phase: 06_sharer_quality_presets

**Phase 06 — final verification pass: 100% green.**

- **Verified (all 6 tasks complete in working tree):** `#quality` select + `PRESETS` table; preset-driven capture request + `contentHint`; per-leg `legCap()`/`degradation` at both call sites; live `applyQuality()` with Overconstrained fallback + republish; `q` key cycle; `#stat-quality`/`#stat-codec` readouts; full e2e matrix (requests, committed params ×3, zero-cap, mid-share switch, unrescalable device, late-joiner first-offer, readout, `q`); realdisplay delivered-pixels `light` case. `test_sender_fidelity.py` **untouched and green** (regression canary).
- **Gates:** `uv run ruff check . && uv run ruff format --check .` → clean (32 files); `uv run pyright` → 0 errors; `uv run pytest` → **284 passed, 5 skipped (realdisplay-gated), coverage 95%** (93s); `MIRROR_REALDISPLAY=1 uv run pytest -m realdisplay` → **4 passed, 1 skipped** (no audio source on host — documented platform condition).
- **Completion criteria:** all 11 ✓ — sharp default reproduces old request; light ≤960×600@15fps/motion/round(cap×0.35)/maintain-framerate with moving viewer frames; mid-share re-prices with `peers.size` unchanged, no renegotiation, roster matches `getSettings()`; refused-rescale toasts "next share"; `q` cycles + toasts, text-field guard holds; readout exact + codec shape, both reset to `—` idle; realdisplay: light decoded ≤990px (measured 320×200), sharp clears `SHARP_FLOOR_PX`; no new env/wire/Python/asset; suite 100% green, coverage >90%.
- **Docs:** README.md reviewed in full against code — Quality table, `q` key, env-var table, routes (`/share`), kiosk commands, key table, doc paths all consistent; **no fixes needed**. AGENTS.md — verified, no stale statements, no changes. PLAN.md untouched (diff = 0).
- **Reported (per phase, not edited):** PLAN.md §6 line 204 still says "per-leg `maxBitrate` cap (default **12 Mbit/s**)" — code has defaulted to **25 Mbit/s** since phase 02; needs a user-approved one-line amendment.
- **Next pending phase:** none — 06 is the last phase in `todo/`; the roadmap is complete.

SECURITY.md

@@ -27,8 +27,10 @@ limiting, no accounts, and no audit trail.
 * Watch any mirror anyone else is sharing.
 * Learn which device names and window titles are being shared (window titles can
   be sensitive: mail, tickets, filenames).
-* Consume a sharer's upstream bandwidth (bounded by `MIRROR_MAX_BITRATE`, per
-  leg).
+* Consume a sharer's upstream bandwidth (per leg, bounded by
+  `MIRROR_MAX_BITRATE`; the sharer's quality preset scales that bound only
+  *down* — 1.0× / 0.6× / 0.35× — and can never raise it above the server's
+  ceiling).
 
 ## 3. What they cannot do (enforced and tested)
 
@@ -149,7 +151,9 @@ audio constraint was dropped), and the wall shows no button at all.
 * **Firewall the port.** Restrict 8055 to the LAN range you actually want:
   `firewall-cmd --add-rich-rule='rule family=ipv4 source address=192.168.1.0/24 port port=8055 protocol=tcp accept'`
 * **Cap the blast radius.** `MIRROR_MAX_MIRRORS` limits concurrent mirrors;
-  `MIRROR_MAX_BITRATE` bounds per-viewer upload.
+  `MIRROR_MAX_BITRATE` bounds per-viewer upload — the sharer's quality preset
+  (1.0× / 0.6× / 0.35× of that bound) can only ever lower it, never raise it
+  above the server's ceiling.
 * **Egress stays closed.** The container image makes no outbound connections; do
   not add STUN unless you are deliberately bridging VLANs.
 * **Assume window titles are public.** Say so before you mirror a desktop full of