diff --git a/.github/workflows/Build.yml b/.github/workflows/Build.yml
index 46bbebae..f8e10e7b 100644
--- a/.github/workflows/Build.yml
+++ b/.github/workflows/Build.yml
@@ -76,6 +76,24 @@ jobs:
           xcopy "T3000Webview\dist\spa\" "T3000 Output\release\ResourceFile\webview\www\" /E /H /C /I /y
           xcopy "T3000Webview\api\target\i686-pc-windows-msvc\release\t3_webview_api.dll" "T3000 Output\release\" /Y
           xcopy "T3000Webview\api\target\i686-pc-windows-msvc\release\t3_webview_api.dll.lib" "T3000 Output\release\" /Y
+          # CCTV UI. Sidecar exes are optional MIT processes (go2rtc / MediaMTX),
+          # never linked into T3000.exe. T3000.aip is unchanged; AddFolder of the
+          # release tree already installs whatever is under T3000 Output\release.
+          xcopy "T3000\ResourceFile\nvr\" "T3000 Output\release\ResourceFile\nvr\" /E /H /C /I /y
+          if exist "T3000\sidecar\go2rtc.exe" (
+            if not exist "T3000 Output\release\sidecar" mkdir "T3000 Output\release\sidecar"
+            copy /Y "T3000\sidecar\go2rtc.exe" "T3000 Output\release\sidecar\"
+          )
+          if exist "T3000\sidecar\mediamtx.exe" (
+            if not exist "T3000 Output\release\sidecar" mkdir "T3000 Output\release\sidecar"
+            copy /Y "T3000\sidecar\mediamtx.exe" "T3000 Output\release\sidecar\"
+          )
+
+      - name: Fetch CCTV sidecars (optional MIT exes for the MSI)
+        continue-on-error: true
+        shell: pwsh
+        run: |
+          powershell -ExecutionPolicy Bypass -File tools\fetch-nvr-sidecars.ps1 -OutDir "T3000 Output\release\sidecar"
 
       # -----------------------------------------------------------------------
       # SIGNING - origin-verification-compliant approach
@@ -125,6 +143,7 @@ jobs:
           # Excluded (3rd-party, not owned by Temco):
           #   sqlite3.dll        - SQLite Consortium
           #   WebView2Loader.dll - Microsoft
+          #   sidecar\go2rtc.exe / mediamtx.exe - MIT sidecars, not linked into T3000.exe
 
           $missing = @()
           foreach ($file in $filesToSign) {
diff --git a/.github/workflows/Release.yml b/.github/workflows/Release.yml
index 65489b0b..43ee4249 100644
--- a/.github/workflows/Release.yml
+++ b/.github/workflows/Release.yml
@@ -85,6 +85,23 @@ jobs:
           xcopy "T3000Webview\dist\spa\" "T3000 Output\release\ResourceFile\webview\www\" /E /H /C /I /y
           xcopy "T3000Webview\api\target\i686-pc-windows-msvc\release\t3_webview_api.dll" "T3000 Output\release\" /Y
           xcopy "T3000Webview\api\target\i686-pc-windows-msvc\release\t3_webview_api.dll.lib" "T3000 Output\release\" /Y
+          # CCTV UI. Sidecar exes are optional MIT processes (go2rtc / MediaMTX).
+          # T3000.aip is unchanged; AddFolder of the release tree installs this folder.
+          xcopy "T3000\ResourceFile\nvr\" "T3000 Output\release\ResourceFile\nvr\" /E /H /C /I /y
+          if exist "T3000\sidecar\go2rtc.exe" (
+            if not exist "T3000 Output\release\sidecar" mkdir "T3000 Output\release\sidecar"
+            copy /Y "T3000\sidecar\go2rtc.exe" "T3000 Output\release\sidecar\"
+          )
+          if exist "T3000\sidecar\mediamtx.exe" (
+            if not exist "T3000 Output\release\sidecar" mkdir "T3000 Output\release\sidecar"
+            copy /Y "T3000\sidecar\mediamtx.exe" "T3000 Output\release\sidecar\"
+          )
+
+      - name: Fetch CCTV sidecars (optional MIT exes for the MSI)
+        continue-on-error: true
+        shell: pwsh
+        run: |
+          powershell -ExecutionPolicy Bypass -File tools\fetch-nvr-sidecars.ps1 -OutDir "T3000 Output\release\sidecar"
 
       # -----------------------------------------------------------------------
       # PE SIGNING (origin-verification-compliant)
diff --git a/.gitignore b/.gitignore
index c7c9fc76..7d715ff5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -953,3 +953,7 @@ build/ALL_BUILD.vcxproj
 /.vs
 /T3000/Database
 T3000Controls/project.lock.json
+
+# CCTV sidecar binaries (downloaded; MIT, not vendored)
+T3000/sidecar/*.exe
+T3000/sidecar/*.zip
diff --git a/DEMO.md b/DEMO.md
new file mode 100644
index 00000000..755e734f
--- /dev/null
+++ b/DEMO.md
@@ -0,0 +1,179 @@
+# T3000 CCTV — Windows teammate demo
+
+**This branch is for a live demo on a normal T3000 Windows box. Do not merge until people have seen it running.**
+
+The Linux cloud agent that opened the PR **cannot** start T3000.exe, WebView2, or a LAN camera. Follow these steps on your VS2019 machine. There is no special installer and you do not need master.
+
+Developer background: [Documentation/nvr.md](Documentation/nvr.md).
+
+---
+
+## 1. Check out this branch and build (same as the rest of T3000)
+
+```bat
+git fetch origin
+git checkout CCTV
+```
+
+1. Open **`T3000 - VS2019.sln`** in Visual Studio 2019.
+2. Toolbar: configuration **Release** (or Debug), platform **Win32**.
+3. **Build → Build Solution** (Ctrl+Shift+B).
+
+Same MFC / x86 / requireAdministrator path as always. Sidecar `.exe` files are **not** required to compile. If the build fails, it is a normal T3000 compile error — see [README_Build.md](README_Build.md).
+
+**Ignore the red GitHub check named “Testing the MSBuild” on this PR.** That workflow has been failing on `master` as well (missing MFC and .NET Framework 4.5.2 targeting pack on `windows-latest`). It dies before compiling `T3000NvrSidecar.cpp`. Your local VS2019 box is the real build.
+
+Built app:
+
+| Config | T3000.exe |
+| --- | --- |
+| Release | `T3000 Output\release\T3000.exe` |
+| Debug | `T3000 Output\debug\T3000.exe` |
+
+Post-build already copies `T3000\ResourceFile\nvr\index.html` next to that exe.
+
+You also need the **Microsoft Edge WebView2 Runtime** (same as HVAC graphics / Modbus Register v2). If CCTV warns that it is missing, install it from https://developer.microsoft.com/en-us/microsoft-edge/webview2/ then retry.
+
+---
+
+## 2. Drop `go2rtc.exe` where the launcher will find it
+
+Live video needs **go2rtc** (MIT, separate process, 64-bit is fine). **MediaMTX is optional** for this demo.
+
+### Official Windows zips (no script required)
+
+1. Download **[go2rtc_win64.zip](https://github.com/AlexxIT/go2rtc/releases/download/v1.9.14/go2rtc_win64.zip)** from [go2rtc v1.9.14](https://github.com/AlexxIT/go2rtc/releases/tag/v1.9.14).
+2. Unzip. Copy **`go2rtc.exe`** to **any one** of these folders (create `sidecar` if needed):
+
+**Preferred (no rebuild):** next to the exe you just built
+
+```
+T3000 Output\release\sidecar\go2rtc.exe
+```
+
+or simply
+
+```
+T3000 Output\release\go2rtc.exe
+```
+
+(Debug: the same under `T3000 Output\debug\`.)
+
+**Also works:** source-tree folder (launcher walks `..\..\T3000\sidecar` from the output dir)
+
+```
+T3000\sidecar\go2rtc.exe
+```
+
+A Release post-build will also copy `T3000\sidecar\*.exe` into `T3000 Output\release\sidecar\` if they are already there.
+
+### Optional MediaMTX (record/playback home, not needed for live view)
+
+- Zip: **[mediamtx_v1.20.1_windows_amd64.zip](https://github.com/bluenviron/mediamtx/releases/download/v1.20.1/mediamtx_v1.20.1_windows_amd64.zip)**
+- Drop `mediamtx.exe` in the **same** folder as `go2rtc.exe`.
+- The CCTV header shows **MediaMTX :9197** when it is up, **MediaMTX off** when it is not. Live tiles still work.
+
+### Optional: fetch script instead of a browser download
+
+From the repo root, in PowerShell:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File tools\fetch-nvr-sidecars.ps1
+```
+
+That writes `T3000\sidecar\go2rtc.exe` and `T3000\sidecar\mediamtx.exe`. Then either rebuild once, or copy those two files into `T3000 Output\release\sidecar\`.
+
+**Do not commit the `.exe` files.**
+
+---
+
+## 3. Open the CCTV view
+
+1. Run **`T3000.exe`** (the one you built — it will ask for Administrator, as usual).
+2. Menu: **Tools → CCTV**.
+3. A WebView2 window titled **CCTV** opens.
+
+T3000 starts `go2rtc.exe` (and `mediamtx.exe` if present) on localhost, then loads `http://127.0.0.1:9191/index.html`. Closing that window stops processes T3000 started.
+
+---
+
+## 4. Point at a camera
+
+The PC and the camera must be on the **same LAN** (ONVIF discovery uses multicast).
+
+### Option A — ONVIF on the LAN
+
+1. If the camera needs a login, type **Username** / **Password** first.
+2. Click **Discover ONVIF**.
+3. Wait a few seconds. Devices appear in the list (name + URL).
+4. Click **Add** on the one you want.
+
+### Option B — paste an RTSP URL (no ONVIF camera)
+
+1. **Name:** e.g. `lobby`
+2. **RTSP or ONVIF URL:** from the camera’s web UI, for example  
+   `rtsp://admin:password@192.168.1.20/Streaming/Channels/101`
+3. Click **Add and play**.
+
+Any RTSP the Windows box can reach works (another recorder, a camera, a phone app that publishes RTSP). There is no fake “demo stream” bundled. Without a reachable URL you still see the CCTV UI and sidecar status, but no video.
+
+WebView2 cannot play raw `rtsp://` inside a `<video>` tag. The page asks go2rtc for **WebRTC**, then **MP4**, then **MJPEG**.
+
+---
+
+## 5. What success looks like
+
+- Header pills: **go2rtc :9191** (green). MediaMTX green only if you dropped that exe.
+- Sidecar panel: something like “CCTV sidecar started (go2rtc on 127.0.0.1:9191).”
+- After Add / Discover: a **live tile** with moving video (not a frozen snapshot).
+- Status bar at the bottom of T3000 may repeat the sidecar message.
+
+Close **CCTV**, reopen **Tools → CCTV** — saved cameras come back (WebView `localStorage` + `%LOCALAPPDATA%\T3000\nvr\cameras.json`).
+
+---
+
+## 6. What you should see if sidecar exes are missing
+
+Leave `go2rtc.exe` out on purpose if you want to show this:
+
+1. T3000 still starts and the rest of the app is unchanged.
+2. **Tools → CCTV** still opens a CCTV window (no crash).
+3. The sidecar panel is **red** and says `go2rtc.exe was not found. T3000 is running normally.`
+4. It lists the folders to drop the file into, plus the official zip URL.
+5. You can still use every other T3000 tool.
+
+Drop `go2rtc.exe` into one of those folders, close CCTV, open it again — no reinstall.
+
+---
+
+## 7. Ports (localhost only — 9103 / 9104 / 3003 stay free)
+
+| Process | Bind | Port | Used for |
+| --- | --- | --- | --- |
+| go2rtc | 127.0.0.1 | **9191** | CCTV page + API |
+| go2rtc | 127.0.0.1 | 9192 | RTSP republish |
+| go2rtc | 127.0.0.1 | 9193 | WebRTC |
+| MediaMTX | 127.0.0.1 | 9194 / 9196 / 9197 | Optional; later record/playback |
+
+Already taken by T3000 and **left alone**:
+
+| Port | Owner |
+| --- | --- |
+| **9103** | Rust `t3_webview_api` HTTP |
+| **9104** | Rust WebSocket |
+| **3003** | Quasar / T3000Webview dev UI |
+
+If something else already owns **9191** and it is not go2rtc, CCTV opens offline and tells you the port is in use.
+
+Config written on each open: `%LOCALAPPDATA%\T3000\nvr\` (`go2rtc.yaml`, `mediamtx.yml`, `www\index.html`).
+
+---
+
+## Quick checklist for the person running the demo
+
+- [ ] Branch `CCTV` built Win32 in VS2019
+- [ ] `go2rtc.exe` sitting next to `T3000.exe` or in `sidecar\`
+- [ ] **Tools → CCTV** opens
+- [ ] Green **go2rtc :9191**
+- [ ] ONVIF **Discover** or a pasted `rtsp://...` shows **live video**
+- [ ] (Optional) Hide `go2rtc.exe` and reopen CCTV — red message, T3000 still works
diff --git a/Documentation/README.md b/Documentation/README.md
index f9475cdf..126df351 100644
--- a/Documentation/README.md
+++ b/Documentation/README.md
@@ -8,5 +8,7 @@ Technical plans, integration guides, and reference material for the T3000 Buildi
 
 ## Technical reference
 
+- [CCTV Windows demo](../DEMO.md) — checkout, build, drop go2rtc, open Tools → CCTV, ONVIF/RTSP.
+- [CCTV first slice](nvr.md) — go2rtc + MediaMTX sidecars, ports, CCTV WebView, installer notes.
 - [WireGuard Modbus Register Map](WireGuard%20Modbus%20Register%20Map.md) — Modbus register interface for WireGuard VPN configuration on T3 ESP32 controllers.
 - [Rebrand guide](rebrand.md) — How to extract custom names into `AppConfig.props` for software rebranding.
diff --git a/Documentation/nvr.md b/Documentation/nvr.md
new file mode 100644
index 00000000..5794c35f
--- /dev/null
+++ b/Documentation/nvr.md
@@ -0,0 +1,102 @@
+# T3000 CCTV (first slice)
+
+**Windows demo (do not merge until teammates have seen it):** follow **[DEMO.md](../DEMO.md)** — checkout, VS2019 Win32 build, where to drop `go2rtc.exe`, Tools → CCTV, ONVIF/RTSP, success vs missing-exe.
+
+Temco customers get cameras plus building automation in one T3000 install. v1 launches localhost sidecar processes, discovers ONVIF cameras, and shows live video in the existing WebView2 host. Motion detection, AI, mobile apps, full timeline playback, and cloud relay are out of scope.
+
+T3000.exe stays 32-bit MFC. Sidecars are **separate processes** (64-bit is fine) talking HTTP on 127.0.0.1. Do not load go2rtc or MediaMTX as a DLL into T3000.exe.
+
+## What we ship in this repo
+
+| Piece | Location | Notes |
+| --- | --- | --- |
+| Launcher / lifecycle | `T3000/T3000NvrSidecar.cpp` | `CreateProcess`, job object, port checks |
+| CCTV UI | `T3000/ResourceFile/nvr/index.html` | Self-contained page (T3000Webview is a submodule) |
+| Menu entry | Tools → **CCTV** | Opens WebView2 |
+| Fetch script | `tools/fetch-nvr-sidecars.ps1` | Downloads MIT binaries for devs / CI |
+| Sidecar folder | `T3000/sidecar/` | Place `go2rtc.exe` and `mediamtx.exe` here |
+
+Large binaries are **not** committed. The MSI picks them up only if they are copied into `T3000 Output\release\sidecar\` before Advanced Installer's `AddFolder` of the release tree.
+
+## Sidecar bricks
+
+| Binary | License | Role in v1 |
+| --- | --- | --- |
+| [go2rtc](https://github.com/AlexxIT/go2rtc) v1.9.14 | MIT | ONVIF discovery, RTSP ingest, WebRTC / MSE / MP4 live view |
+| [MediaMTX](https://github.com/bluenviron/mediamtx) v1.20.1 | MIT | Layout + config for later record/playback. Optional for live view. |
+
+FFmpeg is not shipped. Do not vendor GPL/AGPL NVR code (ZoneMinder, Moonfire, OpenNVR, motion) and do not statically link GPL into T3000.exe or `t3_webview_api.dll`.
+
+## Obtain the sidecars (developers)
+
+From a PowerShell prompt at the repo root:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File tools\fetch-nvr-sidecars.ps1
+```
+
+This writes:
+
+- `T3000\sidecar\go2rtc.exe`
+- `T3000\sidecar\mediamtx.exe`
+
+A VS2019 post-build step copies `ResourceFile\nvr\` to the output tree and, if present, `sidecar\*.exe` next to `T3000.exe`.
+
+You can also drop the exes next to `T3000.exe` or under `nvr\`. Search order:
+
+1. `{T3000.exe dir}\sidecar\go2rtc.exe` (same for `mediamtx.exe`)
+2. `{T3000.exe dir}\go2rtc.exe`
+3. `{T3000.exe dir}\nvr\go2rtc.exe`
+4. `{T3000.exe dir}\..\..\T3000\sidecar\` (source tree when running from `T3000 Output\`)
+5. `{T3000.exe dir}\..\T3000\sidecar\`
+
+T3000 still builds and runs if the exes are missing. Opening CCTV shows a clear message in the WebView (see [DEMO.md](../DEMO.md) §6).
+
+## Ports (127.0.0.1 only)
+
+Do not use 9103 (Rust HTTP), 9104 (Rust WS), or 3003 (Quasar dev).
+
+| Service | Port | Purpose |
+| --- | --- | --- |
+| go2rtc HTTP / API / UI | 9191 | Live view page + `/api` |
+| go2rtc RTSP | 9192 | Local RTSP republish |
+| go2rtc WebRTC | 9193 | WebRTC ICE |
+| MediaMTX RTSP | 9194 | Future record ingest |
+| MediaMTX playback | 9196 | Future VOD |
+| MediaMTX API | 9197 | Health / later control |
+
+## Config and user data
+
+Generated under `%LOCALAPPDATA%\T3000\nvr\` (same LocalAppData root as WebView2's `T3000` user-data folder):
+
+- `go2rtc.yaml` — rewritten on each CCTV launch
+- `mediamtx.yml` — record/playback hook (`record` stays commented)
+- `www\index.html` — copy of the CCTV page served by go2rtc `static_dir`
+- `cameras.json` — persisted camera list (also kept in WebView `localStorage`)
+- `recordings\` — reserved for MediaMTX
+
+## How to open the view
+
+1. Build T3000 (VS2019, Win32, Release or Debug) with or without sidecar exes.
+2. Fetch or copy `go2rtc.exe` into `sidecar\` (and optionally `mediamtx.exe`).
+3. Run T3000 and choose **Tools → CCTV**.
+4. T3000 starts go2rtc (and MediaMTX if present), then opens WebView2 at `http://127.0.0.1:9191/index.html`.
+5. Closing the CCTV window stops processes T3000 started. Exit of T3000 also stops them. An already-running go2rtc on 9191 is reused and not killed.
+
+## Point at a camera
+
+- **ONVIF:** click **Discover ONVIF**, enter credentials if needed, then **Add**.
+- **RTSP:** set a name and URL such as `rtsp://user:pass@192.168.1.20/Streaming/Channels/101`, then **Add and play**.
+- Live tiles prefer go2rtc WebRTC, then `/api/stream.mp4`, then MJPEG. WebView2 does not play raw RTSP.
+
+## Installer / CI
+
+`T3000.aip` is not edited (Advanced Installer projects are easy to break without a local test). `Build.yml` / `Release.yml`:
+
+1. Copy `T3000\ResourceFile\nvr\` into `T3000 Output\release\ResourceFile\nvr\`.
+2. Optionally run `tools/fetch-nvr-sidecars.ps1 -OutDir "T3000 Output\release\sidecar"` so the existing `AddFolder "APPDIR" ".\T3000 Output\release"` includes the MIT exes.
+3. Do **not** add go2rtc/MediaMTX to the SignPath PE list (third-party, like sqlite).
+
+## License isolation
+
+T3000 remains MIT. go2rtc and MediaMTX remain separate MIT programs. Notices: `T3000/sidecar/NOTICE.txt`.
diff --git a/README.md b/README.md
index f211d473..6bc7a894 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@ T3000 Building Automation System
 
 This is our T3000 Building Automation front end, a mature project for managing the air conditioning, lighting, access control and other automation functions of commercial buildings. The application runs on a Windows PC and allows the building operator to manage the building as a complete system. There is a small but growing team of developers working on the application full time. The system works mainly with Temco Controls products but integrators, controls contractors and other manufacturers are encouraged to join in to add their own devices and features. Communication is supported using Modbus and/or Bacnet calls over Ethernet, Wifi, RS485, RS232, and Bluetooth.  
 
-The project has been around for many years and has a bright future as the system and our application matures. We welcome contributions and suggestions on next steps. Please refer to [Wiki](https://github.com/temcocontrols/T3000_Building_Automation_System/wiki) for details on how you can get started with contributing towards the project.  For build instructions see [Compile T3000](README_Build.md). See [Documentation](Documentation/README.md) for technical plans and integration guides.
+The project has been around for many years and has a bright future as the system and our application matures. We welcome contributions and suggestions on next steps. Please refer to [Wiki](https://github.com/temcocontrols/T3000_Building_Automation_System/wiki) for details on how you can get started with contributing towards the project.  For build instructions see [Compile T3000](README_Build.md). See [Documentation](Documentation/README.md) for technical plans and integration guides. CCTV Windows demo: [DEMO.md](DEMO.md). Details: [Documentation/nvr.md](Documentation/nvr.md).
 
 To see how you can use our github release action in your own fork follow the instructions in our Wiki [How to use our github action to build the solution and the msi installer](https://github.com/temcocontrols/T3000_Building_Automation_System/wiki/How-to-use-our-github-action-to-build-the-solution-and-the-msi-installer)
 
diff --git a/README_Build.md b/README_Build.md
index 5a1c7fda..af1f9f3e 100644
--- a/README_Build.md
+++ b/README_Build.md
@@ -51,6 +51,20 @@ Launching a Build
   
    Once the compilation is successful, the output files (executable, libraries, etc.) will be generated in the appropriate directory. By default, for the Release configuration, you can find the output files in the "Release" folder within your project directory.
 
+CCTV sidecars (optional)
+---------------------------------
+Live view uses `go2rtc.exe` (and optionally `mediamtx.exe`) as localhost processes. They are not required to compile T3000.
+
+**Windows teammate demo (this branch):** [DEMO.md](DEMO.md) — checkout, Win32 build, official zip links, Tools → CCTV, ONVIF/RTSP, missing-exe behavior.
+
+Short version after a successful build:
+
+```
+powershell -ExecutionPolicy Bypass -File tools\fetch-nvr-sidecars.ps1
+```
+
+or drop `go2rtc.exe` from https://github.com/AlexxIT/go2rtc/releases/download/v1.9.14/go2rtc_win64.zip into `T3000 Output\release\sidecar\`. Then start T3000 and open **Tools → CCTV**.
+
 * **Test the Application:**
   
    Before distributing or using the compiled application, it's important to test it thoroughly to ensure it behaves as expected. Run the executable generated during the compilation to verify its functionality.
diff --git a/T3000/BacnetWebView.cpp b/T3000/BacnetWebView.cpp
index 6294c7e0..847f3c81 100644
--- a/T3000/BacnetWebView.cpp
+++ b/T3000/BacnetWebView.cpp
@@ -23,6 +23,7 @@
 #include "BacnetWeeklyRoutine.h"
 #include "BacnetAnnualRoutine.h"
 #include "BacnetWebView.h"
+#include "T3000NvrSidecar.h"
 #include "MainFrm.h"
 #include "JsonHead.h"
 extern "C" {
@@ -870,6 +871,12 @@ void HandleWebViewMsg(CString msg, CString& outmsg, int msg_source = 0)
 	std::string message = CT2A(msg);
 	Json::Reader reader;
 	reader.parse(message, json, false);
+	if (json.isMember("type") && json["type"].asString() == "nvr")
+	{
+		T3000Nvr_HandleWebMessage(msg, outmsg);
+		return;
+	}
+
 	int action = json.get("action", Json::nullValue).asInt();
 
 
diff --git a/T3000/CMakeLists.txt b/T3000/CMakeLists.txt
index 86194db7..a483eb2c 100644
--- a/T3000/CMakeLists.txt
+++ b/T3000/CMakeLists.txt
@@ -743,6 +743,7 @@ set(T3000_SOURCE_FILES
   ${T3000_SOURCE_DIR}/Json-cpp/dist/jsoncpp.cpp
   ${T3000_SOURCE_DIR}/BacnetWebViewToolBar.cpp
   ${T3000_SOURCE_DIR}/BacnetWebView.cpp
+  ${T3000_SOURCE_DIR}/T3000NvrSidecar.cpp
   ${T3000_SOURCE_DIR}/webview/WebViewHvacDraw.cpp
 )
 
diff --git a/T3000/MainFrm.cpp b/T3000/MainFrm.cpp
index ad8ed5e4..0c93e8b6 100644
--- a/T3000/MainFrm.cpp
+++ b/T3000/MainFrm.cpp
@@ -169,6 +169,7 @@ extern void Init_table_bank();
 #include "BacnetRemotePoint.h"
 #include "BacnetSetting.h"
 #include "BacnetWebView.h"
+#include "T3000NvrSidecar.h"
 #include "BacnetPVar.h"
 
 HANDLE h_create_webview_server_thread = NULL;
@@ -394,6 +395,7 @@ BEGIN_MESSAGE_MAP(CMainFrame, CFrameWndEx)
         ON_MESSAGE(WM_WRITE_INTO_NEW_DEVICE, HandleWriteNewDevice)
         ON_COMMAND(ID_WEBVIEW_MODBUSREGISTER, &CMainFrame::OnWebviewModbusregister)
         //ON_COMMAND(ID_WEBVIEW_THIRDPARTYMODBUSDATABASE, &CMainFrame::OnWebviewThirdpartymodbusdatabase)
+        ON_COMMAND(ID_TOOLS_CAMERAS, &CMainFrame::OnToolsCameras)
         ON_COMMAND(ID_TOOLS_LOGINMYACCOUNT, &CMainFrame::OnToolsLoginmyaccount)
         ON_WM_SYSCOMMAND()
         ON_WM_ACTIVATEAPP()
@@ -16567,6 +16569,37 @@ CString GetUserAppDataPath(LPCTSTR lpFolderName = NULL)
     return _T("");
 }
 
+void CMainFrame::OnToolsCameras()
+{
+	extern int check_webview_runtime();
+	if (check_webview_runtime() == 0)
+	{
+		const int answer = AfxMessageBox(
+			_T("CCTV needs the Microsoft Edge WebView2 Runtime.\r\nDownload it from https://developer.microsoft.com/microsoft-edge/webview2/"),
+			MB_YESNO | MB_ICONWARNING);
+		if (answer == IDYES)
+		{
+			ShellExecute(NULL, _T("open"),
+				_T("https://developer.microsoft.com/en-us/microsoft-edge/webview2/"),
+				NULL, NULL, SW_SHOWNORMAL);
+		}
+		return;
+	}
+
+	const T3000NvrLaunchResult launch = T3000Nvr_StartSidecars();
+	SetPaneString(BAC_SHOW_MISSION_RESULTS, launch.message);
+
+	CString webviewUrl = launch.viewUrl;
+	CString webviewTitle = _T("CCTV");
+	auto webviewwindow = new BacnetWebViewAppWindow(
+		IDM_CREATION_MODE_WINDOWED,
+		wstring(webviewUrl),
+		wstring(webviewTitle));
+	BacnetWebViewAppWindow::RunMessagePump();
+	delete webviewwindow;
+	T3000Nvr_StopSidecars();
+}
+
 void CMainFrame::OnWebviewModbusregister()
 {
     // TODO: 在此添加命令处理程序代码
diff --git a/T3000/MainFrm.h b/T3000/MainFrm.h
index 4c34e0ff..02d27240 100644
--- a/T3000/MainFrm.h
+++ b/T3000/MainFrm.h
@@ -624,6 +624,7 @@ class CMainFrame : public CFrameWndEx
 #endif
 		afx_msg void OnWebviewModbusregister();
 		//afx_msg void OnWebviewThirdpartymodbusdatabase();
+		afx_msg void OnToolsCameras();
 		afx_msg void OnToolsLoginmyaccount();
 		afx_msg void OnSysCommand(UINT nID, LPARAM lParam);
 };
diff --git a/T3000/ResourceFile/nvr/index.html b/T3000/ResourceFile/nvr/index.html
new file mode 100644
index 00000000..bb17401d
--- /dev/null
+++ b/T3000/ResourceFile/nvr/index.html
@@ -0,0 +1,488 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate" />
+  <title>T3000 CCTV</title>
+  <style>
+    :root {
+      --navy: #0d2137;
+      --navy-2: #16324f;
+      --accent: #1e6bb8;
+      --accent-hover: #185a9a;
+      --bg: #e8eef2;
+      --card: #ffffff;
+      --text: #1a1a1a;
+      --muted: #5a6570;
+      --line: #c5d0d8;
+      --ok: #2e7d32;
+      --warn: #c47d00;
+      --err: #b71c1c;
+    }
+    * { box-sizing: border-box; }
+    html, body { margin: 0; height: 100%; }
+    body {
+      font-family: "Segoe UI", Tahoma, Arial, sans-serif;
+      font-size: 13px;
+      color: var(--text);
+      background: var(--bg);
+    }
+    header {
+      background: linear-gradient(180deg, var(--navy) 0%, var(--navy-2) 100%);
+      color: #fff;
+      padding: 10px 16px;
+      display: flex;
+      align-items: center;
+      gap: 16px;
+      min-height: 48px;
+    }
+    header h1 { font-size: 16px; font-weight: 600; margin: 0; letter-spacing: 0.02em; }
+    header .sub { color: #c5d4e4; font-size: 12px; }
+    .status { margin-left: auto; display: flex; gap: 10px; flex-wrap: wrap; }
+    .pill {
+      background: rgba(255,255,255,0.1);
+      border: 1px solid rgba(255,255,255,0.2);
+      border-radius: 12px;
+      padding: 3px 10px;
+      font-size: 11px;
+    }
+    .pill.ok { background: #1f6b3a; border-color: #2e8b4f; }
+    .pill.warn { background: #7a5a10; border-color: #c47d00; }
+    .pill.err { background: #7a1f1f; border-color: #b71c1c; }
+    .wrap { padding: 12px 16px 24px; display: grid; grid-template-columns: 320px 1fr; gap: 12px; }
+    @media (max-width: 900px) { .wrap { grid-template-columns: 1fr; } }
+    .panel {
+      background: var(--card);
+      border: 1px solid var(--line);
+      border-radius: 4px;
+    }
+    .panel h2 {
+      margin: 0;
+      padding: 8px 12px;
+      font-size: 13px;
+      background: #f3f6f8;
+      border-bottom: 1px solid var(--line);
+    }
+    .panel .body { padding: 12px; }
+    label { display: block; color: var(--muted); margin: 8px 0 3px; }
+    input, select {
+      width: 100%;
+      padding: 6px 8px;
+      border: 1px solid var(--line);
+      border-radius: 3px;
+      font: inherit;
+    }
+    button {
+      background: var(--accent);
+      color: #fff;
+      border: 0;
+      border-radius: 3px;
+      padding: 7px 12px;
+      font: inherit;
+      cursor: pointer;
+    }
+    button:hover { background: var(--accent-hover); }
+    button.secondary { background: #5a6570; }
+    button.secondary:hover { background: #465058; }
+    button.danger { background: #b71c1c; }
+    .row { display: flex; gap: 8px; margin-top: 10px; flex-wrap: wrap; }
+    .msg {
+      margin-top: 10px;
+      padding: 8px 10px;
+      border-radius: 3px;
+      background: #f4f7fa;
+      color: var(--muted);
+      white-space: pre-wrap;
+    }
+    .msg.err { background: #fdecea; color: var(--err); }
+    .msg.warn { background: #fff6e0; color: #7a5200; }
+    .disc { list-style: none; margin: 8px 0 0; padding: 0; }
+    .disc li {
+      border: 1px solid var(--line);
+      border-radius: 3px;
+      padding: 8px;
+      margin-bottom: 8px;
+    }
+    .disc .name { font-weight: 600; }
+    .disc .meta { color: var(--muted); font-size: 12px; word-break: break-all; }
+    .tiles {
+      display: grid;
+      grid-template-columns: repeat(auto-fill, minmax(320px, 1fr));
+      gap: 12px;
+      padding: 12px;
+    }
+    .tile {
+      background: #000;
+      border-radius: 4px;
+      overflow: hidden;
+      border: 1px solid var(--line);
+      min-height: 220px;
+      position: relative;
+    }
+    .tile video, .tile img { width: 100%; height: 220px; object-fit: contain; background: #000; display: block; }
+    .tile .cap {
+      background: var(--card);
+      padding: 6px 8px;
+      display: flex;
+      justify-content: space-between;
+      align-items: center;
+      gap: 8px;
+    }
+    .tile .cap span { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+    .empty { color: var(--muted); padding: 32px 16px; text-align: center; }
+  </style>
+</head>
+<body>
+  <header>
+    <div>
+      <h1>T3000 CCTV</h1>
+      <div class="sub">ONVIF discovery and live view via go2rtc sidecar</div>
+    </div>
+    <div class="status">
+      <span id="pill-go2rtc" class="pill">go2rtc …</span>
+      <span id="pill-mtx" class="pill">MediaMTX …</span>
+    </div>
+  </header>
+  <div class="wrap">
+    <div>
+      <div class="panel">
+        <h2>Sidecar</h2>
+        <div class="body">
+          <div id="sidecar-msg" class="msg">Checking localhost sidecars…</div>
+        </div>
+      </div>
+      <div class="panel" style="margin-top:12px">
+        <h2>Add camera</h2>
+        <div class="body">
+          <label>Name</label>
+          <input id="cam-name" placeholder="lobby" />
+          <label>RTSP or ONVIF URL</label>
+          <input id="cam-src" placeholder="rtsp://user:pass@192.168.1.20/Streaming/Channels/101" />
+          <div class="row">
+            <button id="btn-add">Add and play</button>
+            <button id="btn-refresh" class="secondary" type="button">Refresh list</button>
+          </div>
+        </div>
+      </div>
+      <div class="panel" style="margin-top:12px">
+        <h2>ONVIF discovery</h2>
+        <div class="body">
+          <p class="sub" style="margin:0 0 8px;color:var(--muted)">Scans the local subnet. Enter credentials if the camera requires them, then add.</p>
+          <label>Username</label>
+          <input id="onvif-user" placeholder="admin" />
+          <label>Password</label>
+          <input id="onvif-pass" type="password" />
+          <div class="row">
+            <button id="btn-discover">Discover ONVIF</button>
+          </div>
+          <ul id="disc-list" class="disc"></ul>
+        </div>
+      </div>
+    </div>
+    <div class="panel">
+      <h2>Live view</h2>
+      <div id="tiles" class="tiles"><div class="empty">Add an RTSP URL or discover an ONVIF camera to start live video.</div></div>
+    </div>
+  </div>
+  <script>
+    (function () {
+      var qs = new URLSearchParams(location.search);
+      var API = qs.get("api") || (location.protocol === "http:" ? location.origin : "http://127.0.0.1:9191");
+      var cameras = [];
+      var peers = {};
+
+      function $(id) { return document.getElementById(id); }
+      function hostAvailable() {
+        return !!(window.chrome && chrome.webview && chrome.webview.postMessage);
+      }
+      function postHost(obj) {
+        if (hostAvailable()) chrome.webview.postMessage(JSON.stringify(obj));
+      }
+      function setPill(id, ok, label) {
+        var el = $(id);
+        el.className = "pill " + (ok ? "ok" : "err");
+        el.textContent = label;
+      }
+      function showMsg(text, kind) {
+        var el = $("sidecar-msg");
+        el.className = "msg" + (kind ? " " + kind : "");
+        el.textContent = text;
+      }
+      function sanitizeName(name) {
+        return String(name || "").replace(/[^A-Za-z0-9_-]/g, "_").replace(/^_+/, "") || ("cam_" + Date.now());
+      }
+      function persist() {
+        try { localStorage.setItem("t3000.nvr.cameras", JSON.stringify(cameras)); } catch (e) {}
+        postHost({ type: "nvr", cmd: "saveCameras", cameras: cameras });
+      }
+      function loadLocal() {
+        try {
+          var raw = localStorage.getItem("t3000.nvr.cameras");
+          if (raw) cameras = JSON.parse(raw) || [];
+        } catch (e) { cameras = []; }
+      }
+
+      async function api(path, opt) {
+        var r = await fetch(API + path, opt || {});
+        if (!r.ok) throw new Error(path + " HTTP " + r.status);
+        var ct = r.headers.get("content-type") || "";
+        if (ct.indexOf("json") >= 0) return r.json();
+        return r.text();
+      }
+
+      async function putStream(name, src) {
+        var url = API + "/api/streams?name=" + encodeURIComponent(name) + "&src=" + encodeURIComponent(src);
+        var r = await fetch(url, { method: "PUT" });
+        if (!r.ok && r.status !== 400) {
+          r = await fetch(API + "/api/streams", {
+            method: "PUT",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ name: name, src: [src] })
+          });
+        }
+        if (!r.ok && r.status !== 200 && r.status !== 400) {
+          throw new Error("Could not register stream " + name + " (" + r.status + ")");
+        }
+      }
+
+      async function playWebRtc(video, src) {
+        var pc = new RTCPeerConnection({ iceServers: [{ urls: "stun:stun.l.google.com:19302" }] });
+        pc.addTransceiver("video", { direction: "recvonly" });
+        pc.addTransceiver("audio", { direction: "recvonly" });
+        pc.ontrack = function (ev) {
+          if (ev.streams && ev.streams[0]) video.srcObject = ev.streams[0];
+        };
+        var offer = await pc.createOffer();
+        await pc.setLocalDescription(offer);
+        var r = await fetch(API + "/api/webrtc?src=" + encodeURIComponent(src), {
+          method: "POST",
+          headers: { "Content-Type": "application/sdp" },
+          body: offer.sdp
+        });
+        if (!r.ok) throw new Error("webrtc " + r.status);
+        var answer = await r.text();
+        await pc.setRemoteDescription({ type: "answer", sdp: answer });
+        return pc;
+      }
+
+      function playMp4(video, src) {
+        video.srcObject = null;
+        video.src = API + "/api/stream.mp4?src=" + encodeURIComponent(src);
+        video.muted = true;
+        video.autoplay = true;
+        video.playsInline = true;
+        return video.play();
+      }
+
+      async function playTile(video, name) {
+        try {
+          peers[name] = await playWebRtc(video, name);
+          video.muted = true;
+          video.autoplay = true;
+          video.playsInline = true;
+          await video.play().catch(function () {});
+        } catch (e) {
+          try { await playMp4(video, name); }
+          catch (e2) {
+            video.poster = "";
+            video.src = API + "/api/stream.mjpeg?src=" + encodeURIComponent(name);
+          }
+        }
+      }
+
+      function renderTiles() {
+        var box = $("tiles");
+        box.innerHTML = "";
+        if (!cameras.length) {
+          box.innerHTML = '<div class="empty">Add an RTSP URL or discover an ONVIF camera to start live video.</div>';
+          return;
+        }
+        cameras.forEach(function (cam) {
+          var tile = document.createElement("div");
+          tile.className = "tile";
+          var video = document.createElement("video");
+          video.controls = true;
+          video.muted = true;
+          video.autoplay = true;
+          video.playsInline = true;
+          var cap = document.createElement("div");
+          cap.className = "cap";
+          cap.innerHTML = "<span></span>";
+          cap.querySelector("span").textContent = cam.title || cam.name;
+          var rm = document.createElement("button");
+          rm.className = "danger";
+          rm.textContent = "Remove";
+          rm.onclick = function () { removeCam(cam.name); };
+          cap.appendChild(rm);
+          tile.appendChild(video);
+          tile.appendChild(cap);
+          box.appendChild(tile);
+          playTile(video, cam.name);
+        });
+      }
+
+      function upsertCam(name, src, title) {
+        name = sanitizeName(name);
+        var found = cameras.filter(function (c) { return c.name === name; })[0];
+        if (found) { found.src = src; found.title = title || name; }
+        else cameras.push({ name: name, src: src, title: title || name });
+        persist();
+        return name;
+      }
+
+      async function addCam(name, src, title) {
+        if (!src) { showMsg("Enter an RTSP or ONVIF URL.", "err"); return; }
+        name = upsertCam(name || "camera", src, title);
+        try {
+          await putStream(name, src);
+          renderTiles();
+          showMsg("Playing " + name + ".", "");
+        } catch (e) {
+          showMsg(String(e.message || e), "err");
+          renderTiles();
+        }
+      }
+
+      function removeCam(name) {
+        cameras = cameras.filter(function (c) { return c.name !== name; });
+        if (peers[name]) { try { peers[name].close(); } catch (e) {} delete peers[name]; }
+        persist();
+        fetch(API + "/api/streams?src=" + encodeURIComponent(name), { method: "DELETE" }).catch(function () {});
+        renderTiles();
+      }
+
+      function onvifUrl(raw, user, pass) {
+        raw = String(raw || "");
+        if (!raw) return "";
+        if (raw.indexOf("onvif://") !== 0 && raw.indexOf("rtsp://") !== 0) {
+          raw = "onvif://" + raw.replace(/^https?:\/\//, "");
+        }
+        if (user && raw.indexOf("@") < 0) {
+          raw = raw.replace(/^(onvif|rtsp):\/\//, function (m) {
+            return m + encodeURIComponent(user) + ":" + encodeURIComponent(pass || "") + "@";
+          });
+        }
+        return raw;
+      }
+
+      function renderDiscovery(list) {
+        var ul = $("disc-list");
+        ul.innerHTML = "";
+        if (!list || !list.length) {
+          ul.innerHTML = "<li class='meta'>No ONVIF devices answered. Confirm the camera is on this LAN and not isolated from multicast.</li>";
+          return;
+        }
+        list.forEach(function (dev, i) {
+          var url = dev.url || dev.src || dev.xaddr || dev.location || "";
+          var name = dev.name || dev.hardware || ("onvif_" + (i + 1));
+          var li = document.createElement("li");
+          li.innerHTML = "<div class='name'></div><div class='meta'></div>";
+          li.querySelector(".name").textContent = name;
+          li.querySelector(".meta").textContent = url || JSON.stringify(dev);
+          var b = document.createElement("button");
+          b.textContent = "Add";
+          b.style.marginTop = "6px";
+          b.onclick = function () {
+            var src = onvifUrl(url, $("onvif-user").value, $("onvif-pass").value);
+            addCam(name, src, name);
+          };
+          li.appendChild(b);
+          ul.appendChild(li);
+        });
+      }
+
+      async function discover() {
+        $("disc-list").innerHTML = "<li>Scanning…</li>";
+        var paths = ["/api/onvif", "/api/discovery?src=onvif", "/api/discovery"];
+        var lastErr = null;
+        for (var i = 0; i < paths.length; i++) {
+          try {
+            var data = await api(paths[i]);
+            var list = Array.isArray(data) ? data : (data.sources || data.devices || data.items || []);
+            if (data && !Array.isArray(data) && typeof data === "object" && !list.length) {
+              list = Object.keys(data).map(function (k) {
+                var v = data[k] || {};
+                if (typeof v === "string") return { name: k, url: v };
+                v.name = v.name || k;
+                return v;
+              });
+            }
+            renderDiscovery(list);
+            return;
+          } catch (e) { lastErr = e; }
+        }
+        $("disc-list").innerHTML = "";
+        showMsg("ONVIF discovery failed. " + (lastErr && lastErr.message ? lastErr.message : "Is go2rtc running?"), "err");
+      }
+
+      async function refreshFromGo2rtc() {
+        try {
+          var data = await api("/api/streams");
+          if (data && typeof data === "object") {
+            Object.keys(data).forEach(function (name) {
+              if (!cameras.some(function (c) { return c.name === name; })) {
+                var src = "";
+                var rec = data[name];
+                if (rec && rec.producers && rec.producers[0] && rec.producers[0].url)
+                  src = rec.producers[0].url;
+                cameras.push({ name: name, src: src || name, title: name });
+              }
+            });
+            persist();
+          }
+        } catch (e) {}
+        renderTiles();
+      }
+
+      async function init() {
+        if (qs.get("offline") === "1") {
+          setPill("pill-go2rtc", false, "go2rtc missing");
+          setPill("pill-mtx", false, "MediaMTX off");
+          var reason = qs.get("reason") || (
+            "go2rtc.exe was not found. T3000 is still running.\n\n" +
+            "Drop go2rtc.exe next to T3000.exe, in sidecar\\go2rtc.exe, or in T3000\\sidecar\\, then reopen Tools > CCTV.\n" +
+            "Download: https://github.com/AlexxIT/go2rtc/releases/download/v1.9.14/go2rtc_win64.zip\n" +
+            "See DEMO.md"
+          );
+          showMsg(reason, "err");
+          loadLocal();
+          if (cameras.length) renderTiles();
+          return;
+        }
+        try {
+          await api("/api");
+          setPill("pill-go2rtc", true, "go2rtc :9191");
+          var mtxOk = qs.get("mediamtx") === "1";
+          try {
+            var m = await fetch((qs.get("mtx") || "http://127.0.0.1:9197") + "/v3/config/global/get");
+            mtxOk = m.ok;
+          } catch (e) {}
+          setPill("pill-mtx", mtxOk, mtxOk ? "MediaMTX :9197" : "MediaMTX off");
+          showMsg("Live view is served by go2rtc on 127.0.0.1:9191 (WebRTC, then MP4). MediaMTX is reserved for later record/playback.", mtxOk ? "" : "warn");
+          loadLocal();
+          for (var i = 0; i < cameras.length; i++) {
+            if (cameras[i].src) {
+              try { await putStream(cameras[i].name, cameras[i].src); } catch (e) {}
+            }
+          }
+          await refreshFromGo2rtc();
+        } catch (e) {
+          setPill("pill-go2rtc", false, "go2rtc down");
+          setPill("pill-mtx", false, "MediaMTX off");
+          showMsg("Cannot reach go2rtc at " + API + ". " + (e.message || e), "err");
+        }
+      }
+
+      $("btn-add").onclick = function () {
+        addCam($("cam-name").value, $("cam-src").value.trim(), $("cam-name").value);
+      };
+      $("btn-discover").onclick = discover;
+      $("btn-refresh").onclick = refreshFromGo2rtc;
+      if (hostAvailable()) {
+        chrome.webview.addEventListener("message", function () {});
+      }
+      init();
+    })();
+  </script>
+</body>
+</html>
diff --git a/T3000/T3000.cpp b/T3000/T3000.cpp
index f14bd55c..5576cc4e 100644
--- a/T3000/T3000.cpp
+++ b/T3000/T3000.cpp
@@ -31,6 +31,7 @@ const unsigned int g_versionNO = 20260717;     // PROJECT_VERSION
 
 
 #include "global_variable.h"
+#include "T3000NvrSidecar.h"
 
 BEGIN_MESSAGE_MAP(CT3000App, CWinAppEx)
 	ON_COMMAND(ID_APP_ABOUT, &CT3000App::OnAppAbout)
@@ -847,6 +848,7 @@ int CT3000App::ExitInstance()
 #ifdef read_prop_multi_function
 	SyncReadState_Cleanup();
 #endif
+	T3000Nvr_StopSidecars();
 	CoUninitialize( );
 	return CWinAppEx::ExitInstance();
 }
diff --git a/T3000/T3000.rc b/T3000/T3000.rc
index 0a08c098..f10c5f64 100644
--- a/T3000/T3000.rc
+++ b/T3000/T3000.rc
@@ -11526,6 +11526,7 @@ BEGIN
         MENUITEM "Modbus Poll",                 ID_DATABASE_MBPOLL
         MENUITEM "Register Viewer",             ID_TOOL_REGISTERVIEWER
         MENUITEM "Modbus Register v2 ( beta )", ID_WEBVIEW_MODBUSREGISTER
+        MENUITEM "CCTV",                        ID_TOOLS_CAMERAS
         MENUITEM "RegisterList Database Folder", ID_FILE_EXPORTREGISETERSLIST1
         MENUITEM "Load firmware for a single device    [Ctrl+F2]", ID_TOOL_ISPTOOLFORONE
         MENUITEM "Load firmware for many devices [Ctrl+M]", ID_FILE_BATCHBURNHEX, INACTIVE
diff --git a/T3000/T3000NvrSidecar.cpp b/T3000/T3000NvrSidecar.cpp
new file mode 100644
index 00000000..51d02665
--- /dev/null
+++ b/T3000/T3000NvrSidecar.cpp
@@ -0,0 +1,661 @@
+#include "stdafx.h"
+#include "T3000NvrSidecar.h"
+
+#include <string>
+#include <ShlObj.h>
+#include <Shlwapi.h>
+#include <json/json.h>
+
+#pragma comment(lib, "Shlwapi.lib")
+
+namespace
+{
+	HANDLE g_job = NULL;
+	HANDLE g_go2rtcProcess = NULL;
+	HANDLE g_mediamtxProcess = NULL;
+	bool g_ownGo2rtc = false;
+	bool g_ownMediamtx = false;
+
+	CString ExeDir()
+	{
+		TCHAR path[MAX_PATH] = { 0 };
+		GetModuleFileName(NULL, path, MAX_PATH);
+		PathRemoveFileSpec(path);
+		return CString(path);
+	}
+
+	bool FileExists(const CString& path)
+	{
+		const DWORD attr = GetFileAttributes(path);
+		return attr != INVALID_FILE_ATTRIBUTES && !(attr & FILE_ATTRIBUTE_DIRECTORY);
+	}
+
+	bool DirExists(const CString& path)
+	{
+		const DWORD attr = GetFileAttributes(path);
+		return attr != INVALID_FILE_ATTRIBUTES && (attr & FILE_ATTRIBUTE_DIRECTORY);
+	}
+
+	void EnsureDir(const CString& path)
+	{
+		if (!DirExists(path))
+			CreateDirectory(path, NULL);
+	}
+
+	CString Utf8ToCString(const std::string& s)
+	{
+		if (s.empty())
+			return CString();
+		const int n = MultiByteToWideChar(CP_UTF8, 0, s.c_str(), (int)s.size(), NULL, 0);
+		CString out;
+		LPWSTR buf = out.GetBuffer(n);
+		MultiByteToWideChar(CP_UTF8, 0, s.c_str(), (int)s.size(), buf, n);
+		out.ReleaseBuffer(n);
+		return out;
+	}
+
+	std::string CStringToUtf8(const CString& s)
+	{
+		if (s.IsEmpty())
+			return std::string();
+		const int n = WideCharToMultiByte(CP_UTF8, 0, s, s.GetLength(), NULL, 0, NULL, NULL);
+		std::string out(n, 0);
+		WideCharToMultiByte(CP_UTF8, 0, s, s.GetLength(), &out[0], n, NULL, NULL);
+		return out;
+	}
+
+	CString YamlQuote(const CString& s)
+	{
+		CString t = s;
+		t.Replace(_T("\\"), _T("\\\\"));
+		t.Replace(_T("\""), _T("\\\""));
+		return _T("\"") + t + _T("\"");
+	}
+
+	CString UrlEncode(const CString& s)
+	{
+		CStringA utf8 = CStringA(s);
+		CString out;
+		for (int i = 0; i < utf8.GetLength(); ++i)
+		{
+			unsigned char c = (unsigned char)utf8[i];
+			if ((c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') ||
+				(c >= '0' && c <= '9') || c == '-' || c == '_' || c == '.' || c == '~')
+			{
+				out.AppendChar((TCHAR)c);
+			}
+			else
+			{
+				CString hex;
+				hex.Format(_T("%%%02X"), c);
+				out += hex;
+			}
+		}
+		return out;
+	}
+
+	CString FileUri(const CString& winPath)
+	{
+		CString p = winPath;
+		p.Replace(_T("\\"), _T("/"));
+		if (p.GetLength() >= 2 && p[1] == _T(':'))
+			return _T("file:///") + p;
+		return _T("file://") + p;
+	}
+
+	bool TcpPortOpen(int port, int timeoutMs)
+	{
+		SOCKET s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
+		if (s == INVALID_SOCKET)
+			return false;
+
+		u_long nonblock = 1;
+		ioctlsocket(s, FIONBIO, &nonblock);
+
+		sockaddr_in addr = {};
+		addr.sin_family = AF_INET;
+		addr.sin_port = htons((u_short)port);
+		addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+
+		connect(s, (sockaddr*)&addr, sizeof(addr));
+
+		fd_set writeSet;
+		FD_ZERO(&writeSet);
+		FD_SET(s, &writeSet);
+		timeval tv;
+		tv.tv_sec = timeoutMs / 1000;
+		tv.tv_usec = (timeoutMs % 1000) * 1000;
+		const int sel = select(0, NULL, &writeSet, NULL, &tv);
+		bool ok = false;
+		if (sel > 0 && FD_ISSET(s, &writeSet))
+		{
+			int err = 0;
+			int len = sizeof(err);
+			getsockopt(s, SOL_SOCKET, SO_ERROR, (char*)&err, &len);
+			ok = (err == 0);
+		}
+		closesocket(s);
+		return ok;
+	}
+
+	bool HttpGetLocal(int port, const char* path, CStringA& body, int timeoutMs)
+	{
+		body.Empty();
+		SOCKET s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
+		if (s == INVALID_SOCKET)
+			return false;
+
+		DWORD tv = (DWORD)timeoutMs;
+		setsockopt(s, SOL_SOCKET, SO_RCVTIMEO, (const char*)&tv, sizeof(tv));
+		setsockopt(s, SOL_SOCKET, SO_SNDTIMEO, (const char*)&tv, sizeof(tv));
+
+		sockaddr_in addr = {};
+		addr.sin_family = AF_INET;
+		addr.sin_port = htons((u_short)port);
+		addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+		if (connect(s, (sockaddr*)&addr, sizeof(addr)) != 0)
+		{
+			closesocket(s);
+			return false;
+		}
+
+		CStringA req;
+		req.Format("GET %s HTTP/1.0\r\nHost: 127.0.0.1:%d\r\nConnection: close\r\n\r\n", path, port);
+		if (send(s, req.GetString(), req.GetLength(), 0) <= 0)
+		{
+			closesocket(s);
+			return false;
+		}
+
+		char buf[2048];
+		int n;
+		while ((n = recv(s, buf, sizeof(buf), 0)) > 0)
+			body.Append(buf, n);
+		closesocket(s);
+
+		const int headerEnd = body.Find("\r\n\r\n");
+		const CStringA head = (headerEnd >= 0) ? body.Left(headerEnd) : body;
+		return head.Find(" 200") >= 0;
+	}
+
+	bool LooksLikeGo2rtc(const CStringA& body)
+	{
+		return body.Find("\"rtsp\"") >= 0 ||
+			body.Find("go2rtc") >= 0 ||
+			body.Find("\"streams\"") >= 0 ||
+			body.Find("\"host\"") >= 0;
+	}
+
+	CString CamerasJsonPath()
+	{
+		return T3000Nvr_GetConfigDir() + _T("\\cameras.json");
+	}
+
+	CString ReadTextFile(const CString& path)
+	{
+		CFile f;
+		if (!f.Open(path, CFile::modeRead | CFile::shareDenyWrite))
+			return CString();
+		const ULONGLONG len = f.GetLength();
+		if (len == 0 || len > 2 * 1024 * 1024)
+		{
+			f.Close();
+			return CString();
+		}
+		std::string raw((size_t)len, 0);
+		f.Read(&raw[0], (UINT)len);
+		f.Close();
+		return Utf8ToCString(raw);
+	}
+
+	bool WriteTextFile(const CString& path, const CString& text)
+	{
+		CFile f;
+		if (!f.Open(path, CFile::modeCreate | CFile::modeWrite | CFile::shareDenyWrite))
+			return false;
+		const std::string raw = CStringToUtf8(text);
+		if (!raw.empty())
+			f.Write(raw.data(), (UINT)raw.size());
+		f.Close();
+		return true;
+	}
+
+	CString StreamsYamlFromCamerasJson()
+	{
+		const CString jsonText = ReadTextFile(CamerasJsonPath());
+		if (jsonText.IsEmpty())
+			return CString();
+
+		Json::Value root;
+		Json::Reader reader;
+		if (!reader.parse(CStringToUtf8(jsonText), root, false))
+			return CString();
+
+		const Json::Value cams = root.isMember("cameras") ? root["cameras"] : root;
+		if (!cams.isArray())
+			return CString();
+
+		CString yaml;
+		for (Json::ArrayIndex i = 0; i < cams.size(); ++i)
+		{
+			const Json::Value& c = cams[i];
+			CString name = Utf8ToCString(c.get("name", "").asString());
+			CString src = Utf8ToCString(c.get("src", "").asString());
+			if (name.IsEmpty() || src.IsEmpty())
+				continue;
+			for (int k = 0; k < name.GetLength(); ++k)
+			{
+				const TCHAR ch = name[k];
+				const bool ok = (ch >= _T('A') && ch <= _T('Z')) ||
+					(ch >= _T('a') && ch <= _T('z')) ||
+					(ch >= _T('0') && ch <= _T('9')) ||
+					ch == _T('_') || ch == _T('-');
+				if (!ok)
+					name.SetAt(k, _T('_'));
+			}
+			yaml += _T("  ") + name + _T(": ") + YamlQuote(src) + _T("\r\n");
+		}
+		return yaml;
+	}
+
+	void WriteGo2rtcYaml(const CString& configDir, const CString& staticDir)
+	{
+		CString streams = StreamsYamlFromCamerasJson();
+		CString yaml;
+		yaml += _T("# Generated by T3000. Bind localhost only.\r\n");
+		yaml += _T("# Live/discover: go2rtc. Record/playback hook: MediaMTX (separate process).\r\n");
+		yaml += _T("api:\r\n");
+		yaml.AppendFormat(_T("  listen: \"127.0.0.1:%d\"\r\n"), T3000_NVR_GO2RTC_API_PORT);
+		yaml += _T("  origin: \"*\"\r\n");
+		yaml += _T("  static_dir: ") + YamlQuote(staticDir) + _T("\r\n");
+		yaml += _T("rtsp:\r\n");
+		yaml.AppendFormat(_T("  listen: \"127.0.0.1:%d\"\r\n"), T3000_NVR_GO2RTC_RTSP_PORT);
+		yaml += _T("webrtc:\r\n");
+		yaml.AppendFormat(_T("  listen: \"127.0.0.1:%d\"\r\n"), T3000_NVR_GO2RTC_WEBRTC_PORT);
+		yaml += _T("log:\r\n");
+		yaml += _T("  level: info\r\n");
+		if (streams.IsEmpty())
+			yaml += _T("streams: {}\r\n");
+		else
+		{
+			yaml += _T("streams:\r\n");
+			yaml += streams;
+		}
+		WriteTextFile(configDir + _T("\\go2rtc.yaml"), yaml);
+	}
+
+	void WriteMediamtxYml(const CString& configDir)
+	{
+		const CString recDir = configDir + _T("\\recordings");
+		EnsureDir(recDir);
+		CString yml;
+		yml += _T("# Generated by T3000. v1 live view uses go2rtc; this file is the record/playback home.\r\n");
+		yml += _T("logLevel: info\r\n");
+		yml += _T("api: yes\r\n");
+		yml.AppendFormat(_T("apiAddress: 127.0.0.1:%d\r\n"), T3000_NVR_MEDIAMTX_API_PORT);
+		yml += _T("rtsp: yes\r\n");
+		yml.AppendFormat(_T("rtspAddress: 127.0.0.1:%d\r\n"), T3000_NVR_MEDIAMTX_RTSP_PORT);
+		yml += _T("playback: yes\r\n");
+		yml.AppendFormat(_T("playbackAddress: 127.0.0.1:%d\r\n"), T3000_NVR_MEDIAMTX_PLAY_PORT);
+		yml += _T("rtmp: no\r\n");
+		yml += _T("hls: no\r\n");
+		yml += _T("webrtc: no\r\n");
+		yml += _T("srt: no\r\n");
+		yml += _T("pathDefaults:\r\n");
+		yml += _T("  source: publisher\r\n");
+		yml += _T("  # record: yes\r\n");
+		yml += _T("  # recordPath: ") + YamlQuote(recDir + _T("\\%path\\%Y-%m-%d_%H-%M-%S-%f")) + _T("\r\n");
+		WriteTextFile(configDir + _T("\\mediamtx.yml"), yml);
+	}
+
+	void CopyUiIntoConfigWww(const CString& configDir)
+	{
+		const CString www = configDir + _T("\\www");
+		EnsureDir(www);
+		const CString src = ExeDir() + _T("\\ResourceFile\\nvr\\index.html");
+		const CString dst = www + _T("\\index.html");
+		if (FileExists(src))
+			CopyFile(src, dst, FALSE);
+	}
+
+	void EnsureJobObject()
+	{
+		if (g_job)
+			return;
+		g_job = CreateJobObject(NULL, _T("T3000NVRSidecars"));
+		if (!g_job)
+			return;
+		JOBOBJECT_EXTENDED_LIMIT_INFORMATION info = {};
+		info.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
+		SetInformationJobObject(g_job, JobObjectExtendedLimitInformation, &info, sizeof(info));
+	}
+
+	bool StartHiddenProcess(const CString& exe, const CString& cmdLine, const CString& workDir, HANDLE& outHandle)
+	{
+		STARTUPINFO si = {};
+		si.cb = sizeof(si);
+		si.dwFlags = STARTF_USESHOWWINDOW;
+		si.wShowWindow = SW_HIDE;
+		PROCESS_INFORMATION pi = {};
+
+		CString writable = cmdLine;
+		LPTSTR buf = writable.GetBuffer(writable.GetLength() + 1);
+		DWORD flags = CREATE_NO_WINDOW | CREATE_BREAKAWAY_FROM_JOB;
+		BOOL ok = CreateProcess(
+			exe,
+			buf,
+			NULL,
+			NULL,
+			FALSE,
+			flags,
+			NULL,
+			workDir.IsEmpty() ? NULL : workDir.GetString(),
+			&si,
+			&pi);
+		if (!ok)
+		{
+			ok = CreateProcess(
+				exe,
+				buf,
+				NULL,
+				NULL,
+				FALSE,
+				CREATE_NO_WINDOW,
+				NULL,
+				workDir.IsEmpty() ? NULL : workDir.GetString(),
+				&si,
+				&pi);
+		}
+		writable.ReleaseBuffer();
+		if (!ok)
+			return false;
+
+		EnsureJobObject();
+		if (g_job)
+			AssignProcessToJobObject(g_job, pi.hProcess);
+
+		outHandle = pi.hProcess;
+		CloseHandle(pi.hThread);
+		return true;
+	}
+
+	bool WaitForHttp(int port, const char* path, int timeoutMs)
+	{
+		const DWORD start = GetTickCount();
+		CStringA body;
+		while ((GetTickCount() - start) < (DWORD)timeoutMs)
+		{
+			if (HttpGetLocal(port, path, body, 400))
+				return true;
+			Sleep(200);
+		}
+		return false;
+	}
+
+	void CloseOwned(HANDLE& h, bool& owned)
+	{
+		if (owned && h)
+		{
+			TerminateProcess(h, 0);
+			WaitForSingleObject(h, 2000);
+		}
+		if (h)
+		{
+			CloseHandle(h);
+			h = NULL;
+		}
+		owned = false;
+	}
+
+	CString OfflineViewUrl(const CString& reason)
+	{
+		CString html = ExeDir() + _T("\\ResourceFile\\nvr\\index.html");
+		if (!FileExists(html))
+			html = T3000Nvr_GetConfigDir() + _T("\\www\\index.html");
+		CString url = FileUri(html);
+		url += _T("?offline=1&reason=");
+		url += UrlEncode(reason);
+		url.AppendFormat(_T("&go2rtcPort=%d&mediamtxApi=%d"),
+			T3000_NVR_GO2RTC_API_PORT, T3000_NVR_MEDIAMTX_API_PORT);
+		return url;
+	}
+
+	CString OnlineViewUrl(bool mediamtxOk)
+	{
+		CString url;
+		url.Format(
+			_T("http://127.0.0.1:%d/index.html?go2rtc=1&mediamtx=%d&api=http://127.0.0.1:%d&mtx=http://127.0.0.1:%d"),
+			T3000_NVR_GO2RTC_API_PORT,
+			mediamtxOk ? 1 : 0,
+			T3000_NVR_GO2RTC_API_PORT,
+			T3000_NVR_MEDIAMTX_API_PORT);
+		return url;
+	}
+}
+
+CString T3000Nvr_GetConfigDir()
+{
+	PWSTR localApp = NULL;
+	CString dir;
+	if (SUCCEEDED(SHGetKnownFolderPath(FOLDERID_LocalAppData, 0, NULL, &localApp)) && localApp)
+	{
+		dir = CString(localApp) + _T("\\T3000");
+		EnsureDir(dir);
+		dir += _T("\\nvr");
+		EnsureDir(dir);
+		CoTaskMemFree(localApp);
+	}
+	else
+	{
+		dir = ExeDir() + _T("\\nvr-config");
+		EnsureDir(dir);
+	}
+	EnsureDir(dir + _T("\\www"));
+	EnsureDir(dir + _T("\\recordings"));
+	return dir;
+}
+
+CString T3000Nvr_FindSidecarExe(LPCTSTR fileName)
+{
+	const CString exeDir = ExeDir();
+	// Runtime next to T3000.exe first, then the source-tree sidecar folder so a
+	// teammate can drop go2rtc.exe in T3000\sidecar\ without a rebuild.
+	const CString candidates[] = {
+		exeDir + _T("\\sidecar\\") + fileName,
+		exeDir + _T("\\") + fileName,
+		exeDir + _T("\\nvr\\") + fileName,
+		exeDir + _T("\\..\\..\\T3000\\sidecar\\") + fileName,
+		exeDir + _T("\\..\\T3000\\sidecar\\") + fileName,
+	};
+	for (int i = 0; i < 5; ++i)
+	{
+		TCHAR full[MAX_PATH] = { 0 };
+		if (GetFullPathName(candidates[i], MAX_PATH, full, NULL) == 0)
+			continue;
+		if (FileExists(full))
+			return CString(full);
+	}
+	return CString();
+}
+
+T3000NvrLaunchResult T3000Nvr_StartSidecars()
+{
+	T3000NvrLaunchResult r = {};
+	const CString configDir = T3000Nvr_GetConfigDir();
+	CopyUiIntoConfigWww(configDir);
+	WriteGo2rtcYaml(configDir, configDir + _T("\\www"));
+	WriteMediamtxYml(configDir);
+
+	CStringA probe;
+	const bool port9191 = TcpPortOpen(T3000_NVR_GO2RTC_API_PORT, 200);
+	if (port9191)
+	{
+		if (HttpGetLocal(T3000_NVR_GO2RTC_API_PORT, "/api", probe, 800) && LooksLikeGo2rtc(probe))
+		{
+			r.go2rtcOk = true;
+			r.go2rtcAlreadyRunning = true;
+		}
+		else
+		{
+			r.go2rtcPortBusy = true;
+			r.message = _T("Port 127.0.0.1:9191 is in use by another program. Close it or change the T3000 CCTV ports.");
+			r.viewUrl = OfflineViewUrl(r.message);
+			return r;
+		}
+	}
+
+	if (!r.go2rtcOk)
+	{
+		const CString go2rtc = T3000Nvr_FindSidecarExe(_T("go2rtc.exe"));
+		if (go2rtc.IsEmpty())
+		{
+			r.go2rtcMissing = true;
+			r.message.Format(
+				_T("go2rtc.exe was not found. T3000 is running normally.\r\n\r\n")
+				_T("Drop go2rtc.exe here and reopen Tools > CCTV:\r\n")
+				_T("  %s\\sidecar\\go2rtc.exe\r\n")
+				_T("  %s\\go2rtc.exe\r\n")
+				_T("or in the source tree: T3000\\sidecar\\go2rtc.exe\r\n\r\n")
+				_T("Windows zip: https://github.com/AlexxIT/go2rtc/releases/download/v1.9.14/go2rtc_win64.zip\r\n")
+				_T("Step-by-step: DEMO.md"),
+				ExeDir().GetString(), ExeDir().GetString());
+			r.viewUrl = OfflineViewUrl(r.message);
+		}
+		else
+		{
+			CString cmd;
+			cmd.Format(_T("\"%s\" -c \"%s\\go2rtc.yaml\""), go2rtc.GetString(), configDir.GetString());
+			if (!StartHiddenProcess(go2rtc, cmd, configDir, g_go2rtcProcess))
+			{
+				r.message.Format(_T("Failed to start go2rtc.exe (Win32 error %u)."), GetLastError());
+				r.viewUrl = OfflineViewUrl(r.message);
+			}
+			else
+			{
+				g_ownGo2rtc = true;
+				if (WaitForHttp(T3000_NVR_GO2RTC_API_PORT, "/api", 10000))
+				{
+					r.go2rtcOk = true;
+				}
+				else
+				{
+					r.message = _T("go2rtc.exe started but its API on 127.0.0.1:9191 did not become ready.");
+					r.viewUrl = OfflineViewUrl(r.message);
+				}
+			}
+		}
+	}
+
+	const bool port9197 = TcpPortOpen(T3000_NVR_MEDIAMTX_API_PORT, 200);
+	if (port9197)
+	{
+		r.mediamtxOk = true;
+		r.mediamtxAlreadyRunning = true;
+	}
+	else
+	{
+		const CString mtx = T3000Nvr_FindSidecarExe(_T("mediamtx.exe"));
+		if (mtx.IsEmpty())
+		{
+			r.mediamtxMissing = true;
+		}
+		else
+		{
+			CString cmd;
+			cmd.Format(_T("\"%s\" \"%s\\mediamtx.yml\""), mtx.GetString(), configDir.GetString());
+			if (StartHiddenProcess(mtx, cmd, configDir, g_mediamtxProcess))
+			{
+				g_ownMediamtx = true;
+				r.mediamtxOk = WaitForHttp(T3000_NVR_MEDIAMTX_API_PORT, "/v3/config/global/get", 8000)
+					|| TcpPortOpen(T3000_NVR_MEDIAMTX_API_PORT, 200);
+			}
+		}
+	}
+
+	if (r.go2rtcOk)
+	{
+		r.viewUrl = OnlineViewUrl(r.mediamtxOk);
+		if (r.message.IsEmpty())
+		{
+			if (r.go2rtcAlreadyRunning)
+				r.message = _T("Using go2rtc already listening on 127.0.0.1:9191.");
+			else
+				r.message = _T("CCTV sidecar started (go2rtc on 127.0.0.1:9191).");
+			if (r.mediamtxMissing)
+				r.message += _T(" MediaMTX is not installed yet (optional for live view).");
+		}
+	}
+
+	return r;
+}
+
+void T3000Nvr_StopSidecars()
+{
+	CloseOwned(g_go2rtcProcess, g_ownGo2rtc);
+	CloseOwned(g_mediamtxProcess, g_ownMediamtx);
+}
+
+void T3000Nvr_HandleWebMessage(const CString& msg, CString& outmsg)
+{
+	Json::Value json;
+	Json::Reader reader;
+	if (!reader.parse(CStringToUtf8(msg), json, false))
+	{
+		outmsg = _T("{\"type\":\"nvr\",\"ok\":false,\"error\":\"invalid json\"}");
+		return;
+	}
+
+	const std::string cmd = json.get("cmd", "").asString();
+	Json::Value reply;
+	reply["type"] = "nvr";
+	reply["ok"] = true;
+	if (json.isMember("msgId"))
+		reply["msgId"] = json["msgId"];
+
+	if (cmd == "saveCameras")
+	{
+		Json::Value store;
+		store["cameras"] = json["cameras"];
+		Json::StreamWriterBuilder wb;
+		wb["indentation"] = "  ";
+		const std::string raw = Json::writeString(wb, store);
+		if (!WriteTextFile(CamerasJsonPath(), Utf8ToCString(raw)))
+		{
+			reply["ok"] = false;
+			reply["error"] = "failed to write cameras.json";
+		}
+		else
+		{
+			WriteGo2rtcYaml(T3000Nvr_GetConfigDir(), T3000Nvr_GetConfigDir() + _T("\\www"));
+			reply["path"] = CStringToUtf8(CamerasJsonPath());
+		}
+	}
+	else if (cmd == "loadCameras")
+	{
+		const CString text = ReadTextFile(CamerasJsonPath());
+		Json::Value stored;
+		if (!text.IsEmpty())
+			reader.parse(CStringToUtf8(text), stored, false);
+		reply["cameras"] = stored.isMember("cameras") ? stored["cameras"] : Json::Value(Json::arrayValue);
+	}
+	else if (cmd == "status")
+	{
+		CStringA body;
+		reply["go2rtc"] = HttpGetLocal(T3000_NVR_GO2RTC_API_PORT, "/api", body, 500);
+		reply["mediamtx"] = TcpPortOpen(T3000_NVR_MEDIAMTX_API_PORT, 200);
+		reply["go2rtcPort"] = T3000_NVR_GO2RTC_API_PORT;
+		reply["mediamtxPort"] = T3000_NVR_MEDIAMTX_API_PORT;
+		reply["configDir"] = CStringToUtf8(T3000Nvr_GetConfigDir());
+		reply["go2rtcExe"] = CStringToUtf8(T3000Nvr_FindSidecarExe(_T("go2rtc.exe")));
+		reply["mediamtxExe"] = CStringToUtf8(T3000Nvr_FindSidecarExe(_T("mediamtx.exe")));
+	}
+	else
+	{
+		reply["ok"] = false;
+		reply["error"] = "unknown nvr cmd";
+	}
+
+	Json::StreamWriterBuilder wb;
+	wb["indentation"] = "";
+	outmsg = Utf8ToCString(Json::writeString(wb, reply));
+}
diff --git a/T3000/T3000NvrSidecar.h b/T3000/T3000NvrSidecar.h
new file mode 100644
index 00000000..3cdf6532
--- /dev/null
+++ b/T3000/T3000NvrSidecar.h
@@ -0,0 +1,39 @@
+#pragma once
+
+// First-slice ONVIF / live-view NVR hosted as localhost sidecar processes.
+// go2rtc and MediaMTX stay out-of-process (may be 64-bit). Do not LoadLibrary
+// them into 32-bit T3000.exe. They are MIT-licensed; T3000 talks HTTP/WS only.
+//
+// Ports (all 127.0.0.1 — do not collide with Rust API 9103/9104 or Quasar 3003):
+//   go2rtc  HTTP/API/WebUI  9191
+//   go2rtc  RTSP            9192
+//   go2rtc  WebRTC          9193
+//   MediaMTX RTSP           9194
+//   MediaMTX playback       9196
+//   MediaMTX API            9197
+
+#define T3000_NVR_GO2RTC_API_PORT     9191
+#define T3000_NVR_GO2RTC_RTSP_PORT    9192
+#define T3000_NVR_GO2RTC_WEBRTC_PORT  9193
+#define T3000_NVR_MEDIAMTX_RTSP_PORT  9194
+#define T3000_NVR_MEDIAMTX_PLAY_PORT  9196
+#define T3000_NVR_MEDIAMTX_API_PORT   9197
+
+struct T3000NvrLaunchResult
+{
+	bool go2rtcOk;
+	bool go2rtcAlreadyRunning;
+	bool go2rtcMissing;
+	bool go2rtcPortBusy;
+	bool mediamtxOk;
+	bool mediamtxAlreadyRunning;
+	bool mediamtxMissing;
+	CString message;
+	CString viewUrl;
+};
+
+CString T3000Nvr_GetConfigDir();
+CString T3000Nvr_FindSidecarExe(LPCTSTR fileName);
+T3000NvrLaunchResult T3000Nvr_StartSidecars();
+void T3000Nvr_StopSidecars();
+void T3000Nvr_HandleWebMessage(const CString& msg, CString& outmsg);
diff --git a/T3000/T3000_VS2019.vcxproj b/T3000/T3000_VS2019.vcxproj
index b8751ec3..e196a72d 100644
--- a/T3000/T3000_VS2019.vcxproj
+++ b/T3000/T3000_VS2019.vcxproj
@@ -110,7 +110,8 @@
 XCOPY "$(SolutionDir)DLLs\T3WebviewApi\*" "$(TargetDir)" /D /K /Y</Command>
     </PreBuildEvent>
     <PostBuildEvent>
-      <Command>XCOPY "$(ProjectDir)ResourceFile" "$(TargetDir)ResourceFile" /E /C /I /D /Y</Command>
+      <Command>XCOPY "$(ProjectDir)ResourceFile" "$(TargetDir)ResourceFile" /E /C /I /D /Y
+IF EXIST "$(ProjectDir)sidecar\*.exe" XCOPY "$(ProjectDir)sidecar\*.exe" "$(TargetDir)sidecar\" /C /I /D /Y</Command>
     </PostBuildEvent>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
@@ -155,7 +156,8 @@ XCOPY "$(SolutionDir)DLLs\T3WebviewApi\*" "$(TargetDir)" /D /K /Y</Command>
 XCOPY "$(SolutionDir)DLLs\T3WebviewApi\*" "$(TargetDir)" /D /K /Y</Command>
     </PreBuildEvent>
     <PostBuildEvent>
-      <Command>XCOPY "$(ProjectDir)ResourceFile" "$(TargetDir)ResourceFile" /E /C /I /D /Y</Command>
+      <Command>XCOPY "$(ProjectDir)ResourceFile" "$(TargetDir)ResourceFile" /E /C /I /D /Y
+IF EXIST "$(ProjectDir)sidecar\*.exe" XCOPY "$(ProjectDir)sidecar\*.exe" "$(TargetDir)sidecar\" /C /I /D /Y</Command>
     </PostBuildEvent>
   </ItemDefinitionGroup>
   <ItemGroup>
@@ -232,6 +234,7 @@ XCOPY "$(SolutionDir)DLLs\T3WebviewApi\*" "$(TargetDir)" /D /K /Y</Command>
       <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">NotUsing</PrecompiledHeader>
     </ClCompile>
     <ClCompile Include="BacnetWebView_Exports.cpp" />
+    <ClCompile Include="T3000NvrSidecar.cpp" />
     <ClCompile Include="BacnetWeeklyRoutine.cpp" />
     <ClCompile Include="Bacnet_Range_Msv.cpp" />
     <ClCompile Include="BADO\BADO.cpp" />
@@ -455,6 +458,7 @@ XCOPY "$(SolutionDir)DLLs\T3WebviewApi\*" "$(TargetDir)" /D /K /Y</Command>
     </None>
     <None Include="packages.config" />
     <None Include="ResourceFile\DeviceDatabase.mdb" />
+    <None Include="ResourceFile\nvr\index.html" />
     <None Include="res\AlarmsBrown.bmp" />
     <None Include="res\AlarmsGreen.bmp" />
     <None Include="res\AlarmsRed.bmp" />
@@ -623,6 +627,7 @@ XCOPY "$(SolutionDir)DLLs\T3WebviewApi\*" "$(TargetDir)" /D /K /Y</Command>
     <ClInclude Include="BacnetWebView.h" />
     <ClInclude Include="BacnetWebViewDropTarget.h" />
     <ClInclude Include="BacnetWebViewToolBar.h" />
+    <ClInclude Include="T3000NvrSidecar.h" />
     <ClInclude Include="Bacnet_Include.h" />
     <ClInclude Include="Bacnet_Range_Msv.h" />
     <ClInclude Include="BADO\BADO.h" />
diff --git a/T3000/T3000_VS2019.vcxproj.filters b/T3000/T3000_VS2019.vcxproj.filters
index 5ecb61c2..2eb187c8 100644
--- a/T3000/T3000_VS2019.vcxproj.filters
+++ b/T3000/T3000_VS2019.vcxproj.filters
@@ -867,6 +867,9 @@
     <ClCompile Include="BacnetWebView_Exports.cpp">
       <Filter>Source Files\WebView</Filter>
     </ClCompile>
+    <ClCompile Include="T3000NvrSidecar.cpp">
+      <Filter>Source Files\WebView</Filter>
+    </ClCompile>
     <ClCompile Include="BacnetPvar.cpp">
       <Filter>Bacnet</Filter>
     </ClCompile>
@@ -2117,6 +2120,9 @@
     <ClInclude Include="BacnetWebViewToolBar.h">
       <Filter>Header Files\Webview</Filter>
     </ClInclude>
+    <ClInclude Include="T3000NvrSidecar.h">
+      <Filter>Header Files\Webview</Filter>
+    </ClInclude>
     <ClInclude Include="Json-cpp\dist\json\json.h">
       <Filter>Header Files\JsonCpp</Filter>
     </ClInclude>
diff --git a/T3000/resource.h b/T3000/resource.h
index 097ba7fd..920fda58 100644
--- a/T3000/resource.h
+++ b/T3000/resource.h
@@ -3381,6 +3381,7 @@
 #define ID_THIRD_LIST_AND               34088
 #define ID_TOOLS_LOGINMYACCOUNT         34089
 #define ID_TOOLS_WEBVIEW34090           34090
+#define ID_TOOLS_CAMERAS                34093
 #define ID_RENUMBER                     34091
 #define ID_CONTROL_PVAR                 34092
 #define ID_HELP_USING_UPDATE            34904
diff --git a/T3000/sidecar/.gitignore b/T3000/sidecar/.gitignore
new file mode 100644
index 00000000..a844370f
--- /dev/null
+++ b/T3000/sidecar/.gitignore
@@ -0,0 +1,8 @@
+# Downloaded sidecar binaries — do not vendor
+*.exe
+*.zip
+*.yml
+*.yaml
+!NOTICE.txt
+!.gitignore
+!README.txt
diff --git a/T3000/sidecar/NOTICE.txt b/T3000/sidecar/NOTICE.txt
new file mode 100644
index 00000000..3527a862
--- /dev/null
+++ b/T3000/sidecar/NOTICE.txt
@@ -0,0 +1,40 @@
+T3000 CCTV sidecars
+===================
+
+This folder is for optional MIT-licensed companion processes. They are not
+linked into T3000.exe or t3_webview_api.dll.
+
+go2rtc
+------
+https://github.com/AlexxIT/go2rtc
+Copyright (c) AlexxIT and contributors
+License: MIT
+
+MediaMTX
+--------
+https://github.com/bluenviron/mediamtx
+Copyright (c) MediaMTX / bluenviron contributors
+License: MIT
+
+Place go2rtc.exe and mediamtx.exe here (see tools/fetch-nvr-sidecars.ps1).
+Do not commit the binaries.
+
+The MIT license text (both projects):
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/T3000/sidecar/README.txt b/T3000/sidecar/README.txt
new file mode 100644
index 00000000..24eaa65f
--- /dev/null
+++ b/T3000/sidecar/README.txt
@@ -0,0 +1,16 @@
+T3000 CCTV sidecar binaries
+===========================
+
+Windows teammate demo (no installer, no merge): see DEMO.md at the repo root. Open Tools → CCTV.
+
+Drop go2rtc.exe here (and optionally mediamtx.exe). Official zips:
+
+  https://github.com/AlexxIT/go2rtc/releases/download/v1.9.14/go2rtc_win64.zip
+  https://github.com/bluenviron/mediamtx/releases/download/v1.20.1/mediamtx_v1.20.1_windows_amd64.zip
+
+Or:
+
+  powershell -ExecutionPolicy Bypass -File ..\..\tools\fetch-nvr-sidecars.ps1
+
+Then either rebuild, or copy the exes next to T3000.exe / T3000 Output\release\sidecar\.
+Do not commit the .exe files.
diff --git a/tools/fetch-nvr-sidecars.ps1 b/tools/fetch-nvr-sidecars.ps1
new file mode 100644
index 00000000..205c1964
--- /dev/null
+++ b/tools/fetch-nvr-sidecars.ps1
@@ -0,0 +1,49 @@
+# Download MIT-licensed CCTV sidecars for T3000 (not committed to git).
+# Usage:
+#   powershell -ExecutionPolicy Bypass -File tools\fetch-nvr-sidecars.ps1
+#   powershell -ExecutionPolicy Bypass -File tools\fetch-nvr-sidecars.ps1 -OutDir "T3000 Output\release\sidecar"
+
+[CmdletBinding()]
+param(
+    [string]$OutDir = "",
+    [string]$Go2rtcVersion = "1.9.14",
+    [string]$MediamtxVersion = "1.20.1"
+)
+
+$ErrorActionPreference = "Stop"
+
+if (-not $OutDir) {
+    $repoRoot = Split-Path -Parent $PSScriptRoot
+    $OutDir = Join-Path $repoRoot "T3000\sidecar"
+}
+
+New-Item -ItemType Directory -Force -Path $OutDir | Out-Null
+$tmp = Join-Path $env:TEMP ("t3000-nvr-" + [guid]::NewGuid().ToString("N"))
+New-Item -ItemType Directory -Force -Path $tmp | Out-Null
+
+try {
+    $go2rtcZip = Join-Path $tmp "go2rtc_win64.zip"
+    $go2rtcUrl = "https://github.com/AlexxIT/go2rtc/releases/download/v$Go2rtcVersion/go2rtc_win64.zip"
+    Write-Host "Downloading $go2rtcUrl"
+    Invoke-WebRequest -Uri $go2rtcUrl -OutFile $go2rtcZip -UseBasicParsing
+    Expand-Archive -Path $go2rtcZip -DestinationPath $tmp -Force
+    $go2rtcExe = Get-ChildItem $tmp -Recurse -Filter "go2rtc.exe" | Select-Object -First 1
+    if (-not $go2rtcExe) { throw "go2rtc.exe not found in zip" }
+    Copy-Item $go2rtcExe.FullName (Join-Path $OutDir "go2rtc.exe") -Force
+    Write-Host "Wrote $(Join-Path $OutDir 'go2rtc.exe')"
+
+    $mtxZip = Join-Path $tmp "mediamtx.zip"
+    $mtxUrl = "https://github.com/bluenviron/mediamtx/releases/download/v$MediamtxVersion/mediamtx_v${MediamtxVersion}_windows_amd64.zip"
+    Write-Host "Downloading $mtxUrl"
+    Invoke-WebRequest -Uri $mtxUrl -OutFile $mtxZip -UseBasicParsing
+    Expand-Archive -Path $mtxZip -DestinationPath (Join-Path $tmp "mtx") -Force
+    $mtxExe = Get-ChildItem (Join-Path $tmp "mtx") -Recurse -Filter "mediamtx.exe" | Select-Object -First 1
+    if (-not $mtxExe) { throw "mediamtx.exe not found in zip" }
+    Copy-Item $mtxExe.FullName (Join-Path $OutDir "mediamtx.exe") -Force
+    Write-Host "Wrote $(Join-Path $OutDir 'mediamtx.exe')"
+}
+finally {
+    Remove-Item -Recurse -Force $tmp -ErrorAction SilentlyContinue
+}
+
+Write-Host "Sidecars are MIT-licensed separate processes. See T3000\sidecar\NOTICE.txt and Documentation\nvr.md."