No US PIA region offers port forwarding, so the qbittorrent client moves to ca_ontario (pia-exit stays on Washington DC). A pia-portforward service in the guest asks PIA for a port (getSignature), keeps it bound (bindPort every 10 min), opens it in the guest firewall and writes it into qBittorrent's config, restarting qBittorrent only when the port changes. Toronto servers refuse the forwarding API despite the region flag, so the server was chosen by probing.