Release v0.6.63: automatic LAN transport fallback and connection help

LAN-PREVIEW.md

@@ -76,6 +76,26 @@ the preview does not change firewall rules. Broadcast-blocked networks, separate
 VLANs, public IPv4 and IPv6-only networks are not supported by discovery yet.
 A second LAN-enabled KSwitcher cannot use the same ports on one computer.
 
+Input first tries TCP in the usual direction, then reverse TCP after 1.5 seconds.
+If TCP has not authenticated after 5 seconds, the lower-ID peer negotiates an
+encrypted UDP input session on the existing discovery socket (UDP 45883).
+UDP uses fresh session challenges, authenticated encryption, ordered event
+numbers, acknowledgements and bounded retries; duplicated packets do not repeat
+key presses. Two seconds without authenticated traffic or acknowledgement
+progress closes the session and returns control locally. A working UDP session
+stays on UDP until disconnected; it does not oscillate between transports.
+Both PCs must run an updated build to use all fallback methods. Older peers can
+still use the original TCP protocol. No extra ports or external relay are used.
+
+After 15 seconds without a connection, the UI points to **Connection help**.
+The help window can copy PowerShell commands for the actual resident EXE path,
+including a path containing apostrophes. Run each PC's own command in an
+administrator PowerShell on that PC. These commands permit inbound TCP 45884
+and UDP 45883 only from the local subnet; the program does not execute them.
+Moving the EXE may require a new application firewall rule. A timeout alone
+does not establish that the firewall is the cause: check that input sharing is
+enabled on both PCs and that both are running the intended copy.
+
 The instance ID belongs to a data directory, not a hostname/IP address. Discovered
 names and addresses are untrusted. Pairing uses a generated 128-bit code and
 mutual HMAC-SHA256 challenge proofs bound to both instance IDs. The code is never