docs: add devops.md detailing release workflow

Merge pull request #15 from Shik3i/codex/issue-13-title-privacy
feat(extension): add title privacy controls and settings
2026-07-26 12:08:15 +00:00 · 2026-07-01 19:47:31 +02:00 · 2026-07-01 19:43:46 +02:00 · 2026-07-01 19:40:57 +02:00 · 2026-07-01 19:26:25 +02:00 · 2026-07-01 19:21:38 +02:00
225 changed files with 10558 additions and 19438 deletions
@@ -37,7 +37,7 @@ Closes #
 - [ ] I have performed a self-review of my code
 - [ ] I have added/updated tests if needed
 - [ ] I have updated documentation if needed (`docs/`, README, etc.)
- [ ] Protocol changes: I ran `node scripts/build-extension.js` and updated relevant docs
+- [ ] Protocol changes: I ran `node scripts/build-extension.cjs` and updated relevant docs
 - [ ] No new warnings, secrets, or hardcoded credentials introduced

 ### Additional Context
@@ -0,0 +1,75 @@
+name: Beta Server Image
+
+# Publishes the relay server as a Docker image under NON-production tags so a
+# feature branch can be deployed to a staging/backup server and used as a custom
+# server, without ever touching the ':latest' tag the official relay tracks.
+#
+# Tags produced (on ghcr.io/<owner>/<repo>):
+#   - beta                         moving channel pointer to the newest build
+#   - <branch-slug>                e.g. feature-host-control-mode
+#   - sha-<short-commit>           immutable, pin to an exact build
+#   - <custom>                     only on manual run, e.g. hostcontrol01
+# Never ':latest' (flavor: latest=false).
+#
+# Remove this workflow once the feature is merged & released the normal way.
+
+on:
+  push:
+    branches:
+      - feature/host-control-mode
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Extra immutable tag for this build (e.g. hostcontrol01). Optional.'
+        required: false
+        default: ''
+
+concurrency:
+  group: beta-image-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-beta-image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ghcr.io/${{ github.repository }}
+          # Never publish ':latest' from a beta build.
+          flavor: |
+            latest=false
+          tags: |
+            type=raw,value=beta
+            type=ref,event=branch
+            type=sha,prefix=sha-
+            type=raw,value=${{ github.event.inputs.tag }},enable=${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag != '' }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: server/Dockerfile
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
@@ -0,0 +1,46 @@
+name: CI
+
+# Runs the full verification suite (lint, unit/integration tests, production
+# audits, extension + website build) on every push to main and every PR, so a
+# regression can never reach main or a release tag unchecked.
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+# Cancel superseded runs on the same ref to save CI minutes. Unlike the release
+# workflow, an interrupted CI run has no side effects.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          cache: 'npm'
+          cache-dependency-path: |
+            package-lock.json
+            server/package-lock.json
+
+      - name: Install root dependencies
+        run: npm ci
+
+      # The server test suite (test-server-ws/routes/ops) imports express,
+      # socket.io, and dotenv from server/node_modules, so install them too.
+      - name: Install server dependencies
+        run: npm ci
+        working-directory: server
+
+      - name: Run verification suite
+        run: npm run verify
@@ -5,21 +5,29 @@ on:
    tags:
      - 'v*'

+# A release run must never be interrupted (it commits back to main and publishes
+# artifacts). Only dedupe accidental re-pushes of the same tag.
+concurrency:
+  group: release-${{ github.ref_name }}
+  cancel-in-progress: false
+
 jobs:
  release-server:
    runs-on: ubuntu-latest
    permissions:
-      contents: write
+      contents: read
      packages: write
+      id-token: write
+      attestations: write
    steps:
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -27,7 +35,7 @@ jobs:

      - name: Extract Docker metadata
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
@@ -35,7 +43,8 @@ jobs:
            type=ref,event=tag

      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        id: build
+        uses: docker/build-push-action@v7
        with:
          context: .
          file: server/Dockerfile
@@ -43,14 +52,32 @@ jobs:
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
+          # Reuse layers across releases to speed up the multi-arch build.
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Generate artifact attestation
+        uses: actions/attest@v4
+        with:
+          subject-name: ghcr.io/${{ github.repository }}
+          subject-digest: ${{ steps.build.outputs.digest }}
+          push-to-registry: true

  release-extension:
    runs-on: ubuntu-latest
    permissions:
      contents: write
+      id-token: write
+      attestations: write
    steps:
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          cache: 'npm'

      - name: Extract version from tag
        id: version
@@ -67,7 +94,7 @@ jobs:
          echo "  ✓ manifest.base.json -> $VERSION"

          # 2. shared/constants.js — APP_VERSION
-          sed -i "s/export const APP_VERSION = '.*'/export const APP_VERSION = '$VERSION'/" shared/constants.js
+          sed -i "s/export const APP_VERSION = [\"'].*[\"']/export const APP_VERSION = \"$VERSION\"/" shared/constants.js
          echo "  ✓ shared/constants.js -> $VERSION"

          # 3. package.json
@@ -78,13 +105,26 @@ jobs:
          jq -n --arg v "$VERSION" --arg d "$DATE" '{version: $v, date: $d}' > website/version.json
          echo "  ✓ website/version.json -> version $VERSION, date $DATE"

+          # 5. website/template.html — SoftwareApplication schema
+          sed -i "s/\"softwareVersion\": \".*\"/\"softwareVersion\": \"$VERSION\"/" website/template.html
+          echo "  ✓ website/template.html -> softwareVersion $VERSION"
+
+          # 6. README.md — version badge & banner
+          sed -i "s|Release-v[0-9]\+\.[0-9]\+\.[0-9]\+-blue|Release-v$VERSION-blue|g" README.md
+          sed -i "s/New v[0-9]\+\.[0-9]\+\.[0-9]\+ Release/New v$VERSION Release/g" README.md
+          echo "  ✓ README.md -> v$VERSION"
+
+          # 7. website/sitemap.xml — lastmod dates
+          sed -i "s/<lastmod>[0-9-]*<\/lastmod>/<lastmod>$(date +%Y-%m-%d)<\/lastmod>/g" website/sitemap.xml
+          echo "  ✓ website/sitemap.xml -> lastmod $(date +%Y-%m-%d)"
+
          echo "Version injection complete."

      - name: Commit and push version updates back to main
        run: |
          git config --local user.email "action@github.com"
          git config --local user.name "GitHub Action"
-          git add extension/manifest.base.json shared/constants.js package.json website/version.json
+          git add extension/manifest.base.json shared/constants.js package.json website/version.json website/template.html README.md website/sitemap.xml
          git commit -m "chore(release): update versions to $GITHUB_REF_NAME [skip ci]" || echo "No changes to commit"
          git push origin HEAD:main
        env:
@@ -92,11 +132,26 @@ jobs:

      - name: Build Extensions
        run: |
-          npm install
+          npm ci
          npm run build:extension

+      - name: Generate artifact attestation for extensions
+        uses: actions/attest@v4
+        with:
+          subject-path: dist/koalasync-*.zip
+
+      - name: Build Website
+        run: node website/build.cjs
+
+      - name: Upload Website Artifacts
+        uses: actions/upload-artifact@v7
+        with:
+          name: website-www
+          path: website/www/
+          if-no-files-found: error
+
      - name: Create GitHub Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v3
        with:
          files: |
            dist/koalasync-chrome.zip
@@ -27,6 +27,7 @@ Thumbs.db
 # IDEs
 .vscode/
 .idea/
+.claude/
 *.swp
 *.swo

@@ -40,5 +41,8 @@ coverage/
 # the root 'shared/' remains the Single Source of Truth.
 extension/shared/

+# Auto-generated website build output
+website/www/
+
 # Temporary scratch files
 scratch/
@@ -12,7 +12,7 @@ Please note that by participating in this project, you agree to abide by our [Co
 |------|-------------|
 | **Bug Reports** | Found a bug? Open an issue with repro steps (see template below). |
 | **Code** | Fix bugs, add features, or improve the extension / server / website. |
-| **Translations** | Help localize the extension and website into more languages. See [TRANSLATION.md](website/TRANSLATION.md). |
+| **Translations** | Help localize the extension and website into more languages. See [TRANSLATION.md](docs/TRANSLATION.md). |
 | **Documentation** | Improve docs, fix typos, or add missing examples. |
 | **Security** | Found a vulnerability? See [SECURITY.md](SECURITY.md) — do NOT open a public issue. |

@@ -31,7 +31,7 @@ Please note that by participating in this project, you agree to abide by our [Co
 git clone https://github.com/Shik3i/KoalaSync.git
 cd KoalaSync
 npm install
-node scripts/build-extension.js
+node scripts/build-extension.cjs
 ```

 ---
@@ -62,7 +62,7 @@ node scripts/build-extension.js
 ### Website

 ```bash
-node website/build.js           # Compile static site → www/
+node website/build.cjs           # Compile static site → www/
 python3 -m http.server 8080 -d website/www  # Serve locally
 ```

@@ -77,7 +77,7 @@ KoalaSync uses a **single source of truth** for all protocol constants in `share
 > [!IMPORTANT]
 > After modifying `shared/constants.js`, you **must** run the build script to sync changes to the extension:
 > ```bash
-> node scripts/build-extension.js
+> node scripts/build-extension.cjs
 > ```
 > This automatically injects constants into `content.js` and regenerates browser bundles in `dist/`.

@@ -100,15 +100,23 @@ KoalaSync uses a **single source of truth** for all protocol constants in `share

 ---

-## Pull Request Process
+## Open Source Workflow & Pull Requests

-1. **Branch** from `main` for your feature or fix.
-2. **Test locally** on both Chrome and Firefox.
-3. **Website changes**: Run `node website/build.js` and verify the compiled output in `www/`.
-4. **Lint**: Ensure `npm run lint` passes with zero errors and zero warnings.
-5. **Syntax**: Run `node -c` on every modified `.js` file.
-6. **Protocol changes**: Update relevant documentation in `docs/`.
-7. **Submit your PR** with a clear description and linked issue (if applicable).
+If you are new to open-source contributions, follow these steps to propose your changes:
+
+1. **Fork the Repository**: Click the "Fork" button at the top right of this repository to create your own copy of KoalaSync.
+2. **Clone your Fork**: `git clone https://github.com/YOUR-USERNAME/KoalaSync.git`
+3. **Create a Branch**: `git checkout -b my-new-feature` (e.g. `feature/dark-mode` or `fix/translation-de`)
+4. **Make your Changes**: Edit the files, then verify them locally.
+   - *Extension/Server changes*: Test on Chrome/Firefox and check `npm run lint`.
+   - *Website/Translation changes*: Run `node website/build.cjs` and check the output in `www/`.
+5. **Commit and Push**: `git commit -m "Add my feature"` and `git push origin my-new-feature`
+6. **Open a Pull Request (PR)**: Go to the original KoalaSync repository on GitHub and click "New Pull Request".
+
+### PR Code Requirements
+- **Lint**: Ensure `npm run lint` passes with zero errors and warnings.
+- **Syntax**: Run `node -c` on every modified `.js` file.
+- **Protocol changes**: Update relevant documentation in `docs/`.

 ---

@@ -140,14 +148,18 @@ If you cannot access the Status tab, include as much of the following manually:

 ---

-## Translation Contributions
+## Translation Contributions (Translators Welcome!)

-KoalaSync supports 6 languages: English, German, French, Spanish, Portuguese (Brazilian), and Russian.
+We welcome native speakers to help translate KoalaSync! You **do not** need deep programming knowledge to contribute translations.

-To add or improve translations:
-1. Edit the locale files in `website/locales/` (for the website).
-2. For extension translations, see [TRANSLATION.md](website/TRANSLATION.md).
-3. Run `node website/build.js` to regenerate the static site.
+KoalaSync supports multiple languages. To add or improve translations:
+1. Read the **[Translation Guide](docs/TRANSLATION.md)** first. It explains how our localization system works.
+2. Edit the `.json` files in `website/locales/` (for the website) and `extension/locales/` (for the extension).
+3. Test your translations locally by running:
+   - `node scripts/test-locales.cjs` (for extension)
+   - `node scripts/test-website-locales.mjs` (for website)
+   - `node website/build.cjs` (to build the site)
+4. Follow the **Open Source Workflow** above (Fork -> Branch -> Edit -> PR) to submit your translations.

 ---

@@ -6,15 +6,15 @@

 <p align="center">
  <a href="https://github.com/Shik3i/KoalaSync/actions/workflows/release.yml"><img src="https://github.com/Shik3i/KoalaSync/actions/workflows/release.yml/badge.svg" alt="Release Status"></a>
-  <a href="https://github.com/Shik3i/KoalaSync/releases"><img src="https://img.shields.io/github/v/release/Shik3i/KoalaSync" alt="GitHub release"></a>
-  <a href="LICENSE"><img src="https://img.shields.io/github/license/Shik3i/KoalaSync?color=blue" alt="License"></a>
+  <a href="https://github.com/Shik3i/KoalaSync/releases"><img src="https://img.shields.io/badge/Release-v2.5.0-blue?logo=github" alt="GitHub release"></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-blue" alt="License"></a>
  <a href="https://addons.mozilla.org/de/firefox/addon/koalasync/"><img src="https://img.shields.io/badge/Firefox-Download-orange?logo=firefoxbrowser&logoColor=white" alt="Firefox Add-on"></a>
  <a href="https://chromewebstore.google.com/detail/koalasync/obbnmkmlaaddodakcbdljknjpagklifc"><img src="https://img.shields.io/badge/Chrome-Download-blue?logo=googlechrome&logoColor=white" alt="Chrome Extension"></a>
 </p>

 <p align="center"><i>KoalaSync is a lightweight Browser Extension and Relay Server for synchronized video playback on almost any website with a video element—YouTube, Twitch, Netflix, Emby, Jellyfin, and beyond. Built with a focus on <b>Data Sovereignty</b> and <b>Performance</b>.</i></p>

-<p align="center"><a href="docs/CHANGELOG.md"><b>New v2.2.0 Release!</b> — See what's changed</a></p>
+<p align="center"><a href="docs/CHANGELOG.md"><b>New v2.5.0 Release!</b> — See what's changed</a></p>

 ### 🌟 Why KoalaSync?

@@ -33,7 +33,7 @@
 - **Dual Heartbeat Architecture**: Robust session tracking that prevents ghost rooms and stale connections.
 - **Efficient Relay**: Minimal overhead WebSocket message forwarding.
 - **Seamless Invitations**: Smart links that automatically configure server and room credentials for your friends.
- **Audio Compressor**: Built-in Web Audio API dynamic range compression with presets (Recommended, Dynamic Range, Vocal Enhancement, Smooth) and fully customizable controls.
+- **Smart Audio Compressor**: Tired of constantly riding the volume? Automatically balance out whispering dialogue and deafening explosions with simple presets, or fully customize the audio to your liking.

 ---

@@ -54,6 +54,16 @@ The easiest and safest way to install KoalaSync is directly through the official
 2. **Invite Friends:** Share the auto-copied invite link. Once they click it, they automatically join.
 3. **Pick a Video:** Navigate to the Sync Tab, select the tab playing your video, and grab some popcorn! 🍿

+---
+
+### 🌐 Localization & Translations
+
+Both the official KoalaSync website and the **v2.0 Browser Extension** feature full dynamic localization:
+- **Available Languages**: Support is included for 15 languages: English (`en`), German (`de`), French (`fr`), Spanish (`es`), Portuguese (Brazil) (`pt-BR`), Russian (`ru`), Italian (`it`), Polish (`pl`), Turkish (`tr`), Dutch (`nl`), Japanese (`ja`), Korean (`ko`), Chinese (Simplified) (`zh`), Ukrainian (`uk`), and European Portuguese (`pt`).
+- **Real-Time Extension Localization**: Inside the extension Settings panel, users can swap languages instantly. The entire interface, notifications, Empty States, and onboarding guides re-translate dynamically in real-time.
+- **Contributing**: We welcome community translations for both the website and the extension! Please refer directly to the [TRANSLATION.md](docs/TRANSLATION.md) guide for step-by-step instructions on how to audit, refine, or add new languages.
+
+
 ---

 ### 🛠️ For Developers & Self-Hosters
@@ -71,7 +81,7 @@ The easiest and safest way to install KoalaSync is directly through the official
 To build the extension from source and synchronize protocol constants:
 ```bash
 npm install
-node scripts/build-extension.js
+npm run build:extension
 ```
 The compiled artifacts will be available in the `dist/` directory.

@@ -93,15 +103,21 @@ To connect your extension to a self-hosted server, open the popup → **Room** t

 To verify your relay is reachable from outside, visit `https://your-domain.com` in a browser — it should return `{"status":"online","service":"KoalaSync Relay"}`.

---
+#### Supply Chain Security (v2.2.2+)

-### 🌐 Localization & Translations
+All official release artifacts (Docker images and extension binaries) are published with signed [artifact attestations](https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations) to prove they were built from this repository's source code.

-Both the official KoalaSync website and the **v2.0 Browser Extension** feature full dynamic localization:
- **Available Languages**: Support is included for 13 languages: English (`en`), German (`de`), French (`fr`), Spanish (`es`), Portuguese (Brazil) (`pt-BR`), Russian (`ru`), Italian (`it`), Polish (`pl`), Turkish (`tr`), Dutch (`nl`), Japanese (`ja`), Korean (`ko`), and European Portuguese (`pt`).
- **Real-Time Extension Localization**: Inside the extension Settings panel, users can swap languages instantly. The entire interface, notifications, Empty States, and onboarding guides re-translate dynamically in real-time.
- **Contributing**: We welcome community translations for both the website and the extension! Please refer directly to the [TRANSLATION.md](website/TRANSLATION.md) guide for step-by-step instructions on how to audit, refine, or add new languages.
+**Verify a Docker image:**
+```bash
+gh attestation verify oci://ghcr.io/shik3i/koalasync:latest \
+  -R Shik3i/KoalaSync
+```

+**Verify an extension binary:**
+```bash
+gh attestation verify dist/koalasync-chrome.zip \
+  -R Shik3i/KoalaSync
+```

 ---

@@ -109,19 +125,21 @@ Both the official KoalaSync website and the **v2.0 Browser Extension** feature f

 - **[CHANGELOG.md](docs/CHANGELOG.md)**: Full version history for the extension and relay server.
 - **[TESTED_SERVICES.md](docs/TESTED_SERVICES.md)**: Detailed compatibility matrix of tested streaming platforms and known limitations.
- **[TRANSLATION.md](website/TRANSLATION.md)**: Translation and localization guide for contributors.
+- **[TRANSLATION.md](docs/TRANSLATION.md)**: Translation and localization guide for contributors.
 - **[PRIVACY.md](docs/PRIVACY.md)**: Data Handling and Privacy Policy.
 - **[CONTRIBUTING.md](CONTRIBUTING.md)**: How to help make KoalaSync better.
 - **[CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)**: Our community standards and expectations.
 - **[HOW_IT_WORKS.md](docs/HOW_IT_WORKS.md)**: Step-by-step walkthrough of the complete user flow.
 - **[ARCHITECTURE.md](docs/ARCHITECTURE.md)**: Deep-dive into the two-phase sync and heartbeat logic.
+- **[ROADMAP.md](docs/ROADMAP.md)**: Planned features, backlog, and rejected ideas.
 - **[SECURITY.md](SECURITY.md)**: Disclosure policy and security practices.
 - **[Caddyfile.example](examples/Caddyfile.example)**: Production Caddy configuration for website and relay.

 ---

 <div align="center">
-  <sub>Built with ❤️ by <a href="https://github.com/Shik3i">Shik3i</a>. KoalaSync is Open Source under the <a href="LICENSE">MIT License</a>.</sub>
-  <sub><a href="https://ko-fi.com/koaladev"><img src="https://img.shields.io/badge/Ko--Fi-Support-FF5E5B?logo=ko-fi&logoColor=white" alt="Ko-Fi"></a></sub>
+  <sub><a href="https://support.koalastuff.net"><img src="https://img.shields.io/badge/Support-KoalaSync-FF5E5B" alt="Support KoalaSync"></a></sub>
  <sub><a href="https://gitgem.org/github/Shik3i/KoalaSync"><img src="https://gitgem.org/api/badge/github/Shik3i/KoalaSync.svg" alt="GitGem Badge" /></a></sub>
+
+  <sub>Built with ❤️ by <a href="https://github.com/Shik3i">Shik3i</a>. KoalaSync is Open Source under the <a href="LICENSE">MIT License</a>.</sub>
 </div>
@@ -82,6 +82,12 @@ KoalaSync's security is grounded in its architecture:

 If you find a way to bypass any of these protections, we want to know about it.

+> [!NOTE]
+> Some frequently-reported "issues" are **intentional and out of scope** for our
+> threat model (ephemeral, account-less rooms of invited participants) — e.g. an
+> unauthenticated `peerId` or non-constant-time room-password compare. Before
+> reporting, please read **[`docs/KNOWN_LIMITATIONS.md`](docs/KNOWN_LIMITATIONS.md)**.
+
 ---

 ## Responsible Disclosure
@@ -0,0 +1,66 @@
+# KoalaSync — Marketing Copy Kit
+
+Ready-to-paste copy for product listings, launch pages, directory submissions, and anywhere else you keep re-typing the same pitch. Three lengths, one consistent message. Pick the one that fits the field limit.
+
+---
+
+## 1. One-Sentence Pitch
+
+> KoalaSync is a privacy-first browser extension that synchronizes video playback across almost any website so you can watch with friends in real time — no accounts, no tracking, and your video never passes through anyone's server but the original site's.
+
+**Shorter alternative** (for tight tagline fields):
+
+> Private, universal watch parties on any website — no accounts, no tracking, no media proxying.
+
+---
+
+## 2. Three-Sentence Overview
+
+> KoalaSync is a lightweight browser extension that keeps you and your friends perfectly in sync on YouTube, Netflix, Twitch, Prime Video, Jellyfin, Emby, and almost any other site with an HTML5 video player — press play once and everyone stays together. It's built privacy-first: no accounts, no telemetry, and the official relay server runs entirely in volatile RAM with zero persistence, so nothing about your sessions is ever stored. Open source under the MIT license and fully self-hostable with a single Docker command, KoalaSync is a transparent watch-party tool that works everywhere and respects your data sovereignty.
+
+---
+
+## 3. Full Description
+
+### Watch together — on any site, on your terms.
+
+Counting down "3, 2, 1, play" over voice chat doesn't scale past two people. KoalaSync fixes that with a tiny browser extension that synchronizes play, pause, and seeking across everyone in the room, on almost any website with a `<video>` element. Create a room, share a link, press play — that's it.
+
+### What makes KoalaSync different
+
+Most watch-party tools fall into one of two traps: they only work on a short allowlist of sites (site-specific extensions that need a separate build for every platform), or they route your video through their own player and servers. KoalaSync was built around three principles that break that mold.
+
+**Universal by design.** If the site has an HTML5 `<video>` element, KoalaSync can usually sync it. YouTube, Netflix, Twitch, Prime Video, Disney+, Jellyfin, Emby, and countless niche sites work out of the box — no per-site integration to wait for, no extension swap when your friends want to switch services.
+
+**Your video never touches our servers.** KoalaSync only relays tiny timing messages — play, pause, seek position, readiness — over a hand-rolled WebSocket protocol. The actual video keeps streaming directly from the original site to each viewer's browser. KoalaSync never proxies, transcodes, uploads, or redistributes a single frame, which also means there is no legal gray zone around redistribution.
+
+**Privacy is the default, not an upgrade.** No accounts, no emails, no telemetry, no analytics, no behavior profiling. The official relay server runs entirely in volatile RAM and keeps zero persistent state — when the room closes, the data is gone. Pick a nickname or let KoalaSync generate one for you and you're in.
+
+### Built for people who actually want to read the code
+
+KoalaSync is MIT-licensed open source, built by a solo developer. Audit it, fork it, change it. The extension is dependency-free with a direct Socket.IO wire implementation — no opaque libraries, no framework bloat, no surprise third-party SDKs. Want full sovereignty? Self-host your own relay with a single Docker command and keep all watch-party coordination traffic inside your own infrastructure. The official public relay is there when you don't care, self-hosting is there when you do.
+
+### Little touches you'll notice
+
+- **Episode Auto-Sync** pauses the room when someone loads the next episode and resumes only when everyone is ready — no spoilers, no one left behind on the previous cliffhanger.
+- **Smart Audio Compressor** tames the modern "whisper dialogue, deafening explosion" mix with one click. Three presets or full manual control over threshold, ratio, attack, and release.
+- **One-click invite links** auto-configure the server and room for your friends — they just click the link and they're in. No fumbling with server URLs or room IDs.
+- **Dual-heartbeat architecture** kills ghost rooms and stale connections before they desync your session.
+- **15 languages** fully translated and switchable in real time from the settings panel — English, German, French, Spanish, Portuguese (Brazil + European), Russian, Italian, Polish, Turkish, Dutch, Japanese, Korean, Chinese, Ukrainian.
+
+### Install and start in under a minute
+
+Install KoalaSync from the Chrome Web Store or Firefox Add-ons, click "Create Room," share the invite link, and pick a video. The official relay is ready out of the box — no setup required unless you want to self-host.
+
+- Website: https://sync.koalastuff.net
+- GitHub: https://github.com/Shik3i/KoalaSync
+
+---
+
+## Bonus: Taglines (for hero headlines, social bios, meta descriptions)
+
+- Watch together. Anywhere. Privately.
+- The watch-party tool that works on every site and tracks none of them.
+- Sync play, pause, and seek on any video — no accounts, no logs, no lock-in.
+- Self-hostable, open-source watch parties for the post-"3, 2, 1, play" era.
+- Press play once. Stay together anywhere.
@@ -1,37 +1,57 @@
-KoalaSync: The Privacy-First Watch Party Extension
+KoalaSync: Private Watch Parties for Emby, Jellyfin, Plex, Netflix & YouTube

-Private watch parties for Emby, Jellyfin, Plex, Netflix, YouTube & more. No account needed. Real-time sync. Supports 13 languages. 100% free.
+Tired of counting down "3, 2, 1, Play" over voice chat? KoalaSync keeps you and your friends perfectly in sync. Whether you are streaming from your own self-hosted media server like Emby, Jellyfin or Plex, or watching on a major platform like Netflix, Prime Video or YouTube — KoalaSync is designed for smooth, browser-based watch parties.

-Whether you're binge-watching Netflix, streaming from your own self-hosted Emby, Jellyfin, or Plex servers, or watching on virtually any other website with a video player — KoalaSync keeps everyone perfectly in sync.
-Lightweight, open-source, and built for absolute data sovereignty with a clean, minimalist UI.

-✨ CORE FEATURES 
+✨ CORE FEATURES
+No account required. No tracking. Just create a room, invite your friends, and start watching together.

- • No Account Needed: Just create a room and share the link. No emails, no passwords, no hassle. A random nickname is assigned automatically, or pick your own.
- • Universal HTML5 Sync: Flawlessly synchronizes play, pause, and seeking on Netflix, Jellyfin, Emby, YouTube, and almost any website hosting a standard HTML5 <video> tag.
- • Smart Binge-Watching (Auto-Sync): When a new episode loads, KoalaSync automatically pauses playback in a smart lobby until everyone's video is ready. No spoilers, no one left behind.
- • Fully Localized: Enjoy a native experience with a user interface fully translated into 13 different languages.
- • One-Click Invitations: Generate a smart invite link. Once clicked, the extension instantly configures room credentials and server settings for your guests.
- • Zero-Latency Protocol: Powered by a custom WebSocket architecture designed for real-time coordination without buffering loops.
+• Real-Time Video Sync: Play, pause, seek, and watch together with fast synchronized playback across everyone in your room.
+• No Account Needed: Create a room and share the invite link. No emails, no passwords, no sign-ups. Pick a nickname or let KoalaSync generate one for you.
+• Works Almost Everywhere: If the website uses a standard HTML5 video player, KoalaSync can usually sync it. Perfect for streaming sites, self-hosted media servers, and other websites.
+• Smart Binge-Watching: When a new episode loads, KoalaSync automatically pauses the lobby until everyone is ready. No spoilers, no one left behind.
+• Smart Audio Compressor: Tired of quiet dialogue and suddenly loud action scenes? Balance whispering, explosions, and music with a single click while you watch.
+• One-Click Invites: Send a smart invite link to your friends. When they open it, KoalaSync automatically configures the room so they can join instantly.
+• 13 Languages: Enjoy a native experience with a fully translated user interface.

-🛡️ UNCOMPROMISING PRIVACY & SECURITY 

- No data collection. No compromises.
- • 100% Anonymous: Zero tracking, zero analytics, zero telemetry.
- • Ready Out-Of-The-Box: No technical knowledge needed. Install and start watching immediately using the official public server.
- • RAM-Only Public Server: The official relay server operates entirely in volatile RAM. No databases, no logs, no watch history — nothing persists. It also features built-in rate-limiting and brute-force protection to prevent room-id spamming.
- • Self-Hostable: Take total control by deploying a private relay server in seconds via Docker. Optional, never required.

-🚀 HOW IT WORKS 
+🛡️ PRIVACY & SECURITY
+KoalaSync is built for private watch parties without unnecessary data collection.

- 1. Install KoalaSync and click "Create Room" to spin up a secure lobby.
- 2. Copy the invite link and send it to your friends.
- 3. Open your favorite streaming site and set the video tab as the active target.
- 4. Press play — everyone stays perfectly in sync.
+• No Tracking: Zero analytics, zero telemetry, and absolutely no behavior profiling.
+• Anonymous by Design: No accounts needed. Rooms can be joined with a simple nickname.
+• Ready Out of the Box: Install KoalaSync and start watching immediately using the official public relay server. No technical setup required.
+• RAM-Only Public Server: The official relay server operates entirely in volatile RAM. No databases, no stored watch history, no persistent room data. Room data exists only temporarily and disappears when the room closes.
+• Self-Hostable: Want full control? You can run your own private KoalaSync relay server via Docker in seconds. Self-hosting is optional and never required.

-💻 OPEN SOURCE 

- KoalaSync was built by a solo developer who needed a fast, secure way to watch movies with friends — and builds tools worth using. The code is fully transparent under the MIT license: audit it, fork it, improve it. Found a bug or have a feature idea? Open an issue on GitHub. Contributions and code reviews are always welcome.

- • Website: https://sync.koalastuff.net
- • GitHub: https://github.com/Shik3i/KoalaSync
+🚀 HOW IT WORKS
+1. Install KoalaSync.
+2. Click "Create Room" to start a private watch party.
+3. Share the invite link with your friends.
+4. Open your favorite streaming site or media server.
+5. Select the active video tab.
+6. Press play — everyone stays perfectly in sync.
+
+
+
+⚙️ UNDER THE HOOD
+KoalaSync is lightweight, transparent, and built with privacy in mind.
+
+• On-Demand Relay: Playback state is synchronized through a custom WebSocket-based relay server. No persistent connection — the relay is only active while you're in a room. No background traffic, no idle connections.
+• No Media Streaming: KoalaSync does not stream, proxy, upload, download, or redistribute any video content. Everyone watches from their own browser on the original website.
+• Temporary Room State Only: The relay server only coordinates room state such as play, pause, seek position, active target, nickname, and readiness status.
+• Docker Self-Hosting: The relay server can be self-hosted with Docker if you prefer to run your own private instance.
+• Open Architecture: The project is designed to be inspectable, forkable, and easy to review.
+
+
+
+💻 OPEN SOURCE
+KoalaSync was built by a solo developer who needed a fast, secure way to watch movies with friends. The code is fully transparent under the MIT license: audit it, fork it, improve it, or self-host your own relay server.
+
+Found a bug or have a feature idea? Open an issue on GitHub. Contributions and code reviews are always welcome.
+
+• Website: https://sync.koalastuff.net
+• GitHub: https://github.com/Shik3i/KoalaSync
@@ -21,14 +21,14 @@ KoalaSync is a specialized tool for **synchronized video playback** across multi
 - `extension/`: Browser Extension (Chrome & Firefox, Manifest V3). Contains background service worker, content scripts, and popup UI.
 - `server/`: Node.js Relay Server using Socket.IO (WebSocket-only).
 - `website/`: **Landing Page** & Invitation Bridge (Marketing, Tutorials, and Downloads).
-  - **`build.js`**: Zero-dependency static site compiler. Translates `template.html` + `locales/*.json` → `www/`. Also minifies CSS/JS automatically.
-  - **`www/` is auto-generated**: Never edit files in `www/` directly. Always edit source files (`template.html`, `style.css`, `app.js`, `lang-init.js`, `locales/*.json`) and run `node website/build.js` to regenerate. CSS/JS are output as `.min.*` files — a built-in cleanup step removes stale artifacts on each build.
+  - **`build.cjs`**: Zero-dependency static site compiler. Translates `template.html` + `locales/*.json` → `www/`. Also minifies CSS/JS automatically.
+  - **`www/` is auto-generated**: Never edit files in `www/` directly. Always edit source files (`template.html`, `style.css`, `app.js`, `lang-init.js`, `locales/*.json`) and run `node website/build.cjs` to regenerate. CSS/JS are output as `.min.*` files — a built-in cleanup step removes stale artifacts on each build.
 - `shared/`: **Single Source of Truth** for protocol constants and event names.
- `scripts/`: Development utilities (e.g., `build-extension.js`).
+- `scripts/`: Development utilities (e.g., `build-extension.cjs`).
 - `docker-compose.yml`: Root-level orchestration for the relay server.

 > [!IMPORTANT]
-> **Single Source of Truth**: `shared/constants.js` and `shared/blacklist.js` are the master files. They must be synchronized to the `extension/shared/` directory using `node scripts/build-extension.js`. 
+> **Single Source of Truth**: `shared/constants.js` and `shared/blacklist.js` are the master files. They must be synchronized to the `extension/shared/` directory using `node scripts/build-extension.cjs`. 
 > - **Extension Modules** (`background.js`, `popup.js`) import directly from `./shared/constants.js`.
 > - **Content Scripts** (`content.js`) use a **marker-injected synchronous copy** of the constants. The build script automatically replaces the marked blocks — no manual mirroring needed.

@@ -41,7 +41,7 @@ Before touching any code, you MUST read the following documents in order:
 ## 4. The "Vanilla JS Mirror" Pattern
 To avoid boot-time race conditions in Manifest V3 without a bundler, the following architectural trade-off is enforced:
 - **Synchronous Execution**: `content.js` MUST execute synchronously to catch early media events. 
- **Automated Injection**: The build script (`node scripts/build-extension.js`) automatically injects `EVENTS` and `HEARTBEAT_INTERVAL` into `content.js` using marker-based replacement (see `../scripts/README.md` for marker details).
+- **Automated Injection**: The build script (`node scripts/build-extension.cjs`) automatically injects `EVENTS` and `HEARTBEAT_INTERVAL` into `content.js` using marker-based replacement (see `../scripts/README.md` for marker details).
 - **Maintenance**: After modifying `shared/constants.js`, simply run the build script. No manual mirroring is required.

 ## 5. File Responsibility Map
@@ -137,18 +137,18 @@ Before starting any task, committing, or pushing, you **MUST** run `git pull --r

 ### Adding a Protocol Event
 1. Add the event name to `shared/constants.js`.
-2. Run the build script (`node scripts/build-extension.js`).
+2. Run the build script (`node scripts/build-extension.cjs`).
 3. Implement the handler in `server/index.js` and `background.js`.

 ### Making Website Changes
 1. Edit source files in `website/` (`template.html`, `style.css`, `app.js`, `lang-init.js`, or `locales/*.json`).
-2. Run the compiler: `node website/build.js`. This generates the multilingual pages in `www/` and minifies CSS/JS.
+2. Run the compiler: `node website/build.cjs`. This generates the multilingual pages in `www/` and minifies CSS/JS.
 3. Verify the output: `node --check website/www/app.js && node --check website/www/lang-init.js`.
 4. Test locally: `npx serve website/www` or `python3 -m http.server 8080 -d website/www`.
 5. Commit both source changes and the updated `www/` output.

 ### Testing Locally
-1. Run the build script: `node scripts/build-extension.js`.
+1. Run the build script: `node scripts/build-extension.cjs`.
 2. Load `dist/chrome/` as an "Unpacked Extension" in Chrome (or `dist/firefox/` in Firefox).
 3. Start the server from the root: `docker-compose up --build`.
 4. Use **different browser profiles** or vendors to test multi-peer logic.
@@ -2,9 +2,10 @@

 This document describes the communication flows and internal logic of the KoalaSync system.

-## 1. Extension Startup & Connection
- **Initialization**: On startup, `background.js` reads settings (Server URL, Username, Last Room) from `chrome.storage.sync`.
- **WebSocket Handshake**:
+## 1. Extension Connection (Lazy Connect)
+- **Initialization**: On startup, `background.js` reads settings (Server URL, Username, Last Room) from `chrome.storage.sync`. No WebSocket connection is established at this point.
+- **On-Demand Connection**: The extension only connects when needed — either the user opens the popup with saved room credentials, or when actively in a room. When not in a room, no connection exists. This improves privacy (IP not exposed while idle) and reduces battery/network usage.
+- **WebSocket Handshake (when connecting)**:
  1. Background creates a `new WebSocket` to `/socket.io/?EIO=4&transport=websocket&version=1.0.0`.
  2. Server performs security checks:
     - **IP Rate Limit**: Checks if the IP has exceeded connection limits.
@@ -45,7 +46,7 @@ To maintain a clean room state and eliminate "Ghost Peers":
 - **Video Heartbeat (Content)**: Every 15 seconds, `content.js` sends current playback metadata (time, title, state) if a video is found.
 - **Server Pruning**: The server runs a "Reaper" every 2 minutes. If a peer has sent **zero** activity (no events and no heartbeats) for 5 minutes, they are forcefully disconnected.
 - **Immediate Cleanup**: Rooms are deleted instantly when the last peer leaves or disconnects.
- **Reconnect Strategy**: Aggressive backoff — 500ms base, 1.5x multiplier, capped at 5s. Max 20 attempts before marking as failed. Events are queued during disconnect and flushed after namespace rejoin.
+- **Reconnect Strategy (while in room)**: Aggressive backoff — 500ms base, 1.5x multiplier, capped at 5s. Max 20 attempts before marking as failed. Events are queued during disconnect and flushed after namespace rejoin. When not in a room, no reconnection occurs.

 > [!CAUTION]
 > **Identity Rule**: Differentiate between `peerId` and `socket.id`. Use `socket.id` exclusively for ephemeral transport routing on the server. Use `peerId` exclusively for identity, state management, and room tracking across the stack.
@@ -70,5 +71,5 @@ KoalaSync uses a megaphone routing approach to minimize server logic:
 To maintain a "Single Source of Truth" across the server and extension without using a bundler:
 - **Relay Server & Extension Modules**: `background.js` and `popup.js` import constants directly from `shared/constants.js`.
 - **Content Scripts**: To ensure zero-latency execution, `content.js` uses a synchronized copy of `EVENTS` and constants.
- **Automation**: The `node scripts/build-extension.js` script automatically injects these constants into `content.js` during the build process, eliminating the risk of manual mirror mismatch.
+- **Automation**: The `npm run build:extension` script automatically injects `EVENTS`, `HEARTBEAT_INTERVAL`, and `episode-utils.js` functions into `content.js` during the build process, eliminating the risk of manual mirror mismatch.
 - **Verification**: Any protocol change is automatically propagated across the stack by running the build script.
@@ -4,15 +4,202 @@ All notable changes to the KoalaSync browser extension and relay server.

 ---

+## Unreleased
+
+### Added
+- **Extension: Privacy title controls** - Advanced users can now disable sending browser tab titles separately from media titles. Media titles can still be sent in full, reduced to detected episode identifiers such as `S01E04`, or hidden entirely. Defaults remain full titles for backwards compatibility.
+
+---
+
+## [v2.5.0] — 2026-06-29
+
+### Added
+- **Extension + Relay: Host Control Mode** — Room owners can now switch a room between open playback control and host-controlled playback. In host-only mode, guests stay synchronized but their local play, pause, and seek actions are not rebroadcast to the room.
+- **Backward-compatible Host Control rollout** — The extension only shows Host Control when the connected relay supports it, so users on older self-hosted servers do not see controls that cannot work yet.
+- **Extension: Clear host and guest states** — The popup shows the current control mode, host status, peer roles, and localized guest guidance so participants understand when playback is controlled by the host.
+- **Website: FAQ clarification for streaming access** — The landing page and FAQ structured data now state clearly that KoalaSync does not stream, host, share, or bypass access to video content. Every participant watches locally and needs their own access to services such as Netflix.
+
+### Changed
+- **Playback sync now follows the room's control setting** — When Host Control is enabled, only the host can drive room-wide playback changes; guests can still watch in sync without accidentally changing playback for everyone.
+
+---
+
+## [v2.4.6] — 2026-06-23
+
+### Fixed
+- **Room and settings are no longer stored in `chrome.storage.sync`** — Room ID, password, and username were being resurrected from synced storage on a fresh install (sync survives an uninstall in the user's Google account), which made the extension silently auto-connect to a dead room and appear permanently connected. `getSettings()` and all settings reads are now local-only, and legacy keys are actively purged from sync on install/update/startup. Only `onboardingComplete` and `dismissedHints` remain in sync.
+- **No server traffic while alone in a room** — When you are the only peer, heartbeats, force-sync, and episode auto-sync are now fully suppressed (previously the keepAlive heartbeat, force-sync, and episode lobby were still broadcast to an empty room). The solo state is re-evaluated live on every event — never cached — so the instant another peer joins, syncing resumes immediately, including an instant state push so the newcomer sees your current position without waiting for the next heartbeat.
+
+## [v2.4.4] — 2026-06-23
+
+### Changed
+- **Server: Event rate limit raised 30 → 50 per 10s**, and all connection/event/health rate-limit thresholds and windows extracted into named constants.
+- **Extension: Reconnect backoff tuned and jittered** — capped at ~8 attempts/60s (under the per-IP connection limit) with ±20% jitter to de-synchronize reconnect herds after a server blip.
+- **CI: Added a verification workflow** running lint, tests, audits, and builds on every push/PR; the release build now uses `npm ci`.
+
+### Fixed
+- **Extension: Offline event-queue flush is now paced** (small batches instead of one synchronous burst) so a reconnect after a long outage no longer trips the server event limit and gets disconnected on rejoin.
+- **Extension: Ping liveness tolerates one missed PONG** — a reconnect is forced only after 2 consecutive misses (~20s) instead of a single 5s timeout, avoiding spurious drops under transient load.
+- **Extension: `socket.send()` failures are caught and re-queued** instead of losing the event on a disconnect race.
+
+## [v2.4.3] — 2026-06-19
+
+### Added
+- **Two new languages: Ukrainian (`uk`) and Chinese (`zh`, Simplified)** — added across the extension (UI strings + Chrome `_locales`) and the website (localized pages, hreflang/Open Graph/schema tags, language selector), bringing the total to 15 languages.
+
+### Changed
+- **Play/pause sync coalescing** — The content script now collapses rapid bursts of native play/pause events (source swaps, ABR/quality switches, ad transitions, page teardown) into a single relayed command: the first event is sent instantly and a short 150ms window absorbs the rest. This cuts redundant relay traffic and stops bursts from tripping the server's per-socket event rate limit.
+
+### Fixed
+- **zh/uk translation quality** — Corrected systematic machine-translation word-sense errors in the two new locales (e.g. "Play", "Status", "Leave Room", "Clear", "Open", "peers", and audio compressor terms) and translated the remaining English leftovers.
+- **Relay logging** — An `EVENT_ACK` aimed at a peer that already left is now logged quietly instead of as a `[SECURITY]` cross-room event, so genuine cross-room attempts stand out in the logs.
+
+## [v2.4.2] — 2026-06-19
+
+### Changed
+- **Extension: Optimized uninstall URL registration** — Extracted registration into a reusable, race-condition-protected `initUninstallURL()` helper. It registers the uninstall feedback URL with browser context on both extension installation/update and browser startup to prevent state loss, without storing or sending an installation token.
+
+## [v2.4.1] — 2026-06-19
+
+### Added
+- **Extension: Onboarding tour now has a closing step** — The first-run tour ends on a dedicated "You're all set!" card (the `ONBOARDING_5` copy that already existed in all 13 locales but was never shown). The tour no longer stops abruptly on the username step.
+- **Extension: One-click invite from the empty peer list** — The "No peers yet" state now shows a **📋 Invite Link** button that copies the invite link to the clipboard, so users can share it without hunting for the field.
+
+### Changed
+- **Extension: Cleaner onboarding welcome** — Step 1 is now a centered welcome card instead of spotlighting the logo title. Added a guard so target-less tour steps center cleanly.
+- **Website: Mobile comparison table** — The KoalaSync vs Teleparty table stacks into per-feature cards on phones instead of forcing horizontal scrolling; feature descriptions are shown again on mobile.
+
+### Fixed
+- **Extension: Onboarding step counter/progress placeholders** — Static `Step 1 of 3` / 33% fallbacks in `popup.html` corrected to match the actual 5-step tour (`Step 1 of 5` / 20%).
+- **Website: Mobile navigation restored** — The header hamburger menu was hidden by a `display:none !important` rule, leaving the nav links unreachable on phones. Re-enabled, with spacing kept comfortable down to ~320px.
+- **Website: Hero alignment on mobile** — A fixed-width extension mockup forced the hero grid column wider than the container, shifting all hero content off-center (larger left margin than right). The mockup is now responsive (`width:100%/max-width` + `minmax(0,1fr)` grid track).
+- **Website: Reveal-animation fallback** — Added a `<noscript>` style fallback and `IntersectionObserver` feature guards so scroll-revealed content can never stay invisible if JavaScript is disabled or unsupported.
+
+## [v2.4.0] — 2026-06-16
+
+### Added
+- **Extension: Lazy WebSocket connection** — The extension no longer maintains a permanent WebSocket connection to the relay server. Instead, the connection is established only when actively in a room or when the popup is opened with a saved room configuration. This improves privacy (IP is not exposed while idle), reduces battery/network usage, and prevents the server from tracking online status of inactive users. Automatic reconnect is guaranteed while in a room — zero behavior change during active sync sessions. See `connectIntent` flag in `background.js`.
+- **Extension: Episode title regex unification** — `extractEpisodeId()` had inconsistent regex patterns between `background.js` and `content.js`. The content script correctly matched Crunchyroll-style separators (`S01/E01`) while the service worker's stricter pattern (`[\s\-\.]*`) silently rejected them, causing episode lobby sync failures. Now unified to `[^a-zA-Z0-9]*` via shared `episode-utils.js`.
+- **Unit tests: `rate-limiter` and `episode-utils`** — 12 test groups for rate-limit functions and 30+ assertions for episode title parsing, covering all 6 separator types (dash, dot, slash, colon, comma, space). Run automatically via `npm run verify`.
+
+### Changed
+- **Server: Rate limiter extracted to `rate-limiter.js`** — 6 rate-limit functions, all rate-limit Maps, and cleanup intervals moved from `index.js` (149 lines). `index.js` now imports via facade pattern with re-exports for backward compatibility.
+- **Extension: Episode utilities extracted to `episode-utils.js`** — `extractEpisodeId()` and `sameEpisode()` deduplicated from `background.js` and `content.js`. The shared module is imported as an ES module by the service worker and injected into the content script IIFE by the build script.
+- **Build: `"type": "module"` in root `package.json`** — All scripts standardized to ESM (`.mjs`) or explicitly CommonJS (`.cjs`). Eliminated Node.js `MODULE_TYPELESS_PACKAGE_JSON` warnings.
+- **Build: 4 CJS scripts renamed to `.cjs`** — `build-extension.js`, `test-content-video-finder.js`, `test-locales.js`, `website/build.js`.
+
+### Fixed
+- **Server: npm audit resolved** — `ws` package vulnerability (CVE-2024-37890) fixed. Zero vulnerabilities in production dependencies.
+- **Pop-up: Connection status flicker fixed** — Removed hardcoded `disconnected` state on every pop-up open. Status now reflects actual background state from the first frame.
+- **Pop-up: Join button timeout improved** — No longer blindly re-enables after 15s. Polls connection status and extends window if still connecting.
+- **Pop-up: Validation failure state cleanup** — Custom server URL validation errors now properly reset `isProcessingConnection` and `joinBtnTimeout`.
+- **Extension: `WEB_JOIN_REQUEST` channel leak fixed** — Missing `sendResponse()` call when already in the target room.
+- **Extension: `LEAVE_ROOM` now clears `roomId` from storage** — Prevents phantom auto-reconnect on browser restart after explicit leave.
+- **Extension: Reconnect attempt counters reset on leave** — Prevents stale `reconnecting` status display after intentional disconnect.
+
+## [v2.3.2] — 2026-06-16
+
+### Changed
+- **Extension: Refined Spanish, Italian, and Portuguese translations**: Complete manual review and improvement of all Spanish (`es`), Italian (`it`), Portuguese — Brazil (`pt-BR`), and Portuguese — Portugal (`pt`) locale files for both the extension UI and the landing website. Thanks to [@Kaia-Alenia](https://github.com/Kaia-Alenia) for the native-quality translations.
+
+### Fixed
+- **Extension: Locale typos and corrupted characters fixed**: Repaired a Korean refresh button label (`Refreschi` → `새로고침`), a corrupted Korean connection status string (`연kel` → `연결`), a Korean character contaminating a Japanese string (`의` → `の`), and a Dutch typo (`cmmuniceren` → `communiceren`).
+- **Server: Admin token length leak fixed (timing side-channel)**: `isAdminMetricsAuthorized()` returned early when the provided buffer had a different length than the expected token, leaking the token length via response timing. Now `crypto.timingSafeEqual` runs in constant time on every attempt regardless of length match. Reported by [@Kaia-Alenia](https://github.com/Kaia-Alenia).
+
+---
+
+## [v2.3.1] — 2026-06-15
+
+### Fixed
+- **Server: Concurrent peer join race condition and teardown error handling**
+
+### Changed
+- **Server: Smart unhandled rejection handling (exits after 5/min instead of 1)**
+- **Server: Optimized admin health metrics allocation**
+
+---
+
+## [v2.3.0] — 2026-06-14
+
+### Added
+- **Extension: New Interactive Onboarding Tour**: A fully redesigned, interactive step-by-step onboarding experience.
+- **Extension: Auto-Switch to Sync Tab**: The UI now intelligently switches to the Sync tab when you join a room to guide video selection.
+- **Extension: Uninstall URL Integration**: Prepared an uninstall URL setup that works natively across Chrome and Firefox, cleanly attaching browser context for analytics.
+
+### Fixed
+- **Extension: Infinite Seek Loop Prevention**: Replaced the fragile time-based seek suppression with an exact target-time verification mechanism, entirely eliminating infinite seek loops on slow buffers.
+- **Extension: Zombie Connections Resolved**: Implemented a forced disconnect upon ping timeouts, ensuring the extension reliably auto-reconnects when the WebSocket hangs in a half-open state.
+- **Extension: Room Switching Architecture**: Joining a new room while already connected now explicitly severs the old connection first, preventing state cross-contamination. 
+- **Extension: Join/Leave Race Conditions**: Added UI locks to prevent users from accidentally sending conflicting connection commands via rapid double-clicking.
+- **Extension: Same-Room Invite Bypass**: Clicking an invite link for the room you are currently in no longer triggers a redundant reconnect, instead instantly confirming the join.
+- **Extension: Audio settings now propagate immediately to video tabs**: Changes made in the audio options page are now instantly applied to the active video tab. Previously, settings saved to `chrome.storage.local` were not picked up by the background listener, which only watched `chrome.storage.sync`.
+- **Extension: Audio compressor now logs enable/disable state and resume failures**: The compressor reports when it is activated or bypassed, and warns if the `AudioContext` cannot be resumed (e.g. browser autoplay policy requires a user gesture on the page first).
+- **Extension: Video heartbeat no longer sent when alone in a room**: The full media metadata `PEER_STATUS` is now only emitted when other peers are present. The session keepalive (background heartbeat) continues to run unaffected, preventing the server reaper from disconnecting idle peers.
+- **Server: Increased `failedAuthAttempts` eviction threshold from 50k to 200k**: Reduces frequency of expensive batch evictions under high auth-failure volumes, smoothing heap usage.
+
+---
+
+## [v2.2.4] — 2026-06-10
+
+### Fixed
+- **Extension: Error notifications now respect `browserNotifications` setting**: Server error events (e.g. "Server is restarting") no longer trigger a browser notification when the user has disabled notifications in the extension settings.
+- **Server: Misleading reconnect message corrected**: The graceful shutdown message no longer tells users to manually reconnect — the extension handles this automatically.
+
+---
+
+## [v2.2.3] — 2026-06-10
+
+### Added
+- **Artifact Attestations (Supply Chain Security)**: All release artifacts (Docker images, extension ZIPs) are now published with signed [SLSA provenance attestations](https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations) via `actions/attest@v4`. Anyone can verify that an artifact was built from this repository using `gh attestation verify`.
+- **Admin health: `rateLimits.denied` counters**: New rolling counters track actual rate-limit denials (429 responses), separate from `rateLimits.trackedClients` which reports unique IPs in the tracking window.
+- **Docker HEALTHCHECK**: Container health is now checked every 30s via `GET /health`.
+- **`npm start` script**: Server can now be started with `npm start`.
+
+### Fixed
+- **Server: `activeLobby` no longer silently overwritten**: If a second peer sends `EPISODE_LOBBY` while a lobby is already active, the request is now ignored instead of destroying the first peer's lobby.
+- **CORS log sanitization**: Rejected origin headers are sanitized (`\r\n` stripped) to prevent log injection.
+- **Extension: pagehide resource leak**: `keepAlivePort`, `lobbyPollTimer`, heartbeats, and `MutationObserver` are now properly cleaned up when a tab is hidden or enters bfcache.
+- **Extension: unhandled storage rejections**: `chrome.storage.session.set()` calls in the disconnect handler now have `.catch(() => {})`.
+- **`'Pixel'` duplicate in name generator**: Second occurrence replaced with `'Nitro'` for better name diversity.
+- **`'opposum'` typo**: Corrected to `'opossum'` in the emoji map and added `'Opossum'` to `USERNAME_NOUNS`.
+- **Test reliability**: `test-server-routes.mjs` now sets `ADMIN_METRICS_TOKEN` before importing the server module, fixing standalone test execution.
+- **`MAX_PEERS_PER_ROOM` konsistent**: `.env` auf 25 gesetzt (wie `.env.example`).
+- **pt-BR.json duplicate removed**: Duplicate `FOOTER_DISCLAIMER` key removed from website locale.
+
+### Changed
+- **Admin health: `rateLimitEntries` renamed to `rateLimits.trackedClients`**: The field now accurately describes that it tracks unique clients in the rate-limit window, not denial counts. Update your json_exporter/Grafana config accordingly.
+- **README restructured**: Sections reordered by progressive technical depth. New "Supply Chain Security" subsection under "For Developers & Self-Hosters" with verification commands.
+
+---
+
+## [v2.2.2] — 2026-06-09
+
+### Added
+- **Chrome Web Store i18n Support**: Added `default_locale: "en"` to manifest and created `_locales/*/messages.json` for all 13 supported languages. This unlocks the language selection dropdown in the Chrome Web Store dashboard, allowing translated store listings (title, description) per locale. The extension's own UI translations (`locales/*.json` + `i18n.js`) remain unchanged.
+- **Locale test coverage**: Extended `scripts/test-locales.js` to validate all `_locales/*/messages.json` files (correct format, required keys, no duplicates) and verify `default_locale` is set in the manifest.
+
+### Fixed
+- **Copy Logs button alignment**: Removed stray `margin-top: 8px` inherited from `.secondary` class that pushed the button 8px down in the connection status row.
+
+---
+
+## [v2.2.1] — 2026-06-09
+
+### Added
+- **Server Ping Display**: Measures round-trip latency to the relay server via application-level ping/pong events. The extension sends `PING { t }` every 15 seconds; the server responds with `PONG { t }`. Round-trip time is calculated client-side and displayed in the Status tab, color-coded (<50ms green, 50–150ms yellow, >150ms red). No ping value is shown when disconnected or if the server does not respond within 5 seconds.
+- **Peer Ping Response (Future-Proof)**: The extension can now respond to incoming `PING { t, sender }` events from other peers by sending back `PONG { t, target: sender }`. The relay server forwards `PING` to the target peer and routes `PONG` back to the original sender. Both client and server validate that peers are in the same room before forwarding/routing. Peer-to-peer ping initiation will be activated in a future extension update without requiring a server restart.
+
+---
+
 ## [v2.2.0] — 2026-06-08

 ### Added
- **Web Audio API Compressor**: Built-in audio dynamic range compression with four presets (Recommended, Dynamic Range, Vocal Enhancement, Smooth) and fully customizable sliders (threshold, ratio, knee, attack, release, makeup gain). Uses dry/wet crossfade (40ms linear ramp) to avoid clicks. Configured via the new Audio Options page accessible from the Settings tab.
+- **Web Audio API Compressor**: Built-in audio dynamic range compression with four presets (Recommended, Dynamic Range, Vocal Enhancement, Smooth) and fully customizable sliders (threshold, ratio, knee, attack, release). Uses dry/wet crossfade (40ms linear ramp) to avoid clicks. Configured via the new Audio Options page accessible from the Settings tab.
 - **Audio Options Page** (`audio-options.html`): Dedicated settings page with master toggle, compressor preset selector, real-time custom sliders, and equalizer placeholder. Dark theme matching the popup design.
 - **Feature Hint System**: Generic `dismissedHints` array in sync storage for announcing new features. First hint highlights the Audio Options entry in Settings. Extensible for future features.

 ### Changed
- **Ko-Fi Support Links**: Static footer badges on the Settings and Status tabs linking to the developer's support page. README and website footer updated with Ko-Fi badge.
+- **Support Links**: Static footer badges on the Settings and Status tabs linking to the developer's support page. README and website footer updated with a Support KoalaSync badge.

 ### Fixed
 - **Portuguese (PT) locale**: Removed Italian contamination — "sincronizzazione" → "sincronização", "tempo reale" → "tempo real", "Link di Invito" → "Link de Convite", "Sair della Sala" → "Sair da Sala".
@@ -16,9 +16,9 @@ This guide walks through the complete user flow of KoalaSync, from creating a ro

 ## Step 2: Connecting to the Relay Server

-When you open the extension popup, the background service worker connects to the relay server:
+When you open the extension popup (with saved room credentials) or when a saved room configuration exists from a previous session, the background service worker connects to the relay server:

-1. **WebSocket Handshake**: `background.js` opens a WebSocket to `wss://syncserver.koalastuff.net/socket.io/?EIO=4&transport=websocket`.
+1. **WebSocket Handshake** (on demand): `background.js` opens a WebSocket to `wss://syncserver.koalastuff.net/socket.io/?EIO=4&transport=websocket` only when needed (popup opened or active room).
 2. **Security Checks** (server-side):
   - The server checks the client's **IP rate limit** (max 10 connections per 60 seconds).
   - The server validates the **authentication token** (hardcoded in `shared/constants.js`) to verify this is a legitimate KoalaSync client.
@@ -155,8 +155,8 @@ While in a room, two heartbeats keep the session alive:

 | Heartbeat | Interval | Source | Purpose |
 |:----------|:---------|:-------|:--------|
-| **Background** | 30 seconds | `background.js` | Signals "I'm still connected" and triggers aggressive reconnect (500ms base, max 5s) |
-| **Content** | 15 seconds | `content.js` | Sends video metadata: `currentTime`, `mediaTitle`, `playbackState`, `volume`, `muted` |
+| **Background** | 30 seconds | `background.js` | While connected, signals "I'm still connected" and triggers automatic reconnect (500ms base, max 5s). No heartbeats fire when idle (lazy connect). |
+| **Content** | 15 seconds | `content.js` | Sends video metadata: `currentTime`, privacy-filtered `mediaTitle`, `playbackState`, `volume`, `muted` |

 - **Server Reaper**: Every 2 minutes, the server checks for peers with no activity for 5+ minutes and disconnects them ("dead peer pruning").
 - **Room Cleanup**: Empty rooms are deleted immediately. Inactive rooms are pruned after 2 hours.
@@ -184,7 +184,7 @@ When a user clicks **"Leave"** or closes their browser:
 When watching a series and an episode ends:

 1. `content.js` monitors the [Media Session API](https://developer.mozilla.org/en-US/docs/Web/API/Media_Session_API) for title changes.
-2. When a new title is detected, the peer broadcasts `EPISODE_LOBBY` with the expected new title.
+2. When a new title is detected, the peer broadcasts `EPISODE_LOBBY` with the expected title after applying the local media title privacy setting. In episode-only mode this is an identifier such as `S01E04`; when media titles are not sent, the client does not create a new episode lobby.
 3. All peers' videos freeze. The UI shows an "Episode Lobby" card with peer readiness status.
 4. Each peer's `content.js` polls for the new title to appear in the `<video>` element's metadata.
 5. Once a peer detects the matching title, they send `EPISODE_READY`.
@@ -0,0 +1,103 @@
+# Known Limitations & Accepted Non-Issues (NOFIX)
+
+This file records design decisions that are **intentional** and **out of scope** for
+KoalaSync's threat model. They are frequently re-discovered by reviewers, linters, and
+AI agents and re-reported as "bugs" or "vulnerabilities." They are not. Please read the
+threat model below before flagging any of them.
+
+> **For reviewers & agents:** Do **not** re-report the NOFIX items below. They are
+> deliberate. If you think the *threat model itself* should change (e.g. KoalaSync
+> starts handling accounts, payments, or sensitive data), raise **that** discussion
+> first — these items only stand because the threat model holds.
+
+---
+
+## Threat model
+
+KoalaSync is a **privacy-preserving watch-party sync tool**, not a security product.
+
+- **Rooms are ephemeral.** They exist for a few hours and are auto-reaped. There are no
+  accounts, no persistent storage, no money, and no sensitive content on the relay.
+- **The relay is a dumb, stateless message bus.** It forwards play/pause/seek between
+  peers who *chose* to watch together and joined via an invite link shared out-of-band.
+- **Participants are invited.** Anyone in a room was let in. The social contract is
+  "we're watching a video together," not "mutually distrusting parties."
+
+### What we DO defend against
+- **Accidental disruption** — the entire point of Host Control Mode.
+- **Spam / DoS** that degrades the relay for everyone — rate limits, 4 KB payload cap,
+  server-side gating, lazy-cached health responses.
+- **Resource exhaustion / memory leaks** — bounded maps, periodic cleanup, room/peer reaping.
+- **Crashes from malformed input** — strict sanitization and clamping of every field.
+- **Genuine boundary breaches** — admin-metrics auth (constant-time), CORS, WSS upgrade,
+  invite-hash isolation, strict CSP. Reports here are very welcome (see `SECURITY.md`).
+
+### What we explicitly DO NOT defend against
+A **determined participant who modifies their own client to misbehave inside a room they
+were invited to.** The worst they achieve is sending playback commands or seizing the
+"host" role in a temporary room they could already disrupt by other means. That is a
+**social** problem, solved socially: kick them, or start a new room. Engineering real
+identity/auth to prevent it would destroy the account-less, frictionless, privacy-first
+design — a bad trade for an ad-hoc movie night.
+
+---
+
+## NOFIX entries
+
+### NOFIX-1 — `peerId` is unauthenticated; a crafted client can impersonate or seize the host
+**Flag:** `peerId` is client-asserted and broadcast to every peer (in `ROOM_DATA` /
+`PEER_STATUS`). A modified client can join with the host's `peerId`, dedupe-kick the real
+host, and become host — controlling or locking `host-only` mode.
+
+**Why NOFIX:** Requires a *modified client* + an *invited* participant + a `peerId` that is
+only meaningful inside that one *temporary* room. The payoff is sending play/pause or
+locking a room the attacker is already in — pure trolling, instantly reversible (kick /
+new room). Cryptographic per-user identity is wildly disproportionate for an ad-hoc,
+account-less, ephemeral watch party. **Out of threat model.**
+Do **not** "fix" with accounts, signed peerIds, or per-user tokens — that breaks the
+core design.
+
+### NOFIX-2 — Room-password comparison is not constant-time
+**Flag:** room password hashes are compared with `!==` (`server/index.js`), so the compare
+is theoretically timing-attackable.
+
+**Why NOFIX:** The compared value is an **HMAC-SHA256 hash that never leaves the server** —
+an attacker cannot observe it to mount a timing attack. Even a hypothetical success only
+lets someone join a *temporary* room to send playback commands. Not worth defending.
+(The admin-metrics bearer token — a real boundary — **does** use `crypto.timingSafeEqual`.
+That is the line we actually guard.)
+
+### NOFIX-3 — `OFFICIAL_SERVER_TOKEN` is public in the repo
+**Flag:** the connection token in `shared/constants.js` is committed, so anyone can connect.
+
+**Why NOFIX:** It is a **coarse filter** to keep random scanners off the relay, **not
+authentication**. The relay is a public message bus by design; rate limits and per-room
+behavior are the real protections.
+
+### NOFIX-4 — Room IDs are enumerable via `GET_ROOMS`
+**Flag:** any connected client can list all room IDs (and whether each has a password).
+
+**Why NOFIX:** This is the intended **"Public Rooms"** feature. Rooms wanting privacy set a
+password; listing the IDs of password-less rooms only lets someone join a watch party —
+the same as being handed the invite link.
+
+### NOFIX-5 — A pause/seek can only be reverted, not prevented
+**Flag:** in `host-only` mode a guest's pause still fires locally before the extension can
+react, so there is a brief flicker before snap-back.
+
+**Why NOFIX:** A content script cannot intercept a `<video>` event before the element
+acts. Reacting (snap-back) is the only option and is by design; the ~½s flicker is
+acceptable. Not a bug.
+
+---
+
+## Not NOFIX — just deferred (may be revisited)
+
+These are *not* accepted-forever; they are scoped out of v1 and tracked separately
+(see the host-control-mode design docs in `docs/`):
+
+- **Host grace on a long disconnect (EC-10).** A brief reconnect/second-tab keeps the host
+  (handled), but a long real disconnect still falls back to `everyone`. A ~30s host-reserve
+  grace could be added later.
+- **Intent-classifier / snap-back tuning.** Thresholds are first-pass; real-device testing
+  may adjust them.
@@ -8,7 +8,7 @@ KoalaSync is designed with a **Security-First & Volatile** architecture. This me

 ## 1. Data Processing (In-Memory Only)
 KoalaSync does not use a database. All active session data exists only in the server's RAM and is purged immediately when no longer needed.
- **Session Data**: To synchronize playback, the server must temporarily hold your `peerId`, `username`, and the `title` of the video you are watching. Additionally, playback metadata (`mediaTitle`, `playbackState`, `currentTime`, `volume`, `muted`) is held per peer for the duration of the session. All of this is deleted as soon as you leave the room.
+- **Session Data**: To synchronize playback, the server must temporarily hold your `peerId` and `username`. By default, KoalaSync also shares the selected tab title and media title with the room so peers can identify matching videos and coordinate episode transitions. Privacy Settings let you disable sending the tab title separately, and choose whether media titles are sent in full, reduced to a detected episode identifier (for example `S01E04`), or not sent. Playback metadata (`playbackState`, `currentTime`, `volume`, `muted`) is held per peer for the duration of the session. All of this is deleted as soon as you leave the room.
 - **Room Passwords**: If you set a room password, it is stored only as an in-memory **keyed SHA-256 HMAC hash**. The server receives the plaintext password only during join validation, never stores it, and keeps only the hash for the short room lifetime.
 - **Routing Maps**: The server maintains ephemeral lookup tables (`socketToRoom`, `peerToSocket`) to route messages between peers. These contain only transport identifiers and are purged on disconnect.

@@ -33,7 +33,7 @@ The browser extension requires the following permissions:
 - `storage`: To remember your local preferences (username, server URL, room settings).
 - `tabs` & `scripting`: To detect and control video elements on the pages you choose to sync.
 - `<all_urls>` (host permission): Required to detect `<video>` elements on any website the user chooses to synchronize. The extension only activates on the specific tab the user has actively selected — it does not scan, monitor, or interact with any other tabs or pages.
- `alarms`: To keep the background service worker alive during active sync sessions.
+- `alarms`: To keep the background service worker alive during active sync sessions (the extension only stays connected while you are in a room).
 - `notifications`: To display sync status updates (e.g., "Peer joined", "Force Sync initiated").
 - **No History Access**: We do not read, store, or transmit your browsing history. We only interact with the specific tab you have actively selected for synchronization.

@@ -5,3 +5,4 @@ This directory contains deep-dives into the KoalaSync protocol and architecture.
 - [HOW_IT_WORKS.md](HOW_IT_WORKS.md): Step-by-step walkthrough of every user flow, from room creation to synchronized playback. Ideal for store reviewers and manual testers.
 - [ARCHITECTURE.md](ARCHITECTURE.md): Communication flows, Dual Heartbeat, and Sync logic.
 - [SYNC_GUIDE.md](SYNC_GUIDE.md): Protocol constants and sync requirements.
+- [TRANSLATION.md](TRANSLATION.md): Translation and localization guide for the extension and website.
@@ -1,14 +1,73 @@
 # KoalaSync Roadmap

-This document tracks future technical plans and optimizations for the KoalaSync system.
+> Feature priorities, planned work, backlog, and rejected ideas for KoalaSync.

 ---

-## Planned Optimizations & Technical Roadmap
+## Status Legend
+
+| Badge | Meaning |
+|---|---|
+| 🚧 In Progress | Currently being developed |
+| 📋 Planned | Prioritized for an upcoming phase |
+| 💡 Backlog | Under evaluation, not yet prioritized |
+| ❌ Rejected | Declined (with rationale) |
+| ✅ Completed | Shipped |
+
+---
+
+## 🚧 In Progress
+
+*Currently being worked on.*
+
+| Feature | Priority | Area |
+|---|---|---|
+| *(none yet)* | | |
+
+---
+
+## 📋 Planned
+
+*Prioritized for upcoming phases.*
+
+### 2. Invite link with target URL for auto-redirect
+
+- **Priority:** P2
+- **Category:** UX / Ease of Sharing
+- **Background:** The invite link currently only contains the room ID. The invited person has to manually open the page. Ideally, the link would include the shared tab's URL so the invitee gets redirected to the right page and the tab is auto-selected (auto-matching via tab title already exists).
+- **Known challenges:**
+  - Many streaming sites (e.g., Emby, Jellyfin) don't have unique URLs per content — once inside the player, the URL stays the same.
+  - Dozens of such edge cases exist; a generic solution is difficult.
+  - Would likely need site-specific extractor logic (similar to the existing sync service adapters).
+- **Possible approaches:**
+  - Fallback: if no unique URL can be determined, only pass the tab title.
+  - Site-specific URL extraction for known services.
+
+---
+
+## 💡 Backlog
+
+*Ideas and feature requests under evaluation.*
+
+### In-room chat overlay (like TeleParty)
+
+- **Priority:** P3
+- **Category:** Social / Communication
+- **Background:** A collapsible chat panel to the right of the video (or as an overlay) allowing text-based communication with everyone in the room.
+- **Why backlog (still uncertain):**
+  - **Use case:** No strong personal need — with chat, latency matters less than with voice; async communication tolerates a few seconds of delay.
+  - **Complexity:** Relatively large feature (UI + message persistence + possibly history).
+  - **Legal/moderation:** Unclear what moderation requirements would apply if users can exchange chat messages. Could be relevant depending on jurisdiction.
+- **Status:** Under evaluation, may come later.
+
+---
+
+## ❌ Rejected
+
+*Declined features with rationale — keeps decisions documented so they don't get re-debated.*
+
+| Feature | Reason |
+|---|---|
+| *(none yet)* | |
+

-### 1. Split large JavaScript files (> 800 lines) into smaller modules
-* **Category**: Maintainability / AI Context Optimization
-* **Background**: Core files like `background.js` and `popup.js` have grown large and exceed 800 lines. This makes manual debugging harder and wastes context window space for AI models.
-* **Planned solution**:
-  - Structurally split logic into separate focused modules (e.g., UI Renderer, Message Router, Storage Manager, Socket Client).
-  - Use ES modules for clean separation and better reusability.
@@ -17,13 +17,15 @@ You MUST run the build script in any of the following scenarios:

 Run the Node.js build script from the repository root:
 ```bash
-node scripts/build-extension.js
+node scripts/build-extension.cjs
+# or simply:
+npm run build:extension
 ```

 ## What does it do?
 The build script performs the following actions:
 1. Synchronizes protocol constants by copying `shared/constants.js`, `shared/blacklist.js`, and `shared/README.md` into `extension/shared/`.
-2. Injects `EVENTS` and `HEARTBEAT_INTERVAL` into `content.js` via marker-based replacement.
+2. Injects `EVENTS`, `HEARTBEAT_INTERVAL`, and `episode-utils.js` functions (`extractEpisodeId`, `sameEpisode`) into `content.js` via marker-based replacement.
 3. Compiles browser-specific manifest files.
 4. Packages the final ready-to-publish extension artifacts for Chrome and Firefox into the `dist/` directory.

@@ -4,19 +4,19 @@ This document tracks which streaming platforms and media servers have been teste

 | Service | Sync Works | Media Title | Episode Auto-Sync | Notes |
 |---------|:----------:|:-----------:|:-----------------:|-------|
-| **YouTube** | ✅ Full | ✅ Full | ❌ | Best-in-class support. Native player API, reliable title detection. |
-| **Twitch** | ✅ Full | ✅ Full | ❌ | Live-only platform. Tested on regular streams. |
-| **Netflix** | ✅ Full | ⚠️ Hidden | ⚠️ Manual | Sync works perfectly, but DRM prevents media title detection. Episode transitions may require manual lobby. |
-| **Emby** | ✅ Full | ✅ Full | ✅ Full | Self-hosted. Full HTML5 player access. |
-| **Jellyfin** | ✅ Full | ✅ Full | ✅ Full | Self-hosted. Full HTML5 player access. |
-| **Plex** | Not tested | Not tested | Not tested | Community reports indicate compatibility via HTML5 player mode. |
-| **Disney+** | Not tested | Not tested | Not tested | Widevine DRM may restrict title detection similar to Netflix. |
-| **Prime Video** | ⚠️ Partial | ⚠️ Partial | ❌ | Video elements detected (2 on page, picks larger one). Playback state + time readable. However, the preview/trailer video may be selected instead of the main content. Play/Pause commands may not reach the correct player. Title detection from MediaSession API may work for some content. |
+| **YouTube** | ✅ Full | ✅ Full | ❌ | Individual videos, not episodes — no episode auto-sync. |
+| **Twitch** | ✅ Full | ✅ Full | ❌ | Individual streams/VODs, not episodes — no episode auto-sync. |
+| **Netflix** | ✅ Full | ❌ | ❌ | No media title exposed. |
+| **Emby** | ✅ Full | ✅ Full | ✅ Full | Best-in-class support. |
+| **Jellyfin** | ✅ Full | ✅ Full | ✅ Full | — |
+| **Plex** | Not tested | Not tested | Not tested | — |
+| **Disney+** | ✅ Full | ⚠️ Partial | ❌ | Series title only (e.g. "The Simpsons"), no episode info. |
+| **Prime Video** | ✅ Full  | ✅ Full  | ❌ | — |
 | **HBO Max / Max** | Not tested | Not tested | Not tested | — |
 | **Crunchyroll** | Not tested | Not tested | Not tested | — |
 | **Vimeo** | Not tested | Not tested | Not tested | — |
 | **Dailymotion** | Not tested | Not tested | Not tested | — |
-| **ARD / ZDF Mediathek** | Not tested | Not tested | Not tested | German public broadcasters. HTML5 players expected to work. |
+| **ARD / ZDF Mediathek** | Not tested | Not tested | Not tested | — |

 ## Legend

@@ -39,7 +39,7 @@ Tested a service that's not listed? Found different behavior than documented?
 KoalaSync works on any website with a **standard HTML5 `<video>` element** that allows script injection. 

 Limited functionality on certain platforms is typically caused by:
- **DRM/Copy Protection** (e.g., Widevine on Netflix, Disney+) which restricts access to media metadata like title and playback state
+- **DRM/Copy Protection** (e.g., Widevine on Netflix) which restricts access to media metadata like title and playback state
 - **Shadow DOM encapsulation** that hides video elements from content scripts
 - **Strict Content Security Policies** (CSP) that block script injection

@@ -0,0 +1,121 @@
+# KoalaSync Translation & Localization Guide
+
+Welcome to the **KoalaSync** translation guide. We rely on the open-source community to make KoalaSync accessible to users worldwide.
+
+KoalaSync is split into two independent translation areas. You can translate either one, or both:
+
+1. **The Browser Extension** (`extension/locales/`): The core product that users interact with daily.
+2. **The Website** (`website/locales/`): The landing page and invitation bridge.
+
+---
+
+## Supported Languages Dashboard
+
+We divide supported languages into two tiers: **Core Languages** (fully hand-crafted and audited by native speakers) and **Extended Languages** (auto-generated using translation models to expand initial coverage).
+
+> [!TIP]
+> **Help Us Improve!**
+> We welcome community contributions to audit `Auto-Generated` translations and elevate them to `100% Manually Verified` status.
+
+| Language Code | Language Name | Verification Status | Rationale / Context |
+| :--- | :--- | :--- | :--- |
+| `en` | **English** | `100% Manually Verified` | Global default language (verified by developer) |
+| `de` | **German** | `100% Manually Verified` | Developer's native language |
+| `fr` | **French** | `Auto-Generated` | Needs manual native review and polishing |
+| `es` | **Spanish** | `100% Manually Verified` | Manual native review by Alenia Studios |
+| `pt-BR` | **Portuguese (Brazil)** | `100% Manually Verified` | Manual native review by Alenia Studios |
+| `ru` | **Russian** | `Auto-Generated` | Needs manual native review and polishing |
+| `it` | **Italian** | `100% Manually Verified` | Manual native review by Alenia Studios |
+| `pl` | **Polish** | `Auto-Generated` | Needs manual native review and polishing |
+| `tr` | **Turkish** | `Auto-Generated` | Needs manual native review and polishing |
+| `nl` | **Dutch** | `Auto-Generated` | Needs manual native review and polishing |
+| `ja` | **Japanese** | `Auto-Generated` | Needs manual native review and polishing |
+| `ko` | **Korean** | `Auto-Generated` | Needs manual native review and polishing |
+| `pt` | **European Portuguese** | `100% Manually Verified` | Manual native review by Alenia Studios |
+| `zh` | **Chinese (Simplified)** | `Auto-Generated` | Needs manual native review and polishing |
+| `uk` | **Ukrainian** | `Auto-Generated` | Needs manual native review and polishing |
+
+> [!WARNING]
+> **Autogeneration Quality Rule**
+> Any newly contributed languages must be marked as `Auto-Generated` in this table until fully reviewed and signed off by a native speaker in a pull request.
+
+---
+
+## How to Translate KoalaSync
+
+Here is the exact step-by-step process for contributing translations.
+
+### Step 1: Fork and Clone the Repository
+
+If you are an external contributor, start with the standard open-source workflow:
+
+1. Click the "Fork" button on GitHub to create your own copy of the repository.
+2. Clone your fork locally: `git clone https://github.com/YOUR-USERNAME/KoalaSync.git`
+3. Create a branch: `git checkout -b translation/my-language`
+
+### Step 2: Translate the Extension
+
+The browser extension handles real-time syncing, settings, and popups.
+
+1. Navigate to `extension/locales/`.
+2. Edit an existing `[lang].json` or copy `en.json` to create a new one (for example, `it.json`).
+3. Translate all string values. **Do not change the JSON keys.**
+
+### Step 3: Translate the Website
+
+The website hosts the landing page and invitation bridge.
+
+1. Navigate to `website/locales/`.
+2. Edit an existing `[lang].json` or copy `en.json` to create a new one.
+3. Translate all string values. **Do not change the JSON keys.**
+4. If creating a brand new language, configure the metadata at the top of your JSON file:
+
+```json
+{
+  "LANG_CODE": "it",
+  "HTML_CLASS": "lang-it",
+  "CANONICAL_PATH": "it/",
+  "LANG_TOGGLE_URL": "../",
+  "LANG_TOGGLE_TEXT": "EN"
+}
+```
+
+5. If creating a brand new language, register it in `website/build.cjs` by adding it to the `languages` array.
+
+### Step 4: Verify Locally
+
+Ensure your JSON files are valid and all keys match the English baseline. Open your terminal in the KoalaSync root folder and run:
+
+```bash
+# Tests the extension locales for missing keys or syntax errors
+node scripts/test-locales.cjs
+
+# Tests the website locales for missing keys or syntax errors
+node scripts/test-website-locales.mjs
+
+# Builds the website with your new translations
+node website/build.cjs
+```
+
+If you receive any errors about missing keys or placeholder strings, fix them before submitting.
+
+### Step 5: Commit and Pull Request
+
+1. Open this `TRANSLATION.md` file and add or update your language in the **Supported Languages Dashboard** above. Mark it as `100% Manually Verified` only if it has been reviewed by a native speaker.
+2. Commit your changes: `git commit -m "Update Italian translations"`
+3. Push to your fork: `git push origin translation/my-language`
+4. Open a pull request on the main KoalaSync repository on GitHub.
+
+---
+
+## Strict Legal Exclusion Rule
+
+Our legal pages have strict constraints to protect user privacy and avoid regulatory liabilities.
+
+> [!IMPORTANT]
+> **Do Not Translate Legal Documents**
+> The legal notice (`website/impressum.html`) and privacy policy (`website/datenschutz.html`) **MUST remain exclusively in English and German**.
+>
+> **Rationale:** Legal compliance under the European Union General Data Protection Regulation (GDPR) and the German Digital Services Act (DDG). Offering automated translations of legally binding notices introduces compliance risks due to potential mistranslations of liability limits.
+>
+> **Technical fallback:** Our system automatically falls back to English for legal pages if a user visits them in an unsupported language, so you do not need to translate them.
@@ -0,0 +1,51 @@
+# DevOps Release Workflow
+
+This document describes the deployment and release process for KoalaSync.
+
+## Tag-Based Releases
+
+KoalaSync uses a fully automated release pipeline triggered by Git tags. 
+
+> [!IMPORTANT]
+> **DO NOT** manually bump the version numbers in any files (such as `package.json`, `manifest.base.json`, `shared/constants.js`, etc.) before creating a release. 
+> Bumping versions manually is redundant, leads to conflicts, and is completely handled by the CI/CD pipeline.
+
+### How it Works
+
+When you push a Git tag matching `v*` (e.g., `v2.5.1`), the GitHub Actions release workflow (`.github/workflows/release.yml`) is triggered. The workflow performs the following actions:
+
+1. **Extracts the version** from the tag (e.g., `2.5.1` from `v2.5.1`).
+2. **Injects the version** automatically into the following files:
+   - `extension/manifest.base.json`
+   - `shared/constants.js` (updates `APP_VERSION`)
+   - `package.json`
+   - `website/version.json`
+   - `website/template.html` (updates `softwareVersion` schema)
+   - `README.md` (updates badge and announcement banner)
+   - `website/sitemap.xml` (updates `lastmod` dates)
+3. **Commits and pushes** these version updates back to the `main` branch automatically with the commit message `chore(release): update versions to vX.X.X [skip ci]`.
+4. **Builds the extension** for both Chrome and Firefox and publishes the zipped archives.
+5. **Builds the website** and uploads website artifacts.
+6. **Builds and publishes** the Docker image for the relay server to the GitHub Container Registry (`ghcr.io`).
+
+---
+
+## Steps to Deploy a New Release
+
+To release a new version (e.g., `v2.5.1`), follow these steps:
+
+1. Make sure your local repository is synced on `main`:
+   ```bash
+   git checkout main
+   git pull origin main
+   ```
+2. Create a local Git tag:
+   ```bash
+   git tag v2.5.1
+   ```
+3. Push the tag to GitHub:
+   ```bash
+   git push origin v2.5.1
+   ```
+
+The release pipeline will take care of the rest! You can monitor the progress under the **Actions** tab of the GitHub repository.
@@ -0,0 +1,118 @@
+# Co-Host (Multi-Controller) — Implementation Plan
+
+Branch base: `feature/host-control-mode` (builds directly on it).
+Goal: let the room owner grant **playback control to several peers** (co-hosts), not
+just one — e.g. 4 of N people in a room may drive play/pause/seek, the rest are guests.
+
+This is the second server-gated feature the `capabilities` hook was designed for
+(`CAPABILITIES.CO_HOST = 'co-host'`, already stubbed in `shared/constants.js`).
+
+---
+
+## 1. Roles
+
+| Role | Can drive (play/pause/seek/force-sync/episode-lobby) | Can promote/demote + toggle mode |
+|------|------|------|
+| **Owner** (room creator, = today's "host") | yes (always a controller) | **yes** |
+| **Controller** (co-host) | yes (in `host-only` mode) | no |
+| **Guest** | only in `everyone` mode | no |
+
+The single-host feature is just the special case `controllers = { owner }`.
+
+## 2. Data model
+
+### Server (`room` object)
+- `ownerPeerId` — the creator / manager. Keep `hostPeerId` as an **alias** (= ownerPeerId)
+  so older clients keep working.
+- `controllers: Set<peerId>` — peers allowed to drive. **Always contains ownerPeerId.**
+- `controlMode: 'everyone' | 'host-only'` — unchanged wire values (`'host-only'` now means
+  "restricted to controllers", not "single host").
+- `MAX_CONTROLLERS` cap (e.g. 10) to bound the set + payload.
+
+### Shared constants
+- `CAPABILITIES.CO_HOST = 'co-host'` (un-stub it) → add to `SERVER_CAPABILITIES`.
+- New events:
+  - `SET_PEER_ROLE` (client→server): `{ peerId, controller: boolean }` — owner promotes/demotes.
+  - Extend `CONTROL_MODE` (server→client) payload: `{ controlMode, ownerPeerId, hostPeerId, controllers: [peerId...] }`.
+- `ROOM_DATA` gains `ownerPeerId` + `controllers`.
+
+## 3. Gate generalization (the core change)
+
+Today the gate compares against a single `hostPeerId`. Generalize to set membership:
+
+- **Server relay gate** (`server/index.js`): `controlMode === 'host-only' && !room.controllers.has(mapping.peerId)` → drop. (Was `mapping.peerId !== room.hostPeerId`.)
+- **Background gates** (sender + receiver): replace `amHost()` / `senderId !== hostPeerId`
+  with controller-set membership: `controllers.includes(myPeerId)` / `senderId ∈ controllers`.
+- **Helpers:** split `amHost()` into `amOwner()` (manage rights) and `amController()`
+  (drive rights). The desync/snap-back path keys on `!amController()` instead of `!amHost()`.
+
+`SET_PEER_ROLE` handler (server): validate sender is owner, target is a current peer in the
+room, enforce `MAX_CONTROLLERS`, always keep owner in the set, then broadcast `CONTROL_MODE`
+with the new `controllers`.
+
+## 4. Client + UI
+
+- **Owner** sees the peer list with a per-peer **"Controller" toggle** (promote/demote) plus
+  the existing mode toggle.
+- **Controllers** see a "Controller" badge and are NOT locked out of the remote-control buttons.
+- **Guests** see "Guest" + the host-only notice (unchanged).
+- The promote UI + co-host badges render only when the relay advertises the `co-host`
+  capability (feature detection, same pattern as `hostControlSupported`).
+- i18n: new keys (`ROLE_CONTROLLER`, `BTN_PROMOTE`, `BTN_DEMOTE`, …) across all locales.
+
+## 5. Backwards compatibility
+
+- **New client + old server** (host-control only, no `co-host` capability): no co-host UI;
+  behaves as today's single-host. ✓
+- **Old client + new server**: ignores `controllers` / `SET_PEER_ROLE`. An old client that
+  the owner promotes still **gates itself** (its sender-gate only knows `!amHost`), so it
+  can't drive — it degrades to a guest. Co-host requires a client that understands
+  `controllers`. Document this; not a crash. ✓
+- No `PROTOCOL_VERSION` bump needed — purely additive, same as host-control.
+
+## 6. Edge cases
+- **Controller leaves** → `removePeerFromRoom` also does `room.controllers.delete(peerId)`.
+- **Owner leaves** → fallback: promote the earliest remaining **controller** to owner (prefer
+  a controller over a random peer); if none, earliest peer; keep the rest of the set. Reuse
+  the `peerJoinLocks` guard so a reconnect/second-tab doesn't demote (same fix as host).
+- **Promote a peer not in the room** → server rejects (target must be a live peer).
+- **Promote beyond `MAX_CONTROLLERS`** → server rejects, re-syncs the owner's UI.
+- **`everyone` mode** → the `controllers` set is still maintained (so flipping to `host-only`
+  keeps the chosen co-hosts), it just isn't enforced while in `everyone`.
+- **peerId spoofing** → unchanged accepted limitation (see `docs/KNOWN_LIMITATIONS.md`);
+  co-host doesn't widen it materially (still bounded to a temporary room).
+
+## 7. Scale: the "4 of 510 people" part — read this
+
+The role change above is moderate. **Putting 510 people in one room is a separate, larger
+problem** and should be its own track:
+
+- `MAX_PEERS_PER_ROOM` is **25** today. 510 needs a large raise + load testing.
+- **The real bottleneck at scale is heartbeat fan-out, not control events.** Every peer
+  heartbeats and the relay broadcasts each to all peers → O(N²) per interval. At 510 that's
+  ~510×509 / 15s ≈ **17k msg/s just for heartbeats** — the scaling wall.
+- **Co-host actually *helps* the control-event side:** in `host-only` mode only the few
+  controllers emit play/pause/seek, so event *sources* drop from N to K (e.g. 4). Restricting
+  who can drive is synergistic with big rooms.
+- Large rooms therefore need (independent of co-host):
+  - **Heartbeat fan-out reduction** — e.g. only relay controller/owner heartbeats to everyone,
+    relay guest heartbeats only to the owner/controllers (for the UI), or server-side
+    aggregation into periodic snapshots instead of per-peer relay.
+  - **`ROOM_DATA` payload trimming** — a 510-entry peer list is large; send counts + controller
+    details, lazy-load the full roster.
+  - Possibly the **socket.io Redis adapter** for horizontal scaling, and broadcast tuning.
+
+## 8. Effort estimate
+- **Co-host roles** (server gate generalization + `SET_PEER_ROLE` + owner-leave fallback +
+  client gates + promote UI + i18n), at the current ≤25-peer scale: **~3–4 dev days** (same
+  shape as host-control itself — mostly generalizing host→controller-set).
+- **Large-room scaling (510)**: a **separate ~1–2 week** track (heartbeat redesign + payload
+  trimming + cap raise + load testing), independent of co-host. Recommend shipping co-host at
+  the current cap first, then scaling rooms as its own project.
+
+## 9. Suggested sequencing
+1. `CAPABILITIES.CO_HOST` + `controllers`/`ownerPeerId` in room state + `ROOM_DATA` (additive).
+2. Server `SET_PEER_ROLE` + gate generalization + owner-leave fallback + WS tests.
+3. Background: controller-set membership in both gates + `amOwner`/`amController`.
+4. Popup: promote/demote toggles (owner) + Controller badge + i18n.
+5. (Separate track) large-room scaling.
@@ -0,0 +1,283 @@
+# Host Control Mode — Branch Overview, Goals & Edge Cases
+
+> **This is the canonical entry-point doc for branch `feature/host-control-mode`.**
+> If you're an agent or contributor picking this up: read this file first, then the
+> implementation plan in [`host-control-mode-plan.md`](./host-control-mode-plan.md).
+> Temporary working doc — delete or fold into permanent docs before merging to `main`.
+>
+> Status legend: 🔴 open / unresolved · 🟡 idea, needs testing · 🟢 decided
+
+---
+
+## 0. Implementation status
+
+All five layers are implemented & pushed (server + background + content + popup + i18n).
+Automated checks green: ESLint, WS integration tests (incl. host-only gate, toggle
+reject, host-leave fallback), content video-finder, locale consistency (15 langs),
+full release verification.
+
+**Still needs real-device testing** — the EC test matrix in §7 (YouTube/Netflix/
+Twitch/Disney+/Jellyfin): involuntary-pause classification (EC-1/EC-5/EC-8), snap-back
+reliability and fight-loops (EC-4), and the desync/resync flow across players. The
+intent classifier (EC-9) and snap-back cooldown are first-pass heuristics tuned by
+reading the code, not yet by watching them behave on each site.
+
+Deferred by decision (see §8): host grace period on disconnect (EC-10).
+
+### Capability detection (forward-compat hook)
+The relay advertises `capabilities: ['host-control']` in `ROOM_DATA`
+(`SERVER_CAPABILITIES` in server, `CAPABILITIES` in shared/constants). The client
+enables host-control UI/behavior only when the flag is present, so the feature
+degrades cleanly on an older relay (absent → off) and old clients ignore the
+field. This is the extensible hook for the planned **co-host** feature (owner
+promotes guests to additional controllers): it will add a `'co-host'` capability
+ events without a protocol bump or breaking older relays/clients. Add new flags
+to `CAPABILITIES` / `SERVER_CAPABILITIES` as features land.
+
+### Pre-test self-audit (fixed)
+- **Popup remote buttons froze for guests** — in host-only a guest's Play/Pause/SYNC
+  click was gated server-side but the button stuck on "Playing"/disabled with no
+  feedback. Now the remote controls are locked (disabled + tooltip) for guests, with
+  backstop guards in the handlers. (popup.js)
+- **Desync dialog could break under strict CSP** — it used `innerHTML` with inline
+  `style=""` attributes, which Netflix/YouTube/Disney+ strip via `style-src`. Rebuilt
+  with the DOM API (CSSOM `.style` is CSP-safe) inside a **Shadow DOM** so page CSS
+  can't restyle/hide it. (content.js)
+- **Live-DVR not detected (EC-15)** — `duration === Infinity` misses Twitch/YouTube
+  live-DVR (finite, sliding duration). Added a `seekable.start(0) > 1` sliding-window
+  heuristic in `hcmIsLive()`. (content.js)
+
+### Pre-test self-audit
+- ~~**EC-4/EC-1 snap-back thrash:**~~ FIXED — implemented the **buffer-aware deferred
+  snap-back** (`hcmDeferredSnapBack`): on an involuntary event, if the player isn't
+  ready (`readyState<3` or seeking) we wait (poll, 8s cap) until it can play, then snap
+  ONCE to the host's re-queried position instead of repeatedly fighting the buffer.
+  Done defensively/player-agnostically — we can't enumerate every site, so this is safe
+  whether a player fires `pause()` or only `waiting`. Aborts if the user goes solo or is
+  no longer a gated guest; single pending poll (no stacking).
+- ~~**Control-mode race at join:**~~ FIXED — `hcmHandleBlocked` now treats `HOST_BLOCKED`
+  as authoritative (adopts host-only/guest role) instead of re-checking local mode,
+  since background only sends it to gated guests.
+- ~~**Dialog/badge text is English-only**~~ FIXED — background resolves the strings
+  via GET_HCM_STRINGS (it has the i18n loader); content fetches them on init with
+  English fallback. 6 new keys (HCM_DIALOG_*/HCM_BADGE_*) across all 15 locales.
+
+---
+
+## 1. What this branch is for
+
+Origin: a GitHub feature request. When watching with larger groups, anyone can pause
+or seek and disrupt everyone else. The requester wants the room creator to optionally
+restrict control to a single **host**, the way Teleparty works — guests who try to
+pause get asked whether they want to pause *only their own* player (and desync), and
+otherwise get snapped back to the room's position.
+
+**Goal:** Add an optional per-room **Host Control Mode**. A room can be switched
+between:
+- **`everyone`** (default, current behavior): anyone can play/pause/seek for the room.
+- **`host-only`**: only the host drives the room. A guest's deliberate play/pause/seek
+  is not broadcast; instead they're snapped back to the room position — unless they
+  explicitly choose to desync (go solo) with a "Resync" escape hatch.
+
+## 2. Trust model (read this before over-engineering)
+
+This is **client-side trust, by design**. It's a watch party, not a security boundary.
+The point is preventing *accidental* and *casual* disruption, not stopping someone
+determined to patch their own extension. We do **not** add auth, tokens, or
+cryptographic host identity. `peerId` is unauthenticated and that's fine here.
+
+(We still gate server-side as the robust chokepoint — see plan — but that's about
+killing spam reliably, not about defeating a hostile client.)
+
+## 3. Scope / non-goals
+
+In scope:
+- Host designation (first joiner = host), mode toggle, host-only gating of all
+  room-moving events, guest snap-back, deliberate-desync flow + resync, host UI.
+
+Explicit non-goals (for this branch):
+- Authenticated / spoof-proof host identity.
+- Persistent host across server restarts (room state is in-memory).
+- Syncing around personalized ad breaks.
+- Host transfer UI (auto-fallback to `everyone` when host leaves; manual transfer
+  is a possible later add).
+
+## 4. Architecture summary
+
+Three-layer gate for room-moving events from a non-host in host-only mode
+(`PLAY`, `PAUSE`, `SEEK`, `FORCE_SYNC_PREPARE`, `FORCE_SYNC_EXECUTE`, `EPISODE_LOBBY`):
+1. **Server** — doesn't relay them (robust chokepoint, kills spam regardless of client).
+2. **Sender (guest)** — doesn't emit; shows confirm dialog / disables host-only buttons.
+3. **Receiver** — drops any that slip through (covers old/buggy/modified clients).
+
+Snap-back reuses the existing `_setSuppress` mechanism (content.js:442) so applying
+the room state programmatically doesn't echo back as a new event. Target position is
+extrapolated from the host's last known state (±1s). Full detail + code hooks in the
+plan doc.
+
+---
+
+## 5. The central challenge
+
+Everything hard about this feature reduces to **one question** (see EC-9):
+
+> How do we reliably tell a **deliberate** guest pause/seek from an **involuntary**
+> player/browser event (buffering, ads, tab throttling, source swaps, DRM hiccups)?
+
+If we get this wrong, guests get spammed with desync dialogs and snap-back loops for
+things they never did. The host/role plumbing is the easy part; this classifier is the
+real work. **Design the intent-classifier before writing the gate.**
+
+---
+
+## 6. Edge cases
+
+### EC-1 🔴 Buffering / loading fires a `pause` event
+content.js listens to `play`/`pause`/`seeked`/`loadeddata` only (content.js:1000-1003),
+not `waiting`/`stalled`. Pure HTML5 buffering fires `waiting` → harmless. But custom
+players (Netflix/YouTube/Twitch/JW) often call `video.pause()` during buffering/ads →
+real `pause` → guest gate would mis-classify as deliberate. Sub-cases: (a) initial load
+sits paused, no event, fine; (b) mid-stream stall, player-dependent; (c) seek-induced
+re-buffering may outlast the suppress window and leak. Mitigation: `isBuffering` flag
+from `waiting`/`playing`, or grace window; in host-only the guest's own state is
+irrelevant so just ignore involuntary pauses and let catch-up logic (content.js:489)
+re-sync them.
+
+### EC-2 🟢 Force-Sync / Episode-Lobby abuse by guests
+Guest could seek + spam Force-Sync to drag everyone, or spam Episode-Lobby to pause
+everyone. Decision: host-only blocks guest *initiation* of `FORCE_SYNC_*` and
+`EPISODE_LOBBY`; guests may only respond (`FORCE_SYNC_ACK`, `EPISODE_READY`). Guests'
+legitimate path is the personal "Resync" button.
+
+### EC-3 🟢 Host leaves the room
+Fall back to `controlMode = 'everyone'`, broadcast `CONTROL_MODE`. Never a stuck locked
+room. (Auto-promote next peer deferred.)
+
+### EC-4 🔴 Snap-back fight loop (pause/play/skip back/pause/play)
+Mashing controls or a janky player → each snap-back may emit events → ping-pong.
+Mitigation: cooldown (~600ms) after snap-back; ensure snap-back runs fully under
+suppress. Also: if target is unreachable (seek past buffered range), retry K times then
+give up — no infinite loop.
+
+### EC-5 🔴 Ad breaks (YouTube/Twitch/…)
+Mid-roll ads pause/swap the media element, differ per peer → desync is unavoidable and
+must NOT spam the dialog. Probably covered by EC-1 buffering grace; flag for explicit
+testing.
+
+### EC-6 🟡 Snap-back target accuracy
+No continuous room clock; extrapolate from host's `currentTime` + `lastHeartbeat`
+(±1s, worse if stale). The follow-up host correction must also be suppressed so it
+doesn't read as guest input.
+
+### EC-7 🟢 Old / buggy / modified guest client
+Covered by receiver-side + server-side gates.
+
+### EC-8 🔴 Tab throttling / background tab
+Backgrounding throttles timers and may pause media. There's existing
+`visibilityGraceUntil` handling for seeks (content.js:892). Confirm a
+background-induced pause isn't treated as deliberate in host-only; reuse the grace flag.
+
+### EC-9 🔴 What counts as "deliberate" — the central unresolved question
+Collapses EC-1/EC-5/EC-8. Candidate signals: `readyState`/`networkState`/`video.seeking`
+at event time; recent `waiting`; recent user gesture (`navigator.userActivation`,
+keydown/click); visibility/focus. Build one shared **intent-classifier** helper in
+content.js that all host-only gating flows through.
+
+### EC-10 🔴 Host brief disconnect / reconnect (network blip)
+Host's wifi drops for 3s and reconnects. With "host leaves → fallback to everyone",
+a blip would silently unlock the room and demote the host (peerId persists in
+chrome.storage so they rejoin with the same id, but the server already cleared
+`hostPeerId`). Mitigation idea: short **host grace period** (e.g. keep `hostPeerId`
+reserved for ~30s after disconnect; if the same peerId rejoins, restore host + mode).
+Needs the server reaper (server:644) and `removePeerFromRoom` (server:168) to cooperate.
+
+### EC-11 🔴 New guest joins mid-session in host-only mode
+On join they must (a) immediately sync to the host's current position without the host
+doing anything, and (b) see they're a guest in the UI. ROOM_DATA already carries peers;
+add `hostPeerId`/`controlMode` so a fresh client knows its role instantly. Verify the
+existing "newcomer syncs without waiting" path (content.js:542) still fires.
+
+### EC-12 🔴 Desync semantics — what does "solo" actually mean?
+When a guest chooses "pause only me", do they (a) fully ignore all subsequent host
+events until they Resync, or (b) keep receiving but not auto-applying? Define clearly.
+Proposed: full solo — ignore host play/pause/seek while desynced; Resync re-attaches and
+snaps to current host position. Also: what state does Resync land them in if the host is
+currently paused vs playing?
+
+### EC-13 🔴 Race: host flips to host-only exactly as a guest pauses
+Event ordering between `SET_CONTROL_MODE`/`CONTROL_MODE` and an in-flight guest `PAUSE`.
+The `seq` ordering helps, but define the tie-break. Likely: server is authoritative —
+once it has `host-only`, it drops the guest event regardless of client-side timing.
+
+### EC-14 🟡 Volume / mute / audio-options must NOT be gated
+Those are per-peer, not room control. The gate must target only play/pause/seek +
+forcesync/episode — not `PEER_STATUS` volume/mute fields. Easy to over-block; add a test.
+
+### EC-15 🔴 Live streams (Twitch live, live DVR)
+"Room timestamp" is fuzzy on live edge; seeking semantics differ. Decide whether
+host-only even makes sense for live, or degrade gracefully. Low priority but log it.
+
+### EC-16 🟡 Host's own involuntary events still drive the room
+If the host buffers and the player auto-pauses, that pause is "allowed" and pauses
+everyone. That's existing behavior, but in host-only it means the host's buffering
+stalls the whole room. Acceptable? Probably yes (host is authoritative), but note it.
+
+### EC-17 🟡 Server restart drops room state
+`hostPeerId`/`controlMode` are in-memory. After a server restart, whoever rejoins first
+becomes the new host and mode resets to `everyone`. Acceptable for now (non-goal), but
+document so it's not a surprise.
+
+### EC-18 🟡 Dialog dismissed without choosing
+Guest clicks away / presses Esc on the desync prompt. Default = treat as "No" → snap
+back. Make sure an un-answered dialog can't leave them in limbo (paused + not desynced +
+no dialog).
+
+### EC-19 🟡 Multiple video elements / element swap (SPA, ad → content)
+Players that swap the `<video>` element mid-session: re-attach handlers (content.js
+already re-binds on `loadeddata`) and make sure host-only gating follows the new element.
+
+### EC-20 🟡 Peer list shape (object vs legacy string)
+Throughout background.js peers may be objects or bare peerId strings
+(`typeof p === 'object' ? p.peerId : p`). All new `hostPeerId` comparisons must handle
+both forms, or we get a host that's never recognized.
+
+### EC-21 🟡 Mode toggle spam / rate limiting
+Host hammering the toggle → many `SET_CONTROL_MODE`. Covered by existing
+`checkEventRate` (server), but debounce in the UI and ignore no-op transitions.
+
+---
+
+## 7. Test matrix (fill in during dev)
+
+| Player            | Buffer→`pause`? | Ad behavior | Snap-back works? | Element swap? | Notes |
+|-------------------|-----------------|-------------|------------------|---------------|-------|
+| Generic HTML5     |                 |             |                  |               |       |
+| YouTube           |                 |             |                  |               |       |
+| Netflix           |                 |             |                  |               |       |
+| Twitch (VOD)      |                 |             |                  |               |       |
+| Twitch (live)     |                 |             |                  |               |       |
+| Disney+ / DRM     |                 |             |                  |               |       |
+| Jellyfin / Emby   |                 |             |                  |               |       |
+
+## 8. Decisions (audited)
+- [x] **Intent-classifier (EC-9):** A `pause`/`seek` is **involuntary** if ANY of:
+  `readyState < 3`, `video.seeking`, a `waiting` fired < ~1500ms ago (`isBuffering`
+  flag), inside `visibilityGraceUntil`, OR no own-tracked user gesture
+  (`Date.now() - lastUserGestureAt < 1000`, via capturing keydown/pointerdown — do
+  NOT use sticky `navigator.userActivation.hasBeenActive`). Bias: only *clearly*
+  involuntary is ignored; everything else = deliberate. **Note:** in host-only the
+  guest never broadcasts anyway, so this only decides dialog-vs-silent — a UX call,
+  not a room-integrity call. Start simple, tune later.
+- [x] **Host grace on disconnect (EC-10): NOT in v1.** Immediate fallback to
+  `everyone` (EC-3). A grace window risks a multi-second hard-lock if the host never
+  returns. Revisit as polish once the core flow works.
+- [x] **Desync semantics (EC-12): full solo.** Ignore host play/pause/seek while
+  desynced; Resync snaps to host position + adopts host play/pause state. Desync
+  auto-clears on new media/episode. Requires a persistent, obvious "You are desynced"
+  UI.
+- [x] **Snap-back cooldown (EC-4): until-settled, not fixed.** Suppress re-trigger
+  until `readyState>=3 && playing && |Δt|<tol`, hard-cap ~1500ms. Retry target up to
+  3×, then give up (no infinite loop).
+- [x] **Live streams (EC-15): degrade.** Disable the gate when
+  `video.duration === Infinity`. Caveat: live-DVR may report finite duration and slip
+  through — acceptable for v1.
@@ -0,0 +1,83 @@
+# Host Control Mode — Beta Testing Guide
+
+> Temporary doc for branch `feature/host-control-mode`. Remove before merge.
+> The feature needs the **server** half too — the official relay
+> (`wss://syncserver.koalastuff.net`) doesn't run it yet, so test against a beta
+> server first.
+
+## 1. Run the beta relay (Docker)
+
+The branch publishes the server image to GHCR under non-production tags
+(`:beta` = newest branch build, `:sha-<commit>` = immutable pin). `:latest` is
+never touched.
+
+```bash
+# Log in (the package is private → PAT with read:packages)
+echo "$GHCR_PAT" | docker login ghcr.io -u <your-gh-user> --password-stdin
+
+# Pull + (re)create — NOTE: `docker restart` does NOT pick up a new image,
+# you must remove and re-run (or use compose / Watchtower).
+docker pull ghcr.io/shik3i/koalasync:beta
+docker rm -f koala-beta 2>/dev/null || true
+docker run -d --name koala-beta -p 3000:3000 \
+  -e SERVER_SALT='choose-your-own-salt' \
+  ghcr.io/shik3i/koalasync:beta
+```
+
+To always run the newest beta automatically, point **Watchtower** at the
+container — it does the pull → recreate whenever `:beta` moves.
+
+The `OFFICIAL_SERVER_TOKEN` is baked into `shared/constants.js`, so no token env
+is needed. Set `SERVER_SALT` (used for room-password hashing).
+
+## 2. Connect the extension to it
+
+⚠️ The client **force-upgrades `ws://` to `wss://` for any non-localhost host**
+(see background.js "Upgraded to wss:// for remote host"). So a bare
+`ws://your-server:3000` will fail without TLS. Two options:
+
+- **Quick (no TLS):** SSH-tunnel the port so it counts as local:
+  ```bash
+  ssh -L 3000:localhost:3000 your-beta-server
+  ```
+  then in the popup → **Manual Connect / Advanced → Custom →** `ws://localhost:3000`.
+- **Proper:** put the container behind a TLS reverse proxy (Caddy does automatic
+  HTTPS) → `wss://beta.yourdomain`.
+
+Then create/join a room.
+
+## 3. ⚠️ Use two *new* clients
+
+Test with **two browser profiles both running this branch build** (load unpacked
+from `extension/`, or install the built zip). A stock release client as a guest
+will be correctly gated by the server but has none of the content-side code, so
+it silently desyncs with no dialog/snap-back — that's expected degradation, not a
+bug, but it looks like one during testing.
+
+## 4. Verification checklist
+
+| # | Step | Expect |
+|---|------|--------|
+| 1 | Create a room (host) | Host Control card shows **Host** + the toggle |
+| 2 | Second profile joins | Guest sees no card while mode is "everyone" |
+| 3 | Host enables "Only I can control" | Guest's Play/Pause/SYNC buttons lock; card shows **Guest** |
+| 4 | Guest presses pause/space on the video | Brief flicker, snaps back to host position |
+| 5 | Guest pauses again | Dialog: "Stay in sync" / "Watch on my own" |
+| 6 | Guest → "Watch on my own" | Persistent "Solo" badge; host's peer list shows **Solo** |
+| 7 | Guest → "Resync" | Snaps back to host; Solo badge clears on both sides |
+| 8 | Guest tries Force-Sync / seek spam | Nothing propagates to the room |
+| 9 | Host disables host-only | Card hides for guest; controls unlock |
+| 10 | Host leaves the room | Room falls back to "everyone"; a remaining peer becomes host |
+| 11 | Reload the guest's page while desynced | Still shows Solo (state survives reload) |
+| 12 | Switch the popup language | Dialog/badge text is localized |
+
+## 5. Capability detection
+
+The relay advertises `capabilities: ['host-control']` in `ROOM_DATA`. The client
+only enables the feature when that flag is present, so:
+- against this beta server → feature on;
+- against the old official server → feature cleanly hidden (no errors).
+
+This is the extensible hook for the planned **co-host** feature (owner promotes
+guests to additional controllers) — it'll add a `'co-host'` capability + events
+without breaking older relays/clients.
@@ -0,0 +1,122 @@
+# Host Control Mode — Implementierungsplan
+
+Branch: `feature/host-control-mode`
+Issue: GitHub feature request (wasserrutschentester) — nur Host darf den Raum steuern; Gäste werden zurückgesnappt oder gehen bewusst in Desync.
+
+## Ziel
+
+Ein Raum kann zwischen zwei Modi umgeschaltet werden:
+- **`everyone`** (Default, heutiges Verhalten): jeder kann play/pause/seek für alle auslösen.
+- **`host-only`**: nur der Host steuert den Raum. Pause/Seek eines Gasts wird **nicht** gebroadcastet; stattdessen snappt die eigene Extension den Gast zurück auf den Raum-Zustand — es sei denn, der Gast entscheidet sich bewusst für Desync.
+
+Trust-Modell: client-seitig durchgesetzt. Kein Token, keine Auth. Es geht um versehentliches Stören, nicht um Angriffsschutz.
+
+---
+
+## Datenmodell
+
+### Server (`server/index.js`, Room-Objekt ~Z.331)
+Room bekommt zwei neue Felder:
+```js
+room = {
+  ...,
+  hostPeerId: peerId,        // gesetzt beim Anlegen = erster Joiner
+  controlMode: 'everyone',   // 'everyone' | 'host-only'
+}
+```
+- In `ROOM_DATA` (~Z.418) mitschicken: `hostPeerId`, `controlMode`.
+- Neues Event `SET_CONTROL_MODE` (siehe unten): nur akzeptieren, wenn `senderPeerId === room.hostPeerId`. Server setzt `room.controlMode`, broadcastet die Änderung an alle.
+- **Host-Migration:** in `removePeerFromRoom` (~Z.168) — wenn der gehende Peer `hostPeerId` war: entweder neuen Host bestimmen (nächster Peer) **oder** `controlMode` auf `everyone` zurückfallen lassen. → Entscheidung: **Fallback auf `everyone`** (simpel, nie verwaister gesperrter Raum). Optional später: Host-Transfer-Button.
+
+### Shared Constants (`shared/constants.js`)
+Neue Events im `EVENTS`-Objekt:
+```js
+SET_CONTROL_MODE: "set_control_mode",   // Client->Server: Host ändert Modus
+CONTROL_MODE: "control_mode",            // Server->Client: Modus geändert { controlMode, hostPeerId }
+```
+⚠️ Danach `node scripts/build-extension.cjs` laufen lassen (Single Source of Truth propagieren). Ggf. `PROTOCOL_VERSION` bumpen — **nein, nur wenn alte Clients brechen würden**. Da alles additiv ist und alte Clients die neuen Felder/Events einfach ignorieren, ist KEIN Protokoll-Bump nötig. (Alter Client in host-only-Raum kennt den Modus nicht und sendet weiter → Host-Extensions ignorieren fremde Events nicht... → siehe Edge Case 7. Evtl. doch Bump erwägen.)
+
+### Extension State (`background.js`)
+```js
+let controlMode = 'everyone';
+let hostPeerId = null;
+// abgeleitet: const amHost = () => hostPeerId === peerId;
+```
+Aus `ROOM_DATA` / `CONTROL_MODE` befüllen, in `chrome.storage.session` persistieren (wie `currentRoom`).
+
+---
+
+## Implementierung nach Schichten
+
+### 1. Server (`server/index.js`)
+- [ ] Room-Objekt um `hostPeerId` + `controlMode` erweitern (~Z.331).
+- [ ] `ROOM_DATA`-Payload erweitern (~Z.418).
+- [ ] Handler `SET_CONTROL_MODE`: validieren (Host-Check + Wert in {everyone, host-only}), setzen, `CONTROL_MODE` an Raum broadcasten.
+- [ ] Host-Migration in `removePeerFromRoom`: Fallback auf `everyone` + neues `CONTROL_MODE` broadcasten, wenn Host geht.
+- [ ] `SET_CONTROL_MODE` in die `relayEvents`-Liste? **Nein** — eigener Handler, da Sonderlogik + Host-Check. (relayEvents broadcastet blind.)
+
+### 2. Shared / Build
+- [ ] `EVENTS.SET_CONTROL_MODE`, `EVENTS.CONTROL_MODE` ergänzen.
+- [ ] `node scripts/build-extension.cjs`.
+
+### 3. background.js (Gast-Logik = Kern)
+- [ ] `controlMode` / `hostPeerId` aus `ROOM_DATA` (~Z.875) und neuem `CONTROL_MODE`-Case übernehmen + persistieren + an Popup/Content pushen.
+- [ ] **Emit-Gate** im SEND-Pfad (~Z.1786): bei `host-only && !amHost()` und action ∈ {play, pause, seek}:
+      - NICHT `emit`en.
+      - Stattdessen Content-Script anweisen: "snap back" ODER Desync-Confirm anzeigen.
+- [ ] **Snap-Back-Zielzeit berechnen:** aus Host-Peer-State (`playbackState`, `currentTime`, `lastHeartbeat`) extrapolieren:
+      `targetTime = host.currentTime + (host.playbackState==='playing' ? (now - host.lastHeartbeat)/1000 : 0)`.
+      Genauigkeit ~±1s, für Watchparty ok. (Force-Sync-Maschinerie als Referenz für Ziel-Zeit-Koordination.)
+- [ ] Nachricht an content.js: `{ type: 'HOST_BLOCK', action, targetTime, hostPlaybackState }`.
+
+### 4. content.js (Player-Reaktion + Dialog)
+- [ ] Handler für `HOST_BLOCK`: Confirm-Dialog im Player-Overlay rendern:
+      "Pause only your own player and desync from the group? [Yes] [No]".
+      - **No** (Default): Player via bestehende `_setSuppress`-Mechanik ([content.js:442](../extension/content.js:442)) wieder in Raum-Zustand zwingen (play + seek auf targetTime). Suppress verhindert Re-Broadcast.
+      - **Yes:** lokal pausiert lassen, `isDesynced = true` setzen, dezenten "Desynced — Resync"-Button zeigen.
+- [ ] "Resync"-Button → snappt zurück auf aktuelle Raum-Zeit, `isDesynced = false`.
+- [ ] **Loop-Schutz:** nach einer Snap-Back-Aktion kurzes Cooldown-Fenster (z.B. 600ms), in dem weitere lokale pause/seek-Events nicht erneut den Dialog triggern (verhindert pause→play→pause-Pingpong).
+
+### 5. popup (Host-UI)
+- [ ] Host-Toggle "Only I can control" (nur sichtbar wenn `amHost()`), sendet `SET_CONTROL_MODE`.
+- [ ] Rollen-Badge: "Host" / "Guest" + aktueller Modus.
+- [ ] Gast-Hinweis wenn host-only aktiv: "The host controls playback".
+- [ ] i18n-Keys in `extension/_locales` / `locales` für ~15 Sprachen.
+
+---
+
+## Edge Cases (Test-Checkliste)
+
+1. **Pause nicht verhinderbar, nur revidierbar** → kurzer Flicker (~½s) beim Gast ist erwartet/akzeptabel.
+2. **Snap-Back-Zielzeit** aus Heartbeat extrapoliert, ±1s. Bei stark veraltetem Host-State (kein Heartbeat) → letzten bekannten Wert nehmen.
+3. **Kampf-Loop pause/play/skip back/pause/play** → Cooldown-Fenster nach Snap-Back. Testen mit aggressivem Mashing.
+4. **Desync-Escape:** Gast kann bewusst pausieren (Klo/Telefon) → "Yes" → solo, dann Resync.
+5. **Host verlässt Raum** → Fallback auf `everyone`, alle bekommen `CONTROL_MODE`-Update. Testen: Host schließt Tab / Disconnect / Netzabbruch.
+6. **host-only + Episode-Auto-Sync / Force-Sync** (server/index.js:503-516): **Gast darf NICHT initiieren.** Force-Sync trägt eine `targetTime` und zwingt ALLE darauf (background.js:1261) — ein Gast könnte seeken → Force-Sync spammen und damit host-only komplett aushebeln. Episode-Lobby pausiert ebenfalls alle. → Im host-only-Modus dürfen `FORCE_SYNC_PREPARE`/`FORCE_SYNC_EXECUTE` und `EPISODE_LOBBY` nur vom Host **initiiert** werden. Gäste dürfen weiterhin nur **reagieren**: `FORCE_SYNC_ACK`, `EPISODE_READY`. Gäste brauchen Force-Sync nicht — ihr legitimer Fall ist der "Resync"-Button (snappt nur sie selbst, nicht alle).
+7. **Alter Client (ohne Feature) in host-only-Raum** → kennt Modus nicht, sendet weiter pause/seek → andere Extensions wenden es an. Mitigation: Empfänger-seitiges Gate (host-only-Clients ignorieren play/pause/seek von Nicht-Host) ODER `MIN_VERSION`/Protokoll-Bump. → **Empfehlung: zusätzlich Empfänger-seitig filtern** (robuster als nur Sender-Gate).
+8. **Seek getrennt von Pause** → host-only blockt auch Gast-Seeks, nicht nur Pausen.
+9. **Mehrere Tabs / Multi-Peer mit gleicher peerId** (Dedup, server:381) → Host-Identität bleibt an peerId hängen, ok.
+10. **DAU-Verwirrung** "warum kann ich nicht mehr pausieren?" → klare UI-Botschaft + der Desync-Dialog erklärt sich selbst.
+
+## Architektur-Entscheidung zu Edge Case 7 (wichtig)
+Wir setzen das Gate **doppelt** und über **alle raum-verschiebenden Events**, nicht nur play/pause/seek:
+Geblockte Initiierungen für Nicht-Host im host-only-Modus:
+`PLAY`, `PAUSE`, `SEEK`, `FORCE_SYNC_PREPARE`, `FORCE_SYNC_EXECUTE`, `EPISODE_LOBBY`.
+Weiterhin erlaubt für Gäste (reine Reaktion, verschiebt niemanden): `FORCE_SYNC_ACK`, `EPISODE_READY`, `PEER_STATUS`, `PING`/`PONG`.
+
+- **Sender-seitig** (Gast sendet erst gar nicht) → saubere UX, Confirm-Dialog bei play/pause/seek; Force-Sync-/Episode-Lobby-Buttons im Gast-UI deaktiviert/ausgeblendet.
+- **Empfänger-seitig** (in `handleServerEvent`, background.js:969 + Force-Sync-/Episode-Cases): wenn `host-only` und `data.senderId !== hostPeerId` → Event verwerfen (nicht an Content routen, keine State-Mutation).
+So sind auch alte/buggy/manipulierte Clients abgedeckt, ohne harten Protokoll-Bump.
+
+Optional zusätzlich **server-seitig** in den `relayEvents` (server/index.js:445): im host-only-Modus Initiierungs-Events von Nicht-Host gar nicht erst relayen. Spart Traffic + deckt alles zentral ab. Empfehlenswert, da der Server `hostPeerId`/`controlMode` ohnehin kennt.
+
+---
+
+## Reihenfolge der Umsetzung (kleine, testbare Schritte)
+1. Constants + Build (Events da, nichts kaputt).
+2. Server: hostPeerId/controlMode + ROOM_DATA + SET_CONTROL_MODE + Migration.
+3. background.js: State übernehmen + Empfänger-seitiges Gate (Edge 7) — testbar ohne UI.
+4. background.js: Sender-seitiges Gate + Snap-Back-Zielzeit.
+5. content.js: Snap-Back-Apply + Confirm-Dialog + Loop-Cooldown.
+6. popup: Host-Toggle + Badge + i18n.
+7. Durchtesten der Edge-Case-Liste auf YT / Netflix / generischem HTML5-Player.
@@ -8,6 +8,7 @@ export default [
      sourceType: "module",
      globals: {
        chrome: "readonly",
+        browser: "readonly",
        window: "readonly",
        document: "readonly",
        navigator: "readonly",
@@ -36,8 +37,10 @@ export default [
        URL: "readonly",
        URLSearchParams: "readonly",
        WebSocket: "readonly",
+        history: "readonly",
+        location: "readonly",
        self: "readonly",
-        process: "readonly"
+        process: "readonly",
      }
    },
    rules: {
@@ -55,7 +58,7 @@ export default [
    }
  },
  {
-    files: ["server/**/*.js", "scripts/**/*.js", "website/build.js"],
+    files: ["server/**/*.js", "scripts/**/*.js", "scripts/**/*.cjs", "website/build.cjs"],
    languageOptions: {
      globals: {
        require: "readonly",
@@ -54,26 +54,51 @@ modules:
        path: '{.memory.heapTotal}'
        help: "V8 engine heap total in bytes"

+      # Rate limiter tracking — unique clients currently in each tracking window
+      # (not rate-limit denials; these include legitimate traffic too)
+
      - name: koalasync_rate_limit_connections
-        path: '{.rateLimitEntries.connections}'
-        help: "Number of entries tracked in the connection rate limiter"
+        path: '{.rateLimits.trackedClients.connections}'
+        help: "Unique clients tracked in the connection rate limiter window"

      - name: koalasync_rate_limit_events
-        path: '{.rateLimitEntries.events}'
-        help: "Number of entries in the event rate limiter"
+        path: '{.rateLimits.trackedClients.events}'
+        help: "Unique sockets tracked in the event rate limiter window"

      - name: koalasync_rate_limit_health
-        path: '{.rateLimitEntries.health}'
-        help: "Number of entries in the health rate limiter"
+        path: '{.rateLimits.trackedClients.health}'
+        help: "Unique IPs tracked in the health endpoint rate limiter window"

      - name: koalasync_rate_limit_admin_metrics_auth
-        path: '{.rateLimitEntries.adminMetricsAuth}'
-        help: "Number of entries in the admin metrics auth rate limiter"
+        path: '{.rateLimits.trackedClients.adminMetricsAuth}'
+        help: "Unique IPs tracked in the admin metrics auth rate limiter window"

      - name: koalasync_rate_limit_auth_failures
-        path: '{.rateLimitEntries.authFailures}'
-        help: "Number of entries in the authentication failures cache"
+        path: '{.rateLimits.trackedClients.authFailures}'
+        help: "Unique IPs tracked in the authentication failures cache"

      - name: koalasync_rate_limit_room_list
-        path: '{.rateLimitEntries.roomList}'
-        help: "Number of entries in the room list cooldown cache"
+        path: '{.rateLimits.trackedClients.roomList}'
+        help: "Unique sockets in the room list cooldown cache"
+
+      # Actual rate-limit denials — incremented only when a 429 is served
+
+      - name: koalasync_rate_limit_denied_connections
+        path: '{.rateLimits.denied.connections}'
+        help: "Total connection attempts denied by rate limiter"
+
+      - name: koalasync_rate_limit_denied_events
+        path: '{.rateLimits.denied.events}'
+        help: "Total socket events denied by rate limiter"
+
+      - name: koalasync_rate_limit_denied_health
+        path: '{.rateLimits.denied.health}'
+        help: "Total health endpoint requests denied by rate limiter"
+
+      - name: koalasync_rate_limit_denied_admin_metrics_auth
+        path: '{.rateLimits.denied.adminMetricsAuth}'
+        help: "Total admin metrics auth attempts denied by rate limiter"
+
+      - name: koalasync_rate_limit_denied_room_list
+        path: '{.rateLimits.denied.roomList}'
+        help: "Total room list refresh requests denied by rate limiter"
@@ -6,9 +6,9 @@ A Manifest V3 Browser Extension (Chrome & Firefox) for synchronized video playba
 - **Manifest V3**: Optimized Service Worker architecture with session persistence.
 - **Pure Vanilla JS**: No external dependencies or heavy libraries.
 - **Smart Peer IDs**: Hexadecimal IDs combined with customizable Usernames for easy identification.
- **Dual Heartbeat**: Advanced session tracking (Background) and video synchronization (Content) to prevent ghost sessions.
+- **On-Demand Connection**: The service worker only maintains a WebSocket connection while you're in a room. No persistent background connections — privacy-first architecture. Based on `connectIntent` flag that gates all reconnect attempts.
 - **Live Diagnostics**: Built-in "Dev" tab for real-time video state debugging (ReadyState, CurrentTime, etc.).
- **Dynamic i18n (Multi-Language)**: Fully localized in 6 languages (`en`, `de`, `fr`, `es`, `pt-BR`, `ru`) with auto-detected fallback and dynamic on-the-fly language selectors.
+- **Dynamic i18n (Multi-Language)**: Fully localized in 13 languages (`en`, `de`, `fr`, `es`, `it`, `pl`, `tr`, `nl`, `ja`, `ko`, `pt-BR`, `pt`, `ru`) with auto-detected fallback and dynamic on-the-fly language selectors.

 ## Tab Overview
 1. **Room**: Manage connections, view active peers, and share invitation links.
@@ -26,7 +26,7 @@ KoalaSync requires `<all_urls>` permission to detect and interact with video ele
 ## Installation
 1. **Prepare Extension**: From the repository root, run:
   ```bash
-   node scripts/build-extension.js
+   npm run build:extension
   ```
 2. Open Chrome and go to `chrome://extensions/`.
 3. Enable **Developer mode** (top right).
@@ -35,6 +35,18 @@ KoalaSync requires `<all_urls>` permission to detect and interact with video ele
 ## Development
 If you modify `shared/constants.js`, you must synchronize the changes by running the build script from the root:
 ```bash
-node scripts/build-extension.js
+npm run build:extension
 ```
 This ensures that the `extension/shared` folder is updated with the latest protocol constants.
+
+## Module Structure
+
+| File | Purpose |
+|---|---|
+| `background.js` | Service worker: message routing, tab listeners, startup |
+| `content.js` | Video detection, audio processing, episode transition (IIFE) |
+| `popup.js` | Popup UI: join/create, tabs, status, settings |
+| `bridge.js` | Landing page bridge (injected into sync.koalastuff.net) |
+| `episode-utils.js` | Shared `extractEpisodeId()` / `sameEpisode()` — used by background.js, injected into content.js at build time |
+| `i18n.js` | Translation loader |
+| `shared/` | Constants, blacklist, name generator |
@@ -0,0 +1,8 @@
+{
+  "appName": {
+    "message": "KoalaSync"
+  },
+  "appDesc": {
+    "message": "Synchronisiere die Videowiedergabe auf YouTube, Netflix, Emby, Jellyfin und jeder HTML5-Seite in Echtzeit mit Freunden."
+  }
+}
@@ -0,0 +1,8 @@
+{
+  "appName": {
+    "message": "KoalaSync"
+  },
+  "appDesc": {
+    "message": "Synchronize video playback on YouTube, Netflix, Emby, Jellyfin, and any HTML5 site in real-time with friends."
+  }
+}
@@ -0,0 +1,8 @@
+{
+  "appName": {
+    "message": "KoalaSync"
+  },
+  "appDesc": {
+    "message": "Mira videos junto a tus amigos en perfecta sincronización. Compatible con Netflix, YouTube, Twitch, Prime Video, Disney+ y cualquier reproductor HTML5."
+  }
+}
@@ -0,0 +1,8 @@
+{
+  "appName": {
+    "message": "KoalaSync"
+  },
+  "appDesc": {
+    "message": "Synchronisez la lecture vidéo sur YouTube, Netflix, Emby, Jellyfin et tout site HTML5 en temps réel avec vos amis."
+  }
+}
@@ -0,0 +1,8 @@
+{
+  "appName": {
+    "message": "KoalaSync"
+  },
+  "appDesc": {
+    "message": "Sincronizza la riproduzione video su YouTube, Netflix, Emby, Jellyfin e qualsiasi sito HTML5 in tempo reale con gli amici."
+  }
+}
@@ -0,0 +1,8 @@
+{
+  "appName": {
+    "message": "KoalaSync"
+  },
+  "appDesc": {
+    "message": "YouTube、Netflix、Emby、Jellyfin、その他HTML5サイトでの動画再生を友達とリアルタイムで同期します。"
+  }
+}
@@ -0,0 +1,8 @@
+{
+  "appName": {
+    "message": "KoalaSync"
+  },
+  "appDesc": {
+    "message": "YouTube, Netflix, Emby, Jellyfin 및 모든 HTML5 사이트에서 친구들과 실시간으로 비디오 재생을 동기화하세요."
+  }
+}
@@ -0,0 +1,8 @@
+{
+  "appName": {
+    "message": "KoalaSync"
+  },
+  "appDesc": {
+    "message": "Synchroniseer video-afspelen op YouTube, Netflix, Emby, Jellyfin en elke HTML5-site in realtime met vrienden."
+  }
+}
@@ -0,0 +1,8 @@
+{
+  "appName": {
+    "message": "KoalaSync"
+  },
+  "appDesc": {
+    "message": "Synchronizuj odtwarzanie wideo na YouTube, Netflix, Emby, Jellyfin i dowolnej stronie HTML5 w czasie rzeczywistym ze znajomymi."
+  }
+}
@@ -0,0 +1,8 @@
+{
+  "appName": {
+    "message": "KoalaSync"
+  },
+  "appDesc": {
+    "message": "Assista a vídeos junto com seus amigos em sincronia perfeita. Compatível com Netflix, YouTube, Twitch, Prime Video, Disney+ e qualquer player HTML5."
+  }
+}
@@ -0,0 +1,8 @@
+{
+  "appName": {
+    "message": "KoalaSync"
+  },
+  "appDesc": {
+    "message": "Veja vídeos em conjunto com os seus amigos em sincronia perfeita. Compatível com Netflix, YouTube, Twitch, Prime Video, Disney+ e qualquer leitor HTML5."
+  }
+}
@@ -0,0 +1,8 @@
+{
+  "appName": {
+    "message": "KoalaSync"
+  },
+  "appDesc": {
+    "message": "Синхронизируйте воспроизведение видео на YouTube, Netflix, Emby, Jellyfin и любых HTML5-сайтах в реальном времени с друзьями."
+  }
+}
@@ -0,0 +1,8 @@
+{
+  "appName": {
+    "message": "KoalaSync"
+  },
+  "appDesc": {
+    "message": "YouTube, Netflix, Emby, Jellyfin ve herhangi bir HTML5 sitesinde video oynatmayı arkadaşlarınızla gerçek zamanlı olarak senkronize edin."
+  }
+}
@@ -0,0 +1,8 @@
+{
+  "appName": {
+    "message": "KoalaSync"
+  },
+  "appDesc": {
+    "message": "Синхронізуйте відтворення відео на YouTube, Netflix, Emby, Jellyfin і будь-якому сайті HTML5 у режимі реального часу з друзями."
+  }
+}
@@ -0,0 +1,8 @@
+{
+  "appName": {
+    "message": "KoalaSync"
+  },
+  "appDesc": {
+    "message": "与朋友实时同步YouTube、Netflix、Emby、Jellyfin和任何HTML5网站上的视频播放。"
+  }
+}
@@ -126,17 +126,13 @@ function setCustomParam(param, value) {
 }

 async function init() {
-    let audioData = (await chrome.storage.local.get(['audioSettings'])).audioSettings;
-    const syncData = await chrome.storage.sync.get(['audioSettings', 'locale']);
-    if (!audioData && syncData.audioSettings) {
-        audioData = syncData.audioSettings;
-        await chrome.storage.local.set({ audioSettings: audioData });
-    }
-    const lang = syncData.locale || getSystemLanguage();
+    // Local-only: audioSettings/locale are never read from storage.sync.
+    const { audioSettings, locale } = await chrome.storage.local.get(['audioSettings', 'locale']);
+    const lang = locale || getSystemLanguage();
    await loadLocale(lang);
    translateDOM();

-    currentSettings = mergeAudioSettings(audioData);
+    currentSettings = mergeAudioSettings(audioSettings);
    render();
 }

@@ -55,6 +55,30 @@
    const MIN_SEEK_DELTA = 2.0;
    let lastReportedSeekTime = null;  // last currentTime we relayed as a SEEK
    let seekDebounceTimer = null;     // debounce timer for rapid seek events
+    let expectedSeekTime = null;      // strictly track programmatic seeks
+
+    // --- Play/Pause Coalescing (leading + trailing) ---
+    // Media players (HLS/DASH, ad insertion, ABR/quality switches, source swaps,
+    // page teardown) fire bursts of native play/pause events within a few hundred
+    // ms. Relaying each as a distinct command spams peers and the relay.
+    //
+    // Strategy: emit the FIRST event immediately (leading edge → a deliberate
+    // single play/pause has zero added latency), then hold a short window. If
+    // more play/pause events arrive during the window it's a burst — we suppress
+    // the intermediate churn and, once it settles, emit the FINAL state on the
+    // trailing edge.
+    //
+    // We deliberately do NOT dedup the trailing send against the leading one. A
+    // remote play/pause may be applied mid-window (e.g. I pause, peer plays, I
+    // pause again within 150ms): the settled state then equals my last *sent*
+    // state yet is a genuine change versus the now-shared state — suppressing it
+    // would desync. Re-sending an unchanged state is a harmless no-op on peers,
+    // so re-sending is always the safe choice. Echo-suppression and seek-flush
+    // still run synchronously on event arrival (see reportEvent) — only the
+    // network emit is governed here.
+    const PLAY_PAUSE_COALESCE_MS = 150;
+    let playPauseCoalesceTimer = null;  // non-null = a coalescing window is open
+    let pendingPlayPauseAction = null;  // last play/pause seen during the window, awaiting trailing flush

    // --- Episode Auto-Sync State ---
    let lastKnownMediaTitle = null;
@@ -65,25 +89,8 @@
    let _audioSettings = null;
    let _audioProcessingAllowed = true;

-    // Cache the autoSyncNextEpisode setting
+    // Cache the autoSyncNextEpisode setting (local-only; never read from sync)
    chrome.storage.local.get(['autoSyncNextEpisode', 'audioSettings'], (data) => {
-        if (data.autoSyncNextEpisode === undefined || data.audioSettings === undefined) {
-            chrome.storage.sync.get(['autoSyncNextEpisode', 'audioSettings'], (syncData) => {
-                const migrate = {};
-                if (data.autoSyncNextEpisode === undefined && syncData.autoSyncNextEpisode !== undefined) {
-                    migrate.autoSyncNextEpisode = syncData.autoSyncNextEpisode;
-                }
-                if (data.audioSettings === undefined && syncData.audioSettings !== undefined) {
-                    migrate.audioSettings = syncData.audioSettings;
-                }
-                if (Object.keys(migrate).length) chrome.storage.local.set(migrate);
-                _autoSyncEnabled = syncData.autoSyncNextEpisode !== false;
-                _audioSettings = mergeAudioSettings(syncData.audioSettings);
-                const v = findVideo();
-                if (v && _audioProcessingAllowed) applyAudioSettings(v, _audioSettings);
-            });
-            return;
-        }
        _autoSyncEnabled = data.autoSyncNextEpisode !== false;
        _audioSettings = mergeAudioSettings(data.audioSettings);
        const video = findVideo();
@@ -95,6 +102,306 @@
        }
    });

+    // --- Host Control Mode (guest-side) ---
+    // When a room is in 'host-only' mode and we're a guest, a deliberate local
+    // pause/seek must not drive the room (background/server already drop it). Here
+    // we handle the *local* UX: snap back to the host's position, or — if the user
+    // really wants to — let them go solo (desync) with a resync escape hatch.
+    let hcmControlMode = 'everyone';   // mirror of room control mode
+    let hcmAmController = false;        // are we allowed to drive (owner or co-host)?
+    let hcmHostPeerId = null;          // last known host peerId (room/host identity)
+    let hcmDesynced = false;           // user chose to go solo
+    let hcmSnapBackCooldownUntil = 0;  // suppress re-trigger right after a snap-back
+    let hcmDeferredSnapPending = false; // a buffer-aware snap-back is waiting for readiness
+    let hcmLastUserGestureAt = 0;      // for deliberate-vs-involuntary classification
+    let hcmBufferingUntil = 0;         // set on 'waiting' — buffering grace window
+    let hcmDialogTimer = null;         // 8s auto-stay timer — cleared on dialog replace (H-4)
+    // Localized strings for the in-page dialog/badge (content has no i18n loader;
+    // background resolves them via GET_HCM_STRINGS on init). English fallbacks here.
+    const hcmStrings = {
+        title:  'KoalaSync · Host controls this room',
+        body:   'Only the host can control playback in this room. Keep watching together, or watch on your own?',
+        stay:   'Stay in sync',
+        solo:   'Watch on my own',
+        badge:  'Watching on your own',
+        resync: 'Resync'
+    };
+    const HCM_USER_GESTURE_MS = 1000;
+    const HCM_BUFFERING_GRACE_MS = 1500;
+    const HCM_SNAP_BACK_COOLDOWN_MS = 1000;
+    const HCM_BUFFER_WAIT_MS = 8000;   // cap on waiting for a buffering player before snapping anyway
+
+    // Track genuine user input so we can tell a deliberate pause/seek from a
+    // player-/browser-initiated one. Capturing + passive so we never interfere.
+    const _hcmGesture = () => { hcmLastUserGestureAt = Date.now(); };
+    document.addEventListener('keydown', _hcmGesture, { capture: true, passive: true });
+    document.addEventListener('pointerdown', _hcmGesture, { capture: true, passive: true });
+
+    function hcmIsGuestGated() {
+        return hcmControlMode === 'host-only' && !hcmAmController;
+    }
+
+    // EC-9 intent classifier: only a *clearly deliberate* guest action triggers the
+    // dialog/snap-back. Anything that smells involuntary (buffering, seeking, tab
+    // refocus, no recent gesture) is treated as involuntary. Bias intentional —
+    // in host-only the guest never broadcasts anyway, so this only tunes UX.
+    function hcmClassifyIntent() {
+        const video = findVideo();
+        if (!video) return 'involuntary';
+        if (hcmIsLive(video)) return 'live';                   // EC-15: degrade, don't gate
+        if (video.readyState < 3) return 'involuntary';        // buffering / not enough data
+        if (video.seeking) return 'involuntary';
+        if (Date.now() < hcmBufferingUntil) return 'involuntary';
+        if (Date.now() < visibilityGraceUntil) return 'involuntary';
+        if (Date.now() - hcmLastUserGestureAt > HCM_USER_GESTURE_MS) return 'involuntary';
+        return 'deliberate';
+    }
+
+    // Live detection (EC-15 + DVR). Pure live reports duration Infinity/NaN. Live-DVR
+    // (Twitch/YouTube-live with rewind) reports a *finite, sliding* duration — its
+    // seekable window doesn't start at 0, which we use as the DVR signal.
+    function hcmIsLive(video) {
+        // Don't trust duration before metadata has loaded (readyState >= 1) —
+        // otherwise pre-loaded videos report NaN and get misclassified as live,
+        // which suppresses the desync dialog (L-2).
+        if (video.readyState < 1) return false;
+        if (!Number.isFinite(video.duration)) return true;
+        try {
+            const s = video.seekable;
+            if (s && s.length > 0 && s.start(0) > 1) return true; // sliding DVR window
+        } catch (_e) { /* seekable may throw if empty */ }
+        return false;
+    }
+
+    // Snap the local player back to the host's current position/state.
+    function hcmSnapBackToHost(target) {
+        if (hcmDesynced) return; // user opted out — never yank them back automatically
+        hcmSnapBackCooldownUntil = Date.now() + HCM_SNAP_BACK_COOLDOWN_MS;
+        const video = findVideo();
+        if (!video) return;
+        if (target && Number.isFinite(target.targetTime)) {
+            tryMediaAction(EVENTS.SEEK, { targetTime: target.targetTime });
+        }
+        // Adopt the host's play/pause state — but ONLY if we actually know it.
+        // Defaulting to PLAY when the state is unknown would auto-resume a paused
+        // video against the host's real state (H-1).
+        if (target && target.playbackState === 'paused') {
+            tryMediaAction(EVENTS.PAUSE);
+        } else if (target && target.playbackState === 'playing') {
+            tryMediaAction(EVENTS.PLAY);
+        }
+        reportLog('Host-only: snapped back to host position', 'info');
+    }
+
+    // Resync to the host's current position, retrying briefly if the host's state
+    // isn't known yet (e.g. they just paused and no heartbeat has propagated) —
+    // otherwise the request is a silent no-op and the user thinks they're synced
+    // when they aren't. Shared by the dialog's "Stay in sync" and the Resync badge.
+    function hcmRequestHostSyncWithRetry() {
+        let attempts = 0;
+        const tryOnce = () => {
+            chrome.runtime.sendMessage({ type: 'REQUEST_HOST_SYNC' }, (res) => {
+                if (chrome.runtime.lastError || !res || !res.target) {
+                    if (++attempts < 5) setTimeout(tryOnce, 250);
+                    else reportLog('Host-only: resync requested but host state unavailable', 'warn');
+                    return;
+                }
+                hcmSnapBackToHost(res.target);
+            });
+        };
+        tryOnce();
+    }
+
+    // Buffer-aware snap-back (#3). An involuntary pause/seek often coincides with the
+    // player buffering — and a player can't actually play while it's stalled. Snapping
+    // immediately just fights the buffer (seek → re-buffer → another pause → …), which
+    // looks like stutter. Instead: if the player isn't ready, wait until it can play
+    // (readyState>=3, not seeking), then snap ONCE to the host's *current* position
+    // (re-queried, since the captured target may be stale by the time buffering ends).
+    // Player-agnostic on purpose — we can't enumerate every site, so this must be safe
+    // regardless of whether a given player fires 'pause' or only 'waiting'.
+    function hcmDeferredSnapBack() {
+        if (hcmDeferredSnapPending) return; // already waiting — don't stack polls
+        hcmDeferredSnapPending = true;
+        const deadline = Date.now() + HCM_BUFFER_WAIT_MS;
+        const poll = () => {
+            // Abort if the reason to snap is gone: user went solo, we're no longer a
+            // gated guest, or the video vanished.
+            if (hcmDesynced || !hcmIsGuestGated()) { hcmDeferredSnapPending = false; return; }
+            const video = findVideo();
+            const ready = video && video.readyState >= 3 && !video.seeking;
+            if (ready || Date.now() >= deadline) {
+                hcmDeferredSnapPending = false;
+                hcmRequestHostSyncWithRetry(); // fresh host position + snap once
+                return;
+            }
+            setTimeout(poll, 300);
+        };
+        poll();
+    }
+
+    // Entry point: background told us our local action was blocked in host-only.
+    function hcmHandleBlocked(action, target) {
+        // HOST_BLOCKED is only ever sent to a gated guest (background verifies
+        // host-only + !host before sending), so it's authoritative. Adopt the
+        // role/mode from it in case our CONTROL_MODE broadcast hasn't landed yet
+        // (join race, EC-5) — otherwise we'd miss the dialog/snap-back.
+        hcmControlMode = 'host-only';
+        hcmAmController = false;
+        if (hcmDesynced) return; // already solo, nothing to do
+
+        const intent = hcmClassifyIntent();
+        if (intent === 'live') return;          // EC-15: leave the guest alone on live
+        if (intent === 'involuntary') {
+            // EC-4 loop guard: only the silent auto snap-back is suppressed by the
+            // cooldown — the deliberate dialog path below must still go through,
+            // otherwise a second deliberate pause inside the cooldown window leaves
+            // the user stuck paused with no UI (M-3).
+            if (Date.now() < hcmSnapBackCooldownUntil || hcmDeferredSnapPending) return;
+            // Buffering/ads/throttle — silently re-sync, no dialog spam.
+            const video = findVideo();
+            if (video && video.readyState >= 3 && !video.seeking) {
+                // Ready now → snap immediately. Use the captured target if it's
+                // usable, otherwise re-query+retry (host state may not be known yet)
+                // so we never leave the guest silently stuck (consistent with the
+                // deferred and "Stay in sync" paths).
+                if (target && Number.isFinite(target.targetTime)) hcmSnapBackToHost(target);
+                else hcmRequestHostSyncWithRetry();
+            } else {
+                hcmDeferredSnapBack();             // buffering → wait for ready, then snap once (#3)
+            }
+            return;
+        }
+        // Deliberate: offer the choice (Teleparty-style), default = snap back.
+        hcmShowDesyncDialog(action, target);
+    }
+
+    // --- In-page UI (dialog + persistent desync badge) ---
+    // Built with the DOM API (CSSOM .style is CSP-safe; inline style="" in innerHTML
+    // is stripped by strict style-src on Netflix/YouTube/Disney+). Hosted in a
+    // Shadow DOM so the page's CSS can't restyle or hide our controls.
+    let hcmDialogHost = null;  // shadow host element for the dialog
+    let hcmBadgeHost = null;   // shadow host element for the persistent badge
+    let hcmBadgePending = false;  // retry flag for early-injection badge creation (L-4)
+
+    function hcmEl(tag, css, text) {
+        const el = document.createElement(tag);
+        if (css) el.style.cssText = css;        // CSSOM assignment — not gated by CSP
+        if (text != null) el.textContent = text;
+        return el;
+    }
+
+    function hcmRemoveDialog() {
+        // Cancel any pending auto-stay timer so a replaced dialog's stale closure
+        // can't later remove its successor / snap to an outdated target (H-4).
+        if (hcmDialogTimer) { clearTimeout(hcmDialogTimer); hcmDialogTimer = null; }
+        if (hcmDialogHost) { hcmDialogHost.remove(); hcmDialogHost = null; }
+    }
+
+    function hcmShowDesyncDialog(action, target) {
+        if (!document.body) { hcmSnapBackToHost(target); return; }
+        hcmRemoveDialog();
+        const host = hcmEl('div', 'all:initial');
+        const root = host.attachShadow({ mode: 'open' });
+
+        const wrap = hcmEl('div', 'position:fixed;z-index:2147483647;left:50%;bottom:32px;transform:translateX(-50%);background:#1f2937;color:#f9fafb;font:14px/1.4 system-ui,sans-serif;padding:16px 18px;border-radius:12px;box-shadow:0 8px 30px rgba(0,0,0,.45);max-width:360px;border:1px solid #374151');
+        wrap.setAttribute('role', 'dialog');
+        const title = hcmEl('div', 'font-weight:600;margin-bottom:6px', hcmStrings.title);
+        const body = hcmEl('div', 'margin-bottom:12px;color:#d1d5db', hcmStrings.body);
+        const btnRow = hcmEl('div', 'display:flex;gap:8px;justify-content:flex-end');
+        const soloBtn = hcmEl('button', 'background:#374151;color:#f9fafb;border:0;padding:8px 12px;border-radius:8px;cursor:pointer', hcmStrings.solo);
+        const stayBtn = hcmEl('button', 'background:#10b981;color:#062a20;border:0;padding:8px 12px;border-radius:8px;cursor:pointer;font-weight:600', hcmStrings.stay);
+        btnRow.append(soloBtn, stayBtn);
+        wrap.append(title, body, btnRow);
+        root.appendChild(wrap);
+        document.body.appendChild(host);
+        hcmDialogHost = host;
+
+        let settled = false;
+        // Re-query the host's current position on click instead of using the
+        // potentially stale target captured at HOST_BLOCKED time (M-1).
+        const stay = () => {
+            if (settled) return; settled = true; hcmRemoveDialog();
+            hcmRequestHostSyncWithRetry();
+        };
+        const solo = () => { if (settled) return; settled = true; hcmRemoveDialog(); hcmEnterDesync(); };
+        stayBtn.addEventListener('click', stay);
+        soloBtn.addEventListener('click', solo);
+        // EC-18: if the user ignores the prompt, default to staying in sync.
+        hcmDialogTimer = setTimeout(() => { if (!settled) stay(); }, 8000);
+    }
+
+    function hcmEnterDesync() {
+        hcmDesynced = true;
+        reportLog('Host-only: you chose to watch on your own (desynced)', 'warn');
+        // Notify background so it can relay our desynced state to the host via
+        // heartbeats — the host's UI then knows we're not following commands
+        // instead of appearing silently un-ACK'd.
+        chrome.runtime.sendMessage({ type: 'HCM_DESYNC_STATE', desynced: true }).catch(() => {});
+        hcmShowBadge();
+    }
+
+    function hcmExitDesync() {
+        const wasDesynced = hcmDesynced;
+        hcmDesynced = false;
+        hcmRemoveBadge();
+        if (wasDesynced) {
+            chrome.runtime.sendMessage({ type: 'HCM_DESYNC_STATE', desynced: false }).catch(() => {});
+        }
+        // Resync to the host's current position (retries if host state not yet known).
+        hcmRequestHostSyncWithRetry();
+        reportLog('Host-only: resynced with the host', 'info');
+    }
+
+    function hcmShowBadge() {
+        if (hcmBadgeHost) return;
+        if (!document.body) {
+            // Body not ready yet (very early injection). Defer until DOMReady,
+            // otherwise the desynced user silently never sees the badge (L-4).
+            if (!hcmBadgePending) {
+                hcmBadgePending = true;
+                const retry = () => {
+                    hcmBadgePending = false;
+                    if (hcmDesynced && !hcmBadgeHost) hcmShowBadge();
+                };
+                if (document.readyState === 'loading') {
+                    document.addEventListener('DOMContentLoaded', retry, { once: true });
+                } else {
+                    setTimeout(retry, 50);
+                }
+            }
+            return;
+        }
+        const host = hcmEl('div', 'all:initial');
+        const root = host.attachShadow({ mode: 'open' });
+        const b = hcmEl('div', 'position:fixed;z-index:2147483646;right:16px;bottom:16px;background:#b45309;color:#fff;font:13px/1.3 system-ui,sans-serif;padding:8px 12px;border-radius:10px;box-shadow:0 6px 20px rgba(0,0,0,.4);cursor:pointer;display:flex;align-items:center;gap:8px');
+        b.append(hcmEl('span', null, '● ' + hcmStrings.badge), hcmEl('span', 'text-decoration:underline', hcmStrings.resync));
+        b.addEventListener('click', hcmExitDesync);
+        root.appendChild(b);
+        document.body.appendChild(host);
+        hcmBadgeHost = host;
+    }
+
+    function hcmRemoveBadge() {
+        if (hcmBadgeHost) { hcmBadgeHost.remove(); hcmBadgeHost = null; }
+    }
+
+    function hcmReset() {
+        const wasDesynced = hcmDesynced;
+        hcmDesynced = false;
+        hcmDeferredSnapPending = false;
+        hcmSnapBackCooldownUntil = 0; // don't let a stale cooldown swallow the next snap-back
+        hcmBufferingUntil = 0;
+        hcmRemoveDialog();
+        hcmRemoveBadge();
+        // If we were desynced, notify background so it stops reporting us as
+        // desynced in heartbeats (otherwise the host's UI keeps showing the
+        // stale Solo badge until the next state change).
+        if (wasDesynced) {
+            chrome.runtime.sendMessage({ type: 'HCM_DESYNC_STATE', desynced: false }).catch(() => {});
+        }
+    }
+
    function reportLog(message, level = 'info') {
        chrome.runtime.sendMessage({ type: 'LOG', message, level }).catch(() => {});
    }
@@ -184,7 +491,7 @@
            }
        }
        if (audioCtx.state === 'suspended') {
-            audioCtx.resume().catch(() => {});
+            audioCtx.resume().catch(() => { reportLog('AudioContext resume failed - browser may need page interaction first', 'warn'); });
        }
        return audioCtx;
    }
@@ -242,6 +549,7 @@
        rampGain(chain.dryGain, 1, t);
        rampGain(chain.compGain, 0, t);
        chain.active = false;
+        reportLog('Audio compressor disabled', 'info');
    }

    function bypassCurrentAudioProcessing() {
@@ -274,6 +582,7 @@
            rampGain(chain.dryGain, 0, t);
            rampGain(chain.compGain, 1, t);
            chain.active = true;
+            reportLog('Audio compressor enabled', 'info');
        }
    }

@@ -287,28 +596,27 @@
    // Extract a canonical episode identifier from a title string.
    // Handles: S01E01, S1E1, S01 - E01, Season 1 Episode 1, "Folge 5", "Episode 5", "Ep. 5", "#5"
    // Returns null if no episode pattern found.
+    // --- SHARED_EPISODE_UTILS_INJECT_START ---
+    // This block is automatically replaced by /scripts/build-extension.js
    function extractEpisodeId(title) {
        if (!title || typeof title !== 'string') return null;
-        // S01E01 patterns (with any non-alphanumeric separator between season and E)
        const se = title.match(/S(?:eason\s*)?(\d+)[^a-zA-Z0-9]*E(?:pisode\s*)?(\d+)/i);
        if (se) return `S${String(se[1]).padStart(2, '0')}E${String(se[2]).padStart(2, '0')}`;
-        // "Episode X", "Folge X", "Ep. X", "#X"
        const ep = title.match(/(?:Episode|Folge|Ep\.?|#)\s*(\d+)/i);
        if (ep) return `EP${String(ep[1]).padStart(3, '0')}`;
        return null;
    }

-    // Returns true if two titles likely refer to the same episode.
-    // Strict: both must have IDs and match, OR neither has IDs and exact match.
    function sameEpisode(titleA, titleB) {
-        if (!titleA && !titleB) return true; // Both unknown → assume same (backward compat)
-        if (!titleA || !titleB) return false; // One unknown, one known → different
+        if (!titleA && !titleB) return true;
+        if (!titleA || !titleB) return false;
        const idA = extractEpisodeId(titleA);
        const idB = extractEpisodeId(titleB);
-        if (idA && idB) return idA === idB; // Both have parseable IDs → compare IDs
-        if (idA || idB) return false;       // One has ID, other doesn't → different
-        return titleA === titleB;            // Neither has ID → exact string match
+        if (idA && idB) return idA === idB;
+        if (idA || idB) return false;
+        return titleA === titleB;
    }
+    // --- SHARED_EPISODE_UTILS_INJECT_END ---

    // Returns true only when we are CERTAIN the episodes differ.
    // Permissive: only blocks if BOTH titles have parseable IDs AND they differ.
@@ -348,6 +656,10 @@

        reportLog(`Episode transition detected: "${newTitle}"`, 'info');

+        // EC-12: a new episode dissolves any solo/desync state — the guest rejoins
+        // the room for the fresh content rather than staying stuck on the old one.
+        if (hcmDesynced) hcmReset();
+
        // Do NOT pause here. We notify background.js first.
        // Background checks the setting; if enabled it creates a lobby
        // and sends back PAUSE_FOR_LOBBY so we only freeze if the feature is on.
@@ -436,7 +748,7 @@
                        ytButton.click();
                    }
                    if (action === EVENTS.SEEK) {
-                        _setSuppress('seek');
+                        expectedSeekTime = data.targetTime;
                        video.currentTime = data.targetTime;
                    }
                    return;
@@ -452,7 +764,7 @@
                        twitchButton.click();
                    }
                    if (action === EVENTS.SEEK) {
-                        _setSuppress('seek');
+                        expectedSeekTime = data.targetTime;
                        video.currentTime = data.targetTime;
                    }
                    return;
@@ -470,7 +782,7 @@
                _setSuppress('paused');
                video.pause();
            } else if (action === EVENTS.SEEK) {
-                _setSuppress('seek');
+                expectedSeekTime = data.targetTime;
                video.currentTime = data.targetTime;
            }
    } catch (e) {
@@ -530,10 +842,56 @@
            return true;
        }

+        // Host Control Mode: room mode/role changed.
+        if (message.type === 'CONTROL_MODE') {
+            const wasGated = hcmIsGuestGated();
+            const prevHostPeerId = hcmHostPeerId;
+            hcmControlMode = message.controlMode || 'everyone';
+            hcmAmController = !!message.amController;
+            hcmHostPeerId = message.hostPeerId || null;
+            // Reset guest-side state when leaving the gated state, OR when the
+            // host identity changes (room switch, host-leave fallback, missed
+            // teardown broadcast) — clears stale desync so a rejoin starts clean (H-3).
+            const hostChanged = prevHostPeerId !== null && hcmHostPeerId !== prevHostPeerId;
+            if ((wasGated && !hcmIsGuestGated()) || hostChanged) hcmReset();
+            sendResponse({ ok: true });
+            return true;
+        }
+
+        // Host Control Mode: background blocked our local action — handle UX locally.
+        if (message.type === 'HOST_BLOCKED') {
+            hcmHandleBlocked(message.action, message.target || null);
+            sendResponse({ ok: true });
+            return true;
+        }
+
+        // Background asks for an immediate state push (e.g. the first peer just
+        // joined while we were solo) so the newcomer syncs without waiting.
+        if (message.type === 'REQUEST_HEARTBEAT') {
+            sendHeartbeat();
+            sendResponse({ ok: true });
+            return true;
+        }
+
        if (message.type === 'SERVER_COMMAND') {
            const { action, payload } = message;
            let actionCompleted = false;

+            // Host Control Mode: while watching on our own (desynced), don't apply
+            // host commands. Only ACK FORCE_SYNC_PREPARE — that's the one the host's
+            // force-sync flow actually waits on. Skipping CMD_ACKs for PLAY/PAUSE/SEEK
+            // is intentional so the host's UI honestly reflects that we didn't apply
+            // the command (M-2); sending them would make the host think we're synced.
+            if (hcmDesynced) {
+                const soloIgnored = [EVENTS.PLAY, EVENTS.PAUSE, EVENTS.SEEK, EVENTS.FORCE_SYNC_PREPARE, EVENTS.FORCE_SYNC_EXECUTE];
+                if (soloIgnored.includes(action)) {
+                    if (action === EVENTS.FORCE_SYNC_PREPARE) {
+                        chrome.runtime.sendMessage({ type: 'FORCE_SYNC_ACK' }).catch(() => {});
+                    }
+                    return;
+                }
+            }
+
            // Guard: Don't execute sync commands if peers are on different episodes.
            // Only active when autoSyncNextEpisode setting is enabled (default: on).
            // Only blocks when BOTH sides have parseable S01E01-style IDs that differ.
@@ -573,7 +931,7 @@
                        return;
                    }
                    _setSuppress('paused');
-                    _setSuppress('seek');
+                    expectedSeekTime = payload.targetTime;
                    video.pause();
                    try {
                        video.currentTime = payload.targetTime;
@@ -603,6 +961,15 @@

        // Episode Auto-Sync: Lobby notification from background
        if (message.type === 'EPISODE_LOBBY') {
+            // Host Control Mode: a desynced guest is watching on their own and must
+            // not join the lobby flow. Otherwise they'd pause on title match, report
+            // ready, but then ignore the host's FORCE_SYNC_* (hcmDesynced skip in
+            // SERVER_COMMAND) and end up frozen in pause. They also can't be counted
+            // toward lobby completion (background filters them out).
+            if (hcmDesynced) {
+                sendResponse({ status: 'ignored_desynced' });
+                return true;
+            }
            const expectedTitle = message.expectedTitle;
            if (expectedTitle) {
                reportLog(`Episode lobby received: waiting for "${expectedTitle}"`, 'info');
@@ -766,6 +1133,46 @@
    });

    // Detect native events
+    // Build the relay payload from the *current* media state and send it to
+    // background.js. Re-reads the video each call so deferred (coalesced) emits
+    // carry an up-to-date position. Safe with no/invalid video — it no-ops.
+    function sendContentEvent(action) {
+        const video = findVideo();
+        if (!video) return;
+
+        const current = video.currentTime;
+        if (!Number.isFinite(current)) return;
+
+        const mediaTitle = (navigator.mediaSession && navigator.mediaSession.metadata) ? navigator.mediaSession.metadata.title : null;
+
+        chrome.runtime.sendMessage({
+            type: 'CONTENT_EVENT',
+            action,
+            payload: {
+                currentTime: current,
+                targetTime: current,
+                mediaTitle: mediaTitle,
+                timestamp: Date.now()
+            }
+        }).catch(() => {});
+
+        // Trigger proactive heartbeat to push stabilized state
+        scheduleProactiveHeartbeat();
+    }
+
+    // Trailing-edge flush of a coalesced play/pause burst: emit the final settled
+    // state. No-ops only when no burst followed the leading edge. We do NOT skip
+    // when the state matches the leading send — a remote command may have changed
+    // the shared state mid-window, so re-sending is the safe (idempotent) choice.
+    function flushPlayPause() {
+        playPauseCoalesceTimer = null;
+        const finalAction = pendingPlayPauseAction;
+        pendingPlayPauseAction = null;
+        // No burst follow-up (only the leading edge fired), or invalid state.
+        if (finalAction !== EVENTS.PLAY && finalAction !== EVENTS.PAUSE) return;
+        sendContentEvent(finalAction);
+    }
+
    function reportEvent(action) {
        if (seekDebounceTimer && (action === EVENTS.PLAY || action === EVENTS.PAUSE)) {
            clearTimeout(seekDebounceTimer);
@@ -784,10 +1191,11 @@
        const current = video.currentTime;
        if (!Number.isFinite(current)) return;

-        const mediaTitle = (navigator.mediaSession && navigator.mediaSession.metadata) ? navigator.mediaSession.metadata.title : null;
-
        const eventState = action === EVENTS.PLAY ? 'playing' : (action === EVENTS.PAUSE ? 'paused' : (action === EVENTS.SEEK ? 'seek' : null));
-        
+
+        // Echo-suppression for remotely-applied commands. MUST stay synchronous
+        // on event arrival: the suppress timer is short-lived (300ms) and would
+        // expire if deferred, leaking an echo back to peers.
        if (_suppressTimers[eventState]) {
            _clearSuppress(eventState);
            return;
@@ -796,20 +1204,29 @@
        // Suppress only SEEK during visibility grace period (tab re-focus ghost jump).
        // Play/Pause pass through — user may want to immediately pause after tabbing back.
        if (Date.now() < visibilityGraceUntil && action === EVENTS.SEEK) return;
-        
-        chrome.runtime.sendMessage({
-            type: 'CONTENT_EVENT',
-            action,
-            payload: {
-                currentTime: current,
-                targetTime: current,
-                mediaTitle: mediaTitle,
-                timestamp: Date.now()
-            }
-        }).catch(() => {});

-        // Trigger proactive heartbeat to push stabilized state
-        scheduleProactiveHeartbeat();
+        // Coalesce play/pause bursts (source swaps, ABR, ads, teardown). The
+        // synchronous gates above have already run; only the network emit is
+        // governed here. Leading edge sends the first event instantly; further
+        // events within the window are collapsed to the final state by the
+        // trailing flush. A pending burst is REPLACED, never dropped — the last
+        // event in the window always wins.
+        if (action === EVENTS.PLAY || action === EVENTS.PAUSE) {
+            if (playPauseCoalesceTimer === null) {
+                // Window closed → fresh action. Emit now (zero added latency).
+                sendContentEvent(action);
+                pendingPlayPauseAction = null;
+            } else {
+                // Window open → part of a burst. Defer to the trailing flush.
+                pendingPlayPauseAction = action;
+                clearTimeout(playPauseCoalesceTimer);
+            }
+            playPauseCoalesceTimer = setTimeout(flushPlayPause, PLAY_PAUSE_COALESCE_MS);
+            return;
+        }
+
+        // SEEK (and any non play/pause action): emit immediately.
+        sendContentEvent(action);
    }

    // --- Tab Visibility Handling ---
@@ -837,6 +1254,15 @@
    window.addEventListener('pagehide', () => {
        pageVisible = false;
        closeAudioContext();
+        if (keepAlivePort) { try { keepAlivePort.disconnect(); } catch (_e) { /* ignore */ } keepAlivePort = null; }
+        if (lobbyPollTimer) { clearInterval(lobbyPollTimer); lobbyPollTimer = null; }
+        if (heartbeatTimeout) { clearTimeout(heartbeatTimeout); heartbeatTimeout = null; }
+        if (proactiveHeartbeatTimeout) { clearTimeout(proactiveHeartbeatTimeout); proactiveHeartbeatTimeout = null; }
+        // Drop any pending coalesced play/pause: we are tearing down and will
+        // disconnect — peers learn we are gone via PEER_STATUS 'left'. This also
+        // intentionally suppresses the teardown play/pause burst at the source.
+        if (playPauseCoalesceTimer) { clearTimeout(playPauseCoalesceTimer); playPauseCoalesceTimer = null; pendingPlayPauseAction = null; }
+        observer.disconnect();
    });
    window.addEventListener('pageshow', (event) => {
        // event.persisted is true ONLY when restored from bfcache, not on initial load
@@ -849,6 +1275,9 @@

    const handlePlay = () => reportEvent(EVENTS.PLAY);
    const handlePause = () => reportEvent(EVENTS.PAUSE);
+    // Host Control Mode: a 'waiting' (buffering) event opens a grace window so the
+    // pause it may trigger isn't misread as a deliberate guest action (EC-1).
+    const handleWaiting = () => { hcmBufferingUntil = Date.now() + HCM_BUFFERING_GRACE_MS; };

    // Seek filtering: ignore HLS/DASH buffering micro-seeks.
    // Only relay if delta >= MIN_SEEK_DELTA AND not already debouncing.
@@ -858,11 +1287,17 @@
        const current = video.currentTime;
        if (!Number.isFinite(current)) return;

-        // Step 1: Check _suppressTimers (programmatic seek from remote peer)
-        if (_suppressTimers['seek']) {
-            _clearSuppress('seek');
-            lastReportedSeekTime = current;
-            return;
+        // Step 1: Check expectedSeekTime (programmatic seek from remote peer)
+        if (expectedSeekTime !== null) {
+            if (Math.abs(current - expectedSeekTime) < 1.0) {
+                // Video arrived at expected time. Safely clear and ignore.
+                expectedSeekTime = null;
+                lastReportedSeekTime = current;
+                return;
+            } else {
+                // User manually scrubbed to a DIFFERENT time while we were buffering
+                expectedSeekTime = null;
+            }
        }

        // Step 2: Suppress during visibility grace period (tab re-focus ghost events)
@@ -913,13 +1348,15 @@
                video.removeEventListener('pause', existing.pause);
                video.removeEventListener('seeked', existing.seeked);
                video.removeEventListener('loadeddata', existing.loadeddata);
+                if (existing.waiting) video.removeEventListener('waiting', existing.waiting);
            }
-            video._koalaHandlers = { play: handlePlay, pause: handlePause, seeked: handleSeeked, loadeddata: handleLoadedData };
+            video._koalaHandlers = { play: handlePlay, pause: handlePause, seeked: handleSeeked, loadeddata: handleLoadedData, waiting: handleWaiting };

            video.addEventListener('play', handlePlay);
            video.addEventListener('pause', handlePause);
            video.addEventListener('seeked', handleSeeked);
            video.addEventListener('loadeddata', handleLoadedData);
+            video.addEventListener('waiting', handleWaiting);
            video.dataset.koalaAttached = 'true';
            lastVideoSrc = video.currentSrc || video.src || null;

@@ -1055,4 +1492,34 @@
        }
    });

+    // Host Control Mode: fetch current room mode/role on injection (we may have
+    // been injected after ROOM_DATA already arrived, missing the broadcast).
+    chrome.runtime.sendMessage({ type: 'GET_CONTROL_MODE' }, (res) => {
+        if (chrome.runtime.lastError || !res) return;
+        hcmControlMode = res.controlMode || 'everyone';
+        hcmAmController = !!res.amController;
+        hcmHostPeerId = res.hostPeerId || null;
+        // Re-adopt persisted desync after a page reload so we don't start synced
+        // while background still relays us as "Solo" to the host (split-brain).
+        // Only when we're actually a gated guest — never adopt a stale flag as a
+        // controller or in 'everyone' mode (would self-label "Solo" / ignore commands).
+        if (res.desynced && res.controlMode === 'host-only' && !res.amController && !hcmDesynced) {
+            hcmDesynced = true;
+            hcmShowBadge();
+        }
+    });
+
+    // Pull localized strings for the in-page dialog/badge (English fallback above).
+    chrome.runtime.sendMessage({ type: 'GET_HCM_STRINGS' }, (res) => {
+        if (chrome.runtime.lastError || !res) return;
+        Object.keys(hcmStrings).forEach(k => { if (res[k]) hcmStrings[k] = res[k]; });
+        // If the badge is already showing (early desync), refresh its text in place.
+        // Re-creating the host element nukes the click target mid-poll and can drop a
+        // click that landed between remove() and the re-create (L-4).
+        if (hcmBadgeHost) {
+            const span = hcmBadgeHost.shadowRoot && hcmBadgeHost.shadowRoot.querySelector('span');
+            if (span) span.textContent = '● ' + hcmStrings.badge;
+        }
+    });
+
 })();
@@ -0,0 +1,24 @@
+/**
+ * KoalaSync Episode Title Utilities
+ * Single source of truth — synced to content.js by build-extension.js.
+ * Keep in sync with the injection block in content.js!
+ */
+
+export function extractEpisodeId(title) {
+    if (!title || typeof title !== 'string') return null;
+    const se = title.match(/S(?:eason\s*)?(\d+)[^a-zA-Z0-9]*E(?:pisode\s*)?(\d+)/i);
+    if (se) return `S${String(se[1]).padStart(2, '0')}E${String(se[2]).padStart(2, '0')}`;
+    const ep = title.match(/(?:Episode|Folge|Ep\.?|#)\s*(\d+)/i);
+    if (ep) return `EP${String(ep[1]).padStart(3, '0')}`;
+    return null;
+}
+
+export function sameEpisode(titleA, titleB) {
+    if (!titleA && !titleB) return true;
+    if (!titleA || !titleB) return false;
+    const idA = extractEpisodeId(titleA);
+    const idB = extractEpisodeId(titleB);
+    if (idA && idB) return idA === idB;
+    if (idA || idB) return false;
+    return titleA === titleB;
+}
@@ -1,5 +1,5 @@
 // extension/i18n.js
-export const SUPPORTED_LANGUAGES = ['en', 'de', 'fr', 'es', 'pt-BR', 'ru', 'it', 'pl', 'tr', 'nl', 'ja', 'ko', 'pt'];
+export const SUPPORTED_LANGUAGES = ['en', 'de', 'fr', 'es', 'it', 'nl', 'pl', 'pt', 'pt-BR', 'tr', 'ru', 'ja', 'ko', 'zh', 'uk'];
 export const DEFAULT_LANGUAGE = 'en';

 let activeDictionary = {};
@@ -44,6 +44,24 @@
  "LABEL_INVITE_LINK_TOOLTIP": "Teile diesen Link mit Freunden, damit sie beitreten können",
  "LABEL_PEERS_IN_ROOM": "Teilnehmer im Raum",
  "LABEL_PEERS_IN_ROOM_TOOLTIP": "Andere Benutzer, die derzeit mit diesem Raum verbunden sind",
+  "LABEL_HOST_CONTROL": "Host-Steuerung",
+  "LABEL_HOST_CONTROL_TOOLTIP": "Festlegen, wer die Wiedergabe in diesem Raum steuern darf",
+  "LABEL_HOST_ONLY_TOGGLE": "Nur ich darf die Wiedergabe steuern",
+  "NOTICE_HOST_CONTROLS": "Der Host steuert die Wiedergabe für alle.",
+  "NOTICE_COHOST_HINT": "Tipp: Gib einzelnen Teilnehmern unten in der Teilnehmerliste die Steuerung.",
+  "BADGE_HOST": "Host",
+  "BADGE_GUEST": "Gast",
+  "BADGE_CONTROLLER": "Controller",
+  "BTN_GIVE_CONTROL": "Steuerung geben",
+  "BTN_REVOKE_CONTROL": "Entziehen",
+  "BADGE_DESYNCED": "Solo",
+  "TOOLTIP_PEER_DESYNCED": "Schaut alleine — ignoriert die Befehle des Hosts",
+  "HCM_DIALOG_TITLE": "KoalaSync · Der Host steuert diesen Raum",
+  "HCM_DIALOG_BODY": "Nur der Host kann die Wiedergabe in diesem Raum steuern. Weiter gemeinsam schauen oder allein weiterschauen?",
+  "HCM_DIALOG_STAY": "Synchron bleiben",
+  "HCM_DIALOG_SOLO": "Allein weiterschauen",
+  "HCM_BADGE_SOLO": "Du schaust allein",
+  "HCM_BADGE_RESYNC": "Neu sync",
  "NO_PEERS_CONNECTED": "Keine Teilnehmer verbunden",
  "BTN_LEAVE_ROOM": "Raum verlassen",
  "LABEL_SELECT_VIDEO": "Video auswählen",
@@ -92,6 +110,7 @@
  "BTN_REGEN_ID_TOOLTIP": "Generiere deine interne ID neu und verbinde dich erneut",
  "REGEN_ID_DESC": "Verwende dies, wenn du Fehler wegen doppelter Identität siehst.",
  "REGEN_ID_OTHER_ISSUE": "Anderes Problem? Öffne ein GitHub Issue",
+  "TOAST_ID_REGENERATED": "Identität neu generiert — Verbindung wird wiederhergestellt…",
  "LABEL_CONN_STATUS": "Verbindungsstatus",
  "LABEL_CONN_STATUS_TOOLTIP": "Aktueller WebSocket-Verbindungsstatus",
  "CONN_STATUS_DISCONNECTED": "Getrennt",
@@ -143,6 +162,8 @@
  "STATUS_CONNECTING": "Verbinde...",
  "STATUS_FAILED": "Fehlgeschlagen",
  "STATUS_DISCONNECTED": "Getrennt",
+  "STATUS_IDLE": "Bereit zum Verbinden",
+  "STATUS_IDLE_TOOLTIP": "KoalaSync ist bereit. Tritt einem Raum bei oder erstelle einen, um die Verbindung herzustellen und die Synchronisierung zu starten.",
  "BTN_STATE_JOINING": "🚀 Trete bei...",
  "BTN_STATE_RECONNECTING": "🔄 Verbinde erneut...",
  "BTN_STATE_PLAYING": "▶ Spiele ab...",
@@ -181,7 +202,7 @@
  "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Zeitüberschreitung — nicht alle Teilnehmer haben die Episode geladen",
  "LOBBY_CANCEL_USER": "Vom Benutzer abgebrochen",
  "NOTIF_ERROR_TITLE": "KoalaSync-Fehler",
-  "FOOTER_SUPPORT": "☕ Kauf mir einen Kaffee",
+  "FOOTER_SUPPORT": "Support KoalaSync",
  "FOOTER_REVIEW": "★ Bewerten",
  "FOOTER_SUPPORT_PROMPT": "Gefällt dir KoalaSync? Hinterlasse eine Bewertung!",
  "LABEL_AUDIO_PROCESSING": "Audio-Verarbeitung",
@@ -205,5 +226,17 @@
  "AUDIO_PARAM_ATTACK": "Attack",
  "AUDIO_PARAM_RELEASE": "Release",
  "AUDIO_EQUALIZER": "Equalizer",
-  "AUDIO_COMING_SOON": "Demnächst"
+  "AUDIO_COMING_SOON": "Demnächst",
+  "BTN_RESTART_TOUR": "Einführung neu starten",
+  "BTN_RESTART_TOUR_TOOLTIP": "Startet die Einführung für neue Benutzer erneut",
+  "HINT_SELECT_VIDEO": "Wähle hier dein Video aus!",
+  "OPTION_TITLE_PRIVACY_FULL": "Voll senden",
+  "OPTION_TITLE_PRIVACY_EPISODE": "Nur Episoden-ID senden",
+  "OPTION_TITLE_PRIVACY_HIDDEN": "Nicht senden",
+  "LABEL_PRIVACY_SETTINGS": "Privatsphäre-Einstellungen",
+  "LABEL_PRIVACY_SETTINGS_TOOLTIP": "Lege fest, welche Tab- und Medientitel an den Raum gesendet werden.",
+  "LABEL_SEND_TAB_TITLE": "Tab-Titel senden",
+  "LABEL_SEND_TAB_TITLE_TOOLTIP": "Sendet den Titel des ausgewählten Browser-Tabs an den Raum.",
+  "LABEL_MEDIA_TITLE_PRIVACY": "Medientitel",
+  "LABEL_MEDIA_TITLE_PRIVACY_TOOLTIP": "Lege fest, wie Medientitel an den Raum gesendet werden."
 }
@@ -44,6 +44,24 @@
  "LABEL_INVITE_LINK_TOOLTIP": "Share this link with friends so they can join",
  "LABEL_PEERS_IN_ROOM": "Peers in Room",
  "LABEL_PEERS_IN_ROOM_TOOLTIP": "Other users currently connected to this room",
+  "LABEL_HOST_CONTROL": "Host Control",
+  "LABEL_HOST_CONTROL_TOOLTIP": "Restrict who can control playback in this room",
+  "LABEL_HOST_ONLY_TOGGLE": "Only I can control playback",
+  "NOTICE_HOST_CONTROLS": "The host controls playback for everyone.",
+  "NOTICE_COHOST_HINT": "Tip: grant control to individual viewers in the participant list below.",
+  "BADGE_HOST": "Host",
+  "BADGE_GUEST": "Guest",
+  "BADGE_CONTROLLER": "Controller",
+  "BTN_GIVE_CONTROL": "Give control",
+  "BTN_REVOKE_CONTROL": "Revoke",
+  "BADGE_DESYNCED": "Solo",
+  "TOOLTIP_PEER_DESYNCED": "Watching on their own — host's commands are ignored",
+  "HCM_DIALOG_TITLE": "KoalaSync · Host controls this room",
+  "HCM_DIALOG_BODY": "Only the host can control playback in this room. Keep watching together, or watch on your own?",
+  "HCM_DIALOG_STAY": "Stay in sync",
+  "HCM_DIALOG_SOLO": "Watch on my own",
+  "HCM_BADGE_SOLO": "Watching on your own",
+  "HCM_BADGE_RESYNC": "Resync",
  "NO_PEERS_CONNECTED": "No peers connected",
  "BTN_LEAVE_ROOM": "Leave Room",
  "LABEL_SELECT_VIDEO": "Select Video",
@@ -92,6 +110,7 @@
  "BTN_REGEN_ID_TOOLTIP": "Regenerate your internal ID and reconnect",
  "REGEN_ID_DESC": "Use this if you see \"Duplicate Identity\" errors.",
  "REGEN_ID_OTHER_ISSUE": "Other issue? Open a GitHub Issue",
+  "TOAST_ID_REGENERATED": "Identity regenerated — reconnecting…",
  "LABEL_CONN_STATUS": "Connection Status",
  "LABEL_CONN_STATUS_TOOLTIP": "Current WebSocket connection state",
  "CONN_STATUS_DISCONNECTED": "Disconnected",
@@ -143,6 +162,8 @@
  "STATUS_CONNECTING": "Connecting...",
  "STATUS_FAILED": "Failed",
  "STATUS_DISCONNECTED": "Disconnected",
+  "STATUS_IDLE": "Ready to connect",
+  "STATUS_IDLE_TOOLTIP": "KoalaSync is ready. Join or create a room to connect and start syncing.",
  "BTN_STATE_JOINING": "🚀 Joining...",
  "BTN_STATE_RECONNECTING": "🔄 Reconnecting...",
  "BTN_STATE_PLAYING": "▶ Playing...",
@@ -181,7 +202,7 @@
  "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Timeout — not all peers loaded the episode",
  "LOBBY_CANCEL_USER": "Cancelled by user",
  "NOTIF_ERROR_TITLE": "KoalaSync Error",
-  "FOOTER_SUPPORT": "☕ Buy me a coffee",
+  "FOOTER_SUPPORT": "Support KoalaSync",
  "FOOTER_REVIEW": "★ Rate us",
  "FOOTER_SUPPORT_PROMPT": "Enjoying KoalaSync? Leave a review!",
  "LABEL_AUDIO_PROCESSING": "Audio Processing",
@@ -205,5 +226,17 @@
  "AUDIO_PARAM_ATTACK": "Attack",
  "AUDIO_PARAM_RELEASE": "Release",
  "AUDIO_EQUALIZER": "Equalizer",
-  "AUDIO_COMING_SOON": "Coming soon"
+  "AUDIO_COMING_SOON": "Coming soon",
+  "BTN_RESTART_TOUR": "Restart Tutorial",
+  "BTN_RESTART_TOUR_TOOLTIP": "Restart the onboarding tutorial",
+  "HINT_SELECT_VIDEO": "Select your video here!",
+  "OPTION_TITLE_PRIVACY_FULL": "Send full title",
+  "OPTION_TITLE_PRIVACY_EPISODE": "Send episode ID",
+  "OPTION_TITLE_PRIVACY_HIDDEN": "Do not send",
+  "LABEL_PRIVACY_SETTINGS": "Privacy Settings",
+  "LABEL_PRIVACY_SETTINGS_TOOLTIP": "Choose which tab and media titles are sent to the room.",
+  "LABEL_SEND_TAB_TITLE": "Send tab title",
+  "LABEL_SEND_TAB_TITLE_TOOLTIP": "Send the selected browser tab title to the room.",
+  "LABEL_MEDIA_TITLE_PRIVACY": "Media title",
+  "LABEL_MEDIA_TITLE_PRIVACY_TOOLTIP": "Choose how media titles are sent to the room."
 }
@@ -6,7 +6,7 @@
  "TAB_ROOM_TOOLTIP": "Configuración de sala y conexión",
  "TAB_SYNC": "Sincro",
  "TAB_SYNC_TOOLTIP": "Controles de sincronización de video y acciones",
-  "TAB_SETTINGS": "Opciones",
+  "TAB_SETTINGS": "Configuración",
  "TAB_SETTINGS_TOOLTIP": "Preferencias de la extensión",
  "TAB_STATUS": "Estado",
  "TAB_STATUS_TOOLTIP": "Diagnósticos avanzados y registros",
@@ -15,7 +15,7 @@
  "LABEL_SERVER": "Servidor",
  "BTN_SERVER_OFFICIAL": "Oficial",
  "BTN_SERVER_OFFICIAL_TOOLTIP": "Usar el servidor oficial confiable",
-  "BTN_SERVER_CUSTOM": "Perso",
+  "BTN_SERVER_CUSTOM": "Personalizado",
  "BTN_SERVER_CUSTOM_TOOLTIP": "Conectarse a su propio servidor auto-alojado",
  "PLACEHOLDER_SERVER_URL": "wss://tu-servidor:3000",
  "LABEL_ROOM_ID": "ID de sala",
@@ -44,6 +44,24 @@
  "LABEL_INVITE_LINK_TOOLTIP": "Comparte este enlace con amigos para que se unan",
  "LABEL_PEERS_IN_ROOM": "Participantes en la sala",
  "LABEL_PEERS_IN_ROOM_TOOLTIP": "Otros usuarios conectados actualmente a esta sala",
+  "LABEL_HOST_CONTROL": "Control del anfitrión",
+  "LABEL_HOST_CONTROL_TOOLTIP": "Restringir quién puede controlar la reproducción en esta sala",
+  "LABEL_HOST_ONLY_TOGGLE": "Solo yo puedo controlar la reproducción",
+  "NOTICE_HOST_CONTROLS": "El anfitrión controla la reproducción para todos.",
+  "NOTICE_COHOST_HINT": "Consejo: concede el control a usuarios concretos en la lista de participantes de abajo.",
+  "BADGE_HOST": "Anfitrión",
+  "BADGE_GUEST": "Invitado",
+  "BADGE_CONTROLLER": "Controlador",
+  "BTN_GIVE_CONTROL": "Dar control",
+  "BTN_REVOKE_CONTROL": "Quitar",
+  "BADGE_DESYNCED": "Solo",
+  "TOOLTIP_PEER_DESYNCED": "Viendo por su cuenta — ignora los comandos del anfitrión",
+  "HCM_DIALOG_TITLE": "KoalaSync · El anfitrión controla esta sala",
+  "HCM_DIALOG_BODY": "Solo el anfitrión puede controlar la reproducción en esta sala. ¿Seguir viendo juntos o ver por tu cuenta?",
+  "HCM_DIALOG_STAY": "Seguir sincronizado",
+  "HCM_DIALOG_SOLO": "Ver por mi cuenta",
+  "HCM_BADGE_SOLO": "Viendo por tu cuenta",
+  "HCM_BADGE_RESYNC": "Resincronizar",
  "NO_PEERS_CONNECTED": "Sin participantes conectados",
  "BTN_LEAVE_ROOM": "Salir de la sala",
  "LABEL_SELECT_VIDEO": "Seleccionar video",
@@ -58,16 +76,16 @@
  "BTN_PAUSE_TOOLTIP": "Enviar un comando de pausa a todos",
  "BTN_SYNC": "⚡ SYNC",
  "BTN_SYNC_TOOLTIP": "Forzar la sincronización de todos los usuarios",
-  "OPTION_JUMP_TO_OTHERS": "Unirse a otros",
-  "OPTION_JUMP_TO_ME": "Traerlos a mí",
+  "OPTION_JUMP_TO_OTHERS": "Ir a la posición de otros",
+  "OPTION_JUMP_TO_ME": "Traerlos a mi posición",
  "OPTION_JUMP_MODE_TOOLTIP": "Elegir el objetivo de sincronización",
  "LABEL_LAST_ACTIVITY": "Última actividad",
-  "LABEL_LAST_ACTIVITY_TOOLTIP": "Muestra el comando más reciente de reproducción, pausa o búsqueda",
+  "LABEL_LAST_ACTIVITY_TOOLTIP": "Muestra el comando más reciente de reproducción, pausa o salto en el tiempo",
  "NO_RECENT_COMMANDS": "Sin comandos recientes",
  "LOBBY_HEADER": "SALA DE ESPERA DE EPISODIO",
  "LOBBY_WAITING_FOR": "🎬 Esperando a: \"{title}\"",
  "LOBBY_WAITING_PEERS": "Esperando participantes...",
-  "BTN_SKIP_PLAY": "Omitir y reproducir",
+  "BTN_SKIP_PLAY": "Omitir y reproducir ya",
  "BTN_SKIP_PLAY_TOOLTIP": "Cancelar la sala de espera y reproducir de todos modos",
  "LOBBY_CONNECT_FIRST": "Únete a una sala primero",
  "LOBBY_CONNECT_FIRST_DESC": "Necesitas unirte a una sala a través de un enlace de invitación o crear una nueva para sincronizar videos.",
@@ -76,7 +94,7 @@
  "LABEL_USERNAME": "Tu nombre de usuario",
  "LABEL_USERNAME_TOOLTIP": "El nombre de usuario ayuda a otros a identificarte.",
  "PLACEHOLDER_USERNAME": "Koala anónimo",
-  "LABEL_HIDE_CLUTTER": "Lista de pestañas limpia",
+  "LABEL_HIDE_CLUTTER": "Ocultar pestañas sin video",
  "LABEL_HIDE_CLUTTER_TOOLTIP": "Filtra pestañas que no son de video y dominios no relacionados para mantener limpia la lista",
  "LABEL_AUTO_SYNC_NEXT": "Sincro auto del siguiente episodio",
  "LABEL_AUTO_SYNC_NEXT_TOOLTIP": "Pausa automáticamente y espera a todos al cambiar de episodio, luego inicia de forma sincrónica.",
@@ -88,10 +106,11 @@
  "LABEL_LANGUAGE_TOOLTIP": "Elige tu idioma preferido para la extensión",
  "LABEL_TROUBLESHOOTING": "Resolución de problemas",
  "LABEL_TROUBLESHOOTING_TOOLTIP": "Herramientas para solucionar problemas de conexión",
-  "BTN_REGEN_ID": "Regenerar ID de participante",
+  "BTN_REGEN_ID": "Regenerar ID de usuario",
  "BTN_REGEN_ID_TOOLTIP": "Regenerar tu ID interno y volver a conectarte",
  "REGEN_ID_DESC": "Usa esto si ves errores de 'Identidad duplicada'.",
-  "REGEN_ID_OTHER_ISSUE": "¿Otro problema? Abre un Issue en GitHub",
+  "REGEN_ID_OTHER_ISSUE": "¿Tienes otro problema? Abre un reporte en GitHub",
+  "TOAST_ID_REGENERATED": "Identidad regenerada — reconectando…",
  "LABEL_CONN_STATUS": "Estado de la conexión",
  "LABEL_CONN_STATUS_TOOLTIP": "Estado actual de la conexión WebSocket",
  "CONN_STATUS_DISCONNECTED": "Desconectado",
@@ -115,7 +134,7 @@
  "BTN_ONBOARDING_NEXT": "Siguiente",
  "BTN_ONBOARDING_NEXT_TOOLTIP": "Ir al siguiente paso",
  "ONBOARDING_1_TITLE": "¡Bienvenido a KoalaSync!",
-  "ONBOARDING_1_TEXT": "Mira videos juntos en perfecta sincronización, sin importar dónde estén. ¡Hagamos un recorrido rápido!",
+  "ONBOARDING_1_TEXT": "Mira videos junto a tus amigos en perfecta sincronización, sin importar dónde estén. ¡Hagamos un recorrido rápido!",
  "ONBOARDING_2_TITLE": "1. Crear una sala",
  "ONBOARDING_2_TEXT": "Comienza aquí. Crea una sala y comparte el enlace de invitación con tus amigos.",
  "ONBOARDING_3_TITLE": "2. Seleccionar video",
@@ -127,7 +146,7 @@
  "ERR_CONN_TIMEOUT": "Tiempo de conexión agotado. Inténtalo de nuevo.",
  "ERR_INVALID_SERVER_URL": "Formato de URL de servidor no válido.",
  "ERR_IDENTITY_NOT_LOADED": "Identidad no cargada aún. Espera un momento e inténtalo de nuevo.",
-  "ERR_NO_PEERS_TIME": "No hay otros participantes con posición conocida. Cambia a 'Traerlos a mí'.",
+  "ERR_NO_PEERS_TIME": "No hay otros participantes con posición conocida. Cambia a 'Traerlos a mi posición'.",
  "ERR_NO_VIDEO_TAB": "No se pudo conectar a la pestaña de video.",
  "ERR_SELECT_VIDEO": "¡Selecciona un video primero!",
  "TOAST_INVITE_COPIED": "¡Enlace de invitación copiado!",
@@ -135,14 +154,16 @@
  "TOAST_LOBBY_SKIPPED": "Sala de espera de episodio omitida.",
  "TOAST_LOBBY_SKIP_FAILED": "Error al omitir la sala de espera.",
  "TOAST_LOGS_COPIED": "¡Copiado!",
-  "TOAST_PEER_JOINED": "{name} se unió a la sala",
-  "TOAST_PEER_LEFT": "{name} salió de la sala",
+  "TOAST_PEER_JOINED": "{name} se ha unido a la sala",
+  "TOAST_PEER_LEFT": "{name} ha salido de la sala",
  "TOAST_PEER_ACTION": "{name} ha {action}",
  "STATUS_CONNECTED": "Conectado",
  "STATUS_RECONNECTING": "Reconectando...",
  "STATUS_CONNECTING": "Conectando...",
  "STATUS_FAILED": "Error",
  "STATUS_DISCONNECTED": "Desconectado",
+  "STATUS_IDLE": "Listo para conectar",
+  "STATUS_IDLE_TOOLTIP": "KoalaSync está listo. Únete o crea una sala para conectarte y empezar a sincronizar.",
  "BTN_STATE_JOINING": "🚀 Uniéndose...",
  "BTN_STATE_RECONNECTING": "🔄 Reconectando...",
  "BTN_STATE_PLAYING": "▶ Reproduciendo...",
@@ -150,17 +171,17 @@
  "BTN_STATE_SYNCING_GROUP": "Sincronizando al grupo ({time})...",
  "BTN_STATE_SYNCING": "Sincronizando...",
  "BTN_STATE_SYNCED": "✅ ¡Sincronizado!",
-  "NOTIF_PLAY": "inició la reproducción",
-  "NOTIF_PAUSE": "pausó la reproducción",
-  "NOTIF_SEEK": "cambió la posición del video",
-  "NOTIF_FORCE_PREPARE": "inició una sincronización forzada",
-  "NOTIF_FORCE_EXECUTE": "sincronizó a todos",
+  "NOTIF_PLAY": "ha iniciado la reproducción",
+  "NOTIF_PAUSE": "ha pausado la reproducción",
+  "NOTIF_SEEK": "ha cambiado la posición del video",
+  "NOTIF_FORCE_PREPARE": "ha iniciado una sincronización forzada",
+  "NOTIF_FORCE_EXECUTE": "ha sincronizado a todos",
  "DEBUG_NO_TAB": "No hay pestaña objetivo seleccionada.",
  "DEBUG_COMM_FAIL": "No se pudo comunicar con el video de la pestaña.",
  "EMPTY_PEERS_TITLE": "Sin participantes aún",
  "EMPTY_PEERS_HINT": "Comparte tu enlace de invitación para comenzar",
  "EMPTY_HISTORY_TITLE": "Sin actividad aún",
-  "EMPTY_HISTORY_HINT": "Reproduce, pausa o busca para ver el historial",
+  "EMPTY_HISTORY_HINT": "Reproduce, pausa o salta en el tiempo para ver el historial",
  "EMPTY_LOGS_TITLE": "Sin registros",
  "EMPTY_LOGS_HINT": "Los eventos de conexión aparecerán aquí",
  "EMPTY_ROOMS_TITLE": "Sin salas activas",
@@ -181,7 +202,7 @@
  "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Tiempo de espera agotado: no todos los participantes cargaron el episodio",
  "LOBBY_CANCEL_USER": "Cancelado por el usuario",
  "NOTIF_ERROR_TITLE": "Error de KoalaSync",
-  "FOOTER_SUPPORT": "☕ Invítame a un café",
+  "FOOTER_SUPPORT": "Support KoalaSync",
  "FOOTER_REVIEW": "★ Valorar",
  "FOOTER_SUPPORT_PROMPT": "¿Te gusta KoalaSync? ¡Deja una reseña!",
  "LABEL_AUDIO_PROCESSING": "Procesamiento de audio",
@@ -199,11 +220,23 @@
  "AUDIO_PRESET_VOCAL_ENHANCEMENT": "Mejora de voz",
  "AUDIO_PRESET_SMOOTH": "Suave",
  "AUDIO_PRESET_CUSTOM": "Personalizado",
-  "AUDIO_PARAM_THRESHOLD": "Umbral",
-  "AUDIO_PARAM_KNEE": "Knee",
-  "AUDIO_PARAM_RATIO": "Ratio",
-  "AUDIO_PARAM_ATTACK": "Attack",
-  "AUDIO_PARAM_RELEASE": "Release",
+  "AUDIO_PARAM_THRESHOLD": "Umbral (Threshold)",
+  "AUDIO_PARAM_KNEE": "Codo (Knee)",
+  "AUDIO_PARAM_RATIO": "Relación (Ratio)",
+  "AUDIO_PARAM_ATTACK": "Ataque (Attack)",
+  "AUDIO_PARAM_RELEASE": "Liberación (Release)",
  "AUDIO_EQUALIZER": "Ecualizador",
-  "AUDIO_COMING_SOON": "Próximamente"
+  "AUDIO_COMING_SOON": "Próximamente",
+  "BTN_RESTART_TOUR": "Reiniciar tutorial",
+  "BTN_RESTART_TOUR_TOOLTIP": "Reiniciar el tutorial de inicio",
+  "HINT_SELECT_VIDEO": "¡Selecciona tu video aquí!",
+  "OPTION_TITLE_PRIVACY_FULL": "Enviar título completo",
+  "OPTION_TITLE_PRIVACY_EPISODE": "Enviar ID de episodio",
+  "OPTION_TITLE_PRIVACY_HIDDEN": "No enviar",
+  "LABEL_PRIVACY_SETTINGS": "Ajustes de privacidad",
+  "LABEL_PRIVACY_SETTINGS_TOOLTIP": "Elige qué títulos de pestaña y multimedia se envían a la sala.",
+  "LABEL_SEND_TAB_TITLE": "Enviar título de pestaña",
+  "LABEL_SEND_TAB_TITLE_TOOLTIP": "Envía a la sala el título de la pestaña del navegador seleccionada.",
+  "LABEL_MEDIA_TITLE_PRIVACY": "Título multimedia",
+  "LABEL_MEDIA_TITLE_PRIVACY_TOOLTIP": "Elige cómo se envían los títulos multimedia a la sala."
 }
@@ -44,6 +44,24 @@
  "LABEL_INVITE_LINK_TOOLTIP": "Partagez ce lien avec vos amis pour qu'ils vous rejoignent",
  "LABEL_PEERS_IN_ROOM": "Membres dans le salon",
  "LABEL_PEERS_IN_ROOM_TOOLTIP": "Autres utilisateurs connectés à ce salon",
+  "LABEL_HOST_CONTROL": "Contrôle de l'hôte",
+  "LABEL_HOST_CONTROL_TOOLTIP": "Définir qui peut contrôler la lecture dans ce salon",
+  "LABEL_HOST_ONLY_TOGGLE": "Moi seul peux contrôler la lecture",
+  "NOTICE_HOST_CONTROLS": "L'hôte contrôle la lecture pour tout le monde.",
+  "NOTICE_COHOST_HINT": "Astuce : donnez le contrôle à des participants précis dans la liste ci-dessous.",
+  "BADGE_HOST": "Hôte",
+  "BADGE_GUEST": "Invité",
+  "BADGE_CONTROLLER": "Contrôleur",
+  "BTN_GIVE_CONTROL": "Donner le contrôle",
+  "BTN_REVOKE_CONTROL": "Retirer",
+  "BADGE_DESYNCED": "Solo",
+  "TOOLTIP_PEER_DESYNCED": "Regarde de son côté — ignore les commandes de l'hôte",
+  "HCM_DIALOG_TITLE": "KoalaSync · L'hôte contrôle ce salon",
+  "HCM_DIALOG_BODY": "Seul l'hôte peut contrôler la lecture dans ce salon. Continuer à regarder ensemble, ou regarder de votre côté ?",
+  "HCM_DIALOG_STAY": "Rester synchronisé",
+  "HCM_DIALOG_SOLO": "Regarder de mon côté",
+  "HCM_BADGE_SOLO": "Vous regardez seul",
+  "HCM_BADGE_RESYNC": "Resynchroniser",
  "NO_PEERS_CONNECTED": "Aucun membre connecté",
  "BTN_LEAVE_ROOM": "Quitter le salon",
  "LABEL_SELECT_VIDEO": "Choisir une vidéo",
@@ -92,6 +110,7 @@
  "BTN_REGEN_ID_TOOLTIP": "Régénérer votre identifiant interne et vous reconnecter",
  "REGEN_ID_DESC": "Utilisez cette option si vous rencontrez des erreurs de 'Double identité'.",
  "REGEN_ID_OTHER_ISSUE": "Autre problème? Ouvrez un Issue GitHub",
+  "TOAST_ID_REGENERATED": "Identité régénérée — reconnexion…",
  "LABEL_CONN_STATUS": "Statut de la connexion",
  "LABEL_CONN_STATUS_TOOLTIP": "Statut actuel de la connexion WebSocket",
  "CONN_STATUS_DISCONNECTED": "Déconnecté",
@@ -143,6 +162,8 @@
  "STATUS_CONNECTING": "Connexion...",
  "STATUS_FAILED": "Échec",
  "STATUS_DISCONNECTED": "Déconnecté",
+  "STATUS_IDLE": "Prêt à se connecter",
+  "STATUS_IDLE_TOOLTIP": "KoalaSync est prêt. Rejoignez ou créez un salon pour vous connecter et commencer la synchronisation.",
  "BTN_STATE_JOINING": "🚀 Connexion...",
  "BTN_STATE_RECONNECTING": "🔄 Reconnexion...",
  "BTN_STATE_PLAYING": "▶ Lecture...",
@@ -181,7 +202,7 @@
  "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Délai dépassé — tous les membres n'ont pas chargé l'épisode",
  "LOBBY_CANCEL_USER": "Annulé par l'utilisateur",
  "NOTIF_ERROR_TITLE": "Erreur KoalaSync",
-  "FOOTER_SUPPORT": "☕ Offre-moi un café",
+  "FOOTER_SUPPORT": "Support KoalaSync",
  "FOOTER_REVIEW": "★ Évaluer",
  "FOOTER_SUPPORT_PROMPT": "Tu aimes KoalaSync? Laisse un avis!",
  "LABEL_AUDIO_PROCESSING": "Traitement audio",
@@ -205,5 +226,17 @@
  "AUDIO_PARAM_ATTACK": "Attack",
  "AUDIO_PARAM_RELEASE": "Release",
  "AUDIO_EQUALIZER": "Égaliseur",
-  "AUDIO_COMING_SOON": "Bientôt disponible"
+  "AUDIO_COMING_SOON": "Bientôt disponible",
+  "BTN_RESTART_TOUR": "Redémarrer le tutoriel",
+  "BTN_RESTART_TOUR_TOOLTIP": "Recommencer le tutoriel d'intégration",
+  "HINT_SELECT_VIDEO": "Sélectionnez votre vidéo ici !",
+  "OPTION_TITLE_PRIVACY_FULL": "Envoyer le titre complet",
+  "OPTION_TITLE_PRIVACY_EPISODE": "Envoyer l’identifiant d’épisode",
+  "OPTION_TITLE_PRIVACY_HIDDEN": "Ne pas envoyer",
+  "LABEL_PRIVACY_SETTINGS": "Paramètres de confidentialité",
+  "LABEL_PRIVACY_SETTINGS_TOOLTIP": "Choisissez quels titres d’onglet et de média sont envoyés au salon.",
+  "LABEL_SEND_TAB_TITLE": "Envoyer le titre de l’onglet",
+  "LABEL_SEND_TAB_TITLE_TOOLTIP": "Envoie au salon le titre de l’onglet de navigateur sélectionné.",
+  "LABEL_MEDIA_TITLE_PRIVACY": "Titre du média",
+  "LABEL_MEDIA_TITLE_PRIVACY_TOOLTIP": "Choisissez comment les titres des médias sont envoyés au salon."
 }
@@ -1,204 +0,0 @@
-# KoalaSync Browser Extension v2.0 - i18n Technical Implementation Plan
-
-Welcome, future Antigravity AI agent! This document is placed directly in the codebase at `/extension/locales/i18n_plan.md` to serve as a comprehensive architectural handbook for the next steps in adding **full internationalization (i18n) support to the browser extension itself** while maintaining 100% video-sync and background communication safety.
-
---
-
-## 🔍 Context & Audited Scope
-
-KoalaSync is a lightweight, premium browser extension (Chrome & Firefox Manifest V3) for synchronized video playback. The landing pages are already compiled dynamically in 6 languages:
-*   English (`en`)
-*   German (`de`)
-*   French (`fr`)
-*   Spanish (`es`)
-*   Portuguese (Brazil) (`pt-BR`)
-*   Russian (`ru`)
-
-Our goal is to build an identical, premium translation engine for the extension itself.
-
---
-
-## 🏛️ Architectural Choice: Custom JSON Dictionary Engine (Approach B)
-
-We evaluated two paths:
-1.  **Approach A (Native `chrome.i18n` API):** Uses `_locales/` directory. Too rigid—cannot support real-time dynamic switching inside the extension Settings dropdown without closing/re-opening the popup.
-2.  **Approach B (Custom Unified JSON Engine):** Uses flat JSON files matching our website files (`"KEY": "Value"`). Dynamically merges the target dictionary with baseline English `en.json` at runtime, programmatically providing an **airtight English fallback** and **real-time DOM translations** without popup reload.
-
-We chose **Approach B** for maximum compatibility, premium real-time toggling, and clean fallback safety.
-
---
-
-## 🔄 Resolve, Load, & State Flow
-
-1.  **On launch:** Look for saved language in `chrome.storage.sync.get('locale')`.
-2.  **Fallback Autodetect:** If no saved language, read `navigator.language` or `chrome.i18n.getUILanguage()`.
-    *   If the detected locale is supported, set as active.
-    *   If not supported, default to English (`en`).
-3.  **Dictionary Resolution:**
-    *   Asynchronously load the English baseline dictionary (`/extension/locales/en.json`).
-    *   If the target language is different, load target JSON (e.g. `/extension/locales/de.json`) and execute `Object.assign({}, enDict, targetDict)`. This guarantees dynamic translation while cleanly falling back to English for any missing keys.
-4.  **DOM Replacements:** Scan for `data-i18n`, `data-i18n-title`, and `data-i18n-placeholder` attributes, and translate them on the fly.
-5.  **Persistence:** Save dynamic selection modifications from the dropdown into `chrome.storage.sync`. Trigger instant DOM re-translation on change.
-
---
-
-## 📂 Proposed File Structure
-
-```
-KoalaPlay/
-└── extension/
-    ├── locales/                # [NEW] Contains flat translation maps
-    │   ├── i18n_plan.md        # This roadmap file
-    │   ├── en.json             # Flat English baseline keys
-    │   ├── de.json             # German keys
-    │   ├── fr.json             # French keys
-    │   ├── es.json             # Spanish keys
-    │   ├── pt-BR.json          # Portuguese (Brasil) keys
-    │   └── ru.json             # Russian keys
-    ├── i18n.js                 # [NEW] ESM translation engine module
-    ├── popup.html              # Modified with data-i18n attributes
-    ├── popup.js                # Modified to initialize locales and update variables
-    └── background.js           # Modified to push localized notification alerts
-```
-
---
-
-## 🛠️ Draft Code Snippets
-
-### 1. `i18n.js` (Zero-Dependency Engine Module)
-```javascript
-// extension/i18n.js
-export const SUPPORTED_LANGUAGES = ['en', 'de', 'fr', 'es', 'pt-BR', 'ru'];
-export const DEFAULT_LANGUAGE = 'en';
-
-let activeDictionary = {};
-
-export async function loadLocale(langCode) {
-    const resolvedLang = SUPPORTED_LANGUAGES.includes(langCode) ? langCode : DEFAULT_LANGUAGE;
-    try {
-        const enResponse = await fetch(chrome.runtime.getURL(`locales/${DEFAULT_LANGUAGE}.json`));
-        const enDict = await enResponse.json();
-        
-        if (resolvedLang === DEFAULT_LANGUAGE) {
-            activeDictionary = enDict;
-            return;
-        }
-
-        const targetResponse = await fetch(chrome.runtime.getURL(`locales/${resolvedLang}.json`));
-        const targetDict = await targetResponse.json();
-        
-        activeDictionary = Object.assign({}, enDict, targetDict);
-    } catch (err) {
-        console.error('[i18n] Failed to load dictionary. Falling back to English:', err);
-        const rescue = await fetch(chrome.runtime.getURL(`locales/${DEFAULT_LANGUAGE}.json`));
-        activeDictionary = await rescue.json();
-    }
-}
-
-export function getMessage(key) {
-    return activeDictionary[key] || key;
-}
-
-export function translateDOM() {
-    // Translate text nodes
-    document.querySelectorAll('[data-i18n]').forEach(el => {
-        const key = el.getAttribute('data-i18n');
-        const translated = getMessage(key);
-        const img = el.querySelector('img');
-        if (img) {
-            el.innerHTML = '';
-            el.appendChild(img);
-            el.appendChild(document.createTextNode(' ' + translated));
-        } else {
-            el.textContent = translated;
-        }
-    });
-
-    // Translate tooltips
-    document.querySelectorAll('[data-i18n-title]').forEach(el => {
-        const key = el.getAttribute('data-i18n-title');
-        el.setAttribute('title', getMessage(key));
-    });
-
-    // Translate placeholders
-    document.querySelectorAll('[data-i18n-placeholder]').forEach(el => {
-        const key = el.getAttribute('data-i18n-placeholder');
-        el.setAttribute('placeholder', getMessage(key));
-    });
-}
-```
-
-### 2. Markup Changes (`popup.html`)
-*   Annotate text elements: `<button class="tab-btn" data-tab="tab-settings" data-i18n="TAB_SETTINGS" data-i18n-title="TAB_SETTINGS_TOOLTIP">Settings</button>`
-*   Add Language Dropdown in the Settings Panel:
-    ```html
-    <div class="form-group" style="display: flex; align-items: center; justify-content: space-between; background: var(--card); padding: 10px; border-radius: 8px; margin-bottom: 12px; border: 1px solid #334155;">
-        <label style="margin-bottom: 0;" data-i18n="LABEL_LANGUAGE" title="Choose your preferred extension language">App Language</label>
-        <select id="langSelector" style="width: 150px; padding: 6px 10px; font-size: 13px; cursor: pointer;">
-            <option value="en">English</option>
-            <option value="de">Deutsch</option>
-            <option value="fr">Français</option>
-            <option value="es">Español</option>
-            <option value="pt-BR">Português (Brasil)</option>
-            <option value="ru">Русский</option>
-        </select>
-    </div>
-    ```
-
-### 3. Dynamic Script Wiring (`popup.js`)
-*   Import our engine: `import { loadLocale, translateDOM, getMessage } from './i18n.js';`
-*   Initialize during startup:
-    ```javascript
-    async function init() {
-        const data = await chrome.storage.sync.get(['locale', ...]);
-        let activeLang = data.locale;
-        if (!activeLang) {
-            const systemLang = (navigator.language || chrome.i18n.getUILanguage()).split('-')[0];
-            activeLang = ['en', 'de', 'fr', 'es', 'pt', 'ru'].includes(systemLang) ? (systemLang === 'pt' ? 'pt-BR' : systemLang) : 'en';
-            chrome.storage.sync.set({ locale: activeLang });
-        }
-        await loadLocale(activeLang);
-        translateDOM();
-        
-        // Select matching option in selector
-        const langSelector = document.getElementById('langSelector');
-        if (langSelector) langSelector.value = activeLang;
-        
-        // rest of standard init...
-    }
-    ```
-*   Listen to Settings change event:
-    ```javascript
-    const langSelector = document.getElementById('langSelector');
-    if (langSelector) {
-        langSelector.addEventListener('change', async () => {
-            const selectedLang = langSelector.value;
-            await chrome.storage.sync.set({ locale: selectedLang });
-            await loadLocale(selectedLang);
-            translateDOM();
-            // Re-render empty elements and tab list using new dynamic strings
-            refreshLogs();
-            refreshHistory();
-            populateTabs();
-        });
-    }
-    ```
-
-### 4. Background Notifications (`background.js`)
-*   Notifications inside `showNotification` should fetch dynamic keys based on `chrome.storage.sync` language settings and build clean alerts dynamically using `chrome.storage.sync.get('locale')`.
-*   Ensure that WebSocket event transmissions and video player scripts in `content.js` remain **completely untouched and unaware** of the localization engine.
-
---
-
-## 🔒 Safety Guardrail
-
-*   **WebSocket Engine Integrity:** Under no circumstances should `background.js` Socket.IO handshakes, rate limits, or binary protocol headers be adjusted. i18n is strictly an interface rendering skin layer.
-*   **Player Control Pipeline Integrity:** `content.js` expectedEvent suppression tables, HLS buffer calculations, and Media Session API listeners must remain untouched. Do not bind any i18n logic into the content script's active tracking loop.
-
---
-
-## 🧪 Verification Tasks
-
-1.  **Autodetection Audit:** Force-load the extension in Chrome/Firefox in a non-English language container and ensure it starts in that language or English gracefully.
-2.  **Integrity Validation Script:** Write a sanity node checker script `/scripts/test-locales.js` to ensure all key structures are uniform across all JSON files.
-3.  **Real-Time Refresh Verification:** Change dynamic drop-down preferences and verify that every element and alert swaps languages cleanly with zero redraw glitches or page crashes.
@@ -3,8 +3,8 @@
  "HTML_CLASS": "lang-it",
  "APP_TITLE": "KoalaSync",
  "TAB_ROOM": "Stanza",
-  "TAB_ROOM_TOOLTIP": "Impostazioni della stanza e connessione",
-  "TAB_SYNC": "Sincronizza",
+  "TAB_ROOM_TOOLTIP": "Impostazioni della stanza y connessione",
+  "TAB_SYNC": "Sincro",
  "TAB_SYNC_TOOLTIP": "Controlli di sincronizzazione video e azioni remote",
  "TAB_SETTINGS": "Impostazioni",
  "TAB_SETTINGS_TOOLTIP": "Preferenze dell'estensione",
@@ -16,155 +16,176 @@
  "BTN_SERVER_OFFICIAL": "Ufficiale",
  "BTN_SERVER_OFFICIAL_TOOLTIP": "Usa il server ufficiale affidabile",
  "BTN_SERVER_CUSTOM": "Personalizzato",
-  "BTN_SERVER_CUSTOM_TOOLTIP": "Connettiti al tuo server ospitato autonomamente",
+  "BTN_SERVER_CUSTOM_TOOLTIP": "Connettiti al tuo server privato",
  "PLACEHOLDER_SERVER_URL": "wss://tuo-server:3000",
  "LABEL_ROOM_ID": "ID Stanza",
-  "LABEL_ROOM_ID_TOOLTIP": "L'identificatore univoco per la tua stanza di sincronizzazione",
+  "LABEL_ROOM_ID_TOOLTIP": "L'identificatore univoco per la tua stanza",
  "PLACEHOLDER_ROOM_ID": "Inserisci ID Stanza",
-  "PLACEHOLDER_ROOM_ID_TOOLTIP": "L'ID univoco della stanza a cui vuoi unirti",
+  "PLACEHOLDER_ROOM_ID_TOOLTIP": "L'ID della stanza a cui vuoi unirti",
  "LABEL_PASSWORD": "Password (Opzionale)",
-  "LABEL_PASSWORD_TOOLTIP": "Password opzionale per limitare l'accesso alla stanza",
+  "LABEL_PASSWORD_TOOLTIP": "Password per limitare l'accesso alla stanza",
  "PLACEHOLDER_PASSWORD": "Password della stanza (opzionale)",
-  "PLACEHOLDER_PASSWORD_TOOLTIP": "Password per la stanza (lascia vuoto se nessuna)",
+  "PLACEHOLDER_PASSWORD_TOOLTIP": "Lascia vuoto se non c'è una password",
  "BTN_JOIN_ROOM": "Entra / Crea Stanza",
-  "BTN_JOIN_ROOM_TOOLTIP": "Connettiti alla stanza",
+  "BTN_JOIN_ROOM_TOOLTIP": "Entra nella stanza",
  "LABEL_PUBLIC_ROOMS": "Stanze Pubbliche",
-  "LABEL_PUBLIC_ROOMS_TOOLTIP": "Elenco delle stanze pubblicamente disponibili su questo server",
+  "LABEL_PUBLIC_ROOMS_TOOLTIP": "Elenco delle stanze pubbliche su questo server",
  "BTN_REFRESH": "AGGIORNA",
-  "BTN_REFRESH_TOOLTIP": "Aggiorna l'elenco delle stanze pubbliche",
+  "BTN_REFRESH_TOOLTIP": "Aggiorna l'elenco delle stanze",
  "PUBLIC_ROOMS_REFRESHING": "Aggiornamento...",
  "BTN_REFRESH_COOLDOWN": "ATTENDI {seconds}s",
-  "BTN_REFRESH_COOLDOWN_TOOLTIP": "L'aggiornamento dell'elenco è in pausa. Riprova tra {seconds}s.",
-  "PUBLIC_ROOMS_REFRESHING_COOLDOWN": "Aggiornamento stanze pubbliche. Prossimo aggiornamento disponibile tra {seconds}s.",
+  "BTN_REFRESH_COOLDOWN_TOOLTIP": "Riprova tra {seconds}s.",
+  "PUBLIC_ROOMS_REFRESHING_COOLDOWN": "Aggiornamento in corso. Disponibile tra {seconds}s.",
  "LABEL_ACTIVE_ROOM": "Stanza Attiva",
-  "LABEL_ACTIVE_ROOM_TOOLTIP": "La stanza a cui sei attualmente connesso",
+  "LABEL_ACTIVE_ROOM_TOOLTIP": "La stanza a cui sei connesso",
  "ACTIVE_ROOM_NONE": "NESSUNA",
  "ACTIVE_SERVER_OFFICIAL": "Server Ufficiale",
  "LABEL_INVITE_LINK": "Link di Invito",
-  "LABEL_INVITE_LINK_TOOLTIP": "Condividi questo link con gli amici per farli entrare",
-  "LABEL_PEERS_IN_ROOM": "Partecipanti nella Stanza",
-  "LABEL_PEERS_IN_ROOM_TOOLTIP": "Altri utenti attualmente connessi a questa stanza",
+  "LABEL_INVITE_LINK_TOOLTIP": "Condividi questo link per invitare i tuoi amici",
+  "LABEL_PEERS_IN_ROOM": "Partecipanti",
+  "LABEL_PEERS_IN_ROOM_TOOLTIP": "Utenti connessi a questa stanza",
+  "LABEL_HOST_CONTROL": "Controllo host",
+  "LABEL_HOST_CONTROL_TOOLTIP": "Limita chi può controllare la riproduzione in questa stanza",
+  "LABEL_HOST_ONLY_TOGGLE": "Solo io posso controllare la riproduzione",
+  "NOTICE_HOST_CONTROLS": "L'host controlla la riproduzione per tutti.",
+  "NOTICE_COHOST_HINT": "Suggerimento: concedi il controllo ai singoli partecipanti nell'elenco qui sotto.",
+  "BADGE_HOST": "Host",
+  "BADGE_GUEST": "Ospite",
+  "BADGE_CONTROLLER": "Controller",
+  "BTN_GIVE_CONTROL": "Dai il controllo",
+  "BTN_REVOKE_CONTROL": "Revoca",
+  "BADGE_DESYNCED": "Solo",
+  "TOOLTIP_PEER_DESYNCED": "Guarda per conto proprio — ignora i comandi dell'host",
+  "HCM_DIALOG_TITLE": "KoalaSync · L'host controlla questa stanza",
+  "HCM_DIALOG_BODY": "Solo l'host può controllare la riproduzione in questa stanza. Continuare a guardare insieme o guardare per conto tuo?",
+  "HCM_DIALOG_STAY": "Resta sincronizzato",
+  "HCM_DIALOG_SOLO": "Guarda per conto mio",
+  "HCM_BADGE_SOLO": "Stai guardando da solo",
+  "HCM_BADGE_RESYNC": "Risincronizza",
  "NO_PEERS_CONNECTED": "Nessun partecipante connesso",
  "BTN_LEAVE_ROOM": "Lascia Stanza",
  "LABEL_SELECT_VIDEO": "Seleziona Video",
-  "LABEL_SELECT_VIDEO_TOOLTIP": "Scegli la scheda del browser contenente il video da sincronizzare",
+  "LABEL_SELECT_VIDEO_TOOLTIP": "Scegli la scheda con il video da sincronizzare",
  "OPTION_SELECT_TAB": "-- Seleziona una Scheda --",
-  "LABEL_REMOTE_CONTROL": "Controllo Remoto",
+  "LABEL_REMOTE_CONTROL": "Telecomando",
  "BTN_COPY_INVITE": "📋 Link di Invito",
-  "BTN_COPY_INVITE_TOOLTIP": "Copia Link di Invito",
+  "BTN_COPY_INVITE_TOOLTIP": "Copia il link di invito",
  "BTN_PLAY": "▶ Riproduci",
-  "BTN_PLAY_TOOLTIP": "Invia un comando di riproduzione a tutti",
+  "BTN_PLAY_TOOLTIP": "Avvia la riproduzione per tutti",
  "BTN_PAUSE": "⏸ Pausa",
-  "BTN_PAUSE_TOOLTIP": "Invia un comando di pausa a tutti",
-  "BTN_SYNC": "⚡ SYNC",
-  "BTN_SYNC_TOOLTIP": "Forza la sincronizzazione di tutti gli utenti",
-  "OPTION_JUMP_TO_OTHERS": "Salto dagli Altri",
-  "OPTION_JUMP_TO_ME": "Salto da Me",
-  "OPTION_JUMP_MODE_TOOLTIP": "Scegli il target di sincronizzazione",
-  "LABEL_LAST_ACTIVITY": "Stato Ultima Attività",
-  "LABEL_LAST_ACTIVITY_TOOLTIP": "Mostra il comando più recente di riproduzione, pausa o ricerca",
+  "BTN_PAUSE_TOOLTIP": "Metti in pausa per tutti",
+  "BTN_SYNC": "⚡ SINCRO",
+  "BTN_SYNC_TOOLTIP": "Forza la sincronizzazione per tutti",
+  "OPTION_JUMP_TO_OTHERS": "Vai alla posizione degli altri",
+  "OPTION_JUMP_TO_ME": "Portali alla mia posizione",
+  "OPTION_JUMP_MODE_TOOLTIP": "Scegli l'obiettivo di sincronizzazione",
+  "LABEL_LAST_ACTIVITY": "Ultima Attività",
+  "LABEL_LAST_ACTIVITY_TOOLTIP": "Mostra l'ultimo comando inviato",
  "NO_RECENT_COMMANDS": "Nessun comando recente",
-  "LOBBY_HEADER": "LOBBY EPISODIO",
+  "LOBBY_HEADER": "SALA D'ATTESA EPISODIO",
  "LOBBY_WAITING_FOR": "🎬 In attesa di: \"{title}\"",
  "LOBBY_WAITING_PEERS": "In attesa dei partecipanti...",
-  "BTN_SKIP_PLAY": "Salta e riproduci comunque",
-  "BTN_SKIP_PLAY_TOOLTIP": "Annulla la lobby e riproduci comunque",
-  "LOBBY_CONNECT_FIRST": "Connettiti prima a una stanza",
-  "LOBBY_CONNECT_FIRST_DESC": "Devi unirti a una stanza tramite un link di invito o crearne una nuova per sincronizzare i video.",
+  "BTN_SKIP_PLAY": "Salta e riproduci ora",
+  "BTN_SKIP_PLAY_TOOLTIP": "Annulla l'attesa e riproduci comunque",
+  "LOBBY_CONNECT_FIRST": "Entra prima in una stanza",
+  "LOBBY_CONNECT_FIRST_DESC": "Devi unirti a una stanza o crearne una nuova per sincronizzare i video.",
  "BTN_CREATE_ROOM_ALT": "Crea Nuova Stanza",
-  "BTN_CREATE_ROOM_ALT_TOOLTIP": "Crea una nuova stanza casuale ed entra",
+  "BTN_CREATE_ROOM_ALT_TOOLTIP": "Crea una stanza casuale ed entra",
  "LABEL_USERNAME": "Tuo Nome Utente",
-  "LABEL_USERNAME_TOOLTIP": "Il nome utente aiuta gli altri a identificarti.",
+  "LABEL_USERNAME_TOOLTIP": "Il tuo nome visibile agli altri.",
  "PLACEHOLDER_USERNAME": "Koala Anonimo",
-  "LABEL_HIDE_CLUTTER": "Nascondi Schede Inutili",
-  "LABEL_HIDE_CLUTTER_TOOLTIP": "Filtra le schede senza video e i domini non correlati per mantenere pulito l'elenco",
-  "LABEL_AUTO_SYNC_NEXT": "Auto-Sync Prossimo Episodio",
-  "LABEL_AUTO_SYNC_NEXT_TOOLTIP": "Pausa automaticamente e attende tutti i partecipanti al cambio episodio, poi si avvia in sincro.",
-  "LABEL_AUTO_COPY_INVITE": "Copia Automatica Invito",
-  "LABEL_AUTO_COPY_INVITE_TOOLTIP": "Copia automaticamente il link di invito negli appunti quando crei una nuova stanza.",
+  "LABEL_HIDE_CLUTTER": "Nascondi schede senza video",
+  "LABEL_HIDE_CLUTTER_TOOLTIP": "Mantiene pulito l'elenco filtrando le schede non pertinenti",
+  "LABEL_AUTO_SYNC_NEXT": "Sincro auto prossimo episodio",
+  "LABEL_AUTO_SYNC_NEXT_TOOLTIP": "Attende tutti i partecipanti prima di avviare il prossimo episodio.",
+  "LABEL_AUTO_COPY_INVITE": "Copia automatica invito",
+  "LABEL_AUTO_COPY_INVITE_TOOLTIP": "Copia il link negli appunti quando crei una nuova stanza.",
  "LABEL_NOTIFICATIONS": "Notifiche del Browser",
-  "LABEL_NOTIFICATIONS_TOOLTIP": "Mostra le notifiche di sistema quando qualcuno entra/esce o riproduce/mette in pausa.",
+  "LABEL_NOTIFICATIONS_TOOLTIP": "Mostra notifiche quando qualcuno entra, esce o cambia stato.",
  "LABEL_LANGUAGE": "Lingua Applicazione",
-  "LABEL_LANGUAGE_TOOLTIP": "Scegli la lingua preferita per l'estensione",
+  "LABEL_LANGUAGE_TOOLTIP": "Scegli la lingua dell'estensione",
  "LABEL_TROUBLESHOOTING": "Risoluzione Problemi",
  "LABEL_TROUBLESHOOTING_TOOLTIP": "Strumenti per risolvere problemi di connessione",
-  "BTN_REGEN_ID": "Rigenera ID Peer",
-  "BTN_REGEN_ID_TOOLTIP": "Rigenera il tuo ID interno e riconnettiti",
-  "REGEN_ID_DESC": "Usa questo se riscontri errori di \"Identità Duplicata\".",
-  "REGEN_ID_OTHER_ISSUE": "Altro problema? Apri una Issue su GitHub",
+  "BTN_REGEN_ID": "Rigenera ID Utente",
+  "BTN_REGEN_ID_TOOLTIP": "Genera un nuovo ID interno e riconnettiti",
+  "REGEN_ID_DESC": "Usa questa opzione se riscontri errori di 'Identità Duplicata'.",
+  "REGEN_ID_OTHER_ISSUE": "Hai altri problemi? Apri una segnalazione su GitHub",
+  "TOAST_ID_REGENERATED": "Identità rigenerata — riconnessione…",
  "LABEL_CONN_STATUS": "Stato Connessione",
-  "LABEL_CONN_STATUS_TOOLTIP": "Stato corrente della connessione WebSocket",
+  "LABEL_CONN_STATUS_TOOLTIP": "Stato attuale della connessione",
  "CONN_STATUS_DISCONNECTED": "Disconnesso",
  "BTN_RETRY": "RIPROVA",
  "BTN_RETRY_TOOLTIP": "Tenta di riconnettersi al server",
  "BTN_COPY_LOGS": "Copia Log",
-  "BTN_COPY_LOGS_TOOLTIP": "Copia i log negli appunti per la condivisione",
-  "LABEL_VIDEO_DEBUG": "Info Debug Video",
-  "LABEL_VIDEO_DEBUG_TOOLTIP": "Dettagli tecnici sull'elemento video attualmente selezionato",
+  "BTN_COPY_LOGS_TOOLTIP": "Copia i log negli appunti",
+  "LABEL_VIDEO_DEBUG": "Debug Video",
+  "LABEL_VIDEO_DEBUG_TOOLTIP": "Dettagli tecnici sul video selezionato",
  "VIDEO_DEBUG_EMPTY": "Nessuna scheda selezionata o video rilevato.",
-  "LABEL_HISTORY": "Cronologia Azioni Completa",
-  "LABEL_HISTORY_TOOLTIP": "Registro cronologico di tutti i comandi di sincronizzazione nella stanza",
+  "LABEL_HISTORY": "Cronologia Completa",
+  "LABEL_HISTORY_TOOLTIP": "Registro di tutti i comandi inviati nella stanza",
  "HISTORY_EMPTY": "Ancora nessuna attività",
  "LABEL_LOGS": "Log (Ultimi 50)",
-  "LABEL_LOGS_TOOLTIP": "Log di connessione tecnica per il debug",
+  "LABEL_LOGS_TOOLTIP": "Log tecnici per il debug",
  "BTN_CLEAR": "PULISCI",
-  "BTN_CLEAR_TOOLTIP": "Cancella l'output del log",
+  "BTN_CLEAR_TOOLTIP": "Cancella i log",
  "LABEL_GITHUB": "Repository GitHub",
  "BTN_ONBOARDING_SKIP": "Salta",
  "BTN_ONBOARDING_SKIP_TOOLTIP": "Salta il tutorial",
  "BTN_ONBOARDING_NEXT": "Avanti",
  "BTN_ONBOARDING_NEXT_TOOLTIP": "Vai al passaggio successivo",
  "ONBOARDING_1_TITLE": "Benvenuto in KoalaSync!",
-  "ONBOARDING_1_TEXT": "Guarda i video insieme in perfetta sincronia, non importa dove ti trovi. Facciamo un rapido tour!",
+  "ONBOARDING_1_TEXT": "Guarda i video insieme ai tuoi amici in perfetta sincronia. Facciamo un breve tour!",
  "ONBOARDING_2_TITLE": "1. Crea una Stanza",
-  "ONBOARDING_2_TEXT": "Inizia qui. Crea una stanza e condividi il link di invito con i tuoi amici.",
+  "ONBOARDING_2_TEXT": "Inizia da qui. Crea una stanza e condividi il link con i tuoi amici.",
  "ONBOARDING_3_TITLE": "2. Seleziona Video",
-  "ONBOARDING_3_TEXT": "Naviga qui per selezionare il video che vuoi sincronizzare. Riproduci, metti in pausa e cerca: tutti rimangono sincronizzati.",
+  "ONBOARDING_3_TEXT": "Scegli il video che vuoi sincronizzare. Play, pausa o salta: tutti vedranno lo stesso.",
  "ONBOARDING_4_TITLE": "3. Personalizza",
-  "ONBOARDING_4_TEXT": "Scegli un nome utente divertente così i tuoi amici sanno chi sei.",
+  "ONBOARDING_4_TEXT": "Scegli un nome utente per farti riconoscere dai tuoi amici.",
  "ONBOARDING_5_TITLE": "Tutto pronto!",
-  "ONBOARDING_5_TEXT": "È ora di prendere i popcorn. Buona visione insieme!",
+  "ONBOARDING_5_TEXT": "È ora di prendere i popcorn. Buona visione!",
  "ERR_CONN_TIMEOUT": "Connessione scaduta. Riprova.",
  "ERR_INVALID_SERVER_URL": "Formato URL del server non valido.",
-  "ERR_IDENTITY_NOT_LOADED": "Identità non ancora caricata. Attendi un momento e riprova.",
-  "ERR_NO_PEERS_TIME": "Nessun altro peer con un orario noto. Passa a 'Salto da Me'.",
+  "ERR_IDENTITY_NOT_LOADED": "Identità non ancora caricata. Attendi un momento.",
+  "ERR_NO_PEERS_TIME": "Nessun altro partecipante con posizione nota. Passa a 'Portali alla mia posizione'.",
  "ERR_NO_VIDEO_TAB": "Impossibile connettersi alla scheda del video.",
  "ERR_SELECT_VIDEO": "Seleziona prima un video!",
  "TOAST_INVITE_COPIED": "Link di invito copiato!",
  "TOAST_COPY_FAILED": "Impossibile copiare negli appunti",
-  "TOAST_LOBBY_SKIPPED": "Lobby dell'episodio saltata.",
-  "TOAST_LOBBY_SKIP_FAILED": "Impossibile saltare la lobby.",
+  "TOAST_LOBBY_SKIPPED": "Sala d'attesa saltata.",
+  "TOAST_LOBBY_SKIP_FAILED": "Impossibile saltare la sala d'attesa.",
  "TOAST_LOGS_COPIED": "Copiato!",
  "TOAST_PEER_JOINED": "{name} è entrato nella stanza",
  "TOAST_PEER_LEFT": "{name} ha lasciato la stanza",
-  "TOAST_PEER_ACTION": "{name} ha {action}",
+  "TOAST_PEER_ACTION": "{name} {action}",
  "STATUS_CONNECTED": "Connesso",
  "STATUS_RECONNECTING": "Riconnessione...",
  "STATUS_CONNECTING": "Connessione in corso...",
-  "STATUS_FAILED": "Fallito",
+  "STATUS_FAILED": "Errore",
  "STATUS_DISCONNECTED": "Disconnesso",
+  "STATUS_IDLE": "Pronto a connettersi",
+  "STATUS_IDLE_TOOLTIP": "KoalaSync è pronto. Entra o crea una stanza per connetterti e avviare la sincronizzazione.",
  "BTN_STATE_JOINING": "🚀 Entrando...",
  "BTN_STATE_RECONNECTING": "🔄 Riconnessione...",
-  "BTN_STATE_PLAYING": "▶ Riproduzione...",
+  "BTN_STATE_PLAYING": "▶ In riproduzione...",
  "BTN_STATE_PAUSING": "⏸ In pausa...",
-  "BTN_STATE_SYNCING_GROUP": "Sincronizzazione al gruppo ({time})...",
+  "BTN_STATE_SYNCING_GROUP": "Sincronizzazione di gruppo ({time})...",
  "BTN_STATE_SYNCING": "Sincronizzazione...",
  "BTN_STATE_SYNCED": "✅ Sincronizzato!",
-  "NOTIF_PLAY": "avviato la riproduzione",
-  "NOTIF_PAUSE": "messo in pausa la riproduzione",
-  "NOTIF_SEEK": "cercato nel video",
-  "NOTIF_FORCE_PREPARE": "avviato la sincronizzazione forzata",
-  "NOTIF_FORCE_EXECUTE": "sincronizzato tutti",
-  "DEBUG_NO_TAB": "Nessuna scheda di destinazione selezionata.",
-  "DEBUG_COMM_FAIL": "Impossibile comunicare con il video della scheda.",
-  "EMPTY_PEERS_TITLE": "Ancora nessun partecipante",
-  "EMPTY_PEERS_HINT": "Condividi il tuo link di invito per iniziare",
-  "EMPTY_HISTORY_TITLE": "Ancora nessuna attività",
-  "EMPTY_HISTORY_HINT": "Riproduci, metti in pausa o cerca per vedere la cronologia",
+  "NOTIF_PLAY": "ha avviato la riproduzione",
+  "NOTIF_PAUSE": "ha messo in pausa",
+  "NOTIF_SEEK": "ha cambiato posizione",
+  "NOTIF_FORCE_PREPARE": "ha avviato una sincronizzazione forzata",
+  "NOTIF_FORCE_EXECUTE": "ha sincronizzato tutti",
+  "DEBUG_NO_TAB": "Nessuna scheda selezionata.",
+  "DEBUG_COMM_FAIL": "Errore di comunicazione con il video.",
+  "EMPTY_PEERS_TITLE": "Nessun partecipante",
+  "EMPTY_PEERS_HINT": "Condividi il tuo link per iniziare",
+  "EMPTY_HISTORY_TITLE": "Nessuna attività",
+  "EMPTY_HISTORY_HINT": "Usa i comandi per vedere la cronologia",
  "EMPTY_LOGS_TITLE": "Nessun log",
-  "EMPTY_LOGS_HINT": "Gli eventi di connessione appariranno qui",
+  "EMPTY_LOGS_HINT": "Gli eventi appariranno qui",
  "EMPTY_ROOMS_TITLE": "Nessuna stanza attiva",
-  "EMPTY_ROOMS_HINT": "Crea una stanza o aggiorna per trovare quelle pubbliche",
+  "EMPTY_ROOMS_HINT": "Crea una stanza o aggiorna l'elenco",
  "LABEL_YOU": "Tu",
  "ONBOARDING_DONE": "Fatto!",
  "LABEL_LOBBY_PEER_READY": "Pronto",
@@ -173,37 +194,49 @@
  "LABEL_PEERS_COUNT": "{count} partecipanti",
  "LABEL_CUSTOM_SERVER": "Server Personalizzato",
  "BTN_STATE_CREATING": "🚀 Creazione Stanza...",
-  "NOTIF_LOBBY_CANCEL_TITLE": "KoalaSync — Sincronizzazione Episodio Fallita",
-  "NOTIF_LOBBY_CANCEL_MSG": "Auto-sync annullato: {reason}. Potrebbe essere necessaria una sincronizzazione manuale.",
-  "LOBBY_CANCEL_TIMEOUT": "Timeout",
-  "LOBBY_CANCEL_TIMEOUT_RECOVERED": "Timeout (ripristinato)",
-  "LOBBY_CANCEL_PEERS_LEFT": "Tutti gli altri partecipanti hanno lasciato la stanza",
-  "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Timeout — non tutti i partecipanti hanno caricato l'episodio",
+  "NOTIF_LOBBY_CANCEL_TITLE": "KoalaSync — Sincro Episodio Fallita",
+  "NOTIF_LOBBY_CANCEL_MSG": "Sincro auto annullata: {reason}. Usa la sincronizzazione manuale.",
+  "LOBBY_CANCEL_TIMEOUT": "Tempo scaduto",
+  "LOBBY_CANCEL_TIMEOUT_RECOVERED": "Tempo scaduto (ripristinato)",
+  "LOBBY_CANCEL_PEERS_LEFT": "Tutti gli altri partecipanti sono usciti",
+  "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Tempo scaduto: caricamento incompleto per alcuni partecipanti",
  "LOBBY_CANCEL_USER": "Annullato dall'utente",
  "NOTIF_ERROR_TITLE": "Errore KoalaSync",
-  "FOOTER_SUPPORT": "☕ Offrimi un caffè",
-  "FOOTER_REVIEW": "★ Valuta",
+  "FOOTER_SUPPORT": "Support KoalaSync",
+  "FOOTER_REVIEW": "★ Valutaci",
  "FOOTER_SUPPORT_PROMPT": "Ti piace KoalaSync? Lascia una recensione!",
-  "LABEL_AUDIO_PROCESSING": "Elaborazione audio",
-  "LABEL_AUDIO_PROCESSING_TOOLTIP": "Applica effetti audio come la compressione alla riproduzione video",
+  "LABEL_AUDIO_PROCESSING": "Elaborazione Audio",
+  "LABEL_AUDIO_PROCESSING_TOOLTIP": "Applica effetti sonori (come il compressore) ai video",
  "AUDIO_OPEN_SETTINGS": "Apri",
-  "NEW_FEATURE_AUDIO": "Novità: Elaborazione audio — prova il compressore!",
+  "NEW_FEATURE_AUDIO": "Novità: Elaborazione Audio — prova il compressore!",
  "AUDIO_BACK": "← Indietro",
-  "AUDIO_PAGE_TITLE": "Impostazioni audio",
-  "AUDIO_MASTER_TOGGLE": "Elaborazione audio",
+  "AUDIO_PAGE_TITLE": "Impostazioni Audio",
+  "AUDIO_MASTER_TOGGLE": "Elaborazione Audio",
  "AUDIO_COMPRESSOR": "Compressore",
-  "AUDIO_COMPRESSOR_ENABLE": "Attivato",
+  "AUDIO_COMPRESSOR_ENABLE": "Attivo",
  "AUDIO_PRESET": "Preimpostazione",
  "AUDIO_PRESET_RECOMMENDED": "Consigliato",
-  "AUDIO_PRESET_DYNAMIC_RANGE": "Gamma dinamica",
-  "AUDIO_PRESET_VOCAL_ENHANCEMENT": "Miglioramento vocale",
+  "AUDIO_PRESET_DYNAMIC_RANGE": "Gamma Dinamica",
+  "AUDIO_PRESET_VOCAL_ENHANCEMENT": "Miglioramento Vocale",
  "AUDIO_PRESET_SMOOTH": "Morbido",
  "AUDIO_PRESET_CUSTOM": "Personalizzato",
-  "AUDIO_PARAM_THRESHOLD": "Soglia",
-  "AUDIO_PARAM_KNEE": "Knee",
-  "AUDIO_PARAM_RATIO": "Ratio",
-  "AUDIO_PARAM_ATTACK": "Attack",
-  "AUDIO_PARAM_RELEASE": "Release",
+  "AUDIO_PARAM_THRESHOLD": "Soglia (Threshold)",
+  "AUDIO_PARAM_KNEE": "Ginocchio (Knee)",
+  "AUDIO_PARAM_RATIO": "Rapporto (Ratio)",
+  "AUDIO_PARAM_ATTACK": "Attacco (Attack)",
+  "AUDIO_PARAM_RELEASE": "Rilascio (Release)",
  "AUDIO_EQUALIZER": "Equalizzatore",
-  "AUDIO_COMING_SOON": "Prossimamente"
+  "AUDIO_COMING_SOON": "Prossimamente",
+  "BTN_RESTART_TOUR": "Riavvia Tutorial",
+  "BTN_RESTART_TOUR_TOOLTIP": "Riavvia il tutorial introduttivo",
+  "HINT_SELECT_VIDEO": "Scegli il tuo video qui!",
+  "OPTION_TITLE_PRIVACY_FULL": "Invia titolo completo",
+  "OPTION_TITLE_PRIVACY_EPISODE": "Invia ID episodio",
+  "OPTION_TITLE_PRIVACY_HIDDEN": "Non inviare",
+  "LABEL_PRIVACY_SETTINGS": "Impostazioni privacy",
+  "LABEL_PRIVACY_SETTINGS_TOOLTIP": "Scegli quali titoli di scheda e contenuto multimediale vengono inviati alla stanza.",
+  "LABEL_SEND_TAB_TITLE": "Invia titolo scheda",
+  "LABEL_SEND_TAB_TITLE_TOOLTIP": "Invia alla stanza il titolo della scheda del browser selezionata.",
+  "LABEL_MEDIA_TITLE_PRIVACY": "Titolo multimediale",
+  "LABEL_MEDIA_TITLE_PRIVACY_TOOLTIP": "Scegli come inviare alla stanza i titoli multimediali."
 }
@@ -29,7 +29,7 @@
  "BTN_JOIN_ROOM": "ルームに参加 / 作成",
  "BTN_JOIN_ROOM_TOOLTIP": "ルームに接続",
  "LABEL_PUBLIC_ROOMS": "公開ルーム",
-  "LABEL_PUBLIC_ROOMS_TOOLTIP": "このサーバー上の公開ルーム의リスト",
+  "LABEL_PUBLIC_ROOMS_TOOLTIP": "このサーバー上の公開ルームのリスト",
  "BTN_REFRESH": "更新",
  "BTN_REFRESH_TOOLTIP": "公開ルームのリストを更新",
  "PUBLIC_ROOMS_REFRESHING": "更新中...",
@@ -44,6 +44,24 @@
  "LABEL_INVITE_LINK_TOOLTIP": "友達とこのリンクを共有して参加してもらいましょう",
  "LABEL_PEERS_IN_ROOM": "ルーム内のメンバー",
  "LABEL_PEERS_IN_ROOM_TOOLTIP": "現在このルームに接続している他のユーザー",
+  "LABEL_HOST_CONTROL": "ホスト操作",
+  "LABEL_HOST_CONTROL_TOOLTIP": "このルームで再生を操作できる人を制限します",
+  "LABEL_HOST_ONLY_TOGGLE": "再生を操作できるのは自分だけ",
+  "NOTICE_HOST_CONTROLS": "ホストが全員の再生を操作します。",
+  "NOTICE_COHOST_HINT": "ヒント: 下の参加者リストで個別の参加者に操作権限を付与できます。",
+  "BADGE_HOST": "ホスト",
+  "BADGE_GUEST": "ゲスト",
+  "BADGE_CONTROLLER": "操作権あり",
+  "BTN_GIVE_CONTROL": "操作権を付与",
+  "BTN_REVOKE_CONTROL": "取り消す",
+  "BADGE_DESYNCED": "ソロ",
+  "TOOLTIP_PEER_DESYNCED": "単独で視聴中 — ホストのコマンドを無視しています",
+  "HCM_DIALOG_TITLE": "KoalaSync · ホストがこのルームを操作中",
+  "HCM_DIALOG_BODY": "このルームではホストのみが再生を操作できます。一緒に視聴を続けますか、それとも自分だけで視聴しますか？",
+  "HCM_DIALOG_STAY": "同期を維持",
+  "HCM_DIALOG_SOLO": "自分だけで視聴",
+  "HCM_BADGE_SOLO": "自分だけで視聴中",
+  "HCM_BADGE_RESYNC": "再同期",
  "NO_PEERS_CONNECTED": "接続しているメンバーはいません",
  "BTN_LEAVE_ROOM": "ルームを退室",
  "LABEL_SELECT_VIDEO": "ビデオを選択",
@@ -92,6 +110,7 @@
  "BTN_REGEN_ID_TOOLTIP": "内部IDを再生成して再接続します",
  "REGEN_ID_DESC": "「Duplicate Identity」（ID重複）エラーが表示される場合に使用します。",
  "REGEN_ID_OTHER_ISSUE": "他の問題？GitHub Issueを開く",
+  "TOAST_ID_REGENERATED": "IDを再生成しました — 再接続中…",
  "LABEL_CONN_STATUS": "接続状態",
  "LABEL_CONN_STATUS_TOOLTIP": "現在のWebSocket接続状態",
  "CONN_STATUS_DISCONNECTED": "切断されました",
@@ -143,6 +162,8 @@
  "STATUS_CONNECTING": "接続中...",
  "STATUS_FAILED": "失敗",
  "STATUS_DISCONNECTED": "切断されました",
+  "STATUS_IDLE": "接続準備完了",
+  "STATUS_IDLE_TOOLTIP": "KoalaSyncの準備ができました。ルームに参加するか作成して接続し、同期を開始してください。",
  "BTN_STATE_JOINING": "🚀 参加中...",
  "BTN_STATE_RECONNECTING": "🔄 再接続中...",
  "BTN_STATE_PLAYING": "▶ 再生中...",
@@ -181,7 +202,7 @@
  "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "タイムアウト — 一部のメンバーがエピソードを読み込めませんでした",
  "LOBBY_CANCEL_USER": "ユーザーによってキャンセルされました",
  "NOTIF_ERROR_TITLE": "KoalaSyncエラー",
-  "FOOTER_SUPPORT": "☕ コーヒーをおごってね",
+  "FOOTER_SUPPORT": "Support KoalaSync",
  "FOOTER_REVIEW": "★ 評価する",
  "FOOTER_SUPPORT_PROMPT": "KoalaSyncはいかが？レビューを書いてください！",
  "LABEL_AUDIO_PROCESSING": "オーディオ処理",
@@ -205,5 +226,17 @@
  "AUDIO_PARAM_ATTACK": "Attack",
  "AUDIO_PARAM_RELEASE": "Release",
  "AUDIO_EQUALIZER": "イコライザー",
-  "AUDIO_COMING_SOON": "近日公開"
+  "AUDIO_COMING_SOON": "近日公開",
+  "BTN_RESTART_TOUR": "チュートリアルを再起動",
+  "BTN_RESTART_TOUR_TOOLTIP": "オンボーディングチュートリアルを再起動する",
+  "HINT_SELECT_VIDEO": "ここで動画を選択してください！",
+  "OPTION_TITLE_PRIVACY_FULL": "完全なタイトルを送信",
+  "OPTION_TITLE_PRIVACY_EPISODE": "エピソードIDを送信",
+  "OPTION_TITLE_PRIVACY_HIDDEN": "送信しない",
+  "LABEL_PRIVACY_SETTINGS": "プライバシー設定",
+  "LABEL_PRIVACY_SETTINGS_TOOLTIP": "ルームに送信するタブタイトルとメディアタイトルを選択します。",
+  "LABEL_SEND_TAB_TITLE": "タブタイトルを送信",
+  "LABEL_SEND_TAB_TITLE_TOOLTIP": "選択中のブラウザータブのタイトルをルームに送信します。",
+  "LABEL_MEDIA_TITLE_PRIVACY": "メディアタイトル",
+  "LABEL_MEDIA_TITLE_PRIVACY_TOOLTIP": "メディアタイトルをルームに送信する方法を選択します。"
 }
@@ -30,7 +30,7 @@
  "BTN_JOIN_ROOM_TOOLTIP": "방에 연결",
  "LABEL_PUBLIC_ROOMS": "공개 방",
  "LABEL_PUBLIC_ROOMS_TOOLTIP": "이 서버의 공개 방 목록",
-  "BTN_REFRESH": "Refreschi",
+  "BTN_REFRESH": "새로고침",
  "BTN_REFRESH_TOOLTIP": "공개 방 목록 새로고침",
  "PUBLIC_ROOMS_REFRESHING": "새로고침 중...",
  "BTN_REFRESH_COOLDOWN": "{seconds}초 대기",
@@ -44,6 +44,24 @@
  "LABEL_INVITE_LINK_TOOLTIP": "친구들이 참여할 수 있도록 이 링크를 공유하세요",
  "LABEL_PEERS_IN_ROOM": "방의 참여자",
  "LABEL_PEERS_IN_ROOM_TOOLTIP": "현재 이 방에 연결되어 있는 다른 사용자들",
+  "LABEL_HOST_CONTROL": "호스트 제어",
+  "LABEL_HOST_CONTROL_TOOLTIP": "이 방에서 재생을 제어할 수 있는 사람 제한",
+  "LABEL_HOST_ONLY_TOGGLE": "나만 재생을 제어할 수 있음",
+  "NOTICE_HOST_CONTROLS": "호스트가 모두의 재생을 제어합니다.",
+  "NOTICE_COHOST_HINT": "팁: 아래 참가자 목록에서 개별 참가자에게 제어 권한을 부여하세요.",
+  "BADGE_HOST": "호스트",
+  "BADGE_GUEST": "게스트",
+  "BADGE_CONTROLLER": "제어자",
+  "BTN_GIVE_CONTROL": "제어 권한 부여",
+  "BTN_REVOKE_CONTROL": "취소",
+  "BADGE_DESYNCED": "단독",
+  "TOOLTIP_PEER_DESYNCED": "혼자 시청 중 — 호스트 명령을 무시합니다",
+  "HCM_DIALOG_TITLE": "KoalaSync · 호스트가 이 방을 제어합니다",
+  "HCM_DIALOG_BODY": "이 방에서는 호스트만 재생을 제어할 수 있습니다. 계속 함께 보시겠어요, 아니면 혼자 보시겠어요?",
+  "HCM_DIALOG_STAY": "동기화 유지",
+  "HCM_DIALOG_SOLO": "혼자 보기",
+  "HCM_BADGE_SOLO": "혼자 시청 중",
+  "HCM_BADGE_RESYNC": "다시 동기화",
  "NO_PEERS_CONNECTED": "연결된 참여자가 없습니다",
  "BTN_LEAVE_ROOM": "방 나가기",
  "LABEL_SELECT_VIDEO": "비디오 선택",
@@ -92,6 +110,7 @@
  "BTN_REGEN_ID_TOOLTIP": "내부 ID를 재생성하고 다시 연결합니다",
  "REGEN_ID_DESC": "\"중복된 ID\" 오류가 발생할 경우에 사용하세요.",
  "REGEN_ID_OTHER_ISSUE": "다른 문제? GitHub Issue 열기",
+  "TOAST_ID_REGENERATED": "ID가 재생성되었습니다 — 다시 연결 중…",
  "LABEL_CONN_STATUS": "연결 상태",
  "LABEL_CONN_STATUS_TOOLTIP": "현재 WebSocket 연결 상태",
  "CONN_STATUS_DISCONNECTED": "연결 끊김",
@@ -140,9 +159,11 @@
  "TOAST_PEER_ACTION": "{name} 님이 {action}",
  "STATUS_CONNECTED": "연결됨",
  "STATUS_RECONNECTING": "재연결 중...",
-  "STATUS_CONNECTING": "연kel 중...",
+  "STATUS_CONNECTING": "연결 중...",
  "STATUS_FAILED": "실패",
  "STATUS_DISCONNECTED": "연결 끊김",
+  "STATUS_IDLE": "연결 준비 완료",
+  "STATUS_IDLE_TOOLTIP": "KoalaSync가 준비되었습니다. 방에 참여하거나 생성하여 연결하고 동기화를 시작하세요.",
  "BTN_STATE_JOINING": "🚀 참여 중...",
  "BTN_STATE_RECONNECTING": "🔄 재연결 중...",
  "BTN_STATE_PLAYING": "▶ 재생 중...",
@@ -181,7 +202,7 @@
  "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "시간 초과 — 모든 피어가 에피소드를 로드하지 못했습니다",
  "LOBBY_CANCEL_USER": "사용자에 의해 취소됨",
  "NOTIF_ERROR_TITLE": "KoalaSync 오류",
-  "FOOTER_SUPPORT": "☕ 커피 한 잔 사주세요",
+  "FOOTER_SUPPORT": "Support KoalaSync",
  "FOOTER_REVIEW": "★ 평가하기",
  "FOOTER_SUPPORT_PROMPT": "KoalaSync가 마음에 드세요? 리뷰를 남겨주세요!",
  "LABEL_AUDIO_PROCESSING": "오디오 처리",
@@ -205,5 +226,17 @@
  "AUDIO_PARAM_ATTACK": "Attack",
  "AUDIO_PARAM_RELEASE": "Release",
  "AUDIO_EQUALIZER": "이퀄라이저",
-  "AUDIO_COMING_SOON": "출시 예정"
+  "AUDIO_COMING_SOON": "출시 예정",
+  "BTN_RESTART_TOUR": "튜토리얼 다시 시작",
+  "BTN_RESTART_TOUR_TOOLTIP": "온보딩 튜토리얼을 다시 시작합니다",
+  "HINT_SELECT_VIDEO": "여기에서 비디오를 선택하세요!",
+  "OPTION_TITLE_PRIVACY_FULL": "전체 제목 보내기",
+  "OPTION_TITLE_PRIVACY_EPISODE": "에피소드 ID 보내기",
+  "OPTION_TITLE_PRIVACY_HIDDEN": "보내지 않음",
+  "LABEL_PRIVACY_SETTINGS": "개인정보 설정",
+  "LABEL_PRIVACY_SETTINGS_TOOLTIP": "방에 보낼 탭 제목과 미디어 제목을 선택합니다.",
+  "LABEL_SEND_TAB_TITLE": "탭 제목 보내기",
+  "LABEL_SEND_TAB_TITLE_TOOLTIP": "선택한 브라우저 탭 제목을 방에 보냅니다.",
+  "LABEL_MEDIA_TITLE_PRIVACY": "미디어 제목",
+  "LABEL_MEDIA_TITLE_PRIVACY_TOOLTIP": "미디어 제목을 방에 보내는 방식을 선택합니다."
 }
@@ -44,6 +44,24 @@
  "LABEL_INVITE_LINK_TOOLTIP": "Deel deze link met vrienden zodat ze kunnen deelnemen",
  "LABEL_PEERS_IN_ROOM": "Deelnemers in kamer",
  "LABEL_PEERS_IN_ROOM_TOOLTIP": "Andere gebruikers die momenteel zijn verbonden met deze kamer",
+  "LABEL_HOST_CONTROL": "Hostbeheer",
+  "LABEL_HOST_CONTROL_TOOLTIP": "Bepaal wie de weergave in deze kamer mag bedienen",
+  "LABEL_HOST_ONLY_TOGGLE": "Alleen ik mag de weergave bedienen",
+  "NOTICE_HOST_CONTROLS": "De host bedient de weergave voor iedereen.",
+  "NOTICE_COHOST_HINT": "Tip: geef afzonderlijke deelnemers de besturing in de lijst hieronder.",
+  "BADGE_HOST": "Host",
+  "BADGE_GUEST": "Gast",
+  "BADGE_CONTROLLER": "Bediener",
+  "BTN_GIVE_CONTROL": "Bediening geven",
+  "BTN_REVOKE_CONTROL": "Intrekken",
+  "BADGE_DESYNCED": "Solo",
+  "TOOLTIP_PEER_DESYNCED": "Zelfstandig aan het kijken — negeert de commando's van de host",
+  "HCM_DIALOG_TITLE": "KoalaSync · De host bedient deze kamer",
+  "HCM_DIALOG_BODY": "Alleen de host kan de weergave in deze kamer bedienen. Samen blijven kijken of zelf verder kijken?",
+  "HCM_DIALOG_STAY": "Gesynchroniseerd blijven",
+  "HCM_DIALOG_SOLO": "Zelf verder kijken",
+  "HCM_BADGE_SOLO": "Je kijkt zelfstandig",
+  "HCM_BADGE_RESYNC": "Opnieuw sync",
  "NO_PEERS_CONNECTED": "Geen deelnemers verbonden",
  "BTN_LEAVE_ROOM": "Kamer verlaten",
  "LABEL_SELECT_VIDEO": "Selecteer video",
@@ -92,6 +110,7 @@
  "BTN_REGEN_ID_TOOLTIP": "Genereer uw interne ID opnieuw en maak opnieuw verbinding",
  "REGEN_ID_DESC": "Gebruik dit als u fouten ziet over 'Duplicate Identity'.",
  "REGEN_ID_OTHER_ISSUE": "Ander probleem? Open een GitHub Issue",
+  "TOAST_ID_REGENERATED": "Identiteit opnieuw gegenereerd — opnieuw verbinden…",
  "LABEL_CONN_STATUS": "Verbindingsstatus",
  "LABEL_CONN_STATUS_TOOLTIP": "Huidige WebSocket-verbindingsstatus",
  "CONN_STATUS_DISCONNECTED": "Verbinding verbroken",
@@ -143,6 +162,8 @@
  "STATUS_CONNECTING": "Verbinden...",
  "STATUS_FAILED": "Mislukt",
  "STATUS_DISCONNECTED": "Verbinding verbroken",
+  "STATUS_IDLE": "Gereed om te verbinden",
+  "STATUS_IDLE_TOOLTIP": "KoalaSync is gereed. Neem deel aan een kamer of maak er een aan om te verbinden en te synchroniseren.",
  "BTN_STATE_JOINING": "🚀 Deelnemen...",
  "BTN_STATE_RECONNECTING": "🔄 Opnieuw verbinden...",
  "BTN_STATE_PLAYING": "▶ Afspelen...",
@@ -156,7 +177,7 @@
  "NOTIF_FORCE_PREPARE": "is een geforceerde sync gestart",
  "NOTIF_FORCE_EXECUTE": "heeft iedereen gesynchroniseerd",
  "DEBUG_NO_TAB": "Geen doeltabblad geselecteerd.",
-  "DEBUG_COMM_FAIL": "Kon niet cmmuniceren met de videotab.",
+  "DEBUG_COMM_FAIL": "Kon niet communiceren met de videotab.",
  "EMPTY_PEERS_TITLE": "Nog geen deelnemers",
  "EMPTY_PEERS_HINT": "Deel uw uitnodigingslink om te beginnen",
  "EMPTY_HISTORY_TITLE": "Nog geen activiteit",
@@ -181,7 +202,7 @@
  "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Time-out — niet alle deelnemers hebben de aflevering geladen",
  "LOBBY_CANCEL_USER": "Geannuleerd door gebruiker",
  "NOTIF_ERROR_TITLE": "KoalaSync-fout",
-  "FOOTER_SUPPORT": "☕ Trakteer op een koffie",
+  "FOOTER_SUPPORT": "Support KoalaSync",
  "FOOTER_REVIEW": "★ Beoordelen",
  "FOOTER_SUPPORT_PROMPT": "Vind je KoalaSync leuk? Laat een review achter!",
  "LABEL_AUDIO_PROCESSING": "Audioverwerking",
@@ -205,5 +226,17 @@
  "AUDIO_PARAM_ATTACK": "Attack",
  "AUDIO_PARAM_RELEASE": "Release",
  "AUDIO_EQUALIZER": "Equalizer",
-  "AUDIO_COMING_SOON": "Binnenkort beschikbaar"
+  "AUDIO_COMING_SOON": "Binnenkort beschikbaar",
+  "BTN_RESTART_TOUR": "Tutorial opnieuw starten",
+  "BTN_RESTART_TOUR_TOOLTIP": "Start de introductie-tutorial opnieuw",
+  "HINT_SELECT_VIDEO": "Selecteer hier je video!",
+  "OPTION_TITLE_PRIVACY_FULL": "Volledige titel verzenden",
+  "OPTION_TITLE_PRIVACY_EPISODE": "Afleverings-ID verzenden",
+  "OPTION_TITLE_PRIVACY_HIDDEN": "Niet verzenden",
+  "LABEL_PRIVACY_SETTINGS": "Privacy-instellingen",
+  "LABEL_PRIVACY_SETTINGS_TOOLTIP": "Kies welke tab- en mediatitels naar de kamer worden gestuurd.",
+  "LABEL_SEND_TAB_TITLE": "Tabtitel verzenden",
+  "LABEL_SEND_TAB_TITLE_TOOLTIP": "Stuurt de titel van het geselecteerde browsertabblad naar de kamer.",
+  "LABEL_MEDIA_TITLE_PRIVACY": "Mediatitel",
+  "LABEL_MEDIA_TITLE_PRIVACY_TOOLTIP": "Kies hoe mediatitels naar de kamer worden gestuurd."
 }
@@ -44,6 +44,24 @@
  "LABEL_INVITE_LINK_TOOLTIP": "Udostępnij ten link znajomym, aby mogli dołączyć",
  "LABEL_PEERS_IN_ROOM": "Uczestnicy w pokoju",
  "LABEL_PEERS_IN_ROOM_TOOLTIP": "Inni użytkownicy aktualnie połączeni z tym pokojem",
+  "LABEL_HOST_CONTROL": "Kontrola hosta",
+  "LABEL_HOST_CONTROL_TOOLTIP": "Określ, kto może sterować odtwarzaniem w tym pokoju",
+  "LABEL_HOST_ONLY_TOGGLE": "Tylko ja mogę sterować odtwarzaniem",
+  "NOTICE_HOST_CONTROLS": "Host steruje odtwarzaniem dla wszystkich.",
+  "NOTICE_COHOST_HINT": "Wskazówka: przyznaj sterowanie wybranym uczestnikom na liście poniżej.",
+  "BADGE_HOST": "Host",
+  "BADGE_GUEST": "Gość",
+  "BADGE_CONTROLLER": "Sterujący",
+  "BTN_GIVE_CONTROL": "Daj sterowanie",
+  "BTN_REVOKE_CONTROL": "Odbierz",
+  "BADGE_DESYNCED": "Solo",
+  "TOOLTIP_PEER_DESYNCED": "Ogląda samodzielnie — ignoruje polecenia hosta",
+  "HCM_DIALOG_TITLE": "KoalaSync · Host steruje tym pokojem",
+  "HCM_DIALOG_BODY": "Tylko host może sterować odtwarzaniem w tym pokoju. Oglądać dalej razem czy oglądać samodzielnie?",
+  "HCM_DIALOG_STAY": "Pozostań zsynchronizowany",
+  "HCM_DIALOG_SOLO": "Oglądaj samodzielnie",
+  "HCM_BADGE_SOLO": "Oglądasz samodzielnie",
+  "HCM_BADGE_RESYNC": "Zsynchronizuj",
  "NO_PEERS_CONNECTED": "Brak połączonych uczestników",
  "BTN_LEAVE_ROOM": "Opuść pokój",
  "LABEL_SELECT_VIDEO": "Wybierz wideo",
@@ -92,6 +110,7 @@
  "BTN_REGEN_ID_TOOLTIP": "Wygeneruj ponownie swój identyfikator i połącz się ponownie",
  "REGEN_ID_DESC": "Użyj tego, jeśli widzisz błędy o zduplikowanej tożsamości.",
  "REGEN_ID_OTHER_ISSUE": "Inny problem? Otwórz Issue na GitHub",
+  "TOAST_ID_REGENERATED": "Tożsamość wygenerowana ponownie — ponowne łączenie…",
  "LABEL_CONN_STATUS": "Status połączenia",
  "LABEL_CONN_STATUS_TOOLTIP": "Bieżący stan połączenia WebSocket",
  "CONN_STATUS_DISCONNECTED": "Rozłączono",
@@ -143,6 +162,8 @@
  "STATUS_CONNECTING": "Łączenie...",
  "STATUS_FAILED": "Nieudane",
  "STATUS_DISCONNECTED": "Rozłączono",
+  "STATUS_IDLE": "Gotowy do połączenia",
+  "STATUS_IDLE_TOOLTIP": "KoalaSync jest gotowy. Dołącz do pokoju lub utwórz go, aby się połączyć i rozpocząć synchronizację.",
  "BTN_STATE_JOINING": "🚀 Dołączanie...",
  "BTN_STATE_RECONNECTING": "🔄 Ponowne łączenie...",
  "BTN_STATE_PLAYING": "▶ Odtwarzanie...",
@@ -181,7 +202,7 @@
  "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Limit czasu — nie wszyscy uczestnicy załadowali odcinek",
  "LOBBY_CANCEL_USER": "Anulowane przez użytkownika",
  "NOTIF_ERROR_TITLE": "Błąd KoalaSync",
-  "FOOTER_SUPPORT": "☕ Postaw kawę",
+  "FOOTER_SUPPORT": "Support KoalaSync",
  "FOOTER_REVIEW": "★ Oceń",
  "FOOTER_SUPPORT_PROMPT": "Podoba Ci się KoalaSync? Zostaw recenzję!",
  "LABEL_AUDIO_PROCESSING": "Przetwarzanie dźwięku",
@@ -205,5 +226,17 @@
  "AUDIO_PARAM_ATTACK": "Attack",
  "AUDIO_PARAM_RELEASE": "Release",
  "AUDIO_EQUALIZER": "Korektor",
-  "AUDIO_COMING_SOON": "Wkrótce"
+  "AUDIO_COMING_SOON": "Wkrótce",
+  "BTN_RESTART_TOUR": "Uruchom samouczek ponownie",
+  "BTN_RESTART_TOUR_TOOLTIP": "Uruchom ponownie samouczek powitalny",
+  "HINT_SELECT_VIDEO": "Wybierz swoje wideo tutaj!",
+  "OPTION_TITLE_PRIVACY_FULL": "Wysyłaj pełny tytuł",
+  "OPTION_TITLE_PRIVACY_EPISODE": "Wysyłaj ID odcinka",
+  "OPTION_TITLE_PRIVACY_HIDDEN": "Nie wysyłaj",
+  "LABEL_PRIVACY_SETTINGS": "Ustawienia prywatności",
+  "LABEL_PRIVACY_SETTINGS_TOOLTIP": "Wybierz, które tytuły kart i multimediów są wysyłane do pokoju.",
+  "LABEL_SEND_TAB_TITLE": "Wysyłaj tytuł karty",
+  "LABEL_SEND_TAB_TITLE_TOOLTIP": "Wysyła do pokoju tytuł wybranej karty przeglądarki.",
+  "LABEL_MEDIA_TITLE_PRIVACY": "Tytuł multimediów",
+  "LABEL_MEDIA_TITLE_PRIVACY_TOOLTIP": "Wybierz, jak tytuły multimediów są wysyłane do pokoju."
 }
@@ -4,9 +4,9 @@
  "APP_TITLE": "KoalaSync",
  "TAB_ROOM": "Sala",
  "TAB_ROOM_TOOLTIP": "Configurações da sala e conexão",
-  "TAB_SYNC": "Sincro",
+  "TAB_SYNC": "Sincronia",
  "TAB_SYNC_TOOLTIP": "Controles de sincronia de vídeo e ações",
-  "TAB_SETTINGS": "Opções",
+  "TAB_SETTINGS": "Configurações",
  "TAB_SETTINGS_TOOLTIP": "Preferências da extensão",
  "TAB_STATUS": "Status",
  "TAB_STATUS_TOOLTIP": "Diagnósticos avançados e logs",
@@ -15,23 +15,23 @@
  "LABEL_SERVER": "Servidor",
  "BTN_SERVER_OFFICIAL": "Oficial",
  "BTN_SERVER_OFFICIAL_TOOLTIP": "Usar o servidor oficial confiável",
-  "BTN_SERVER_CUSTOM": "Perso",
-  "BTN_SERVER_CUSTOM_TOOLTIP": "Conectar ao seu próprio servidor auto-hospedado",
+  "BTN_SERVER_CUSTOM": "Personalizado",
+  "BTN_SERVER_CUSTOM_TOOLTIP": "Conectar ao seu próprio servidor privado",
  "PLACEHOLDER_SERVER_URL": "wss://seu-servidor:3000",
  "LABEL_ROOM_ID": "ID da sala",
-  "LABEL_ROOM_ID_TOOLTIP": "O identificador exclusivo para sua sala de sincronização",
+  "LABEL_ROOM_ID_TOOLTIP": "O identificador exclusivo da sua sala",
  "PLACEHOLDER_ROOM_ID": "Digite o ID da sala",
-  "PLACEHOLDER_ROOM_ID_TOOLTIP": "O ID exclusivo da sala na qual você deseja entrar",
+  "PLACEHOLDER_ROOM_ID_TOOLTIP": "O ID da sala na qual você deseja entrar",
  "LABEL_PASSWORD": "Senha (Opcional)",
  "LABEL_PASSWORD_TOOLTIP": "Senha opcional para restringir o acesso à sala",
-  "PLACEHOLDER_PASSWORD": "Senha da sala (opcional)",
-  "PLACEHOLDER_PASSWORD_TOOLTIP": "Senha para a sala (deixe em branco se não houver)",
+  "PLACEHOLDER_PASSWORD": "Senha da sala",
+  "PLACEHOLDER_PASSWORD_TOOLTIP": "Deixe em branco se não houver senha",
  "BTN_JOIN_ROOM": "Entrar / Criar sala",
-  "BTN_JOIN_ROOM_TOOLTIP": "Conectar à sala",
+  "BTN_JOIN_ROOM_TOOLTIP": "Entrar na sala",
  "LABEL_PUBLIC_ROOMS": "Salas públicas",
  "LABEL_PUBLIC_ROOMS_TOOLTIP": "Lista de salas públicas disponíveis neste servidor",
  "BTN_REFRESH": "ATUALIZAR",
-  "BTN_REFRESH_TOOLTIP": "Atualizar a lista de salas públicas",
+  "BTN_REFRESH_TOOLTIP": "Atualizar a lista de salas",
  "PUBLIC_ROOMS_REFRESHING": "Atualizando...",
  "BTN_REFRESH_COOLDOWN": "AGUARDE {seconds}s",
  "BTN_REFRESH_COOLDOWN_TOOLTIP": "A lista de salas está em espera. Tente novamente em {seconds}s.",
@@ -41,99 +41,118 @@
  "ACTIVE_ROOM_NONE": "NENHUMA",
  "ACTIVE_SERVER_OFFICIAL": "Servidor oficial",
  "LABEL_INVITE_LINK": "Link de convite",
-  "LABEL_INVITE_LINK_TOOLTIP": "Compartilhe este link com amigos para que eles entrem",
-  "LABEL_PEERS_IN_ROOM": "Participantes na sala",
-  "LABEL_PEERS_IN_ROOM_TOOLTIP": "Outros usuários conectados atualmente a esta sala",
+  "LABEL_INVITE_LINK_TOOLTIP": "Compartilhe este link com seus amigos para que eles entrem",
+  "LABEL_PEERS_IN_ROOM": "Participantes",
+  "LABEL_PEERS_IN_ROOM_TOOLTIP": "Outros usuários conectados a esta sala",
+  "LABEL_HOST_CONTROL": "Controle do anfitrião",
+  "LABEL_HOST_CONTROL_TOOLTIP": "Restringir quem pode controlar a reprodução nesta sala",
+  "LABEL_HOST_ONLY_TOGGLE": "Somente eu posso controlar a reprodução",
+  "NOTICE_HOST_CONTROLS": "O anfitrião controla a reprodução para todos.",
+  "NOTICE_COHOST_HINT": "Dica: conceda o controle a participantes específicos na lista abaixo.",
+  "BADGE_HOST": "Anfitrião",
+  "BADGE_GUEST": "Convidado",
+  "BADGE_CONTROLLER": "Controlador",
+  "BTN_GIVE_CONTROL": "Dar controle",
+  "BTN_REVOKE_CONTROL": "Revogar",
+  "BADGE_DESYNCED": "Solo",
+  "TOOLTIP_PEER_DESYNCED": "Assistindo por conta própria — ignora os comandos do anfitrião",
+  "HCM_DIALOG_TITLE": "KoalaSync · O anfitrião controla esta sala",
+  "HCM_DIALOG_BODY": "Somente o anfitrião pode controlar a reprodução nesta sala. Continuar assistindo juntos ou assistir por conta própria?",
+  "HCM_DIALOG_STAY": "Manter sincronizado",
+  "HCM_DIALOG_SOLO": "Assistir por conta própria",
+  "HCM_BADGE_SOLO": "Assistindo por conta própria",
+  "HCM_BADGE_RESYNC": "Ressincronizar",
  "NO_PEERS_CONNECTED": "Sem participantes conectados",
  "BTN_LEAVE_ROOM": "Sair da sala",
  "LABEL_SELECT_VIDEO": "Selecionar vídeo",
-  "LABEL_SELECT_VIDEO_TOOLTIP": "Escolha a aba do navegador contendo o vídeo a ser sincronizado",
+  "LABEL_SELECT_VIDEO_TOOLTIP": "Escolha a aba do navegador com o vídeo a ser sincronizado",
  "OPTION_SELECT_TAB": "-- Selecione uma aba --",
  "LABEL_REMOTE_CONTROL": "Controle remoto",
  "BTN_COPY_INVITE": "📋 Link de convite",
  "BTN_COPY_INVITE_TOOLTIP": "Copiar link de convite",
  "BTN_PLAY": "▶ Reproduzir",
-  "BTN_PLAY_TOOLTIP": "Enviar um comando de reproduzir para todos",
+  "BTN_PLAY_TOOLTIP": "Iniciar a reprodução para todos",
  "BTN_PAUSE": "⏸ Pausar",
-  "BTN_PAUSE_TOOLTIP": "Enviar um comando de pausar para todos",
-  "BTN_SYNC": "⚡ SYNC",
+  "BTN_PAUSE_TOOLTIP": "Pausar o vídeo para todos",
+  "BTN_SYNC": "⚡ SINCRO",
  "BTN_SYNC_TOOLTIP": "Forçar todos os usuários a sincronizar",
-  "OPTION_JUMP_TO_OTHERS": "Ir para os outros",
-  "OPTION_JUMP_TO_ME": "Trazer para mim",
+  "OPTION_JUMP_TO_OTHERS": "Ir para a posição dos outros",
+  "OPTION_JUMP_TO_ME": "Trazer para a minha posição",
  "OPTION_JUMP_MODE_TOOLTIP": "Escolher o alvo de sincronização",
  "LABEL_LAST_ACTIVITY": "Última atividade",
-  "LABEL_LAST_ACTIVITY_TOOLTIP": "Mostra o comando mais recente de reproduzir, pausar ou buscar",
+  "LABEL_LAST_ACTIVITY_TOOLTIP": "Mostra o comando mais recente de reproduzir, pausar ou pular",
  "NO_RECENT_COMMANDS": "Sem comandos recentes",
-  "LOBBY_HEADER": "LOBBY DE EPISÓDIO",
+  "LOBBY_HEADER": "SALA DE ESPERA",
  "LOBBY_WAITING_FOR": "🎬 Aguardando: \"{title}\"",
  "LOBBY_WAITING_PEERS": "Aguardando participantes...",
-  "BTN_SKIP_PLAY": "Pular e reproduzir",
-  "BTN_SKIP_PLAY_TOOLTIP": "Cancelar o lobby e reproduzir assim mesmo",
+  "BTN_SKIP_PLAY": "Pular e reproduzir agora",
+  "BTN_SKIP_PLAY_TOOLTIP": "Cancelar a espera e reproduzir mesmo assim",
  "LOBBY_CONNECT_FIRST": "Entre em uma sala primeiro",
  "LOBBY_CONNECT_FIRST_DESC": "Você precisa entrar em uma sala através de um link de convite ou criar uma nova para sincronizar vídeos.",
  "BTN_CREATE_ROOM_ALT": "Criar nova sala",
  "BTN_CREATE_ROOM_ALT_TOOLTIP": "Criar uma nova sala aleatória e entrar",
  "LABEL_USERNAME": "Seu nome de usuário",
-  "LABEL_USERNAME_TOOLTIP": "O nome de usuário ajuda os outros a identificá-lo.",
+  "LABEL_USERNAME_TOOLTIP": "Seu nome visível para os outros.",
  "PLACEHOLDER_USERNAME": "Coala anônimo",
-  "LABEL_HIDE_CLUTTER": "Lista de abas limpa",
-  "LABEL_HIDE_CLUTTER_TOOLTIP": "Filtra abas que não são de vídeo e domínios não relacionados para manter a lista organizada",
+  "LABEL_HIDE_CLUTTER": "Ocultar abas sem vídeo",
+  "LABEL_HIDE_CLUTTER_TOOLTIP": "Filtra abas não relacionadas para manter a lista limpa",
  "LABEL_AUTO_SYNC_NEXT": "Sincro auto do próximo episódio",
-  "LABEL_AUTO_SYNC_NEXT_TOOLTIP": "Pausa automaticamente e aguarda todos ao mudar de episódio, depois inicia em sincronia.",
-  "LABEL_AUTO_COPY_INVITE": "Auto-copiar link",
-  "LABEL_AUTO_COPY_INVITE_TOOLTIP": "Copia automaticamente o link de convite para a área de transferência ao criar uma nova sala.",
+  "LABEL_AUTO_SYNC_NEXT_TOOLTIP": "Pausa automaticamente e aguarda todos ao mudar de episódio.",
+  "LABEL_AUTO_COPY_INVITE": "Auto-copiar link de convite",
+  "LABEL_AUTO_COPY_INVITE_TOOLTIP": "Copia automaticamente o link para a área de transferência ao criar uma nova sala.",
  "LABEL_NOTIFICATIONS": "Notificações do navegador",
-  "LABEL_NOTIFICATIONS_TOOLTIP": "Mostra notificações do sistema quando alguém entra/sai ou reproduz/pausa.",
+  "LABEL_NOTIFICATIONS_TOOLTIP": "Mostra notificações quando alguém entra, sai, reproduz ou pausa.",
  "LABEL_LANGUAGE": "Idioma do aplicativo",
-  "LABEL_LANGUAGE_TOOLTIP": "Escolha o idioma de sua preferência para a extensão",
-  "LABEL_TROUBLESHOOTING": "Resolução de problemas",
-  "LABEL_TROUBLESHOOTING_TOOLTIP": "Ferramentas para solucionar problemas de conexão",
-  "BTN_REGEN_ID": "Regenerar ID de participante",
-  "BTN_REGEN_ID_TOOLTIP": "Regenerar seu ID interno e conectar novamente",
-  "REGEN_ID_DESC": "Use esta opção se notar erros de 'Identidade duplicada'.",
-  "REGEN_ID_OTHER_ISSUE": "Outro problema? Abra um Issue no GitHub",
+  "LABEL_LANGUAGE_TOOLTIP": "Escolha o seu idioma preferido",
+  "LABEL_TROUBLESHOOTING": "Solução de problemas",
+  "LABEL_TROUBLESHOOTING_TOOLTIP": "Ferramentas para corrigir problemas de conexão",
+  "BTN_REGEN_ID": "Regenerar ID do usuário",
+  "BTN_REGEN_ID_TOOLTIP": "Gerar um novo ID interno e conectar novamente",
+  "REGEN_ID_DESC": "Use esta opção se aparecer o erro de 'Identidade duplicada'.",
+  "REGEN_ID_OTHER_ISSUE": "Outro problema? Abra um relatório no GitHub",
+  "TOAST_ID_REGENERATED": "Identidade regenerada — reconectando…",
  "LABEL_CONN_STATUS": "Status da conexão",
  "LABEL_CONN_STATUS_TOOLTIP": "Status atual da conexão WebSocket",
  "CONN_STATUS_DISCONNECTED": "Desconectado",
-  "BTN_RETRY": "REENTRAR",
+  "BTN_RETRY": "TENTAR NOVAMENTE",
  "BTN_RETRY_TOOLTIP": "Tentar reconectar ao servidor",
  "BTN_COPY_LOGS": "Copiar logs",
-  "BTN_COPY_LOGS_TOOLTIP": "Copiar logs para a área de transferência para compartilhar",
-  "LABEL_VIDEO_DEBUG": "Informações de depuração de vídeo",
-  "LABEL_VIDEO_DEBUG_TOOLTIP": "Detalhes técnicos sobre o elemento de vídeo selecionado atualmente",
+  "BTN_COPY_LOGS_TOOLTIP": "Copiar logs para a área de transferência",
+  "LABEL_VIDEO_DEBUG": "Debug de vídeo",
+  "LABEL_VIDEO_DEBUG_TOOLTIP": "Detalhes técnicos sobre o vídeo selecionado no momento",
  "VIDEO_DEBUG_EMPTY": "Nenhuma aba selecionada ou vídeo detectado.",
  "LABEL_HISTORY": "Histórico completo",
-  "LABEL_HISTORY_TOOLTIP": "Registro cronológico de todos os comandos de sincronização na sala",
+  "LABEL_HISTORY_TOOLTIP": "Registro cronológico de todos os comandos na sala",
  "HISTORY_EMPTY": "Sem atividade ainda",
  "LABEL_LOGS": "Logs (Últimos 50)",
  "LABEL_LOGS_TOOLTIP": "Logs técnicos de conexão para depuração",
  "BTN_CLEAR": "LIMPAR",
-  "BTN_CLEAR_TOOLTIP": "Limpar a saída dos logs",
+  "BTN_CLEAR_TOOLTIP": "Limpar os logs",
  "LABEL_GITHUB": "Repositório GitHub",
  "BTN_ONBOARDING_SKIP": "Pular",
  "BTN_ONBOARDING_SKIP_TOOLTIP": "Pular o tutorial",
  "BTN_ONBOARDING_NEXT": "Próximo",
  "BTN_ONBOARDING_NEXT_TOOLTIP": "Ir para o próximo passo",
  "ONBOARDING_1_TITLE": "Bem-vindo ao KoalaSync!",
-  "ONBOARDING_1_TEXT": "Assista a vídeos juntos em perfeita sincronia, não importa onde estejam. Vamos fazer um tour rápido!",
+  "ONBOARDING_1_TEXT": "Assista a vídeos com seus amigos em perfeita sincronia, não importa onde estejam. Vamos fazer um tour rápido!",
  "ONBOARDING_2_TITLE": "1. Criar uma sala",
  "ONBOARDING_2_TEXT": "Comece aqui. Crie uma sala e compartilhe o link de convite com seus amigos.",
  "ONBOARDING_3_TITLE": "2. Selecionar vídeo",
-  "ONBOARDING_3_TEXT": "Navegue aqui para selecionar o vídeo a ser sincronizado. Reproduza, pause e busque: todos permanecem sincronizados.",
+  "ONBOARDING_3_TEXT": "Navegue aqui para selecionar o vídeo a ser sincronizado. Reproduza, pause e avance — todos verão o mesmo.",
  "ONBOARDING_4_TITLE": "3. Personalizar",
-  "ONBOARDING_4_TEXT": "Escolha um nome de usuário divertido para que seus amigos saibam quem você é.",
+  "ONBOARDING_4_TEXT": "Escolha um nome de usuário divertido para que seus amigos reconheçam você.",
  "ONBOARDING_5_TITLE": "Tudo pronto!",
  "ONBOARDING_5_TEXT": "Hora de pegar a pipoca. Divirta-se assistindo com seus amigos!",
-  "ERR_CONN_TIMEOUT": "Tempo limite de conexão esgotado. Tente novamente.",
+  "ERR_CONN_TIMEOUT": "Tempo limite esgotado. Tente novamente.",
  "ERR_INVALID_SERVER_URL": "Formato de URL do servidor inválido.",
-  "ERR_IDENTITY_NOT_LOADED": "Identidade não carregada ainda. Aguarde um momento e tente novamente.",
-  "ERR_NO_PEERS_TIME": "Nenhum outro participante com posição conhecida. Mude para 'Traerlos a mí' / 'Trazer para mim'.",
+  "ERR_IDENTITY_NOT_LOADED": "Identidade não carregada ainda. Aguarde um momento.",
+  "ERR_NO_PEERS_TIME": "Nenhum participante com posição conhecida. Mude para 'Trazer para a minha posição'.",
  "ERR_NO_VIDEO_TAB": "Não foi possível conectar à aba do vídeo.",
  "ERR_SELECT_VIDEO": "Selecione um vídeo primeiro!",
  "TOAST_INVITE_COPIED": "Link de convite copiado!",
  "TOAST_COPY_FAILED": "Falha ao copiar para a área de transferência",
-  "TOAST_LOBBY_SKIPPED": "Lobby de episódio ignorado.",
-  "TOAST_LOBBY_SKIP_FAILED": "Falha ao ignorar o lobby.",
+  "TOAST_LOBBY_SKIPPED": "Sala de espera ignorada.",
+  "TOAST_LOBBY_SKIP_FAILED": "Falha ao ignorar a sala de espera.",
  "TOAST_LOGS_COPIED": "Copiado!",
  "TOAST_PEER_JOINED": "{name} entrou na sala",
  "TOAST_PEER_LEFT": "{name} saiu da sala",
@@ -143,49 +162,51 @@
  "STATUS_CONNECTING": "Conectando...",
  "STATUS_FAILED": "Falhou",
  "STATUS_DISCONNECTED": "Desconectado",
+  "STATUS_IDLE": "Pronto para conectar",
+  "STATUS_IDLE_TOOLTIP": "O KoalaSync está pronto. Entre ou crie uma sala para conectar e começar a sincronizar.",
  "BTN_STATE_JOINING": "🚀 Entrando...",
  "BTN_STATE_RECONNECTING": "🔄 Reconectando...",
  "BTN_STATE_PLAYING": "▶ Reproduzindo...",
-  "BTN_STATE_PAUSING": "⏸ Pausando...",
+  "BTN_STATE_PAUSING": "⏸ Em pausa...",
  "BTN_STATE_SYNCING_GROUP": "Sincronizando com o grupo ({time})...",
  "BTN_STATE_SYNCING": "Sincronizando...",
  "BTN_STATE_SYNCED": "✅ Sincronizado!",
  "NOTIF_PLAY": "iniciou a reprodução",
-  "NOTIF_PAUSE": "pausou a reprodução",
+  "NOTIF_PAUSE": "pausou o vídeo",
  "NOTIF_SEEK": "mudou a posição do vídeo",
  "NOTIF_FORCE_PREPARE": "iniciou uma sincronização forçada",
  "NOTIF_FORCE_EXECUTE": "sincronizou todos",
-  "DEBUG_NO_TAB": "Nenhuma aba alvo selecionada.",
-  "DEBUG_COMM_FAIL": "Não foi possível comunicar com o vídeo da aba.",
-  "EMPTY_PEERS_TITLE": "Nenhum participante ainda",
+  "DEBUG_NO_TAB": "Nenhuma aba selecionada.",
+  "DEBUG_COMM_FAIL": "Erro ao se comunicar com o vídeo.",
+  "EMPTY_PEERS_TITLE": "Nenhum participante",
  "EMPTY_PEERS_HINT": "Compartilhe seu link de convite para começar",
-  "EMPTY_HISTORY_TITLE": "Sem atividade ainda",
-  "EMPTY_HISTORY_HINT": "Reproduza, pause ou busque para ver o histórico",
+  "EMPTY_HISTORY_TITLE": "Sem atividade",
+  "EMPTY_HISTORY_HINT": "Reproduza ou pause para ver o histórico",
  "EMPTY_LOGS_TITLE": "Sem logs",
  "EMPTY_LOGS_HINT": "Os eventos de conexão aparecerão aqui",
  "EMPTY_ROOMS_TITLE": "Sem salas ativas",
-  "EMPTY_ROOMS_HINT": "Crie uma sala ou atualize para buscar salas públicas",
+  "EMPTY_ROOMS_HINT": "Crie uma sala ou atualize a lista",
  "LABEL_YOU": "Você",
  "ONBOARDING_DONE": "Concluído!",
  "LABEL_LOBBY_PEER_READY": "Pronto",
  "LABEL_LOBBY_PEER_LOADING": "Carregando...",
  "LABEL_PASSWORD_PROTECTED": "Protegido por senha",
  "LABEL_PEERS_COUNT": "{count} participantes",
-  "LABEL_CUSTOM_SERVER": "Servidor personalizado",
+  "LABEL_CUSTOM_SERVER": "Servidor privado",
  "BTN_STATE_CREATING": "🚀 Criando sala...",
  "NOTIF_LOBBY_CANCEL_TITLE": "KoalaSync — Falha na sincronização do episódio",
-  "NOTIF_LOBBY_CANCEL_MSG": "Sincronização automática cancelada: {reason}. Pode ser necessário sincronizar manualmente.",
+  "NOTIF_LOBBY_CANCEL_MSG": "Sincronização automática cancelada: {reason}. Você deve sincronizar manualmente.",
  "LOBBY_CANCEL_TIMEOUT": "Tempo limite esgotado",
-  "LOBBY_CANCEL_TIMEOUT_RECOVERED": "Tempo limite esgotado (recuperado)",
+  "LOBBY_CANCEL_TIMEOUT_RECOVERED": "Tempo limite (recuperado)",
  "LOBBY_CANCEL_PEERS_LEFT": "Todos os outros participantes saíram",
-  "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Tempo limite esgotado — nem todos os participantes carregaram o episódio",
+  "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Tempo limite — nem todos carregaram o episódio",
  "LOBBY_CANCEL_USER": "Cancelado pelo usuário",
-  "NOTIF_ERROR_TITLE": "Erro do KoalaSync",
-  "FOOTER_SUPPORT": "☕ Me pague um café",
+  "NOTIF_ERROR_TITLE": "Erro no KoalaSync",
+  "FOOTER_SUPPORT": "Support KoalaSync",
  "FOOTER_REVIEW": "★ Avaliar",
  "FOOTER_SUPPORT_PROMPT": "Gostou do KoalaSync? Deixe uma avaliação!",
  "LABEL_AUDIO_PROCESSING": "Processamento de áudio",
-  "LABEL_AUDIO_PROCESSING_TOOLTIP": "Aplica efeitos de áudio como compressão à reprodução de vídeo",
+  "LABEL_AUDIO_PROCESSING_TOOLTIP": "Aplica efeitos de áudio (como compressão) aos vídeos",
  "AUDIO_OPEN_SETTINGS": "Abrir",
  "NEW_FEATURE_AUDIO": "Novo: Processamento de áudio — experimente o compressor!",
  "AUDIO_BACK": "← Voltar",
@@ -196,14 +217,26 @@
  "AUDIO_PRESET": "Predefinição",
  "AUDIO_PRESET_RECOMMENDED": "Recomendado",
  "AUDIO_PRESET_DYNAMIC_RANGE": "Faixa dinâmica",
-  "AUDIO_PRESET_VOCAL_ENHANCEMENT": "Aprimoramento de voz",
+  "AUDIO_PRESET_VOCAL_ENHANCEMENT": "Aprimoramento vocal",
  "AUDIO_PRESET_SMOOTH": "Suave",
  "AUDIO_PRESET_CUSTOM": "Personalizado",
-  "AUDIO_PARAM_THRESHOLD": "Limiar",
-  "AUDIO_PARAM_KNEE": "Knee",
-  "AUDIO_PARAM_RATIO": "Ratio",
-  "AUDIO_PARAM_ATTACK": "Attack",
-  "AUDIO_PARAM_RELEASE": "Release",
+  "AUDIO_PARAM_THRESHOLD": "Limiar (Threshold)",
+  "AUDIO_PARAM_KNEE": "Joelho (Knee)",
+  "AUDIO_PARAM_RATIO": "Razão (Ratio)",
+  "AUDIO_PARAM_ATTACK": "Ataque (Attack)",
+  "AUDIO_PARAM_RELEASE": "Liberação (Release)",
  "AUDIO_EQUALIZER": "Equalizador",
-  "AUDIO_COMING_SOON": "Em breve"
+  "AUDIO_COMING_SOON": "Em breve",
+  "BTN_RESTART_TOUR": "Reiniciar tutorial",
+  "BTN_RESTART_TOUR_TOOLTIP": "Reiniciar o tutorial de introdução",
+  "HINT_SELECT_VIDEO": "Selecione seu vídeo aqui!",
+  "OPTION_TITLE_PRIVACY_FULL": "Enviar título completo",
+  "OPTION_TITLE_PRIVACY_EPISODE": "Enviar ID do episódio",
+  "OPTION_TITLE_PRIVACY_HIDDEN": "Não enviar",
+  "LABEL_PRIVACY_SETTINGS": "Configurações de privacidade",
+  "LABEL_PRIVACY_SETTINGS_TOOLTIP": "Escolha quais títulos de aba e mídia são enviados para a sala.",
+  "LABEL_SEND_TAB_TITLE": "Enviar título da aba",
+  "LABEL_SEND_TAB_TITLE_TOOLTIP": "Envia para a sala o título da aba selecionada do navegador.",
+  "LABEL_MEDIA_TITLE_PRIVACY": "Título da mídia",
+  "LABEL_MEDIA_TITLE_PRIVACY_TOOLTIP": "Escolha como os títulos de mídia são enviados para a sala."
 }
@@ -4,136 +4,155 @@
  "APP_TITLE": "KoalaSync",
  "TAB_ROOM": "Sala",
  "TAB_ROOM_TOOLTIP": "Definições da sala e ligação",
-  "TAB_SYNC": "Sincronização",
+  "TAB_SYNC": "Sincronia",
  "TAB_SYNC_TOOLTIP": "Controlo de sincronização de vídeo e ações remotas",
  "TAB_SETTINGS": "Definições",
  "TAB_SETTINGS_TOOLTIP": "Preferências da extensão",
  "TAB_STATUS": "Estado",
-  "TAB_STATUS_TOOLTIP": "Diagnóstico avanzado e registos",
+  "TAB_STATUS_TOOLTIP": "Diagnóstico avançado e registos",
  "BTN_CREATE_ROOM": "+ Criar Nova Sala",
  "MANUAL_CONNECT_HEADER": "Ligação Manual / Avançado",
  "LABEL_SERVER": "Servidor",
  "BTN_SERVER_OFFICIAL": "Oficial",
  "BTN_SERVER_OFFICIAL_TOOLTIP": "Usar o servidor oficial fiável",
  "BTN_SERVER_CUSTOM": "Personalizado",
-  "BTN_SERVER_CUSTOM_TOOLTIP": "Ligar ao seu próprio servidor auto-hospedado",
+  "BTN_SERVER_CUSTOM_TOOLTIP": "Ligar ao seu próprio servidor privado",
  "PLACEHOLDER_SERVER_URL": "wss://o-seu-servidor:3000",
  "LABEL_ROOM_ID": "ID da Sala",
-  "LABEL_ROOM_ID_TOOLTIP": "O identificador exclusivo para a sua sala de sincronização",
+  "LABEL_ROOM_ID_TOOLTIP": "O identificador exclusivo para a sua sala",
  "PLACEHOLDER_ROOM_ID": "Introduzir ID da Sala",
-  "PLACEHOLDER_ROOM_ID_TOOLTIP": "O ID exclusivo da sala à qual deseja aderir",
+  "PLACEHOLDER_ROOM_ID_TOOLTIP": "O ID da sala à qual deseja aceder",
  "LABEL_PASSWORD": "Palavra-passe (Opcional)",
-  "LABEL_PASSWORD_TOOLTIP": "Palavra-passe opcional para restringir o acesso à sala",
-  "PLACEHOLDER_PASSWORD": "Palavra-passe da sala (opcional)",
-  "PLACEHOLDER_PASSWORD_TOOLTIP": "Palavra-passe para la sala (deixar em branco se não houver)",
+  "LABEL_PASSWORD_TOOLTIP": "Palavra-passe para restringir o acesso à sala",
+  "PLACEHOLDER_PASSWORD": "Palavra-passe da sala",
+  "PLACEHOLDER_PASSWORD_TOOLTIP": "Deixe em branco se não houver palavra-passe",
  "BTN_JOIN_ROOM": "Entrar / Criar Sala",
-  "BTN_JOIN_ROOM_TOOLTIP": "Ligar à sala",
+  "BTN_JOIN_ROOM_TOOLTIP": "Entrar na sala",
  "LABEL_PUBLIC_ROOMS": "Salas Públicas",
-  "LABEL_PUBLIC_ROOMS_TOOLTIP": "Lista de salas públicas disponíveis neste servidor",
+  "LABEL_PUBLIC_ROOMS_TOOLTIP": "Lista de salas públicas neste servidor",
  "BTN_REFRESH": "ATUALIZAR",
-  "BTN_REFRESH_TOOLTIP": "Atualizar a lista de salas públicas",
+  "BTN_REFRESH_TOOLTIP": "Atualizar a lista de salas",
  "PUBLIC_ROOMS_REFRESHING": "A atualizar...",
  "BTN_REFRESH_COOLDOWN": "AGUARDE {seconds}s",
-  "BTN_REFRESH_COOLDOWN_TOOLTIP": "A atualização da lista de salas está em espera. Tente novamente em {seconds}s.",
-  "PUBLIC_ROOMS_REFRESHING_COOLDOWN": "A atualizar salas públicas. Próxima atualização disponível em {seconds}s.",
+  "BTN_REFRESH_COOLDOWN_TOOLTIP": "A atualização está em espera. Tente novamente em {seconds}s.",
+  "PUBLIC_ROOMS_REFRESHING_COOLDOWN": "A atualizar salas. Próxima atualização em {seconds}s.",
  "LABEL_ACTIVE_ROOM": "Sala Ativa",
  "LABEL_ACTIVE_ROOM_TOOLTIP": "A sala à qual está atualmente ligado",
  "ACTIVE_ROOM_NONE": "NENHUMA",
  "ACTIVE_SERVER_OFFICIAL": "Servidor Oficial",
-  "LABEL_INVITE_LINK": "Link de Invito",
-  "LABEL_INVITE_LINK_TOOLTIP": "Partilhar este link com os amigos para que possam entrar",
+  "LABEL_INVITE_LINK": "Link de Convite",
+  "LABEL_INVITE_LINK_TOOLTIP": "Partilhe este link com os amigos para que possam entrar",
  "LABEL_PEERS_IN_ROOM": "Participantes na Sala",
-  "LABEL_PEERS_IN_ROOM_TOOLTIP": "Outros utilizadores attualmente ligados a questa sala",
-  "NO_PEERS_CONNECTED": "Nenhum partecipante ligado",
-  "BTN_LEAVE_ROOM": "Sair della Sala",
+  "LABEL_PEERS_IN_ROOM_TOOLTIP": "Utilizadores atualmente ligados a esta sala",
+  "LABEL_HOST_CONTROL": "Controlo do anfitrião",
+  "LABEL_HOST_CONTROL_TOOLTIP": "Restringir quem pode controlar a reprodução nesta sala",
+  "LABEL_HOST_ONLY_TOGGLE": "Só eu posso controlar a reprodução",
+  "NOTICE_HOST_CONTROLS": "O anfitrião controla a reprodução para todos.",
+  "NOTICE_COHOST_HINT": "Dica: conceda o controlo a participantes específicos na lista abaixo.",
+  "BADGE_HOST": "Anfitrião",
+  "BADGE_GUEST": "Convidado",
+  "BADGE_CONTROLLER": "Controlador",
+  "BTN_GIVE_CONTROL": "Dar controlo",
+  "BTN_REVOKE_CONTROL": "Revogar",
+  "BADGE_DESYNCED": "Solo",
+  "TOOLTIP_PEER_DESYNCED": "A ver por conta própria — ignora os comandos do anfitrião",
+  "HCM_DIALOG_TITLE": "KoalaSync · O anfitrião controla esta sala",
+  "HCM_DIALOG_BODY": "Só o anfitrião pode controlar a reprodução nesta sala. Continuar a ver em conjunto ou ver por conta própria?",
+  "HCM_DIALOG_STAY": "Manter sincronizado",
+  "HCM_DIALOG_SOLO": "Ver por minha conta",
+  "HCM_BADGE_SOLO": "A ver por tua conta",
+  "HCM_BADGE_RESYNC": "Ressincronizar",
+  "NO_PEERS_CONNECTED": "Nenhum participante ligado",
+  "BTN_LEAVE_ROOM": "Sair da Sala",
  "LABEL_SELECT_VIDEO": "Selecionar Vídeo",
-  "LABEL_SELECT_VIDEO_TOOLTIP": "Escolher o separador do navegador que contém o vídeo a sincronizar",
+  "LABEL_SELECT_VIDEO_TOOLTIP": "Escolha o separador do navegador com o vídeo a sincronizar",
  "OPTION_SELECT_TAB": "-- Selecionar um Separador --",
  "LABEL_REMOTE_CONTROL": "Controlo Remoto",
-  "BTN_COPY_INVITE": "📋 Link de Invito",
-  "BTN_COPY_INVITE_TOOLTIP": "Copiar Link de Invito",
+  "BTN_COPY_INVITE": "📋 Link de Convite",
+  "BTN_COPY_INVITE_TOOLTIP": "Copiar Link de Convite",
  "BTN_PLAY": "▶ Reproduzir",
-  "BTN_PLAY_TOOLTIP": "Enviar um comando de Reproduzir para todos",
+  "BTN_PLAY_TOOLTIP": "Iniciar a reprodução para todos",
  "BTN_PAUSE": "⏸ Pausa",
-  "BTN_PAUSE_TOOLTIP": "Enviar um comando de Pausa para todos",
-  "BTN_SYNC": "⚡ SYNC",
-  "BTN_SYNC_TOOLTIP": "Forçar todos os utilizadores a sincronizarem-se",
-  "OPTION_JUMP_TO_OTHERS": "Ir para os Outros",
-  "OPTION_JUMP_TO_ME": "Ir para Mim",
+  "BTN_PAUSE_TOOLTIP": "Pausar o vídeo para todos",
+  "BTN_SYNC": "⚡ SINCRO",
+  "BTN_SYNC_TOOLTIP": "Forçar sincronização de todos os utilizadores",
+  "OPTION_JUMP_TO_OTHERS": "Ir para a posição dos outros",
+  "OPTION_JUMP_TO_ME": "Trazer para a minha posição",
  "OPTION_JUMP_MODE_TOOLTIP": "Escolher o destino de sincronização",
-  "LABEL_LAST_ACTIVITY": "Estado da Última Atividade",
-  "LABEL_LAST_ACTIVITY_TOOLTIP": "Mostra o comando mais recente de reproduzir, pausa ou busca",
+  "LABEL_LAST_ACTIVITY": "Última Atividade",
+  "LABEL_LAST_ACTIVITY_TOOLTIP": "Mostra o comando mais recente",
  "NO_RECENT_COMMANDS": "Nenhum comando recente",
-  "LOBBY_HEADER": "LOBBY DE EPISÓDIO",
-  "LOBBY_WAITING_FOR": "🎬 A aguardar: \"{title}\"",
-  "LOBBY_WAITING_PEERS": "A aguardar participantes...",
-  "BTN_SKIP_PLAY": "Ignorar e reproduzir mesmo assim",
-  "BTN_SKIP_PLAY_TOOLTIP": "Cancelar o lobby e reproduzir mesmo assim",
-  "LOBBY_CONNECT_FIRST": "Ligar-se primeiro a uma sala",
+  "LOBBY_HEADER": "SALA DE ESPERA",
+  "LOBBY_WAITING_FOR": "🎬 À espera de: \"{title}\"",
+  "LOBBY_WAITING_PEERS": "À espera dos participantes...",
+  "BTN_SKIP_PLAY": "Ignorar e reproduzir agora",
+  "BTN_SKIP_PLAY_TOOLTIP": "Cancelar a espera e reproduzir mesmo assim",
+  "LOBBY_CONNECT_FIRST": "Ligue-se primeiro a uma sala",
  "LOBBY_CONNECT_FIRST_DESC": "Precisa de entrar numa sala através de um link de convite ou criar uma nova para sincronizar vídeos.",
  "BTN_CREATE_ROOM_ALT": "Criar Nova Sala",
-  "BTN_CREATE_ROOM_ALT_TOOLTIP": "Criar uma nova sala aleatória e entrar nela",
+  "BTN_CREATE_ROOM_ALT_TOOLTIP": "Criar uma sala aleatória e entrar nela",
  "LABEL_USERNAME": "O seu Nome de Utilizador",
-  "LABEL_USERNAME_TOOLTIP": "O nome de utilizador ajuda os outros a identificá-lo.",
+  "LABEL_USERNAME_TOOLTIP": "O seu nome visível para os outros.",
  "PLACEHOLDER_USERNAME": "Coala Anónimo",
-  "LABEL_HIDE_CLUTTER": "Ocultar Separadores Desnecessários",
-  "LABEL_HIDE_CLUTTER_TOOLTIP": "Filtra separadores sem vídeo e domínios não relacionados para manter a lista limpa",
-  "LABEL_AUTO_SYNC_NEXT": "Sincronização Automática do Próximo Episódio",
-  "LABEL_AUTO_SYNC_NEXT_TOOLTIP": "Pausa automaticamente e aguarda por todos os participantes quando um episódio muda, iniciando depois a reprodução em sincronia.",
-  "LABEL_AUTO_COPY_INVITE": "Copiar Automaticamente o Link de Convite",
-  "LABEL_AUTO_COPY_INVITE_TOOLTIP": "Copia automaticamente o link de convite para a área de transferência ao criar uma nova sala.",
+  "LABEL_HIDE_CLUTTER": "Ocultar separadores sem vídeo",
+  "LABEL_HIDE_CLUTTER_TOOLTIP": "Filtra separadores não relacionados para manter a lista limpa",
+  "LABEL_AUTO_SYNC_NEXT": "Sincro Auto do Próximo Episódio",
+  "LABEL_AUTO_SYNC_NEXT_TOOLTIP": "Pausa automaticamente e aguarda por todos ao mudar de episódio.",
+  "LABEL_AUTO_COPY_INVITE": "Copiar Convite Automaticamente",
+  "LABEL_AUTO_COPY_INVITE_TOOLTIP": "Copia automaticamente o link para a área de transferência ao criar uma nova sala.",
  "LABEL_NOTIFICATIONS": "Notificações do Navegador",
-  "LABEL_NOTIFICATIONS_TOOLTIP": "Mostra notificações do sistema quando alguém entra/sai ou reproduz/pausa.",
-  "LABEL_LANGUAGE": "Idioma da App",
-  "LABEL_LANGUAGE_TOOLTIP": "Escolha o seu idioma de preferência para a extensão",
+  "LABEL_NOTIFICATIONS_TOOLTIP": "Mostra notificações quando alguém entra, sai, reproduz ou pausa.",
+  "LABEL_LANGUAGE": "Idioma da Aplicação",
+  "LABEL_LANGUAGE_TOOLTIP": "Escolha o seu idioma de preferência",
  "LABEL_TROUBLESHOOTING": "Resolução de Problemas",
  "LABEL_TROUBLESHOOTING_TOOLTIP": "Ferramentas para corrigir problemas de ligação",
-  "BTN_REGEN_ID": "Regerar ID do Peer",
+  "BTN_REGEN_ID": "Regerar ID do Utilizador",
  "BTN_REGEN_ID_TOOLTIP": "Regerar o seu ID interno e voltar a ligar",
-  "REGEN_ID_DESC": "Use isto se vir erros de \"Identidade Duplicata\".",
-  "REGEN_ID_OTHER_ISSUE": "Outro problema? Abra um Issue no GitHub",
+  "REGEN_ID_DESC": "Use isto se encontrar erros de 'Identidade Duplicada'.",
+  "REGEN_ID_OTHER_ISSUE": "Outro problema? Abra um relatório no GitHub",
+  "TOAST_ID_REGENERATED": "Identidade regenerada — a voltar a ligar…",
  "LABEL_CONN_STATUS": "Estado da Ligação",
-  "LABEL_CONN_STATUS_TOOLTIP": "Estado atual da ligação WebSocket",
+  "LABEL_CONN_STATUS_TOOLTIP": "Estado atual da ligação",
  "CONN_STATUS_DISCONNECTED": "Desligado",
  "BTN_RETRY": "TENTAR NOVAMENTE",
  "BTN_RETRY_TOOLTIP": "Tentar voltar a ligar ao servidor",
  "BTN_COPY_LOGS": "Copiar Registos",
-  "BTN_COPY_LOGS_TOOLTIP": "Copiar registos para a área de transferência para partilha",
-  "LABEL_VIDEO_DEBUG": "Info de Debug de Vídeo",
-  "LABEL_VIDEO_DEBUG_TOOLTIP": "Detalhes técnicos sobre o elemento de vídeo atualmente seleccionado",
+  "BTN_COPY_LOGS_TOOLTIP": "Copiar registos para a área de transferência",
+  "LABEL_VIDEO_DEBUG": "Debug de Vídeo",
+  "LABEL_VIDEO_DEBUG_TOOLTIP": "Detalhes técnicos sobre o vídeo atualmente selecionado",
  "VIDEO_DEBUG_EMPTY": "Nenhum separador selecionado ou vídeo detetado.",
-  "LABEL_HISTORY": "Histórico Completo de Ações",
-  "LABEL_HISTORY_TOOLTIP": "Registo cronológico de todos os comandos de sincronização na sala",
+  "LABEL_HISTORY": "Histórico Completo",
+  "LABEL_HISTORY_TOOLTIP": "Registo cronológico de todos os comandos na sala",
  "HISTORY_EMPTY": "Nenhuma atividade ainda",
  "LABEL_LOGS": "Registos (Últimos 50)",
-  "LABEL_LOGS_TOOLTIP": "Registos de ligação técnica para depuração",
+  "LABEL_LOGS_TOOLTIP": "Registos técnicos para depuração",
  "BTN_CLEAR": "LIMPAR",
-  "BTN_CLEAR_TOOLTIP": "Limpar a saída do registo",
+  "BTN_CLEAR_TOOLTIP": "Limpar os registos",
  "LABEL_GITHUB": "Repositório GitHub",
  "BTN_ONBOARDING_SKIP": "Saltar",
  "BTN_ONBOARDING_SKIP_TOOLTIP": "Saltar o tutorial",
  "BTN_ONBOARDING_NEXT": "Seguinte",
  "BTN_ONBOARDING_NEXT_TOOLTIP": "Ir para o passo seguinte",
  "ONBOARDING_1_TITLE": "Bem-vindo ao KoalaSync!",
-  "ONBOARDING_1_TEXT": "Veja vídeos em conjunto numa sincronizzazione perfetta — não importa onde esteja. Vamos fare uma breve visita guiada!",
+  "ONBOARDING_1_TEXT": "Veja vídeos em conjunto com os seus amigos em sincronia perfeita. Vamos fazer uma breve visita guiada!",
  "ONBOARDING_2_TITLE": "1. Criar uma Sala",
  "ONBOARDING_2_TEXT": "Comece aqui. Crie uma sala e partilhe o link de convite com os seus amigos.",
  "ONBOARDING_3_TITLE": "2. Selecionar Vídeo",
-  "ONBOARDING_3_TEXT": "Navegue até aqui para selecionar o vídeo que deseja sincronizar. Reproduza, pause e avance — todos ficam em sincronia.",
+  "ONBOARDING_3_TEXT": "Navegue até aqui para selecionar o vídeo a sincronizar. Reproduza, pause e avance — todos vêm o mesmo.",
  "ONBOARDING_4_TITLE": "3. Personalizar",
-  "ONBOARDING_4_TEXT": "Escolha um nome de utilizador divertido para que os seus amigos saibam quem você é.",
+  "ONBOARDING_4_TEXT": "Escolha um nome de utilizador divertido para que os seus amigos o reconheçam.",
  "ONBOARDING_5_TITLE": "Está tudo pronto!",
-  "ONBOARDING_5_TEXT": "Altura de ir buscar pipocas. Divirtam-se a ver juntos!",
+  "ONBOARDING_5_TEXT": "Hora de ir buscar as pipocas. Divirtam-se!",
  "ERR_CONN_TIMEOUT": "Ligação expirada. Tente novamente.",
-  "ERR_INVALID_SERVER_URL": "Formato de URL do Servidor inválido.",
-  "ERR_IDENTITY_NOT_LOADED": "Identidade ainda não carregada. Aguarde um momento e tente novamente.",
-  "ERR_NO_PEERS_TIME": "Nenhum outro peer com hora conhecida. Mude para 'Ir para Mim'.",
-  "ERR_NO_VIDEO_TAB": "Não foi possível ligar ao separador do vídeo.",
+  "ERR_INVALID_SERVER_URL": "Formato de URL do servidor inválido.",
+  "ERR_IDENTITY_NOT_LOADED": "Identidade ainda não carregada. Aguarde um momento.",
+  "ERR_NO_PEERS_TIME": "Nenhum participante com hora conhecida. Mude para 'Trazer para a minha posição'.",
+  "ERR_NO_VIDEO_TAB": "Não foi possível aceder ao separador do vídeo.",
  "ERR_SELECT_VIDEO": "Selecione primeiro um vídeo!",
  "TOAST_INVITE_COPIED": "Link de convite copiado!",
  "TOAST_COPY_FAILED": "Falha ao copiar para a área de transferência",
-  "TOAST_LOBBY_SKIPPED": "Lobby do episódio ignorado.",
-  "TOAST_LOBBY_SKIP_FAILED": "Falha ao ignorar o lobby.",
+  "TOAST_LOBBY_SKIPPED": "Sala de espera ignorada.",
+  "TOAST_LOBBY_SKIP_FAILED": "Falha ao ignorar a sala de espera.",
  "TOAST_LOGS_COPIED": "Copiado!",
  "TOAST_PEER_JOINED": "{name} entrou na sala",
  "TOAST_PEER_LEFT": "{name} saiu da sala",
@@ -143,67 +162,81 @@
  "STATUS_CONNECTING": "A ligar...",
  "STATUS_FAILED": "Falhou",
  "STATUS_DISCONNECTED": "Desligado",
+  "STATUS_IDLE": "Pronto para ligar",
+  "STATUS_IDLE_TOOLTIP": "O KoalaSync está pronto. Entre ou crie uma sala para ligar e iniciar a sincronização.",
  "BTN_STATE_JOINING": "🚀 A entrar...",
  "BTN_STATE_RECONNECTING": "🔄 A voltar a ligar...",
  "BTN_STATE_PLAYING": "▶ A reproduzir...",
-  "BTN_STATE_PAUSING": "⏸ A pausar...",
-  "BTN_STATE_SYNCING_GROUP": "A sincronizar com o grupo ({time})....",
+  "BTN_STATE_PAUSING": "⏸ Em pausa...",
+  "BTN_STATE_SYNCING_GROUP": "A sincronizar em grupo ({time})....",
  "BTN_STATE_SYNCING": "A sincronizar...",
  "BTN_STATE_SYNCED": "✅ Sincronizado!",
  "NOTIF_PLAY": "iniciou a reprodução",
-  "NOTIF_PAUSE": "pausou a reprodução",
-  "NOTIF_SEEK": "avançou/recuou no vídeo",
-  "NOTIF_FORCE_PREPARE": "iniciou a sincronização forçada",
+  "NOTIF_PAUSE": "pausou o vídeo",
+  "NOTIF_SEEK": "mudou a posição do vídeo",
+  "NOTIF_FORCE_PREPARE": "iniciou uma sincronização forçada",
  "NOTIF_FORCE_EXECUTE": "sincronizou todos",
-  "DEBUG_NO_TAB": "Nenhum separador de destino selecionado.",
-  "DEBUG_COMM_FAIL": "Não foi possível comunicar com o vídeo do separador.",
-  "EMPTY_PEERS_TITLE": "Nenhum participante ainda",
+  "DEBUG_NO_TAB": "Nenhum separador selecionado.",
+  "DEBUG_COMM_FAIL": "Erro ao comunicar com o vídeo.",
+  "EMPTY_PEERS_TITLE": "Nenhum participante",
  "EMPTY_PEERS_HINT": "Partilhe o seu link de convite para começar",
-  "EMPTY_HISTORY_TITLE": "Nenhuma atividade ainda",
-  "EMPTY_HISTORY_HINT": "Reproduza, pause ou avance para ver o histórico",
-  "EMPTY_LOGS_TITLE": "Nenhum registo",
-  "EMPTY_LOGS_HINT": "Os eventi de ligação vão aparecer aqui",
+  "EMPTY_HISTORY_TITLE": "Nenhuma atividade",
+  "EMPTY_HISTORY_HINT": "Reproduza ou pause para ver o histórico",
+  "EMPTY_LOGS_TITLE": "Sem registos",
+  "EMPTY_LOGS_HINT": "Os eventos de ligação vão aparecer aqui",
  "EMPTY_ROOMS_TITLE": "Nenhuma sala ativa",
-  "EMPTY_ROOMS_HINT": "Crie uma sala ou atualize para encontrar salas públicas",
+  "EMPTY_ROOMS_HINT": "Crie uma sala ou atualize a lista",
  "LABEL_YOU": "Tu",
  "ONBOARDING_DONE": "Concluído!",
  "LABEL_LOBBY_PEER_READY": "Pronto",
  "LABEL_LOBBY_PEER_LOADING": "A carregar...",
  "LABEL_PASSWORD_PROTECTED": "Protegido por Palavra-passe",
  "LABEL_PEERS_COUNT": "{count} participantes",
-  "LABEL_CUSTOM_SERVER": "Servidor Personalizado",
+  "LABEL_CUSTOM_SERVER": "Servidor Privado",
  "BTN_STATE_CREATING": "🚀 A Criar Sala...",
-  "NOTIF_LOBBY_CANCEL_TITLE": "KoalaSync — Sincronização do Episódio Falhou",
+  "NOTIF_LOBBY_CANCEL_TITLE": "KoalaSync — Falha na Sincronização do Episódio",
  "NOTIF_LOBBY_CANCEL_MSG": "Sincronização automática cancelada: {reason}. Pode ter de sincronizar manualmente.",
-  "LOBBY_CANCEL_TIMEOUT": "Timeout",
-  "LOBBY_CANCEL_TIMEOUT_RECOVERED": "Timeout (recuperado)",
+  "LOBBY_CANCEL_TIMEOUT": "Tempo limite expirado",
+  "LOBBY_CANCEL_TIMEOUT_RECOVERED": "Tempo limite (recuperado)",
  "LOBBY_CANCEL_PEERS_LEFT": "Todos os outros participantes saíram",
-  "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Timeout — nem todos os participantes carregaram o episódio",
+  "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Tempo limite — alguns participantes não carregaram o episódio",
  "LOBBY_CANCEL_USER": "Cancelado pelo utilizador",
-  "NOTIF_ERROR_TITLE": "Erro do KoalaSync",
-  "FOOTER_SUPPORT": "☕ Oferece um café",
+  "NOTIF_ERROR_TITLE": "Erro no KoalaSync",
+  "FOOTER_SUPPORT": "Support KoalaSync",
  "FOOTER_REVIEW": "★ Avaliar",
  "FOOTER_SUPPORT_PROMPT": "Gostas do KoalaSync? Deixa uma avaliação!",
-  "LABEL_AUDIO_PROCESSING": "Processamento de áudio",
-  "LABEL_AUDIO_PROCESSING_TOOLTIP": "Aplica efeitos de áudio como compressão à reprodução de vídeo",
+  "LABEL_AUDIO_PROCESSING": "Processamento de Áudio",
+  "LABEL_AUDIO_PROCESSING_TOOLTIP": "Aplica efeitos de áudio (como compressão) aos vídeos",
  "AUDIO_OPEN_SETTINGS": "Abrir",
  "NEW_FEATURE_AUDIO": "Novo: Processamento de áudio — experimente o compressor!",
  "AUDIO_BACK": "← Voltar",
-  "AUDIO_PAGE_TITLE": "Configurações de áudio",
-  "AUDIO_MASTER_TOGGLE": "Processamento de áudio",
+  "AUDIO_PAGE_TITLE": "Configurações de Áudio",
+  "AUDIO_MASTER_TOGGLE": "Processamento de Áudio",
  "AUDIO_COMPRESSOR": "Compressor",
  "AUDIO_COMPRESSOR_ENABLE": "Ativado",
  "AUDIO_PRESET": "Predefinição",
  "AUDIO_PRESET_RECOMMENDED": "Recomendado",
-  "AUDIO_PRESET_DYNAMIC_RANGE": "Gama dinâmica",
-  "AUDIO_PRESET_VOCAL_ENHANCEMENT": "Melhoria vocal",
+  "AUDIO_PRESET_DYNAMIC_RANGE": "Gama Dinâmica",
+  "AUDIO_PRESET_VOCAL_ENHANCEMENT": "Melhoria Vocal",
  "AUDIO_PRESET_SMOOTH": "Suave",
  "AUDIO_PRESET_CUSTOM": "Personalizado",
-  "AUDIO_PARAM_THRESHOLD": "Limiar",
-  "AUDIO_PARAM_KNEE": "Knee",
-  "AUDIO_PARAM_RATIO": "Ratio",
-  "AUDIO_PARAM_ATTACK": "Attack",
-  "AUDIO_PARAM_RELEASE": "Release",
+  "AUDIO_PARAM_THRESHOLD": "Limiar (Threshold)",
+  "AUDIO_PARAM_KNEE": "Joelho (Knee)",
+  "AUDIO_PARAM_RATIO": "Rácio (Ratio)",
+  "AUDIO_PARAM_ATTACK": "Ataque (Attack)",
+  "AUDIO_PARAM_RELEASE": "Libertação (Release)",
  "AUDIO_EQUALIZER": "Equalizador",
-  "AUDIO_COMING_SOON": "Em breve"
+  "AUDIO_COMING_SOON": "Em breve",
+  "BTN_RESTART_TOUR": "Reiniciar Tutorial",
+  "BTN_RESTART_TOUR_TOOLTIP": "Reiniciar o tutorial introdutório",
+  "HINT_SELECT_VIDEO": "Selecione o seu vídeo aqui!",
+  "OPTION_TITLE_PRIVACY_FULL": "Enviar título completo",
+  "OPTION_TITLE_PRIVACY_EPISODE": "Enviar ID do episódio",
+  "OPTION_TITLE_PRIVACY_HIDDEN": "Não enviar",
+  "LABEL_PRIVACY_SETTINGS": "Definições de privacidade",
+  "LABEL_PRIVACY_SETTINGS_TOOLTIP": "Escolhe que títulos do separador e do conteúdo multimédia são enviados para a sala.",
+  "LABEL_SEND_TAB_TITLE": "Enviar título do separador",
+  "LABEL_SEND_TAB_TITLE_TOOLTIP": "Envia para a sala o título do separador do navegador selecionado.",
+  "LABEL_MEDIA_TITLE_PRIVACY": "Título multimédia",
+  "LABEL_MEDIA_TITLE_PRIVACY_TOOLTIP": "Escolhe como os títulos multimédia são enviados para a sala."
 }
@@ -44,6 +44,24 @@
  "LABEL_INVITE_LINK_TOOLTIP": "Поделитесь этой ссылкой с друзьями, чтобы они вошли",
  "LABEL_PEERS_IN_ROOM": "Участники в комнате",
  "LABEL_PEERS_IN_ROOM_TOOLTIP": "Другие пользователи, подключенные к этой комнате",
+  "LABEL_HOST_CONTROL": "Управление ведущим",
+  "LABEL_HOST_CONTROL_TOOLTIP": "Ограничить, кто может управлять воспроизведением в этой комнате",
+  "LABEL_HOST_ONLY_TOGGLE": "Только я могу управлять воспроизведением",
+  "NOTICE_HOST_CONTROLS": "Ведущий управляет воспроизведением для всех.",
+  "NOTICE_COHOST_HINT": "Совет: предоставьте управление отдельным участникам в списке ниже.",
+  "BADGE_HOST": "Ведущий",
+  "BADGE_GUEST": "Гость",
+  "BADGE_CONTROLLER": "Управляющий",
+  "BTN_GIVE_CONTROL": "Дать управление",
+  "BTN_REVOKE_CONTROL": "Отозвать",
+  "BADGE_DESYNCED": "Соло",
+  "TOOLTIP_PEER_DESYNCED": "Смотрит отдельно — игнорирует команды ведущего",
+  "HCM_DIALOG_TITLE": "KoalaSync · Комнатой управляет ведущий",
+  "HCM_DIALOG_BODY": "Управлять воспроизведением в этой комнате может только ведущий. Продолжить смотреть вместе или смотреть самостоятельно?",
+  "HCM_DIALOG_STAY": "Оставаться синхронно",
+  "HCM_DIALOG_SOLO": "Смотреть самостоятельно",
+  "HCM_BADGE_SOLO": "Вы смотрите самостоятельно",
+  "HCM_BADGE_RESYNC": "Синхронизировать",
  "NO_PEERS_CONNECTED": "Нет подключенных участников",
  "BTN_LEAVE_ROOM": "Выйти из комнаты",
  "LABEL_SELECT_VIDEO": "Выбрать видео",
@@ -92,6 +110,7 @@
  "BTN_REGEN_ID_TOOLTIP": "Сбросить ваш внутренний идентификатор и переподключиться",
  "REGEN_ID_DESC": "Используйте при появлении ошибок дублирования идентификации.",
  "REGEN_ID_OTHER_ISSUE": "Другая проблема? Откройте Issue на GitHub",
+  "TOAST_ID_REGENERATED": "Идентичность перегенерирована — переподключение…",
  "LABEL_CONN_STATUS": "Статус подключения",
  "LABEL_CONN_STATUS_TOOLTIP": "Текущий статус WebSocket-соединения с сервером",
  "CONN_STATUS_DISCONNECTED": "Отключено",
@@ -143,6 +162,8 @@
  "STATUS_CONNECTING": "Подключение...",
  "STATUS_FAILED": "Ошибка",
  "STATUS_DISCONNECTED": "Отключено",
+  "STATUS_IDLE": "Готов к подключению",
+  "STATUS_IDLE_TOOLTIP": "KoalaSync готов. Присоединитесь к комнате или создайте её, чтобы подключиться и начать синхронизацию.",
  "BTN_STATE_JOINING": "🚀 Вход...",
  "BTN_STATE_RECONNECTING": "🔄 Переподключение...",
  "BTN_STATE_PLAYING": "▶ Запуск...",
@@ -181,7 +202,7 @@
  "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Время ожидания истекло — не все участники загрузили серию",
  "LOBBY_CANCEL_USER": "Отменено пользователем",
  "NOTIF_ERROR_TITLE": "Ошибка KoalaSync",
-  "FOOTER_SUPPORT": "☕ Угости кофе",
+  "FOOTER_SUPPORT": "Support KoalaSync",
  "FOOTER_REVIEW": "★ Оценить",
  "FOOTER_SUPPORT_PROMPT": "Нравится KoalaSync? Оставьте отзыв!",
  "LABEL_AUDIO_PROCESSING": "Обработка звука",
@@ -205,5 +226,17 @@
  "AUDIO_PARAM_ATTACK": "Attack",
  "AUDIO_PARAM_RELEASE": "Release",
  "AUDIO_EQUALIZER": "Эквалайзер",
-  "AUDIO_COMING_SOON": "Скоро"
+  "AUDIO_COMING_SOON": "Скоро",
+  "BTN_RESTART_TOUR": "Перезапустить обучение",
+  "BTN_RESTART_TOUR_TOOLTIP": "Запустить приветственное руководство заново",
+  "HINT_SELECT_VIDEO": "Выберите ваше видео здесь!",
+  "OPTION_TITLE_PRIVACY_FULL": "Отправлять полное название",
+  "OPTION_TITLE_PRIVACY_EPISODE": "Отправлять ID эпизода",
+  "OPTION_TITLE_PRIVACY_HIDDEN": "Не отправлять",
+  "LABEL_PRIVACY_SETTINGS": "Настройки приватности",
+  "LABEL_PRIVACY_SETTINGS_TOOLTIP": "Выберите, какие названия вкладки и медиа отправляются в комнату.",
+  "LABEL_SEND_TAB_TITLE": "Отправлять название вкладки",
+  "LABEL_SEND_TAB_TITLE_TOOLTIP": "Отправляет в комнату название выбранной вкладки браузера.",
+  "LABEL_MEDIA_TITLE_PRIVACY": "Название медиа",
+  "LABEL_MEDIA_TITLE_PRIVACY_TOOLTIP": "Выберите, как названия медиа отправляются в комнату."
 }
@@ -44,6 +44,24 @@
  "LABEL_INVITE_LINK_TOOLTIP": "Katılabilmeleri için bu bağlantıyı arkadaşlarınızla paylaşın",
  "LABEL_PEERS_IN_ROOM": "Odadaki Kişiler",
  "LABEL_PEERS_IN_ROOM_TOOLTIP": "Şu anda bu odaya bağlı olan diğer kullanıcılar",
+  "LABEL_HOST_CONTROL": "Sunucu Kontrolü",
+  "LABEL_HOST_CONTROL_TOOLTIP": "Bu odada oynatmayı kimin kontrol edebileceğini belirleyin",
+  "LABEL_HOST_ONLY_TOGGLE": "Oynatmayı yalnızca ben kontrol edebilirim",
+  "NOTICE_HOST_CONTROLS": "Oynatmayı herkes için sunucu kontrol eder.",
+  "NOTICE_COHOST_HINT": "İpucu: aşağıdaki katılımcı listesinde tek tek katılımcılara kontrol verin.",
+  "BADGE_HOST": "Sunucu",
+  "BADGE_GUEST": "Misafir",
+  "BADGE_CONTROLLER": "Kontrolcü",
+  "BTN_GIVE_CONTROL": "Kontrol ver",
+  "BTN_REVOKE_CONTROL": "Geri al",
+  "BADGE_DESYNCED": "Solo",
+  "TOOLTIP_PEER_DESYNCED": "Tek başına izliyor — sunucu komutlarını yok sayar",
+  "HCM_DIALOG_TITLE": "KoalaSync · Bu odayı sunucu kontrol ediyor",
+  "HCM_DIALOG_BODY": "Bu odada oynatmayı yalnızca sunucu kontrol edebilir. Birlikte izlemeye devam mı, yoksa kendi başına mı izlemek istiyorsun?",
+  "HCM_DIALOG_STAY": "Senkron kal",
+  "HCM_DIALOG_SOLO": "Kendi başıma izle",
+  "HCM_BADGE_SOLO": "Kendi başına izliyorsun",
+  "HCM_BADGE_RESYNC": "Yeniden senkronize et",
  "NO_PEERS_CONNECTED": "Bağlı kimse yok",
  "BTN_LEAVE_ROOM": "Odadan Ayrıl",
  "LABEL_SELECT_VIDEO": "Video Seç",
@@ -92,6 +110,7 @@
  "BTN_REGEN_ID_TOOLTIP": "Dahili kimliğinizi yeniden oluşturun ve tekrar bağlanın",
  "REGEN_ID_DESC": "\"Duplicate Identity\" (Mükerrer Kimlik) hataları görüyorsanız bunu kullanın.",
  "REGEN_ID_OTHER_ISSUE": "Başka bir sorun? GitHub Issue açın",
+  "TOAST_ID_REGENERATED": "Kimlik yeniden oluşturuldu — yeniden bağlanılıyor…",
  "LABEL_CONN_STATUS": "Bağlantı Durumu",
  "LABEL_CONN_STATUS_TOOLTIP": "Mevcut WebSocket bağlantı durumu",
  "CONN_STATUS_DISCONNECTED": "Bağlantı Kesildi",
@@ -143,6 +162,8 @@
  "STATUS_CONNECTING": "Bağlanılıyor...",
  "STATUS_FAILED": "Başarısız",
  "STATUS_DISCONNECTED": "Bağlantı Kesildi",
+  "STATUS_IDLE": "Bağlanmaya hazır",
+  "STATUS_IDLE_TOOLTIP": "KoalaSync hazır. Bağlanmak ve senkronizasyonu başlatmak için bir odaya katılın veya oluşturun.",
  "BTN_STATE_JOINING": "🚀 Katılınıyor...",
  "BTN_STATE_RECONNECTING": "🔄 Yeniden bağlanılıyor...",
  "BTN_STATE_PLAYING": "▶ Oynatılıyor...",
@@ -181,7 +202,7 @@
  "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Zaman aşımı — tüm bağlantılar bölümü yüklemedi",
  "LOBBY_CANCEL_USER": "Kullanıcı tarafından iptal edildi",
  "NOTIF_ERROR_TITLE": "KoalaSync Hatası",
-  "FOOTER_SUPPORT": "☕ Bana kahve ısmarla",
+  "FOOTER_SUPPORT": "Support KoalaSync",
  "FOOTER_REVIEW": "★ Değerlendir",
  "FOOTER_SUPPORT_PROMPT": "KoalaSync'i beğendin mi? Bir yorum bırak!",
  "LABEL_AUDIO_PROCESSING": "Ses işleme",
@@ -205,5 +226,17 @@
  "AUDIO_PARAM_ATTACK": "Attack",
  "AUDIO_PARAM_RELEASE": "Release",
  "AUDIO_EQUALIZER": "Ekolayzer",
-  "AUDIO_COMING_SOON": "Çok yakında"
+  "AUDIO_COMING_SOON": "Çok yakında",
+  "BTN_RESTART_TOUR": "Eğitimi Yeniden Başlat",
+  "BTN_RESTART_TOUR_TOOLTIP": "Tanıtım eğitimini yeniden başlat",
+  "HINT_SELECT_VIDEO": "Videonuzu buradan seçin!",
+  "OPTION_TITLE_PRIVACY_FULL": "Tam başlığı gönder",
+  "OPTION_TITLE_PRIVACY_EPISODE": "Bölüm ID’sini gönder",
+  "OPTION_TITLE_PRIVACY_HIDDEN": "Gönderme",
+  "LABEL_PRIVACY_SETTINGS": "Gizlilik ayarları",
+  "LABEL_PRIVACY_SETTINGS_TOOLTIP": "Odaya hangi sekme ve medya başlıklarının gönderileceğini seçin.",
+  "LABEL_SEND_TAB_TITLE": "Sekme başlığını gönder",
+  "LABEL_SEND_TAB_TITLE_TOOLTIP": "Seçili tarayıcı sekmesinin başlığını odaya gönderir.",
+  "LABEL_MEDIA_TITLE_PRIVACY": "Medya başlığı",
+  "LABEL_MEDIA_TITLE_PRIVACY_TOOLTIP": "Medya başlıklarının odaya nasıl gönderileceğini seçin."
 }
@@ -0,0 +1,242 @@
+{
+  "LANG_CODE": "uk",
+  "HTML_CLASS": "lang-uk",
+  "APP_TITLE": "KoalaSync",
+  "TAB_ROOM": "Кімната",
+  "TAB_ROOM_TOOLTIP": "Налаштування кімнати та підключення",
+  "TAB_SYNC": "Синхронізувати",
+  "TAB_SYNC_TOOLTIP": "Елементи керування синхронізацією відео та віддалені дії",
+  "TAB_SETTINGS": "Налаштування",
+  "TAB_SETTINGS_TOOLTIP": "Параметри розширення",
+  "TAB_STATUS": "Статус",
+  "TAB_STATUS_TOOLTIP": "Розширена діагностика та журнали",
+  "BTN_CREATE_ROOM": "+ Створити нову кімнату",
+  "MANUAL_CONNECT_HEADER": "Ручне підключення / Додатково",
+  "LABEL_SERVER": "Сервер",
+  "BTN_SERVER_OFFICIAL": "Офіційний",
+  "BTN_SERVER_OFFICIAL_TOOLTIP": "Використовуйте офіційний надійний сервер",
+  "BTN_SERVER_CUSTOM": "Власний",
+  "BTN_SERVER_CUSTOM_TOOLTIP": "Підключіться до власного серверу, розміщеного на власному хостингу",
+  "PLACEHOLDER_SERVER_URL": "wss://your-server:3000",
+  "LABEL_ROOM_ID": "ID кімнати",
+  "LABEL_ROOM_ID_TOOLTIP": "Унікальний ідентифікатор вашої кімнати синхронізації",
+  "PLACEHOLDER_ROOM_ID": "Введіть Room ID",
+  "PLACEHOLDER_ROOM_ID_TOOLTIP": "Унікальний ідентифікатор кімнати, до якої ви хочете приєднатися",
+  "LABEL_PASSWORD": "Пароль (необов'язково)",
+  "LABEL_PASSWORD_TOOLTIP": "Додатковий пароль для обмеження доступу до кімнати",
+  "PLACEHOLDER_PASSWORD": "Пароль кімнати (необов'язково)",
+  "PLACEHOLDER_PASSWORD_TOOLTIP": "Пароль для кімнати (залиште порожнім, якщо немає)",
+  "BTN_JOIN_ROOM": "Приєднатися / Створити кімнату",
+  "BTN_JOIN_ROOM_TOOLTIP": "Підключіться до кімнати",
+  "LABEL_PUBLIC_ROOMS": "Громадські кімнати",
+  "LABEL_PUBLIC_ROOMS_TOOLTIP": "Список загальнодоступних кімнат на цьому сервері",
+  "BTN_REFRESH": "ОНОВИТИ",
+  "BTN_REFRESH_TOOLTIP": "Оновити список громадських кімнат",
+  "PUBLIC_ROOMS_REFRESHING": "Оновлення...",
+  "BTN_REFRESH_COOLDOWN": "ЧЕКАЙТЕ {seconds}s",
+  "BTN_REFRESH_COOLDOWN_TOOLTIP": "Оновлення списку кімнат охолоджується. Повторіть спробу в {seconds}s.",
+  "PUBLIC_ROOMS_REFRESHING_COOLDOWN": "Оновлення громадських кімнат. Наступне оновлення доступне в {seconds}s.",
+  "LABEL_ACTIVE_ROOM": "Активна кімната",
+  "LABEL_ACTIVE_ROOM_TOOLTIP": "Кімната, до якої ви зараз підключені",
+  "ACTIVE_ROOM_NONE": "ЖОДНОГО",
+  "ACTIVE_SERVER_OFFICIAL": "Офіційний сервер",
+  "LABEL_INVITE_LINK": "Посилання на запрошення",
+  "LABEL_INVITE_LINK_TOOLTIP": "Поділіться цим посиланням з друзями, щоб вони могли приєднатися",
+  "LABEL_PEERS_IN_ROOM": "Учасники в кімнаті",
+  "LABEL_PEERS_IN_ROOM_TOOLTIP": "Інші користувачі зараз підключені до цієї кімнати",
+  "LABEL_HOST_CONTROL": "Керування ведучим",
+  "LABEL_HOST_CONTROL_TOOLTIP": "Обмежити, хто може керувати відтворенням у цій кімнаті",
+  "LABEL_HOST_ONLY_TOGGLE": "Лише я можу керувати відтворенням",
+  "NOTICE_HOST_CONTROLS": "Ведучий керує відтворенням для всіх.",
+  "NOTICE_COHOST_HINT": "Порада: надайте керування окремим учасникам у списку нижче.",
+  "BADGE_HOST": "Ведучий",
+  "BADGE_GUEST": "Гість",
+  "BADGE_CONTROLLER": "Керуючий",
+  "BTN_GIVE_CONTROL": "Дати керування",
+  "BTN_REVOKE_CONTROL": "Відкликати",
+  "BADGE_DESYNCED": "Соло",
+  "TOOLTIP_PEER_DESYNCED": "Дивиться окремо — ігнорує команди ведучого",
+  "HCM_DIALOG_TITLE": "KoalaSync · Кімнатою керує ведучий",
+  "HCM_DIALOG_BODY": "Керувати відтворенням у цій кімнаті може лише ведучий. Продовжити дивитися разом чи дивитися самостійно?",
+  "HCM_DIALOG_STAY": "Залишатися синхронно",
+  "HCM_DIALOG_SOLO": "Дивитися самостійно",
+  "HCM_BADGE_SOLO": "Ви дивитеся самостійно",
+  "HCM_BADGE_RESYNC": "Синхронізувати",
+  "NO_PEERS_CONNECTED": "Немає підключених однорангових пристроїв",
+  "BTN_LEAVE_ROOM": "Вийти з кімнати",
+  "LABEL_SELECT_VIDEO": "Виберіть Відео",
+  "LABEL_SELECT_VIDEO_TOOLTIP": "Виберіть вкладку браузера, яка містить відео для синхронізації",
+  "OPTION_SELECT_TAB": "-- Виберіть вкладку --",
+  "LABEL_REMOTE_CONTROL": "Пульт дистанційного керування",
+  "BTN_COPY_INVITE": "📋 Посилання на запрошення",
+  "BTN_COPY_INVITE_TOOLTIP": "Копіювати посилання для запрошення",
+  "BTN_PLAY": "▶ Відтворити",
+  "BTN_PLAY_TOOLTIP": "Надішліть усім команду Play",
+  "BTN_PAUSE": "⏸ Пауза",
+  "BTN_PAUSE_TOOLTIP": "Надішліть команду паузи всім",
+  "BTN_SYNC": "⚡ СИНХР",
+  "BTN_SYNC_TOOLTIP": "Змусити всіх користувачів синхронізуватися",
+  "OPTION_JUMP_TO_OTHERS": "Перейти до інших",
+  "OPTION_JUMP_TO_ME": "Перейти до мене",
+  "OPTION_JUMP_MODE_TOOLTIP": "Виберіть ціль синхронізації",
+  "LABEL_LAST_ACTIVITY": "Статус останньої дії",
+  "LABEL_LAST_ACTIVITY_TOOLTIP": "Показує останню команду відтворення, паузи або перемотування",
+  "NO_RECENT_COMMANDS": "Немає останніх команд",
+  "LOBBY_HEADER": "ЕПІЗОДНЕ ЛОБІ",
+  "LOBBY_WAITING_FOR": "🎬 Чекаємо: \"{title}\"",
+  "LOBBY_WAITING_PEERS": "Очікування учасників...",
+  "BTN_SKIP_PLAY": "Все одно пропустити та відтворити",
+  "BTN_SKIP_PLAY_TOOLTIP": "Скасуйте лобі та все одно відтворюйте",
+  "LOBBY_CONNECT_FIRST": "Спочатку підключіться до кімнати",
+  "LOBBY_CONNECT_FIRST_DESC": "Вам потрібно приєднатися до кімнати за посиланням із запрошенням або створити нову, щоб синхронізувати відео.",
+  "BTN_CREATE_ROOM_ALT": "Створити нову кімнату",
+  "BTN_CREATE_ROOM_ALT_TOOLTIP": "Створіть нову випадкову кімнату та приєднайтеся до неї",
+  "LABEL_USERNAME": "Ваше ім'я користувача",
+  "LABEL_USERNAME_TOOLTIP": "Ім'я користувача допомагає іншим ідентифікувати вас.",
+  "PLACEHOLDER_USERNAME": "Анонімна коала",
+  "LABEL_HIDE_CLUTTER": "Приховати безладні вкладки",
+  "LABEL_HIDE_CLUTTER_TOOLTIP": "Відфільтровує вкладки, не пов’язані з відео, і непов’язані домени, щоб зберегти список чистим",
+  "LABEL_AUTO_SYNC_NEXT": "Автоматична синхронізація наступного епізоду",
+  "LABEL_AUTO_SYNC_NEXT_TOOLTIP": "Автоматично призупиняється та чекає на всіх однорангових пристроїв, коли епізод зміниться, а потім синхронізація починається разом.",
+  "LABEL_AUTO_COPY_INVITE": "Автоматичне копіювання посилання для запрошення",
+  "LABEL_AUTO_COPY_INVITE_TOOLTIP": "Автоматично копіює посилання запрошення в буфер обміну під час створення нової кімнати.",
+  "LABEL_NOTIFICATIONS": "Сповіщення браузера",
+  "LABEL_NOTIFICATIONS_TOOLTIP": "Показує рідні системні сповіщення, коли хтось приєднується/виходить або відтворює/призупиняє.",
+  "LABEL_LANGUAGE": "Мова програми",
+  "LABEL_LANGUAGE_TOOLTIP": "Виберіть бажану мову розширення",
+  "LABEL_TROUBLESHOOTING": "Усунення несправностей",
+  "LABEL_TROUBLESHOOTING_TOOLTIP": "Інструменти для вирішення проблем з підключенням",
+  "BTN_REGEN_ID": "Регенерувати Peer ID",
+  "BTN_REGEN_ID_TOOLTIP": "Повторно згенеруйте свій внутрішній ідентифікатор і повторно підключіться",
+  "REGEN_ID_DESC": "Використовуйте це, якщо ви бачите помилку \"Дублікати ідентифікатора\".",
+  "REGEN_ID_OTHER_ISSUE": "Інша проблема? Відкрийте випуск GitHub",
+  "TOAST_ID_REGENERATED": "Ідентичність перегенеровано — повторне підключення…",
+  "LABEL_CONN_STATUS": "Статус підключення",
+  "LABEL_CONN_STATUS_TOOLTIP": "Поточний стан підключення WebSocket",
+  "CONN_STATUS_DISCONNECTED": "Відключено",
+  "BTN_RETRY": "ПОВТОРИТИ",
+  "BTN_RETRY_TOOLTIP": "Спробуйте повторно підключитися до сервера",
+  "BTN_COPY_LOGS": "Копіювати журнали",
+  "BTN_COPY_LOGS_TOOLTIP": "Скопіюйте журнали в буфер обміну для спільного використання",
+  "LABEL_VIDEO_DEBUG": "Інформація про налагодження відео",
+  "LABEL_VIDEO_DEBUG_TOOLTIP": "Технічні відомості про поточний вибраний елемент відео",
+  "VIDEO_DEBUG_EMPTY": "Вкладка не вибрана або відео не виявлено.",
+  "LABEL_HISTORY": "Повна історія дій",
+  "LABEL_HISTORY_TOOLTIP": "Хронологічний журнал усіх команд синхронізації в кімнаті",
+  "HISTORY_EMPTY": "Активності ще немає",
+  "LABEL_LOGS": "Журнали (останні 50)",
+  "LABEL_LOGS_TOOLTIP": "Журнали технічного підключення для налагодження",
+  "BTN_CLEAR": "Очистити",
+  "BTN_CLEAR_TOOLTIP": "Очистити журнал",
+  "LABEL_GITHUB": "Репозиторій GitHub",
+  "BTN_ONBOARDING_SKIP": "Пропустити",
+  "BTN_ONBOARDING_SKIP_TOOLTIP": "Пропустити підручник",
+  "BTN_ONBOARDING_NEXT": "Далі",
+  "BTN_ONBOARDING_NEXT_TOOLTIP": "Перейти до наступного кроку",
+  "ONBOARDING_1_TITLE": "Ласкаво просимо до KoalaSync!",
+  "ONBOARDING_1_TEXT": "Дивіться відео разом у ідеальній синхронізації — де б ви не були. Давайте зробимо короткий тур!",
+  "ONBOARDING_2_TITLE": "1. Створіть кімнату",
+  "ONBOARDING_2_TEXT": "Почніть тут. Створіть кімнату та поділіться посиланням запрошення з друзями.",
+  "ONBOARDING_3_TITLE": "2. Виберіть Відео",
+  "ONBOARDING_3_TEXT": "Перейдіть сюди, щоб вибрати відео, яке потрібно синхронізувати. Відтворення, пауза та пошук — усі залишаються синхронізованими.",
+  "ONBOARDING_4_TITLE": "3. Персоналізація",
+  "ONBOARDING_4_TEXT": "Виберіть цікаве ім’я користувача, щоб ваші друзі знали, хто ви.",
+  "ONBOARDING_5_TITLE": "Усе готово!",
+  "ONBOARDING_5_TEXT": "Час взяти попкорн. Приємного перегляду разом!",
+  "ERR_CONN_TIMEOUT": "Час очікування підключення минув. Спробуйте ще раз.",
+  "ERR_INVALID_SERVER_URL": "Недійсний формат URL-адреси сервера.",
+  "ERR_IDENTITY_NOT_LOADED": "Посвідчення особи ще не завантажено. Зачекайте хвилинку та повторіть спробу.",
+  "ERR_NO_PEERS_TIME": "Немає інших аналогів із відомим часом. Переключіться на «Перейти до мене».",
+  "ERR_NO_VIDEO_TAB": "Не вдалося підключитися до вкладки відео.",
+  "ERR_SELECT_VIDEO": "Спочатку виберіть відео!",
+  "TOAST_INVITE_COPIED": "Посилання на запрошення скопійовано!",
+  "TOAST_COPY_FAILED": "Не вдалося скопіювати в буфер обміну",
+  "TOAST_LOBBY_SKIPPED": "Лобі епізоду пропущено.",
+  "TOAST_LOBBY_SKIP_FAILED": "Не вдалося пропустити лобі.",
+  "TOAST_LOGS_COPIED": "Скопійовано!",
+  "TOAST_PEER_JOINED": "{name} приєднався до кімнати",
+  "TOAST_PEER_LEFT": "{name} вийшов з кімнати",
+  "TOAST_PEER_ACTION": "{name} {action}",
+  "STATUS_CONNECTED": "Підключено",
+  "STATUS_RECONNECTING": "Повторне підключення...",
+  "STATUS_CONNECTING": "Підключення...",
+  "STATUS_FAILED": "Не вдалося",
+  "STATUS_DISCONNECTED": "Відключено",
+  "STATUS_IDLE": "Готовий до підключення",
+  "STATUS_IDLE_TOOLTIP": "KoalaSync готовий. Приєднайтеся до кімнати або створіть її, щоб підключитися та почати синхронізацію.",
+  "BTN_STATE_JOINING": "🚀 Приєднуюсь...",
+  "BTN_STATE_RECONNECTING": "🔄 Повторне підключення...",
+  "BTN_STATE_PLAYING": "▶ Грає...",
+  "BTN_STATE_PAUSING": "⏸ Призупинення...",
+  "BTN_STATE_SYNCING_GROUP": "Синхронізація з групою ({time})...",
+  "BTN_STATE_SYNCING": "Синхронізація...",
+  "BTN_STATE_SYNCED": "✅ Синхронізовано!",
+  "NOTIF_PLAY": "почав відтворення",
+  "NOTIF_PAUSE": "призупинено відтворення",
+  "NOTIF_SEEK": "перемотав відео",
+  "NOTIF_FORCE_PREPARE": "почав примусову синхронізацію",
+  "NOTIF_FORCE_EXECUTE": "синхронізував усіх",
+  "DEBUG_NO_TAB": "Цільова вкладка не вибрана.",
+  "DEBUG_COMM_FAIL": "Не вдалося зв’язатися з відео вкладки.",
+  "EMPTY_PEERS_TITLE": "Учасників ще немає",
+  "EMPTY_PEERS_HINT": "Поділіться своїм запрошенням, щоб почати",
+  "EMPTY_HISTORY_TITLE": "Активності ще немає",
+  "EMPTY_HISTORY_HINT": "Відтворення, призупинення або перемотування, щоб побачити історію",
+  "EMPTY_LOGS_TITLE": "Без журналів",
+  "EMPTY_LOGS_HINT": "Тут відображатимуться події підключення",
+  "EMPTY_ROOMS_TITLE": "Немає активних кімнат",
+  "EMPTY_ROOMS_HINT": "Створіть кімнату або оновіть, щоб знайти загальнодоступні",
+  "LABEL_YOU": "Ви",
+  "ONBOARDING_DONE": "Готово!",
+  "LABEL_LOBBY_PEER_READY": "Готовий",
+  "LABEL_LOBBY_PEER_LOADING": "Завантаження...",
+  "LABEL_PASSWORD_PROTECTED": "Захищено паролем",
+  "LABEL_PEERS_COUNT": "{count} учасників",
+  "LABEL_CUSTOM_SERVER": "Спеціальний сервер",
+  "BTN_STATE_CREATING": "🚀 Створення кімнати...",
+  "NOTIF_LOBBY_CANCEL_TITLE": "KoalaSync — Помилка синхронізації епізоду",
+  "NOTIF_LOBBY_CANCEL_MSG": "Автоматичну синхронізацію скасовано: {reason}. Можливо, вам знадобиться виконати синхронізацію вручну.",
+  "LOBBY_CANCEL_TIMEOUT": "Час очікування",
+  "LOBBY_CANCEL_TIMEOUT_RECOVERED": "Тайм-аут (відновлено)",
+  "LOBBY_CANCEL_PEERS_LEFT": "Усі інші учасники вийшли",
+  "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "Тайм-аут — не всі вузли завантажили епізод",
+  "LOBBY_CANCEL_USER": "Скасовано користувачем",
+  "NOTIF_ERROR_TITLE": "Помилка KoalaSync",
+  "FOOTER_SUPPORT": "Support KoalaSync",
+  "FOOTER_REVIEW": "★ Оцініть нас",
+  "FOOTER_SUPPORT_PROMPT": "Подобається KoalaSync? Залиште відгук!",
+  "LABEL_AUDIO_PROCESSING": "Обробка аудіо",
+  "LABEL_AUDIO_PROCESSING_TOOLTIP": "Застосуйте звукові ефекти, такі як стиснення, до відтворення відео",
+  "AUDIO_OPEN_SETTINGS": "Відкрити",
+  "NEW_FEATURE_AUDIO": "Новинка: обробка звуку — спробуйте компресор!",
+  "AUDIO_BACK": "← Назад",
+  "AUDIO_PAGE_TITLE": "Параметри звуку",
+  "AUDIO_MASTER_TOGGLE": "Обробка аудіо",
+  "AUDIO_COMPRESSOR": "Компресор",
+  "AUDIO_COMPRESSOR_ENABLE": "Увімкнено",
+  "AUDIO_PRESET": "Попереднє налаштування",
+  "AUDIO_PRESET_RECOMMENDED": "Рекомендовано",
+  "AUDIO_PRESET_DYNAMIC_RANGE": "Динамічний діапазон",
+  "AUDIO_PRESET_VOCAL_ENHANCEMENT": "Покращення голосу",
+  "AUDIO_PRESET_SMOOTH": "Плавний",
+  "AUDIO_PRESET_CUSTOM": "Власний",
+  "AUDIO_PARAM_THRESHOLD": "Поріг",
+  "AUDIO_PARAM_KNEE": "Коліно",
+  "AUDIO_PARAM_RATIO": "Співвідношення",
+  "AUDIO_PARAM_ATTACK": "Атака",
+  "AUDIO_PARAM_RELEASE": "Спад",
+  "AUDIO_EQUALIZER": "Еквалайзер",
+  "AUDIO_COMING_SOON": "Скоро буде",
+  "BTN_RESTART_TOUR": "Перезапустіть підручник",
+  "BTN_RESTART_TOUR_TOOLTIP": "Перезапустіть навчальний посібник із адаптації",
+  "HINT_SELECT_VIDEO": "Виберіть своє відео тут!",
+  "OPTION_TITLE_PRIVACY_FULL": "Надсилати повну назву",
+  "OPTION_TITLE_PRIVACY_EPISODE": "Надсилати ID епізоду",
+  "OPTION_TITLE_PRIVACY_HIDDEN": "Не надсилати",
+  "LABEL_PRIVACY_SETTINGS": "Налаштування приватності",
+  "LABEL_PRIVACY_SETTINGS_TOOLTIP": "Виберіть, які назви вкладки й медіа надсилати до кімнати.",
+  "LABEL_SEND_TAB_TITLE": "Надсилати назву вкладки",
+  "LABEL_SEND_TAB_TITLE_TOOLTIP": "Надсилає до кімнати назву вибраної вкладки браузера.",
+  "LABEL_MEDIA_TITLE_PRIVACY": "Назва медіа",
+  "LABEL_MEDIA_TITLE_PRIVACY_TOOLTIP": "Виберіть, як назви медіа надсилати до кімнати."
+}
@@ -0,0 +1,242 @@
+{
+  "LANG_CODE": "zh",
+  "HTML_CLASS": "lang-zh",
+  "APP_TITLE": "KoalaSync",
+  "TAB_ROOM": "房间",
+  "TAB_ROOM_TOOLTIP": "房间设置和连接",
+  "TAB_SYNC": "同步",
+  "TAB_SYNC_TOOLTIP": "视频同步控制和远程操作",
+  "TAB_SETTINGS": "设置",
+  "TAB_SETTINGS_TOOLTIP": "扩展首选项",
+  "TAB_STATUS": "状态",
+  "TAB_STATUS_TOOLTIP": "高级诊断和日志",
+  "BTN_CREATE_ROOM": "+ 创建新房间",
+  "MANUAL_CONNECT_HEADER": "手动连接/高级",
+  "LABEL_SERVER": "服务器",
+  "BTN_SERVER_OFFICIAL": "官方的",
+  "BTN_SERVER_OFFICIAL_TOOLTIP": "使用官方可靠服务器",
+  "BTN_SERVER_CUSTOM": "自定义",
+  "BTN_SERVER_CUSTOM_TOOLTIP": "连接到您自己的自托管服务器",
+  "PLACEHOLDER_SERVER_URL": "wss://your-server:3000",
+  "LABEL_ROOM_ID": "房间 ID",
+  "LABEL_ROOM_ID_TOOLTIP": "您的同步室的唯一标识符",
+  "PLACEHOLDER_ROOM_ID": "输入Room ID",
+  "PLACEHOLDER_ROOM_ID_TOOLTIP": "您要加入的房间的唯一ID",
+  "LABEL_PASSWORD": "密码（可选）",
+  "LABEL_PASSWORD_TOOLTIP": "可选密码以限制房间访问",
+  "PLACEHOLDER_PASSWORD": "房间密码（可选）",
+  "PLACEHOLDER_PASSWORD_TOOLTIP": "房间密码（无则留空）",
+  "BTN_JOIN_ROOM": "加入/创建房间",
+  "BTN_JOIN_ROOM_TOOLTIP": "连接到房间",
+  "LABEL_PUBLIC_ROOMS": "公共房间",
+  "LABEL_PUBLIC_ROOMS_TOOLTIP": "该服务器上公开可用的房间列表",
+  "BTN_REFRESH": "刷新",
+  "BTN_REFRESH_TOOLTIP": "刷新公共房间列表",
+  "PUBLIC_ROOMS_REFRESHING": "刷新中...",
+  "BTN_REFRESH_COOLDOWN": "等等{seconds}",
+  "BTN_REFRESH_COOLDOWN_TOOLTIP": "房间列表刷新正在冷却。在 {seconds} 中重试。",
+  "PUBLIC_ROOMS_REFRESHING_COOLDOWN": "公共房间列表刷新冷却中。下次刷新将在 {seconds} 后可用。",
+  "LABEL_ACTIVE_ROOM": "活动室",
+  "LABEL_ACTIVE_ROOM_TOOLTIP": "您当前连接的房间",
+  "ACTIVE_ROOM_NONE": "没有任何",
+  "ACTIVE_SERVER_OFFICIAL": "官方服务器",
+  "LABEL_INVITE_LINK": "邀请链接",
+  "LABEL_INVITE_LINK_TOOLTIP": "与朋友分享此链接，以便他们可以加入",
+  "LABEL_PEERS_IN_ROOM": "房间里的同伴",
+  "LABEL_PEERS_IN_ROOM_TOOLTIP": "当前连接到该房间的其他用户",
+  "LABEL_HOST_CONTROL": "主持人控制",
+  "LABEL_HOST_CONTROL_TOOLTIP": "限制谁可以在此房间中控制播放",
+  "LABEL_HOST_ONLY_TOGGLE": "仅我可以控制播放",
+  "NOTICE_HOST_CONTROLS": "由主持人为所有人控制播放。",
+  "NOTICE_COHOST_HINT": "提示：在下方的参与者列表中将控制权授予单个参与者。",
+  "BADGE_HOST": "主持人",
+  "BADGE_GUEST": "访客",
+  "BADGE_CONTROLLER": "控制者",
+  "BTN_GIVE_CONTROL": "授予控制权",
+  "BTN_REVOKE_CONTROL": "撤销",
+  "BADGE_DESYNCED": "单独",
+  "TOOLTIP_PEER_DESYNCED": "单独观看中 — 忽略主持人的命令",
+  "HCM_DIALOG_TITLE": "KoalaSync · 主持人控制本房间",
+  "HCM_DIALOG_BODY": "本房间只有主持人可以控制播放。继续一起观看，还是自己单独观看？",
+  "HCM_DIALOG_STAY": "保持同步",
+  "HCM_DIALOG_SOLO": "自己单独观看",
+  "HCM_BADGE_SOLO": "正在单独观看",
+  "HCM_BADGE_RESYNC": "重新同步",
+  "NO_PEERS_CONNECTED": "没有对等点连接",
+  "BTN_LEAVE_ROOM": "离开房间",
+  "LABEL_SELECT_VIDEO": "选择视频",
+  "LABEL_SELECT_VIDEO_TOOLTIP": "选择包含要同步的视频的浏览器选项卡",
+  "OPTION_SELECT_TAB": "-- 选择一个选项卡 --",
+  "LABEL_REMOTE_CONTROL": "遥控",
+  "BTN_COPY_INVITE": "📋 邀请链接",
+  "BTN_COPY_INVITE_TOOLTIP": "复制邀请链接",
+  "BTN_PLAY": "▶ 播放",
+  "BTN_PLAY_TOOLTIP": "向所有人发送播放命令",
+  "BTN_PAUSE": "⏸ 暂停",
+  "BTN_PAUSE_TOOLTIP": "向所有人发送暂停命令",
+  "BTN_SYNC": "⚡ 同步",
+  "BTN_SYNC_TOOLTIP": "强制所有用户同步",
+  "OPTION_JUMP_TO_OTHERS": "跳转到其他",
+  "OPTION_JUMP_TO_ME": "跳到我这里",
+  "OPTION_JUMP_MODE_TOOLTIP": "选择同步目标",
+  "LABEL_LAST_ACTIVITY": "上次活动状态",
+  "LABEL_LAST_ACTIVITY_TOOLTIP": "显示最近的播放、暂停或跳转命令",
+  "NO_RECENT_COMMANDS": "没有最近的命令",
+  "LOBBY_HEADER": "剧集大厅",
+  "LOBBY_WAITING_FOR": "🎬 等待：“{title}”",
+  "LOBBY_WAITING_PEERS": "等待同行...",
+  "BTN_SKIP_PLAY": "仍然跳过并播放",
+  "BTN_SKIP_PLAY_TOOLTIP": "取消大厅并继续播放",
+  "LOBBY_CONNECT_FIRST": "首先连接到房间",
+  "LOBBY_CONNECT_FIRST_DESC": "您需要通过邀请链接加入房间或创建一个新房间来同步视频。",
+  "BTN_CREATE_ROOM_ALT": "创建新房间",
+  "BTN_CREATE_ROOM_ALT_TOOLTIP": "创建一个新的随机房间并加入它",
+  "LABEL_USERNAME": "您的用户名",
+  "LABEL_USERNAME_TOOLTIP": "用户名可以帮助其他人识别您。",
+  "PLACEHOLDER_USERNAME": "无名考拉",
+  "LABEL_HIDE_CLUTTER": "隐藏杂乱标签",
+  "LABEL_HIDE_CLUTTER_TOOLTIP": "过滤掉非视频选项卡和不相关的域以保持列表干净",
+  "LABEL_AUTO_SYNC_NEXT": "自动同步下一集",
+  "LABEL_AUTO_SYNC_NEXT_TOOLTIP": "当情节发生变化时，自动暂停并等待所有对等点，然后一起开始同步。",
+  "LABEL_AUTO_COPY_INVITE": "自动复制邀请链接",
+  "LABEL_AUTO_COPY_INVITE_TOOLTIP": "创建新房间时，自动将邀请链接复制到剪贴板。",
+  "LABEL_NOTIFICATIONS": "浏览器通知",
+  "LABEL_NOTIFICATIONS_TOOLTIP": "当有人加入/离开或播放/暂停时显示本机系统通知。",
+  "LABEL_LANGUAGE": "应用程序语言",
+  "LABEL_LANGUAGE_TOOLTIP": "选择您喜欢的扩展语言",
+  "LABEL_TROUBLESHOOTING": "故障排除",
+  "LABEL_TROUBLESHOOTING_TOOLTIP": "用于修复连接问题的工具",
+  "BTN_REGEN_ID": "再生Peer ID",
+  "BTN_REGEN_ID_TOOLTIP": "重新生成您的内部 ID 并重新连接",
+  "REGEN_ID_DESC": "如果您看到“重复身份”错误，请使用此选项。",
+  "REGEN_ID_OTHER_ISSUE": "其他问题？打开 GitHub 问题",
+  "TOAST_ID_REGENERATED": "身份已重新生成 — 正在重新连接…",
+  "LABEL_CONN_STATUS": "连接状态",
+  "LABEL_CONN_STATUS_TOOLTIP": "当前WebSocket连接状态",
+  "CONN_STATUS_DISCONNECTED": "已断开连接",
+  "BTN_RETRY": "重试",
+  "BTN_RETRY_TOOLTIP": "尝试重新连接服务器",
+  "BTN_COPY_LOGS": "复制日志",
+  "BTN_COPY_LOGS_TOOLTIP": "将日志复制到剪贴板以便共享",
+  "LABEL_VIDEO_DEBUG": "视频调试信息",
+  "LABEL_VIDEO_DEBUG_TOOLTIP": "有关当前所选视频元素的技术详细信息",
+  "VIDEO_DEBUG_EMPTY": "未选择任何选项卡或检测到视频。",
+  "LABEL_HISTORY": "完整的行动历史",
+  "LABEL_HISTORY_TOOLTIP": "房间内所有同步命令的时间日志",
+  "HISTORY_EMPTY": "还没有活动",
+  "LABEL_LOGS": "日志（最后 50 条）",
+  "LABEL_LOGS_TOOLTIP": "用于调试的技术连接日志",
+  "BTN_CLEAR": "清除",
+  "BTN_CLEAR_TOOLTIP": "清除日志输出",
+  "LABEL_GITHUB": "GitHub 存储库",
+  "BTN_ONBOARDING_SKIP": "跳过",
+  "BTN_ONBOARDING_SKIP_TOOLTIP": "跳过教程",
+  "BTN_ONBOARDING_NEXT": "下一个",
+  "BTN_ONBOARDING_NEXT_TOOLTIP": "进入下一步",
+  "ONBOARDING_1_TITLE": "欢迎来到KoalaSync！",
+  "ONBOARDING_1_TEXT": "无论您身在何处，都能完美同步地一起观看视频。让我们快速浏览一下吧！",
+  "ONBOARDING_2_TITLE": "1. 创建房间",
+  "ONBOARDING_2_TEXT": "从这里开始。创建一个房间并与您的朋友分享邀请链接。",
+  "ONBOARDING_3_TITLE": "2. 选择视频",
+  "ONBOARDING_3_TEXT": "导航此处选择您要同步的视频。播放、暂停和搜索——每个人都保持同步。",
+  "ONBOARDING_4_TITLE": "3. 个性化",
+  "ONBOARDING_4_TEXT": "选择一个有趣的用户名，以便您的朋友知道您是谁。",
+  "ONBOARDING_5_TITLE": "你都准备好了！",
+  "ONBOARDING_5_TEXT": "是时候去买点爆米花了。一起观赏吧！",
+  "ERR_CONN_TIMEOUT": "连接超时。请再试一次。",
+  "ERR_INVALID_SERVER_URL": "服务器 URL 格式无效。",
+  "ERR_IDENTITY_NOT_LOADED": "身份尚未加载。稍等片刻，然后重试。",
+  "ERR_NO_PEERS_TIME": "没有其他已知时间的同行。切换到“跳到我这里”。",
+  "ERR_NO_VIDEO_TAB": "无法连接到视频选项卡。",
+  "ERR_SELECT_VIDEO": "请先选择视频！",
+  "TOAST_INVITE_COPIED": "邀请链接已复制！",
+  "TOAST_COPY_FAILED": "无法复制到剪贴板",
+  "TOAST_LOBBY_SKIPPED": "剧集大厅已跳过。",
+  "TOAST_LOBBY_SKIP_FAILED": "无法跳过大厅。",
+  "TOAST_LOGS_COPIED": "复制了！",
+  "TOAST_PEER_JOINED": "{name} 加入房间",
+  "TOAST_PEER_LEFT": "{name} 离开房间",
+  "TOAST_PEER_ACTION": "{name} {action}",
+  "STATUS_CONNECTED": "已连接",
+  "STATUS_RECONNECTING": "正在重新连接...",
+  "STATUS_CONNECTING": "正在连接...",
+  "STATUS_FAILED": "失败的",
+  "STATUS_DISCONNECTED": "已断开连接",
+  "STATUS_IDLE": "已准备好连接",
+  "STATUS_IDLE_TOOLTIP": "KoalaSync 已准备就绪。加入或创建房间以连接并开始同步。",
+  "BTN_STATE_JOINING": "🚀 正在加入...",
+  "BTN_STATE_RECONNECTING": "🔄 正在重新连接...",
+  "BTN_STATE_PLAYING": "▶ 播放中...",
+  "BTN_STATE_PAUSING": "⏸ 暂停...",
+  "BTN_STATE_SYNCING_GROUP": "正在同步到群组 ({time})...",
+  "BTN_STATE_SYNCING": "正在同步...",
+  "BTN_STATE_SYNCED": "✅ 已同步！",
+  "NOTIF_PLAY": "开始播放",
+  "NOTIF_PAUSE": "暂停播放",
+  "NOTIF_SEEK": "跳转视频",
+  "NOTIF_FORCE_PREPARE": "开始强制同步",
+  "NOTIF_FORCE_EXECUTE": "同步所有人",
+  "DEBUG_NO_TAB": "未选择目标选项卡。",
+  "DEBUG_COMM_FAIL": "无法与标签视频通信。",
+  "EMPTY_PEERS_TITLE": "还没有同行",
+  "EMPTY_PEERS_HINT": "分享您的邀请链接以开始使用",
+  "EMPTY_HISTORY_TITLE": "还没有活动",
+  "EMPTY_HISTORY_HINT": "播放、暂停或跳转以查看历史",
+  "EMPTY_LOGS_TITLE": "无日志",
+  "EMPTY_LOGS_HINT": "连接事件将出现在这里",
+  "EMPTY_ROOMS_TITLE": "没有活动房间",
+  "EMPTY_ROOMS_HINT": "创建房间或刷新以查找公共房间",
+  "LABEL_YOU": "你",
+  "ONBOARDING_DONE": "完毕！",
+  "LABEL_LOBBY_PEER_READY": "准备好",
+  "LABEL_LOBBY_PEER_LOADING": "加载中...",
+  "LABEL_PASSWORD_PROTECTED": "密码保护",
+  "LABEL_PEERS_COUNT": "{count} 同行",
+  "LABEL_CUSTOM_SERVER": "定制服务器",
+  "BTN_STATE_CREATING": "🚀 正在创建房间...",
+  "NOTIF_LOBBY_CANCEL_TITLE": "KoalaSync — 剧集同步失败",
+  "NOTIF_LOBBY_CANCEL_MSG": "自动同步取消：{reason}。您可能需要手动同步。",
+  "LOBBY_CANCEL_TIMEOUT": "暂停",
+  "LOBBY_CANCEL_TIMEOUT_RECOVERED": "超时（已恢复）",
+  "LOBBY_CANCEL_PEERS_LEFT": "所有其他同伴都离开了",
+  "LOBBY_CANCEL_TIMEOUT_PEERS_LOAD": "超时——并非所有同行都加载了该剧集",
+  "LOBBY_CANCEL_USER": "已被用户取消",
+  "NOTIF_ERROR_TITLE": "KoalaSync 错误",
+  "FOOTER_SUPPORT": "Support KoalaSync",
+  "FOOTER_REVIEW": "★ 评价我们",
+  "FOOTER_SUPPORT_PROMPT": "喜欢 KoalaSync 吗？留下评论！",
+  "LABEL_AUDIO_PROCESSING": "音频处理",
+  "LABEL_AUDIO_PROCESSING_TOOLTIP": "将压缩等音频效果应用于视频播放",
+  "AUDIO_OPEN_SETTINGS": "打开",
+  "NEW_FEATURE_AUDIO": "新功能：音频处理 - 尝试压缩器！",
+  "AUDIO_BACK": "← 返回",
+  "AUDIO_PAGE_TITLE": "音频设置",
+  "AUDIO_MASTER_TOGGLE": "音频处理",
+  "AUDIO_COMPRESSOR": "压缩器",
+  "AUDIO_COMPRESSOR_ENABLE": "启用",
+  "AUDIO_PRESET": "预设",
+  "AUDIO_PRESET_RECOMMENDED": "推荐",
+  "AUDIO_PRESET_DYNAMIC_RANGE": "动态范围",
+  "AUDIO_PRESET_VOCAL_ENHANCEMENT": "声音增强",
+  "AUDIO_PRESET_SMOOTH": "平滑",
+  "AUDIO_PRESET_CUSTOM": "自定义",
+  "AUDIO_PARAM_THRESHOLD": "阈值",
+  "AUDIO_PARAM_KNEE": "拐点",
+  "AUDIO_PARAM_RATIO": "比率",
+  "AUDIO_PARAM_ATTACK": "起音",
+  "AUDIO_PARAM_RELEASE": "释放",
+  "AUDIO_EQUALIZER": "均衡器",
+  "AUDIO_COMING_SOON": "即将推出",
+  "BTN_RESTART_TOUR": "重启教程",
+  "BTN_RESTART_TOUR_TOOLTIP": "重新启动入门教程",
+  "HINT_SELECT_VIDEO": "在这里选择您的视频！",
+  "OPTION_TITLE_PRIVACY_FULL": "发送完整标题",
+  "OPTION_TITLE_PRIVACY_EPISODE": "发送剧集 ID",
+  "OPTION_TITLE_PRIVACY_HIDDEN": "不发送",
+  "LABEL_PRIVACY_SETTINGS": "隐私设置",
+  "LABEL_PRIVACY_SETTINGS_TOOLTIP": "选择要发送到房间的标签页标题和媒体标题。",
+  "LABEL_SEND_TAB_TITLE": "发送标签页标题",
+  "LABEL_SEND_TAB_TITLE_TOOLTIP": "将所选浏览器标签页的标题发送到房间。",
+  "LABEL_MEDIA_TITLE_PRIVACY": "媒体标题",
+  "LABEL_MEDIA_TITLE_PRIVACY_TOOLTIP": "选择媒体标题发送到房间的方式。"
+}
@@ -1,7 +1,8 @@
 {
  "manifest_version": 3,
+  "default_locale": "en",
  "name": "KoalaSync",
-  "version": "2.2.0",
+  "version": "2.5.0",
  "description": "Synchronize video playback on YouTube, Netflix, Emby, Jellyfin, and any HTML5 site in real-time with friends.",
  "permissions": [
    "storage",
@@ -0,0 +1,94 @@
+export function initTabManager({
+    getCurrentTabId,
+    setCurrentTabId,
+    setCurrentTabTitle,
+    setLastContentHeartbeatAt,
+    setRoomIdleSince,
+    getCurrentRoom,
+    getPeerId,
+    getStorageInitialized,
+    updateBadgeStatus,
+    addLog,
+    getSettings,
+    emit,
+    applyAudioSettingsToTab,
+    ensureState,
+    EVENTS
+}) {
+    chrome.storage.onChanged.addListener(async (changes, area) => {
+        if (area !== 'local' || !changes.audioSettings) return;
+        await ensureState();
+        const tabId = getCurrentTabId();
+        if (!tabId) return;
+
+        chrome.tabs.sendMessage(tabId, {
+            action: 'APPLY_AUDIO_SETTINGS',
+            settings: changes.audioSettings.newValue
+        }).catch(() => {});
+    });
+
+    chrome.tabs.onRemoved.addListener(async (tabId) => {
+        await ensureState();
+        if (tabId === getCurrentTabId()) {
+            const wasInRoom = !!getCurrentRoom();
+            setCurrentTabId(null);
+            setCurrentTabTitle(null);
+            setLastContentHeartbeatAt(null);
+            const now = Date.now();
+            setRoomIdleSince(now);
+            chrome.storage.session.set({
+                currentTabId: null,
+                currentTabTitle: null,
+                roomIdleSince: now,
+                lastContentHeartbeatAt: null
+            });
+            updateBadgeStatus();
+            addLog('Target tab closed.', 'warn');
+
+            if (wasInRoom) {
+                const roomAtClose = getCurrentRoom();
+                getSettings().then(settings => {
+                    if (getCurrentRoom() !== roomAtClose) return;
+
+                    emit(EVENTS.PEER_STATUS, {
+                        peerId: getPeerId(),
+                        playbackState: 'paused',
+                        currentTime: null,
+                        mediaTitle: null,
+                        username: settings.username,
+                        tabTitle: null
+                    });
+
+                    const room = getCurrentRoom();
+                    if (room && Array.isArray(room.peers)) {
+                        const me = room.peers.find(p => (p.peerId || p) === getPeerId());
+                        if (me && typeof me === 'object') {
+                            me.playbackState = 'paused';
+                            me.currentTime = null;
+                            me.mediaTitle = null;
+                            me.tabTitle = null;
+                            me.lastHeartbeat = Date.now();
+                            if (getStorageInitialized()) {
+                                chrome.storage.session.set({ currentRoom: room });
+                            }
+                            chrome.runtime.sendMessage({ type: 'PEER_UPDATE', peers: room.peers }).catch(() => {});
+                        }
+                    }
+                }).catch(() => {});
+            }
+        }
+    });
+
+    chrome.tabs.onUpdated.addListener(async (tabId, changeInfo, _tab) => {
+        await ensureState();
+        const curTabId = getCurrentTabId();
+        if (curTabId && tabId === parseInt(curTabId) && changeInfo.status === 'complete') {
+            chrome.scripting.executeScript({
+                target: { tabId },
+                files: ['content.js']
+            })
+                .then(() => applyAudioSettingsToTab(tabId))
+                .catch(() => {});
+        }
+    });
+}
@@ -364,6 +364,14 @@
            0%, 100% { opacity: 0.4; transform: scale(1); }
            50% { opacity: 1; transform: scale(1.3); }
        }
+        @keyframes spotlightPulse {
+            0%, 100% { box-shadow: 0 0 0 9999px rgba(15, 23, 42, 0.65), 0 0 0 0px var(--accent); }
+            50% { box-shadow: 0 0 0 9999px rgba(15, 23, 42, 0.65), 0 0 0 6px var(--accent); }
+        }
+        @keyframes floatHint {
+            0%, 100% { transform: translateY(0); }
+            50% { transform: translateY(-4px); }
+        }
    </style>
 </head>
 <body>
@@ -394,14 +402,18 @@
            <details style="margin-bottom: 12px; background: var(--card); border: 1px solid #334155; border-radius: 8px; padding: 8px;">
                <summary style="font-size: 11px; font-weight: 700; color: var(--text-muted); text-transform: uppercase; cursor: pointer; outline: none;" data-i18n="MANUAL_CONNECT_HEADER">Manual Connect / Advanced</summary>
                <div style="margin-top: 12px;">
-            <div class="form-group">
-                <label title="Select which KoalaSync server to use" data-i18n="LABEL_SERVER">Server</label>
-                <div style="display:flex; gap:4px; margin-bottom:8px;">
-                    <button id="serverOfficial" class="tab-btn active" style="flex:1; padding:6px; font-size:11px;" data-i18n="BTN_SERVER_OFFICIAL" data-i18n-title="BTN_SERVER_OFFICIAL_TOOLTIP" title="Use the official reliable server">Official</button>
-                    <button id="serverCustom" class="tab-btn" style="flex:1; padding:6px; font-size:11px;" data-i18n="BTN_SERVER_CUSTOM" data-i18n-title="BTN_SERVER_CUSTOM_TOOLTIP" title="Connect to your own self-hosted server">Custom</button>
+            <!-- Server selection — its own concern, kept visually separate from the room fields. -->
+            <div style="background: var(--bg); border: 1px solid #334155; border-radius: 8px; padding: 10px; margin-bottom: 14px;">
+                <div class="form-group" style="margin-bottom:0;">
+                    <label title="Select which KoalaSync server to use" data-i18n="LABEL_SERVER">Server</label>
+                    <div style="display:flex; gap:4px; margin-bottom:0;">
+                        <button id="serverOfficial" class="tab-btn active" style="flex:1; padding:6px; font-size:11px;" data-i18n="BTN_SERVER_OFFICIAL" data-i18n-title="BTN_SERVER_OFFICIAL_TOOLTIP" title="Use the official reliable server">Official</button>
+                        <button id="serverCustom" class="tab-btn" style="flex:1; padding:6px; font-size:11px;" data-i18n="BTN_SERVER_CUSTOM" data-i18n-title="BTN_SERVER_CUSTOM_TOOLTIP" title="Connect to your own self-hosted server">Custom</button>
+                    </div>
+                    <input type="text" id="serverUrl" data-i18n-placeholder="PLACEHOLDER_SERVER_URL" placeholder="wss://your-server:3000" style="display:none; margin-top:8px;">
                </div>
-                <input type="text" id="serverUrl" data-i18n-placeholder="PLACEHOLDER_SERVER_URL" placeholder="wss://your-server:3000" style="display:none;">
            </div>
+            <!-- Room credentials — distinct group below the server picker. -->
            <div class="form-group">
                <label title="The unique identifier for your sync room" data-i18n="LABEL_ROOM_ID" data-i18n-title="LABEL_ROOM_ID_TOOLTIP">Room ID</label>
                <input type="text" id="roomId" data-i18n-placeholder="PLACEHOLDER_ROOM_ID" data-i18n-title="PLACEHOLDER_ROOM_ID_TOOLTIP" placeholder="Enter Room ID" title="The unique ID of the room you want to join">
@@ -442,6 +454,22 @@
                </div>
            </div>

+            <div id="hostControlCard" class="info-card" style="margin-bottom: 20px; display:none;">
+                <div style="display:flex; justify-content:space-between; align-items:center;">
+                    <label style="margin:0;" title="Restrict who can control playback in this room" data-i18n="LABEL_HOST_CONTROL" data-i18n-title="LABEL_HOST_CONTROL_TOOLTIP">Host Control</label>
+                    <span id="hostRoleBadge" style="font-size:10px; font-weight:700; text-transform:uppercase; padding:2px 8px; border-radius:8px; background:var(--accent); color:#fff;"></span>
+                </div>
+                <div id="hostControlToggleRow" style="display:none; align-items:center; justify-content:space-between; gap:12px; margin-top:12px;">
+                    <span style="font-size:12px; color:var(--text); line-height:1.3;" data-i18n="LABEL_HOST_ONLY_TOGGLE">Only I can control playback</span>
+                    <label class="toggle-switch" style="flex:none;">
+                        <input type="checkbox" id="hostControlToggle">
+                        <span class="slider"></span>
+                    </label>
+                </div>
+                <div id="hostControlCohostHint" style="display:none; margin-top:10px; padding-top:10px; border-top:1px solid #334155; font-size:11px; color:var(--text-muted); line-height:1.4;" data-i18n="NOTICE_COHOST_HINT">Tip: grant control to individual viewers in the participant list below.</div>
+                <div id="hostControlGuestNote" style="display:none; margin-top:10px; font-size:12px; color:var(--text-muted);" data-i18n="NOTICE_HOST_CONTROLS">The host controls playback for everyone.</div>
+            </div>
+
            <div style="margin-bottom: 20px;">
                <label title="Other users currently connected to this room" data-i18n="LABEL_PEERS_IN_ROOM" data-i18n-title="LABEL_PEERS_IN_ROOM_TOOLTIP">Peers in Room</label>
                <div id="peerList" class="info-card">
@@ -457,11 +485,16 @@
    <div id="tab-sync" class="tab-content">
        <!-- SYNC ACTIVE: Visible when in a room -->
        <div id="sync-active">
-        <div class="form-group">
+        <div class="form-group" style="position: relative;">
            <label title="Choose the browser tab containing the video to sync" data-i18n="LABEL_SELECT_VIDEO" data-i18n-title="LABEL_SELECT_VIDEO_TOOLTIP">Select Video</label>
            <select id="targetTab">
                <option value="" data-i18n="OPTION_SELECT_TAB">-- Select a Tab --</option>
            </select>
+            <!-- Hint Tooltip -->
+            <div id="targetTabHint" style="display: none; position: absolute; top: -25px; right: 0; background: var(--accent); color: white; padding: 4px 8px; border-radius: 6px; font-size: 11px; font-weight: bold; pointer-events: none; animation: floatHint 2s ease-in-out infinite; box-shadow: 0 4px 12px rgba(99, 102, 241, 0.4); z-index: 10;" data-i18n="HINT_SELECT_VIDEO">
+                Select your video here!
+                <div style="position: absolute; bottom: -4px; right: 20px; width: 8px; height: 8px; background: var(--accent); transform: rotate(45deg);"></div>
+            </div>
        </div>
        
        <div style="display: flex; justify-content: space-between; align-items: center; margin-bottom: 4px;">
@@ -517,6 +550,25 @@
            <input type="text" id="username" data-i18n-placeholder="PLACEHOLDER_USERNAME" placeholder="Anonymous Koala" maxlength="20" style="width: 150px;">
        </div>

+        <details class="form-group" style="background: var(--card); padding: 10px; border-radius: 8px; margin-bottom: 12px; border: 1px solid #334155;">
+            <summary style="cursor: pointer; font-size: 12px; font-weight: 700; color: var(--text);" title="Choose which titles are sent to the room." data-i18n="LABEL_PRIVACY_SETTINGS" data-i18n-title="LABEL_PRIVACY_SETTINGS_TOOLTIP">Privacy Settings</summary>
+            <div style="display: flex; align-items: center; justify-content: space-between; gap: 12px; margin-top: 10px;">
+                <label style="margin-bottom: 0; cursor: help;" title="Send the selected browser tab title to the room." data-i18n="LABEL_SEND_TAB_TITLE" data-i18n-title="LABEL_SEND_TAB_TITLE_TOOLTIP">Send tab title</label>
+                <label class="toggle-switch">
+                    <input type="checkbox" id="sendTabTitle" checked>
+                    <span class="slider"></span>
+                </label>
+            </div>
+            <div style="display: flex; align-items: center; justify-content: space-between; gap: 12px; margin-top: 10px;">
+                <label style="margin-bottom: 0; cursor: help;" title="Choose how media titles are sent to the room." data-i18n="LABEL_MEDIA_TITLE_PRIVACY" data-i18n-title="LABEL_MEDIA_TITLE_PRIVACY_TOOLTIP">Media title</label>
+                <select id="mediaTitlePrivacyMode" style="width: 165px; background: var(--bg); border: 1px solid #334155; color: white; padding: 6px 10px; border-radius: 8px; font-size: 12px; cursor: pointer; outline: none; font-family: inherit;">
+                    <option value="full" data-i18n="OPTION_TITLE_PRIVACY_FULL">Send full title</option>
+                    <option value="episode" data-i18n="OPTION_TITLE_PRIVACY_EPISODE">Send episode ID</option>
+                    <option value="hidden" data-i18n="OPTION_TITLE_PRIVACY_HIDDEN">Do not send</option>
+                </select>
+            </div>
+        </details>
+
        <div class="form-group" style="display: flex; align-items: center; justify-content: space-between; background: var(--card); padding: 10px; border-radius: 8px; margin-bottom: 12px; border: 1px solid #334155;">
            <label style="margin-bottom: 0; cursor: help;" title="Filters out non-video tabs and unrelated domains to keep the list clean" data-i18n="LABEL_HIDE_CLUTTER" data-i18n-title="LABEL_HIDE_CLUTTER_TOOLTIP">Hide Clutter Tabs</label>
            <label class="toggle-switch">
@@ -571,13 +623,16 @@
                <option value="nl">🇳🇱 Nederlands</option>
                <option value="ja">🇯🇵 日本語</option>
                <option value="ko">🇰🇷 한국어</option>
+                <option value="zh">🇨🇳 中文</option>
+                <option value="uk">🇺🇦 Українська</option>
                <option value="pt">🇵🇹 Português (Portugal)</option>
            </select>
        </div>

        <div style="margin-top: 15px; padding: 8px; border-top: 1px solid var(--card);">
            <label title="Tools for fixing connection issues" data-i18n="LABEL_TROUBLESHOOTING" data-i18n-title="LABEL_TROUBLESHOOTING_TOOLTIP">Troubleshooting</label>
-            <button id="regenId" class="secondary" style="width: 100%; font-size: 11px;" title="Regenerate your internal ID and reconnect" data-i18n="BTN_REGEN_ID" data-i18n-title="BTN_REGEN_ID_TOOLTIP">Regenerate Peer ID</button>
+            <button id="restartTourBtn" class="secondary" style="width: 100%; font-size: 11px;" title="Restart the onboarding tutorial" data-i18n="BTN_RESTART_TOUR" data-i18n-title="BTN_RESTART_TOUR_TOOLTIP">Restart Tutorial</button>
+            <button id="regenId" class="secondary" style="width: 100%; font-size: 11px; margin-top: 8px;" title="Regenerate your internal ID and reconnect" data-i18n="BTN_REGEN_ID" data-i18n-title="BTN_REGEN_ID_TOOLTIP">Regenerate Peer ID</button>
            <p style="font-size: 9px; color: var(--text-muted); margin-top: 5px; text-align: center;" data-i18n="REGEN_ID_DESC">Use this if you see "Duplicate Identity" errors.</p>
            <p style="font-size: 9px; text-align: center; margin-top: 6px;"><a href="https://github.com/Shik3i/KoalaSync/issues" target="_blank" style="color: var(--accent); text-decoration: none;" data-i18n="REGEN_ID_OTHER_ISSUE">Other issue? Open a GitHub Issue</a></p>
        </div>
@@ -586,7 +641,7 @@
            <div style="font-size: 9px; color: var(--text-muted); opacity: 0.6; margin-bottom: 6px; line-height: 1.3;" data-i18n="FOOTER_SUPPORT_PROMPT">Enjoying KoalaSync? Leave a review!</div>
            <a id="settingsReviewLink" href="#" target="_blank" data-i18n="FOOTER_REVIEW">★ Rate us</a>
            <span> · </span>
-            <a id="settingsSupportLink" href="#" target="_blank" data-i18n="FOOTER_SUPPORT">☕ Buy me a coffee</a>
+            <a id="settingsSupportLink" href="#" target="_blank" data-i18n="FOOTER_SUPPORT">Support KoalaSync</a>
            <span> · </span>
            <span id="settingsVersion">v0.0.0</span>
        </div>
@@ -597,9 +652,13 @@
        <label title="Current WebSocket connection state" data-i18n="LABEL_CONN_STATUS" data-i18n-title="LABEL_CONN_STATUS_TOOLTIP">Connection Status</label>
        <div id="connStatus" class="info-card" style="display:flex; align-items:center; gap: 10px;">
            <span id="connDot" class="status-dot status-offline"></span>
-            <span id="connText" style="flex:1;">Disconnected</span>
+            <span style="flex:1; display:flex; align-items:center; gap:6px; min-width:0;">
+                <span id="connText">Disconnected</span>
+                <span id="connInfo" data-i18n-title="STATUS_IDLE_TOOLTIP" title="KoalaSync is ready. Join or create a room to connect and start syncing." style="display:none; cursor:help; flex:none; width:15px; height:15px; line-height:14px; text-align:center; border-radius:50%; border:1px solid var(--text-muted); color:var(--text-muted); font-size:10px; font-weight:700; font-style:normal;">i</span>
+            </span>
+            <span id="connPing" style="font-size:11px; font-family:monospace; font-weight:600; opacity:0.8;"></span>
            <button id="retryBtn" class="secondary" style="display:none; width: auto; padding: 4px 8px; font-size: 10px; margin: 0;" title="Attempt to reconnect to the server" data-i18n="BTN_RETRY" data-i18n-title="BTN_RETRY_TOOLTIP">RETRY</button>
-            <button id="copyLogs" class="btn secondary" style="width: auto; padding: 4px 10px; font-size: 11px;" title="Copy logs to clipboard for sharing" data-i18n="BTN_COPY_LOGS" data-i18n-title="BTN_COPY_LOGS_TOOLTIP">Copy Logs</button>
+            <button id="copyLogs" class="btn secondary" style="width: auto; padding: 4px 10px; font-size: 11px; margin: 0;" title="Copy logs to clipboard for sharing" data-i18n="BTN_COPY_LOGS" data-i18n-title="BTN_COPY_LOGS_TOOLTIP">Copy Logs</button>
        </div>

        <label title="Technical details about the currently selected video element" data-i18n="LABEL_VIDEO_DEBUG" data-i18n-title="LABEL_VIDEO_DEBUG_TOOLTIP">Video Debug Info</label>
@@ -626,7 +685,7 @@
                <div style="font-size: 9px; color: var(--text-muted); opacity: 0.6; margin-bottom: 6px; line-height: 1.3;" data-i18n="FOOTER_SUPPORT_PROMPT">Enjoying KoalaSync? Leave a review!</div>
                <a id="devReviewLink" href="#" target="_blank" data-i18n="FOOTER_REVIEW">★ Rate us</a>
                <span> · </span>
-                <a id="devSupportLink" href="#" target="_blank" data-i18n="FOOTER_SUPPORT">☕ Buy me a coffee</a>
+                <a id="devSupportLink" href="#" target="_blank" data-i18n="FOOTER_SUPPORT">Support KoalaSync</a>
                <span> · </span>
                <span id="appVersion">v0.0.0</span>
            </div>
@@ -636,16 +695,31 @@
    <script src="popup.js" type="module"></script>

    <!-- Onboarding Overlay -->
-    <div id="onboarding-overlay" style="display:none; position:fixed; inset:0; background:rgba(0,0,0,0.5); backdrop-filter: blur(2px); z-index:1000; align-items:flex-end; justify-content:center; padding-bottom: 20px;">
-        <div id="onboarding-card" style="background:var(--card); padding:24px; border-radius:16px; max-width:280px; width:90%; text-align:center; box-shadow:0 8px 32px rgba(0,0,0,0.5); ">
-            <div id="onboarding-icon" style="font-size:48px; margin-bottom:12px;">👋</div>
-            <h2 id="onboarding-title" style="color:var(--accent); margin:0 0 8px; font-size:16px;">Welcome to KoalaSync!</h2>
-            <p id="onboarding-text" style="color:var(--text-muted); font-size:13px; margin:0 0 16px; line-height:1.4;">Let's get you started.</p>
-            <div style="display:flex; gap:8px; justify-content:center;">
-                <button id="onboarding-skip" class="secondary" style="width:auto; padding:8px 16px;" title="Skip the tutorial" data-i18n="BTN_ONBOARDING_SKIP" data-i18n-title="BTN_ONBOARDING_SKIP_TOOLTIP">Skip</button>
-                <button id="onboarding-next" class="primary" style="width:auto; padding:8px 16px;" title="Go to next step" data-i18n="BTN_ONBOARDING_NEXT" data-i18n-title="BTN_ONBOARDING_NEXT_TOOLTIP">Next</button>
+    <div id="onboarding-overlay" style="display:none; position:fixed; inset:0; background:transparent; z-index:1000; pointer-events:auto;">
+        <!-- Spotlight element -->
+        <div id="onboarding-spotlight" style="position:fixed; pointer-events:none; border:2px solid var(--accent); box-shadow:0 0 0 9999px rgba(15, 23, 42, 0.65); border-radius:8px; transition:all 0.3s cubic-bezier(0.4, 0, 0.2, 1); display:none; opacity:0; z-index:1001; animation: spotlightPulse 2s infinite ease-in-out;"></div>
+        
+        <!-- Onboarding Card -->
+        <div id="onboarding-card" style="position:fixed; background:var(--card); padding:16px 20px; border-radius:12px; width:280px; box-shadow:0 8px 32px rgba(0,0,0,0.5); z-index:1002; transition:all 0.3s cubic-bezier(0.4, 0, 0.2, 1); box-sizing:border-box; border:1px solid #334155; opacity:0; transform: scale(0.9); display:none;">
+            <div style="display:flex; justify-content:space-between; align-items:center; margin-bottom:8px;">
+                <span id="onboarding-icon" style="font-size:24px;">👋</span>
+                <span id="onboarding-step-indicator" style="font-size:10px; font-weight:700; color:var(--accent); text-transform:uppercase; letter-spacing:0.5px;">Step 1 of 5</span>
            </div>
-            <div id="onboarding-dots" style="margin-top:12px; display:flex; gap:6px; justify-content:center;"></div>
+            <h2 id="onboarding-title" style="color:var(--accent); margin:0 0 6px; font-size:14px; font-weight:700; text-align:left;">Welcome to KoalaSync!</h2>
+            <p id="onboarding-text" style="color:var(--text-muted); font-size:12px; margin:0 0 16px; line-height:1.4; text-align:left;">Let's get you started.</p>
+            
+            <!-- Progress Bar -->
+            <div id="onboarding-progress-container" style="height:4px; background:#334155; border-radius:2px; margin-bottom:16px; overflow:hidden;">
+                <div id="onboarding-progress-bar" style="height:100%; width:20%; background:var(--accent); transition:width 0.3s ease;"></div>
+            </div>
+            
+            <div style="display:flex; gap:8px; justify-content:space-between; align-items:center;">
+                <button id="onboarding-skip" class="secondary" style="width:auto; padding:6px 12px; margin:0; font-size:11px;" title="Skip the tutorial" data-i18n="BTN_ONBOARDING_SKIP" data-i18n-title="BTN_ONBOARDING_SKIP_TOOLTIP">Skip</button>
+                <button id="onboarding-next" class="primary" style="width:auto; padding:6px 16px; margin:0; font-size:11px;" title="Go to next step" data-i18n="BTN_ONBOARDING_NEXT" data-i18n-title="BTN_ONBOARDING_NEXT_TOOLTIP">Next</button>
+            </div>
+            
+            <!-- Tooltip pointer arrow -->
+            <div id="onboarding-arrow" style="position:absolute; width:0; height:0; border:6px solid transparent; transition:all 0.3s ease;"></div>
        </div>
    </div>
 </body>
@@ -2,6 +2,7 @@ import { EVENTS, OFFICIAL_LANDING_PAGE_URL, SUPPORT_URL, getReviewUrl } from './
 import { BLACKLIST_DOMAINS } from './shared/blacklist.js';
 import { getAvatarForName, generateUsername, USERNAME_ADJECTIVES, USERNAME_NOUNS } from './shared/names.js';
 import { loadLocale, translateDOM, getMessage, getSystemLanguage } from './i18n.js';
+import { TITLE_PRIVACY_MODES, normalizeSendTabTitle } from './title-privacy.js';


 const elements = {
@@ -16,6 +17,8 @@ const elements = {
    clearLogs: document.getElementById('clearLogs'),
    connDot: document.getElementById('connDot'),
    connText: document.getElementById('connText'),
+    connInfo: document.getElementById('connInfo'),
+    connPing: document.getElementById('connPing'),
    serverUrl: document.getElementById('serverUrl'),
    serverOfficial: document.getElementById('serverOfficial'),
    serverCustom: document.getElementById('serverCustom'),
@@ -28,6 +31,7 @@ const elements = {
    inviteLink: document.getElementById('inviteLink'),
    filterNoise: document.getElementById('filterNoise'),
    regenId: document.getElementById('regenId'),
+    restartTourBtn: document.getElementById('restartTourBtn'),
    lastActionCard: document.getElementById('lastActionCard'),
    historyList: document.getElementById('historyList'),
    copyLogs: document.getElementById('copyLogs'),
@@ -38,6 +42,12 @@ const elements = {
    retryBtn: document.getElementById('retryBtn'),
    sectionJoin: document.getElementById('section-join'),
    sectionActive: document.getElementById('section-active'),
+    hostControlCard: document.getElementById('hostControlCard'),
+    hostRoleBadge: document.getElementById('hostRoleBadge'),
+    hostControlToggleRow: document.getElementById('hostControlToggleRow'),
+    hostControlToggle: document.getElementById('hostControlToggle'),
+    hostControlGuestNote: document.getElementById('hostControlGuestNote'),
+    hostControlCohostHint: document.getElementById('hostControlCohostHint'),
    activeRoomId: document.getElementById('activeRoomId'),
    activeServer: document.getElementById('activeServer'),
    peerListSync: document.getElementById('peerListSync'),
@@ -45,6 +55,8 @@ const elements = {
    playBtn: document.getElementById('playBtn'),
    pauseBtn: document.getElementById('pauseBtn'),
    autoSyncNextEpisode: document.getElementById('autoSyncNextEpisode'),
+    sendTabTitle: document.getElementById('sendTabTitle'),
+    mediaTitlePrivacyMode: document.getElementById('mediaTitlePrivacyMode'),
    episodeLobbyCard: document.getElementById('episodeLobbyCard'),
    lobbyTitle: document.getElementById('lobbyTitle'),
    lobbyPeerStatus: document.getElementById('lobbyPeerStatus'),
@@ -67,6 +79,7 @@ let lastPeersJson = null;
 let lastKnownPeers = [];
 let isDevTabVisible = false;
 let reconnectSlowMode = false;
+let isProcessingConnection = false;
 let joinBtnTimeout = null;
 let forceSyncResetTimer = null;
 let popupIntervals = [];
@@ -172,19 +185,9 @@ function setRoomRefreshCooldown() {

 // --- Initialization ---
 async function init() {
-    const localData = await chrome.storage.local.get(['serverUrl', 'useCustomServer', 'roomId', 'password', 'username', 'filterNoise', 'autoSyncNextEpisode', 'forceSyncMode', 'browserNotifications', 'autoCopyInvite', 'locale', 'audioSettings']);
-    // Migrate preferences from sync → local for existing users
-    const oldSync = await chrome.storage.sync.get(['serverUrl', 'useCustomServer', 'roomId', 'password', 'username', 'filterNoise', 'autoSyncNextEpisode', 'forceSyncMode', 'browserNotifications', 'autoCopyInvite', 'locale', 'audioSettings']);
-    const toMigrate = {};
-    for (const key of ['serverUrl', 'useCustomServer', 'roomId', 'password', 'username', 'filterNoise', 'autoSyncNextEpisode', 'forceSyncMode', 'browserNotifications', 'autoCopyInvite', 'locale', 'audioSettings']) {
-        if (localData[key] === undefined && oldSync[key] !== undefined) {
-            toMigrate[key] = oldSync[key];
-            localData[key] = oldSync[key];
-        }
-    }
-    if (Object.keys(toMigrate).length) {
-        await chrome.storage.local.set(toMigrate);
-    }
+    // Local-only by design — settings and room credentials never come from
+    // storage.sync (only onboardingComplete + dismissedHints live there).
+    const localData = await chrome.storage.local.get(['serverUrl', 'useCustomServer', 'roomId', 'password', 'username', 'filterNoise', 'autoSyncNextEpisode', 'sendTabTitle', 'mediaTitlePrivacyMode', 'titlePrivacyMode', 'forceSyncMode', 'browserNotifications', 'autoCopyInvite', 'locale', 'audioSettings', 'activeTab']);

    let activeLang = localData.locale;
    if (!activeLang) {
@@ -209,6 +212,10 @@ async function init() {
    elements.username.value = username;
    if (elements.filterNoise) elements.filterNoise.checked = localData.filterNoise !== false;
    if (elements.autoSyncNextEpisode) elements.autoSyncNextEpisode.checked = localData.autoSyncNextEpisode !== false;
+    const legacyTitlePrivacyMode = Object.values(TITLE_PRIVACY_MODES).includes(localData.titlePrivacyMode) ? localData.titlePrivacyMode : TITLE_PRIVACY_MODES.FULL;
+    const mediaTitlePrivacyMode = Object.values(TITLE_PRIVACY_MODES).includes(localData.mediaTitlePrivacyMode) ? localData.mediaTitlePrivacyMode : legacyTitlePrivacyMode;
+    if (elements.sendTabTitle) elements.sendTabTitle.checked = normalizeSendTabTitle(localData.sendTabTitle, legacyTitlePrivacyMode);
+    if (elements.mediaTitlePrivacyMode) elements.mediaTitlePrivacyMode.value = mediaTitlePrivacyMode;
    if (elements.forceSyncMode) elements.forceSyncMode.value = localData.forceSyncMode || 'jump-to-others';
    if (elements.browserNotifications) elements.browserNotifications.checked = localData.browserNotifications === true;
    if (elements.autoCopyInvite) elements.autoCopyInvite.checked = localData.autoCopyInvite !== false;
@@ -234,8 +241,7 @@ async function init() {
    refreshLogs();
    refreshHistory();

-    // Default connection status (localized) before async check
-    applyConnectionStatus('disconnected');
+    // Initial Status Check (status shows via GET_STATUS below)

    // Initial Status Check
    chrome.runtime.sendMessage({ type: 'GET_STATUS' }, async (res) => {
@@ -248,17 +254,39 @@ async function init() {
            localPeerId = res.peerId;
            reconnectSlowMode = res.reconnectSlowMode || false;
            applyConnectionStatus(res.status);
+            updatePingDisplay(res.ping);
            updatePeerList(res.peers);
            lastKnownPeers = res.peers || [];
+            updateHostControlUI({ controlMode: res.controlMode, amHost: res.amHost, amController: res.amController, controllers: res.controllers, hostPeerId: res.hostPeerId, hostControlSupported: res.hostControlSupported, coHostSupported: res.coHostSupported, inRoom: res.status === 'connected' });
            if (res.lastActionState) updateLastActionUI(res.lastActionState, res.peers);
+
+            // If user has a room configured but background is not connected (disconnected or idle),
+            // trigger connection now — the popup opening is explicit user intent.
+            if ((res.status === 'disconnected' || res.status === 'idle') && localData.roomId) {
+                chrome.runtime.sendMessage({ type: 'CONNECT' }).catch(() => {});
+                applyConnectionStatus('connecting');
+            }
            
            // Populate Tabs using the background's targetTabId
            await populateTabs(res.peers, res.targetTabId);

            // Render lobby status if active
            if (res.episodeLobby) updateLobbyUI(res.episodeLobby, res.peers);
+
+            if (res.status === 'connected' && !res.targetTabId && localData.roomId) {
+                const syncTabBtn = document.querySelector('.tab-btn[data-tab="tab-sync"]');
+                if (syncTabBtn) syncTabBtn.click();
+                showSelectVideoHint();
+            } else if (localData.activeTab) {
+                const btn = document.querySelector(`.tab-btn[data-tab="${localData.activeTab}"]`);
+                if (btn) btn.click();
+            }
        } else {
            await populateTabs();
+            if (localData.activeTab) {
+                const btn = document.querySelector(`.tab-btn[data-tab="${localData.activeTab}"]`);
+                if (btn) btn.click();
+            }
        }
    });

@@ -289,6 +317,98 @@ function toggleUIState(inRoom) {
    if (syncInactive) syncInactive.style.display = inRoom ? 'none' : 'block';
 }

+// --- Host Control Mode UI ---
+// True when we're a guest in a host-only room → remote-control buttons are locked.
+let hcmGuestLocked = false;
+
+// Co-Host state mirrored for the peer-list renderer (promote/demote + role badges).
+let hcmAmOwner = false;
+let hcmControllers = [];
+let hcmCoHostSupported = false;
+let hcmOwnerPeerId = null;
+let hcmRoomIsHostOnly = false;
+
+function updateHostControlUI(state) {
+    const s = state || {};
+    const controlMode = s.controlMode;
+    const amHost = !!s.amHost;
+    const amController = !!s.amController;
+    const hostOnly = controlMode === 'host-only';
+
+    // Stash for the peer-list renderer, then force it to re-render with new roles.
+    hcmAmOwner = amHost;
+    hcmControllers = Array.isArray(s.controllers) ? s.controllers : [];
+    hcmCoHostSupported = !!s.coHostSupported;
+    hcmOwnerPeerId = s.hostPeerId || null;
+    hcmRoomIsHostOnly = hostOnly;
+    lastPeersJson = '';
+    if (activePeers) updatePeerList(activePeers);
+
+    const card = elements.hostControlCard;
+    if (!card) return;
+    // Explicit capability advertised by the relay. Against an older relay it's
+    // false/absent → feature unavailable, so hide the card instead of misleading UI.
+    const serverSupportsHostControl = !!s.hostControlSupported;
+    // Show the card only when meaningful: owner always (to manage); a non-controller
+    // guest only while host-only is active. A guest in a normal room sees nothing.
+    const show = s.inRoom && serverSupportsHostControl && (amHost || hostOnly);
+    if (!show) {
+        card.style.display = 'none';
+        hcmGuestLocked = false;
+        setRemoteControlsLocked(false);
+        return;
+    }
+    card.style.display = 'block';
+    if (elements.hostRoleBadge) {
+        const role = amHost ? (getMessage('BADGE_HOST') || 'Host')
+                   : amController ? (getMessage('BADGE_CONTROLLER') || 'Controller')
+                   : (getMessage('BADGE_GUEST') || 'Guest');
+        elements.hostRoleBadge.textContent = role;
+        elements.hostRoleBadge.style.background = (amHost || amController) ? 'var(--accent)' : 'var(--text-muted)';
+    }
+    if (elements.hostControlToggleRow) elements.hostControlToggleRow.style.display = amHost ? 'flex' : 'none';
+    if (elements.hostControlToggle) elements.hostControlToggle.checked = hostOnly;
+    if (elements.hostControlGuestNote) elements.hostControlGuestNote.style.display = (!amController && hostOnly) ? 'block' : 'none';
+    // Owner-only discoverability hint: co-hosting is granted down in the peer list,
+    // which isn't obvious from this card. Only show it when it's actionable — owner,
+    // relay supports co-host, and the room is locked to host-only (the buttons only
+    // render in that mode).
+    if (elements.hostControlCohostHint) elements.hostControlCohostHint.style.display = (amHost && !!s.coHostSupported && hostOnly) ? 'block' : 'none';
+
+    // Only a non-controller is locked out of the remote controls.
+    hcmGuestLocked = (!amController && hostOnly);
+    setRemoteControlsLocked(hcmGuestLocked);
+}
+
+function setRemoteControlsLocked(locked) {
+    [elements.playBtn, elements.pauseBtn, elements.forceSyncBtn].forEach(btn => {
+        if (!btn) return;
+        btn.disabled = locked;
+        btn.style.opacity = locked ? '0.5' : '';
+        btn.style.cursor = locked ? 'not-allowed' : '';
+        btn.title = locked ? (getMessage('NOTICE_HOST_CONTROLS') || 'The host controls playback for everyone.') : '';
+    });
+    // Always restore the default labels. The action handlers leave the text in a
+    // transitional state ("Playing..." / "Pausing...") and the 2.5s safety reset
+    // skips the refresh while guest-locked — so reset on BOTH transitions: on lock
+    // (host enabled host-only just as the guest clicked → don't freeze "Playing...")
+    // and on unlock (L-1).
+    if (elements.playBtn) elements.playBtn.textContent = getMessage('BTN_PLAY') || 'Play';
+    if (elements.pauseBtn) elements.pauseBtn.textContent = getMessage('BTN_PAUSE') || 'Pause';
+}
+
+if (elements.hostControlToggle) {
+    elements.hostControlToggle.addEventListener('change', () => {
+        const mode = elements.hostControlToggle.checked ? 'host-only' : 'everyone';
+        chrome.runtime.sendMessage({ type: 'SET_CONTROL_MODE', controlMode: mode }, (res) => {
+            // Server broadcasts CONTROL_MODE back to refresh the UI; revert on failure.
+            if (chrome.runtime.lastError || !res || res.status !== 'ok') {
+                elements.hostControlToggle.checked = (mode === 'everyone');
+            }
+        });
+    });
+}
+
 function updateUI(roomId, password, useCustomServer = false, serverUrl = '') {
    const inRoom = !!roomId;
    toggleUIState(inRoom);
@@ -480,6 +600,24 @@ function renderEmpty(container, type) {
    wrapper.appendChild(iconDiv);
    wrapper.appendChild(titleDiv);
    wrapper.appendChild(hintDiv);
+
+    // "No peers yet" — turn the hint into a one-click action so the user can
+    // immediately copy and share the invite link instead of hunting for it.
+    if (type === 'peers' && elements.inviteLink && elements.inviteLink.value) {
+        const copyBtn = document.createElement('button');
+        copyBtn.type = 'button';
+        copyBtn.className = 'primary';
+        copyBtn.style.cssText = 'display:inline-block; width:auto; margin-top:12px; padding:6px 14px; font-size:11px;';
+        copyBtn.textContent = getMessage('BTN_COPY_INVITE');
+        copyBtn.title = getMessage('BTN_COPY_INVITE_TOOLTIP');
+        copyBtn.addEventListener('click', () => {
+            navigator.clipboard.writeText(elements.inviteLink.value)
+                .then(() => showToast(getMessage('TOAST_INVITE_COPIED'), 'success', 2000))
+                .catch(() => showToast(getMessage('TOAST_COPY_FAILED'), 'error'));
+        });
+        wrapper.appendChild(copyBtn);
+    }
+
    container.replaceChildren(wrapper);
 }

@@ -545,6 +683,11 @@ function updatePeerList(peers) {

            header.appendChild(nameSpan);

+            // Right-side badges + actions, kept in one group so they sit together
+            // on the right instead of being scattered by the header's space-between.
+            const rightGroup = document.createElement('div');
+            rightGroup.style.cssText = 'display:flex; align-items:center; gap:6px; flex-shrink:0;';
+
            // Volume Icon (Top Right)
            if (p.volume !== undefined && p.volume !== null) {
                const volIcon = document.createElement('div');
@@ -558,9 +701,57 @@ function updatePeerList(peers) {
                const you = document.createElement('span');
                you.style.cssText = 'font-size:10px; color:var(--accent); font-weight:bold;';
                you.textContent = getMessage('LABEL_YOU') || 'YOU';
-                header.appendChild(you);
+                rightGroup.appendChild(you);
            }

+            // Host Control Mode: show "Solo" badge for peers watching on their own.
+            if (typeof p === 'object' && p.desynced) {
+                const solo = document.createElement('span');
+                solo.style.cssText = 'font-size:10px; color:#fff; background:#b45309; padding:2px 6px; border-radius:6px; font-weight:600;';
+                const soloText = getMessage('BADGE_DESYNCED') || 'Solo';
+                solo.textContent = soloText;
+                solo.title = getMessage('TOOLTIP_PEER_DESYNCED') || soloText;
+                rightGroup.appendChild(solo);
+            }
+
+            // Co-Host: role badges + the owner's promote/demote control. Only meaningful
+            // once the room is locked to host-only — in 'everyone' mode anyone can already
+            // control, so roles are moot and we show nothing (no badge/button noise).
+            // The promote/demote button additionally requires owner privileges (below).
+            const showRoles = !!hcmOwnerPeerId && hcmRoomIsHostOnly;
+            if (showRoles) {
+                const isOwner = pId === hcmOwnerPeerId;
+                const isController = !isOwner && hcmControllers.includes(pId);
+                if (isOwner || isController) {
+                    const roleBadge = document.createElement('span');
+                    roleBadge.style.cssText = 'font-size:10px; color:#fff; background:var(--accent); padding:2px 6px; border-radius:6px; font-weight:600;';
+                    roleBadge.textContent = isOwner ? (getMessage('BADGE_HOST') || 'Host') : (getMessage('BADGE_CONTROLLER') || 'Controller');
+                    rightGroup.appendChild(roleBadge);
+                }
+                // Owner can promote/demote any non-owner peer.
+                if (hcmAmOwner && hcmCoHostSupported && !isOwner) {
+                    const btn = document.createElement('button');
+                    const revoke = isController;
+                    btn.style.cssText = `font-size:10px; padding:3px 9px; border-radius:6px; cursor:pointer; white-space:nowrap; font-weight:600; transition:background .15s,color .15s; border:1px solid ${revoke ? 'var(--text-muted)' : 'var(--accent)'}; background:transparent; color:${revoke ? 'var(--text-muted)' : 'var(--accent)'};`;
+                    btn.textContent = revoke ? (getMessage('BTN_REVOKE_CONTROL') || 'Revoke') : (getMessage('BTN_GIVE_CONTROL') || 'Give control');
+                    btn.title = revoke ? (getMessage('BTN_REVOKE_CONTROL') || 'Revoke') : (getMessage('BTN_GIVE_CONTROL') || 'Give control');
+                    btn.addEventListener('mouseenter', () => {
+                        btn.style.background = revoke ? 'var(--text-muted)' : 'var(--accent)';
+                        btn.style.color = '#fff';
+                    });
+                    btn.addEventListener('mouseleave', () => {
+                        btn.style.background = 'transparent';
+                        btn.style.color = revoke ? 'var(--text-muted)' : 'var(--accent)';
+                    });
+                    btn.addEventListener('click', () => {
+                        chrome.runtime.sendMessage({ type: 'SET_PEER_ROLE', peerId: pId, controller: !isController }, () => {});
+                    });
+                    rightGroup.appendChild(btn);
+                }
+            }
+
+            if (rightGroup.childNodes.length) header.appendChild(rightGroup);
+
            peerItem.appendChild(header);

            // Media Info
@@ -787,19 +978,33 @@ async function populateTabs(providedPeers = null, providedTargetTabId = null) {
 }

 function applyConnectionStatus(status) {
+    // Coerce 'idle' to 'disconnected' if a room is actively configured.
+    // An 'idle' status with a configured room indicates the background
+    // worker dropped connection intent due to a server error.
+    if (status === 'idle' && elements.sectionActive && elements.sectionActive.style.display !== 'none') {
+        status = 'disconnected';
+    }
+
    const connected = status === 'connected';
    const connecting = status === 'connecting';
    const reconnecting = status === 'reconnecting';
+    // 'idle' = not in a room and not trying to connect. This is the normal
+    // resting state (lazy connect), NOT an error — surface it neutrally.
+    const idle = status === 'idle';

    if (elements.connDot) {
        elements.connDot.className = 'status-dot ' + (connected ? 'status-online' : ((connecting || reconnecting) ? 'status-online' : 'status-offline'));
-        
+
        if (reconnecting) {
            elements.connDot.style.background = '#f59e0b';
            elements.connDot.style.boxShadow = '0 0 8px #f59e0b';
        } else if (connecting) {
            elements.connDot.style.background = '#fbbf24';
            elements.connDot.style.boxShadow = '0 0 8px #fbbf24';
+        } else if (idle) {
+            // Neutral grey — ready, not failed.
+            elements.connDot.style.background = '#9ca3af';
+            elements.connDot.style.boxShadow = 'none';
        } else if (!connected) {
            elements.connDot.style.background = '#ef4444';
            elements.connDot.style.boxShadow = 'none';
@@ -810,7 +1015,15 @@ function applyConnectionStatus(status) {
    }

    if (elements.connText) {
-        elements.connText.textContent = connected ? getMessage('STATUS_CONNECTED') : (reconnecting ? getMessage('STATUS_RECONNECTING') : (connecting ? getMessage('STATUS_CONNECTING') : getMessage('STATUS_DISCONNECTED')));
+        elements.connText.textContent = connected ? getMessage('STATUS_CONNECTED') : (reconnecting ? getMessage('STATUS_RECONNECTING') : (connecting ? getMessage('STATUS_CONNECTING') : (idle ? getMessage('STATUS_IDLE') : getMessage('STATUS_DISCONNECTED'))));
+    }
+
+    // Show the info "i" + tooltip only in the idle state.
+    if (elements.connInfo) {
+        elements.connInfo.style.display = idle ? '' : 'none';
+    }
+    if (!connected) {
+        updatePingDisplay(null);
    }
    if (elements.retryBtn) {
        elements.retryBtn.style.display = reconnecting && reconnectSlowMode ? 'block' : 'none';
@@ -831,6 +1044,23 @@ function applyConnectionStatus(status) {
    if (elements.forceSyncBtn) elements.forceSyncBtn.textContent = getMessage('BTN_SYNC');
 }

+function updatePingDisplay(pingMs) {
+    if (!elements.connPing) return;
+    if (pingMs === null || pingMs === undefined || typeof pingMs !== 'number' || !Number.isFinite(pingMs)) {
+        elements.connPing.textContent = '';
+        elements.connPing.style.color = '';
+        return;
+    }
+    elements.connPing.textContent = `${Math.round(pingMs)}ms`;
+    if (pingMs < 50) {
+        elements.connPing.style.color = '#22c55e';
+    } else if (pingMs < 150) {
+        elements.connPing.style.color = '#f59e0b';
+    } else {
+        elements.connPing.style.color = '#ef4444';
+    }
+}
+
 function updateHistory(history) {
    if (!history || !elements.historyList) return;
    elements.historyList.innerHTML = '';
@@ -999,6 +1229,22 @@ elements.autoSyncNextEpisode.addEventListener('change', () => {
    chrome.storage.local.set({ autoSyncNextEpisode: elements.autoSyncNextEpisode.checked });
 });

+if (elements.sendTabTitle) {
+    elements.sendTabTitle.addEventListener('change', () => {
+        chrome.storage.local.set({ sendTabTitle: elements.sendTabTitle.checked }, () => {
+            chrome.runtime.sendMessage({ type: 'TITLE_PRIVACY_CHANGED' }).catch(() => {});
+        });
+    });
+}
+
+if (elements.mediaTitlePrivacyMode) {
+    elements.mediaTitlePrivacyMode.addEventListener('change', () => {
+        chrome.storage.local.set({ mediaTitlePrivacyMode: elements.mediaTitlePrivacyMode.value }, () => {
+            chrome.runtime.sendMessage({ type: 'TITLE_PRIVACY_CHANGED' }).catch(() => {});
+        });
+    });
+}
+
 elements.browserNotifications.addEventListener('change', () => {
    chrome.storage.local.set({ browserNotifications: elements.browserNotifications.checked });
 });
@@ -1074,7 +1320,11 @@ if (elements.langSelector) {
 elements.serverUrl.addEventListener('change', () => {
    let url = elements.serverUrl.value.trim();
    if (url && !url.includes('://')) {
-        url = 'ws://' + url;
+        // Default to secure wss:// — plain ws:// is only valid for a local relay
+        // (and the background rejects/upgrades ws:// for any remote host anyway).
+        const host = url.split('/')[0].split(':')[0].toLowerCase();
+        const isLocal = host === 'localhost' || host === '127.0.0.1';
+        url = (isLocal ? 'ws://' : 'wss://') + url;
        elements.serverUrl.value = url;
        chrome.storage.local.set({ serverUrl: url });
    }
@@ -1099,6 +1349,8 @@ elements.tabs.forEach(btn => {
        isDevTabVisible = btn.dataset.tab === 'tab-dev';
        if (isDevTabVisible) refreshLogs();
        if (btn.dataset.tab === 'tab-sync') refreshHistory();
+        
+        chrome.storage.local.set({ activeTab: btn.dataset.tab });
    });
 });

@@ -1141,8 +1393,13 @@ elements.roomId.addEventListener('input', () => {
 });

 elements.joinBtn.addEventListener('click', async () => {
+    if (isProcessingConnection) return;
+    isProcessingConnection = true;
    clearConnectionErrorTimer();
-    if (elements.joinBtn.disabled) return;
+    if (elements.joinBtn.disabled) {
+        isProcessingConnection = false;
+        return;
+    }
    const roomIdInput = elements.roomId.value.trim();
    const isCreating = !roomIdInput;
    
@@ -1151,10 +1408,23 @@ elements.joinBtn.addEventListener('click', async () => {
    
    if (joinBtnTimeout) clearTimeout(joinBtnTimeout);
    joinBtnTimeout = setTimeout(() => {
-        elements.joinBtn.disabled = false;
-        elements.joinBtn.textContent = getMessage('BTN_JOIN_ROOM');
-        joinBtnTimeout = null;
-        showError(getMessage('ERR_CONN_TIMEOUT'));
+        chrome.runtime.sendMessage({ type: 'GET_STATUS' }, (res) => {
+            if (res && res.status === 'connecting') {
+                joinBtnTimeout = setTimeout(() => {
+                    elements.joinBtn.disabled = false;
+                    elements.joinBtn.textContent = getMessage('BTN_JOIN_ROOM');
+                    joinBtnTimeout = null;
+                    isProcessingConnection = false;
+                    showError(getMessage('ERR_CONN_TIMEOUT'));
+                }, 15000);
+                return;
+            }
+            elements.joinBtn.disabled = false;
+            elements.joinBtn.textContent = getMessage('BTN_JOIN_ROOM');
+            joinBtnTimeout = null;
+            isProcessingConnection = false;
+            if (res && res.status !== 'connected') showError(getMessage('ERR_CONN_TIMEOUT'));
+        });
    }, 15000);
    
    const serverUrl = elements.serverUrl.value.trim();
@@ -1165,16 +1435,20 @@ elements.joinBtn.addEventListener('click', async () => {
        showError(getMessage('ERR_INVALID_SERVER_URL'));
        elements.joinBtn.disabled = false;
        elements.joinBtn.textContent = getMessage('BTN_JOIN_ROOM');
+        if (joinBtnTimeout) { clearTimeout(joinBtnTimeout); joinBtnTimeout = null; }
+        isProcessingConnection = false;
        return;
    }
    if (useCustom && serverUrl) {
        try {
-            const urlToCheck = serverUrl.includes('://') ? serverUrl : 'ws://' + serverUrl;
+            const urlToCheck = serverUrl.includes('://') ? serverUrl : 'wss://' + serverUrl;
            new URL(urlToCheck);
        } catch (_e) {
            showError(getMessage('ERR_INVALID_SERVER_URL'));
            elements.joinBtn.disabled = false;
            elements.joinBtn.textContent = getMessage('BTN_JOIN_ROOM');
+            if (joinBtnTimeout) { clearTimeout(joinBtnTimeout); joinBtnTimeout = null; }
+            isProcessingConnection = false;
            return;
        }
    }
@@ -1201,6 +1475,8 @@ elements.joinBtn.addEventListener('click', async () => {
 });

 elements.leaveBtn.addEventListener('click', async () => {
+    if (isProcessingConnection) return;
+    isProcessingConnection = true;
    clearConnectionErrorTimer();
    chrome.runtime.sendMessage({ type: 'LEAVE_ROOM' });
    await chrome.storage.local.set({ roomId: '', password: '' });
@@ -1208,6 +1484,7 @@ elements.leaveBtn.addEventListener('click', async () => {
    elements.password.value = '';
    lastKnownPeers = [];
    updateUI(null, null);
+    isProcessingConnection = false;
 });

 function generateRoomId() {
@@ -1258,6 +1535,9 @@ elements.retryBtn.addEventListener('click', () => {
 });

 elements.targetTab.addEventListener('change', () => {
+    const hint = document.getElementById('targetTabHint');
+    if (hint) hint.style.display = 'none';
+
    const val = elements.targetTab.value;
    const tabId = val ? parseInt(val) : null;
    const tabTitle = elements.targetTab.options[elements.targetTab.selectedIndex]?.dataset.originalTitle || null;
@@ -1265,10 +1545,17 @@ elements.targetTab.addEventListener('change', () => {
 });

 elements.forceSyncBtn.addEventListener('click', async () => {
+    if (hcmGuestLocked) return; // guest in host-only room — backstop (M-2/L-3)
    if (elements.forceSyncBtn.disabled) return;
    
+    const originalText = elements.forceSyncBtn.textContent;
+    elements.forceSyncBtn.disabled = true;
+
    const status = await new Promise(r => chrome.runtime.sendMessage({ type: 'GET_STATUS' }, r));
-    if (chrome.runtime.lastError || !status || !status.targetTabId) return;
+    if (chrome.runtime.lastError || !status || !status.targetTabId) {
+        elements.forceSyncBtn.disabled = false;
+        return;
+    }

    const mode = elements.forceSyncMode.value;
    let targetTime = null;
@@ -1276,6 +1563,7 @@ elements.forceSyncBtn.addEventListener('click', async () => {
    if (mode === 'jump-to-others') {
        if (!localPeerId) {
            showError(getMessage('ERR_IDENTITY_NOT_LOADED'));
+            elements.forceSyncBtn.disabled = false;
            return;
        }
        const peers = status.peers || [];
@@ -1285,6 +1573,7 @@ elements.forceSyncBtn.addEventListener('click', async () => {

        if (otherTimes.length === 0) {
            showError(getMessage('ERR_NO_PEERS_TIME'));
+            elements.forceSyncBtn.disabled = false;
            return;
        }

@@ -1293,14 +1582,15 @@ elements.forceSyncBtn.addEventListener('click', async () => {
        targetTime = otherTimes.length % 2 !== 0 ? otherTimes[mid] : (otherTimes[mid - 1] + otherTimes[mid]) / 2;
    }

-    const originalText = elements.forceSyncBtn.textContent;
-    elements.forceSyncBtn.disabled = true;
    elements.forceSyncBtn.textContent = mode === 'jump-to-others' ? getMessage('BTN_STATE_SYNCING_GROUP', { time: formatTime(targetTime) }) : getMessage('BTN_STATE_SYNCING');
    forceSyncDone = false;
    const peerCount = (status.peers || []).filter(p => (typeof p === 'object' ? p.peerId : p) !== localPeerId).length;
    const syncTimeoutMs = peerCount === 0 ? 3000 : 12000;
    const forceSyncReset = () => {
-        if (!forceSyncDone) {
+        // Don't unlock a button that's locked because we became a guest mid-flight —
+        // hcmGuestLocked is the source of truth for the lock state, and the next
+        // CONTROL_MODE update restores the correct label.
+        if (!forceSyncDone && !hcmGuestLocked) {
            elements.forceSyncBtn.disabled = false;
            elements.forceSyncBtn.textContent = originalText;
        }
@@ -1347,6 +1637,7 @@ elements.forceSyncBtn.addEventListener('click', async () => {
 });

 elements.playBtn.addEventListener('click', () => {
+    if (hcmGuestLocked) return; // guest in host-only room — backstop
    if (!elements.targetTab.value) {
        showToast(getMessage('ERR_SELECT_VIDEO'), 'warning');
        return;
@@ -1365,7 +1656,7 @@ elements.playBtn.addEventListener('click', () => {
    });
    // Safety reset: restore button after 2.5s in case no peers respond
    setTimeout(() => {
-        if (elements.playBtn.disabled) {
+        if (elements.playBtn.disabled && !hcmGuestLocked) {
            elements.playBtn.textContent = getMessage('BTN_PLAY');
            elements.playBtn.disabled = false;
        }
@@ -1373,6 +1664,7 @@ elements.playBtn.addEventListener('click', () => {
 });

 elements.pauseBtn.addEventListener('click', () => {
+    if (hcmGuestLocked) return; // guest in host-only room — backstop
    if (!elements.targetTab.value) {
        showToast(getMessage('ERR_SELECT_VIDEO'), 'warning');
        return;
@@ -1391,7 +1683,7 @@ elements.pauseBtn.addEventListener('click', () => {
    });
    // Safety reset: restore button after 2.5s in case no peers respond
    setTimeout(() => {
-        if (elements.pauseBtn.disabled) {
+        if (elements.pauseBtn.disabled && !hcmGuestLocked) {
            elements.pauseBtn.textContent = getMessage('BTN_PAUSE');
            elements.pauseBtn.disabled = false;
        }
@@ -1404,6 +1696,20 @@ elements.clearLogs.addEventListener('click', () => {
    });
 });

+if (elements.regenId) {
+    elements.regenId.addEventListener('click', () => {
+        elements.regenId.disabled = true;
+        chrome.runtime.sendMessage({ type: 'REGENERATE_ID' }, (res) => {
+            elements.regenId.disabled = false;
+            if (chrome.runtime.lastError || !res || !res.peerId) {
+                showToast(getMessage('TOAST_ID_REGENERATED') || 'Failed to regenerate identity', 'error');
+                return;
+            }
+            showToast(getMessage('TOAST_ID_REGENERATED') || 'Identity regenerated — reconnecting…', 'success', 3000);
+        });
+    });
+}
+
 elements.copyInvite.addEventListener('click', () => {
    navigator.clipboard.writeText(elements.inviteLink.value).then(() => {
        const original = elements.copyInvite.textContent;
@@ -1549,7 +1855,13 @@ chrome.runtime.onMessage.addListener((msg) => {
    } else if (msg.type === 'PEER_UPDATE') {
        updatePeerList(msg.peers);
        if (msg.peers) detectPeerChanges(msg.peers);
+    } else if (msg.type === 'CONTROL_MODE') {
+        const inRoom = elements.sectionActive && elements.sectionActive.style.display === 'block';
+        updateHostControlUI({ controlMode: msg.controlMode, amHost: msg.amHost, amController: msg.amController, controllers: msg.controllers, hostPeerId: msg.hostPeerId, hostControlSupported: msg.hostControlSupported, coHostSupported: msg.coHostSupported, inRoom });
    } else if (msg.type === 'CONNECTION_STATUS') {
+        if (msg.status === 'connected' || msg.status === 'disconnected') {
+            if (joinBtnTimeout) { clearTimeout(joinBtnTimeout); joinBtnTimeout = null; }
+        }
        if (msg.status === 'connected') {
            clearConnectionErrorTimer();
        }
@@ -1559,8 +1871,11 @@ chrome.runtime.onMessage.addListener((msg) => {
        }
        if (msg.status === 'connected') {
            chrome.runtime.sendMessage({ type: 'GET_STATUS' }, (res) => {
-                if (res && res.peers) updatePeerList(res.peers);
-                if (res && res.lastActionState) updateLastActionUI(res.lastActionState, res.peers);
+                if (!res) return;
+                if (res.peers) updatePeerList(res.peers);
+                if (res.lastActionState) updateLastActionUI(res.lastActionState, res.peers);
+                updatePingDisplay(res.ping);
+                updateHostControlUI({ controlMode: res.controlMode, amHost: res.amHost, amController: res.amController, controllers: res.controllers, hostPeerId: res.hostPeerId, hostControlSupported: res.hostControlSupported, coHostSupported: res.coHostSupported, inRoom: true });
            });
        }
        if (msg.status === 'disconnected') {
@@ -1579,11 +1894,14 @@ chrome.runtime.onMessage.addListener((msg) => {
                }
            });
        }
+    } else if (msg.type === 'PING_UPDATE') {
+        updatePingDisplay(msg.ping);
    } else if (msg.type === 'HISTORY_UPDATE') {
        updateHistory(msg.history);
    } else if (msg.type === 'ROOM_LIST') {
        updateRoomList(msg.rooms);
    } else if (msg.type === 'JOIN_STATUS') {
+        isProcessingConnection = false;
        if (joinBtnTimeout) {
            clearTimeout(joinBtnTimeout);
            joinBtnTimeout = null;
@@ -1595,9 +1913,15 @@ chrome.runtime.onMessage.addListener((msg) => {
            // Final confirmation of join from background
            chrome.storage.local.get(['roomId', 'password', 'useCustomServer', 'serverUrl'], (data) => {
                updateUI(data.roomId, data.password, data.useCustomServer, data.serverUrl);
+                const syncTabBtn = document.querySelector('.tab-btn[data-tab="tab-sync"]');
+                if (syncTabBtn) syncTabBtn.click();
+                showSelectVideoHint();
            });
        } else {
            // Join failed: reset UI state
+            chrome.storage.local.set({ roomId: '', password: '' });
+            elements.roomId.value = '';
+            elements.password.value = '';
            updateUI(null, null);
        }
    } else if (msg.type === 'LOBBY_UPDATE') {
@@ -1685,6 +2009,7 @@ elements.copyLogs.addEventListener('click', () => {
            : '\uD83D\uDD34';
        lines.push(`- **Status:** ${emoji} ${st}`);
        lines.push(`- **Server:** \`${safe(status.serverUrl, '?')}\``);
+        lines.push(`- **Ping:** ${status.ping != null ? `${status.ping}ms` : '-'}`);
        if (status.roomId) {
            lines.push(`- **Room:** \`${status.roomId}\``);
            const peers = Array.isArray(status.peers) ? status.peers : [];
@@ -2022,36 +2347,188 @@ function updateLobbyUI(lobby, peers) {

 // --- Onboarding Tour ---
 const onboardingSteps = [
-    { icon: '👋', get title() { return getMessage('ONBOARDING_1_TITLE'); }, get text() { return getMessage('ONBOARDING_1_TEXT'); }, targetTab: 'tab-room' },
-    { icon: '🏠', get title() { return getMessage('ONBOARDING_2_TITLE'); }, get text() { return getMessage('ONBOARDING_2_TEXT'); }, targetTab: 'tab-room' },
-    { icon: '🎬', get title() { return getMessage('ONBOARDING_3_TITLE'); }, get text() { return getMessage('ONBOARDING_3_TEXT'); }, targetTab: 'tab-sync' },
-    { icon: '⚙️', get title() { return getMessage('ONBOARDING_4_TITLE'); }, get text() { return getMessage('ONBOARDING_4_TEXT'); }, targetTab: 'tab-settings' },
-    { icon: '🎉', get title() { return getMessage('ONBOARDING_5_TITLE'); }, get text() { return getMessage('ONBOARDING_5_TEXT'); }, targetTab: 'tab-room' }
+    { 
+        icon: '👋', 
+        get title() { return getMessage('ONBOARDING_1_TITLE'); }, 
+        get text() { return getMessage('ONBOARDING_1_TEXT'); },
+        targetTab: 'tab-room',
+        targetSelector: null
+    },
+    { 
+        icon: '🏠', 
+        get title() { return getMessage('ONBOARDING_2_TITLE'); }, 
+        get text() { return getMessage('ONBOARDING_2_TEXT'); }, 
+        targetTab: 'tab-room',
+        targetSelector: '#createRoomBtn'
+    },
+    { 
+        icon: '🎬', 
+        get title() { return getMessage('ONBOARDING_3_TITLE'); }, 
+        get text() { return getMessage('ONBOARDING_3_TEXT'); }, 
+        targetTab: 'tab-sync',
+        targetSelector: '#targetTab'
+    },
+    { 
+        icon: '⚙️', 
+        get title() { return getMessage('ONBOARDING_4_TITLE'); }, 
+        get text() { return getMessage('ONBOARDING_4_TEXT'); },
+        targetTab: 'tab-settings',
+        targetSelector: '#username'
+    },
+    {
+        icon: '🍿',
+        get title() { return getMessage('ONBOARDING_5_TITLE'); },
+        get text() { return getMessage('ONBOARDING_5_TEXT'); },
+        targetTab: 'tab-room',
+        targetSelector: null
+    }
 ];

+function showSelectVideoHint() {
+    const hint = document.getElementById('targetTabHint');
+    if (hint && !elements.targetTab.value) {
+        hint.style.display = 'block';
+    }
+}
+
 let onboardingStep = 0;
+let onboardingTimeout = null;

 function showOnboarding() {
    const overlay = document.getElementById('onboarding-overlay');
    if (!overlay) return;
-    document.body.style.minHeight = '400px';
-    overlay.style.display = 'flex';
+    document.body.style.minHeight = '420px';
+    overlay.style.display = 'block';
+    onboardingStep = 0;
    renderOnboardingStep();
 }

+function positionSpotlightAndCard(targetEl) {
+    const spotlight = document.getElementById('onboarding-spotlight');
+    const card = document.getElementById('onboarding-card');
+    const arrow = document.getElementById('onboarding-arrow');
+    if (!spotlight || !card || !arrow) return;
+
+    spotlight.style.display = 'block';
+    card.style.display = 'block';
+    
+    // Force a reflow
+    card.getBoundingClientRect();
+    spotlight.getBoundingClientRect();
+
+    const targetRect = targetEl.getBoundingClientRect();
+    const pad = 6;
+    const sLeft = targetRect.left - pad;
+    const sTop = targetRect.top - pad;
+    const sWidth = targetRect.width + (pad * 2);
+    const sHeight = targetRect.height + (pad * 2);
+    
+    spotlight.style.left = `${sLeft}px`;
+    spotlight.style.top = `${sTop}px`;
+    spotlight.style.width = `${sWidth}px`;
+    spotlight.style.height = `${sHeight}px`;
+    spotlight.style.opacity = '1';
+
+    const cardWidth = 280;
+    const viewportHeight = window.innerHeight || document.documentElement.clientHeight;
+    
+    let cLeft = targetRect.left + (targetRect.width - cardWidth) / 2;
+    cLeft = Math.max(12, Math.min(320 - cardWidth - 12, cLeft));
+    
+    const cardHeight = card.offsetHeight || 150;
+    let cTop = targetRect.bottom + 14;
+    let arrowDir = 'up';
+    
+    if (cTop + cardHeight > viewportHeight - 12) {
+        cTop = targetRect.top - cardHeight - 14;
+        arrowDir = 'down';
+    }
+    
+    if (cTop < 12) {
+        cTop = targetRect.bottom + 14;
+        arrowDir = 'up';
+    }
+
+    card.style.left = `${cLeft}px`;
+    card.style.top = `${cTop}px`;
+    card.style.opacity = '1';
+    card.style.transform = 'scale(1)';
+
+    arrow.style.left = '';
+    arrow.style.right = '';
+    arrow.style.top = '';
+    arrow.style.bottom = '';
+    arrow.style.borderColor = 'transparent';
+    
+    const targetCenter = targetRect.left + (targetRect.width / 2);
+    const arrowLeft = targetCenter - cLeft - 6;
+    arrow.style.left = `${Math.max(12, Math.min(cardWidth - 24, arrowLeft))}px`;
+    
+    if (arrowDir === 'up') {
+        arrow.style.top = '-12px';
+        arrow.style.borderBottomColor = 'var(--card)';
+    } else {
+        arrow.style.bottom = '-12px';
+        arrow.style.borderTopColor = 'var(--card)';
+    }
+}
+
+function centerCardFallback() {
+    const spotlight = document.getElementById('onboarding-spotlight');
+    const card = document.getElementById('onboarding-card');
+    const arrow = document.getElementById('onboarding-arrow');
+    if (!card) return;
+
+    if (spotlight) {
+        spotlight.style.display = 'none';
+        spotlight.style.opacity = '0';
+    }
+    if (arrow) {
+        arrow.style.borderColor = 'transparent';
+    }
+
+    card.style.display = 'block';
+    
+    const cardWidth = 280;
+    const viewportHeight = window.innerHeight || document.documentElement.clientHeight;
+    
+    const cLeft = (320 - cardWidth) / 2;
+    const cTop = (viewportHeight - (card.offsetHeight || 150)) / 2;
+    
+    card.style.left = `${cLeft}px`;
+    card.style.top = `${cTop}px`;
+    card.style.opacity = '1';
+    card.style.transform = 'scale(1)';
+}
+
 function renderOnboardingStep() {
+    if (onboardingTimeout) clearTimeout(onboardingTimeout);
+    
    const step = onboardingSteps[onboardingStep];
    const icon = document.getElementById('onboarding-icon');
    const title = document.getElementById('onboarding-title');
    const text = document.getElementById('onboarding-text');
    const nextBtn = document.getElementById('onboarding-next');
-    const dots = document.getElementById('onboarding-dots');
-    if (!icon || !title || !text || !nextBtn || !dots) return;
+    const stepIndicator = document.getElementById('onboarding-step-indicator');
+    const progressBar = document.getElementById('onboarding-progress-bar');
+    
+    if (!icon || !title || !text || !nextBtn) return;

    icon.textContent = step.icon;
    title.textContent = step.title;
    text.textContent = step.text;

+    if (stepIndicator) {
+        stepIndicator.textContent = `Step ${onboardingStep + 1} of ${onboardingSteps.length}`;
+    }
+    if (progressBar) {
+        progressBar.style.width = `${((onboardingStep + 1) / onboardingSteps.length) * 100}%`;
+    }
+
+    nextBtn.textContent = onboardingStep === onboardingSteps.length - 1 
+        ? (getMessage('ONBOARDING_DONE') !== 'ONBOARDING_DONE' ? getMessage('ONBOARDING_DONE') : 'Done!') 
+        : getMessage('BTN_ONBOARDING_NEXT');
+
    if (step.targetTab) {
        const tabBtn = document.querySelector(`.tab-btn[data-tab="${step.targetTab}"]`);
        if (tabBtn) tabBtn.click();
@@ -2062,31 +2539,53 @@ function renderOnboardingStep() {
            if (syncActive) syncActive.style.display = 'block';
            if (syncInactive) syncInactive.style.display = 'none';
        } else {
-            // Restore actual lock state when on other tabs so we don't leave it unlocked
            const inRoom = elements.sectionActive && elements.sectionActive.style.display === 'block';
            if (syncActive) syncActive.style.display = inRoom ? 'block' : 'none';
            if (syncInactive) syncInactive.style.display = inRoom ? 'none' : 'block';
        }
    }

-    dots.replaceChildren();
-    onboardingSteps.forEach((_, i) => {
-        const dot = document.createElement('div');
-        dot.style.cssText = `width:8px; height:8px; border-radius:50%; background:${i === onboardingStep ? 'var(--accent)' : '#475569'};`;
-        dots.appendChild(dot);
-    });
+    const spotlight = document.getElementById('onboarding-spotlight');
+    const card = document.getElementById('onboarding-card');
+    if (spotlight) spotlight.style.opacity = '0';
+    if (card) {
+        card.style.opacity = '0';
+        card.style.transform = 'scale(0.95)';
+    }

-    nextBtn.textContent = onboardingStep === onboardingSteps.length - 1 ? (getMessage('ONBOARDING_DONE') !== 'ONBOARDING_DONE' ? getMessage('ONBOARDING_DONE') : 'Done!') : getMessage('BTN_ONBOARDING_NEXT');
+    onboardingTimeout = setTimeout(() => {
+        const targetEl = step.targetSelector ? document.querySelector(step.targetSelector) : null;
+        if (targetEl && targetEl.offsetParent !== null) {
+            positionSpotlightAndCard(targetEl);
+        } else {
+            centerCardFallback();
+        }
+    }, 180);
 }

 function completeOnboarding() {
-    const overlay = document.getElementById('onboarding-overlay');
-    if (overlay) overlay.style.display = 'none';
-    document.body.style.minHeight = '';
-    chrome.storage.sync.set({ onboardingComplete: true });
+    if (onboardingTimeout) clearTimeout(onboardingTimeout);
    
-    const inRoom = elements.sectionActive && elements.sectionActive.style.display === 'block';
-    toggleUIState(inRoom);
+    const overlay = document.getElementById('onboarding-overlay');
+    const spotlight = document.getElementById('onboarding-spotlight');
+    const card = document.getElementById('onboarding-card');
+    
+    if (card) {
+        card.style.opacity = '0';
+        card.style.transform = 'scale(0.9)';
+    }
+    if (spotlight) {
+        spotlight.style.opacity = '0';
+    }
+    
+    setTimeout(() => {
+        if (overlay) overlay.style.display = 'none';
+        document.body.style.minHeight = '';
+        chrome.storage.sync.set({ onboardingComplete: true });
+        
+        const inRoom = elements.sectionActive && elements.sectionActive.style.display === 'block';
+        toggleUIState(inRoom);
+    }, 300);
 }

 document.getElementById('onboarding-next')?.addEventListener('click', () => {
@@ -2103,3 +2602,8 @@ document.getElementById('onboarding-skip')?.addEventListener('click', completeOn
 document.getElementById('onboarding-overlay')?.addEventListener('click', (e) => {
    if (e.target.id === 'onboarding-overlay') completeOnboarding();
 });
+
+elements.restartTourBtn?.addEventListener('click', () => {
+    onboardingStep = 0;
+    showOnboarding();
+});
@@ -0,0 +1,45 @@
+import { extractEpisodeId } from './episode-utils.js';
+
+export const TITLE_PRIVACY_MODES = Object.freeze({
+    FULL: 'full',
+    EPISODE: 'episode',
+    HIDDEN: 'hidden'
+});
+
+export function normalizeTitlePrivacyMode(mode) {
+    return Object.values(TITLE_PRIVACY_MODES).includes(mode)
+        ? mode
+        : TITLE_PRIVACY_MODES.FULL;
+}
+
+export function normalizeSendTabTitle(sendTabTitle, legacyMode = TITLE_PRIVACY_MODES.FULL) {
+    if (typeof sendTabTitle === 'boolean') return sendTabTitle;
+    return normalizeTitlePrivacyMode(legacyMode) === TITLE_PRIVACY_MODES.FULL;
+}
+
+export function sanitizeTabTitle(title, sendTabTitle) {
+    if (!sendTabTitle) return null;
+    return typeof title === 'string' && title.length > 0 ? title : null;
+}
+
+export function sanitizeSharedTitle(title, mode) {
+    const normalizedMode = normalizeTitlePrivacyMode(mode);
+    if (normalizedMode === TITLE_PRIVACY_MODES.HIDDEN) return null;
+
+    if (typeof title !== 'string' || title.length === 0) return null;
+    if (normalizedMode === TITLE_PRIVACY_MODES.EPISODE) {
+        return extractEpisodeId(title) || null;
+    }
+    return title;
+}
+
+export function applyTitlePrivacyToPayload(payload, mode, keys = ['mediaTitle', 'expectedTitle', 'title']) {
+    const source = payload && typeof payload === 'object' ? payload : {};
+    const next = { ...source };
+    keys.forEach(key => {
+        if (Object.prototype.hasOwnProperty.call(next, key)) {
+            next[key] = sanitizeSharedTitle(next[key], mode);
+        }
+    });
+    return next;
+}
@@ -1,15 +1,15 @@
 {
  "name": "koalasync",
-  "version": "2.1.3",
+  "version": "2.2.4",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "koalasync",
-      "version": "2.1.3",
+      "version": "2.2.4",
      "devDependencies": {
        "archiver": "^7.0.1",
-        "esbuild": "^0.28.0",
+        "esbuild": "^0.28.1",
        "eslint": "^10.4.0",
        "fs-extra": "^11.2.0",
        "sharp": "^0.34.5",
@@ -28,9 +28,9 @@
      }
    },
    "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.0.tgz",
-      "integrity": "sha512-lhRUCeuOyJQURhTxl4WkpFTjIsbDayJHih5kZC1giwE+MhIzAb7mEsQMqMf18rHLsrb5qI1tafG20mLxEWcWlA==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
+      "integrity": "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==",
      "cpu": [
        "ppc64"
      ],
@@ -45,9 +45,9 @@
      }
    },
    "node_modules/@esbuild/android-arm": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.0.tgz",
-      "integrity": "sha512-wqh0ByljabXLKHeWXYLqoJ5jKC4XBaw6Hk08OfMrCRd2nP2ZQ5eleDZC41XHyCNgktBGYMbqnrJKq/K/lzPMSQ==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.1.tgz",
+      "integrity": "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==",
      "cpu": [
        "arm"
      ],
@@ -62,9 +62,9 @@
      }
    },
    "node_modules/@esbuild/android-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.0.tgz",
-      "integrity": "sha512-+WzIXQOSaGs33tLEgYPYe/yQHf0WTU0X42Jca3y8NWMbUVhp7rUnw+vAsRC/QiDrdD31IszMrZy+qwPOPjd+rw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.1.tgz",
+      "integrity": "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==",
      "cpu": [
        "arm64"
      ],
@@ -79,9 +79,9 @@
      }
    },
    "node_modules/@esbuild/android-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.0.tgz",
-      "integrity": "sha512-+VJggoaKhk2VNNqVL7f6S189UzShHC/mR9EE8rDdSkdpN0KflSwWY/gWjDrNxxisg8Fp1ZCD9jLMo4m0OUfeUA==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.1.tgz",
+      "integrity": "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==",
      "cpu": [
        "x64"
      ],
@@ -96,9 +96,9 @@
      }
    },
    "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.0.tgz",
-      "integrity": "sha512-0T+A9WZm+bZ84nZBtk1ckYsOvyA3x7e2Acj1KdVfV4/2tdG4fzUp91YHx+GArWLtwqp77pBXVCPn2We7Letr0Q==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.1.tgz",
+      "integrity": "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==",
      "cpu": [
        "arm64"
      ],
@@ -113,9 +113,9 @@
      }
    },
    "node_modules/@esbuild/darwin-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.0.tgz",
-      "integrity": "sha512-fyzLm/DLDl/84OCfp2f/XQ4flmORsjU7VKt8HLjvIXChJoFFOIL6pLJPH4Yhd1n1gGFF9mPwtlN5Wf82DZs+LQ==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.1.tgz",
+      "integrity": "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==",
      "cpu": [
        "x64"
      ],
@@ -130,9 +130,9 @@
      }
    },
    "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.0.tgz",
-      "integrity": "sha512-l9GeW5UZBT9k9brBYI+0WDffcRxgHQD8ShN2Ur4xWq/NFzUKm3k5lsH4PdaRgb2w7mI9u61nr2gI2mLI27Nh3Q==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==",
      "cpu": [
        "arm64"
      ],
@@ -147,9 +147,9 @@
      }
    },
    "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.0.tgz",
-      "integrity": "sha512-BXoQai/A0wPO6Es3yFJ7APCiKGc1tdAEOgeTNy3SsB491S3aHn4S4r3e976eUnPdU+NbdtmBuLncYir2tMU9Nw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.1.tgz",
+      "integrity": "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==",
      "cpu": [
        "x64"
      ],
@@ -164,9 +164,9 @@
      }
    },
    "node_modules/@esbuild/linux-arm": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.0.tgz",
-      "integrity": "sha512-CjaaREJagqJp7iTaNQjjidaNbCKYcd4IDkzbwwxtSvjI7NZm79qiHc8HqciMddQ6CKvJT6aBd8lO9kN/ZudLlw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.1.tgz",
+      "integrity": "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==",
      "cpu": [
        "arm"
      ],
@@ -181,9 +181,9 @@
      }
    },
    "node_modules/@esbuild/linux-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.0.tgz",
-      "integrity": "sha512-RVyzfb3FWsGA55n6WY0MEIEPURL1FcbhFE6BffZEMEekfCzCIMtB5yyDcFnVbTnwk+CLAgTujmV/Lgvih56W+A==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.1.tgz",
+      "integrity": "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==",
      "cpu": [
        "arm64"
      ],
@@ -198,9 +198,9 @@
      }
    },
    "node_modules/@esbuild/linux-ia32": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.0.tgz",
-      "integrity": "sha512-KBnSTt1kxl9x70q+ydterVdl+Cn0H18ngRMRCEQfrbqdUuntQQ0LoMZv47uB97NljZFzY6HcfqEZ2SAyIUTQBQ==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.1.tgz",
+      "integrity": "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==",
      "cpu": [
        "ia32"
      ],
@@ -215,9 +215,9 @@
      }
    },
    "node_modules/@esbuild/linux-loong64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.0.tgz",
-      "integrity": "sha512-zpSlUce1mnxzgBADvxKXX5sl8aYQHo2ezvMNI8I0lbblJtp8V4odlm3Yzlj7gPyt3T8ReksE6bK+pT3WD+aJRg==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.1.tgz",
+      "integrity": "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==",
      "cpu": [
        "loong64"
      ],
@@ -232,9 +232,9 @@
      }
    },
    "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.0.tgz",
-      "integrity": "sha512-2jIfP6mmjkdmeTlsX/9vmdmhBmKADrWqN7zcdtHIeNSCH1SqIoNI63cYsjQR8J+wGa4Y5izRcSHSm8K3QWmk3w==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.1.tgz",
+      "integrity": "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==",
      "cpu": [
        "mips64el"
      ],
@@ -249,9 +249,9 @@
      }
    },
    "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.0.tgz",
-      "integrity": "sha512-bc0FE9wWeC0WBm49IQMPSPILRocGTQt3j5KPCA8os6VprfuJ7KD+5PzESSrJ6GmPIPJK965ZJHTUlSA6GNYEhg==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.1.tgz",
+      "integrity": "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==",
      "cpu": [
        "ppc64"
      ],
@@ -266,9 +266,9 @@
      }
    },
    "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.0.tgz",
-      "integrity": "sha512-SQPZOwoTTT/HXFXQJG/vBX8sOFagGqvZyXcgLA3NhIqcBv1BJU1d46c0rGcrij2B56Z2rNiSLaZOYW5cUk7yLQ==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.1.tgz",
+      "integrity": "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==",
      "cpu": [
        "riscv64"
      ],
@@ -283,9 +283,9 @@
      }
    },
    "node_modules/@esbuild/linux-s390x": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.0.tgz",
-      "integrity": "sha512-SCfR0HN8CEEjnYnySJTd2cw0k9OHB/YFzt5zgJEwa+wL/T/raGWYMBqwDNAC6dqFKmJYZoQBRfHjgwLHGSrn3Q==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.1.tgz",
+      "integrity": "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==",
      "cpu": [
        "s390x"
      ],
@@ -300,9 +300,9 @@
      }
    },
    "node_modules/@esbuild/linux-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.0.tgz",
-      "integrity": "sha512-us0dSb9iFxIi8srnpl931Nvs65it/Jd2a2K3qs7fz2WfGPHqzfzZTfec7oxZJRNPXPnNYZtanmRc4AL/JwVzHQ==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.1.tgz",
+      "integrity": "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==",
      "cpu": [
        "x64"
      ],
@@ -317,9 +317,9 @@
      }
    },
    "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.0.tgz",
-      "integrity": "sha512-CR/RYotgtCKwtftMwJlUU7xCVNg3lMYZ0RzTmAHSfLCXw3NtZtNpswLEj/Kkf6kEL3Gw+BpOekRX0BYCtklhUw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==",
      "cpu": [
        "arm64"
      ],
@@ -334,9 +334,9 @@
      }
    },
    "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.0.tgz",
-      "integrity": "sha512-nU1yhmYutL+fQ71Kxnhg8uEOdC0pwEW9entHykTgEbna2pw2dkbFSMeqjjyHZoCmt8SBkOSvV+yNmm94aUrrqw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.1.tgz",
+      "integrity": "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==",
      "cpu": [
        "x64"
      ],
@@ -351,9 +351,9 @@
      }
    },
    "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.0.tgz",
-      "integrity": "sha512-cXb5vApOsRsxsEl4mcZ1XY3D4DzcoMxR/nnc4IyqYs0rTI8ZKmW6kyyg+11Z8yvgMfAEldKzP7AdP64HnSC/6g==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==",
      "cpu": [
        "arm64"
      ],
@@ -368,9 +368,9 @@
      }
    },
    "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.0.tgz",
-      "integrity": "sha512-8wZM2qqtv9UP3mzy7HiGYNH/zjTA355mpeuA+859TyR+e+Tc08IHYpLJuMsfpDJwoLo1ikIJI8jC3GFjnRClzA==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.1.tgz",
+      "integrity": "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==",
      "cpu": [
        "x64"
      ],
@@ -385,9 +385,9 @@
      }
    },
    "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.0.tgz",
-      "integrity": "sha512-FLGfyizszcef5C3YtoyQDACyg95+dndv79i2EekILBofh5wpCa1KuBqOWKrEHZg3zrL3t5ouE5jgr94vA+Wb2w==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.1.tgz",
+      "integrity": "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==",
      "cpu": [
        "arm64"
      ],
@@ -402,9 +402,9 @@
      }
    },
    "node_modules/@esbuild/sunos-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.0.tgz",
-      "integrity": "sha512-1ZgjUoEdHZZl/YlV76TSCz9Hqj9h9YmMGAgAPYd+q4SicWNX3G5GCyx9uhQWSLcbvPW8Ni7lj4gDa1T40akdlw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.1.tgz",
+      "integrity": "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==",
      "cpu": [
        "x64"
      ],
@@ -419,9 +419,9 @@
      }
    },
    "node_modules/@esbuild/win32-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.0.tgz",
-      "integrity": "sha512-Q9StnDmQ/enxnpxCCLSg0oo4+34B9TdXpuyPeTedN/6+iXBJ4J+zwfQI28u/Jl40nOYAxGoNi7mFP40RUtkmUA==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.1.tgz",
+      "integrity": "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==",
      "cpu": [
        "arm64"
      ],
@@ -436,9 +436,9 @@
      }
    },
    "node_modules/@esbuild/win32-ia32": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.0.tgz",
-      "integrity": "sha512-zF3ag/gfiCe6U2iczcRzSYJKH1DCI+ByzSENHlM2FcDbEeo5Zd2C86Aq0tKUYAJJ1obRP84ymxIAksZUcdztHA==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.1.tgz",
+      "integrity": "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==",
      "cpu": [
        "ia32"
      ],
@@ -453,9 +453,9 @@
      }
    },
    "node_modules/@esbuild/win32-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.0.tgz",
-      "integrity": "sha512-pEl1bO9mfAmIC+tW5btTmrKaujg3zGtUmWNdCw/xs70FBjwAL3o9OEKNHvNmnyylD6ubxUERiEhdsL0xBQ9efw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.1.tgz",
+      "integrity": "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==",
      "cpu": [
        "x64"
      ],
@@ -1835,9 +1835,9 @@
      }
    },
    "node_modules/esbuild": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.0.tgz",
-      "integrity": "sha512-sNR9MHpXSUV/XB4zmsFKN+QgVG82Cc7+/aaxJ8Adi8hyOac+EXptIp45QBPaVyX3N70664wRbTcLTOemCAnyqw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz",
+      "integrity": "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==",
      "dev": true,
      "hasInstallScript": true,
      "license": "MIT",
@@ -1848,32 +1848,32 @@
        "node": ">=18"
      },
      "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.28.0",
-        "@esbuild/android-arm": "0.28.0",
-        "@esbuild/android-arm64": "0.28.0",
-        "@esbuild/android-x64": "0.28.0",
-        "@esbuild/darwin-arm64": "0.28.0",
-        "@esbuild/darwin-x64": "0.28.0",
-        "@esbuild/freebsd-arm64": "0.28.0",
-        "@esbuild/freebsd-x64": "0.28.0",
-        "@esbuild/linux-arm": "0.28.0",
-        "@esbuild/linux-arm64": "0.28.0",
-        "@esbuild/linux-ia32": "0.28.0",
-        "@esbuild/linux-loong64": "0.28.0",
-        "@esbuild/linux-mips64el": "0.28.0",
-        "@esbuild/linux-ppc64": "0.28.0",
-        "@esbuild/linux-riscv64": "0.28.0",
-        "@esbuild/linux-s390x": "0.28.0",
-        "@esbuild/linux-x64": "0.28.0",
-        "@esbuild/netbsd-arm64": "0.28.0",
-        "@esbuild/netbsd-x64": "0.28.0",
-        "@esbuild/openbsd-arm64": "0.28.0",
-        "@esbuild/openbsd-x64": "0.28.0",
-        "@esbuild/openharmony-arm64": "0.28.0",
-        "@esbuild/sunos-x64": "0.28.0",
-        "@esbuild/win32-arm64": "0.28.0",
-        "@esbuild/win32-ia32": "0.28.0",
-        "@esbuild/win32-x64": "0.28.0"
+        "@esbuild/aix-ppc64": "0.28.1",
+        "@esbuild/android-arm": "0.28.1",
+        "@esbuild/android-arm64": "0.28.1",
+        "@esbuild/android-x64": "0.28.1",
+        "@esbuild/darwin-arm64": "0.28.1",
+        "@esbuild/darwin-x64": "0.28.1",
+        "@esbuild/freebsd-arm64": "0.28.1",
+        "@esbuild/freebsd-x64": "0.28.1",
+        "@esbuild/linux-arm": "0.28.1",
+        "@esbuild/linux-arm64": "0.28.1",
+        "@esbuild/linux-ia32": "0.28.1",
+        "@esbuild/linux-loong64": "0.28.1",
+        "@esbuild/linux-mips64el": "0.28.1",
+        "@esbuild/linux-ppc64": "0.28.1",
+        "@esbuild/linux-riscv64": "0.28.1",
+        "@esbuild/linux-s390x": "0.28.1",
+        "@esbuild/linux-x64": "0.28.1",
+        "@esbuild/netbsd-arm64": "0.28.1",
+        "@esbuild/netbsd-x64": "0.28.1",
+        "@esbuild/openbsd-arm64": "0.28.1",
+        "@esbuild/openbsd-x64": "0.28.1",
+        "@esbuild/openharmony-arm64": "0.28.1",
+        "@esbuild/sunos-x64": "0.28.1",
+        "@esbuild/win32-arm64": "0.28.1",
+        "@esbuild/win32-ia32": "0.28.1",
+        "@esbuild/win32-x64": "0.28.1"
      }
    },
    "node_modules/escape-string-regexp": {
@@ -1,17 +1,19 @@
 {
  "name": "koalasync",
-  "version": "2.2.0",
+  "version": "2.5.0",
  "description": "KoalaSync Build Scripts",
  "private": true,
+  "type": "module",
  "scripts": {
-    "build:extension": "node scripts/build-extension.js",
+    "build:extension": "node scripts/build-extension.cjs",
    "lint": "eslint .",
    "lint:fix": "eslint . --fix",
+    "test": "node scripts/verify-release.mjs",
    "verify": "node scripts/verify-release.mjs"
  },
  "devDependencies": {
    "archiver": "^7.0.1",
-    "esbuild": "^0.28.0",
+    "esbuild": "^0.28.1",
    "eslint": "^10.4.0",
    "fs-extra": "^11.2.0",
    "sharp": "^0.34.5",
@@ -2,7 +2,7 @@

 This directory contains utility scripts for the KoalaSync development workflow.

-## build-extension.js
+## build-extension.cjs

 The primary build tool for KoalaSync. This Node.js script automates two critical tasks:

@@ -15,7 +15,7 @@ The primary build tool for KoalaSync. This Node.js script automates two critical
 From the **repository root**, run:

 ```bash
-node scripts/build-extension.js
+node scripts/build-extension.cjs
 ```

 ### Why this script exists
@@ -38,7 +38,7 @@ const baseManifest = JSON.parse(fs.readFileSync(baseManifestPath, 'utf8'));

 // Helper to copy files, ignoring manifest.json and manifest.base.json
 // Also injects shared constants into content.js
-function copyExtensionFiles(targetDir) {
+function copyExtensionFiles(targetDir, browserName) {
  fs.mkdirSync(targetDir, { recursive: true });
  
  // Read master constants for injection
@@ -77,7 +77,7 @@ function copyExtensionFiles(targetDir) {
        const eStart = '// --- SHARED_EVENTS_INJECT_START ---';
        const eEnd = '// --- SHARED_EVENTS_INJECT_END ---';
        const ePattern = new RegExp(`${eStart}[\\s\\S]+?${eEnd}`);
-        const eRep = `${eStart}\n    // This block is automatically updated by /scripts/build-extension.js\n    const EVENTS = ${eventsObject};\n    ${eEnd}`;
+        const eRep = `${eStart}\n    // This block is automatically updated by /scripts/build-extension.cjs\n    const EVENTS = ${eventsObject};\n    ${eEnd}`;
        
        if (ePattern.test(content)) {
          content = content.replace(ePattern, eRep);
@@ -97,8 +97,49 @@ function copyExtensionFiles(targetDir) {
          console.warn('⚠️ WARNING: Heartbeat markers not found in content.js');
        }

+        // 3. Inject Episode Utils
+        const euStart = '// --- SHARED_EPISODE_UTILS_INJECT_START ---';
+        const euEnd = '// --- SHARED_EPISODE_UTILS_INJECT_END ---';
+        const euPattern = new RegExp(euStart.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + '[\\s\\S]+?' + euEnd.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
+        const euPath = path.join(rootDir, 'extension', 'episode-utils.js');
+        if (fs.existsSync(euPath)) {
+          const euContent = fs.readFileSync(euPath, 'utf8');
+          const stripped = euContent
+            .replace(/^\/\*\*[\s\S]*?\*\/\s*/m, '')
+            .replace(/export function /g, 'function ')
+            .trim();
+          const euRep = `${euStart}\n    // This block is automatically updated by /scripts/build-extension.cjs\n${stripped.split('\n').map(l => '    ' + l).join('\n')}\n    ${euEnd}`;
+          if (euPattern.test(content)) {
+            content = content.replace(euPattern, euRep);
+          } else {
+            console.warn('⚠ WARNING: Episode utils markers not found in content.js');
+          }
+        }
+
        fs.writeFileSync(destPath, content);
        console.log('✓ Injected shared constants into content.js');
+      } else if (item === 'background.js') {
+        let content = fs.readFileSync(srcPath, 'utf8');
+        
+        // 3. Inject Uninstall URL Constants
+        const uStart = '// --- UNINSTALL_URL_INJECT_START ---';
+        const uEnd = '// --- UNINSTALL_URL_INJECT_END ---';
+        const uPattern = new RegExp(`${uStart}[\\s\\S]+?${uEnd}`);
+        const placeholderUrl = "https://bye.koalastuff.net/c/camp_99ztjRVbK1BNN2RU";
+        
+        let uRep = `${uStart}\n        // This block is automatically updated by /scripts/build-extension.cjs\n`;
+        uRep += `        const UNINSTALL_URL = "${placeholderUrl}";\n`;
+        uRep += `        const BROWSER_TYPE = "${browserName}";\n`;
+        uRep += `        ${uEnd}`;
+        
+        if (uPattern.test(content)) {
+          content = content.replace(uPattern, uRep);
+        } else {
+          console.warn('⚠️ WARNING: Uninstall URL markers not found in background.js');
+        }
+
+        fs.writeFileSync(destPath, content);
+        console.log(`✓ Injected uninstall URL constants for ${browserName} into background.js`);
      } else {
        fs.copyFileSync(srcPath, destPath);
      }
@@ -127,7 +168,7 @@ async function buildBrowser(browserName, manifestModifier) {
  const browserDistDir = path.join(distDir, browserName);
  
  // 1. Copy files
-  copyExtensionFiles(browserDistDir);
+  copyExtensionFiles(browserDistDir, browserName);
  
  // 2. Modify and write manifest
  const browserManifest = manifestModifier(JSON.parse(JSON.stringify(baseManifest)));
@@ -0,0 +1,76 @@
+import assert from 'node:assert/strict';
+import { extractEpisodeId, sameEpisode } from '../extension/episode-utils.js';
+
+// --- extractEpisodeId ---
+
+// Standard SxxExx patterns
+assert.equal(extractEpisodeId('S01E01'), 'S01E01');
+assert.equal(extractEpisodeId('S1E1'), 'S01E01');
+assert.equal(extractEpisodeId('s01e01'), 'S01E01', 'case insensitive');
+assert.equal(extractEpisodeId('Season 1 Episode 2'), 'S01E02');
+assert.equal(extractEpisodeId('season 01 episode 02'), 'S01E02');
+
+// Separators: dash, dot, slash, colon, space, comma
+assert.equal(extractEpisodeId('S01 - E01'), 'S01E01', 'dash separator');
+assert.equal(extractEpisodeId('S01.E01'), 'S01E01', 'dot separator');
+assert.equal(extractEpisodeId('S01/E01'), 'S01E01', 'slash separator (Crunchyroll)');
+assert.equal(extractEpisodeId('S01:E01'), 'S01E01', 'colon separator');
+assert.equal(extractEpisodeId('S01,E01'), 'S01E01', 'comma separator');
+assert.equal(extractEpisodeId('S01 E01'), 'S01E01', 'space separator');
+
+// German / multi-language
+assert.equal(extractEpisodeId('Folge 5'), 'EP005');
+assert.equal(extractEpisodeId('Episode 12'), 'EP012');
+assert.equal(extractEpisodeId('Ep. 3'), 'EP003');
+assert.equal(extractEpisodeId('#42'), 'EP042');
+
+// Edge cases
+assert.equal(extractEpisodeId(null), null);
+assert.equal(extractEpisodeId(undefined), null);
+assert.equal(extractEpisodeId(''), null);
+assert.equal(extractEpisodeId(123), null);
+assert.equal(extractEpisodeId('Some Movie Title'), null);
+assert.equal(extractEpisodeId('Breaking Bad'), null);
+
+// Leading zeros preserved
+assert.equal(extractEpisodeId('S01E001'), 'S01E001');
+
+// --- sameEpisode ---
+
+// Identical episodes
+assert.equal(sameEpisode('S01E01', 'S01E01'), true);
+assert.equal(sameEpisode('S01E01 - Pilot', 'S01E01'), true, 'extra text ignored');
+assert.equal(sameEpisode('Folge 5', 'Episode 5'), true, 'German vs English');
+
+// Different episodes
+assert.equal(sameEpisode('S01E01', 'S01E02'), false);
+assert.equal(sameEpisode('Folge 1', 'Folge 2'), false);
+assert.equal(sameEpisode('S01E01', 'S02E01'), false);
+
+// Both unknown → assume same (backward compat)
+assert.equal(sameEpisode(null, null), true);
+assert.equal(sameEpisode(undefined, undefined), true);
+assert.equal(sameEpisode('', ''), true);
+assert.equal(sameEpisode('Some Movie', 'Some Movie'), true);
+assert.equal(sameEpisode('Some Movie', 'Other Movie'), false, 'different unknowns differ');
+
+// One unknown, one known → different
+assert.equal(sameEpisode('S01E01', null), false);
+assert.equal(sameEpisode(null, 'Episode 5'), false);
+assert.equal(sameEpisode(undefined, 'S01E01'), false);
+
+// Mixed formats — only match when the same episode
+assert.equal(sameEpisode('S01E05', 'S01E05'), true, 'same SxxExx');
+assert.equal(sameEpisode('Folge 5', 'Episode 5'), true, 'German Folge vs English Episode');
+assert.equal(sameEpisode('Episode 12', 'Ep. 12'), true, 'Episode X vs Ep. X');
+assert.equal(sameEpisode('#42', 'Folge 42'), true, '#X vs Folge X');
+
+// Different format IDs → different (season-tagged vs seasonless)
+assert.equal(sameEpisode('S01E05', 'Episode 5'), false, 'SxxExx vs Episode X: different IDs');
+assert.equal(sameEpisode('S01E01', 'EP001'), false, 'SxxExx vs EPxxx: different IDs');
+
+// parseable but truly different
+assert.equal(sameEpisode('S01E01', 'S01E02'), false, 'different episodes');
+assert.equal(sameEpisode('S01E01', 'S02E01'), false, 'different seasons');
+
+console.log('episode-utils tests passed');
@@ -0,0 +1,245 @@
+const fs = require('fs');
+const path = require('path');
+
+const localesDir = path.join(__dirname, '..', 'extension', 'locales');
+const enPath = path.join(localesDir, 'en.json');
+
+if (!fs.existsSync(enPath)) {
+  console.error('CRITICAL: en.json is missing!');
+  process.exit(1);
+}
+
+let hasError = false;
+
+// Verify SUPPORTED_LANGUAGES in extension/i18n.js matches JSON files
+const i18nPath = path.join(__dirname, '..', 'extension', 'i18n.js');
+try {
+  if (fs.existsSync(i18nPath)) {
+    const i18nContent = fs.readFileSync(i18nPath, 'utf8');
+    const langMatch = i18nContent.match(/export const SUPPORTED_LANGUAGES = \[(.*?)\];/);
+    if (!langMatch) {
+      hasError = true;
+      console.error('❌ Could not parse SUPPORTED_LANGUAGES from extension/i18n.js');
+    } else {
+      const supportedLangs = langMatch[1].split(',').map(s => s.trim().replace(/['"]/g, ''));
+      const fileLangs = fs.readdirSync(localesDir)
+        .filter(file => file.endsWith('.json'))
+        .map(file => file.replace('.json', ''));
+
+      for (const lang of fileLangs) {
+        if (!supportedLangs.includes(lang)) {
+          hasError = true;
+          console.error(`❌ ${lang}.json exists in extension/locales but is missing from SUPPORTED_LANGUAGES in extension/i18n.js`);
+        }
+      }
+      for (const lang of supportedLangs) {
+        if (!fileLangs.includes(lang)) {
+          hasError = true;
+          console.error(`❌ ${lang} is in SUPPORTED_LANGUAGES in extension/i18n.js but ${lang}.json is missing from extension/locales`);
+        }
+      }
+    }
+  }
+} catch (err) {
+  hasError = true;
+  console.error('❌ Failed to verify SUPPORTED_LANGUAGES synchronization:', err.message);
+}
+
+const enDict = JSON.parse(fs.readFileSync(enPath, 'utf8'));
+const enKeys = Object.keys(enDict);
+
+const localeFiles = fs.readdirSync(localesDir).filter(file => file.endsWith('.json'));
+
+console.log(`Auditing i18n locales using ${enKeys.length} baseline keys from en.json...\n`);
+
+for (const file of localeFiles) {
+  const filePath = path.join(localesDir, file);
+  try {
+    const raw = fs.readFileSync(filePath, 'utf8');
+
+    // Check for duplicate keys in raw JSON before parsing
+    const keyRe = /"(\w+)"\s*:/g;
+    const seenKeys = {};
+    let dupes = [];
+    let m;
+    while ((m = keyRe.exec(raw)) !== null) {
+      if (seenKeys[m[1]]) {
+        dupes.push(m[1]);
+      }
+      seenKeys[m[1]] = true;
+    }
+    if (dupes.length > 0) {
+      hasError = true;
+      console.error(`❌ ${file} has duplicate keys: ${[...new Set(dupes)].join(', ')}`);
+      continue;
+    }
+
+    const dict = JSON.parse(raw);
+    const keys = Object.keys(dict);
+
+    const missingKeys = enKeys.filter(k => !keys.includes(k));
+    const extraKeys = keys.filter(k => !enKeys.includes(k));
+    const emptyKeys = keys.filter(k => typeof dict[k] === 'string' && dict[k].trim() === '');
+    const placeholderKeys = keys.filter(k => {
+      if (typeof dict[k] !== 'string') return false;
+      const val = dict[k];
+      const lower = val.toLowerCase();
+      return (
+        lower.includes('placeholder') ||
+        lower.includes('todo:') ||
+        lower.includes('tbd:') ||
+        /\bTODO\b/.test(val) ||
+        /\bTBD\b/.test(val)
+      );
+    });
+
+    if (missingKeys.length > 0 || extraKeys.length > 0 || emptyKeys.length > 0 || placeholderKeys.length > 0) {
+      hasError = true;
+      console.error(`❌ ${file} has inconsistencies:`);
+      if (missingKeys.length > 0) {
+        console.error(`  Missing keys (${missingKeys.length}):`, missingKeys);
+      }
+      if (extraKeys.length > 0) {
+        console.error(`  Extra keys (${extraKeys.length}):`, extraKeys);
+      }
+      if (emptyKeys.length > 0) {
+        console.error(`  Empty translation values (${emptyKeys.length}):`, emptyKeys);
+      }
+      if (placeholderKeys.length > 0) {
+        console.error(`  Placeholder/TODO values (${placeholderKeys.length}):`, placeholderKeys);
+      }
+    } else {
+      console.log(`✓ ${file} is fully consistent (matches all keys).`);
+    }
+  } catch (err) {
+    hasError = true;
+    console.error(`❌ Failed to parse ${file}:`, err.message);
+  }
+}
+
+// ──────────────────────────────────────
+// Verify Chrome _locales/*/messages.json
+// ──────────────────────────────────────
+console.log('\nVerifying Chrome _locales/messages.json structure...\n');
+
+const chromeLocalesDir = path.join(__dirname, '..', 'extension', '_locales');
+
+// Map custom locale codes to Chrome's underscore format
+const chromeLocaleMap = {
+  'en': 'en', 'de': 'de', 'fr': 'fr', 'es': 'es', 'it': 'it',
+  'ja': 'ja', 'ko': 'ko', 'nl': 'nl', 'pl': 'pl',
+  'pt-BR': 'pt_BR', 'pt': 'pt_PT', 'ru': 'ru', 'tr': 'tr',
+  'zh': 'zh_CN', 'uk': 'uk'
+};
+
+// Read SUPPORTED_LANGUAGES from i18n.js
+const i18nContent = fs.readFileSync(i18nPath, 'utf8');
+const langMatch = i18nContent.match(/export const SUPPORTED_LANGUAGES = \[(.*?)\];/);
+const supportedLangs = langMatch
+  ? langMatch[1].split(',').map(s => s.trim().replace(/['"]/g, ''))
+  : [];
+
+// Verify default_locale in manifest.base.json
+const manifestPath = path.join(__dirname, '..', 'extension', 'manifest.base.json');
+try {
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  if (!manifest.default_locale) {
+    hasError = true;
+    console.error('❌ manifest.base.json is missing "default_locale"');
+  } else if (manifest.default_locale !== 'en') {
+    hasError = true;
+    console.error(`❌ manifest.base.json default_locale is "${manifest.default_locale}", expected "en"`);
+  } else {
+    console.log('✓ manifest.base.json has default_locale: "en"');
+  }
+} catch (err) {
+  hasError = true;
+  console.error('❌ Failed to read manifest.base.json:', err.message);
+}
+
+// Verify _locales structure for each supported language
+const expectedKeys = ['appName', 'appDesc'];
+for (const lang of supportedLangs) {
+  const chromeLocale = chromeLocaleMap[lang];
+  if (!chromeLocale) {
+    hasError = true;
+    console.error(`❌ No Chrome locale mapping for "${lang}" in chromeLocaleMap`);
+    continue;
+  }
+
+  const msgPath = path.join(chromeLocalesDir, chromeLocale, 'messages.json');
+
+  if (!fs.existsSync(msgPath)) {
+    hasError = true;
+    console.error(`❌ Missing _locales/${chromeLocale}/messages.json for language "${lang}"`);
+    continue;
+  }
+
+  try {
+    const raw = fs.readFileSync(msgPath, 'utf8');
+    const messages = JSON.parse(raw);
+    const keys = Object.keys(messages);
+
+    // Detect duplicate top-level keys via regex (JSON.parse silently keeps last value)
+    const topKeyRe = /^\s{2}"(\w+)"\s*:/gm;
+    const topSeen = {};
+    let topDupes = [];
+    let tm;
+    while ((tm = topKeyRe.exec(raw)) !== null) {
+      if (topSeen[tm[1]]) topDupes.push(tm[1]);
+      topSeen[tm[1]] = true;
+    }
+    if (topDupes.length > 0) {
+      hasError = true;
+      console.error(`❌ _locales/${chromeLocale}/messages.json has duplicate keys: ${[...new Set(topDupes)].join(', ')}`);
+      continue;
+    }
+
+    // Validate each entry has a "message" field
+    for (const key of keys) {
+      if (!messages[key].message || typeof messages[key].message !== 'string') {
+        hasError = true;
+        console.error(`❌ _locales/${chromeLocale}/messages.json: "${key}" is missing a valid "message" field`);
+      }
+    }
+
+    // Check for missing or extra keys vs expected baseline
+    const missing = expectedKeys.filter(k => !keys.includes(k));
+    const extra = keys.filter(k => !expectedKeys.includes(k));
+    if (missing.length > 0) {
+      hasError = true;
+      console.error(`❌ _locales/${chromeLocale}/messages.json missing keys: ${missing.join(', ')}`);
+    }
+    if (extra.length > 0) {
+      console.log(`ℹ️  _locales/${chromeLocale}/messages.json has extra keys (ok): ${extra.join(', ')}`);
+    }
+    if (missing.length === 0) {
+      console.log(`✓ _locales/${chromeLocale}/messages.json is valid and complete`);
+    }
+  } catch (err) {
+    hasError = true;
+    console.error(`❌ Failed to parse _locales/${chromeLocale}/messages.json:`, err.message);
+  }
+}
+
+// Detect orphan _locales directories (no matching supported language)
+if (fs.existsSync(chromeLocalesDir)) {
+  const chromeCodes = supportedLangs.map(l => chromeLocaleMap[l]).filter(Boolean);
+  const dirs = fs.readdirSync(chromeLocalesDir);
+  for (const dir of dirs) {
+    const dirPath = path.join(chromeLocalesDir, dir);
+    if (fs.statSync(dirPath).isDirectory() && dir !== '.git' && !chromeCodes.includes(dir)) {
+      hasError = true;
+      console.error(`❌ Orphan _locales/${dir}/ directory exists but no matching language in SUPPORTED_LANGUAGES`);
+    }
+  }
+}
+
+console.log('');
+if (hasError) {
+  console.error('❌ Locale consistency check failed! Please fix the errors listed above.');
+  process.exit(1);
+} else {
+  console.log('🎉 All locale files (locales/ and _locales/) are valid and consistent!');
+  process.exit(0);
+}
@@ -1,108 +0,0 @@
-const fs = require('fs');
-const path = require('path');
-
-const localesDir = path.join(__dirname, '..', 'extension', 'locales');
-const enPath = path.join(localesDir, 'en.json');
-
-if (!fs.existsSync(enPath)) {
-  console.error('CRITICAL: en.json is missing!');
-  process.exit(1);
-}
-
-let hasError = false;
-
-// Verify SUPPORTED_LANGUAGES in extension/i18n.js matches JSON files
-const i18nPath = path.join(__dirname, '..', 'extension', 'i18n.js');
-try {
-  if (fs.existsSync(i18nPath)) {
-    const i18nContent = fs.readFileSync(i18nPath, 'utf8');
-    const langMatch = i18nContent.match(/export const SUPPORTED_LANGUAGES = \[(.*?)\];/);
-    if (!langMatch) {
-      hasError = true;
-      console.error('❌ Could not parse SUPPORTED_LANGUAGES from extension/i18n.js');
-    } else {
-      const supportedLangs = langMatch[1].split(',').map(s => s.trim().replace(/['"]/g, ''));
-      const fileLangs = fs.readdirSync(localesDir)
-        .filter(file => file.endsWith('.json'))
-        .map(file => file.replace('.json', ''));
-
-      for (const lang of fileLangs) {
-        if (!supportedLangs.includes(lang)) {
-          hasError = true;
-          console.error(`❌ ${lang}.json exists in extension/locales but is missing from SUPPORTED_LANGUAGES in extension/i18n.js`);
-        }
-      }
-      for (const lang of supportedLangs) {
-        if (!fileLangs.includes(lang)) {
-          hasError = true;
-          console.error(`❌ ${lang} is in SUPPORTED_LANGUAGES in extension/i18n.js but ${lang}.json is missing from extension/locales`);
-        }
-      }
-    }
-  }
-} catch (err) {
-  hasError = true;
-  console.error('❌ Failed to verify SUPPORTED_LANGUAGES synchronization:', err.message);
-}
-
-const enDict = JSON.parse(fs.readFileSync(enPath, 'utf8'));
-const enKeys = Object.keys(enDict);
-
-const localeFiles = fs.readdirSync(localesDir).filter(file => file.endsWith('.json') && file !== 'en.json');
-
-console.log(`Auditing i18n locales using ${enKeys.length} baseline keys from en.json...\n`);
-
-for (const file of localeFiles) {
-  const filePath = path.join(localesDir, file);
-  try {
-    const raw = fs.readFileSync(filePath, 'utf8');
-
-    // Check for duplicate keys in raw JSON before parsing
-    const keyRe = /"(\w+)"\s*:/g;
-    const seenKeys = {};
-    let dupes = [];
-    let m;
-    while ((m = keyRe.exec(raw)) !== null) {
-      if (seenKeys[m[1]]) {
-        dupes.push(m[1]);
-      }
-      seenKeys[m[1]] = true;
-    }
-    if (dupes.length > 0) {
-      hasError = true;
-      console.error(`❌ ${file} has duplicate keys: ${[...new Set(dupes)].join(', ')}`);
-      continue;
-    }
-
-    const dict = JSON.parse(raw);
-    const keys = Object.keys(dict);
-
-    const missingKeys = enKeys.filter(k => !keys.includes(k));
-    const extraKeys = keys.filter(k => !enKeys.includes(k));
-
-    if (missingKeys.length > 0 || extraKeys.length > 0) {
-      hasError = true;
-      console.error(`❌ ${file} has inconsistencies:`);
-      if (missingKeys.length > 0) {
-        console.error(`  Missing keys (${missingKeys.length}):`, missingKeys);
-      }
-      if (extraKeys.length > 0) {
-        console.error(`  Extra keys (${extraKeys.length}):`, extraKeys);
-      }
-    } else {
-      console.log(`✓ ${file} is fully consistent (matches all keys).`);
-    }
-  } catch (err) {
-    hasError = true;
-    console.error(`❌ Failed to parse ${file}:`, err.message);
-  }
-}
-
-console.log('');
-if (hasError) {
-  console.error('❌ Locale consistency check failed! Please fix the errors listed above.');
-  process.exit(1);
-} else {
-  console.log('🎉 All locale files are perfectly synchronized and consistent!');
-  process.exit(0);
-}
@@ -0,0 +1,56 @@
+import assert from 'node:assert/strict';
+import { getAvatarForName, generateUsername, USERNAME_ADJECTIVES, USERNAME_NOUNS } from '../shared/names.js';
+
+// --- getAvatarForName (deterministic) ---
+
+// Exact matches
+assert.equal(getAvatarForName('Koala'), '🐨', 'Koala');
+assert.equal(getAvatarForName('Tiger'), '🐯', 'Tiger');
+assert.equal(getAvatarForName('Panda'), '🐼', 'Panda');
+assert.equal(getAvatarForName('Fox'), '🦊', 'Fox');
+
+// Case insensitive
+assert.equal(getAvatarForName('koala'), '🐨', 'lowercase');
+assert.equal(getAvatarForName('MyKoalaUser'), '🐨', 'embedded uppercase');
+
+// Longest match wins (caterpillar > cat)
+assert.equal(getAvatarForName('CaterpillarCat'), '🐛', 'caterpillar before cat');
+assert.equal(getAvatarForName('Cat'), '🐱', 'cat alone');
+
+// Emoji with ZWJ sequences (multi-codepoint)
+assert.equal(getAvatarForName('Polar'), '🐻\u200D❄️', 'polar bear ZWJ');
+assert.equal(getAvatarForName('Crow'), '🐦\u200D⬛', 'crow ZWJ');
+
+// Human-like characters
+assert.equal(getAvatarForName('Ninja'), '🥷', 'ninja');
+assert.equal(getAvatarForName('Wizard'), '🧙', 'wizard');
+assert.equal(getAvatarForName('Pirate'), '🏴', 'pirate');
+assert.equal(getAvatarForName('Alien'), '👾', 'alien');
+assert.equal(getAvatarForName('Robot'), '🤖', 'robot');
+
+// Fallback
+assert.equal(getAvatarForName(''), '👤', 'empty string');
+assert.equal(getAvatarForName('Xyzzy123'), '👤', 'unknown name');
+assert.equal(getAvatarForName(null), '👤', 'null');
+assert.equal(getAvatarForName(undefined), '👤', 'undefined');
+
+// --- generateUsername (format check) ---
+for (let i = 0; i < 10; i++) {
+    const name = generateUsername();
+    // Format: AdjectiveNoun (e.g. "HappyKoala")
+    assert.ok(/^[A-Z][a-z]+[A-Z][a-z]+$/.test(name), `format: ${name}`);
+    // Adjective from list
+    const adj = USERNAME_ADJECTIVES.some(a => name.startsWith(a));
+    assert.ok(adj, `adjective from list: ${name}`);
+    // Noun from list
+    const noun = USERNAME_NOUNS.some(n => name.endsWith(n));
+    assert.ok(noun, `noun from list: ${name}`);
+}
+
+// Every noun has an emoji (no broken usernames)
+for (const noun of USERNAME_NOUNS) {
+    const avatar = getAvatarForName(noun);
+    assert.notEqual(avatar, '👤', `noun "${noun}" has no emoji — add to ANIMAL_EMOJI_MAP`);
+}
+
+console.log('names tests passed');
@@ -0,0 +1,114 @@
+import assert from 'node:assert/strict';
+import {
+    checkConnectionRate,
+    checkEventRate,
+    checkHealthRate,
+    checkAdminMetricsAuthRate,
+    checkAuthRate,
+    recordAuthFailure,
+    clearRateLimitMaps,
+    connectionCounts,
+    failedAuthAttempts,
+    eventCounts,
+    healthCounts,
+    adminMetricsAuthCounts,
+    roomListCooldowns,
+    rateLimitDenied,
+    startRateLimitCleanup,
+    stopRateLimitCleanup,
+    CONNECTION_RATE_LIMIT,
+    EVENT_RATE_LIMIT
+} from '../server/rate-limiter.js';
+
+// Helper: mock io for cleanup
+const mockIo = { sockets: { sockets: new Map() } };
+
+// Reset state before each test group
+function reset() {
+    clearRateLimitMaps();
+    Object.assign(rateLimitDenied, { connections: 0, events: 0, health: 0, adminMetricsAuth: 0, roomList: 0 });
+    stopRateLimitCleanup();
+}
+
+// --- checkConnectionRate ---
+reset();
+assert.equal(checkConnectionRate('1.1.1.1'), true, 'first connection allowed');
+// Exhaust the rest of the budget (first call above counted as 1).
+for (let i = 0; i < CONNECTION_RATE_LIMIT - 1; i++) checkConnectionRate('1.1.1.1');
+assert.equal(checkConnectionRate('1.1.1.1'), false, `connection beyond ${CONNECTION_RATE_LIMIT}/window blocked`);
+assert.equal(rateLimitDenied.connections, 1, 'denial counter incremented');
+
+reset();
+assert.equal(checkConnectionRate('2.2.2.2'), true, 'separate IP independent');
+
+// --- checkEventRate ---
+reset();
+assert.equal(checkEventRate('sock1'), true, 'first event allowed');
+// Exhaust the rest of the budget (first call above counted as 1).
+for (let i = 0; i < EVENT_RATE_LIMIT - 1; i++) checkEventRate('sock1');
+assert.equal(checkEventRate('sock1'), false, `event beyond ${EVENT_RATE_LIMIT}/window blocked`);
+assert.equal(rateLimitDenied.events, 1);
+
+reset();
+assert.equal(checkEventRate('sock2'), true, 'separate socket independent');
+
+// --- checkHealthRate ---
+reset();
+assert.equal(checkHealthRate('1.2.3.4'), true, 'first health check allowed');
+for (let i = 0; i < 9; i++) checkHealthRate('1.2.3.4');
+assert.equal(checkHealthRate('1.2.3.4'), false, '11th health check blocked');
+assert.equal(rateLimitDenied.health, 1);
+
+// --- checkAdminMetricsAuthRate ---
+reset();
+assert.equal(checkAdminMetricsAuthRate('5.6.7.8'), true, 'first admin auth allowed');
+for (let i = 0; i < 4; i++) checkAdminMetricsAuthRate('5.6.7.8');
+assert.equal(checkAdminMetricsAuthRate('5.6.7.8'), false, '6th admin auth blocked');
+assert.equal(rateLimitDenied.adminMetricsAuth, 1);
+
+// --- checkAuthRate ---
+reset();
+assert.equal(checkAuthRate('10.0.0.1', 'room-a'), true, 'first auth attempt allowed');
+for (let i = 0; i < 5; i++) recordAuthFailure('10.0.0.1', 'room-a');
+assert.equal(checkAuthRate('10.0.0.1', 'room-a'), false, '6th auth attempt blocked');
+assert.equal(checkAuthRate('10.0.0.1', 'room-b'), true, 'different room not blocked');
+
+// --- recordAuthFailure ---
+reset();
+recordAuthFailure('10.0.0.2', 'room-x');
+assert.equal(failedAuthAttempts.size, 1, 'failure recorded');
+const record = failedAuthAttempts.get('10.0.0.2:room-x');
+assert.equal(record.count, 1, 'count incremented');
+assert.ok(record.lastAttempt <= Date.now(), 'timestamp set');
+
+recordAuthFailure('10.0.0.2', 'room-x');
+assert.equal(failedAuthAttempts.get('10.0.0.2:room-x').count, 2, 'count increments on repeat');
+
+// --- clearRateLimitMaps ---
+reset();
+connectionCounts.set('ip1', { count: 1, resetTime: Date.now() + 60000 });
+eventCounts.set('sock1', { count: 1, resetTime: Date.now() + 10000 });
+healthCounts.set('ip2', { count: 1, resetTime: Date.now() + 60000 });
+adminMetricsAuthCounts.set('ip3', { count: 1, resetTime: Date.now() + 60000 });
+roomListCooldowns.set('sock2', Date.now());
+clearRateLimitMaps();
+assert.equal(connectionCounts.size, 0, 'connectionCounts cleared');
+assert.equal(eventCounts.size, 0, 'eventCounts cleared');
+assert.equal(healthCounts.size, 0, 'healthCounts cleared');
+assert.equal(adminMetricsAuthCounts.size, 0, 'adminMetricsAuthCounts cleared');
+assert.equal(roomListCooldowns.size, 0, 'roomListCooldowns cleared');
+
+// --- startRateLimitCleanup / stopRateLimitCleanup ---
+reset();
+startRateLimitCleanup(mockIo);
+startRateLimitCleanup(mockIo); // double-start guard
+stopRateLimitCleanup();
+assert.ok(true, 'cleanup start/stop does not throw');
+
+// --- rateLimitDenied reset ---
+reset();
+rateLimitDenied.connections = 5;
+Object.assign(rateLimitDenied, { connections: 0, events: 0, health: 0, adminMetricsAuth: 0, roomList: 0 });
+assert.equal(rateLimitDenied.connections, 0, 'denial counter resettable');
+
+console.log('rate-limiter tests passed');
@@ -77,9 +77,12 @@ assert.equal(adminHealth.avgPeersPerRoom, 2.5, 'admin metrics should include ave
 assert.equal(adminHealth.maxPeersInRoom, 3, 'admin metrics should include max room size');
 assert.deepEqual(adminHealth.memory, { rss: 10, heapUsed: 5, heapTotal: 8 }, 'admin metrics should expose process memory');
 assert.deepEqual(
-  adminHealth.rateLimitEntries,
-  { connections: 1, events: 2, health: 3, adminMetricsAuth: 4, authFailures: 5, roomList: 6 },
-  'admin metrics should expose aggregate rate-limit map sizes'
+  adminHealth.rateLimits,
+  {
+    trackedClients: { connections: 1, events: 2, health: 3, adminMetricsAuth: 4, authFailures: 5, roomList: 6 },
+    denied: { connections: 0, events: 0, health: 0, adminMetricsAuth: 0, roomList: 0 }
+  },
+  'admin metrics should expose rate-limit tracking and denial counts'
 );

 console.log('server ops tests passed');
@@ -1,5 +1,8 @@
 import assert from 'node:assert/strict';
-import {
+
+// Must set env before dynamic import — ESM hoists static imports
+process.env.ADMIN_METRICS_TOKEN = process.env.ADMIN_METRICS_TOKEN || 'test-admin-token-with-more-than-32-chars';
+const {
  ADMIN_METRICS_AUTH_RATE_LIMIT_PER_MINUTE,
  HEALTH_RATE_LIMIT_PER_MINUTE,
  healthCounts,
@@ -9,9 +12,9 @@ import {
  rooms,
  startServer,
  stopServerForTests
-} from '../server/index.js';
+} = await import('../server/index.js');

-const adminToken = process.env.ADMIN_METRICS_TOKEN || 'test-admin-token-with-more-than-32-chars';
+const adminToken = process.env.ADMIN_METRICS_TOKEN;
 const baseHeaders = { 'x-forwarded-for': '203.0.113.10' };

 function url(path) {
@@ -0,0 +1,418 @@
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+import { connectionCounts, clearRateLimitMaps } from '../server/rate-limiter.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const require = createRequire(path.join(__dirname, '..', 'server', 'package.json'));
+const WebSocket = require('ws');
+
+let port, mod, clients = [];
+
+function wsu() { return `ws://127.0.0.1:${port}/socket.io/?EIO=4&transport=websocket&version=2.4.0&token=62170b705234c4f4807a9b22420bb93cf1a2aacfa4c5d3b47804482babb8eb50`; }
+async function c() {
+    const ws = new WebSocket(wsu()); clients.push(ws); ws._m = []; ws.on('message', d => ws._m.push(d.toString()));
+    await new Promise((r, j) => { const t = setTimeout(() => j(Error('connect')), 5e3); ws.on('open', () => { clearTimeout(t); r(); }); });
+    ws.send('40'); const s = Date.now(); while (ws._m.length < 2 && Date.now()-s < 5e3) await new Promise(r => setTimeout(r, 50));
+    if (ws._m.length < 2) throw Error('handshake');
+    ws._m.length = 0; return ws;
+}
+function s(ws, evt, d={}) { ws.send(`42${JSON.stringify([evt,d])}`); }
+function a(ws) { if (ws._m.length) { const r=ws._m.shift(); return r.startsWith('42') ? JSON.parse(r.substring(2)) : r; } return new Promise((resolve, reject) => { const t=setTimeout(()=>reject(Error('timeout')),3e3); const h=(d)=>{clearTimeout(t);ws.removeListener('message',h);const r=d.toString();resolve(r.startsWith('42')?JSON.parse(r.substring(2)):r);};ws.on('message',h);}); }
+async function w(ws, evt, ms=3000) { const st=Date.now(); while(Date.now()-st<ms) { for(let i=0;i<ws._m.length;i++){const r=ws._m[i];ws._m.splice(i,1);if(r.startsWith('42')){try{const[e]=JSON.parse(r.substring(2));if(e===evt)return e}catch{/* skip */}}} await new Promise(r=>setTimeout(r,50));} throw Error(`wait:${evt}`); }
+async function j(ws, rid, pid, pw=null) { s(ws,'join_room',{roomId:rid,peerId:pid,password:pw,protocolVersion:'1.0.0'}); assert.equal((await a(ws))[0],'room_data'); }
+function close() { clients.forEach(w=>{try{w.close()}catch{/* ignore */}}); clients.length=0; }
+// Test suite opens >10 connections/min — clear the IP connection counter so the
+// connection rate limiter doesn't mask test failures (test-only, never at runtime).
+function resetConnectionRate() { connectionCounts.clear(); clearRateLimitMaps(); }
+
+try {
+    process.env.ADMIN_METRICS_TOKEN = 'ws-integration-test-32chars-minimum!';
+    mod = await import('../server/index.js');
+    await mod.startServer(0,'127.0.0.1');
+    port = mod.httpServer.address().port;
+
+    // --- Pool: 2 peers in 1 room, test everything ---
+    const rid = 't-'+Date.now();
+    const p1 = await c(), p2 = await c();
+
+    // Room + join
+    await j(p1, rid, 'a'); await j(p2, rid, 'b'); p1._m.length = p2._m.length = 0;
+
+    // Relay
+    s(p1,'play',{currentTime:10}); await w(p2,'play');
+    s(p1,'pause',{currentTime:20}); await w(p2,'pause');
+    s(p1,'seek',{currentTime:30}); await w(p2,'seek');
+
+    // Force Sync
+    s(p1,'force_sync_prepare',{targetTime:0}); await w(p2,'force_sync_prepare');
+    s(p1,'force_sync_ack',{}); await w(p2,'force_sync_ack');
+    s(p1,'force_sync_execute',{}); await w(p2,'force_sync_execute');
+
+    // EVENT_ACK
+    s(p2,'event_ack',{targetId:'a',actionTimestamp:Date.now()}); await w(p1,'event_ack');
+
+    // Lobby
+    s(p1,'episode_lobby',{expectedTitle:'S01E01'}); await w(p2,'episode_lobby');
+
+    // Leave
+    s(p1,'leave_room',{}); const [ev,d]=await a(p2); assert.equal(ev,'peer_status');assert.equal(d.status,'left');
+
+    close();
+    resetConnectionRate();
+
+    // --- Capabilities: ROOM_DATA advertises server features for client detection ---
+    const capClient = await c();
+    s(capClient, 'join_room', { roomId: 'cap-'+Date.now(), peerId: 'capp', protocolVersion: '1.0.0' });
+    const [capEv, capData] = await a(capClient);
+    assert.equal(capEv, 'room_data');
+    assert.ok(Array.isArray(capData.capabilities) && capData.capabilities.includes('host-control'),
+        'ROOM_DATA advertises the host-control capability');
+    close();
+    resetConnectionRate();
+
+    // --- Default 'everyone' mode does NOT gate anyone (host-control OFF = unchanged) ---
+    // Confirms that with host-only off, a non-host guest can still drive every
+    // room-moving event exactly like before the feature existed.
+    const erid = 'every-'+Date.now();
+    const e1 = await c(), e2 = await c();        // e1 = creator/host, e2 = guest
+    await j(e1, erid, 'ehost'); await j(e2, erid, 'eguest'); e1._m.length = e2._m.length = 0;
+    s(e2,'play',{currentTime:1});                 await w(e1,'play');
+    s(e2,'pause',{currentTime:2});                await w(e1,'pause');
+    s(e2,'seek',{currentTime:3});                 await w(e1,'seek');
+    s(e2,'force_sync_prepare',{targetTime:0});    await w(e1,'force_sync_prepare');
+    s(e2,'episode_lobby',{expectedTitle:'S1E1'}); await w(e1,'episode_lobby');
+    // (reaching here without a wait timeout == nothing was gated)
+    close();
+    resetConnectionRate();
+
+    // --- Host Control Mode ---
+    const hrid = 'host-'+Date.now();
+    const h1 = await c(), h2 = await c();          // h1 = host (first joiner), h2 = guest
+    await j(h1, hrid, 'host1'); await j(h2, hrid, 'guest1'); h1._m.length = h2._m.length = 0;
+
+    // Host enables host-only -> both peers get the control_mode broadcast
+    s(h1,'set_control_mode',{controlMode:'host-only'});
+    await w(h1,'control_mode'); await w(h2,'control_mode');
+    h1._m.length = h2._m.length = 0;
+
+    // Guest's room-moving event (pause) is dropped -> host must NOT receive it
+    s(h2,'pause',{currentTime:5});
+    let guestPauseDropped = false; try { await w(h1,'pause',600); } catch { guestPauseDropped = true; }
+    assert.ok(guestPauseDropped, 'guest pause dropped in host-only');
+
+    // Host's own pause still relays to the guest
+    s(h1,'pause',{currentTime:7}); await w(h2,'pause');
+    h1._m.length = h2._m.length = 0;
+
+    // desynced flag is relayed through PEER_STATUS heartbeats so the host's UI
+    // can show "Solo" for guests watching on their own.
+    s(h2,'peer_status',{status:'heartbeat',desynced:true,currentTime:42,playbackState:'playing'});
+    let hbData = null; const hbStart = Date.now();
+    while (Date.now()-hbStart < 600 && !hbData) {
+        for (let i=0;i<h1._m.length;i++){ const r=h1._m[i]; if(r.startsWith('42')){ const [e,dd]=JSON.parse(r.substring(2)); if(e==='peer_status'){ h1._m.splice(i,1); hbData=dd; break; } } }
+        await new Promise(r=>setTimeout(r,30));
+    }
+    assert.ok(hbData && hbData.desynced === true, 'desynced=true relayed in heartbeat');
+    h1._m.length = h2._m.length = 0;
+
+    // Guest cannot change the control mode -> host must NOT receive a broadcast.
+    // The rejected sender gets a unicast of the *actual* state so any optimistic
+    // UI reverts (H-5); assert both halves.
+    s(h2,'set_control_mode',{controlMode:'everyone'});
+    let guestSetBlocked = false; try { await w(h1,'control_mode',600); } catch { guestSetBlocked = true; }
+    assert.ok(guestSetBlocked, 'non-host cannot set control mode');
+    let rejectSync = null; const rsStart = Date.now();
+    while (Date.now()-rsStart < 600 && !rejectSync) {
+        for (let i=0;i<h2._m.length;i++){ const r=h2._m[i]; if(r.startsWith('42')){ const [e,dd]=JSON.parse(r.substring(2)); if(e==='control_mode'){ h2._m.splice(i,1); rejectSync=dd; break; } } }
+        await new Promise(r=>setTimeout(r,30));
+    }
+    assert.ok(rejectSync && rejectSync.controlMode==='host-only' && rejectSync.hostPeerId==='host1',
+        'rejected sender is re-synced to actual state');
+    h1._m.length = h2._m.length = 0;
+
+    // Host leaves -> room falls back to 'everyone' and reassigns host to the guest
+    s(h1,'leave_room',{});
+    let fb = null; const fbStart = Date.now();
+    while (Date.now()-fbStart < 2000 && !fb) {
+        for (let i=0;i<h2._m.length;i++){ const r=h2._m[i]; if(r.startsWith('42')){ const [e,dd]=JSON.parse(r.substring(2)); if(e==='control_mode'){ h2._m.splice(i,1); fb=dd; break; } } }
+        await new Promise(r=>setTimeout(r,50));
+    }
+    assert.ok(fb && fb.controlMode==='everyone' && fb.hostPeerId==='guest1', 'host leave -> fallback everyone + new host');
+    close();
+
+    // --- M-4: rapid control-mode toggles are debounced per-room ---
+    const drid = 'debounce-'+Date.now();
+    const db1 = await c(), db2 = await c();
+    await j(db1, drid, 'dhost'); await j(db2, drid, 'dguest'); db1._m.length = db2._m.length = 0;
+
+    // First toggle (everyone → host-only) goes through.
+    s(db1,'set_control_mode',{controlMode:'host-only'});
+    await w(db1,'control_mode'); await w(db2,'control_mode');
+    db1._m.length = db2._m.length = 0;
+
+    // Immediate second toggle (host-only → everyone) should be debounced:
+    // broadcast goes to neither peer, but sender gets a re-sync unicast.
+    s(db1,'set_control_mode',{controlMode:'everyone'});
+    let dGuestGotIt = false; try { await w(db2,'control_mode',600); } catch { dGuestGotIt = true; }
+    assert.ok(dGuestGotIt, 'rapid control-mode toggle is debounced (no broadcast)');
+    let dSenderResync = null; const dsStart = Date.now();
+    while (Date.now()-dsStart < 600 && !dSenderResync) {
+        for (let i=0;i<db1._m.length;i++){ const r=db1._m[i]; if(r.startsWith('42')){ const [e,dd]=JSON.parse(r.substring(2)); if(e==='control_mode'){ db1._m.splice(i,1); dSenderResync=dd; break; } } }
+        await new Promise(r=>setTimeout(r,30));
+    }
+    assert.ok(dSenderResync && dSenderResync.controlMode==='host-only',
+        'debounced toggle re-syncs sender to actual state');
+    close();
+    resetConnectionRate();
+
+    // --- Host role survives peerId dedup (reconnect / second tab) ---
+    const hdrid = 'dedup-host-'+Date.now();
+    const hd1 = await c(), hd2 = await c();
+    await j(hd1, hdrid, 'dhost'); await j(hd2, hdrid, 'dguest'); hd1._m.length = hd2._m.length = 0;
+    s(hd1,'set_control_mode',{controlMode:'host-only'});
+    await w(hd1,'control_mode'); await w(hd2,'control_mode');
+    hd1._m.length = hd2._m.length = 0;
+    // The host's peerId re-joins on a fresh socket → server dedupes the old socket.
+    // This must NOT demote the host or reset the mode (a network blip / second tab).
+    const hd3 = await c();
+    s(hd3,'join_room',{roomId:hdrid,peerId:'dhost',protocolVersion:'1.0.0'});
+    const hdrd = await a(hd3);
+    assert.equal(hdrd[0],'room_data');
+    assert.ok(hdrd[1].controlMode === 'host-only' && hdrd[1].hostPeerId === 'dhost',
+        'host role + host-only mode survive peerId dedup (reconnect/second tab)');
+    close();
+    resetConnectionRate();
+
+    // --- Co-Host: owner promotes a guest to controller (can drive); demote re-gates ---
+    const crid = 'cohost-'+Date.now();
+    const co1 = await c(), co2 = await c(), co3 = await c(); // owner / to-promote / stays guest
+    await j(co1, crid, 'owner'); await j(co2, crid, 'cohost'); await j(co3, crid, 'guestx');
+    co1._m.length = co2._m.length = co3._m.length = 0;
+    s(co1,'set_control_mode',{controlMode:'host-only'});
+    await w(co1,'control_mode'); await w(co2,'control_mode'); await w(co3,'control_mode');
+    co1._m.length = co2._m.length = co3._m.length = 0;
+    // before promotion the co-host is gated
+    s(co2,'pause',{currentTime:1});
+    let coGatedBefore=false; try { await w(co1,'pause',500); } catch { coGatedBefore=true; }
+    assert.ok(coGatedBefore, 'co-host gated before promotion');
+    // owner promotes co-host → controllers broadcast includes owner + cohost
+    s(co1,'set_peer_role',{peerId:'cohost',controller:true});
+    let promo=null; const pps=Date.now();
+    while(Date.now()-pps<800 && !promo){ for(let i=0;i<co2._m.length;i++){const r=co2._m[i];if(r.startsWith('42')){const[e,dd]=JSON.parse(r.substring(2));if(e==='control_mode'){co2._m.splice(i,1);promo=dd;break;}}} await new Promise(r=>setTimeout(r,30)); }
+    assert.ok(promo && Array.isArray(promo.controllers) && promo.controllers.includes('cohost') && promo.controllers.includes('owner'),
+        'promotion broadcasts controllers (owner + cohost)');
+    co1._m.length = co2._m.length = co3._m.length = 0;
+    // promoted co-host can now drive; a plain guest still cannot
+    s(co2,'pause',{currentTime:2}); await w(co1,'pause');
+    s(co3,'play',{currentTime:3});
+    let plainGuestGated=false; try { await w(co1,'play',500); } catch { plainGuestGated=true; }
+    assert.ok(plainGuestGated, 'plain guest still gated after a co-host is promoted');
+    co1._m.length = co2._m.length = co3._m.length = 0;
+    // a non-owner (the co-host) cannot promote anyone
+    s(co2,'set_peer_role',{peerId:'guestx',controller:true});
+    let nonOwnerBlocked=false; try { await w(co3,'control_mode',500); } catch { nonOwnerBlocked=true; }
+    assert.ok(nonOwnerBlocked, 'non-owner cannot promote (no room broadcast)');
+    co1._m.length = co2._m.length = co3._m.length = 0;
+    // owner demotes the co-host → gated again
+    s(co1,'set_peer_role',{peerId:'cohost',controller:false});
+    await w(co2,'control_mode');
+    co1._m.length = co2._m.length = co3._m.length = 0;
+    s(co2,'seek',{currentTime:4});
+    let coGatedAfter=false; try { await w(co1,'seek',500); } catch { coGatedAfter=true; }
+    assert.ok(coGatedAfter, 'demoted co-host is gated again');
+    close();
+    resetConnectionRate();
+
+    // --- H-1: a demoted co-host's FORCE_SYNC_EXECUTE still relays when they
+    //     initiated the in-flight PREPARE. Without the initiator exemption, the
+    //     EXECUTE would be dropped by the host-only gate and every peer would be
+    //     left stuck paused. ---
+    const h1rid = 'h1-'+Date.now();
+    const ho = await c(), hc = await c(), hg = await c();   // owner / co-host / guest
+    await j(ho, h1rid, 'owner'); await j(hc, h1rid, 'cohost'); await j(hg, h1rid, 'guest');
+    ho._m.length = hc._m.length = hg._m.length = 0;
+    s(ho,'set_control_mode',{controlMode:'host-only'});
+    await w(ho,'control_mode'); await w(hc,'control_mode'); await w(hg,'control_mode');
+    ho._m.length = hc._m.length = hg._m.length = 0;
+    // owner promotes co-host; co-host initiates force sync
+    s(ho,'set_peer_role',{peerId:'cohost',controller:true});
+    await w(hc,'control_mode');
+    ho._m.length = hc._m.length = hg._m.length = 0;
+    s(hc,'force_sync_prepare',{targetTime:0});
+    await w(ho,'force_sync_prepare'); await w(hg,'force_sync_prepare');
+    ho._m.length = hc._m.length = hg._m.length = 0;
+    // owner demotes the co-host mid-flight — the EXECUTE must still go through.
+    // Wait out the per-room role-change debounce (M-4) so this demote broadcasts:
+    // in real usage the host can't promote, run a force-sync, and demote inside 500ms.
+    await new Promise(r => setTimeout(r, 550));
+    s(ho,'set_peer_role',{peerId:'cohost',controller:false});
+    await w(hc,'control_mode');
+    ho._m.length = hc._m.length = hg._m.length = 0;
+    s(hc,'force_sync_execute',{});
+    await w(ho,'force_sync_execute'); await w(hg,'force_sync_execute');
+    // After the EXECUTE, the initiator slot is cleared: a fresh EXECUTE from the
+    // (now plain guest) co-host is gated again, confirming the exemption is scoped.
+    ho._m.length = hc._m.length = hg._m.length = 0;
+    s(hc,'force_sync_execute',{});
+    let reGated=false; try { await w(ho,'force_sync_execute',500); } catch { reGated=true; }
+    assert.ok(reGated, 'initiator exemption is cleared after the EXECUTE relayes');
+    close();
+    resetConnectionRate();
+
+    // --- A guest's stray EXECUTE (no matching PREPARE they initiated) is still gated ---
+    const grid = 'h1b-'+Date.now();
+    const go = await c(), gg = await c();
+    await j(go, grid, 'own'); await j(gg, grid, 'gst');
+    go._m.length = gg._m.length = 0;
+    s(go,'set_control_mode',{controlMode:'host-only'});
+    await w(go,'control_mode'); await w(gg,'control_mode');
+    go._m.length = gg._m.length = 0;
+    s(gg,'force_sync_execute',{});
+    let uninitGated=false; try { await w(go,'force_sync_execute',500); } catch { uninitGated=true; }
+    assert.ok(uninitGated, 'guest FORCE_SYNC_EXECUTE without a matching PREPARE is gated');
+    close();
+    resetConnectionRate();
+
+    // =====================================================================
+    // BACKWARD COMPATIBILITY — old clients (pre-HCM build) against new server.
+    // These tests simulate an old client by deliberately omitting fields the
+    // new feature added (desynced in heartbeats, capabilities expectation)
+    // and by ignoring CONTROL_MODE broadcasts. The wire format for existing
+    // events must stay byte-compatible: the relay must accept old payloads
+    // and must not inject new fields old clients would misread.
+    // =====================================================================
+
+    // --- BC-1: Old-client heartbeat (no `desynced` field) is accepted and
+    //     relayed without injecting `desynced`. Old clients never sent the
+    //     field; the relay must strip it from the wire so we don't surprise
+    //     them with unexpected keys. ---
+    const bcrid = 'bc-'+Date.now();
+    const bco = await c(), bcn = await c();    // bco = "old", bcn = "new"
+    await j(bco, bcrid, 'oldp'); await j(bcn, bcrid, 'newp');
+    bco._m.length = bcn._m.length = 0;
+    // Old-client heartbeat: every field an old build would send, NO `desynced`.
+    s(bco,'peer_status',{
+        status:'heartbeat', username:'old', tabTitle:'t', mediaTitle:'m',
+        playbackState:'playing', currentTime:42, volume:0.5, muted:false
+    });
+    let bcRelay = null; const bcStart = Date.now();
+    while (Date.now()-bcStart < 800 && !bcRelay) {
+        for (let i=0;i<bcn._m.length;i++){ const r=bcn._m[i]; if(r.startsWith('42')){ const [e,dd]=JSON.parse(r.substring(2)); if(e==='peer_status'){ bcn._m.splice(i,1); bcRelay=dd; break; } } }
+        await new Promise(r=>setTimeout(r,30));
+    }
+    assert.ok(bcRelay, 'old-style heartbeat relayed');
+    assert.ok(bcRelay.desynced === undefined, 'old-client heartbeat has no desynced on the wire (stripped)');
+    assert.equal(bcRelay.currentTime, 42, 'old-client currentTime preserved');
+    assert.equal(bcRelay.senderId, 'oldp', 'old-client senderId preserved');
+    close();
+    resetConnectionRate();
+
+    // --- BC-2: Old client in a host-only room — server still gates its events
+    //     even though the client has no awareness of the mode. This is the
+    //     key guarantee for mixed rooms during rollout: an old client can't
+    //     drive a host-only room just because it ignores CONTROL_MODE. ---
+    const hmrid = 'hcmix-'+Date.now();
+    const hmo = await c(), hmg = await c();    // hmo = host (new), hmg = "old" guest
+    await j(hmo, hmrid, 'hmixhost'); await j(hmg, hmrid, 'hmixold');
+    hmo._m.length = hmg._m.length = 0;
+    s(hmo,'set_control_mode',{controlMode:'host-only'});
+    await w(hmo,'control_mode'); await w(hmg,'control_mode');   // old client's socket still receives it; old client would ignore
+    hmo._m.length = hmg._m.length = 0;
+    // "Old" guest tries to drive — server must drop. Host must NOT receive it.
+    s(hmg,'pause',{currentTime:5});
+    let oldGated=false; try { await w(hmo,'pause',600); } catch { oldGated=true; }
+    assert.ok(oldGated, 'old-client pause dropped in host-only (server enforces regardless of client awareness)');
+    // Host's own command still relays to the old client's socket — old client
+    // applies it via its existing PLAY/PAUSE handler.
+    s(hmo,'pause',{currentTime:7}); await w(hmg,'pause');
+    close();
+    resetConnectionRate();
+
+    // --- BC-3: Mixed room with old + new client in 'everyone' mode — every
+    //     event flows identically to pre-HCM. Confirms no regression in the
+    //     default-mode relay path that could fragment a rolling-update room. ---
+    const mxrid = 'mix-'+Date.now();
+    const mxo = await c(), mxn = await c();    // mxo = old, mxn = new
+    await j(mxo, mxrid, 'oldmx'); await j(mxn, mxrid, 'newmx');
+    mxo._m.length = mxn._m.length = 0;
+    // Old → new
+    s(mxo,'play',{currentTime:1}); await w(mxn,'play');
+    s(mxo,'seek',{currentTime:99}); await w(mxn,'seek');
+    s(mxo,'force_sync_prepare',{targetTime:5}); await w(mxn,'force_sync_prepare');
+    s(mxo,'episode_lobby',{expectedTitle:'S1E1'}); await w(mxn,'episode_lobby');
+    // New → old
+    mxo._m.length = mxn._m.length = 0;
+    s(mxn,'pause',{currentTime:2}); await w(mxo,'pause');
+    s(mxn,'seek',{currentTime:50}); await w(mxo,'seek');
+    s(mxn,'force_sync_execute',{}); await w(mxo,'force_sync_execute');
+    s(mxn,'episode_lobby_cancel',{}); await w(mxo,'episode_lobby_cancel');
+    close();
+    resetConnectionRate();
+
+    // --- BC-4: New-client heartbeat WITH `desynced` does not break an old
+    //     client's receive path. The field is appended but old clients ignore
+    //     unknown keys — verify the relay preserves every pre-HCM field and
+    //     only adds `desynced`. ---
+    const b4rid = 'bc4-'+Date.now();
+    const b4old = await c(), b4new = await c();
+    await j(b4old, b4rid, 'b4o'); await j(b4new, b4rid, 'b4n');
+    b4old._m.length = b4new._m.length = 0;
+    s(b4new,'peer_status',{status:'heartbeat', desynced:true, currentTime:7, playbackState:'paused', username:'newp'});
+    let b4Relay = null; const b4Start = Date.now();
+    while (Date.now()-b4Start < 800 && !b4Relay) {
+        for (let i=0;i<b4old._m.length;i++){ const r=b4old._m[i]; if(r.startsWith('42')){ const [e,dd]=JSON.parse(r.substring(2)); if(e==='peer_status'){ b4old._m.splice(i,1); b4Relay=dd; break; } } }
+        await new Promise(r=>setTimeout(r,30));
+    }
+    assert.ok(b4Relay, 'new-client heartbeat relayed to old client');
+    assert.equal(b4Relay.desynced, true, 'desynced preserved for new recipients');
+    assert.equal(b4Relay.currentTime, 7, 'old fields preserved on the same relay');
+    assert.equal(b4Relay.senderId, 'b4n', 'senderId preserved');
+    close();
+    resetConnectionRate();
+
+    // --- Password room ---
+    const prid = 'pw-'+Date.now();
+    const pw1 = await c(); await j(pw1, prid, 'admin', 's3cret');
+    const pw2 = await c();
+    s(pw2,'join_room',{roomId:prid,password:'BAD',peerId:'bad',protocolVersion:'1.0.0'});
+    assert.equal((await a(pw2))[0],'error','wrong pw');
+    const pw3 = await c();
+    s(pw3,'join_room',{roomId:prid,password:'s3cret',peerId:'good',protocolVersion:'1.0.0'});
+    assert.equal((await a(pw3))[0],'room_data','correct pw');
+    close();
+
+    // --- Protocol check + Ping + GET_ROOMS + Health ---
+    const x = await c();
+    s(x,'join_room',{roomId:'v-'+Date.now(),peerId:'old',protocolVersion:'0.0.1'});
+    await w(x,'error'); // version mismatch
+    x._m.length = 0;
+    s(x,'ping',{t:Date.now()}); await w(x,'pong');
+    await j(x,'lst-'+Date.now(),'l1');
+    x._m.length = 0;
+    s(x,'get_rooms',{}); await w(x,'room_list');
+    close();
+
+    // Dedup
+    const did = 'dup-'+Date.now();
+    const d1 = await c(), d2 = await c();
+    await j(d1, did, 'dup'); d1._m.length = 0;
+    s(d2,'join_room',{roomId:did,peerId:'dup',protocolVersion:'1.0.0'});
+    assert.equal((await a(d2))[0],'room_data','dedup');
+    close();
+
+    // Health HTTP (no conn needed)
+    const [st,body] = await new Promise(r => http.get(`http://127.0.0.1:${port}/`, res => {
+        let d=''; res.on('data',c=>d+=c); res.on('end',()=>r([res.statusCode,JSON.parse(d)])); }));
+    assert.equal(st,200); assert.equal(body.status,'online');
+
+    console.log('All WebSocket integration tests passed (incl. host control mode)');
+} catch(e) {
+    console.error('FAILED:', e.message);
+    process.exitCode=1;
+} finally {
+    close();
+    if (mod?.stopServerForTests) await mod.stopServerForTests();
+}
@@ -0,0 +1,76 @@
+import assert from 'node:assert/strict';
+import {
+    TITLE_PRIVACY_MODES,
+    applyTitlePrivacyToPayload,
+    normalizeSendTabTitle,
+    normalizeTitlePrivacyMode,
+    sanitizeSharedTitle,
+    sanitizeTabTitle
+} from '../extension/title-privacy.js';
+
+assert.equal(normalizeTitlePrivacyMode(undefined), TITLE_PRIVACY_MODES.FULL);
+assert.equal(normalizeTitlePrivacyMode('unknown'), TITLE_PRIVACY_MODES.FULL);
+assert.equal(normalizeTitlePrivacyMode(TITLE_PRIVACY_MODES.HIDDEN), TITLE_PRIVACY_MODES.HIDDEN);
+assert.equal(normalizeSendTabTitle(undefined, TITLE_PRIVACY_MODES.FULL), true);
+assert.equal(normalizeSendTabTitle(undefined, TITLE_PRIVACY_MODES.EPISODE), false);
+assert.equal(normalizeSendTabTitle(true, TITLE_PRIVACY_MODES.HIDDEN), true);
+assert.equal(normalizeSendTabTitle(false, TITLE_PRIVACY_MODES.FULL), false);
+
+assert.equal(sanitizeTabTitle('Private Tab', true), 'Private Tab');
+assert.equal(sanitizeTabTitle('Private Tab', false), null);
+assert.equal(sanitizeTabTitle('', true), null);
+
+assert.equal(sanitizeSharedTitle('Example Movie', 'full'), 'Example Movie');
+assert.equal(sanitizeSharedTitle('', 'full'), null);
+assert.equal(sanitizeSharedTitle(null, 'full'), null);
+
+assert.equal(sanitizeSharedTitle('Show Name - S01/E04 - Title', 'episode'), 'S01E04');
+assert.equal(sanitizeSharedTitle('Folge 7 - Private Server', 'episode'), 'EP007');
+assert.equal(sanitizeSharedTitle('Example Movie', 'episode'), null);
+
+assert.equal(sanitizeSharedTitle('Show Name - S01E04', 'hidden'), null);
+assert.equal(sanitizeSharedTitle('Private Tab Title', 'hidden'), null);
+
+assert.deepEqual(
+    applyTitlePrivacyToPayload({
+        tabTitle: 'Private Jellyfin - S01E04',
+        mediaTitle: 'Show Name - S01E04',
+        currentTime: 42
+    }, 'episode'),
+    {
+        tabTitle: 'Private Jellyfin - S01E04',
+        mediaTitle: 'S01E04',
+        currentTime: 42
+    },
+    'media privacy must not rewrite tabTitle'
+);
+
+assert.deepEqual(
+    applyTitlePrivacyToPayload({
+        tabTitle: 'Private Jellyfin - S01E04',
+        status: 'heartbeat'
+    }, 'episode'),
+    {
+        tabTitle: 'Private Jellyfin - S01E04',
+        status: 'heartbeat'
+    },
+    'media privacy must not rewrite tabTitle or add absent media keys'
+);
+
+assert.deepEqual(
+    applyTitlePrivacyToPayload({
+        tabTitle: 'Private Tab',
+        mediaTitle: 'Private Media',
+        expectedTitle: 'S01E04',
+        title: 'S01E04'
+    }, 'hidden'),
+    {
+        tabTitle: 'Private Tab',
+        mediaTitle: null,
+        expectedTitle: null,
+        title: null
+    },
+    'hidden media privacy must not clear tabTitle'
+);
+
+console.log('title-privacy tests passed');
@@ -17,7 +17,7 @@ const enDict = JSON.parse(fs.readFileSync(enPath, 'utf8'));
 const enKeys = Object.keys(enDict).sort();

 const localeFiles = fs.readdirSync(localesDir)
-  .filter(file => file.endsWith('.json') && file !== 'en.json')
+  .filter(file => file.endsWith('.json'))
  .sort();

 let hasError = false;
@@ -51,8 +51,24 @@ for (const file of localeFiles) {

    const missingKeys = enKeys.filter(k => !keys.includes(k));
    const extraKeys = keys.filter(k => !enKeys.includes(k));
+    const emptyKeys = keys.filter(k => {
+      if (file === 'en.json' && k === 'CANONICAL_PATH') return false;
+      return typeof dict[k] === 'string' && dict[k].trim() === '';
+    });
+    const placeholderKeys = keys.filter(k => {
+      if (typeof dict[k] !== 'string') return false;
+      const val = dict[k];
+      const lower = val.toLowerCase();
+      return (
+        lower.includes('placeholder') ||
+        lower.includes('todo:') ||
+        lower.includes('tbd:') ||
+        /\bTODO\b/.test(val) ||
+        /\bTBD\b/.test(val)
+      );
+    });

-    if (missingKeys.length > 0 || extraKeys.length > 0) {
+    if (missingKeys.length > 0 || extraKeys.length > 0 || emptyKeys.length > 0 || placeholderKeys.length > 0) {
      hasError = true;
      console.error(`❌ ${file} has inconsistencies:`);
      if (missingKeys.length > 0) {
@@ -61,6 +77,12 @@ for (const file of localeFiles) {
      if (extraKeys.length > 0) {
        console.error(`  Extra keys (${extraKeys.length}):`, extraKeys);
      }
+      if (emptyKeys.length > 0) {
+        console.error(`  Empty translation values (${emptyKeys.length}):`, emptyKeys);
+      }
+      if (placeholderKeys.length > 0) {
+        console.error(`  Placeholder/TODO values (${placeholderKeys.length}):`, placeholderKeys);
+      }
    } else {
      console.log(`✓ ${file} is fully consistent (matches all keys).`);
    }
@@ -11,21 +11,27 @@ const checks = [
  ['server routes', 'node', ['scripts/test-server-routes.mjs'], {
    env: { ADMIN_METRICS_TOKEN: 'verify-admin-token-with-more-than-32-chars' }
  }],
-  ['content video finder', 'node', ['scripts/test-content-video-finder.js']],
+  ['rate-limiter unit tests', 'node', ['scripts/test-rate-limiter.mjs']],
+  ['episode-utils unit tests', 'node', ['scripts/test-episode-utils.mjs']],
+  ['title privacy unit tests', 'node', ['scripts/test-title-privacy.mjs']],
+  ['server WebSocket integration', 'node', ['scripts/test-server-ws.mjs']],
+  ['names generator', 'node', ['scripts/test-names.mjs']],
+  ['content video finder', 'node', ['scripts/test-content-video-finder.cjs']],
  ['audio settings', 'node', ['scripts/test-audio-settings.mjs']],
  ['popup refresh cooldown', 'node', ['scripts/test-popup-refresh-cooldown.mjs']],
  ['server syntax index', 'node', ['-c', 'server/index.js']],
  ['server syntax ops', 'node', ['-c', 'server/ops.js']],
+  ['server syntax rate-limiter', 'node', ['-c', 'server/rate-limiter.js']],
  ['content syntax', 'node', ['-c', 'extension/content.js']],
  ['popup syntax', 'node', ['-c', 'extension/popup.js']],
  ['background syntax', 'node', ['-c', 'extension/background.js']],
-  ['locale coverage', 'node', ['scripts/test-locales.js']],
+  ['locale coverage', 'node', ['scripts/test-locales.cjs']],
  ['website locale coverage', 'node', ['scripts/test-website-locales.mjs']],
  ['lint', 'npm', ['run', 'lint']],
  ['root production audit', 'npm', ['audit', '--omit=dev']],
  ['server production audit', 'npm', ['audit', '--omit=dev'], { cwd: path.join(repoRoot, 'server') }],
  ['extension build', 'npm', ['run', 'build:extension']],
-  ['website build', 'node', ['website/build.js']]
+  ['website build', 'node', ['website/build.cjs']]
 ];

 function runCheck([label, command, args, options = {}]) {
@@ -10,4 +10,7 @@ RUN cd server && npm install --production
 COPY server/ ./server/

 WORKDIR /app/server
+EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1
 CMD ["node", "index.js"]
@@ -71,3 +71,11 @@ npm start
 - **Single Source of Truth**: The server imports constants directly from the root `shared/` directory.
 - **In-Memory**: Rooms are automatically pruned after 2 hours of inactivity.
 - **Reverse Proxy Boundary**: The server trusts one reverse proxy hop for client IP detection. Keep the Node port private/firewalled so clients can only reach it through Caddy or another trusted proxy.
+
+## Module Structure
+
+| File | Purpose |
+|---|---|
+| `index.js` | Express + Socket.IO server: room management, relay loop, graceful shutdown |
+| `rate-limiter.js` | Connection, event, health, and auth rate limiting with 6 functions + cleanup intervals |
+| `ops.js` | Health endpoint helpers, metrics payload builder, auth validation |
@@ -4,7 +4,7 @@ import { fileURLToPath } from 'url';
 import { Server } from 'socket.io';
 import crypto from 'crypto';
 import dotenv from 'dotenv';
-import { EVENTS, OFFICIAL_SERVER_TOKEN, PROTOCOL_VERSION } from '../shared/constants.js';
+import { EVENTS, OFFICIAL_SERVER_TOKEN, PROTOCOL_VERSION, CONTROL_MODES, CAPABILITIES } from '../shared/constants.js';
 import {
    buildHealthPayload,
    checkCooldown,
@@ -12,6 +12,38 @@ import {
    isAdminMetricsAuthorized,
    isAdminMetricsTokenStrong
 } from './ops.js';
+import {
+    ROOM_LIST_COOLDOWN_MS,
+    HEALTH_RATE_LIMIT_PER_MINUTE,
+    ADMIN_METRICS_AUTH_RATE_LIMIT_PER_MINUTE,
+    connectionCounts,
+    failedAuthAttempts,
+    eventCounts,
+    healthCounts,
+    adminMetricsAuthCounts,
+    roomListCooldowns,
+    rateLimitDenied,
+    checkAuthRate,
+    recordAuthFailure,
+    checkConnectionRate,
+    checkEventRate,
+    checkHealthRate,
+    checkAdminMetricsAuthRate,
+    startRateLimitCleanup,
+    stopRateLimitCleanup,
+    clearRateLimitMaps
+} from './rate-limiter.js';
+
+// Re-export for external consumers (tests, ops)
+export {
+    HEALTH_RATE_LIMIT_PER_MINUTE,
+    ADMIN_METRICS_AUTH_RATE_LIMIT_PER_MINUTE,
+    healthCounts,
+    adminMetricsAuthCounts,
+    connectionCounts,
+    eventCounts,
+    rateLimitDenied
+};

 dotenv.config();

@@ -26,15 +58,16 @@ const MAX_ROOMS = parseInt(process.env.MAX_ROOMS) || 1000;
 const MAX_PEERS_PER_ROOM = parseInt(process.env.MAX_PEERS_PER_ROOM) || 25;
 const MIN_VERSION = process.env.MIN_VERSION || '1.0.0';
 const ADMIN_METRICS_TOKEN = process.env.ADMIN_METRICS_TOKEN || '';
-const ROOM_LIST_COOLDOWN_MS = 10000;
-export const HEALTH_RATE_LIMIT_PER_MINUTE = 10;
-export const ADMIN_METRICS_AUTH_RATE_LIMIT_PER_MINUTE = 5;
 const HEALTH_RESPONSE_CACHE_TTL_MS = 60000;

 if (!isAdminMetricsTokenStrong(ADMIN_METRICS_TOKEN)) {
    console.warn('[SECURITY] ADMIN_METRICS_TOKEN is set but shorter than 32 characters. Use a long random token.');
 }

+if (!process.env.SERVER_SALT) {
+    console.warn('[SECURITY] SERVER_SALT is not set — using the built-in default salt (public in the repo). Set a unique SERVER_SALT so room-password hashes are not computed with a known salt.');
+}
+
 export const app = express();
 app.set('trust proxy', 1); // For real client IP through reverse proxy

@@ -82,7 +115,8 @@ app.get('/health', (req, res) => {
                adminMetricsAuth: adminMetricsAuthCounts.size,
                authFailures: failedAuthAttempts.size,
                roomList: roomListCooldowns.size
-            }
+            },
+            rateLimitDenied
        })
    ));
 });
@@ -96,7 +130,7 @@ export const io = new Server(httpServer, {
            if (!origin || origin === 'https://sync.koalastuff.net' || origin.startsWith('chrome-extension://') || origin.startsWith('moz-extension://')) {
                callback(null, true);
            } else {
-                log('CORS', `Rejected origin: ${origin}`);
+                log('CORS', `Rejected origin: ${(origin || '').replace(/[\r\n]/g, '')}`);
                callback(new Error('Not allowed by CORS'));
            }
        },
@@ -107,6 +141,8 @@ export const io = new Server(httpServer, {
    allowUpgrades: false
 });

+startRateLimitCleanup(io);
+
 /**
 * In-memory storage
 */
@@ -114,150 +150,50 @@ export const rooms = new Map();
 const socketToRoom = new Map();
 const peerToSocket = new Map(); // peerId -> socketId (Global lookup)
 const roomCreationLocks = new Map(); // roomId -> Promise (prevents race on room creation)
+const peerJoinLocks = new Map(); // peerId -> Promise (prevents race on same peerId joins)
+
+// Host Control Mode: events a non-host guest may NOT initiate while a room is in
+// 'host-only' mode (they would move/disrupt everyone). Reactions like FORCE_SYNC_ACK,
+// EPISODE_READY, PEER_STATUS heartbeats remain allowed for all peers.
+const HOST_ONLY_GATED_EVENTS = new Set([
+    EVENTS.PLAY,
+    EVENTS.PAUSE,
+    EVENTS.SEEK,
+    EVENTS.FORCE_SYNC_PREPARE,
+    EVENTS.FORCE_SYNC_EXECUTE,
+    EVENTS.EPISODE_LOBBY,
+    EVENTS.EPISODE_LOBBY_CANCEL
+]);
+
+// Features this relay supports, advertised to clients in ROOM_DATA so they can
+// enable matching UI/behavior only when the server actually backs it. Append a
+// flag here when a new server-gated feature ships (e.g. co-host promotion).
+const SERVER_CAPABILITIES = [CAPABILITIES.HOST_CONTROL, CAPABILITIES.CO_HOST];
+
+// M-4: minimum interval between CONTROL_MODE changes per room. Stops a rapidly
+// toggling host from thrashing every guest's UI (locked/unlocked/locked...) and
+// from generating one broadcast per toggle across all peers.
+const CONTROL_MODE_MIN_INTERVAL_MS = 500;
+
+// Canonical control-mode/role snapshot sent to clients. controllers always includes
+// the owner (hostPeerId). Built in one place so every emit stays consistent.
+function controlModePayload(room) {
+    return {
+        controlMode: room.controlMode,
+        hostPeerId: room.hostPeerId,
+        controllers: room.controllers ? Array.from(room.controllers) : (room.hostPeerId ? [room.hostPeerId] : [])
+    };
+}

 function log(type, message, details = '') {
    const debugLogging = process.env.DEBUG_LOGGING === '1';
-    const isVerbose = type === 'CONN' || type === 'ROOM' || type === 'DEDUPE' || type === 'CORS';
+    const isVerbose = type === 'CONN' || type === 'ROOM' || type === 'DEDUPE' || type === 'CORS' || type === 'ACKDROP';
    if (!debugLogging && isVerbose) return;

    const timestamp = new Date().toISOString();
    console.log(`[${timestamp}] [${type}] ${message}`, details);
 }

-// Rate Limiting & Security
-export const connectionCounts = new Map(); // ip -> { count, resetTime }
-const failedAuthAttempts = new Map(); // Map<IP+RoomID, {count, lastAttempt}>
-
-function checkAuthRate(ip, roomId) {
-    const key = `${ip}:${roomId}`;
-    const now = Date.now();
-    const record = failedAuthAttempts.get(key) || { count: 0, lastAttempt: 0 };
-    
-    // Block for 15 mins if 5 fails in 2 mins
-    if (record.count >= 5 && (now - record.lastAttempt) < 15 * 60 * 1000) {
-        return false;
-    }
-    
-    // Reset if last attempt was long ago
-    if ((now - record.lastAttempt) > 2 * 60 * 1000) {
-        record.count = 0;
-    }
-    
-    return true;
-}
-
-function recordAuthFailure(ip, roomId) {
-    if (failedAuthAttempts.size > 50000) {
-        const now = Date.now();
-        // 1. Clear expired entries (> 15 mins)
-        for (const [key, record] of failedAuthAttempts.entries()) {
-            if (now - record.lastAttempt > 15 * 60 * 1000) {
-                failedAuthAttempts.delete(key);
-            } else {
-                break; // Since entries are insertion-ordered by time, all subsequent entries are newer
-            }
-        }
-        
-        // 2. If still over 50k, perform LRU-style eviction on the oldest 10,000 entries (first items in Map order)
-        if (failedAuthAttempts.size > 50000) {
-            log('SECURITY', 'failedAuthAttempts size exceeded 50000. Performing insertion-order eviction.');
-            for (const [key] of failedAuthAttempts.entries()) {
-                if (failedAuthAttempts.size <= 40000) {
-                    break;
-                }
-                failedAuthAttempts.delete(key);
-            }
-        }
-    }
-    const key = `${ip}:${roomId}`;
-    const record = failedAuthAttempts.get(key) || { count: 0, lastAttempt: 0 };
-    record.count++;
-    record.lastAttempt = Date.now();
-    failedAuthAttempts.delete(key); // Remove first to update insertion order (moves key to the end of iteration)
-    failedAuthAttempts.set(key, record);
-}
-
-// Periodically clean up old auth failure records (every 15 minutes)
-const authFailureCleanupInterval = setInterval(() => {
-    const now = Date.now();
-    for (const [key, record] of failedAuthAttempts.entries()) {
-        if (now - record.lastAttempt > 15 * 60 * 1000) {
-            failedAuthAttempts.delete(key);
-        }
-    }
-}, 15 * 60 * 1000);
-
-export const eventCounts = new Map(); // socketId -> { count, resetTime }
-export const healthCounts = new Map(); // ip -> { count, resetTime }
-export const adminMetricsAuthCounts = new Map(); // ip -> { count, resetTime }
-const roomListCooldowns = new Map(); // socketId -> last allowed timestamp
-
-// Clean up connection counts and event counts to prevent memory leak
-const rateLimitCleanupInterval = setInterval(() => {
-    const now = Date.now();
-    for (const [ip, entry] of connectionCounts.entries()) {
-        if (now > entry.resetTime) {
-            connectionCounts.delete(ip);
-        }
-    }
-    for (const [socketId, entry] of eventCounts.entries()) {
-        if (now > entry.resetTime || !io.sockets.sockets.has(socketId)) {
-            eventCounts.delete(socketId);
-        }
-    }
-    for (const [ip, entry] of healthCounts.entries()) {
-        if (now > entry.resetTime) {
-            healthCounts.delete(ip);
-        }
-    }
-    for (const [ip, entry] of adminMetricsAuthCounts.entries()) {
-        if (now > entry.resetTime) {
-            adminMetricsAuthCounts.delete(ip);
-        }
-    }
-    for (const [socketId] of roomListCooldowns.entries()) {
-        if (!io.sockets.sockets.has(socketId)) {
-            roomListCooldowns.delete(socketId);
-        }
-    }
-}, 60000);
-
-function checkConnectionRate(ip) {
-    const now = Date.now();
-    const entry = connectionCounts.get(ip) || { count: 0, resetTime: now + 60000 };
-    if (now > entry.resetTime) { entry.count = 0; entry.resetTime = now + 60000; }
-    entry.count++;
-    connectionCounts.set(ip, entry);
-    return entry.count <= 10;
-}
-
-function checkEventRate(socketId) {
-    const now = Date.now();
-    const entry = eventCounts.get(socketId) || { count: 0, resetTime: now + 10000 };
-    if (now > entry.resetTime) { entry.count = 0; entry.resetTime = now + 10000; }
-    entry.count++;
-    eventCounts.set(socketId, entry);
-    return entry.count <= 30;
-}
-
-function checkHealthRate(ip) {
-    const now = Date.now();
-    const entry = healthCounts.get(ip) || { count: 0, resetTime: now + 60000 };
-    if (now > entry.resetTime) { entry.count = 0; entry.resetTime = now + 60000; }
-    entry.count++;
-    healthCounts.set(ip, entry);
-    return entry.count <= HEALTH_RATE_LIMIT_PER_MINUTE;
-}
-
-function checkAdminMetricsAuthRate(ip) {
-    const now = Date.now();
-    const entry = adminMetricsAuthCounts.get(ip) || { count: 0, resetTime: now + 60000 };
-    if (now > entry.resetTime) { entry.count = 0; entry.resetTime = now + 60000; }
-    entry.count++;
-    adminMetricsAuthCounts.set(ip, entry);
-    return entry.count <= ADMIN_METRICS_AUTH_RATE_LIMIT_PER_MINUTE;
-}
-
 /**
 * Central peer teardown. Removes a socket from all room state and notifies
 * remaining peers. Call this from every disconnect/leave/reaper/dedupe path.
@@ -302,6 +238,42 @@ function removePeerFromRoom(socketId, roomId, reason) {
        }
    }

+    // 3.6. Host Control Mode: if the host left (and isn't still connected via another
+    //      socket), fall back to 'everyone' so the room never gets stuck locked, and
+    //      reassign host to the earliest remaining peer so the feature stays usable.
+    //      (v1: immediate fallback, no grace period — see host-control-mode docs.)
+    //      Skip while a join for this peerId is in flight (peerJoinLocks holds it):
+    //      that's the reconnect / second-tab case where the same peerId is being
+    //      re-added right after the dedupe kicked the old socket. Demoting there
+    //      would silently unlock the room on every second-tab open.
+    //      NOTE: this does *not* cover a true network blip where the old socket's
+    //      'disconnect' fires before the new socket acquires its join lock — in that
+    //      window peerJoinLocks is empty, so the fallback fires. Documented v1
+    //      limitation (no host grace period); see KNOWN_LIMITATIONS.md.
+    const peerRejoining = peerJoinLocks.has(peerId);
+    const peerGone = !isPeerStillConnected && !peerRejoining;
+    if (peerGone && room.controllers && room.peers.size > 0) {
+        const wasController = room.controllers.has(peerId);
+        room.controllers.delete(peerId);
+        // H-1: a leaving initiator strands the room's force-sync — release the
+        // slot so a future controller's PREPARE can take over cleanly.
+        if (room.forceSyncInitiator === peerId) room.forceSyncInitiator = null;
+        if (room.hostPeerId === peerId) {
+            // Owner left → reassign owner + fall back to 'everyone' so the room is
+            // never stuck locked, and reset the controller set to just the new owner.
+            const nextPeerData = room.peerData.values().next().value;
+            room.hostPeerId = nextPeerData ? nextPeerData.peerId : null;
+            room.controlMode = CONTROL_MODES.EVERYONE;
+            room.controllers = new Set(room.hostPeerId ? [room.hostPeerId] : []);
+            io.to(roomId).emit(EVENTS.CONTROL_MODE, controlModePayload(room));
+            log('ROOM', `Owner left room ${roomId.substring(0, 3)}*** — fell back to 'everyone', new owner: ${room.hostPeerId}`);
+        } else if (wasController) {
+            // A co-host left → keep the mode, just broadcast the updated controller list.
+            io.to(roomId).emit(EVENTS.CONTROL_MODE, controlModePayload(room));
+            log('ROOM', `Controller ${peerId} left room ${roomId.substring(0, 3)}***`);
+        }
+    }
+
    // 4. Delete empty room
    if (room.peers.size === 0) {
        rooms.delete(roomId);
@@ -434,7 +406,19 @@ io.on('connection', (socket) => {
                            peers: new Set(),
                            peerIds: new Map(),
                            peerData: new Map(),
-                            lastActivity: Date.now()
+                            lastActivity: Date.now(),
+                            // Host Control Mode: creator (first joiner) is the host/owner.
+                            hostPeerId: peerId,
+                            controlMode: CONTROL_MODES.EVERYONE,
+                            lastControlModeChangeAt: 0, // M-4: per-room debounce for control-mode toggles
+                            lastRoleChangeAt: 0, // M-4: per-room debounce for role promote/demote
+                            // Co-Host: peers allowed to drive in 'host-only'. Always includes the owner.
+                            controllers: new Set([peerId]),
+                            // H-1: peerId of the in-flight force-sync initiator. Lets a demoted
+                            // controller's FORCE_SYNC_EXECUTE through the host-only gate — without
+                            // it, demoting a co-host mid-force-sync would drop their EXECUTE and
+                            // leave every peer stuck paused.
+                            forceSyncInitiator: null
                        };
                        rooms.set(roomId, room);
                        createdByMe = true;
@@ -451,7 +435,20 @@ io.on('connection', (socket) => {
                return;
            }

-            if (!createdByMe) {
+            let peerLockPromise = peerJoinLocks.get(peerId);
+            if (peerLockPromise) {
+                await peerLockPromise;
+                room = rooms.get(roomId);
+                if (!room) {
+                    socket.emit(EVENTS.ERROR, { message: "Room no longer exists" });
+                    return;
+                }
+            }
+            let resolvePeerLock;
+            peerLockPromise = new Promise(resolve => { resolvePeerLock = resolve; });
+            peerJoinLocks.set(peerId, peerLockPromise);
+            try {
+                if (!createdByMe) {
                if (room.passwordHash) {
                    if (!password || hashPassword(password) !== room.passwordHash) {
                        recordAuthFailure(ip, roomId);
@@ -503,12 +500,20 @@ io.on('connection', (socket) => {
            peerToSocket.set(peerId, socket.id);

            socket.to(roomId).emit(EVENTS.PEER_STATUS, { peerId, username: username || null, tabTitle: tabTitle || null, mediaTitle: mediaTitle || null, status: 'joined' });
-            socket.emit(EVENTS.ROOM_DATA, { 
-                roomId, 
+            socket.emit(EVENTS.ROOM_DATA, {
+                roomId,
                peers: Array.from(room.peers).map(sid => room.peerData.get(sid)),
-                activeLobby: room.activeLobby || null
+                activeLobby: room.activeLobby || null,
+                hostPeerId: room.hostPeerId || null,
+                controlMode: room.controlMode || CONTROL_MODES.EVERYONE,
+                controllers: room.controllers ? Array.from(room.controllers) : [],
+                capabilities: SERVER_CAPABILITIES
            });
            log('ROOM', `Peer ${peerId} joined: ${roomId.substring(0, 3)}***`);
+            } finally {
+                peerJoinLocks.delete(peerId);
+                resolvePeerLock();
+            }
        } catch (err) {
            log('ERROR', `Join error for ${socket.id}`, err);
            if (socket.connected) {
@@ -542,7 +547,35 @@ io.on('connection', (socket) => {
                    const room = rooms.get(mapping.roomId);
                    if (room) {
                    room.lastActivity = Date.now();
-                    
+
+                    // --- Host Control Mode gate ---
+                    // In 'host-only' mode, drop room-moving events from anyone who is not
+                    // a controller (the owner + any promoted co-hosts). Robust chokepoint:
+                    // independent of client behavior, kills spam. Heartbeats/ACKs pass.
+                    //
+                    // H-1 exception: a demoted co-host's FORCE_SYNC_EXECUTE still has to
+                    // land — otherwise their already-relayed PREPARE would leave the whole
+                    // room stuck paused. Track the in-flight initiator on PREPARE and let
+                    // their matching EXECUTE through regardless of current controllers set.
+                    if (eventName === EVENTS.FORCE_SYNC_PREPARE &&
+                        room.controlMode === CONTROL_MODES.HOST_ONLY &&
+                        room.controllers && room.controllers.has(mapping.peerId)) {
+                        room.forceSyncInitiator = mapping.peerId;
+                    }
+                    const isOwnForceSyncExecute = eventName === EVENTS.FORCE_SYNC_EXECUTE &&
+                        room.forceSyncInitiator && mapping.peerId === room.forceSyncInitiator;
+                    if (!isOwnForceSyncExecute &&
+                        room.controlMode === CONTROL_MODES.HOST_ONLY &&
+                        !(room.controllers && room.controllers.has(mapping.peerId)) &&
+                        HOST_ONLY_GATED_EVENTS.has(eventName)) {
+                        log('ROOM', `Dropped ${eventName} from guest ${mapping.peerId} in host-only room ${mapping.roomId.substring(0, 3)}***`);
+                        return;
+                    }
+                    // Clear initiator tracking once the EXECUTE has been relayed.
+                    if (eventName === EVENTS.FORCE_SYNC_EXECUTE && room.forceSyncInitiator) {
+                        room.forceSyncInitiator = null;
+                    }
+
                    // --- S-2 & S-3: Sanitize ALL relay fields (strings, numbers, booleans) ---
                    const clamp    = (val, max) => typeof val === 'string' ? val.substring(0, max) : undefined;
                    const clampNum = (val, min, max) => typeof val === 'number' && Number.isFinite(val) ? Math.max(min, Math.min(max, val)) : undefined;
@@ -553,12 +586,13 @@ io.on('connection', (socket) => {
                    room.peerData.set(socket.id, { 
                        ...existing,
                        username:      data.username      !== undefined ? (clamp(data.username, 30)   ?? existing.username)      : existing.username,
-                        tabTitle:      data.tabTitle      !== undefined ? (clamp(data.tabTitle, 100)  ?? existing.tabTitle)      : existing.tabTitle,
-                        mediaTitle:    data.mediaTitle    !== undefined ? (clamp(data.mediaTitle, 100) ?? existing.mediaTitle)   : existing.mediaTitle,
+                        tabTitle:      data.tabTitle      === null ? null : (data.tabTitle      !== undefined ? (clamp(data.tabTitle, 100)  ?? existing.tabTitle)      : existing.tabTitle),
+                        mediaTitle:    data.mediaTitle    === null ? null : (data.mediaTitle    !== undefined ? (clamp(data.mediaTitle, 100) ?? existing.mediaTitle)   : existing.mediaTitle),
                        playbackState: data.playbackState !== undefined ? (validState(data.playbackState) ?? existing.playbackState) : existing.playbackState,
-                        currentTime:   data.currentTime   !== undefined ? (clampNum(data.currentTime, 0, 86400) ?? existing.currentTime)   : existing.currentTime,
+                        currentTime:   data.currentTime   === null ? null : (data.currentTime   !== undefined ? (clampNum(data.currentTime, 0, 86400) ?? existing.currentTime)   : existing.currentTime),
                        volume:        data.volume        !== undefined ? (clampNum(data.volume, 0, 1) ?? existing.volume)                 : existing.volume,
                        muted:         data.muted         !== undefined ? (validBool(data.muted) ?? existing.muted)                       : existing.muted,
+                        desynced:      data.desynced      !== undefined ? (validBool(data.desynced) === true) : (existing.desynced || false),
                        lastSeen: Date.now()
                    });

@@ -566,14 +600,15 @@ io.on('connection', (socket) => {
                    const relayPayload = {
                        senderId:        mapping.peerId,
                        seq:             clampNum(data.seq, 0, Number.MAX_SAFE_INTEGER),
-                        currentTime:     clampNum(data.currentTime, 0, 86400),
+                        currentTime:     data.currentTime === null ? null : clampNum(data.currentTime, 0, 86400),
                        targetTime:      clampNum(data.targetTime, 0, 86400),
                        playbackState:   validState(data.playbackState),
                        username:        clamp(data.username, 30),
-                        tabTitle:        clamp(data.tabTitle, 100),
-                        mediaTitle:      clamp(data.mediaTitle, 100),
+                        tabTitle:        data.tabTitle === null ? null : clamp(data.tabTitle, 100),
+                        mediaTitle:      data.mediaTitle === null ? null : clamp(data.mediaTitle, 100),
                        volume:          clampNum(data.volume, 0, 1),
                        muted:           validBool(data.muted),
+                        desynced:        validBool(data.desynced),
                        peerId:          mapping.peerId,
                        status:          typeof data.status === 'string' ? data.status.substring(0, 16) : undefined,
                        expectedTitle:   clamp(data.expectedTitle, 100),
@@ -585,7 +620,7 @@ io.on('connection', (socket) => {
                    socket.to(mapping.roomId).emit(eventName, relayPayload);

                    // --- Side-effects: Server-side Episode Lobby Tracking ---
-                    if (eventName === EVENTS.EPISODE_LOBBY && relayPayload.expectedTitle) {
+                    if (eventName === EVENTS.EPISODE_LOBBY && relayPayload.expectedTitle && !room.activeLobby) {
                        room.activeLobby = {
                            expectedTitle: relayPayload.expectedTitle,
                            initiatorPeerId: mapping.peerId,
@@ -613,6 +648,7 @@ io.on('connection', (socket) => {
            return;
        }
        if (!checkCooldown(roomListCooldowns, socket.id, ROOM_LIST_COOLDOWN_MS)) {
+            rateLimitDenied.roomList++;
            socket.emit(EVENTS.ERROR, { message: 'Room list refresh is rate limited. Try again in a few seconds.' });
            return;
        }
@@ -625,13 +661,108 @@ io.on('connection', (socket) => {
    });

    socket.on(EVENTS.LEAVE_ROOM, () => {
-        const mapping = socketToRoom.get(socket.id);
-        if (mapping) {
-            socket.leave(mapping.roomId);
-            removePeerFromRoom(socket.id, mapping.roomId, 'leave');
+        try {
+            const mapping = socketToRoom.get(socket.id);
+            if (mapping) {
+                socket.leave(mapping.roomId);
+                removePeerFromRoom(socket.id, mapping.roomId, 'leave');
+            }
+        } catch (err) {
+            log('ERROR', 'removePeerFromRoom failed in leave', err);
        }
    });

+    socket.on(EVENTS.SET_CONTROL_MODE, (data) => {
+        if (!checkEventRate(socket.id)) {
+            log('SECURITY', `Event rate limit exceeded for socket (SET_CONTROL_MODE): ${socket.id}`);
+            socket.disconnect(true);
+            return;
+        }
+        if (!data || typeof data !== 'object') return;
+        const mode = data.controlMode;
+        if (mode !== CONTROL_MODES.EVERYONE && mode !== CONTROL_MODES.HOST_ONLY) return;
+
+        const mapping = socketToRoom.get(socket.id);
+        if (!mapping) return;
+        const room = rooms.get(mapping.roomId);
+        if (!room) return;
+
+        // Only the owner may change the control mode.
+        if (mapping.peerId !== room.hostPeerId) {
+            log('AUTH', `Non-host ${mapping.peerId} tried to set control mode in ${mapping.roomId.substring(0, 3)}***`);
+            // Re-sync the sender to the actual room state so any optimistic UI
+            // (e.g. popup toggle) reverts — covers stale-local-amHost races (H-5).
+            socket.emit(EVENTS.CONTROL_MODE, controlModePayload(room));
+            return;
+        }
+        if (room.controlMode === mode) return; // no-op, ignore (UI debounce backstop)
+
+        // M-4: per-room debounce — reject toggles faster than CONTROL_MODE_MIN_INTERVAL_MS.
+        // The host still gets the final state via the next legit change; this just
+        // kills the spam vector.
+        const now = Date.now();
+        if (now - room.lastControlModeChangeAt < CONTROL_MODE_MIN_INTERVAL_MS) {
+            log('ROOM', `Control mode toggle debounced in ${mapping.roomId.substring(0, 3)}***`);
+            // Re-sync the sender so any optimistic UI matches the actual (unchanged) state.
+            socket.emit(EVENTS.CONTROL_MODE, controlModePayload(room));
+            return;
+        }
+
+        room.controlMode = mode;
+        room.lastControlModeChangeAt = now;
+        room.lastActivity = now;
+        io.to(mapping.roomId).emit(EVENTS.CONTROL_MODE, controlModePayload(room));
+        log('ROOM', `Control mode set to '${mode}' by host in room ${mapping.roomId.substring(0, 3)}***`);
+    });
+
+    socket.on(EVENTS.SET_PEER_ROLE, (data) => {
+        if (!checkEventRate(socket.id)) {
+            log('SECURITY', `Event rate limit exceeded for socket (SET_PEER_ROLE): ${socket.id}`);
+            socket.disconnect(true);
+            return;
+        }
+        if (!data || typeof data !== 'object') return;
+        const targetPeerId = typeof data.peerId === 'string' ? data.peerId.substring(0, 16) : null;
+        const makeController = data.controller === true;
+        if (!targetPeerId) return;
+
+        const mapping = socketToRoom.get(socket.id);
+        if (!mapping) return;
+        const room = rooms.get(mapping.roomId);
+        if (!room || !room.controllers) return;
+
+        // Only the owner may promote/demote controllers.
+        if (mapping.peerId !== room.hostPeerId) {
+            log('AUTH', `Non-owner ${mapping.peerId} tried to set peer role in ${mapping.roomId.substring(0, 3)}***`);
+            socket.emit(EVENTS.CONTROL_MODE, controlModePayload(room));
+            return;
+        }
+        // The owner is always a controller and cannot be demoted.
+        if (targetPeerId === room.hostPeerId) return;
+        // Target must be a peer currently in the room.
+        const targetPresent = Array.from(room.peerData.values()).some(d => d.peerId === targetPeerId);
+        if (!targetPresent) return;
+
+        const now = Date.now();
+        if (now - (room.lastRoleChangeAt || 0) < CONTROL_MODE_MIN_INTERVAL_MS) {
+            log('ROOM', `Role change debounced in ${mapping.roomId.substring(0, 3)}***`);
+            socket.emit(EVENTS.CONTROL_MODE, controlModePayload(room));
+            return;
+        }
+
+        if (makeController) {
+            if (room.controllers.has(targetPeerId)) return; // no-op
+            room.controllers.add(targetPeerId);
+        } else {
+            if (!room.controllers.has(targetPeerId)) return; // no-op
+            room.controllers.delete(targetPeerId);
+        }
+        room.lastRoleChangeAt = now;
+        room.lastActivity = now;
+        io.to(mapping.roomId).emit(EVENTS.CONTROL_MODE, controlModePayload(room));
+        log('ROOM', `Peer ${targetPeerId} ${makeController ? 'promoted to' : 'demoted from'} controller in ${mapping.roomId.substring(0, 3)}***`);
+    });
+
    socket.on(EVENTS.EVENT_ACK, (data) => {
        if (!checkEventRate(socket.id)) {
            log('SECURITY', `Event rate limit exceeded for socket (ACK): ${socket.id}`);
@@ -648,12 +779,60 @@ io.on('connection', (socket) => {

        // Security: Only relay ACK if both peers are in the same room
        if (senderMapping && targetMapping && senderMapping.roomId === targetMapping.roomId) {
-            io.to(targetSocketId).emit(EVENTS.EVENT_ACK, { 
+            io.to(targetSocketId).emit(EVENTS.EVENT_ACK, {
                senderId: senderMapping.peerId,
                actionTimestamp: data.actionTimestamp
            });
-        } else {
+        } else if (senderMapping && targetMapping) {
+            // Both peers exist but live in different rooms — genuinely suspicious.
            log('SECURITY', `Blocked cross-room ACK attempt from ${socket.id} to ${data.targetId}`);
+        } else {
+            // Benign + common: sender or target left/disconnected before the ACK
+            // arrived (a command was in-flight when they went). Not an attack —
+            // log quietly (verbose only) so it doesn't drown out real signals.
+            log('ACKDROP', `Dropped ACK from ${socket.id} to absent peer ${data.targetId}`);
+        }
+    });
+
+    socket.on(EVENTS.PING, (data) => {
+        if (!checkEventRate(socket.id)) {
+            socket.disconnect(true);
+            return;
+        }
+        if (!data || typeof data.t !== 'number' || !Number.isFinite(data.t)) return;
+
+        if (typeof data.target === 'string' && data.target.length > 0) {
+            const targetSocketId = peerToSocket.get(data.target);
+            const senderMapping = socketToRoom.get(socket.id);
+            if (targetSocketId && senderMapping && data.target !== senderMapping.peerId) {
+                const targetMapping = socketToRoom.get(targetSocketId);
+                if (targetMapping && targetMapping.roomId === senderMapping.roomId) {
+                    io.to(targetSocketId).emit(EVENTS.PING, { t: data.t, sender: senderMapping.peerId });
+                    return;
+                }
+            }
+        }
+
+        socket.emit(EVENTS.PONG, { t: data.t });
+    });
+
+    socket.on(EVENTS.PONG, (data) => {
+        if (!checkEventRate(socket.id)) {
+            socket.disconnect(true);
+            return;
+        }
+        if (!data || typeof data.target !== 'string' || data.target.length === 0) return;
+        if (typeof data.t !== 'number' || !Number.isFinite(data.t)) return;
+
+        const senderMapping = socketToRoom.get(socket.id);
+        if (!senderMapping || data.target === senderMapping.peerId) return;
+
+        const targetSocketId = peerToSocket.get(data.target);
+        if (!targetSocketId) return;
+
+        const targetMapping = socketToRoom.get(targetSocketId);
+        if (targetMapping && targetMapping.roomId === senderMapping.roomId) {
+            io.to(targetSocketId).emit(EVENTS.PONG, { t: data.t });
        }
    });

@@ -662,10 +841,11 @@ io.on('connection', (socket) => {
        roomListCooldowns.delete(socket.id);
        const mapping = socketToRoom.get(socket.id);
        if (mapping) {
-            // Socket is already disconnected — no need to call socket.leave().
-            // removePeerFromRoom uses io.to() for notifications, which correctly
-            // excludes this dead socket since it has already left all rooms.
-            removePeerFromRoom(socket.id, mapping.roomId, 'disconnect');
+            try {
+                removePeerFromRoom(socket.id, mapping.roomId, 'disconnect');
+            } catch (err) {
+                log('ERROR', 'removePeerFromRoom failed in disconnect', err);
+            }
        }
    });
 });
@@ -690,12 +870,14 @@ const roomCleanupInterval = setInterval(() => {
            }
        }
        for (const sid of staleSids) {
-            // Gracefully evict the socket from the Socket.IO room if it is
-            // still technically connected (zombie with no heartbeat).
            const deadSocket = io.sockets?.sockets?.get(sid);
            if (deadSocket) deadSocket.leave(roomId);
            log('CLEANUP', `Pruning dead peer from room ${roomId.substring(0, 3)}***`);
-            removePeerFromRoom(sid, roomId, 'reaper');
+            try {
+                removePeerFromRoom(sid, roomId, 'reaper');
+            } catch (err) {
+                log('ERROR', 'removePeerFromRoom failed in reaper', err);
+            }
        }

        // 2. Prune empty or inactive rooms
@@ -736,7 +918,7 @@ export function startServer(port = PORT, host) {
 function gracefulShutdown(signal) {
    log('SERVER', `${signal} received — starting graceful shutdown...`);
    // 1. Notify all connected clients so they can display a meaningful message
-    io.emit(EVENTS.ERROR, { message: 'Server is restarting. Please reconnect in a moment.' });
+    io.emit(EVENTS.ERROR, { message: 'Server is restarting. Reconnecting automatically...' });
    // 2. Stop accepting new HTTP connections
    httpServer.close(() => {
        log('SERVER', 'HTTP server closed. Exiting.');
@@ -750,22 +932,18 @@ function gracefulShutdown(signal) {
 }

 export async function stopServerForTests() {
-    clearInterval(authFailureCleanupInterval);
-    clearInterval(rateLimitCleanupInterval);
+    stopRateLimitCleanup();
    clearInterval(roomCleanupInterval);
    rooms.clear();
    socketToRoom.clear();
    peerToSocket.clear();
    roomCreationLocks.clear();
-    connectionCounts.clear();
-    failedAuthAttempts.clear();
-    eventCounts.clear();
-    healthCounts.clear();
-    adminMetricsAuthCounts.clear();
-    roomListCooldowns.clear();
+    peerJoinLocks.clear();
+    clearRateLimitMaps();
    healthResponseCache.clear();
    io.removeAllListeners();
    io.disconnectSockets(true);
+    Object.assign(rateLimitDenied, { connections: 0, events: 0, health: 0, adminMetricsAuth: 0, roomList: 0 });
    if (!httpServer.listening) return;
    await new Promise((resolve, reject) => {
        httpServer.close((err) => err ? reject(err) : resolve());
@@ -785,8 +963,19 @@ if (isMainModule) {
        process.exit(1);
    });

+    let unhandledRejectionCount = 0;
+    let unhandledRejectionReset = Date.now();
    process.on('unhandledRejection', (reason) => {
-        log('ERROR', `Unhandled rejection: ${reason}`);
-        process.exit(1);
+        log('ERROR', `Unhandled rejection: ${reason}`, reason?.stack || '');
+        const now = Date.now();
+        if (now - unhandledRejectionReset > 60000) {
+            unhandledRejectionCount = 0;
+            unhandledRejectionReset = now;
+        }
+        unhandledRejectionCount++;
+        if (unhandledRejectionCount >= 5) {
+            log('ERROR', `Too many unhandled rejections (${unhandledRejectionCount}/min) — aborting`);
+            process.exit(1);
+        }
    });
 }
@@ -33,8 +33,17 @@ export function isAdminMetricsAuthorized(authHeader, adminToken) {
    const expectedBuffer = Buffer.from(adminToken);
    const providedBuffer = Buffer.from(provided);

-    if (expectedBuffer.length !== providedBuffer.length) return false;
-    return crypto.timingSafeEqual(expectedBuffer, providedBuffer);
+    // Always run timingSafeEqual to prevent length-based timing leaks.
+    // timingSafeEqual throws on different-length buffers, so when lengths
+    // differ we compare against a zeroed buffer of the provided length
+    // (guaranteed mismatch, constant time).
+    // NOTE: timingSafeEqual must be evaluated eagerly (assigned to const)
+    // before the && short-circuit, otherwise it's skipped on length mismatch
+    // and the timing leak remains.
+    const sameLength = expectedBuffer.length === providedBuffer.length;
+    const compareBuf = sameLength ? expectedBuffer : Buffer.alloc(providedBuffer.length);
+    const equal = crypto.timingSafeEqual(compareBuf, providedBuffer);
+    return sameLength && equal;
 }

 export function isAdminMetricsTokenStrong(adminToken, minLength = 32) {
@@ -48,7 +57,8 @@ export function buildHealthPayload({
    now = Date.now(),
    uptime = 0,
    memoryUsage = () => process.memoryUsage(),
-    rateLimitSizes = {}
+    rateLimitSizes = {},
+    rateLimitDenied = {}
 }) {
    const payload = {
        status: 'ok',
@@ -60,28 +70,42 @@ export function buildHealthPayload({

    if (!includeMetrics) return payload;

-    const roomValues = Array.from(rooms.values());
-    const roomSizes = roomValues.map(room => room.peers?.size || 0);
-    const peers = roomSizes.reduce((sum, size) => sum + size, 0);
-    const maxPeersInRoom = roomSizes.length > 0 ? Math.max(...roomSizes) : 0;
-    const avgPeersPerRoom = roomSizes.length > 0
-        ? Math.round((peers / roomSizes.length) * 100) / 100
+    let peers = 0;
+    let maxPeersInRoom = 0;
+    let roomsWithLobby = 0;
+    for (const room of rooms.values()) {
+        const size = room.peers?.size || 0;
+        peers += size;
+        if (size > maxPeersInRoom) maxPeersInRoom = size;
+        if (room.activeLobby) roomsWithLobby++;
+    }
+    const avgPeersPerRoom = rooms.size > 0
+        ? Math.round((peers / rooms.size) * 100) / 100
        : 0;
    const mem = memoryUsage();

    return {
        ...payload,
        peers,
-        roomsWithLobby: roomValues.filter(room => !!room.activeLobby).length,
+        roomsWithLobby,
        avgPeersPerRoom,
        maxPeersInRoom,
-        rateLimitEntries: {
-            connections: rateLimitSizes.connections || 0,
-            events: rateLimitSizes.events || 0,
-            health: rateLimitSizes.health || 0,
-            adminMetricsAuth: rateLimitSizes.adminMetricsAuth || 0,
-            authFailures: rateLimitSizes.authFailures || 0,
-            roomList: rateLimitSizes.roomList || 0
+        rateLimits: {
+            trackedClients: {
+                connections: rateLimitSizes.connections || 0,
+                events: rateLimitSizes.events || 0,
+                health: rateLimitSizes.health || 0,
+                adminMetricsAuth: rateLimitSizes.adminMetricsAuth || 0,
+                authFailures: rateLimitSizes.authFailures || 0,
+                roomList: rateLimitSizes.roomList || 0
+            },
+            denied: {
+                connections: rateLimitDenied.connections || 0,
+                events: rateLimitDenied.events || 0,
+                health: rateLimitDenied.health || 0,
+                adminMetricsAuth: rateLimitDenied.adminMetricsAuth || 0,
+                roomList: rateLimitDenied.roomList || 0
+            }
        },
        memory: {
            rss: mem.rss,
@@ -256,9 +256,9 @@
      }
    },
    "node_modules/engine.io": {
-      "version": "6.6.8",
-      "resolved": "https://registry.npmjs.org/engine.io/-/engine.io-6.6.8.tgz",
-      "integrity": "sha512-2agL3ueZhqxoVrfmntO8yuVj+uNSlIOnhykYHk3Cq0ShYPdUjjUiSJrQvXjq01I9jAuI0Zl2YO8Evv5Mqytm5g==",
+      "version": "6.6.9",
+      "resolved": "https://registry.npmjs.org/engine.io/-/engine.io-6.6.9.tgz",
+      "integrity": "sha512-clKkw4C7nJ22mGgoVcCg6V/W/TxdNyIOTr89k2ONZu81qqkddPFDF0LXcbAwhzPD8DjkiRCjzuiO6Y+fkpD4vg==",
      "license": "MIT",
      "dependencies": {
        "@types/cors": "^2.8.12",
@@ -270,7 +270,7 @@
        "cors": "~2.8.5",
        "debug": "~4.4.1",
        "engine.io-parser": "~5.2.1",
-        "ws": "~8.20.1"
+        "ws": "~8.21.0"
      },
      "engines": {
        "node": ">=10.2.0"
@@ -941,13 +941,13 @@
      }
    },
    "node_modules/socket.io-adapter": {
-      "version": "2.5.7",
-      "resolved": "https://registry.npmjs.org/socket.io-adapter/-/socket.io-adapter-2.5.7.tgz",
-      "integrity": "sha512-e0LyK91f3cUxTmv95/KzoLg47+zF+s/sbxRGDNsyG4dmIP8ZSX8ax6byOxfJXeNNtS/8AZlfD+uP7gBeR7DLlg==",
+      "version": "2.5.8",
+      "resolved": "https://registry.npmjs.org/socket.io-adapter/-/socket.io-adapter-2.5.8.tgz",
+      "integrity": "sha512-6Oy52pbg+kvdCVvjcN+FnY7BvxZ7cIHNScbvztT/It5d0vbwoJoVZmF2gjJmnV0/4WlXRfG15zc45ySk9Ah8bw==",
      "license": "MIT",
      "dependencies": {
        "debug": "~4.4.1",
-        "ws": "~8.20.1"
+        "ws": "~8.21.0"
      }
    },
    "node_modules/socket.io-parser": {
@@ -1069,9 +1069,9 @@
      "license": "ISC"
    },
    "node_modules/ws": {
-      "version": "8.20.1",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.1.tgz",
-      "integrity": "sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w==",
+      "version": "8.21.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
+      "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
      "license": "MIT",
      "engines": {
        "node": ">=10.0.0"
@@ -4,6 +4,7 @@
  "description": "",
  "main": "index.js",
  "scripts": {
+    "start": "node index.js",
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
@@ -0,0 +1,172 @@
+/**
+ * KoalaSync Rate Limiter
+ * Connection, event, health, and auth rate limiting for the relay server.
+ */
+
+export const ROOM_LIST_COOLDOWN_MS = 10000;
+export const HEALTH_RATE_LIMIT_PER_MINUTE = 10;
+export const ADMIN_METRICS_AUTH_RATE_LIMIT_PER_MINUTE = 5;
+
+// --- Connection & event budgets (formerly inline magic numbers) ---
+export const CONNECTION_RATE_LIMIT = 10;           // max new connections per IP per window
+export const CONNECTION_RATE_WINDOW_MS = 60000;    // 1 minute
+export const EVENT_RATE_LIMIT = 50;                // max relayed events per socket per window
+export const EVENT_RATE_WINDOW_MS = 10000;         // 10 seconds
+export const HEALTH_RATE_WINDOW_MS = 60000;        // 1 minute
+export const ADMIN_METRICS_AUTH_WINDOW_MS = 60000; // 1 minute
+
+export const connectionCounts = new Map(); // ip -> { count, resetTime }
+export const failedAuthAttempts = new Map(); // Map<IP+RoomID, {count, lastAttempt}>
+export const eventCounts = new Map(); // socketId -> { count, resetTime }
+export const healthCounts = new Map(); // ip -> { count, resetTime }
+export const adminMetricsAuthCounts = new Map(); // ip -> { count, resetTime }
+export const roomListCooldowns = new Map(); // socketId -> last allowed timestamp
+
+export const rateLimitDenied = {
+    connections: 0,
+    events: 0,
+    health: 0,
+    adminMetricsAuth: 0,
+    roomList: 0
+};
+
+let authCleanupId = null;
+let rateLimitCleanupId = null;
+
+export function checkAuthRate(ip, roomId) {
+    const key = `${ip}:${roomId}`;
+    const now = Date.now();
+    const record = failedAuthAttempts.get(key) || { count: 0, lastAttempt: 0 };
+
+    if (record.count >= 5 && (now - record.lastAttempt) < 15 * 60 * 1000) {
+        return false;
+    }
+
+    if ((now - record.lastAttempt) > 2 * 60 * 1000) {
+        record.count = 0;
+    }
+
+    return true;
+}
+
+export function recordAuthFailure(ip, roomId) {
+    if (failedAuthAttempts.size > 200000) {
+        const now = Date.now();
+        for (const [key, record] of failedAuthAttempts.entries()) {
+            if (now - record.lastAttempt > 15 * 60 * 1000) {
+                failedAuthAttempts.delete(key);
+            } else {
+                break;
+            }
+        }
+
+        if (failedAuthAttempts.size > 200000) {
+            console.warn('SECURITY: failedAuthAttempts size exceeded 200000. Performing insertion-order eviction.');
+            for (const [key] of failedAuthAttempts.entries()) {
+                if (failedAuthAttempts.size <= 190000) {
+                    break;
+                }
+                failedAuthAttempts.delete(key);
+            }
+        }
+    }
+    const key = `${ip}:${roomId}`;
+    const record = failedAuthAttempts.get(key) || { count: 0, lastAttempt: 0 };
+    record.count++;
+    record.lastAttempt = Date.now();
+    failedAuthAttempts.delete(key);
+    failedAuthAttempts.set(key, record);
+}
+
+export function checkConnectionRate(ip) {
+    const now = Date.now();
+    const entry = connectionCounts.get(ip) || { count: 0, resetTime: now + CONNECTION_RATE_WINDOW_MS };
+    if (now > entry.resetTime) { entry.count = 0; entry.resetTime = now + CONNECTION_RATE_WINDOW_MS; }
+    entry.count++;
+    connectionCounts.set(ip, entry);
+    if (entry.count <= CONNECTION_RATE_LIMIT) return true;
+    rateLimitDenied.connections++;
+    return false;
+}
+
+export function checkEventRate(socketId) {
+    const now = Date.now();
+    const entry = eventCounts.get(socketId) || { count: 0, resetTime: now + EVENT_RATE_WINDOW_MS };
+    if (now > entry.resetTime) { entry.count = 0; entry.resetTime = now + EVENT_RATE_WINDOW_MS; }
+    entry.count++;
+    eventCounts.set(socketId, entry);
+    if (entry.count <= EVENT_RATE_LIMIT) return true;
+    rateLimitDenied.events++;
+    return false;
+}
+
+export function checkHealthRate(ip) {
+    const now = Date.now();
+    const entry = healthCounts.get(ip) || { count: 0, resetTime: now + HEALTH_RATE_WINDOW_MS };
+    if (now > entry.resetTime) { entry.count = 0; entry.resetTime = now + HEALTH_RATE_WINDOW_MS; }
+    entry.count++;
+    healthCounts.set(ip, entry);
+    if (entry.count <= HEALTH_RATE_LIMIT_PER_MINUTE) return true;
+    rateLimitDenied.health++;
+    return false;
+}
+
+export function checkAdminMetricsAuthRate(ip) {
+    const now = Date.now();
+    const entry = adminMetricsAuthCounts.get(ip) || { count: 0, resetTime: now + ADMIN_METRICS_AUTH_WINDOW_MS };
+    if (now > entry.resetTime) { entry.count = 0; entry.resetTime = now + ADMIN_METRICS_AUTH_WINDOW_MS; }
+    entry.count++;
+    adminMetricsAuthCounts.set(ip, entry);
+    if (entry.count <= ADMIN_METRICS_AUTH_RATE_LIMIT_PER_MINUTE) return true;
+    rateLimitDenied.adminMetricsAuth++;
+    return false;
+}
+
+export function startRateLimitCleanup(io) {
+    if (authCleanupId !== null || rateLimitCleanupId !== null) return; // guard double-start
+    // Clean up old auth failure records (every 15 minutes)
+    authCleanupId = setInterval(() => {
+        const now = Date.now();
+        for (const [key, record] of failedAuthAttempts.entries()) {
+            if (now - record.lastAttempt > 15 * 60 * 1000) {
+                failedAuthAttempts.delete(key);
+            }
+        }
+    }, 15 * 60 * 1000);
+
+    // Clean up rate-limit maps to prevent memory leaks (every 60 seconds)
+    rateLimitCleanupId = setInterval(() => {
+        const now = Date.now();
+        for (const [ip, entry] of connectionCounts.entries()) {
+            if (now > entry.resetTime) connectionCounts.delete(ip);
+        }
+        for (const [socketId, entry] of eventCounts.entries()) {
+            if (now > entry.resetTime || !io.sockets.sockets.has(socketId)) {
+                eventCounts.delete(socketId);
+            }
+        }
+        for (const [ip, entry] of healthCounts.entries()) {
+            if (now > entry.resetTime) healthCounts.delete(ip);
+        }
+        for (const [ip, entry] of adminMetricsAuthCounts.entries()) {
+            if (now > entry.resetTime) adminMetricsAuthCounts.delete(ip);
+        }
+        for (const [socketId] of roomListCooldowns.entries()) {
+            if (!io.sockets.sockets.has(socketId)) roomListCooldowns.delete(socketId);
+        }
+    }, 60000);
+}
+
+export function stopRateLimitCleanup() {
+    if (authCleanupId) { clearInterval(authCleanupId); authCleanupId = null; }
+    if (rateLimitCleanupId) { clearInterval(rateLimitCleanupId); rateLimitCleanupId = null; }
+}
+
+export function clearRateLimitMaps() {
+    connectionCounts.clear();
+    failedAuthAttempts.clear();
+    eventCounts.clear();
+    healthCounts.clear();
+    adminMetricsAuthCounts.clear();
+    roomListCooldowns.clear();
+}
@@ -4,7 +4,7 @@ This directory contains constants and protocol definitions used by both the exte

 ## Syncing with the Extension
 > [!IMPORTANT]
-> Every time this directory is modified, you must run `node scripts/build-extension.js` to keep the extension's copy up to date.
+> Every time this directory is modified, you must run `node scripts/build-extension.cjs` to keep the extension's copy up to date.

 Because Browser Extensions (Manifest V3) cannot load files outside their root directory, all files in this directory must be copied to `extension/shared/` whenever they are modified. The build script handles this automatically.

@@ -2,7 +2,7 @@
 * blacklist.js
 * 
 * ⚠️ WARNING: This is the SINGLE SOURCE OF TRUTH.
- * If you edit this file, you MUST run: node scripts/build-extension.js
+ * If you edit this file, you MUST run: node scripts/build-extension.cjs
 * to propagate changes to the extension and relay server.
 * 
 * Domains to be filtered out from the tab selection dropdown to reduce "noise".
@@ -2,18 +2,17 @@
 * KoalaSync Shared Constants & Protocol Definitions
 * 
 * ⚠️ WARNING: This is the SINGLE SOURCE OF TRUTH.
- * If you edit this file, you MUST run: node scripts/build-extension.js
+ * If you edit this file, you MUST run: node scripts/build-extension.cjs
 * to propagate changes to the extension and relay server.
 */

 export const PROTOCOL_VERSION = "1.0.0";
-export const APP_VERSION = "1.9.0";
+export const APP_VERSION = "2.5.0";

 export const OFFICIAL_SERVER_URL = 'wss://syncserver.koalastuff.net';
 export const OFFICIAL_LANDING_PAGE_URL = 'https://sync.koalastuff.net';
 export const OFFICIAL_SERVER_TOKEN = '62170b705234c4f4807a9b22420bb93cf1a2aacfa4c5d3b47804482babb8eb50';
 export const SUPPORT_URL = 'https://support.koalastuff.net';
-export const KOFI_URL = 'https://ko-fi.com/koaladev';
 export const GITHUB_URL = 'https://github.com/Shik3i/KoalaSync';

 export function isFirefox() {
@@ -34,6 +33,11 @@ export const EVENTS = {
    ROOM_DATA: "room_data", // Server -> Client: current room state
    ERROR: "error",

+    // Host Control Mode
+    SET_CONTROL_MODE: "set_control_mode", // Client -> Server: host sets room control mode ('everyone' | 'host-only')
+    CONTROL_MODE: "control_mode",          // Server -> Client: control mode/role changed { controlMode, hostPeerId, controllers }
+    SET_PEER_ROLE: "set_peer_role",        // Client -> Server: owner promotes/demotes a peer { peerId, controller }
+
    // Media Control
    PLAY: "play",
    PAUSE: "pause",
@@ -51,7 +55,29 @@ export const EVENTS = {
    // Episode Auto-Sync
    EPISODE_LOBBY: "episode_lobby",     // Broadcast: waiting for everyone on this episode
    EPISODE_READY: "episode_ready",      // Response: loaded the episode and paused at 0:00
-    EPISODE_LOBBY_CANCEL: "episode_lobby_cancel" // Broadcast: cancel active lobby and resume
+    EPISODE_LOBBY_CANCEL: "episode_lobby_cancel", // Broadcast: cancel active lobby and resume
+
+    // Ping / Latency
+    PING: "ping",  // { t: timestamp, target?: peerId } — empty target = server echo
+    PONG: "pong"   // server responds with same { t } for client RTT calculation
+};
+
+// Room control modes (Host Control Mode feature).
+// NOTE: content.js does not import this module — it uses the string literals
+// 'everyone' / 'host-only' directly. Keep these values in sync there.
+export const CONTROL_MODES = {
+    EVERYONE: 'everyone',   // default: anyone can play/pause/seek for the room
+    HOST_ONLY: 'host-only'  // only the host drives the room
+};
+
+// Server feature capabilities, advertised to clients in ROOM_DATA. Lets a client
+// detect what the relay actually supports instead of inferring it from the
+// presence of a data field — so new server features degrade cleanly on older
+// relays (unknown/absent list → feature treated as unavailable) and old clients
+// simply ignore the field. Add a flag here as each server-gated feature lands.
+export const CAPABILITIES = {
+    HOST_CONTROL: 'host-control',
+    CO_HOST: 'co-host'  // owner promotes guests to additional controllers
 };

 export const HEARTBEAT_INTERVAL = 15000; // 15s
@@ -2,7 +2,7 @@
 * KoalaSync Shared Name Generation & Emoji Mapping
 *
 * ⚠️ WARNING: This is the SINGLE SOURCE OF TRUTH.
- * If you edit this file, you MUST run: node scripts/build-extension.js
+ * If you edit this file, you MUST run: node scripts/build-extension.cjs
 * to propagate changes to the extension.
 *
 * The emoji map covers every animal/creature that has a Unicode emoji.
@@ -21,7 +21,7 @@ export const USERNAME_ADJECTIVES = [
    'Cosmic', 'Neon', 'Shadow', 'Crystal', 'Thunder', 'Silent', 'Golden',
    'Fierce', 'Noble', 'Mystic', 'Frozen', 'Blazing', 'Sapphire', 'Iron', 'Crimson',
    'Turbo', 'Zen', 'Pixel', 'Cyber', 'Solar', 'Lunar', 'Astro', 'Hyper',
-    'Steel', 'Rogue', 'Alpha', 'Omega', 'Royal', 'Pixel', 'Warp', 'Frost',
+    'Steel', 'Rogue', 'Alpha', 'Omega', 'Royal', 'Nitro', 'Warp', 'Frost',
 ];

 export const USERNAME_NOUNS = [
@@ -39,7 +39,7 @@ export const USERNAME_NOUNS = [
    'Mouse', 'Pig', 'Boar', 'Polar', 'Orangutan', 'Mammoth',
    'Crow', 'Duck', 'Swan', 'Penguin', 'Parrot', 'Peacock',
    'Dove', 'Dodo', 'Turkey', 'Flamingo', 'Chicken', 'Rooster', 'Goose',
-    'Dolphin', 'Whale', 'Crab', 'Lobster', 'Octopus', 'Squid',
+    'Dolphin', 'Whale', 'Crab', 'Lobster', 'Octopus', 'Opossum', 'Squid',
    'Jellyfish', 'Turtle',
    'Crocodile', 'Lizard', 'Snake', 'Frog', 'Toad', 'Gecko',
    'Bee', 'Ant', 'Spider', 'Scorpion', 'Butterfly', 'Ladybug',
@@ -102,7 +102,7 @@ export const ANIMAL_EMOJI_MAP = {
    'mammoth': '🦣',
    'meerkat': '🦦',
    'octopus': '🐙',
-    'opposum': '🐭',
+    'opossum': '🐭',
    'ostrich': '🐦',
    'panther': '🐆',
    'pelican': '🦩',
@@ -5,7 +5,7 @@ This directory contains the KoalaSync website. It serves a dual purpose: it is b
 ## Core Roles

 ### 1. Marketing & Onboarding
-Provides a premium, multi-language (EN/DE/FR/ES/PT-BR/RU) overview of features, setup instructions, and direct links to the extension stores.
+Provides a premium, multi-language (EN/DE/FR/ES/PT-BR/RU/IT/PL/TR/NL/JA/KO/PT) overview of features, setup instructions, and direct links to the extension stores.

 ### 2. The Invitation Bridge (`join.html`)
 The website handles incoming invitation links. When a user clicks a link like `sync.koalastuff.net/join.html#join:roomID:pass`, the website:
@@ -16,8 +16,8 @@ The website handles incoming invitation links. When a user clicks a link like `s
 ## Architecture

 The website is 100% **Static HTML, CSS, and JS**. 
- **Static i18n Compiler**: The site uses a lightweight, zero-dependency Node.js compiler (`build.js`) to parse dictionary files inside `/locales/` against a single source-of-truth template (`template.html`), outputting the fully deployable static folder to `/www/`.
- **Build-time Minification**: `build.js` automatically minifies CSS and JS during compilation using a built-in state-machine tokenizer (no npm dependencies). Source files are written unminified (`style.css`, `app.js`, `lang-init.js`) — always edit source files, never the generated `.min.*` files in `www/`.
+- **Static i18n Compiler**: The site uses a lightweight, zero-dependency Node.js compiler (`build.cjs`) to parse dictionary files inside `/locales/` against a single source-of-truth template (`template.html`), outputting the fully deployable static folder to `/www/`.
+- **Build-time Minification**: `build.cjs` automatically minifies CSS and JS during compilation using a built-in state-machine tokenizer (no npm dependencies). Source files are written unminified (`style.css`, `app.js`, `lang-init.js`) — always edit source files, never the generated `.min.*` files in `www/`.
 - **Zero Backend**: No Node.js, PHP, or databases are required to host the compiled website.
 - **Zero Tracking**: All assets (fonts, icons) are self-hosted to prevent third-party tracking.
 - **Responsive**: Fully optimized for mobile with a native-feel hamburger menu.
@@ -62,7 +62,7 @@ sync.koalastuff.net {

 1. Run the compilation script from the repository root to generate the `/website/www` folder:
   ```bash
-   node website/build.js
+   node website/build.cjs
   ```
 2. Serve the compiled `/www` directory using any local development server:
   ```bash
@@ -71,4 +71,4 @@ sync.koalastuff.net {
 3. To test the invitation flow locally, navigate to `http://localhost:5000/join.html#join:test-room:test-pass`.

 > [!IMPORTANT]
-> **Never edit files inside `website/www/` directly.** This directory is fully auto-generated by `build.js`. Always edit source files (`template.html`, `style.css`, `app.js`, `lang-init.js`, locale files in `locales/`) and re-run `node website/build.js` to apply changes. CSS and JS are output as `style.min.css`, `app.min.js`, and `lang-init.min.js` — the `.min.*` naming makes it visually obvious these are build artifacts. Editing minified files in `www/` will result in lost changes on the next build.
+> **Never edit files inside `website/www/` directly.** This directory is fully auto-generated by `build.cjs`. Always edit source files (`template.html`, `style.css`, `app.js`, `lang-init.js`, locale files in `locales/`) and re-run `node website/build.cjs` to apply changes. CSS and JS are output as `style.min.css`, `app.min.js`, and `lang-init.min.js` — the `.min.*` naming makes it visually obvious these are build artifacts. Editing minified files in `www/` will result in lost changes on the next build.
@@ -1,194 +0,0 @@
-# KoalaSync Translation & Localization Guide
-
-Welcome to the **KoalaSync** translation and internationalization framework! This document provides clear, professional instructions for developers and contributors looking to maintain, audit, or add new languages to the official KoalaSync website.
-
---
-
-## 🏛️ Architecture Overview
-
-The KoalaSync website utilizes a custom, high-performance, zero-dependency static site generator built in Node.js. Instead of using complex client-side translation runtimes or bulky frameworks, localized pages are compiled ahead-of-time (AOT) to maintain lightning-fast page speeds and strict data sovereignty.
-
-*   **Template Source:** [`website/template.html`](file:///Users/koala/Documents/KoalaPlay/website/template.html) (Single Source of Truth)
-*   **Locales Source:** `/website/locales/[lang].json` (Structured JSON translation dictionaries)
-*   **Build Pipeline:** [`website/build.js`](file:///Users/koala/Documents/KoalaPlay/website/build.js) (Pure Node.js script that compiles pages into `/website/www/`)
-
---
-
-## 📊 Supported Languages Dashboard
-
-We divide supported languages into two tiers: **Core Languages** (fully hand-crafted and audited by native speakers) and **Extended Languages** (auto-generated using translation models to expand initial coverage).
-
-> [!TIP]
-> **Help Us Improve!**
-> We welcome community contributions to audit "Auto-Generated" translations and elevate them to "Verified" status.
-
-| Language Code | Language Name | Verification Status | Rationale / Context |
-| :--- | :--- | :--- | :--- |
-| `en` | 🇬🇧 **English** | `100% Manually Verified` | Primary developer language and system default |
-| `de` | 🇩🇪 **German** | `100% Manually Verified` | Core market and compliance baseline |
-| `fr` | 🇫🇷 **French** | `Auto-Generated` | Needs manual native review and polishing |
-| `es` | 🇪🇸 **Spanish** | `Auto-Generated` | Needs manual native review and polishing |
-| `pt-BR` | 🇧🇷 **Portuguese (Brasil)** | `Auto-Generated` | Needs manual native review and polishing |
-| `ru` | 🇷🇺 **Russian** | `Auto-Generated` | Needs manual native review and polishing |
-| `it` | 🇮🇹 **Italian** | `Auto-Generated` | Needs manual native review and polishing |
-| `pl` | 🇵🇱 **Polish** | `Auto-Generated` | Needs manual native review and polishing |
-| `tr` | 🇹🇷 **Turkish** | `Auto-Generated` | Needs manual native review and polishing |
-| `nl` | 🇳🇱 **Dutch** | `Auto-Generated` | Needs manual native review and polishing |
-| `ja` | 🇯🇵 **Japanese** | `Auto-Generated` | Needs manual native review and polishing |
-| `ko` | 🇰🇷 **Korean** | `Auto-Generated` | Needs manual native review and polishing |
-| `pt` | 🇵🇹 **European Portuguese** | `Auto-Generated` | Needs manual native review and polishing |
-
-> [!WARNING]
-> **Autogeneration Quality Rule**
-> Any newly contributed languages must be committed as `"Auto-Generated"` until fully reviewed and signed off by a native speaker in a pull request.
-
---
-
-## ⚖️ Strict Legal Exclusion Rule
-
-Our legal pages have strict constraints to protect user privacy and avoid regulatory liabilities.
-
-> [!IMPORTANT]
-> **DO NOT TRANSLATE LEGAL DOCUMENTS**
-> The legal notice ([impressum.html](file:///Users/koala/Documents/KoalaPlay/website/impressum.html)) and privacy policy ([datenschutz.html](file:///Users/koala/Documents/KoalaPlay/website/datenschutz.html)) **MUST remain exclusively in English and German**.
-> 
-> *   **Rationale:** Legal compliance under the European Union General Data Protection Regulation (GDPR) and the German Digital Services Act (DDG). Offering automated translations of legally binding notices introduces compliance risks due to potential mistranslations of liability limits.
-> *   **Technical Fallback:** The dynamic initializer script (`lang-init.js`) is configured to automatically fallback to **English** for legal pages if a user visits them with a French, Spanish, or other unsupported language preference, keeping their dynamic dropdown choice intact for homepage links.
-
---
-
-## 🛠️ Step-by-Step: Adding a New Language
-
-Adding a new language (e.g., Italian - `it`) is straightforward. Follow these four structured steps:
-
-### Step 1: Create the Translation Dictionary
-Create a new JSON file inside the locales directory named `[lang].json` (e.g., `website/locales/it.json`).
-1. Copy the structure of [`website/locales/en.json`](file:///Users/koala/Documents/KoalaPlay/website/locales/en.json) to use as your baseline.
-2. Translate all string values while keeping the JSON keys identical.
-3. Configure the language metadata keys at the top of the file:
-   ```json
-   {
-     "LANG_CODE": "it",
-     "HTML_CLASS": "lang-it",
-     "CANONICAL_PATH": "it/",
-     "LANG_TOGGLE_URL": "../",
-     "LANG_TOGGLE_TEXT": "EN"
-   }
-   ```
-
-### Step 2: Register in the Compiler
-Open the static site generator script [`website/build.js`](file:///Users/koala/Documents/KoalaPlay/website/build.js) and append your new language code to the active `languages` array:
-```javascript
-// Add 'it' to the array
-const languages = ['en', 'de', 'fr', 'es', 'pt-BR', 'ru', 'it'];
-```
-
-### Step 3: Run the Build Script
-Execute the compiler from the root of the repository:
-```bash
-node website/build.js
-```
-The compiler will automatically:
-1. Load the new JSON translation file.
-2. Create the target subdirectory `/website/www/it/`.
-3. Generate the compiled `/website/www/it/index.html` landing page, injecting correct relative assets and canonical metadata.
-
-### Step 4: Update the Dashboard
-Open this `TRANSLATION.md` file and add your language to the **Supported Languages Dashboard** table, marking it as `Auto-Generated` (unless manually verified).
-
---
-
-## 🔮 Future Roadmap: Dynamic Utility Pages
-
-For pages that require fully dynamic, client-side interactions (like the room invitation bridge [`join.html`](file:///Users/koala/Documents/KoalaPlay/website/join.html)), we need to scale to unlimited languages without bloating the HTML size or polluting the URL.
-
-### Clean Client-Side i18n Architecture
-
-To maintain zero URL pollution (e.g. keeping invitation links clean as `/join.html#join:roomID:password`), we propose an **asynchronous JSON dictionary injection architecture**:
-
-#### 1. Page Lifecycle Flow
-1. **User Landing:** The guest enters `/join.html` with a shared hash.
-2. **Language Resolution:** `lang-init.js` immediately reads their saved preference (`localStorage` or `navigator.language`) and applies the active class (e.g. `html.lang = "es"`).
-3. **Async Fetching:** A client-side loader script (`i18n-client.js`) runs asynchronously, downloading the correct dictionary (`fetch("/locales/es.json")`).
-4. **DOM Translation:** The script scans the page for elements carrying a `data-i18n` attribute and safely updates their text content at runtime, avoiding dual-text nodes and stylesheet recalculations.
-
-#### 2. Declarative HTML Markup
-Elements are defined with custom data attributes specifying translation keys. English text is placed as the static HTML fallback:
-```html
-<h1 data-i18n="JOIN_TITLE">Ready to sync?</h1>
-<p id="join-desc" data-i18n="JOIN_SUBTITLE">You've been invited to join a session.</p>
-```
-
-#### 3. Zero-Dependency Engine (`i18n-client.js`)
-```javascript
-document.addEventListener('DOMContentLoaded', async () => {
-    // 1. Recover the language determined during early initialization
-    const activeLang = document.documentElement.lang || 'en';
-    if (activeLang === 'en') return; // Default markup is already in English
-    
-    // 2. Fetch the corresponding locale JSON asynchronously
-    try {
-        const response = await fetch(`locales/${activeLang}.json`);
-        if (!response.ok) throw new Error('Locale file unavailable');
-        const dictionary = await response.json();
-        
-        // 3. Scan and translate data-i18n attributes
-        document.querySelectorAll('[data-i18n]').forEach(el => {
-            const key = el.getAttribute('data-i18n');
-            if (dictionary[key]) {
-                if (el.tagName === 'IMG') {
-                    el.alt = dictionary[key];
-                } else {
-                    el.textContent = dictionary[key];
-                }
-            }
-        });
-    } catch (err) {
-        console.warn('Dynamic i18n loading failed. Defaulting to English:', err);
-    }
-});
-```
-
-#### Core Benefits
-*   **Zero URL Pollution:** Keeps invitation hashes private and avoids messy query parameters (`?lang=de`), protecting user privacy.
-*   **Optimal Performance:** Eliminates duplicate hidden text blocks, cutting page weight in half and ensuring smooth rendering.
-*   **Infinite Scale:** Adding new languages to dynamic pages requires zero edits to HTML markup; the engine simply fetches new JSON dictionaries on-demand.
-
---
-
-## 🔌 Extension Internationalization (i18n)
-
-In **v2.0**, we extended full internationalization support to the **Browser Extension itself**. The architecture mirrors our web-based dynamic localization model to maintain complete parity.
-
-*   **Locales Directory:** [`extension/locales/`](file:///Users/koala/Documents/KoalaPlay/extension/locales/)
-*   **Active Dictionaries:**
-    *   [`en.json`](file:///Users/koala/Documents/KoalaPlay/extension/locales/en.json) (🇬🇧 Baseline English)
-    *   [`de.json`](file:///Users/koala/Documents/KoalaPlay/extension/locales/de.json) (🇩🇪 German)
-    *   [`fr.json`](file:///Users/koala/Documents/KoalaPlay/extension/locales/fr.json) (🇫🇷 French)
-    *   [`es.json`](file:///Users/koala/Documents/KoalaPlay/extension/locales/es.json) (🇪🇸 Spanish)
-    *   [`pt-BR.json`](file:///Users/koala/Documents/KoalaPlay/extension/locales/pt-BR.json) (🇧🇷 Portuguese (Brasil))
-    *   [`ru.json`](file:///Users/koala/Documents/KoalaPlay/extension/locales/ru.json) (🇷🇺 Russian)
-    *   [`it.json`](file:///Users/koala/Documents/KoalaPlay/extension/locales/it.json) (🇮🇹 Italian)
-    *   [`pl.json`](file:///Users/koala/Documents/KoalaPlay/extension/locales/pl.json) (🇵🇱 Polish)
-    *   [`tr.json`](file:///Users/koala/Documents/KoalaPlay/extension/locales/tr.json) (🇹🇷 Turkish)
-    *   [`nl.json`](file:///Users/koala/Documents/KoalaPlay/extension/locales/nl.json) (🇳🇱 Dutch)
-    *   [`ja.json`](file:///Users/koala/Documents/KoalaPlay/extension/locales/ja.json) (🇯🇵 Japanese)
-    *   [`ko.json`](file:///Users/koala/Documents/KoalaPlay/extension/locales/ko.json) (🇰🇷 Korean)
-    *   [`pt.json`](file:///Users/koala/Documents/KoalaPlay/extension/locales/pt.json) (🇵🇹 European Portuguese)
-*   **Translation Engine:** [`extension/i18n.js`](file:///Users/koala/Documents/KoalaPlay/extension/i18n.js)
-*   **Validation Script:** [`scripts/test-locales.js`](file:///Users/koala/Documents/KoalaPlay/scripts/test-locales.js)
-
-### ⚙️ How it Works inside the Extension
-
-1. **System Locale Auto-Detection**: On first run, the extension detects the browser system language using `navigator.language` or `chrome.i18n.getUILanguage()`.
-2. **On-the-Fly Redraws**: When the user selects a different language in the settings tab (`#langSelector`), the selection is stored in `chrome.storage.sync` and the translation engine immediately triggers `translateDOM()`. The interface, empty state cards, tooltips, dynamic onboarding tutorial guides, and status badges re-render instantly without reloading the popup.
-3. **Localized System Notifications**: On play, pause, or seek commands, `background.js` retrieves the user's active locale preference from storage, loads the correct dictionary, and pushes native OS notifications fully translated.
-
-### 🧪 Auditing & Sync Checks
-
-To ensure that no language dictionary falls out of sync (causing missing labels or blank interfaces), developers must run the locale auditor tool before packaging releases:
-```bash
-node scripts/test-locales.js
-```
-This script asserts that all JSON dictionary files under `extension/locales/` share exactly the same set of keys as the English baseline (`en.json`).
-
@@ -0,0 +1,207 @@
+<!DOCTYPE html>
+<html lang="{{LANG_CODE}}" class="lang-{{LANG_CODE}}">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>{{ALT_INDEX_TITLE}}</title>
+    <link rel="preload" href="{{ASSET_PATH}}style.min.css" as="style">
+    <link rel="stylesheet" href="{{ASSET_PATH}}style.min.css">
+    <link rel="icon" type="image/webp" href="{{ASSET_PATH}}assets/NewLogoIcon_64.webp">
+    <link rel="canonical" href="https://sync.koalastuff.net/{{LANG_PREFIX}}alternatives">
+    
+    <link rel="alternate" hreflang="en" href="https://sync.koalastuff.net/alternatives">
+    <link rel="alternate" hreflang="de" href="https://sync.koalastuff.net/de/alternatives">
+    <link rel="alternate" hreflang="fr" href="https://sync.koalastuff.net/fr/alternatives">
+    <link rel="alternate" hreflang="es" href="https://sync.koalastuff.net/es/alternatives">
+    <link rel="alternate" hreflang="pt-br" href="https://sync.koalastuff.net/pt-BR/alternatives">
+    <link rel="alternate" hreflang="ru" href="https://sync.koalastuff.net/ru/alternatives">
+    <link rel="alternate" hreflang="it" href="https://sync.koalastuff.net/it/alternatives">
+    <link rel="alternate" hreflang="pl" href="https://sync.koalastuff.net/pl/alternatives">
+    <link rel="alternate" hreflang="tr" href="https://sync.koalastuff.net/tr/alternatives">
+    <link rel="alternate" hreflang="nl" href="https://sync.koalastuff.net/nl/alternatives">
+    <link rel="alternate" hreflang="ja" href="https://sync.koalastuff.net/ja/alternatives">
+    <link rel="alternate" hreflang="ko" href="https://sync.koalastuff.net/ko/alternatives">
+    <link rel="alternate" hreflang="zh" href="https://sync.koalastuff.net/zh/alternatives">
+    <link rel="alternate" hreflang="uk" href="https://sync.koalastuff.net/uk/alternatives">
+    <link rel="alternate" hreflang="pt" href="https://sync.koalastuff.net/pt/alternatives">
+    <link rel="alternate" hreflang="x-default" href="https://sync.koalastuff.net/alternatives">
+    
+    <meta name="description" content="{{ALT_INDEX_META_DESC}}">
+    <meta name="robots" content="index, follow">
+
+    <!-- Open Graph / Facebook -->
+    <meta property="og:type" content="website">
+    <meta property="og:url" content="https://sync.koalastuff.net/{{LANG_PREFIX}}alternatives">
+    <meta property="og:title" content="{{ALT_INDEX_TITLE}}">
+    <meta property="og:description" content="{{ALT_INDEX_META_DESC}}">
+    <meta property="og:image" content="https://sync.koalastuff.net/assets/RemoteProf.webp">
+    <meta property="og:locale" content="{{OG_LOCALE}}">
+
+    <!-- Twitter / X -->
+    <meta name="twitter:card" content="summary_large_image">
+    <meta name="twitter:title" content="{{ALT_INDEX_TITLE}}">
+    <meta name="twitter:description" content="{{ALT_INDEX_META_DESC}}">
+    <meta name="twitter:image" content="https://sync.koalastuff.net/assets/RemoteProf.webp">
+
+    <!-- Structured Data (Schema.org) for Breadcrumbs -->
+    <script type="application/ld+json">
+    {
+      "@context": "https://schema.org",
+      "@type": "BreadcrumbList",
+      "itemListElement": [
+        {
+          "@type": "ListItem",
+          "position": 1,
+          "name": "Home",
+          "item": "https://sync.koalastuff.net/{{LANG_PREFIX}}"
+        },
+        {
+          "@type": "ListItem",
+          "position": 2,
+          "name": "Alternatives",
+          "item": "https://sync.koalastuff.net/{{LANG_PREFIX}}alternatives"
+        }
+      ]
+    }
+    </script>
+
+    <!-- Organization Schema -->
+    <script type="application/ld+json">
+    {
+      "@context": "https://schema.org",
+      "@type": "Organization",
+      "name": "KoalaSync",
+      "url": "https://sync.koalastuff.net/",
+      "logo": "https://sync.koalastuff.net/assets/NewLogoIcon_128.webp",
+      "sameAs": [
+        "https://github.com/Shik3i/KoalaSync",
+        "https://mastodon.social/@koalastuff"
+      ]
+    }
+    </script>
+
+    <!-- Mobile Browser Theme Styling -->
+    <meta name="theme-color" content="#0f172a">
+    <meta name="mobile-web-app-capable" content="yes">
+    <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
+
+    <script src="{{ASSET_PATH}}lang-init.min.js"></script>
+</head>
+<body>
+    <div class="bg-blobs">
+        <div class="blob blob-1"></div>
+        <div class="blob blob-2"></div>
+        <div class="blob blob-3"></div>
+    </div>
+
+    <nav>
+        <div class="container nav-content">
+            <a href="{{ASSET_PATH}}" class="logo-area" style="text-decoration: none;">
+                <img src="{{ASSET_PATH}}assets/NewLogoIcon.webp" alt="KoalaSync Logo" width="40" height="40">
+                <span>KoalaSync</span>
+            </a>
+            <div class="nav-links">
+                <a href="{{ASSET_PATH}}" style="display: inline-flex; align-items: center; gap: 6px;">
+                    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" style="width: 16px; height: 16px; display: block;"><path d="m3 9 9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"></path><polyline points="9 22 9 12 15 12 15 22"></polyline></svg>
+                    <span>Home</span>
+                </a>
+                <a href="https://github.com/Shik3i/KoalaSync" target="_blank" rel="noopener" style="display: inline-flex; align-items: center; gap: 6px;">
+                    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" width="16" height="16" aria-hidden="true" style="display: block;"><path d="M12 0c-6.626 0-12 5.373-12 12 0 5.302 3.438 9.8 8.207 11.387.599.111.793-.261.793-.577v-2.234c-3.338.726-4.033-1.416-4.033-1.416-.546-1.387-1.333-1.756-1.333-1.756-1.089-.745.083-.729.083-.729 1.205.084 1.839 1.237 1.839 1.237 1.07 1.834 2.807 1.304 3.492.997.107-.775.418-1.305.762-1.604-2.665-.305-5.467-1.334-5.467-5.931 0-1.311.469-2.381 1.236-3.221-.124-.303-.535-1.524.117-3.176 0 0 1.008-.322 3.301 1.23.957-.266 1.983-.399 3.003-.404 1.02.005 2.047.138 3.006.404 2.291-1.552 3.297-1.23 3.297-1.23.653 1.653.242 2.874.118 3.176.77.84 1.235 1.911 1.235 3.221 0 4.609-2.807 5.624-5.479 5.921.43.372.823 1.102.823 2.222v3.293c0 .319.192.694.801.576 4.765-1.589 8.199-6.086 8.199-11.386 0-6.627-5.373-12-12-12z"/></svg>
+                    GitHub
+                </a>
+            </div>
+            <div class="nav-right">
+                <div class="lang-select-container">
+                    <select class="lang-dropdown" aria-label="Select Language">
+                        <option value="en">🇬🇧 English</option>
+                        <option value="de">🇩🇪 Deutsch</option>
+                        <option value="fr">🇫🇷 Français</option>
+                        <option value="es">🇪🇸 Español</option>
+                        <option value="pt-BR">🇧🇷 Português (Brasil)</option>
+                        <option value="ru">🇷🇺 Русский</option>
+                        <option value="it">🇮🇹 Italiano</option>
+                        <option value="pl">🇵🇱 Polski</option>
+                        <option value="tr">🇹🇷 Türkçe</option>
+                        <option value="nl">🇳🇱 Nederlands</option>
+                        <option value="ja">🇯🇵 日本語</option>
+                        <option value="ko">🇰🇷 한국어</option>
+                        <option value="zh">🇨🇳 中文</option>
+                        <option value="uk">🇺🇦 Українська</option>
+                        <option value="pt">🇵🇹 Português (Portugal)</option>
+                    </select>
+                    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" class="chevron-icon"><polyline points="6 9 12 15 18 9"/></svg>
+                </div>
+                <button class="hamburger" aria-label="Menu" aria-expanded="false">☰</button>
+            </div>
+        </div>
+    </nav>
+
+    <main class="legal-content">
+        <div class="legal-card" data-reveal style="padding: 2.5rem 2rem;">
+            <div style="display: flex; justify-content: center;">
+                <img src="{{ASSET_PATH}}assets/RemoteProf.webp" alt="Koala teaching and explaining concepts" class="legal-mascot" width="180" height="180">
+            </div>
+            
+            <h1>
+                <span lang="en">Guides &amp; Comparisons</span>
+                <span lang="de">Vergleiche &amp; Anleitungen</span>
+            </h1>
+            <p style="text-align: center; font-size: 0.95rem; line-height: 1.6; max-width: 600px; margin: 0 auto 2rem auto; color: var(--text-muted);">
+                <span lang="en">How does KoalaSync stack up against other watch party tools and streaming solutions? Read our honest, technical comparisons to find the best fit for your remote movie nights.</span>
+                <span lang="de">Wie schlägt sich KoalaSync im Vergleich zu anderen Watch-Party-Tools und Streaming-Lösungen? Lies unsere ehrlichen, technischen Vergleiche, um die passende Lösung für deine Filmabende zu finden.</span>
+            </p>
+
+            <!-- Cards Grid Layout -->
+            <div class="guides-grid" style="display: grid; grid-template-columns: 1fr 1fr; gap: 1.5rem; margin-top: 2rem; margin-bottom: 2rem;">
+                <!-- Teleparty Card -->
+                <a href="{{ASSET_PATH}}{{LANG_PREFIX}}alternatives/teleparty" class="guide-card" style="text-decoration: none; background: rgba(255, 255, 255, 0.03); border: 1px solid var(--glass-border); border-radius: 12px; padding: 1.5rem; display: flex; flex-direction: column; justify-content: space-between;">
+                    <div>
+                        <h3 style="margin-top: 0; margin-bottom: 0.75rem; color: #fff; font-size: 1.25rem;">{{ALT_TELEPARTY_TITLE}}</h3>
+                        <p style="font-size: 0.9rem; line-height: 1.5; color: var(--text-muted); margin-bottom: 1.5rem;">{{ALT_TELEPARTY_META_DESC}}</p>
+                    </div>
+                    <div class="btn btn-primary" style="align-self: flex-start; padding: 0.5rem 1rem; font-size: 0.85rem; border-radius: 6px;">
+                        <span lang="en">Read Comparison &rarr;</span>
+                        <span lang="de">Vergleich lesen &rarr;</span>
+                    </div>
+                </a>
+
+                <!-- Screen Sharing Card -->
+                <a href="{{ASSET_PATH}}{{LANG_PREFIX}}alternatives/screen-sharing" class="guide-card" style="text-decoration: none; background: rgba(255, 255, 255, 0.03); border: 1px solid var(--glass-border); border-radius: 12px; padding: 1.5rem; display: flex; flex-direction: column; justify-content: space-between;">
+                    <div>
+                        <h3 style="margin-top: 0; margin-bottom: 0.75rem; color: #fff; font-size: 1.25rem;">{{ALT_SCREEN_TITLE}}</h3>
+                        <p style="font-size: 0.9rem; line-height: 1.5; color: var(--text-muted); margin-bottom: 1.5rem;">{{ALT_SCREEN_META_DESC}}</p>
+                    </div>
+                    <div class="btn btn-primary" style="align-self: flex-start; padding: 0.5rem 1rem; font-size: 0.85rem; border-radius: 6px;">
+                        <span lang="en">Read Comparison &rarr;</span>
+                        <span lang="de">Vergleich lesen &rarr;</span>
+                    </div>
+                </a>
+            </div>
+
+            <!-- CTA block -->
+            <div style="display: flex; flex-direction: column; align-items: center; justify-content: center; margin-top: 3rem; padding-top: 2rem; border-top: 1px solid var(--glass-border);">
+                <a href="{{ASSET_PATH}}" class="btn btn-primary" style="margin-bottom: 1.5rem;">{{ALT_TRY_KOALASYNC}}</a>
+            </div>
+
+        </div>
+    </main>
+
+    <footer>
+        <div class="container">
+            <p>&copy; 2026 KoalaSync. {{FOOTER_MIT}}</p>
+            <p style="font-size: 0.8rem; margin-top: 0.5rem;">{{FOOTER_RAM}}</p>
+            <div style="margin-top: 1.5rem; font-size: 0.8rem; display: flex; justify-content: center; align-items: center; gap: 1.5rem; flex-wrap: wrap;">
+                <a href="{{ASSET_PATH}}{{FOOTER_LEGAL_LINK}}">{{FOOTER_LEGAL}}</a>
+                <a href="{{ASSET_PATH}}{{FOOTER_PRIVACY_LINK}}">{{FOOTER_PRIVACY}}</a>
+                <a href="{{ASSET_PATH}}{{LANG_PREFIX}}alternatives"><span><span lang="en">Guides & comparisons</span><span lang="de">Vergleiche & Anleitungen</span></span></a>
+                <a href="https://mastodon.social/@koalastuff" rel="me noopener" target="_blank" style="display: inline-flex; align-items: center; gap: 4px;">
+                    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" width="14" height="14" aria-hidden="true" style="display: block;"><path d="M23.268 5.313c-.35-2.578-2.617-4.61-5.304-5.004C17.51.242 15.792 0 11.813 0h-.03c-3.98 0-4.835.242-5.288.309C3.882.692 1.496 2.518.917 5.127.64 6.412.61 7.837.661 9.143c.074 1.874.088 3.745.26 5.611.118 1.24.325 2.47.62 3.68.55 2.237 2.777 4.098 4.96 4.857 2.336.792 4.849.923 7.256.38.265-.061.527-.132.786-.213.585-.184 1.27-.39 1.774-.753a.057.057 0 0 0 .023-.043v-1.809a.052.052 0 0 0-.02-.041.053.053 0 0 0-.046-.01 20.282 20.282 0 0 1-4.709.545c-2.73 0-3.463-1.284-3.674-1.818a5.593 5.593 0 0 1-.319-1.433.053.053 0 0 1 .066-.054c1.517.363 3.072.546 4.632.546.376 0 .75 0 1.125-.01 1.57-.044 3.224-.124 4.768-.422.038-.008.077-.015.11-.024 2.435-.464 4.753-1.92 4.989-5.604.008-.145.03-1.52.03-1.67.002-.512.167-3.63-.024-5.545zm-3.748 9.195h-2.561V8.29c0-1.309-.55-1.976-1.67-1.976-1.23 0-1.846.79-1.846 2.35v3.403h-2.546V8.663c0-1.56-.617-2.35-1.848-2.35-1.112 0-1.668.668-1.67 1.977v6.218H4.822V8.102c0-1.31.337-2.35 1.011-3.12.696-.77 1.608-1.164 2.74-1.164 1.311 0 2.302.5 2.962 1.498l.638 1.06.638-1.06c.66-.999 1.65-1.498 2.96-1.498 1.13 0 2.043.395 2.74 1.164.675.77 1.012 1.81 1.012 3.12z"/></svg>
+                    Mastodon
+                </a>
+            </div>
+        </div>
+    </footer>
+
+    <script src="{{ASSET_PATH}}app.min.js"></script>
+</body>
+</html>
--- a/Show More
+++ b/Show More