 
 // --- startRateLimitCleanup / stopRateLimitCleanup ---
 reset();
@@ -108,7 +123,9 @@ assert.ok(true, 'cleanup start/stop does not throw');
 // --- rateLimitDenied reset ---
 reset();
 rateLimitDenied.connections = 5;
-Object.assign(rateLimitDenied, { connections: 0, events: 0, health: 0, adminMetricsAuth: 0, roomList: 0 });
+rateLimitDenied.leaveRoom = 5;
+Object.assign(rateLimitDenied, { connections: 0, events: 0, health: 0, adminMetricsAuth: 0, roomList: 0, leaveRoom: 0 });
 assert.equal(rateLimitDenied.connections, 0, 'denial counter resettable');
+assert.equal(rateLimitDenied.leaveRoom, 0, 'leave-room denial counter resettable');
 
 console.log('rate-limiter tests passed');
diff --git a/scripts/test-server-ops.mjs b/scripts/test-server-ops.mjs
index 5506344..65cec5b 100644
--- a/scripts/test-server-ops.mjs
+++ b/scripts/test-server-ops.mjs
@@ -52,7 +52,7 @@ const basicHealth = buildHealthPayload({
   now: 1234,
   uptime: 99,
   memoryUsage: () => ({ rss: 10, heapUsed: 5, heapTotal: 8 }),
-  rateLimitSizes: { connections: 1, events: 2, health: 3, adminMetricsAuth: 4, authFailures: 5, roomList: 6 }
+  rateLimitSizes: { connections: 1, events: 2, health: 3, adminMetricsAuth: 4, authFailures: 5, roomList: 6, leaveRoom: 7 }
 });
 
 assert.deepEqual(
@@ -68,7 +68,8 @@ const adminHealth = buildHealthPayload({
   now: 1234,
   uptime: 99,
   memoryUsage: () => ({ rss: 10, heapUsed: 5, heapTotal: 8 }),
-  rateLimitSizes: { connections: 1, events: 2, health: 3, adminMetricsAuth: 4, authFailures: 5, roomList: 6 }
+  rateLimitSizes: { connections: 1, events: 2, health: 3, adminMetricsAuth: 4, authFailures: 5, roomList: 6, leaveRoom: 7 },
+  rateLimitDenied: { leaveRoom: 8 }
 });
 
 assert.equal(adminHealth.peers, 5, 'admin metrics should include aggregate peer count');
@@ -79,8 +80,8 @@ assert.deepEqual(adminHealth.memory, { rss: 10, heapUsed: 5, heapTotal: 8 }, 'ad
 assert.deepEqual(
   adminHealth.rateLimits,
   {
-    trackedClients: { connections: 1, events: 2, health: 3, adminMetricsAuth: 4, authFailures: 5, roomList: 6 },
-    denied: { connections: 0, events: 0, health: 0, adminMetricsAuth: 0, roomList: 0 }
+    trackedClients: { connections: 1, events: 2, health: 3, adminMetricsAuth: 4, authFailures: 5, roomList: 6, leaveRoom: 7 },
+    denied: { connections: 0, events: 0, health: 0, adminMetricsAuth: 0, roomList: 0, leaveRoom: 8 }
   },
   'admin metrics should expose rate-limit tracking and denial counts'
 );
diff --git a/scripts/verify-release.mjs b/scripts/verify-release.mjs
index ea7b45e..b8545c2 100644
--- a/scripts/verify-release.mjs
+++ b/scripts/verify-release.mjs
@@ -7,6 +7,7 @@ import path from 'node:path';
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
 const checks = [
+  ['vitest unit tests', 'npm', ['run', 'test:unit']],
   ['server ops', 'node', ['scripts/test-server-ops.mjs']],
   ['server routes', 'node', ['scripts/test-server-routes.mjs'], {
     env: { ADMIN_METRICS_TOKEN: 'verify-admin-token-with-more-than-32-chars' }
diff --git a/server/index.js b/server/index.js
index 3a117f8..175369c 100644
--- a/server/index.js
+++ b/server/index.js
@@ -22,6 +22,7 @@ import {
     healthCounts,
     adminMetricsAuthCounts,
     roomListCooldowns,
+    leaveRoomCounts,
     rateLimitDenied,
     checkAuthRate,
     recordAuthFailure,
@@ -29,6 +30,7 @@ import {
     checkEventRate,
     checkHealthRate,
     checkAdminMetricsAuthRate,
+    checkLeaveRoomRate,
     startRateLimitCleanup,
     stopRateLimitCleanup,
     clearRateLimitMaps
@@ -114,7 +116,8 @@ app.get('/health', (req, res) => {
                 health: healthCounts.size,
                 adminMetricsAuth: adminMetricsAuthCounts.size,
                 authFailures: failedAuthAttempts.size,
-                roomList: roomListCooldowns.size
+                roomList: roomListCooldowns.size,
+                leaveRoom: leaveRoomCounts.size
             },
             rateLimitDenied
         })
@@ -661,6 +664,11 @@ io.on('connection', (socket) => {
     });
 
     socket.on(EVENTS.LEAVE_ROOM, () => {
+        if (!checkLeaveRoomRate(socket.id)) {
+            log('SECURITY', `LEAVE_ROOM rate limit exceeded for socket: ${socket.id}`);
+            socket.disconnect(true);
+            return;
+        }
         try {
             const mapping = socketToRoom.get(socket.id);
             if (mapping) {
@@ -839,6 +847,7 @@ io.on('connection', (socket) => {
     socket.on('disconnect', () => {
         eventCounts.delete(socket.id);
         roomListCooldowns.delete(socket.id);
+        leaveRoomCounts.delete(socket.id);
         const mapping = socketToRoom.get(socket.id);
         if (mapping) {
             try {
@@ -919,12 +928,14 @@ function gracefulShutdown(signal) {
     log('SERVER', `${signal} received — starting graceful shutdown...`);
     // 1. Notify all connected clients so they can display a meaningful message
     io.emit(EVENTS.ERROR, { message: 'Server is restarting. Reconnecting automatically...' });
-    // 2. Stop accepting new HTTP connections
+    // 2. Gracefully disconnect all Socket.IO clients
+    io.disconnectSockets(true);
+    // 3. Stop accepting new HTTP connections
     httpServer.close(() => {
         log('SERVER', 'HTTP server closed. Exiting.');
         process.exit(0);
     });
-    // 3. Safety net: force-exit after 5s if connections don't drain
+    // 4. Safety net: force-exit after 5s if connections don't drain
     setTimeout(() => {
         log('SERVER', 'Force-exit after timeout.');
         process.exit(1);
@@ -943,7 +954,7 @@ export async function stopServerForTests() {
     healthResponseCache.clear();
     io.removeAllListeners();
     io.disconnectSockets(true);
-    Object.assign(rateLimitDenied, { connections: 0, events: 0, health: 0, adminMetricsAuth: 0, roomList: 0 });
+    Object.assign(rateLimitDenied, { connections: 0, events: 0, health: 0, adminMetricsAuth: 0, roomList: 0, leaveRoom: 0 });
     if (!httpServer.listening) return;
     await new Promise((resolve, reject) => {
         httpServer.close((err) => err ? reject(err) : resolve());
diff --git a/server/ops.js b/server/ops.js
index de79c6e..7ac9c22 100644
--- a/server/ops.js
+++ b/server/ops.js
@@ -97,14 +97,16 @@ export function buildHealthPayload({
                 health: rateLimitSizes.health || 0,
                 adminMetricsAuth: rateLimitSizes.adminMetricsAuth || 0,
                 authFailures: rateLimitSizes.authFailures || 0,
-                roomList: rateLimitSizes.roomList || 0
+                roomList: rateLimitSizes.roomList || 0,
+                leaveRoom: rateLimitSizes.leaveRoom || 0
             },
             denied: {
                 connections: rateLimitDenied.connections || 0,
                 events: rateLimitDenied.events || 0,
                 health: rateLimitDenied.health || 0,
                 adminMetricsAuth: rateLimitDenied.adminMetricsAuth || 0,
-                roomList: rateLimitDenied.roomList || 0
+                roomList: rateLimitDenied.roomList || 0,
+                leaveRoom: rateLimitDenied.leaveRoom || 0
             }
         },
         memory: {
diff --git a/server/rate-limiter.js b/server/rate-limiter.js
index 69bcf83..aec4171 100644
--- a/server/rate-limiter.js
+++ b/server/rate-limiter.js
@@ -14,6 +14,8 @@ export const EVENT_RATE_LIMIT = 50;                // max relayed events per soc
 export const EVENT_RATE_WINDOW_MS = 10000;         // 10 seconds
 export const HEALTH_RATE_WINDOW_MS = 60000;        // 1 minute
 export const ADMIN_METRICS_AUTH_WINDOW_MS = 60000; // 1 minute
+export const LEAVE_ROOM_RATE_LIMIT = 10;           // max LEAVE_ROOM events per socket per window
+export const LEAVE_ROOM_RATE_WINDOW_MS = 60000;    // 1 minute
 
 export const connectionCounts = new Map(); // ip -> { count, resetTime }
 export const failedAuthAttempts = new Map(); // Map<IP+RoomID, {count, lastAttempt}>
@@ -21,13 +23,15 @@ export const eventCounts = new Map(); // socketId -> { count, resetTime }
 export const healthCounts = new Map(); // ip -> { count, resetTime }
 export const adminMetricsAuthCounts = new Map(); // ip -> { count, resetTime }
 export const roomListCooldowns = new Map(); // socketId -> last allowed timestamp
+export const leaveRoomCounts = new Map();    // socketId -> { count, resetTime }
 
 export const rateLimitDenied = {
     connections: 0,
     events: 0,
     health: 0,
     adminMetricsAuth: 0,
-    roomList: 0
+    roomList: 0,
+    leaveRoom: 0
 };
 
 let authCleanupId = null;
@@ -122,6 +126,20 @@ export function checkAdminMetricsAuthRate(ip) {
     return false;
 }
 
+export function checkLeaveRoomRate(socketId) {
+    const now = Date.now();
+    const entry = leaveRoomCounts.get(socketId) || { count: 0, resetTime: now + LEAVE_ROOM_RATE_WINDOW_MS };
+    if (now > entry.resetTime) {
+        entry.count = 0;
+        entry.resetTime = now + LEAVE_ROOM_RATE_WINDOW_MS;
+    }
+    entry.count++;
+    leaveRoomCounts.set(socketId, entry);
+    if (entry.count <= LEAVE_ROOM_RATE_LIMIT) return true;
+    rateLimitDenied.leaveRoom++;
+    return false;
+}
+
 export function startRateLimitCleanup(io) {
     if (authCleanupId !== null || rateLimitCleanupId !== null) return; // guard double-start
     // Clean up old auth failure records (every 15 minutes)
@@ -145,6 +163,11 @@ export function startRateLimitCleanup(io) {
                 eventCounts.delete(socketId);
             }
         }
+        for (const [socketId, entry] of leaveRoomCounts.entries()) {
+            if (now > entry.resetTime || !io.sockets.sockets.has(socketId)) {
+                leaveRoomCounts.delete(socketId);
+            }
+        }
         for (const [ip, entry] of healthCounts.entries()) {
             if (now > entry.resetTime) healthCounts.delete(ip);
         }
@@ -166,7 +189,9 @@ export function clearRateLimitMaps() {
     connectionCounts.clear();
     failedAuthAttempts.clear();
     eventCounts.clear();
+
     healthCounts.clear();
     adminMetricsAuthCounts.clear();
     roomListCooldowns.clear();
+    leaveRoomCounts.clear();
 }
diff --git a/server/rate-limiter.test.mjs b/server/rate-limiter.test.mjs
new file mode 100644
index 0000000..9a3bb2c
--- /dev/null
+++ b/server/rate-limiter.test.mjs
@@ -0,0 +1,107 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import {
+    checkLeaveRoomRate,
+    LEAVE_ROOM_RATE_LIMIT,
+    LEAVE_ROOM_RATE_WINDOW_MS,
+    rateLimitDenied,
+    leaveRoomCounts,
+    clearRateLimitMaps
+} from './rate-limiter.js';
+
+describe('LEAVE_ROOM Rate Limiter', () => {
+    const testSocketId = 'test-socket-123';
+
+    beforeEach(() => {
+        clearRateLimitMaps();
+        rateLimitDenied.leaveRoom = 0;
+    });
+
+    afterEach(() => {
+        clearRateLimitMaps();
+    });
+
+    it('should allow LEAVE_ROOM within limit', () => {
+        // Test within the rate limit
+        for (let i = 0; i < LEAVE_ROOM_RATE_LIMIT; i++) {
+            const result = checkLeaveRoomRate(testSocketId);
+            expect(result).toBe(true);
+        }
+        expect(rateLimitDenied.leaveRoom).toBe(0);
+    });
+
+    it('should block LEAVE_ROOM when exceeding limit', () => {
+        // Fill up to the limit
+        for (let i = 0; i < LEAVE_ROOM_RATE_LIMIT; i++) {
+            checkLeaveRoomRate(testSocketId);
+        }
+
+        // Next request should be blocked
+        const result = checkLeaveRoomRate(testSocketId);
+        expect(result).toBe(false);
+        expect(rateLimitDenied.leaveRoom).toBe(1);
+    });
+
+    it('should reset count after window expires', () => {
+        // Fill up to the limit
+        for (let i = 0; i < LEAVE_ROOM_RATE_LIMIT; i++) {
+            checkLeaveRoomRate(testSocketId);
+        }
+
+        // Verify we're at the limit
+        let result = checkLeaveRoomRate(testSocketId);
+        expect(result).toBe(false);
+
+        // Fast-forward time beyond the rate limit window
+        const entry = leaveRoomCounts.get(testSocketId);
+        entry.resetTime = Date.now() - LEAVE_ROOM_RATE_WINDOW_MS - 1000;
+        leaveRoomCounts.set(testSocketId, entry);
+
+        // Next request should be allowed again
+        result = checkLeaveRoomRate(testSocketId);
+        expect(result).toBe(true);
+    });
+
+    it('should handle multiple sockets independently', () => {
+        const socketId2 = 'test-socket-456';
+
+        // Fill up first socket
+        for (let i = 0; i < LEAVE_ROOM_RATE_LIMIT; i++) {
+            checkLeaveRoomRate(testSocketId);
+        }
+
+        // Second socket should still be allowed
+        const result = checkLeaveRoomRate(socketId2);
+        expect(result).toBe(true);
+
+        // First socket should be blocked
+        const result2 = checkLeaveRoomRate(testSocketId);
+        expect(result2).toBe(false);
+    });
+
+    it('should increment rateLimitDenied counter on block', () => {
+        for (let i = 0; i < LEAVE_ROOM_RATE_LIMIT; i++) {
+            checkLeaveRoomRate(testSocketId);
+        }
+
+        checkLeaveRoomRate(testSocketId);
+        expect(rateLimitDenied.leaveRoom).toBe(1);
+
+        checkLeaveRoomRate(testSocketId);
+        expect(rateLimitDenied.leaveRoom).toBe(2);
+    });
+
+    it('should be cleared by the shared reset helper', () => {
+        checkLeaveRoomRate(testSocketId);
+        expect(leaveRoomCounts.size).toBe(1);
+
+        clearRateLimitMaps();
+        expect(leaveRoomCounts.size).toBe(0);
+    });
+});
+
+describe('Rate Limit Constants', () => {
+    it('should have correct rate limit values', () => {
+        expect(LEAVE_ROOM_RATE_LIMIT).toBe(10);
+        expect(LEAVE_ROOM_RATE_WINDOW_MS).toBe(60000); // 1 minute
+    });
+});
diff --git a/vitest.config.mjs b/vitest.config.mjs
new file mode 100644
index 0000000..e323a49
--- /dev/null
+++ b/vitest.config.mjs
@@ -0,0 +1,24 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+    test: {
+        globals: false,
+        environment: 'node',
+        include: [
+            'server/**/*.test.js',
+            'server/**/*.test.mjs',
+            'shared/**/*.test.js',
+            'shared/**/*.test.mjs'
+        ],
+        coverage: {
+            provider: 'v8',
+            reporter: ['text', 'lcov'],
+            include: ['server/**/*.js', 'shared/**/*.js'],
+            exclude: [
+                '**/node_modules/**',
+                '**/scripts/**',
+                '**/extension/**'
+            ]
+        }
+    }
+});