Per-machine token. Origin-checked. Four-client cap. Bonjour-discoverable.
Bind localhost:9812, authenticate with the keychain token, and subscribe. The server pushes per-channel RMS, peak, true-peak, LUFS M/S/I, and clip state ten times a second.
Web-scheme origins (http://, https://) are rejected at the handshake so browser pages can't CSRF you. Token regenerates on demand. Auto-advertises as _flexmeter._tcp.