A node that cannot be reached, beside a streamer's encoder behind NAT, pushes instead: for each --peers entry it keeps a MoQ session open, publishing the streams it is ingesting, each announced from its first segment until its session times out and served from the bus like the listener serves it. An https:// peer is asked for its current MoQ URL (getBroadcaster's new moqURL) on every dial. The listener gives each incoming session its own origin, so a pushed announcement never becomes a route it serves, and pulls each announced streamer DID through the same validation as a pull, at most 32 per session. While a pushed stream validates, the receiving node advertises itself in broadcast_origins for it, so its station pulls from it rather than from a pusher it cannot reach. Recording, multistreaming and transcoding now each run on one node per stream, through leases in the shared statedb (pkg/director/roles.go). A replicated segment more than ten minutes from now is refused, before the dedup skip, so old signed segments cannot be replayed as live. --peers with --disable-syndication is refused.