fix(media): recover H264 selection and isolate rejected ICE candidates

## Problem and outcome / 问题与结果

Windows native H.264 startup trusted the first enumerated hardware encoder. A failing GPU/driver could end sharing even when another encoder worked. The shared capture/relay selector now tries hardware candidates within its existing startup budget, verifies actual H.264 output, and retains the selected backend for later source/quality changes. Explicit H.264 never silently becomes VP8.

A browser ICE candidate rejected with `OperationError` also aborted the remaining queue and could prevent the Viewer from answering. The shared candidate receiver now records that rejection and continues; description/lifecycle errors still propagate, and transport state and the existing route deadline retain failure authority.

The launcher no longer prefills the Demo address. Site mode and its explicit origin authorization remain unchanged.

## Release notes

### 中文

这是一次兼容性修复更新，改善 Windows App 的 H.264 分享启动和浏览器的媒体连接建立。

- 首选硬件编码器无法工作时，尝试其他可用的 H.264 硬件编码器；手动选择 H.264 时仍保持该编码格式。
- 修复单条被拒绝的 ICE 候选中断后续候选处理、导致连接建立失败的问题。
- App 的已有站点地址不再预填 Demo；已保存的地址保持不变。

协议和配置格式不变，可直接升级。缺少双方诊断报告的现场连接失败仍待核实。

### English

This maintenance update improves H.264 sharing startup in the Windows App and media connection setup in browsers.

- Try other available H.264 hardware encoders when the preferred encoder cannot work. Manually selected H.264 remains H.264.
- Fix a rejected ICE candidate interrupting subsequent candidate processing and preventing connection setup.
- Stop prefilling the Demo address in App Site mode while preserving saved addresses.

Protocol and configuration formats are unchanged; no migration is required. Reported connection failures without matched diagnostics remain unconfirmed.

## Verification / 验证

- `npm run check`: 74 test files / 1,057 tests, type-check and Web build passed.
- Documentation and repository hygiene checks passed.
- `npm run check:go`: formatting, Go tests/vet, Windows/Linux core builds and Windows native regressions/compile passed. Darwin cgo packaging belongs to the native macOS CI runner.
- Real hardware: a preferred AMD encoder failed activation; the selector reached a working NVIDIA H.264 encoder without changing codec. Local native Host gate passed decoded Viewer frames, live quality changes, source replacement and cleanup.
- Browser Host/Viewer queue regressions fail before the ICE repair and pass afterward. Chrome 152 rejected an injected mismatched media identifier, then connected using valid candidates.
- External-host public invitation HTTP/WebSocket gate and native H.264 RTP delivery gate passed. The remote Pion gate establishes RTP receipt, not physical remote decoding or endurance.

## Impact / 影响

Patch release v1.6.1; no wire, persistence, route-policy or dependency changes. Browser/App/Server public compatibility is preserved. Shared media/routing owners and scoped research/TODO are updated; unknown reporter causes remain explicit.

No claim of universal H.264 driver recovery, improved NAT success on every network, or a fix for provider HTTP 1033. Site-mode redesign and 4K remain outside this phase.

docs/research/cross-platform-client-runtime.md

@@ -170,14 +170,22 @@ DNS failures, API rejection and networks blocking both transports can still fail
 A 2026-09-21 Windows check used the packaged binary with an isolated UDP sink and
 TCP forwarder. The previous arguments timed out at 30 seconds without trying TCP.
 The candidate connected in about 11 seconds, served the public page and echoed a
-WebSocket message, then joined the child on close. A separate ordinary-network
-run registered in about five seconds but this host's public HTTPS/WSS requests
-ended with EOF; end-to-end access on that path remains unverified. These checks
-do not establish the cause of reports without matching diagnostics. Upstream
+WebSocket message, then joined the child on close. The ordinary-network App link
+gate also serves the invitation page and upgrades its WebSocket from an external
+US host, then confirms App exit and link retirement. These bounded checks do not
+establish regional reachability, uninterrupted connector availability or the
+cause of reports without matching diagnostics. Upstream
 [Quick Tunnel setup](https://github.com/cloudflare/cloudflared/blob/2026.8.3/cmd/cloudflared/tunnel/quick_tunnel.go)
 and [protocol fallback](https://github.com/cloudflare/cloudflared/blob/2026.8.3/supervisor/tunnel.go)
 own the dependency behavior; Piik adds no separate retry loop.
 
+[HTTP 1033](https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-1xxx-errors/error-1033/)
+means Cloudflare cannot find a healthy tunnel connector. App readiness requires
+both the assigned origin and a registered connection; later reconnection belongs
+to cloudflared, while process exit ends that App's public-link runtime. This
+HTTP failure precedes WebRTC candidate exchange and is distinct from media-route
+exhaustion on an already reachable site.
+
 ## Remaining Gates
 
 - Run the exact clean-revision package on macOS; Linux amd64 is proved.

docs/research/nat-traversal.md

@@ -87,6 +87,15 @@ An earlier remote description is not readiness for a new generation's candidates
 Native event delivery can precede its offer/answer response; the existing
 negotiation queue retains those candidates until the matching answer is applied.
 
+The Browser queue must also isolate a candidate-processing `OperationError`.
+Fault injection showed that one rejection formerly skipped later candidates in
+both Host and Viewer queues and could prevent the Viewer's SDP answer. Chrome
+152 independently rejected a mismatched media identifier while the connection
+still succeeded with valid candidates. The shared receiver now records that
+individual rejection and continues; missing-description errors are not hidden.
+This agrees with [WebRTC candidate processing](https://www.w3.org/TR/webrtc/#dom-peerconnection-addicecandidate)
+and does not establish the cause of undiagnosed field route failures.
+
 ### Native Shared-Socket Preflight
 
 Native requests one dual-stack wildcard UDP socket through Go and Pion's existing

docs/research/native-client-media.md

@@ -148,6 +148,10 @@ The retained hardware fixture also changed one live NVIDIA MFT through
 produced about `1.00 MB -> 0.68 MB -> 0.97 MB`, while ordered 30 fps output and
 the pinned profile remained intact. Both AMD MFT candidates failed activation
 before this probe, so the evidence is not a cross-vendor dynamic-rate contract.
+With the failing AMD candidate preferred, bounded product selection now reaches
+the working NVIDIA H264 encoder without changing codec. A local native Host gate
+also passes decoded Viewer output, quality changes and source replacement. This
+establishes the selection defect and repair, not the unknown reporter's cause.
 The product therefore observes GCC for routing but does not yet apply one edge's
 target globally to the shared encoder.
 

docs/standards/media-quality.md

@@ -121,7 +121,13 @@ does not by itself prove hardware acceleration, and Web content cannot select a
 specific MFT, NVENC, AMF, or QSV implementation.
 
 Windows native capture uses the same VP8/Auto/H264 controls. H264 selects the
-hardware path and VP8 the bundled libvpx encoder. Auto measures encoding work
+hardware path and VP8 the bundled libvpx encoder. Hardware enumeration is only
+a candidate list: startup tries the preferred encoder first, then remaining
+adapter/encoder candidates within the shared selection budget. Manual H264
+requires actual H264 output and never changes codec on failure. The selected
+device owns capture and output workers; its identity is retained as the first
+choice for quality/source replacement. Native relay encoding uses the same
+selection owner. Auto measures encoding work
 for synthetic NV12 frames at the selected dimensions and frame rate, with a
 bounded warmup and sample. If H264 sustains the target it is selected; otherwise
 VP8 is measured within the remaining four-second budget. This is a throughput

docs/standards/routing-transport.md

@@ -139,6 +139,12 @@ identity still match; future revisions and retired connections are rejected.
 Preparation reports retain their exact operation fence. Reports without a
 connection identity retain their exact room-revision fence.
 
+An individually rejected ICE candidate is disposable input. Browser
+`addIceCandidate` candidate-processing errors are recorded without aborting the
+remaining queue or SDP answer; missing-description/lifecycle errors remain
+visible. Native input follows the same boundary. Actual transport state and the
+route operation's deadline own failure, not one rejected candidate.
+
 ## SFU Fallback
 
 The only application fallback is one admitted embedded SFU publication from the

docs/todo.md

@@ -1,12 +1,17 @@
 # Current TODO Ledger
 
-Last reviewed: 2026-09-21
+Last reviewed: 2026-09-22
 
 Only **Now** is executable. Product modules own behavior; Git/PRs own completed
 history. A parked idea is not implementation authority.
 
 ## Now
 
+- [ ] **Passive App attachment: design hold.** Site mode authorizes one selected
+  origin and supplies native media without starting a local room server. A
+  passive replacement needs an accepted site-consent/discovery flow; it must not
+  admit arbitrary sites or add another runtime owner. Keep Site mode until that
+  decision; removal of the Demo prefill does not authorize changing site trust.
 - [ ] **Complete manual accessible-name review.** Verify the empty video's
   screen-reader output: Chromium exposes an unavailable-media
   description despite the literal shared-picture label and no media error. Also
@@ -26,6 +31,12 @@ history. A parked idea is not implementation authority.
 
 ## Awaiting Device Or Reporter Evidence
 
+- [ ] **No available media route.** Obtain matched Host/Viewer diagnostics from
+  a failed attempt, with version and mode. Inspect candidate exchange, selected
+  paths, first-frame admission and route rejection separately. The Browser
+  candidate-queue rejection defect is repaired and regression-tested; current
+  STUN reachability and route-lifecycle checks do not establish these reporters'
+  causes. HTTP 1033 belongs to the public-link item below, before media routing.
 - [ ] **Camera and Host microphone device coverage.** The owner accepted the
   sharing layout and authorized release with these physical limits recorded.
   Verify real audio levels/echo, multiple-device replacement and native mixing on
@@ -41,6 +52,9 @@ history. A parked idea is not implementation authority.
   bounded protocol fallback. [Runtime evidence](./research/cross-platform-client-runtime.md#public-invitation-startup)
   separates this fix from DNS, provider and remote access failures. The reporting
   environments still need version and diagnostic evidence before assigning a cause.
+  Demo access failures and public-link HTTP 1033 also remain unconfirmed: current
+  Demo health/assets and an external-host public-link HTTP/WebSocket gate pass.
+  Check connector reachability separately from WebRTC media availability.
 - [ ] **Interruption during established viewing.** A Viewer reportedly returns
   to P2P connecting after watching for a while. Native receiver renegotiation,
   retired event delivery and SFU replacement have locally reproduced defects
@@ -67,6 +81,8 @@ history. A parked idea is not implementation authority.
   paired Debug reports are still unavailable. Distinguish site authorization,
   browser permission, control capacity, enumeration and capture-start failures;
   local permission and recovery checks do not establish the reporters' causes.
+  Manual H264 returning immediately to idle also needs reporter diagnostics;
+  bounded selection past an unusable hardware encoder is locally verified.
 - [ ] **Windows 32-bit candidate acceptance.** Verify the isolated
   `spike/windows-x86-capture` candidate's launch, capture/audio, memory pressure,
   source replacement and update links on a 32-bit Windows device. WOW64